{
  "version": 1,
  "entries": [
    {
      "path": "Dockerfile",
      "purpose": "Digest-pinned TLS initializer build"
    },
    {
      "path": "server/scripts/check-health.mjs",
      "purpose": "Loopback API health probe with configured CA and api-hostname verification; local liveness-only TLS when no CA is configured"
    },
    {
      "path": "nginx.conf",
      "purpose": "Verified TLS 1.2/1.3 reverse-proxy connection to the API service"
    },
    {
      "path": "scripts/internal-tls.sh",
      "purpose": "Per-install P-256 CA and API certificate generation, verification and rotation"
    },
    {
      "path": "scripts/check-ui-primitives.mjs",
      "purpose": "Unkeyed SHA-256 source-integrity digests for deliberate review of source-owned UI primitive changes"
    },
    {
      "path": "server/scripts/rehearse/rehearsalChecks.ts",
      "purpose": "Unkeyed SHA-256 database-state digests for temporary anonymised migration rollback rehearsals"
    },
    {
      "path": "server/src/routes/importRoutes.ts",
      "purpose": "Deterministic SHA-256 fingerprint of the account's scoped import snapshot so equivalent reads compare equal and any accepted tenant mutation changes the token"
    },
    {
      "path": "server/src/routes/stateRoutes.ts",
      "purpose": "Deterministic SHA-256 workspace identifiers derived from the command id so a retried create addresses the same workspace"
    },
    {
      "path": "server/src/auditOutboxRecovery.ts",
      "purpose": "Unkeyed SHA-256 integrity digests for exact preserved malformed audit-outbox evidence"
    },
    {
      "path": "server/src/accounts/betterAuthIdentityPort.ts",
      "purpose": "A per-port-instance 256-bit compensation key, key-bound SHA-256 compensation handles and constant-time compensation-handle verification"
    },
    {
      "path": "server/src/accounts/commands.ts",
      "purpose": "Domain-separated unkeyed SHA-256 digests for canonical idempotency payload comparison without retaining bearer/password inputs"
    },
    {
      "path": "server/src/accounts/buildApplicationSessionHandle.ts",
      "purpose": "Domain-separated SHA-256 application-local handles that prevent session bearer tokens crossing the account boundary"
    },
    {
      "path": "server/src/auth.ts",
      "purpose": "Constant-time setup token comparison"
    },
    {
      "path": "server/src/authConfig/authAdapter.ts",
      "purpose": "192-bit CSPRNG identifiers for explicit federated-link ceremonies"
    },
    {
      "path": "server/src/authConfig/authFromEnv.ts",
      "purpose": "192-bit CSPRNG claim tokens for first-owner signup and Better Auth MFA/session configuration"
    },
    {
      "path": "server/src/authConfig/bootstrapAdmin.ts",
      "purpose": "Independent 192-bit CSPRNG credential user and account identifiers and first-owner bootstrap claim tokens"
    },
    {
      "path": "server/src/authConfig/errorRedirect.ts",
      "purpose": "SHA-256 of the OAuth state parameter to look up the stored verification row when redirecting a failed federated sign-in"
    },
    {
      "path": "server/src/authConfig/passwordPolicy.ts",
      "purpose": "Better Auth email-and-password policy: length and breached-password screening ahead of the configured password hasher, invoked through the shared hash-with-backpressure boundary"
    },
    {
      "path": "server/src/federatedLinkLifecycle.ts",
      "purpose": "192-bit CSPRNG non-secret identifiers for bounded federated-link callback ceremonies"
    },
    {
      "path": "server/src/controlTables/inviteTokens.ts",
      "purpose": "SHA-256 invite-token indexing and CSPRNG non-secret identifiers"
    },
    {
      "path": "server/src/db/migrationLedger.ts",
      "purpose": "Unkeyed SHA-256 identity checksums for immutable non-secret database migration definitions"
    },
    {
      "path": "server/src/internalTls.ts",
      "purpose": "Fail-closed internal HTTPS identity loading with a TLS 1.2 minimum"
    },
    {
      "path": "server/src/index.ts",
      "purpose": "Internal TLS environment loading and HTTPS listener activation"
    },
    {
      "path": "server/src/passwordSecurity.ts",
      "purpose": "Versioned scrypt password storage, constant-time verification and HIBP SHA-1 range prefix"
    },
    {
      "path": "server/src/resetOwnerPassword.ts",
      "purpose": "Domain-separated unkeyed SHA-256 ceremony digest of an operator-issued reset token for auditing without retaining the credential, plus CSPRNG audit event identifiers"
    },
    {
      "path": "server/src/routes/masqueradeRoutes.ts",
      "purpose": "256-bit CSPRNG opaque end tokens held only in the process-local session masquerade registry, plus CSPRNG non-secret audit identifiers"
    },
    {
      "path": "server/src/productionGuard.ts",
      "purpose": "Production warning when internal TLS is absent and posture handling for configured identities"
    },
    {
      "path": "server/src/strictOidc.ts",
      "purpose": "JOSE verification of asymmetric signed OIDC ID tokens with issuer, audience, timestamp and remotely rotated JWKS enforcement"
    },
    {
      "path": "server/src/syncOrdering.ts",
      "purpose": "Unkeyed SHA-256 digests of non-secret synchronised row state for exact same-session successor-write provenance checks"
    },
    {
      "path": "shared/src/lib/id.ts",
      "purpose": "Secure-context UUID generation"
    },
    {
      "path": "src/data/offline/crypto.ts",
      "purpose": "Non-extractable AES-256-GCM offline snapshot encryption with random IV and AAD"
    },
    {
      "path": "src/data/offline/records.ts",
      "purpose": "AES-256-GCM offline snapshot decryption and authentication with record-key and timestamp AAD"
    },
    {
      "path": "public/offline-worker.js",
      "purpose": "CSPRNG installation identifiers that isolate staged service-worker shell caches until activation"
    },
    {
      "path": "src/data/sync/state.ts",
      "purpose": "CSPRNG non-secret browser sync-session identifiers for server-side request ordering"
    },
    {
      "path": "src/account/accountCommands.ts",
      "purpose": "Secure-context UUID generation for non-secret account-command correlation and safe unknown-outcome reconciliation"
    },
    {
      "path": "src/account/commandOutcome.ts",
      "purpose": "SHA-256 semantic payload fingerprints for non-secret account-command correlation and safe unknown-outcome reconciliation"
    },
    {
      "path": ".github/workflows/security.yml",
      "purpose": "OpenSSL generation of ephemeral authentication secrets and bootstrap tokens for isolated CI security checks"
    },
    {
      "path": "docker-compose.yml",
      "purpose": "Internal TLS certificate, key and CA path wiring between the API and reverse proxy containers"
    },
    {
      "path": "server/src/accounts/identityPort/instants.ts",
      "purpose": "Domain-separated SHA-256 fallback session handles"
    },
    {
      "path": "server/src/accounts/identityPort/credentials.ts",
      "purpose": "Domain-separated SHA-256 reset ceremony handles"
    },
    {
      "path": "server/src/accounts/adminPort/invitations.ts",
      "purpose": "256-bit CSPRNG invitation bearers"
    },
    {
      "path": "server/src/accounts/adminPort/invitationClaims.ts",
      "purpose": "Domain-separated SHA-256 bearer indexing for account commands"
    }
  ]
}