Function buildSignedAuditLog

src/cli/maintain-audit.ts:125–141

(runs: AuditableRun[], opts: { exportedAt: string; key?: string })

/** Assemble the exportable log, signing the head when a key is provided. PURE (pass `exportedAt`). */
export function buildSignedAuditLog(runs: AuditableRun[], opts: { exportedAt: string; key?: string }): SignedAuditLog {
  const entries = buildAuditChain(runs);
  const head = chainHead(entries);
  const base: SignedAuditLog = {
    kind: 'qodex-maintain-audit',
    version: MAINTAIN_AUDIT_VERSION,
    exportedAt: opts.exportedAt,
    count: entries.length,
    head,
    entries,
    algo: 'sha256-chain',
  };
  if (opts.key) {
    return { ...base, algo: 'sha256-chain+hmac-sha256', keyId: keyIdFor(opts.key), signature: signChainHead(head, opts.key) };
  }
  return base;
}

/** Serialize to pretty JSON. PURE. */
export function serializeAuditLog(log: SignedAuditLog): string {