@vorionsys/proof-plane 0.1.0

package/dist/events/event-signatures.js

@@ -0,0 +1,302 @@
+/**
+ * Event Signatures - Ed25519 Digital Signatures for Proof Events
+ *
+ * Provides cryptographic signing and verification for proof events,
+ * ensuring authenticity and non-repudiation in the audit trail.
+ *
+ * Uses Ed25519 (EdDSA) which provides:
+ * - 128-bit security level
+ * - Small signatures (64 bytes)
+ * - Fast signing and verification
+ * - Deterministic signatures (no random nonce needed)
+ */
+/**
+ * Recursively sort object keys for deterministic serialization
+ */
+function sortObjectKeys(obj) {
+    if (obj === null || typeof obj !== 'object') {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(sortObjectKeys);
+    }
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+        sorted[key] = sortObjectKeys(obj[key]);
+    }
+    return sorted;
+}
+/**
+ * Create the signable representation of an event
+ */
+function getSignableData(event, signedBy) {
+    return {
+        eventId: event.eventId,
+        eventType: event.eventType,
+        correlationId: event.correlationId,
+        agentId: event.agentId,
+        payload: event.payload,
+        previousHash: event.previousHash,
+        occurredAt: event.occurredAt instanceof Date
+            ? event.occurredAt.toISOString()
+            : event.occurredAt,
+        signedBy,
+    };
+}
+/**
+ * Serialize data for signing/verification
+ */
+function serializeForSigning(data) {
+    const sorted = sortObjectKeys(data);
+    return JSON.stringify(sorted);
+}
+/**
+ * Convert ArrayBuffer to base64 string
+ */
+function arrayBufferToBase64(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+/**
+ * Convert base64 string to Uint8Array
+ */
+function base64ToUint8Array(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Generate a new Ed25519 signing key pair
+ */
+export async function generateSigningKeyPair(owner) {
+    const keyPair = await crypto.subtle.generateKey({
+        name: 'Ed25519',
+    }, true, // extractable
+    ['sign', 'verify']);
+    const publicKeyBuffer = await crypto.subtle.exportKey('raw', keyPair.publicKey);
+    const privateKeyBuffer = await crypto.subtle.exportKey('pkcs8', keyPair.privateKey);
+    const keyId = `ed25519-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    return {
+        publicKey: arrayBufferToBase64(publicKeyBuffer),
+        privateKey: arrayBufferToBase64(privateKeyBuffer),
+        keyId,
+        createdAt: new Date(),
+        owner,
+    };
+}
+/**
+ * Import a private key from base64 for signing
+ */
+async function importPrivateKey(privateKeyBase64) {
+    const keyData = base64ToUint8Array(privateKeyBase64);
+    return crypto.subtle.importKey('pkcs8', keyData, { name: 'Ed25519' }, false, ['sign']);
+}
+/**
+ * Import a public key from base64 for verification
+ */
+async function importPublicKey(publicKeyBase64) {
+    const keyData = base64ToUint8Array(publicKeyBase64);
+    return crypto.subtle.importKey('raw', keyData, { name: 'Ed25519' }, false, ['verify']);
+}
+/**
+ * Sign an event using Ed25519
+ */
+export async function signEvent(event, privateKeyBase64, signedBy) {
+    const signableData = getSignableData(event, signedBy);
+    const serialized = serializeForSigning(signableData);
+    const encoder = new TextEncoder();
+    const data = encoder.encode(serialized);
+    const privateKey = await importPrivateKey(privateKeyBase64);
+    const signatureBuffer = await crypto.subtle.sign({ name: 'Ed25519' }, privateKey, data);
+    return arrayBufferToBase64(signatureBuffer);
+}
+/**
+ * Verify an event signature using Ed25519
+ */
+export async function verifyEventSignature(event, publicKeyBase64) {
+    const verifiedAt = new Date();
+    if (!event.signature) {
+        return {
+            valid: false,
+            signer: event.signedBy,
+            error: 'Event has no signature',
+            verifiedAt,
+        };
+    }
+    if (!event.signedBy) {
+        return {
+            valid: false,
+            error: 'Event has no signedBy field',
+            verifiedAt,
+        };
+    }
+    try {
+        const signableData = getSignableData(event, event.signedBy);
+        const serialized = serializeForSigning(signableData);
+        const encoder = new TextEncoder();
+        const data = encoder.encode(serialized);
+        const publicKey = await importPublicKey(publicKeyBase64);
+        const signatureBytes = base64ToUint8Array(event.signature);
+        const isValid = await crypto.subtle.verify({ name: 'Ed25519' }, publicKey, signatureBytes, data);
+        return {
+            valid: isValid,
+            signer: event.signedBy,
+            verifiedAt,
+            error: isValid ? undefined : 'Signature verification failed',
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            signer: event.signedBy,
+            error: `Verification error: ${error instanceof Error ? error.message : String(error)}`,
+            verifiedAt,
+        };
+    }
+}
+/**
+ * Event Signing Service - Manages signing keys and operations
+ */
+export class EventSigningService {
+    serviceId;
+    privateKey;
+    keyId;
+    trustedKeys;
+    constructor(config) {
+        this.serviceId = config.serviceId;
+        this.privateKey = config.privateKey;
+        this.keyId = config.keyId;
+        this.trustedKeys = new Map();
+        // Add trusted keys
+        for (const key of config.trustedKeys ?? []) {
+            this.trustedKeys.set(key.owner, key);
+        }
+    }
+    /**
+     * Check if this service can sign events
+     */
+    canSign() {
+        return this.privateKey !== undefined;
+    }
+    /**
+     * Get the service ID (used in signedBy field)
+     */
+    getServiceId() {
+        return this.serviceId;
+    }
+    /**
+     * Get the key ID
+     */
+    getKeyId() {
+        return this.keyId;
+    }
+    /**
+     * Sign an event
+     */
+    async sign(event) {
+        if (!this.privateKey) {
+            throw new Error('Signing service has no private key configured');
+        }
+        return signEvent(event, this.privateKey, this.serviceId);
+    }
+    /**
+     * Verify an event signature
+     */
+    async verify(event) {
+        if (!event.signedBy) {
+            return {
+                valid: false,
+                error: 'Event has no signedBy field',
+                verifiedAt: new Date(),
+            };
+        }
+        // Find the public key for the signer
+        const trustedKey = this.trustedKeys.get(event.signedBy);
+        if (!trustedKey) {
+            return {
+                valid: false,
+                signer: event.signedBy,
+                error: `No trusted key found for signer: ${event.signedBy}`,
+                verifiedAt: new Date(),
+            };
+        }
+        return verifyEventSignature(event, trustedKey.publicKey);
+    }
+    /**
+     * Add a trusted public key
+     */
+    addTrustedKey(key) {
+        this.trustedKeys.set(key.owner, key);
+    }
+    /**
+     * Remove a trusted public key
+     */
+    removeTrustedKey(owner) {
+        return this.trustedKeys.delete(owner);
+    }
+    /**
+     * Get all trusted keys
+     */
+    getTrustedKeys() {
+        return Array.from(this.trustedKeys.values());
+    }
+    /**
+     * Check if a signer is trusted
+     */
+    isTrusted(signer) {
+        return this.trustedKeys.has(signer);
+    }
+}
+/**
+ * Create an event signing service
+ */
+export function createSigningService(config) {
+    return new EventSigningService(config);
+}
+/**
+ * Verify signatures for a batch of events
+ */
+export async function verifyEventSignatures(events, signingService) {
+    const results = [];
+    let validCount = 0;
+    let invalidCount = 0;
+    let unsignedCount = 0;
+    for (const event of events) {
+        if (!event.signature) {
+            unsignedCount++;
+            results.push({
+                eventId: event.eventId,
+                result: {
+                    valid: false,
+                    error: 'Event is unsigned',
+                    verifiedAt: new Date(),
+                },
+            });
+            continue;
+        }
+        const result = await signingService.verify(event);
+        results.push({ eventId: event.eventId, result });
+        if (result.valid) {
+            validCount++;
+        }
+        else {
+            invalidCount++;
+        }
+    }
+    return {
+        totalEvents: events.length,
+        validCount,
+        invalidCount,
+        unsignedCount,
+        results,
+        success: invalidCount === 0 && (unsignedCount === 0 || events.length === 0),
+    };
+}
+//# sourceMappingURL=event-signatures.js.map

package/dist/events/event-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-signatures.js","sourceRoot":"","sources":["../../src/events/event-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6EH;;GAEG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAE,GAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,KAAiE,EACjE,QAAgB;IAEhB,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU,YAAY,IAAI;YAC1C,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;YAChC,CAAC,CAAC,KAAK,CAAC,UAAU;QACpB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAuB;IAClD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB;IAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACxD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC7C;QACE,IAAI,EAAE,SAAS;KAChB,EACD,IAAI,EAAE,cAAc;IACpB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACwG,CAAC;IAE7H,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpF,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAEhF,OAAO;QACL,SAAS,EAAE,mBAAmB,CAAC,eAAe,CAAC;QAC/C,UAAU,EAAE,mBAAmB,CAAC,gBAAgB,CAAC;QACjD,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,gBAAwB;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,OAAO,EACP,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,eAAuB;IACpD,MAAM,OAAO,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAiE,EACjE,gBAAwB,EACxB,QAAgB;IAEhB,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAC9C,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,UAAU,EACV,IAAI,CACL,CAAC;IAEF,OAAO,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAiB,EACjB,eAAuB;IAEvB,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,KAAK,CAAC,QAAQ;YACtB,KAAK,EAAE,wBAAwB;YAC/B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6BAA6B;YACpC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,cAAc,EACd,IAAI,CACL,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK,CAAC,QAAQ;YACtB,UAAU;YACV,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC7D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,KAAK,CAAC,QAAQ;YACtB,KAAK,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACtF,UAAU;SACX,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,SAAS,CAAS;IAClB,UAAU,CAAU;IACpB,KAAK,CAAU;IACf,WAAW,CAAyB;IAErD,YAAY,MAA4B;QACtC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;QAE7B,mBAAmB;QACnB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,KAAiE;QAEjE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,6BAA6B;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,QAAQ;gBACtB,KAAK,EAAE,oCAAoC,KAAK,CAAC,QAAQ,EAAE;gBAC3D,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC;QACJ,CAAC;QAED,OAAO,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,GAAc;QAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAc;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAuBD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAoB,EACpB,cAAmC;IAEnC,MAAM,OAAO,GAAoE,EAAE,CAAC;IACpF,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,aAAa,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,mBAAmB;oBAC1B,UAAU,EAAE,IAAI,IAAI,EAAE;iBACvB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAEjD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,UAAU,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,UAAU;QACV,YAAY;QACZ,aAAa;QACb,OAAO;QACP,OAAO,EAAE,YAAY,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;KAC5E,CAAC;AACJ,CAAC"}

package/dist/events/event-store.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Event Store - Abstract storage interface for proof events
+ *
+ * Implementations can use in-memory storage (for testing),
+ * or persistent stores (PostgreSQL, Supabase, etc.).
+ */
+import type { ProofEvent, ProofEventFilter, ProofEventSummary, ProofEventType, ShadowModeStatus } from '@vorion/contracts';
+/**
+ * Query options for event retrieval
+ */
+export interface EventQueryOptions {
+    /** Maximum number of events to return */
+    limit?: number;
+    /** Number of events to skip */
+    offset?: number;
+    /** Sort order (default: ascending by occurredAt) */
+    order?: 'asc' | 'desc';
+    /** Include event payload in results */
+    includePayload?: boolean;
+    /**
+     * Filter by shadow mode status
+     *
+     * If provided, only events matching these statuses are returned.
+     * Useful for querying unverified sandbox events:
+     *   shadowModeOnly: ['shadow', 'testnet']
+     */
+    shadowModeOnly?: ShadowModeStatus[];
+    /**
+     * Exclude shadow mode events (production only)
+     *
+     * If true, only production events (no shadowMode or shadowMode='production')
+     * are returned. Used when calculating official trust scores.
+     *
+     * @default false
+     */
+    excludeShadow?: boolean;
+}
+/**
+ * Result of an event query
+ */
+export interface EventQueryResult {
+    /** Retrieved events */
+    events: ProofEvent[];
+    /** Total count matching filter (before pagination) */
+    totalCount: number;
+    /** Whether there are more results */
+    hasMore: boolean;
+}
+/**
+ * Event statistics
+ */
+export interface EventStats {
+    /** Total number of events */
+    totalEvents: number;
+    /** Events by type */
+    byType: Record<string, number>;
+    /** Events by agent */
+    byAgent: Record<string, number>;
+    /** Oldest event timestamp */
+    oldestEvent?: Date;
+    /** Newest event timestamp */
+    newestEvent?: Date;
+    /**
+     * Events by shadow mode status
+     * Tracks how many events are pending HITL verification
+     */
+    byShadowMode?: Record<ShadowModeStatus | 'production', number>;
+}
+/**
+ * Abstract interface for proof event storage
+ */
+export interface ProofEventStore {
+    /**
+     * Append an event to the store
+     * Returns the stored event with recorded timestamp
+     */
+    append(event: ProofEvent): Promise<ProofEvent>;
+    /**
+     * Get an event by its ID
+     */
+    get(eventId: string): Promise<ProofEvent | null>;
+    /**
+     * Get the latest event in the chain
+     */
+    getLatest(): Promise<ProofEvent | null>;
+    /**
+     * Get the latest hash (for chaining new events)
+     */
+    getLatestHash(): Promise<string | null>;
+    /**
+     * Query events with filters
+     */
+    query(filter?: ProofEventFilter, options?: EventQueryOptions): Promise<EventQueryResult>;
+    /**
+     * Get events by correlation ID (for tracing a request)
+     */
+    getByCorrelationId(correlationId: string, options?: EventQueryOptions): Promise<ProofEvent[]>;
+    /**
+     * Get events by agent ID
+     */
+    getByAgentId(agentId: string, options?: EventQueryOptions): Promise<ProofEvent[]>;
+    /**
+     * Get events in a time range
+     */
+    getByTimeRange(from: Date, to: Date, options?: EventQueryOptions): Promise<ProofEvent[]>;
+    /**
+     * Get events by type
+     */
+    getByType(eventType: ProofEventType, options?: EventQueryOptions): Promise<ProofEvent[]>;
+    /**
+     * Get event summaries (lightweight list without payloads)
+     */
+    getSummaries(filter?: ProofEventFilter, options?: EventQueryOptions): Promise<ProofEventSummary[]>;
+    /**
+     * Get the chain of events from a starting point
+     * Returns events in order for chain verification
+     */
+    getChain(fromEventId?: string, limit?: number): Promise<ProofEvent[]>;
+    /**
+     * Get event count
+     */
+    count(filter?: ProofEventFilter): Promise<number>;
+    /**
+     * Get event statistics
+     */
+    getStats(): Promise<EventStats>;
+    /**
+     * Check if an event exists
+     */
+    exists(eventId: string): Promise<boolean>;
+    /**
+     * Clear all events (for testing only)
+     */
+    clear(): Promise<void>;
+}
+/**
+ * Error thrown when event storage fails
+ */
+export declare class EventStoreError extends Error {
+    readonly code: EventStoreErrorCode;
+    readonly eventId?: string | undefined;
+    constructor(message: string, code: EventStoreErrorCode, eventId?: string | undefined);
+}
+/**
+ * Event store error codes
+ */
+export declare enum EventStoreErrorCode {
+    /** Event already exists (duplicate ID) */
+    DUPLICATE_EVENT = "DUPLICATE_EVENT",
+    /** Event not found */
+    NOT_FOUND = "NOT_FOUND",
+    /** Invalid event data */
+    INVALID_EVENT = "INVALID_EVENT",
+    /** Chain integrity error */
+    CHAIN_INTEGRITY = "CHAIN_INTEGRITY",
+    /** Storage error */
+    STORAGE_ERROR = "STORAGE_ERROR"
+}
+//# sourceMappingURL=event-store.d.ts.map

package/dist/events/event-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-store.d.ts","sourceRoot":"","sources":["../../src/events/event-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,6BAA6B;IAC7B,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,gBAAgB,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC;CAChE;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/C;;OAEG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAEjD;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAExC;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAExC;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEzF;;OAEG;IACH,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAE9F;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAElF;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzF;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzF;;OAEG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEnG;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEtE;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAElD;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,IAAI,EAAE,mBAAmB;aACzB,OAAO,CAAC,EAAE,MAAM;gBAFhC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,MAAM,YAAA;CAKnC;AAED;;GAEG;AACH,oBAAY,mBAAmB;IAC7B,0CAA0C;IAC1C,eAAe,oBAAoB;IACnC,sBAAsB;IACtB,SAAS,cAAc;IACvB,yBAAyB;IACzB,aAAa,kBAAkB;IAC/B,4BAA4B;IAC5B,eAAe,oBAAoB;IACnC,oBAAoB;IACpB,aAAa,kBAAkB;CAChC"}

package/dist/events/event-store.js

@@ -0,0 +1,36 @@
+/**
+ * Event Store - Abstract storage interface for proof events
+ *
+ * Implementations can use in-memory storage (for testing),
+ * or persistent stores (PostgreSQL, Supabase, etc.).
+ */
+/**
+ * Error thrown when event storage fails
+ */
+export class EventStoreError extends Error {
+    code;
+    eventId;
+    constructor(message, code, eventId) {
+        super(message);
+        this.code = code;
+        this.eventId = eventId;
+        this.name = 'EventStoreError';
+    }
+}
+/**
+ * Event store error codes
+ */
+export var EventStoreErrorCode;
+(function (EventStoreErrorCode) {
+    /** Event already exists (duplicate ID) */
+    EventStoreErrorCode["DUPLICATE_EVENT"] = "DUPLICATE_EVENT";
+    /** Event not found */
+    EventStoreErrorCode["NOT_FOUND"] = "NOT_FOUND";
+    /** Invalid event data */
+    EventStoreErrorCode["INVALID_EVENT"] = "INVALID_EVENT";
+    /** Chain integrity error */
+    EventStoreErrorCode["CHAIN_INTEGRITY"] = "CHAIN_INTEGRITY";
+    /** Storage error */
+    EventStoreErrorCode["STORAGE_ERROR"] = "STORAGE_ERROR";
+})(EventStoreErrorCode || (EventStoreErrorCode = {}));
+//# sourceMappingURL=event-store.js.map

package/dist/events/event-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-store.js","sourceRoot":"","sources":["../../src/events/event-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4JH;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,IAAyB,EACzB,OAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAqB;QACzB,YAAO,GAAP,OAAO,CAAS;QAGhC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,mBAWX;AAXD,WAAY,mBAAmB;IAC7B,0CAA0C;IAC1C,0DAAmC,CAAA;IACnC,sBAAsB;IACtB,8CAAuB,CAAA;IACvB,yBAAyB;IACzB,sDAA+B,CAAA;IAC/B,4BAA4B;IAC5B,0DAAmC,CAAA;IACnC,oBAAoB;IACpB,sDAA+B,CAAA;AACjC,CAAC,EAXW,mBAAmB,KAAnB,mBAAmB,QAW9B"}

package/dist/events/hash-chain.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Hash Chain Utilities - Cryptographic hash chain for tamper detection
+ *
+ * Each proof event contains a hash of its contents and a reference
+ * to the previous event's hash, forming an immutable chain.
+ */
+import type { ProofEvent } from '@vorion/contracts';
+/**
+ * Create a SHA-256 hash of the given data
+ */
+export declare function sha256(data: string): Promise<string>;
+/**
+ * Compute the hash of an event's content
+ */
+export declare function computeEventHash(event: Omit<ProofEvent, 'eventHash' | 'recordedAt'>): Promise<string>;
+/**
+ * Verify that an event's hash is correct
+ */
+export declare function verifyEventHash(event: ProofEvent): Promise<boolean>;
+/**
+ * Verify that an event correctly chains to the previous event
+ */
+export declare function verifyChainLink(event: ProofEvent, previousEvent: ProofEvent | null): boolean;
+/**
+ * Verify an entire chain of events
+ */
+export declare function verifyChain(events: ProofEvent[]): Promise<{
+    valid: boolean;
+    verifiedCount: number;
+    brokenAtIndex?: number;
+    brokenAtEventId?: string;
+    error?: string;
+}>;
+/**
+ * Create a genesis hash for the first event in a chain
+ */
+export declare function getGenesisHash(): null;
+/**
+ * Result of chain verification with detailed info
+ */
+export interface ChainVerificationResult {
+    /** Is the chain valid? */
+    valid: boolean;
+    /** Number of events successfully verified */
+    verifiedCount: number;
+    /** Total events in chain */
+    totalEvents: number;
+    /** First event ID in chain */
+    firstEventId?: string;
+    /** Last event ID in chain */
+    lastEventId?: string;
+    /** Event ID where chain broke (if invalid) */
+    brokenAtEventId?: string;
+    /** Index where chain broke */
+    brokenAtIndex?: number;
+    /** Error description */
+    error?: string;
+}
+/**
+ * Verify a chain and return detailed results
+ */
+export declare function verifyChainWithDetails(events: ProofEvent[]): Promise<ChainVerificationResult>;
+//# sourceMappingURL=hash-chain.d.ts.map

package/dist/events/hash-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-chain.d.ts","sourceRoot":"","sources":["../../src/events/hash-chain.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,mBAAmB,CAAC;AAEvE;;GAEG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1D;AAsDD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,YAAY,CAAC,GAClD,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAGzE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAM5F;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAoCD;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,0BAA0B;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC;IACtB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAanG"}