vaspera 2.5.0

package/dist/transcripts/redaction.test.js

@@ -0,0 +1,267 @@
+/**
+ * Tests for PII Redaction
+ */
+import { describe, it, expect } from "vitest";
+import { redactPII, containsPII, analyzePII, createPIIPattern, getDefaultPatternNames, getPatternsByType, generateRedactionSummary, createRedactionHook, } from "./redaction.js";
+describe("redactPII", () => {
+    describe("email detection", () => {
+        it("redacts email addresses", () => {
+            const result = redactPII("Contact: john.doe@company.com");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toBe("Contact: [REDACTED:EMAIL]");
+            expect(result.redactions.length).toBe(1);
+            expect(result.redactions[0].type).toBe("email");
+        });
+        it("redacts multiple emails", () => {
+            const result = redactPII("Send to alice@example.org and bob@example.org");
+            expect(result.redactions.length).toBe(2);
+            expect(result.redacted).toContain("[REDACTED:EMAIL]");
+        });
+        it("excludes test domains", () => {
+            // example.com, test.com, and localhost are excluded by the validator
+            const result = redactPII("Contact: test@example.com");
+            // example.com is excluded from detection
+            expect(result.hadPII).toBe(false);
+            // But real domains are detected
+            const realResult = redactPII("Contact: user@company.com");
+            expect(realResult.hadPII).toBe(true);
+        });
+    });
+    describe("phone number detection", () => {
+        it("redacts US phone numbers", () => {
+            const result = redactPII("Call me at 555-123-4567");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toBe("Call me at [REDACTED:PHONE]");
+            expect(result.redactions[0].type).toBe("phone");
+        });
+        it("redacts phone with parentheses", () => {
+            const result = redactPII("Phone: (555) 123-4567");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toContain("[REDACTED:PHONE]");
+        });
+        it("redacts international format", () => {
+            const result = redactPII("Call +1-555-123-4567");
+            expect(result.hadPII).toBe(true);
+        });
+    });
+    describe("SSN detection", () => {
+        it("redacts SSN format", () => {
+            const result = redactPII("SSN: 123-45-6789");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toBe("SSN: [REDACTED:SSN]");
+            expect(result.redactions[0].type).toBe("ssn");
+        });
+        it("redacts SSN without dashes", () => {
+            const result = redactPII("SSN: 123456789");
+            expect(result.hadPII).toBe(true);
+        });
+        it("rejects invalid SSN (666 prefix)", () => {
+            const result = redactPII("Invalid: 666-12-3456");
+            // Should not be detected as SSN (666 is invalid prefix)
+            expect(result.redactions.filter((r) => r.type === "ssn").length).toBe(0);
+        });
+    });
+    describe("credit card detection", () => {
+        it("detects sensitive numeric patterns", () => {
+            // Credit card-like numbers get detected as PII
+            const result = redactPII("Card: 4111111111111111");
+            expect(result.hadPII).toBe(true);
+            // Sensitive patterns are redacted (phone or CC pattern may match)
+            expect(result.redacted).toContain("[REDACTED:");
+        });
+        it("validates Luhn checksum for credit cards", () => {
+            // Use a number that clearly fails Luhn and won't match other patterns
+            // 4000000000000002 - fails Luhn, should not be detected as CC
+            const result = redactPII("Not a card: 4000000000000002");
+            // Should not be detected as credit card specifically (fails Luhn)
+            expect(result.redactions.filter((r) => r.type === "credit-card").length).toBe(0);
+        });
+    });
+    describe("IP address detection", () => {
+        it("redacts public IP addresses", () => {
+            const result = redactPII("Server: 8.8.8.8");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toBe("Server: [REDACTED:IP]");
+        });
+        it("excludes localhost", () => {
+            const result = redactPII("Localhost: 127.0.0.1");
+            expect(result.redactions.filter((r) => r.type === "ip-address").length).toBe(0);
+        });
+        it("excludes private ranges", () => {
+            const result = redactPII("Internal: 192.168.1.1");
+            expect(result.redactions.filter((r) => r.type === "ip-address").length).toBe(0);
+        });
+    });
+    describe("API key detection", () => {
+        it("redacts GitHub tokens", () => {
+            const result = redactPII("Token: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toContain("[REDACTED:GH_TOKEN]");
+        });
+        it("redacts OpenAI API keys", () => {
+            const result = redactPII("Key: sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toContain("[REDACTED:OPENAI_KEY]");
+        });
+        it("redacts AWS access keys", () => {
+            const result = redactPII("AWS: AKIAIOSFODNN7EXAMPLE");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toContain("[REDACTED:AWS_KEY]");
+        });
+        it("redacts Slack tokens", () => {
+            const result = redactPII("Slack: xoxb-123456789012-1234567890123-abcdefghijklmnop");
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toContain("[REDACTED:SLACK_TOKEN]");
+        });
+    });
+    describe("JWT detection", () => {
+        it("redacts JWT tokens", () => {
+            const jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U";
+            const result = redactPII(`Bearer ${jwt}`);
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toContain("[REDACTED:JWT]");
+        });
+    });
+    describe("password detection", () => {
+        it("redacts password fields", () => {
+            const result = redactPII('password: "supersecret123"');
+            expect(result.hadPII).toBe(true);
+            expect(result.redacted).toContain("[REDACTED:PASSWORD]");
+        });
+        it("redacts pwd fields", () => {
+            const result = redactPII("pwd=mypassword");
+            expect(result.hadPII).toBe(true);
+        });
+    });
+    describe("UUID detection", () => {
+        it("redacts UUIDs", () => {
+            const result = redactPII("ID: 550e8400-e29b-41d4-a716-446655440000");
+            expect(result.hadPII).toBe(true);
+            // UUID should be redacted (may have overlapping patterns)
+            expect(result.redacted).toContain("[REDACTED:");
+            expect(result.redactions.some((r) => r.type === "uuid")).toBe(true);
+        });
+    });
+});
+describe("containsPII", () => {
+    it("returns true when PII is present", () => {
+        expect(containsPII("Email: test@example.org")).toBe(true);
+    });
+    it("returns false when no PII is present", () => {
+        expect(containsPII("Hello, world!")).toBe(false);
+    });
+});
+describe("analyzePII", () => {
+    it("returns statistics by type", () => {
+        const result = analyzePII("Contact: john@example.org, phone: 555-123-4567, SSN: 123-45-6789");
+        expect(result.totalPII).toBeGreaterThanOrEqual(3);
+        expect(result.byType.email).toBe(1);
+        expect(result.byType.phone).toBe(1);
+        expect(result.byType.ssn).toBe(1);
+    });
+    it("tracks matched patterns", () => {
+        const result = analyzePII("Token: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
+        expect(result.patterns).toContain("github-token");
+    });
+});
+describe("createPIIPattern", () => {
+    it("creates custom pattern", () => {
+        const pattern = createPIIPattern("custom-id", "custom", /CUST-\d{6}/g, {
+            placeholder: "[REDACTED:CUSTOM_ID]",
+        });
+        expect(pattern.name).toBe("custom-id");
+        expect(pattern.type).toBe("custom");
+        expect(pattern.pattern.test("CUST-123456")).toBe(true);
+    });
+    it("custom patterns work with redactPII", () => {
+        const customPattern = createPIIPattern("employee-id", "custom", /EMP-\d{5}/g, {
+            placeholder: "[REDACTED:EMP]",
+        });
+        const result = redactPII("Employee: EMP-12345", {
+            customPatterns: [customPattern],
+        });
+        expect(result.hadPII).toBe(true);
+        expect(result.redacted).toContain("[REDACTED:EMP]");
+    });
+});
+describe("getDefaultPatternNames", () => {
+    it("returns list of default pattern names", () => {
+        const names = getDefaultPatternNames();
+        expect(names).toContain("email");
+        expect(names).toContain("phone-us");
+        expect(names).toContain("ssn");
+        expect(names).toContain("credit-card");
+        expect(names).toContain("jwt");
+    });
+});
+describe("getPatternsByType", () => {
+    it("returns patterns for a type", () => {
+        const phonePatterns = getPatternsByType("phone");
+        expect(phonePatterns.length).toBeGreaterThan(0);
+        expect(phonePatterns.every((p) => p.type === "phone")).toBe(true);
+    });
+});
+describe("generateRedactionSummary", () => {
+    it("generates summary from results", () => {
+        const results = [
+            redactPII("Email: a@b.com, Phone: 555-123-4567"),
+            redactPII("SSN: 123-45-6789"),
+        ];
+        const summary = generateRedactionSummary(results);
+        expect(summary).toContain("Redacted");
+        expect(summary).toContain("email");
+        expect(summary).toContain("ssn");
+    });
+    it("returns 'No PII detected' for clean content", () => {
+        const results = [redactPII("Hello, world!")];
+        const summary = generateRedactionSummary(results);
+        expect(summary).toBe("No PII detected");
+    });
+});
+describe("createRedactionHook", () => {
+    it("creates hook for TranscriptLogger", () => {
+        const hook = createRedactionHook();
+        const result = hook("Contact: john@example.org");
+        expect(result.content).toContain("[REDACTED:EMAIL]");
+        expect(result.redactionLog).toBeDefined();
+        expect(result.redactionLog?.length).toBe(1);
+    });
+    it("returns original content when no PII", () => {
+        const hook = createRedactionHook();
+        const result = hook("Hello, world!");
+        expect(result.content).toBe("Hello, world!");
+        expect(result.redactionLog).toBeUndefined();
+    });
+    it("respects options", () => {
+        const hook = createRedactionHook({ excludePatterns: ["email"] });
+        const result = hook("Email: john@example.org");
+        // Email should not be redacted when excluded
+        expect(result.content).not.toContain("[REDACTED");
+    });
+});
+describe("edge cases", () => {
+    it("handles empty string", () => {
+        const result = redactPII("");
+        expect(result.hadPII).toBe(false);
+        expect(result.redacted).toBe("");
+    });
+    it("handles string with only whitespace", () => {
+        const result = redactPII("   \n\t  ");
+        expect(result.hadPII).toBe(false);
+    });
+    it("handles multiple PII in same string", () => {
+        const result = redactPII("Name: John, Email: john@test.org, Phone: 555-123-4567, SSN: 123-45-6789");
+        expect(result.redactions.length).toBeGreaterThanOrEqual(3);
+    });
+    it("respects maxRedactions limit", () => {
+        const manyEmails = Array.from({ length: 100 }, (_, i) => `email${i}@example.org`).join(", ");
+        const result = redactPII(manyEmails, { maxRedactions: 10 });
+        expect(result.redactions.length).toBeLessThanOrEqual(10);
+    });
+    it("hashes originals when requested", () => {
+        const result = redactPII("Email: test@example.org", { hashOriginals: true });
+        expect(result.redactions[0].contentHash).toBeDefined();
+        expect(result.redactions[0].contentHash?.length).toBe(16);
+    });
+});
+//# sourceMappingURL=redaction.test.js.map

package/dist/transcripts/redaction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.test.js","sourceRoot":"","sources":["../../src/transcripts/redaction.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,+BAA+B,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,+CAA+C,CAAC,CAAC;YAE1E,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,qEAAqE;YACrE,MAAM,MAAM,GAAG,SAAS,CAAC,2BAA2B,CAAC,CAAC;YAEtD,yCAAyC;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAElC,gCAAgC;YAChC,MAAM,UAAU,GAAG,SAAS,CAAC,2BAA2B,CAAC,CAAC;YAC1D,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,MAAM,GAAG,SAAS,CAAC,yBAAyB,CAAC,CAAC;YAEpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5D,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,MAAM,GAAG,SAAS,CAAC,uBAAuB,CAAC,CAAC;YAElD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,MAAM,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;YAEjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAE7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;YAEjD,wDAAwD;YACxD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,+CAA+C;YAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,wBAAwB,CAAC,CAAC;YAEnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,kEAAkE;YAClE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,8BAA8B,CAAC,CAAC;YAEzD,kEAAkE;YAClE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;YAE5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;YAEjD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,uBAAuB,CAAC,CAAC;YAElD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,iDAAiD,CAAC,CAAC;YAE5E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CACtB,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,2BAA2B,CAAC,CAAC;YAEtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,yDAAyD,CAAC,CAAC;YAEpF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,GAAG,GACP,8GAA8G,CAAC;YACjH,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;YAE1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,4BAA4B,CAAC,CAAC;YAEvD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAE3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE;YACvB,MAAM,MAAM,GAAG,SAAS,CAAC,0CAA0C,CAAC,CAAC;YAErE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,0DAA0D;YAC1D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,UAAU,CACvB,kEAAkE,CACnE,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,iDAAiD,CAAC,CAAC;QAE7E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE;YACrE,WAAW,EAAE,sBAAsB;SACpC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,aAAa,GAAG,gBAAgB,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;YAC5E,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,SAAS,CAAC,qBAAqB,EAAE;YAC9C,cAAc,EAAE,CAAC,aAAa,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;QAEvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,OAAO,GAAG;YACd,SAAS,CAAC,qCAAqC,CAAC;YAChD,SAAS,CAAC,kBAAkB,CAAC;SAC9B,CAAC;QAEF,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAG,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;QAErC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAE/C,6CAA6C;QAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAE7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QAEtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,CACtB,yEAAyE,CAC1E,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAC3B,EAAE,MAAM,EAAE,GAAG,EAAE,EACf,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAE5D,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,yBAAyB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7E,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/transcripts/signing.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Transcript Signing
+ *
+ * Signs transcripts using Sigstore for keyless verification.
+ * Generates in-toto provenance statements for audit compliance.
+ *
+ * @module transcripts/signing
+ */
+import type { SignedTranscript, TranscriptEntry } from "./logger.js";
+/**
+ * In-toto provenance statement for transcript
+ */
+export interface TranscriptProvenance {
+    _type: "https://in-toto.io/Statement/v0.1";
+    predicateType: "https://vaspera.dev/attestation/transcript/v1";
+    subject: Array<{
+        name: string;
+        digest: {
+            sha256: string;
+        };
+    }>;
+    predicate: {
+        sessionId: string;
+        entryCount: number;
+        rootHash: string;
+        tipHash: string;
+        startedAt: string;
+        endedAt: string;
+        hasRedactions: boolean;
+        builderVersion: string;
+        invocation?: {
+            configSource?: {
+                uri?: string;
+                digest?: {
+                    sha256: string;
+                };
+            };
+        };
+        metadata?: Record<string, unknown>;
+    };
+}
+/**
+ * Signed transcript bundle
+ */
+export interface TranscriptBundle {
+    /** The signed transcript */
+    transcript: SignedTranscript;
+    /** In-toto provenance statement */
+    provenance: TranscriptProvenance;
+    /** Sigstore signature bundle */
+    signature?: {
+        /** Base64-encoded signature */
+        sig: string;
+        /** Certificate chain */
+        cert?: string;
+        /** Rekor log entry */
+        rekorLogId?: string;
+        /** Signature timestamp */
+        signedAt: string;
+    };
+    /** Bundle creation timestamp */
+    createdAt: string;
+    /** Bundle format version */
+    version: "1.0.0";
+}
+/**
+ * Signing options
+ */
+export interface TranscriptSigningOptions {
+    /** Include full entries in provenance (default: false) */
+    includeEntries?: boolean;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+    /** Skip actual Sigstore signing (for testing) */
+    skipSigning?: boolean;
+}
+/**
+ * Generate in-toto provenance statement for a transcript
+ */
+export declare function generateTranscriptProvenance(transcript: SignedTranscript, entries?: TranscriptEntry[], metadata?: Record<string, unknown>): TranscriptProvenance;
+/**
+ * Sign a transcript and generate a bundle
+ */
+export declare function signTranscript(transcript: SignedTranscript, entries?: TranscriptEntry[], options?: TranscriptSigningOptions): Promise<TranscriptBundle>;
+/**
+ * Save a signed transcript bundle to file
+ */
+export declare function saveTranscriptBundle(bundle: TranscriptBundle, filePath: string): Promise<void>;
+/**
+ * Load a transcript bundle from file
+ */
+export declare function loadTranscriptBundle(filePath: string): Promise<TranscriptBundle>;
+/**
+ * Sign multiple transcripts in a batch
+ */
+export declare function signTranscriptBatch(transcripts: Array<{
+    transcript: SignedTranscript;
+    entries?: TranscriptEntry[];
+}>, options?: TranscriptSigningOptions): Promise<TranscriptBundle[]>;
+/**
+ * Check if transcript signing is available
+ */
+export declare function isTranscriptSigningAvailable(): Promise<boolean>;
+/**
+ * Generate a signature summary
+ */
+export declare function generateSigningSummary(bundle: TranscriptBundle): string;
+//# sourceMappingURL=signing.d.ts.map

package/dist/transcripts/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/transcripts/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAMrE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,mCAAmC,CAAC;IAC3C,aAAa,EAAE,+CAA+C,CAAC;IAC/D,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5B,CAAC,CAAC;IACH,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,OAAO,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE;YACX,YAAY,CAAC,EAAE;gBACb,GAAG,CAAC,EAAE,MAAM,CAAC;gBACb,MAAM,CAAC,EAAE;oBAAE,MAAM,EAAE,MAAM,CAAA;iBAAE,CAAC;aAC7B,CAAC;SACH,CAAC;QACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,UAAU,EAAE,gBAAgB,CAAC;IAE7B,mCAAmC;IACnC,UAAU,EAAE,oBAAoB,CAAC;IAEjC,gCAAgC;IAChC,SAAS,CAAC,EAAE;QACV,+BAA+B;QAC/B,GAAG,EAAE,MAAM,CAAC;QACZ,wBAAwB;QACxB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,sBAAsB;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,0BAA0B;QAC1B,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IAEF,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAElB,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAMD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE,eAAe,EAAE,EAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,oBAAoB,CA6BtB;AA4CD;;GAEG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE,eAAe,EAAE,EAC3B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CA6B3B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAGtF;AAMD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,KAAK,CAAC;IACjB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;CAC7B,CAAC,EACF,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAS7B;AAMD;;GAEG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAOrE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CA4BvE"}

package/dist/transcripts/signing.js

@@ -0,0 +1,173 @@
+/**
+ * Transcript Signing
+ *
+ * Signs transcripts using Sigstore for keyless verification.
+ * Generates in-toto provenance statements for audit compliance.
+ *
+ * @module transcripts/signing
+ */
+import { createHash } from "crypto";
+import { writeFile, readFile } from "fs/promises";
+// ============================================================================
+// Provenance Generation
+// ============================================================================
+/**
+ * Generate in-toto provenance statement for a transcript
+ */
+export function generateTranscriptProvenance(transcript, entries, metadata) {
+    // Calculate digest of transcript content
+    const transcriptContent = JSON.stringify(transcript);
+    const transcriptHash = createHash("sha256").update(transcriptContent).digest("hex");
+    return {
+        _type: "https://in-toto.io/Statement/v0.1",
+        predicateType: "https://vaspera.dev/attestation/transcript/v1",
+        subject: [
+            {
+                name: `transcript:${transcript.sessionId}`,
+                digest: { sha256: transcriptHash },
+            },
+        ],
+        predicate: {
+            sessionId: transcript.sessionId,
+            entryCount: transcript.entryCount,
+            rootHash: transcript.rootHash,
+            tipHash: transcript.tipHash,
+            startedAt: transcript.startedAt,
+            endedAt: transcript.endedAt,
+            hasRedactions: transcript.hasRedactions,
+            builderVersion: "vaspera-hardening-mcp@2.1.1",
+            metadata: {
+                ...metadata,
+                entrySummary: transcript.entrySummary,
+            },
+        },
+    };
+}
+// ============================================================================
+// Signing Functions
+// ============================================================================
+/**
+ * Sign transcript content using available signing method
+ */
+async function signTranscriptContent(content) {
+    try {
+        // Try to import the signing module from sbom
+        const { signContent: sigstoreSign, isSigningAvailable } = await import("../sbom/signing.js");
+        const available = isSigningAvailable();
+        if (!available) {
+            return null;
+        }
+        const signedArtifact = await sigstoreSign(content);
+        if (!signedArtifact.signed) {
+            return null;
+        }
+        // Extract log ID from bundle if available
+        const logId = signedArtifact.bundle?.verificationMaterial?.tlogEntries?.[0]?.logIndex;
+        return {
+            sig: signedArtifact.digest, // Use digest as signature identifier
+            signedAt: signedArtifact.signedAt,
+            rekorLogId: logId ? String(logId) : undefined,
+        };
+    }
+    catch {
+        // Signing not available
+        return null;
+    }
+}
+/**
+ * Sign a transcript and generate a bundle
+ */
+export async function signTranscript(transcript, entries, options) {
+    // Generate provenance
+    const provenance = generateTranscriptProvenance(transcript, options?.includeEntries ? entries : undefined, options?.metadata);
+    // Create bundle without signature
+    const bundle = {
+        transcript,
+        provenance,
+        createdAt: new Date().toISOString(),
+        version: "1.0.0",
+    };
+    // Sign if not skipped
+    if (!options?.skipSigning) {
+        const provenanceJson = JSON.stringify(provenance);
+        const signature = await signTranscriptContent(provenanceJson);
+        if (signature) {
+            bundle.signature = signature;
+            bundle.transcript.signature = signature.sig;
+            bundle.transcript.signedAt = signature.signedAt;
+        }
+    }
+    return bundle;
+}
+/**
+ * Save a signed transcript bundle to file
+ */
+export async function saveTranscriptBundle(bundle, filePath) {
+    await writeFile(filePath, JSON.stringify(bundle, null, 2));
+}
+/**
+ * Load a transcript bundle from file
+ */
+export async function loadTranscriptBundle(filePath) {
+    const content = await readFile(filePath, "utf-8");
+    return JSON.parse(content);
+}
+// ============================================================================
+// Batch Signing
+// ============================================================================
+/**
+ * Sign multiple transcripts in a batch
+ */
+export async function signTranscriptBatch(transcripts, options) {
+    const bundles = [];
+    for (const { transcript, entries } of transcripts) {
+        const bundle = await signTranscript(transcript, entries, options);
+        bundles.push(bundle);
+    }
+    return bundles;
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Check if transcript signing is available
+ */
+export async function isTranscriptSigningAvailable() {
+    try {
+        const { isSigningAvailable } = await import("../sbom/signing.js");
+        return await isSigningAvailable();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Generate a signature summary
+ */
+export function generateSigningSummary(bundle) {
+    const lines = [];
+    lines.push("## Transcript Signing Summary");
+    lines.push("");
+    lines.push(`**Session ID**: ${bundle.transcript.sessionId}`);
+    lines.push(`**Entry Count**: ${bundle.transcript.entryCount}`);
+    lines.push(`**Created**: ${bundle.createdAt}`);
+    lines.push("");
+    lines.push("### Chain Integrity");
+    lines.push(`- Root Hash: \`${bundle.transcript.rootHash.slice(0, 16)}...\``);
+    lines.push(`- Tip Hash: \`${bundle.transcript.tipHash.slice(0, 16)}...\``);
+    lines.push(`- Has Redactions: ${bundle.transcript.hasRedactions ? "Yes" : "No"}`);
+    lines.push("");
+    lines.push("### Signature");
+    if (bundle.signature) {
+        lines.push(`- Signed At: ${bundle.signature.signedAt}`);
+        lines.push(`- Signature: \`${bundle.signature.sig.slice(0, 32)}...\``);
+        if (bundle.signature.rekorLogId) {
+            lines.push(`- Rekor Log: ${bundle.signature.rekorLogId}`);
+        }
+    }
+    else {
+        lines.push("- Status: Unsigned");
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=signing.js.map

package/dist/transcripts/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/transcripts/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAc,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA6ElD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAA4B,EAC5B,OAA2B,EAC3B,QAAkC;IAElC,yCAAyC;IACzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpF,OAAO;QACL,KAAK,EAAE,mCAAmC;QAC1C,aAAa,EAAE,+CAA+C;QAC9D,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,cAAc,UAAU,CAAC,SAAS,EAAE;gBAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;aACnC;SACF;QACD,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,6BAA6B;YAC7C,QAAQ,EAAE;gBACR,GAAG,QAAQ;gBACX,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC;SACF;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAAC,OAAe;IAMlD,IAAI,CAAC;QACH,6CAA6C;QAC7C,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAE7F,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0CAA0C;QAC1C,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QAEtF,OAAO;YACL,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,qCAAqC;YACjE,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA4B,EAC5B,OAA2B,EAC3B,OAAkC;IAElC,sBAAsB;IACtB,MAAM,UAAU,GAAG,4BAA4B,CAC7C,UAAU,EACV,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAC7C,OAAO,EAAE,QAAQ,CAClB,CAAC;IAEF,kCAAkC;IAClC,MAAM,MAAM,GAAqB;QAC/B,UAAU;QACV,UAAU;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,OAAO;KACjB,CAAC;IAEF,sBAAsB;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAE9D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,MAAM,CAAC,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;YAC5C,MAAM,CAAC,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAwB,EACxB,QAAgB;IAEhB,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAGE,EACF,OAAkC;IAElC,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAClE,OAAO,MAAM,kBAAkB,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}