raz-encrypt 2.1.0 → 2.3.0

package/dist/identity.js

@@ -1,34 +1,9 @@
 import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { generateClassicalKeypair, isValidClassicalKeypairShape } from "./crypto/classical.js";
-import { signCore } from "./crypto/hybrid.js";
-import { decryptFileWithFormat, DecryptionFailedError, encryptToFile, upgradeLegacyFile } from "./fileCrypto.js";
-import { assertAcceptablePassphrase, MIN_PASSPHRASE_LENGTH, normalizePassphrase } from "./passphrase.js";
-import { generatePqcKemKeypair, generatePqcSignKeypair, isValidPqcKemKeypairShape, isValidPqcSignKeypairShape, } from "./crypto/pqc.js";
-function isHex(value) {
-    return typeof value === "string" && value.length % 2 === 0 && /^[0-9a-f]*$/i.test(value);
-}
-function isValidKeypairShape(value) {
-    if (typeof value !== "object" || value === null)
-        return false;
-    const v = value;
-    return isHex(v.publicKey) && isHex(v.secretKey);
-}
-/**
- * Structural shape check for a decrypted identity file's plaintext. In
- * normal operation AEAD authentication already guarantees this shape, so a
- * malformed value here would mean a wrong/corrupted ciphertext slipped past
- * decryption (practically impossible without the passphrase) — this exists
- * so that case fails closed with DecryptionFailedError instead of crashing
- * on a missing/non-hex field (found by fuzzing, issue #42).
- */
-function isValidSerializedIdentityShape(data) {
-    if (typeof data !== "object" || data === null)
-        return false;
-    const d = data;
-    return typeof d.alias === "string" && isValidKeypairShape(d.classical) && isValidKeypairShape(d.pqcSign) && isValidKeypairShape(d.pqcKem);
-}
+import { generateClassicalKeypair } from "./crypto/classical.js";
+import { decryptFromFile, encryptToFile } from "./fileCrypto.js";
+import { generatePqcKemKeypair, generatePqcSignKeypair } from "./crypto/pqc.js";
 function identityFilePath(storageDir) {
     return join(storageDir, "identity.enc.json");
 }
@@ -67,28 +42,20 @@ function deserialize(storageDir, data) {
         },
     };
 }
-export { MIN_PASSPHRASE_LENGTH };
+export const MIN_PASSPHRASE_LENGTH = 12;
 /**
  * Generates a new hybrid classical+post-quantum identity (one ECDSA/ECDH-P384
  * keypair, one ML-DSA-87 signing keypair, one ML-KEM-1024 key-exchange
  * keypair) and persists it encrypted-at-rest under `storageDir`.
  *
- * The passphrase is normalized to Unicode NFKC, must be at least
- * MIN_PASSPHRASE_LENGTH characters (counted as code points after
- * normalization), must not be a single repeated character, and must not be
- * on a small blocklist of very common passphrases (ADR 0017). These checks
- * only apply here, not to loadIdentity, so an identity created before they
- * existed can still be loaded with its original passphrase.
- *
- * `options.checkPassphrase`, if supplied, runs after all of the above pass
- * (ADR 0021) — this is where real breach-corpus checking belongs, not in
- * this library's own, deliberately small, blocklist.
+ * Requires a passphrase of at least MIN_PASSPHRASE_LENGTH characters — this
+ * check only applies here, not to loadIdentity, so an identity created
+ * before this check existed can still be loaded with its original passphrase.
  */
 export async function createIdentity(options) {
-    const passphrase = normalizePassphrase(options.passphrase);
-    assertAcceptablePassphrase(passphrase);
-    if (options.checkPassphrase)
-        await options.checkPassphrase(passphrase);
+    if (options.passphrase.length < MIN_PASSPHRASE_LENGTH) {
+        throw new Error(`Passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters long.`);
+    }
     const filePath = identityFilePath(options.storageDir);
     if (!options.overwrite && existsSync(filePath)) {
         throw new Error(`An identity already exists at ${filePath}. Pass { overwrite: true } to replace it.`);
@@ -100,67 +67,14 @@ export async function createIdentity(options) {
         pqcSign: generatePqcSignKeypair(),
         pqcKem: generatePqcKemKeypair(),
     };
-    await encryptToFile(filePath, passphrase, serialize(identity));
+    await encryptToFile(filePath, options.passphrase, serialize(identity));
     return identity;
 }
 /** Loads a previously-created identity back from disk. */
 export async function loadIdentity(options) {
-    const filePath = identityFilePath(options.storageDir);
-    const normalized = normalizePassphrase(options.passphrase);
-    // Normalized form first; the raw form only matters for a file written
-    // before normalization existed under a passphrase NFKC would change.
-    const candidates = normalized === options.passphrase ? [normalized] : [normalized, options.passphrase];
-    const { data, legacy, passphraseIndex } = await decryptFileWithFormat(filePath, candidates);
-    if (!isValidSerializedIdentityShape(data))
-        throw new DecryptionFailedError();
-    if (legacy || passphraseIndex > 0) {
-        // Upgrade a pre-versioned file (and/or re-key one made under an
-        // un-normalized passphrase) to the current format under the normalized
-        // passphrase now that the passphrase is proven correct. Best effort: a
-        // read-only directory or a full disk must not stop the identity from
-        // loading.
-        try {
-            await upgradeLegacyFile(filePath, normalized, data);
-        }
-        catch {
-            // The original file is untouched (see upgradeLegacyFile); try again on the next load.
-        }
-    }
+    const data = await decryptFromFile(identityFilePath(options.storageDir), options.passphrase);
     return deserialize(options.storageDir, data);
 }
-/**
- * Builds an Identity from a caller-supplied KeyStore instead of a
- * passphrase-encrypted file — `identity.enc.json` and a passphrase are
- * never part of the picture. The returned key material's shape (byte
- * lengths) is validated before trusting it, so a buggy KeyStore fails
- * clearly here rather than with a cryptic error the first time a signing
- * call happens to touch the bad bytes. `storageDir` is still required: the
- * trust store and audit log are a separate concern from where secret keys
- * live, unaffected by this function.
- */
-export async function loadIdentityFromKeyStore(options) {
-    const { classical, pqcSign, pqcKem } = await options.keyStore.load();
-    if (!isValidClassicalKeypairShape(classical))
-        throw new Error("KeyStore returned a classical keypair with the wrong byte length(s) for P-384.");
-    if (!isValidPqcSignKeypairShape(pqcSign))
-        throw new Error("KeyStore returned a pqcSign keypair with the wrong byte length(s) for ML-DSA-87.");
-    if (!isValidPqcKemKeypairShape(pqcKem))
-        throw new Error("KeyStore returned a pqcKem keypair with the wrong byte length(s) for ML-KEM-1024.");
-    return { alias: options.alias, storageDir: options.storageDir, classical, pqcSign, pqcKem };
-}
-/**
- * Best-effort wipe of the secret key bytes held by `identity`: overwrites
- * them with zeros so they do not linger in this process's memory after you
- * are done. The identity is unusable afterwards. Limits: JavaScript gives no
- * guarantee about copies the engine or GC already made, and the hex strings
- * produced while saving or loading an identity are immutable and cannot be
- * wiped. This narrows the exposure window; it is not a secure-erase.
- */
-export function zeroizeIdentity(identity) {
-    identity.classical.secretKey.fill(0);
-    identity.pqcSign.secretKey.fill(0);
-    identity.pqcKem.secretKey.fill(0);
-}
 /** The shareable public half of an identity — hand this to the other party out of band. */
 export function exportPublicIdentity(identity) {
     return {
@@ -170,17 +84,4 @@ export function exportPublicIdentity(identity) {
         pqcKemPublicKey: bytesToHex(identity.pqcKem.publicKey),
     };
 }
-/**
- * A self-signed, optionally time-limited version of `exportPublicIdentity`'s
- * card (ADR 0023/issue #37): the identity signs its own card, so a peer can
- * verify it wasn't tampered with and — if `options.expiresAt` was set —
- * reject it once expired, enforcing a cryptoperiod the bare card has no way
- * to carry (it has no signature at all). `exportPublicIdentity` itself is
- * unchanged; this is a separate, opt-in function precisely so every
- * existing caller of the bare card is unaffected. Verify and trust a
- * received one with `trustSignedCard`, not `trustParty`.
- */
-export async function exportSignedCard(identity, options = {}) {
-    return signCore(identity, exportPublicIdentity(identity), options);
-}
 //# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAyB,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAE,QAAQ,EAAsC,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,mBAAmB,EAA0B,MAAM,iBAAiB,CAAC;AACjI,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAG3B,MAAM,iBAAiB,CAAC;AAyBzB,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CAAC,IAAa;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5I,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;SACpD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;SAClD;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAChD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAwB;IAC/D,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU;QACV,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAChD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SAC9C;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAYjC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,2CAA2C,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,QAAQ,GAAa;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,wBAAwB,EAAE;QACrC,OAAO,EAAE,sBAAsB,EAAE;QACjC,MAAM,EAAE,qBAAqB,EAAE;KAChC,CAAC;IAEF,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,UAAU,GAAG,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,qBAAqB,CAAqB,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChH,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;IAC7E,IAAI,MAAM,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QAClC,gEAAgE;QAChE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,WAAW;QACX,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAwC;IACrF,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAErE,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChJ,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IAC9I,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAE7I,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5D,gBAAgB,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACxD,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAkB,EAAE,UAAuB,EAAE;IAClF,OAAO,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAA2C,MAAM,iBAAiB,CAAC;AAyBzH,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;SACpD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;SAClD;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAChD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAwB;IAC/D,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU;QACV,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAChD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SAC9C;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAUxC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+BAA+B,qBAAqB,mBAAmB,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,2CAA2C,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,QAAQ,GAAa;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,wBAAwB,EAAE;QACrC,OAAO,EAAE,sBAAsB,EAAE;QACjC,MAAM,EAAE,qBAAqB,EAAE;KAChC,CAAC;IAEF,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAqB,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACjH,OAAO,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5D,gBAAgB,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACxD,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,11 +1,10 @@
 export { canonicalize, hashDocument } from "./canonicalJson.js";
 export { fingerprint } from "./fingerprint.js";
-export { decryptFrom, DecryptionError, encryptFor, ReplayedBoxError, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
-export type { BoxReplayInfo, Certificate, EncryptedBox, VerifyFailureReason, VerifyResult } from "./crypto/nodeHybrid.js";
-export { createIdentity, exportPublicIdentity, exportSignedCard, loadIdentity, loadIdentityFromKeyStore, MIN_PASSPHRASE_LENGTH, zeroizeIdentity, } from "./identity.js";
-export type { CreateIdentityOptions, Identity, KeyStore, LoadIdentityFromKeyStoreOptions, LoadIdentityOptions, PublicCard } from "./identity.js";
-export type { PassphraseChecker } from "./passphrase.js";
-export { migrateAuditLogToEncrypted, readLog, verifyLogIntegrity } from "./store.js";
+export { decryptFrom, encryptFor, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
+export type { Certificate, EncryptedBox, VerifyFailureReason, VerifyResult } from "./crypto/nodeHybrid.js";
+export { createIdentity, exportPublicIdentity, loadIdentity, MIN_PASSPHRASE_LENGTH } from "./identity.js";
+export type { CreateIdentityOptions, Identity, LoadIdentityOptions, PublicCard } from "./identity.js";
+export { readLog, verifyLogIntegrity } from "./store.js";
 export type { LogEntry, LogIntegrityResult } from "./store.js";
-export { applyRevocationNotice, applyRotation, beginRotation, completeRotation, createRevocationNotice, getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, migrateLegacyTrustStore, migrateTrustStoreToEncrypted, TrustStoreIntegrityError, trustParty, trustSignedCard, untrustFingerprint, untrustParty, } from "./trust.js";
-export type { RevocationDocument, RevocationNotice, RotationDocument, RotationStatement, TrustRecord } from "./trust.js";
+export { getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, trustParty, untrustParty, } from "./trust.js";
+export type { TrustRecord } from "./trust.js";

package/dist/index.js

@@ -1,7 +1,7 @@
 export { canonicalize, hashDocument } from "./canonicalJson.js";
 export { fingerprint } from "./fingerprint.js";
-export { decryptFrom, DecryptionError, encryptFor, ReplayedBoxError, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
-export { createIdentity, exportPublicIdentity, exportSignedCard, loadIdentity, loadIdentityFromKeyStore, MIN_PASSPHRASE_LENGTH, zeroizeIdentity, } from "./identity.js";
-export { migrateAuditLogToEncrypted, readLog, verifyLogIntegrity } from "./store.js";
-export { applyRevocationNotice, applyRotation, beginRotation, completeRotation, createRevocationNotice, getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, migrateLegacyTrustStore, migrateTrustStoreToEncrypted, TrustStoreIntegrityError, trustParty, trustSignedCard, untrustFingerprint, untrustParty, } from "./trust.js";
+export { decryptFrom, encryptFor, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
+export { createIdentity, exportPublicIdentity, loadIdentity, MIN_PASSPHRASE_LENGTH } from "./identity.js";
+export { readLog, verifyLogIntegrity } from "./store.js";
+export { getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, trustParty, untrustParty, } from "./trust.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEvI,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErF,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,YAAY,GACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1G,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/store.d.ts

@@ -6,60 +6,23 @@ export interface LogEntry {
     result?: string;
     at: string;
 }
-/**
- * Constant-time MAC comparison (ADR 0009/0019's chain and head MACs are both
- * HMAC-SHA384, so 96 lowercase hex chars). `candidate` is untrusted on-disk
- * data of unknown shape: a non-string, wrong-length, or non-hex value is
- * reported as a mismatch, never thrown, matching verifyKeyConfirmation's
- * contract in crypto/hybrid.ts.
- *
- * Exported (ADR 0026) so the timing-safety test can exercise this exact
- * compare in isolation, without the file I/O its only internal callers do.
- */
-export declare function macEquals(candidate: unknown, expected: string): boolean;
 /**
  * Appends one entry to the local, append-only audit log (public metadata
- * only — no secrets). Each entry is chained to the previous one's MAC
- * (see verifyLogIntegrity), keyed from identity's own secret material
- * (ADR 0009) so tampering or deleting past entries is detectable by anyone
- * EXCEPT someone who also holds that secret — not just theoretically
- * append-only, and not forgeable by file-write access alone.
+ * only — no secrets). Each entry is chained to the previous one's hash
+ * (see verifyLogIntegrity) so tampering or deleting past entries is
+ * detectable, not just theoretically append-only.
  */
 export declare function appendLogEntry(identity: Identity, entry: Omit<LogEntry, "at">): Promise<void>;
-/** Transparently decrypts any v2 (encrypted, issue #43) entries alongside plaintext v1 ones. */
 export declare function readLog(identity: Identity): Promise<LogEntry[]>;
 export type LogIntegrityResult = {
     intact: true;
 } | {
     intact: false;
-    /** First entry whose chain link failed; for the reasons below, the number of entries actually present. */
     brokenAtIndex: number;
-    /** Absent for an edited or deleted entry inside the chain. "truncated": entries at the end were removed. "head-missing" / "head-invalid": the head record that would show this is gone or not authentic. */
-    reason?: "truncated" | "head-missing" | "head-invalid";
 };
 /**
- * Walks the MAC chain and reports whether it's intact. If an entry was
+ * Walks the hash chain and reports whether it's intact. If an entry was
  * edited or deleted, `brokenAtIndex` is the (0-based) index of the first
- * entry whose chain link no longer matches. Recomputing a matching MAC
- * requires identity's own secret material (see computeMac/deriveAuditLogKey)
- * — this is what makes forging the chain require more than filesystem
- * write access (ADR 0009). It also checks the authenticated head record
- * (ADR 0019), so deleting the most recent entries is reported too, with
- * `reason: "truncated"`.
- *
- * Not detectable: replacing BOTH log.jsonl and log.head.json with an older,
- * consistent pair, or deleting both files outright. Keep an off-box copy of
- * the head if that matters to you.
+ * entry whose chain link no longer matches.
  */
 export declare function verifyLogIntegrity(identity: Identity): Promise<LogIntegrityResult>;
-/**
- * One-time, explicit opt-in (issue #43/ADR 0027) to encrypt the audit log's
- * entry content, so filesystem access alone no longer reveals what actions
- * this identity has performed. Re-encrypts every existing entry in one pass
- * (there is no mixed-format file afterwards) and marks the head record so
- * every later `appendLogEntry` call encrypts just the one entry it writes —
- * never the whole log again. A no-op if the log is already encrypted.
- * Throws if the log fails its integrity check first: there is nothing safe
- * to migrate if the chain can't be trusted.
- */
-export declare function migrateAuditLogToEncrypted(identity: Identity): Promise<void>;

package/dist/store.js

@@ -1,92 +1,14 @@
-import { gcm } from "@noble/ciphers/aes.js";
-import { equalBytes } from "@noble/ciphers/utils.js";
-import { hkdf } from "@noble/hashes/hkdf.js";
-import { hmac } from "@noble/hashes/hmac.js";
 import { sha384 } from "@noble/hashes/sha2.js";
-import { bytesToHex, concatBytes, hexToBytes, randomBytes, utf8ToBytes } from "@noble/hashes/utils.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
 import { appendFile, mkdir, readFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
 import { canonicalize } from "./canonicalJson.js";
-import { writeFileAtomic } from "./fileCrypto.js";
-function isV2Entry(entry) {
-    return entry.version === 2;
-}
-function stripChainFields(entry) {
-    const { prevMac: _prevMac, mac: _mac, ...rest } = entry;
-    return rest;
-}
 const GENESIS_HASH = "GENESIS";
-const AUDIT_LOG_HMAC_INFO = utf8ToBytes("raz-encrypt-audit-log-v1|hmac-key");
-// A separate key for the head record, so a head MAC can never be mistaken for an entry MAC (ADR 0019).
-const AUDIT_LOG_HEAD_INFO = utf8ToBytes("raz-encrypt-audit-log-v1|head-hmac-key");
-// A separate key from both MAC keys above, same reasoning (ADR 0027) — never derived from a passphrase, since appendLogEntry/readLog only ever receive an Identity.
-const AUDIT_LOG_ENC_INFO = utf8ToBytes("raz-encrypt-audit-log-v1|enc-key");
 function logFilePath(storageDir) {
     return join(storageDir, "log.jsonl");
 }
-function headFilePath(storageDir) {
-    return join(storageDir, "log.head.json");
-}
-/**
- * HKDF-derived from BOTH the classical and PQC signing secrets (concatenated,
- * same composition pattern as hybrid.ts's deriveHybridKey) — matching this
- * library's hybrid posture everywhere else: compromising either secret key
- * alone must not be enough to forge the chain. Recomputed fresh on every
- * call, never persisted (ADR 0009).
- */
-function deriveAuditLogKey(identity) {
-    return hkdf(sha384, concatBytes(identity.classical.secretKey, identity.pqcSign.secretKey), undefined, AUDIT_LOG_HMAC_INFO, 32);
-}
-/**
- * Keyed with deriveAuditLogKey — plain SHA-384 (ADR 0009's rejected
- * approach) lets anyone with filesystem write access to log.jsonl forge the
- * whole chain with no knowledge of the Identity's secret material at all.
- * HMAC means forging it requires that secret. Generic over the entry's own
- * shape (v1 plaintext fields, or v2's `{version,nonce,ciphertext}` — issue
- * #43) since `canonicalize` doesn't care which fields are present; the chain
- * mechanism itself never changes, only the bytes it authenticates.
- */
-function computeMac(identity, entry) {
-    return bytesToHex(hmac(sha384, deriveAuditLogKey(identity), utf8ToBytes(canonicalize(entry))));
-}
-/** Same derivation shape as deriveAuditLogKey, under its own info label (ADR 0027). */
-function deriveAuditLogEncKey(identity) {
-    return hkdf(sha384, concatBytes(identity.classical.secretKey, identity.pqcSign.secretKey), undefined, AUDIT_LOG_ENC_INFO, 32);
-}
-/** Associated data for an entry's content AEAD: binds the ciphertext to its format version and its own nonce, same pattern as fileCrypto.ts's headerAad. */
-function entryAad(nonce) {
-    return utf8ToBytes(canonicalize({ version: 2, nonce }));
-}
-function encryptEntryContent(identity, content) {
-    const nonceBytes = randomBytes(12);
-    const nonce = bytesToHex(nonceBytes);
-    const ciphertext = gcm(deriveAuditLogEncKey(identity), nonceBytes, entryAad(nonce)).encrypt(utf8ToBytes(canonicalize(content)));
-    return { nonce, ciphertext: bytesToHex(ciphertext) };
-}
-/** Throws (never returns something un-decrypted) if the entry doesn't authenticate under this identity's key. */
-function decryptEntryContent(identity, entry) {
-    try {
-        const plaintext = gcm(deriveAuditLogEncKey(identity), hexToBytes(entry.nonce), entryAad(entry.nonce)).decrypt(hexToBytes(entry.ciphertext));
-        return JSON.parse(new TextDecoder().decode(plaintext));
-    }
-    catch (err) {
-        throw new Error(`Audit log entry failed to decrypt: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-/**
- * Constant-time MAC comparison (ADR 0009/0019's chain and head MACs are both
- * HMAC-SHA384, so 96 lowercase hex chars). `candidate` is untrusted on-disk
- * data of unknown shape: a non-string, wrong-length, or non-hex value is
- * reported as a mismatch, never thrown, matching verifyKeyConfirmation's
- * contract in crypto/hybrid.ts.
- *
- * Exported (ADR 0026) so the timing-safety test can exercise this exact
- * compare in isolation, without the file I/O its only internal callers do.
- */
-export function macEquals(candidate, expected) {
-    if (typeof candidate !== "string" || !/^[0-9a-f]{96}$/.test(candidate))
-        return false;
-    return equalBytes(hexToBytes(candidate), hexToBytes(expected));
+function computeHash(entry) {
+    return bytesToHex(sha384(utf8ToBytes(canonicalize(entry))));
 }
 async function readStoredEntries(storageDir) {
     try {
@@ -94,15 +16,7 @@ async function readStoredEntries(storageDir) {
         return raw
             .split("\n")
             .filter((line) => line.trim().length > 0)
-            .map((line) => {
-            const parsed = JSON.parse(line);
-            // A corrupted line can be valid JSON that isn't an object (e.g.
-            // `null`) — destructuring that downstream throws TypeError instead
-            // of being reported as a broken chain link. Coerce to an empty
-            // object so it flows safely through as a non-matching entry (found
-            // by fuzzing, issue #42).
-            return (typeof parsed === "object" && parsed !== null ? parsed : {});
-        });
+            .map((line) => JSON.parse(line));
     }
     catch (err) {
         if (err.code === "ENOENT")
@@ -110,185 +24,39 @@ async function readStoredEntries(storageDir) {
         throw err;
     }
 }
-function computeHeadMac(identity, head) {
-    const key = hkdf(sha384, concatBytes(identity.classical.secretKey, identity.pqcSign.secretKey), undefined, AUDIT_LOG_HEAD_INFO, 32);
-    return bytesToHex(hmac(sha384, key, utf8ToBytes(canonicalize(head))));
-}
-async function readHead(identity) {
-    let raw;
-    try {
-        raw = await readFile(headFilePath(identity.storageDir), "utf8");
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return { state: "missing" };
-        throw err;
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        const { headMac, ...rest } = parsed;
-        if (rest.version !== 1 ||
-            typeof rest.count !== "number" ||
-            !Number.isSafeInteger(rest.count) ||
-            rest.count < 0 ||
-            typeof rest.mac !== "string" ||
-            typeof headMac !== "string" ||
-            (rest.encrypted !== undefined && rest.encrypted !== true)) {
-            return { state: "invalid" };
-        }
-        // Only ever include `encrypted` when true, exactly as writeHead does —
-        // otherwise a legacy head record's canonicalized bytes (and therefore
-        // its headMac) would silently change underneath it.
-        const head = rest.encrypted === true ? { version: 1, count: rest.count, mac: rest.mac, encrypted: true } : { version: 1, count: rest.count, mac: rest.mac };
-        return macEquals(headMac, computeHeadMac(identity, head)) ? { state: "ok", head } : { state: "invalid" };
-    }
-    catch {
-        return { state: "invalid" };
-    }
-}
-/** Compares an already-read head against the entries on disk. Returns undefined when they agree (a head up to a few entries behind is fine: that is a crash between append and head update). */
-function checkHeadAgainst(read, entries) {
-    if (read.state === "missing")
-        return entries.length === 0 ? undefined : { reason: "head-missing", brokenAtIndex: entries.length };
-    if (read.state === "invalid")
-        return { reason: "head-invalid", brokenAtIndex: entries.length };
-    const { count, mac } = read.head;
-    if (count > entries.length)
-        return { reason: "truncated", brokenAtIndex: entries.length };
-    const expected = count === 0 ? GENESIS_HASH : entries[count - 1].mac;
-    if (mac !== expected)
-        return { reason: "head-invalid", brokenAtIndex: entries.length };
-    return undefined;
-}
-async function checkHead(identity, entries) {
-    return checkHeadAgainst(await readHead(identity), entries);
-}
-async function writeHead(identity, count, mac, encrypted) {
-    const head = encrypted ? { version: 1, count, mac, encrypted: true } : { version: 1, count, mac };
-    await writeFileAtomic(headFilePath(identity.storageDir), JSON.stringify({ ...head, headMac: computeHeadMac(identity, head) }));
-}
-const appendState = new Map();
-function stateFor(storageDir) {
-    const key = resolve(storageDir);
-    let state = appendState.get(key);
-    if (!state) {
-        state = { queue: Promise.resolve(), tail: null, headTrusted: true, encrypted: false };
-        appendState.set(key, state);
-    }
-    return state;
-}
-async function doAppend(identity, entry, state) {
-    const full = { ...entry, at: new Date().toISOString() };
-    if (!state.tail) {
-        const existing = await readStoredEntries(identity.storageDir);
-        const head = await readHead(identity);
-        state.tail = { mac: existing.length > 0 ? existing[existing.length - 1].mac : GENESIS_HASH, entryCount: existing.length };
-        state.headTrusted = checkHeadAgainst(head, existing) === undefined;
-        state.encrypted = head.state === "ok" && head.head.encrypted === true;
-    }
-    const content = state.encrypted ? { version: 2, ...encryptEntryContent(identity, full) } : { ...full };
-    const withPrev = { ...content, prevMac: state.tail.mac };
-    const mac = computeMac(identity, withPrev);
-    const stored = { ...withPrev, mac };
-    await mkdir(identity.storageDir, { recursive: true, mode: 0o700 });
-    await appendFile(logFilePath(identity.storageDir), JSON.stringify(stored) + "\n", { mode: 0o600 });
-    state.tail = { mac, entryCount: state.tail.entryCount + 1 };
-    // Never overwrite a head that already disagreed with the log: that would
-    // launder a truncation into a "clean" state.
-    if (state.headTrusted)
-        await writeHead(identity, state.tail.entryCount, mac, state.encrypted);
-}
 /**
  * Appends one entry to the local, append-only audit log (public metadata
- * only — no secrets). Each entry is chained to the previous one's MAC
- * (see verifyLogIntegrity), keyed from identity's own secret material
- * (ADR 0009) so tampering or deleting past entries is detectable by anyone
- * EXCEPT someone who also holds that secret — not just theoretically
- * append-only, and not forgeable by file-write access alone.
+ * only — no secrets). Each entry is chained to the previous one's hash
+ * (see verifyLogIntegrity) so tampering or deleting past entries is
+ * detectable, not just theoretically append-only.
  */
 export async function appendLogEntry(identity, entry) {
-    const state = stateFor(identity.storageDir);
-    // Chain onto the previous operation regardless of how it settled (a past
-    // failure must not permanently block future appends to this storageDir),
-    // but this call's own outcome — via `task`, awaited below — propagates to
-    // ITS caller untouched.
-    const task = state.queue.catch(() => { }).then(() => doAppend(identity, entry, state));
-    state.queue = task.catch(() => { });
-    await task;
+    const full = { ...entry, at: new Date().toISOString() };
+    const existing = await readStoredEntries(identity.storageDir);
+    const prevHash = existing.length > 0 ? existing[existing.length - 1].hash : GENESIS_HASH;
+    const withPrev = { ...full, prevHash };
+    const stored = { ...withPrev, hash: computeHash(withPrev) };
+    await mkdir(identity.storageDir, { recursive: true });
+    await appendFile(logFilePath(identity.storageDir), JSON.stringify(stored) + "\n", { mode: 0o600 });
 }
-/** Transparently decrypts any v2 (encrypted, issue #43) entries alongside plaintext v1 ones. */
 export async function readLog(identity) {
-    return (await readStoredEntries(identity.storageDir)).map((entry) => (isV2Entry(entry) ? decryptEntryContent(identity, entry) : stripChainFields(entry)));
+    return (await readStoredEntries(identity.storageDir)).map(({ prevHash: _prevHash, hash: _hash, ...entry }) => entry);
 }
 /**
- * Walks the MAC chain and reports whether it's intact. If an entry was
+ * Walks the hash chain and reports whether it's intact. If an entry was
  * edited or deleted, `brokenAtIndex` is the (0-based) index of the first
- * entry whose chain link no longer matches. Recomputing a matching MAC
- * requires identity's own secret material (see computeMac/deriveAuditLogKey)
- * — this is what makes forging the chain require more than filesystem
- * write access (ADR 0009). It also checks the authenticated head record
- * (ADR 0019), so deleting the most recent entries is reported too, with
- * `reason: "truncated"`.
- *
- * Not detectable: replacing BOTH log.jsonl and log.head.json with an older,
- * consistent pair, or deleting both files outright. Keep an off-box copy of
- * the head if that matters to you.
+ * entry whose chain link no longer matches.
  */
 export async function verifyLogIntegrity(identity) {
     const entries = await readStoredEntries(identity.storageDir);
-    let expectedPrevMac = GENESIS_HASH;
+    let expectedPrevHash = GENESIS_HASH;
     for (let i = 0; i < entries.length; i++) {
-        const { prevMac, mac, ...rest } = entries[i];
-        if (prevMac !== expectedPrevMac || !macEquals(mac, computeMac(identity, { ...rest, prevMac }))) {
+        const { prevHash, hash, ...rest } = entries[i];
+        if (prevHash !== expectedPrevHash || hash !== computeHash({ ...rest, prevHash })) {
             return { intact: false, brokenAtIndex: i };
         }
-        expectedPrevMac = mac;
+        expectedPrevHash = hash;
     }
-    const problem = await checkHead(identity, entries);
-    if (problem)
-        return { intact: false, ...problem };
     return { intact: true };
 }
-/**
- * One-time, explicit opt-in (issue #43/ADR 0027) to encrypt the audit log's
- * entry content, so filesystem access alone no longer reveals what actions
- * this identity has performed. Re-encrypts every existing entry in one pass
- * (there is no mixed-format file afterwards) and marks the head record so
- * every later `appendLogEntry` call encrypts just the one entry it writes —
- * never the whole log again. A no-op if the log is already encrypted.
- * Throws if the log fails its integrity check first: there is nothing safe
- * to migrate if the chain can't be trusted.
- */
-export async function migrateAuditLogToEncrypted(identity) {
-    const state = stateFor(identity.storageDir);
-    const task = state.queue.catch(() => { }).then(() => doMigrateToEncrypted(identity, state));
-    state.queue = task.catch(() => { });
-    await task;
-}
-async function doMigrateToEncrypted(identity, state) {
-    const head = await readHead(identity);
-    if (head.state === "ok" && head.head.encrypted === true)
-        return; // already encrypted — true no-op
-    const integrity = await verifyLogIntegrity(identity);
-    if (!integrity.intact) {
-        throw new Error("Cannot migrate: the audit log failed its integrity check. Investigate before encrypting it.");
-    }
-    const entries = await readStoredEntries(identity.storageDir);
-    let prevMac = GENESIS_HASH;
-    const rewritten = [];
-    for (const entry of entries) {
-        const content = isV2Entry(entry) ? decryptEntryContent(identity, entry) : stripChainFields(entry);
-        const { nonce, ciphertext } = encryptEntryContent(identity, content);
-        const withPrev = { version: 2, nonce, ciphertext, prevMac };
-        const mac = computeMac(identity, withPrev);
-        rewritten.push({ ...withPrev, mac });
-        prevMac = mac;
-    }
-    await mkdir(identity.storageDir, { recursive: true, mode: 0o700 });
-    await writeFileAtomic(logFilePath(identity.storageDir), rewritten.map((entry) => JSON.stringify(entry)).join("\n") + (rewritten.length > 0 ? "\n" : ""));
-    await writeHead(identity, rewritten.length, prevMac, true);
-    state.tail = { mac: prevMac, entryCount: rewritten.length };
-    state.headTrusted = true;
-    state.encrypted = true;
-}
 //# sourceMappingURL=store.js.map