Function keyIdFor

src/cli/maintain-audit.ts:107–109

(key: string)

/** A non-secret label for a key: a short hash prefix, so an exported log says WHICH key signed it. PURE. */
export function keyIdFor(key: string): string {
  return sha256('qodex-audit-key:' + key).slice(0, 12);
}

/** HMAC-SHA256 over the chain head. PURE (deterministic). */
export function signChainHead(head: string, key: string): string {