yanacuti1121/yana-ai/append-only-hypercore

import Hypercore from 'hypercore'
import { join }  from 'path'
const AUDIT_DIR = './releases/logs/hypercore-audit'
// Writer feed (local audit log)
const feed = new Hypercore(join(AUDIT_DIR, 'feed'), {
  valueEncoding: 'json',
})
await feed.ready()
console.log('[hypercore] public key:', feed.key.toString('hex'))
console.log('[hypercore] length:', feed.length)
// Append audit entry (returns sequence number)
async function appendAuditEntry(entry: object): Promise<number> {
  const seq = await feed.append(entry)
  console.log(`[hypercore] appended seq=${seq}`)
  return seq
}
await appendAuditEntry({
  ts:      new Date().toISOString(),
  level:   'info',
  action:  'tool-call',
  cmd:     'sandbox-exec',
  session: process.env.YAMTAM_SESSION_ID,
})

// Read single entry by sequence number
const entry = await feed.get(0)  // first entry
// Read range
for (let i = 0; i < feed.length; i++) {
  const e = await feed.get(i)
  console.log(`[${i}]`, e)
}
// Create readable stream
const stream = feed.createReadStream({ start: 0, end: feed.length, live: false })
stream.on('data', (entry) => console.log(entry))

import net from 'net'
// Server: expose feed for replication
const server = net.createServer((socket) => {
  const replicationStream = feed.replicate(false, { live: true })
  replicationStream.pipe(socket).pipe(replicationStream)
})
server.listen(9000, '127.0.0.1')
// Client: connect and sync
const socket     = net.connect(9000, '127.0.0.1')
const remoteFeed = new Hypercore(join(AUDIT_DIR, 'remote'), feed.key, {
  valueEncoding: 'json',
})
await remoteFeed.ready()
const replStream = remoteFeed.replicate(true, { live: true })
replStream.pipe(socket).pipe(replStream)

// Hypercore has built-in Merkle tree — every get() verifies the proof automatically
// To explicitly check integrity:
async function verifyEntry(seq: number): Promise<boolean> {
  try {
    await feed.get(seq)  // throws if Merkle proof fails
    return true
  } catch {
    return false
  }
}

❌ feed not await ready() before operations → operations fail silently
❌ Writable feed without key backup → feed is unrecoverable if storage deleted
❌ No replication → single point of failure for audit log
❌ valueEncoding not set → raw Buffer returned, not parsed JSON
❌ live:true replication without auth → any peer can replicate private audit data
❌ feed.close() not called on exit → storage corruption possible on crash