// engine/audit-trail/hasher.ts — SHA-256 hash chain for SPEC-387 audit entries
import { createHash } from 'node:crypto';
/**
 * Compute the SHA-256 hex digest for an audit entry.
 * Fields are joined with '|' in a deterministic order so the hash is stable
 * across serialization formats.
 */
export function hashEntry(entry) {
    const content = [
        entry.id,
        entry.timestamp,
        entry.toolName,
        entry.inputSummary,
        entry.outputType,
        String(entry.durationMs),
        entry.prevHash,
    ].join('|');
    return createHash('sha256').update(content, 'utf8').digest('hex');
}
/**
 * Verify the integrity of a chain of audit entries.
 *
 * For each entry:
 *   1. `prevHash` must match the previous entry's `hash` (empty string for index 0).
 *   2. The recomputed hash of the entry's fields must match the stored `hash`.
 *
 * Returns true only when every entry passes both checks.
 */
export function verifyChain(entries) {
    for (let i = 0; i < entries.length; i++) {
        const entry = entries[i];
        if (entry === undefined) {
            return false;
        }
        const expectedPrevHash = i === 0 ? '' : (entries[i - 1]?.hash ?? '');
        if (entry.prevHash !== expectedPrevHash) {
            return false;
        }
        const { hash, ...rest } = entry;
        if (hashEntry(rest) !== hash) {
            return false;
        }
    }
    return true;
}
//# sourceMappingURL=hasher.js.map