Function verifyAuditLog

src/cli/maintain-audit.ts:195–214

(log: SignedAuditLog, key?: string)

 * and (when a key is available) the HMAC signature. PURE. `ok` = everything checkable passed.
 */
export function verifyAuditLog(log: SignedAuditLog, key?: string): AuditVerifyResult {
  const entries = Array.isArray(log?.entries) ? log.entries : [];
  const chain = verifyAuditChain(entries);
  const recomputedHead = chainHead(entries);
  const headMatches = recomputedHead === log?.head;
  const signaturePresent = !!log?.signature;
  let signatureValid: boolean | undefined;
  if (signaturePresent && key) signatureValid = verifyChainSignature(log.head, log.signature!, key);
  const ok = chain.valid && headMatches && (!signaturePresent || signatureValid === true);
  return {
    ok,
    chainValid: chain.valid,
    brokenAt: chain.brokenAt,
    reason: chain.reason,
    signaturePresent,
    signatureValid,
    headMatches,
    count: entries.length,
  };
}