@degenerate/sharedata 0.2.7 → 0.4.0

package/dist/share-data/proofs/helpers/create-transaction-proposal-string-to-sign.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTransactionProposalStringToSign = void 0;
+/**
+ * Builds the canonical string a transaction proposal proof signs over.
+ *
+ * Deliberately distinct from `createShareDataStringToSign` (the structural /
+ * creation proof payload). A structural proof signs
+ * `${hash}${previousHash}${timestamp}` with no delimiters; this payload adds a
+ * `tx:` prefix, pipe delimiters, the *proposed* state hash, and the function
+ * id. Because the two signed strings can never collide, a structural proof's
+ * signature can never satisfy transaction verification and vice versa — the
+ * proof kinds are cryptographically non-interchangeable even though they share
+ * the `IShareDataCryptoProof` wire shape.
+ *
+ * The `proposedStateHash` component is what closes the runtime replay hole:
+ * the signature binds the exact post-transaction state, so a proof minted for
+ * a 1000-unit deposit cannot authorize a 9000-unit deposit.
+ *
+ * @param currentShareDataHash hash of the share-data state before the transaction
+ * @param proposedStateHash hash of the proposed (post-transaction) state
+ * @param functionId id of the function authorized to produce the proposed state
+ * @param previousShareDataHash previous hash anchoring the chain position
+ * @param timeStamp the timestamp folded into the signature
+ */
+const createTransactionProposalStringToSign = (currentShareDataHash, proposedStateHash, functionId, previousShareDataHash, timeStamp) => {
+    return `tx:${currentShareDataHash}|${proposedStateHash}|${functionId}|${previousShareDataHash}|${timeStamp}`;
+};
+exports.createTransactionProposalStringToSign = createTransactionProposalStringToSign;

package/dist/share-data/proofs/helpers/get-previous-hash-from-share-data.d.ts

@@ -0,0 +1,9 @@
+import { ShareData } from '../../share-data';
+/**
+ * This gets the previous hash from the share data object.
+ *
+ * @param shareData the share data object
+ * @returns the previous hash
+ */
+export declare const getPreviousHashFromShareData: (shareData: ShareData) => string;
+//# sourceMappingURL=get-previous-hash-from-share-data.d.ts.map

package/dist/share-data/proofs/helpers/get-previous-hash-from-share-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-previous-hash-from-share-data.d.ts","sourceRoot":"","sources":["../../../../src/share-data/proofs/helpers/get-previous-hash-from-share-data.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,GAAI,WAAW,SAAS,KAAG,MAmBnE,CAAC"}

package/dist/share-data/proofs/helpers/get-previous-hash-from-share-data.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPreviousHashFromShareData = void 0;
+const generic_1 = require("@degenerate/generic");
+/**
+ * This gets the previous hash from the share data object.
+ *
+ * @param shareData the share data object
+ * @returns the previous hash
+ */
+const getPreviousHashFromShareData = (shareData) => {
+    if (shareData.isLocked) {
+        if (shareData.cryptoProofs.length !== 0) {
+            return shareData.cryptoProofs[shareData.cryptoProofs.length - 1].shareDataHash;
+        }
+        return shareData.structuralProofs[shareData.structuralProofs.length - 1].shareDataHash;
+    }
+    if (shareData.structuralProofs.length !== 0) {
+        return shareData.structuralProofs[shareData.structuralProofs.length - 1].shareDataHash;
+    }
+    // If the share data is not locked and there are no structural proofs,
+    // then the creation hash is the previous hash
+    if (!shareData.creationHash) {
+        throw new generic_1.ShareDataPreviousHashNotAvailableError(shareData.id);
+    }
+    return shareData.creationHash;
+};
+exports.getPreviousHashFromShareData = getPreviousHashFromShareData;

package/dist/share-data/proofs/helpers/hash-proposed-state.d.ts

@@ -0,0 +1,12 @@
+import { IShareData } from '@degenerate/generic';
+/**
+ * Canonical hash of a proposed ShareData state.
+ *
+ * Uses the same serialization the default string config applies to the live
+ * `currentState` (`JSON.stringify` via `stringify`), so a proposed state
+ * hashes identically whether it is computed here at signing time or recomputed
+ * at verify time from the same object. Keeping this in one helper guarantees
+ * the signer and verifier never drift apart on how proposed state is hashed.
+ */
+export declare const hashProposedState: (proposedState: IShareData) => string;
+//# sourceMappingURL=hash-proposed-state.d.ts.map

package/dist/share-data/proofs/helpers/hash-proposed-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash-proposed-state.d.ts","sourceRoot":"","sources":["../../../../src/share-data/proofs/helpers/hash-proposed-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGhE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAI,eAAe,UAAU,KAAG,MAE7D,CAAC"}

package/dist/share-data/proofs/helpers/hash-proposed-state.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashProposedState = void 0;
+const generic_1 = require("@degenerate/generic");
+const stringify_1 = require("../../helpers/config/stringify");
+/**
+ * Canonical hash of a proposed ShareData state.
+ *
+ * Uses the same serialization the default string config applies to the live
+ * `currentState` (`JSON.stringify` via `stringify`), so a proposed state
+ * hashes identically whether it is computed here at signing time or recomputed
+ * at verify time from the same object. Keeping this in one helper guarantees
+ * the signer and verifier never drift apart on how proposed state is hashed.
+ */
+const hashProposedState = (proposedState) => {
+    return (0, generic_1.calculateHash)((0, stringify_1.stringify)(proposedState));
+};
+exports.hashProposedState = hashProposedState;

package/dist/share-data/proofs/testing/test-proof-signer.d.ts

@@ -0,0 +1,53 @@
+import { EllipticalCurvesSigning, IShareData, IShareDataCryptoProof } from '@degenerate/generic';
+import { ShareData } from '../../share-data';
+/**
+ * Generate a fresh elliptic keypair suitable for signing ShareData proofs
+ * in tests. Returns the hex-encoded private and public keys so the caller
+ * can use the public half as the ShareData's `creationPublicKey` and the
+ * private half to mint real signed proofs.
+ *
+ * Test-only helper — not exported from the package barrel. Real signing
+ * keys must come from a key manager in production.
+ */
+export declare const generateTestSigningKey: (curve?: EllipticalCurvesSigning) => {
+    privateKey: string;
+    publicKey: string;
+};
+/**
+ * Build a `(purpose, shareData) => IShareDataCryptoProof` callback that
+ * signs each requested proof with `privateKey`. On the very first call for
+ * a given `shareData`, initializes its crypto chain (matches
+ * `buildEllipticalCurvesProofFor` in `@degenerate/shareblock` — the two
+ * helpers serve the same role at different layers).
+ *
+ * Test-only helper. Production signing flows should use
+ * `buildEllipticalCurvesProofFor` from `@degenerate/shareblock` which
+ * handles the same plumbing through a documented public API.
+ */
+export declare const createTestProofFor: (privateKey: string, curve?: EllipticalCurvesSigning) => (purpose: string, shareData: ShareData) => IShareDataCryptoProof;
+/**
+ * Build a `(proposedState, functionId, shareData) => IShareDataCryptoProof`
+ * callback that mints a *transaction* proposal proof (binds the proposed
+ * state + functionId, see `createTransactionProposalProof`). Use this for the
+ * runtime mutation path — `ShareData.addTransaction` /
+ * `ShareDataManager.applyTransaction` / realtime `propose` — where the proof
+ * must authorize one exact state change, unlike the structural proofs minted
+ * by {@link createTestProofFor}.
+ *
+ * Test-only helper. Production flows mint these from a key manager.
+ */
+export declare const createTestTransactionProofFor: (privateKey: string, curve?: EllipticalCurvesSigning) => (proposedState: IShareData, functionId: string, shareData: ShareData) => IShareDataCryptoProof;
+/**
+ * Convenience wrapper: generate a fresh signing keypair AND return a
+ * matching proof signer in one call. Returns both so the test can use the
+ * public key when constructing the ShareData under test. `proofFor` mints
+ * structural proofs (addFunction/addRule); `transactionProofFor` mints
+ * runtime transaction proposal proofs.
+ */
+export declare const generateTestSigner: (curve?: EllipticalCurvesSigning) => {
+    privateKey: string;
+    publicKey: string;
+    proofFor: ReturnType<typeof createTestProofFor>;
+    transactionProofFor: ReturnType<typeof createTestTransactionProofFor>;
+};
+//# sourceMappingURL=test-proof-signer.d.ts.map

package/dist/share-data/proofs/testing/test-proof-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-proof-signer.d.ts","sourceRoot":"","sources":["../../../../src/share-data/proofs/testing/test-proof-signer.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,uBAAuB,EACvB,UAAU,EACV,qBAAqB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAK7C;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAC/B,QAAO,uBAA4D,KACpE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAOzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAC3B,YAAY,MAAM,EAClB,QAAO,uBAA4D,MAE3D,SAAS,MAAM,EAAE,WAAW,SAAS,KAAG,qBAYnD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,GACtC,YAAY,MAAM,EAClB,QAAO,uBAA4D,MAG/D,eAAe,UAAU,EACzB,YAAY,MAAM,EAClB,WAAW,SAAS,KACrB,qBAEN,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC3B,QAAO,uBAA4D,KACpE;IACC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAChD,mBAAmB,EAAE,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC;CASzE,CAAC"}

package/dist/share-data/proofs/testing/test-proof-signer.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateTestSigner = exports.createTestTransactionProofFor = exports.createTestProofFor = exports.generateTestSigningKey = void 0;
+/* eslint-disable new-cap */
+const elliptic = __importStar(require("elliptic"));
+const generic_1 = require("@degenerate/generic");
+const create_share_data_initial_crypto_1 = require("../../creation/create-share-data-initial-crypto");
+const create_share_data_proposal_proof_1 = require("../creation/create-share-data-proposal-proof");
+const create_transaction_proposal_proof_1 = require("../creation/create-transaction-proposal-proof");
+/**
+ * Generate a fresh elliptic keypair suitable for signing ShareData proofs
+ * in tests. Returns the hex-encoded private and public keys so the caller
+ * can use the public half as the ShareData's `creationPublicKey` and the
+ * private half to mint real signed proofs.
+ *
+ * Test-only helper — not exported from the package barrel. Real signing
+ * keys must come from a key manager in production.
+ */
+const generateTestSigningKey = (curve = generic_1.EllipticalCurvesSigning.Curve25519) => {
+    const ec = new elliptic.ec(curve);
+    const keyPair = ec.genKeyPair();
+    return {
+        privateKey: keyPair.getPrivate('hex'),
+        publicKey: keyPair.getPublic('hex'),
+    };
+};
+exports.generateTestSigningKey = generateTestSigningKey;
+/**
+ * Build a `(purpose, shareData) => IShareDataCryptoProof` callback that
+ * signs each requested proof with `privateKey`. On the very first call for
+ * a given `shareData`, initializes its crypto chain (matches
+ * `buildEllipticalCurvesProofFor` in `@degenerate/shareblock` — the two
+ * helpers serve the same role at different layers).
+ *
+ * Test-only helper. Production signing flows should use
+ * `buildEllipticalCurvesProofFor` from `@degenerate/shareblock` which
+ * handles the same plumbing through a documented public API.
+ */
+const createTestProofFor = (privateKey, curve = generic_1.EllipticalCurvesSigning.Curve25519) => {
+    return (purpose, shareData) => {
+        if (!shareData.creationHash && shareData.structuralProofs.length === 0) {
+            const initialCrypto = (0, create_share_data_initial_crypto_1.createShareDataInitialCrypto)(privateKey, shareData, curve);
+            shareData.initializeCrypto(initialCrypto);
+        }
+        return (0, create_share_data_proposal_proof_1.createShareDataProposalProof)(privateKey, shareData, { purpose }, curve);
+    };
+};
+exports.createTestProofFor = createTestProofFor;
+/**
+ * Build a `(proposedState, functionId, shareData) => IShareDataCryptoProof`
+ * callback that mints a *transaction* proposal proof (binds the proposed
+ * state + functionId, see `createTransactionProposalProof`). Use this for the
+ * runtime mutation path — `ShareData.addTransaction` /
+ * `ShareDataManager.applyTransaction` / realtime `propose` — where the proof
+ * must authorize one exact state change, unlike the structural proofs minted
+ * by {@link createTestProofFor}.
+ *
+ * Test-only helper. Production flows mint these from a key manager.
+ */
+const createTestTransactionProofFor = (privateKey, curve = generic_1.EllipticalCurvesSigning.Curve25519) => {
+    return (proposedState, functionId, shareData) => (0, create_transaction_proposal_proof_1.createTransactionProposalProof)(privateKey, shareData, proposedState, functionId, curve);
+};
+exports.createTestTransactionProofFor = createTestTransactionProofFor;
+/**
+ * Convenience wrapper: generate a fresh signing keypair AND return a
+ * matching proof signer in one call. Returns both so the test can use the
+ * public key when constructing the ShareData under test. `proofFor` mints
+ * structural proofs (addFunction/addRule); `transactionProofFor` mints
+ * runtime transaction proposal proofs.
+ */
+const generateTestSigner = (curve = generic_1.EllipticalCurvesSigning.Curve25519) => {
+    const { privateKey, publicKey } = (0, exports.generateTestSigningKey)(curve);
+    return {
+        privateKey,
+        publicKey,
+        proofFor: (0, exports.createTestProofFor)(privateKey, curve),
+        transactionProofFor: (0, exports.createTestTransactionProofFor)(privateKey, curve),
+    };
+};
+exports.generateTestSigner = generateTestSigner;

package/dist/share-data/proofs/verification/verify-share-data-proposal-proof.d.ts

@@ -0,0 +1,40 @@
+import { EllipticalCurvesSigning, IShareDataCryptoProof } from '@degenerate/generic';
+import { ShareData } from '../../share-data';
+/**
+ * Verifies that an `IShareDataCryptoProof` is a faithful attestation of the
+ * supplied `shareData`'s structural state. Returns `true` on success; throws
+ * {@link ShareDataStructuralProofFailedError} on any failure.
+ *
+ * The `purpose` to verify under is read from `proof.purpose` — proofs are
+ * self-describing so callers don't need to remember which purpose to verify
+ * with. This also means an attacker can't shift a proof's purpose to bypass
+ * verification (they'd need a fresh signature for the new purpose, which
+ * requires the private key).
+ *
+ * Synchronous on purpose — `addFunction` / `addRule` are synchronous and we
+ * don't want to cascade-async every caller in the codebase.
+ * `elliptic.ec().keyFromPublic().verify()` is itself synchronous; the
+ * project's existing `verifyCryptoSignatureByHash` wrapper is `async` only
+ * cosmetically.
+ *
+ * Verification proceeds in this order:
+ *   1. Recompute the canonical share-data string + hash, folding in
+ *      `proof.purpose`. If the proof's `shareDataHash` doesn't match,
+ *      reject. (Catches "proof signed against different state.")
+ *   2. Recompute the previous hash from the chain. If the proof's
+ *      `shareDataPreviousHash` doesn't match, reject. (Catches "proof claims
+ *      a different chain position.")
+ *   3. Reconstruct the signed string from the proof's now-validated hash,
+ *      previousHash, and timestamp, and verify the signature against the
+ *      proof's `publicKey`. (Catches "signature was tampered or signed with
+ *      a different key.")
+ *
+ * The order matters: skipping step 1 or 2 and going straight to signature
+ * verification would accept an attacker-crafted proof that claims to attest
+ * to one state while the actual share-data has a different state — the
+ * signature alone only proves the publicKey holder signed the
+ * `(hash, previousHash, timestamp)` triple, not that the hash matches
+ * anything real.
+ */
+export declare const verifyShareDataProposalProof: (proof: IShareDataCryptoProof, shareData: ShareData, ellipticalCurve?: EllipticalCurvesSigning) => true;
+//# sourceMappingURL=verify-share-data-proposal-proof.d.ts.map

package/dist/share-data/proofs/verification/verify-share-data-proposal-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-share-data-proposal-proof.d.ts","sourceRoot":"","sources":["../../../../src/share-data/proofs/verification/verify-share-data-proposal-proof.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,uBAAuB,EACvB,qBAAqB,EAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,4BAA4B,GACrC,OAAO,qBAAqB,EAC5B,WAAW,SAAS,EACpB,kBAAiB,uBAA4D,KAC9E,IAoDF,CAAC"}

package/dist/share-data/proofs/verification/verify-share-data-proposal-proof.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyShareDataProposalProof = void 0;
+const elliptic = __importStar(require("elliptic"));
+const generic_1 = require("@degenerate/generic");
+const calculate_share_data_string_1 = require("../../helpers/calculate-share-data-string");
+const get_previous_hash_from_share_data_1 = require("../helpers/get-previous-hash-from-share-data");
+const create_share_data_string_to_sign_1 = require("../helpers/create-share-data-string-to-sign");
+/**
+ * Verifies that an `IShareDataCryptoProof` is a faithful attestation of the
+ * supplied `shareData`'s structural state. Returns `true` on success; throws
+ * {@link ShareDataStructuralProofFailedError} on any failure.
+ *
+ * The `purpose` to verify under is read from `proof.purpose` — proofs are
+ * self-describing so callers don't need to remember which purpose to verify
+ * with. This also means an attacker can't shift a proof's purpose to bypass
+ * verification (they'd need a fresh signature for the new purpose, which
+ * requires the private key).
+ *
+ * Synchronous on purpose — `addFunction` / `addRule` are synchronous and we
+ * don't want to cascade-async every caller in the codebase.
+ * `elliptic.ec().keyFromPublic().verify()` is itself synchronous; the
+ * project's existing `verifyCryptoSignatureByHash` wrapper is `async` only
+ * cosmetically.
+ *
+ * Verification proceeds in this order:
+ *   1. Recompute the canonical share-data string + hash, folding in
+ *      `proof.purpose`. If the proof's `shareDataHash` doesn't match,
+ *      reject. (Catches "proof signed against different state.")
+ *   2. Recompute the previous hash from the chain. If the proof's
+ *      `shareDataPreviousHash` doesn't match, reject. (Catches "proof claims
+ *      a different chain position.")
+ *   3. Reconstruct the signed string from the proof's now-validated hash,
+ *      previousHash, and timestamp, and verify the signature against the
+ *      proof's `publicKey`. (Catches "signature was tampered or signed with
+ *      a different key.")
+ *
+ * The order matters: skipping step 1 or 2 and going straight to signature
+ * verification would accept an attacker-crafted proof that claims to attest
+ * to one state while the actual share-data has a different state — the
+ * signature alone only proves the publicKey holder signed the
+ * `(hash, previousHash, timestamp)` triple, not that the hash matches
+ * anything real.
+ */
+const verifyShareDataProposalProof = (proof, shareData, ellipticalCurve = generic_1.EllipticalCurvesSigning.Curve25519) => {
+    // Step 1: hash of current state matches what the proof claims. The
+    // purpose comes from the proof itself, so a tampered purpose produces
+    // a different hash and gets caught here.
+    const shareDataString = (0, calculate_share_data_string_1.calculateShareDataString)(shareData, undefined, { purpose: proof.purpose });
+    const recomputedHash = (0, generic_1.calculateHash)(shareDataString);
+    if (recomputedHash !== proof.shareDataHash) {
+        throw new generic_1.ShareDataStructuralProofFailedError(shareData.id);
+    }
+    // Step 2: previous-hash matches the chain.
+    let recomputedPreviousHash;
+    try {
+        recomputedPreviousHash = (0, get_previous_hash_from_share_data_1.getPreviousHashFromShareData)(shareData);
+    }
+    catch {
+        // ShareDataPreviousHashNotAvailableError — chain is in a state
+        // where no previous hash exists. The proof should not be claiming
+        // one either.
+        throw new generic_1.ShareDataStructuralProofFailedError(shareData.id);
+    }
+    if (recomputedPreviousHash !== proof.shareDataPreviousHash) {
+        throw new generic_1.ShareDataStructuralProofFailedError(shareData.id);
+    }
+    // Step 3: signature verifies against the proof's publicKey for the
+    // (now-validated) hash + previousHash + timestamp triple.
+    const signedString = (0, create_share_data_string_to_sign_1.createShareDataStringToSign)(proof.shareDataHash, proof.shareDataPreviousHash, proof.timestamp);
+    let signatureValid;
+    try {
+        // eslint-disable-next-line new-cap
+        const key = new elliptic.ec(ellipticalCurve).keyFromPublic(proof.publicKey, 'hex');
+        // Mirror the hash-before-sign step in `createEllipticalCurveSignature`
+        // so the verifier sees the same fixed-size 256-bit digest the signer
+        // operated on. Without this, elliptic's ECDSA on ed25519 silently
+        // truncates inputs longer than ~253 bits and the signature stops
+        // binding the trailing bytes (timestamp, tail of previousHash).
+        const digest = (0, generic_1.calculateHash)(signedString);
+        signatureValid = key.verify(digest, proof.shareDataSignature);
+    }
+    catch {
+        // elliptic throws on malformed signature/key strings rather than
+        // returning false — normalize to a single rejection mode.
+        throw new generic_1.ShareDataStructuralProofFailedError(shareData.id);
+    }
+    if (!signatureValid) {
+        throw new generic_1.ShareDataStructuralProofFailedError(shareData.id);
+    }
+    return true;
+};
+exports.verifyShareDataProposalProof = verifyShareDataProposalProof;

package/dist/share-data/proofs/verification/verify-transaction-proposal-proof.d.ts

@@ -0,0 +1,37 @@
+import { EllipticalCurvesSigning, IShareData, IShareDataCryptoProof } from '@degenerate/generic';
+import { ShareData } from '../../share-data';
+/**
+ * Verify a transaction proposal proof against the live `shareData` and the
+ * `proposedState` the caller intends to apply. Returns `true`; throws
+ * {@link ShareDataTransactionProofFailedError} on any mismatch.
+ *
+ * This is the runtime counterpart to `verifyShareDataProposalProof`. The
+ * critical extra step over the structural verifier is step 2: it recomputes
+ * the hash of the *proposed* state the caller is about to apply and folds it
+ * into the reconstructed signed string. A proof minted for one proposed state
+ * therefore fails for any other — the runtime replay hole is closed here, at
+ * the verification boundary, not by trusting the transport.
+ *
+ * Verification order:
+ *   1. Recompute the current-state hash (purpose = `proof.purpose` =
+ *      functionId); it must equal `proof.shareDataHash`. (Catches "proof
+ *      signed against a different current state.")
+ *   2. Recompute the proposed-state hash from `proposedState`. (Binds the
+ *      exact state being applied.)
+ *   3. Recompute the previous hash from the chain; it must equal
+ *      `proof.shareDataPreviousHash`. (Catches "proof claims a different
+ *      chain position.")
+ *   4. Reconstruct the transaction signed string from the validated current
+ *      hash, the recomputed proposed hash, the function id, the previous
+ *      hash, and the timestamp, and verify the signature against
+ *      `proof.publicKey`.
+ *
+ * Because the reconstructed string carries the `tx:` prefix and the proposed
+ * hash, a structural proof's signature can never satisfy this check — the two
+ * proof kinds are non-interchangeable.
+ *
+ * Synchronous to match the rest of the proof pipeline; elliptic's `verify`
+ * is itself synchronous.
+ */
+export declare const verifyTransactionProposalProof: (proof: IShareDataCryptoProof, shareData: ShareData, proposedState: IShareData, ellipticalCurve?: EllipticalCurvesSigning) => true;
+//# sourceMappingURL=verify-transaction-proposal-proof.d.ts.map

package/dist/share-data/proofs/verification/verify-transaction-proposal-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-transaction-proposal-proof.d.ts","sourceRoot":"","sources":["../../../../src/share-data/proofs/verification/verify-transaction-proposal-proof.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,uBAAuB,EACvB,UAAU,EACV,qBAAqB,EAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAK7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,8BAA8B,GACvC,OAAO,qBAAqB,EAC5B,WAAW,SAAS,EACpB,eAAe,UAAU,EACzB,kBAAiB,uBAA4D,KAC9E,IAwDF,CAAC"}

package/dist/share-data/proofs/verification/verify-transaction-proposal-proof.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyTransactionProposalProof = void 0;
+const elliptic = __importStar(require("elliptic"));
+const generic_1 = require("@degenerate/generic");
+const calculate_share_data_string_1 = require("../../helpers/calculate-share-data-string");
+const get_previous_hash_from_share_data_1 = require("../helpers/get-previous-hash-from-share-data");
+const create_transaction_proposal_string_to_sign_1 = require("../helpers/create-transaction-proposal-string-to-sign");
+const hash_proposed_state_1 = require("../helpers/hash-proposed-state");
+/**
+ * Verify a transaction proposal proof against the live `shareData` and the
+ * `proposedState` the caller intends to apply. Returns `true`; throws
+ * {@link ShareDataTransactionProofFailedError} on any mismatch.
+ *
+ * This is the runtime counterpart to `verifyShareDataProposalProof`. The
+ * critical extra step over the structural verifier is step 2: it recomputes
+ * the hash of the *proposed* state the caller is about to apply and folds it
+ * into the reconstructed signed string. A proof minted for one proposed state
+ * therefore fails for any other — the runtime replay hole is closed here, at
+ * the verification boundary, not by trusting the transport.
+ *
+ * Verification order:
+ *   1. Recompute the current-state hash (purpose = `proof.purpose` =
+ *      functionId); it must equal `proof.shareDataHash`. (Catches "proof
+ *      signed against a different current state.")
+ *   2. Recompute the proposed-state hash from `proposedState`. (Binds the
+ *      exact state being applied.)
+ *   3. Recompute the previous hash from the chain; it must equal
+ *      `proof.shareDataPreviousHash`. (Catches "proof claims a different
+ *      chain position.")
+ *   4. Reconstruct the transaction signed string from the validated current
+ *      hash, the recomputed proposed hash, the function id, the previous
+ *      hash, and the timestamp, and verify the signature against
+ *      `proof.publicKey`.
+ *
+ * Because the reconstructed string carries the `tx:` prefix and the proposed
+ * hash, a structural proof's signature can never satisfy this check — the two
+ * proof kinds are non-interchangeable.
+ *
+ * Synchronous to match the rest of the proof pipeline; elliptic's `verify`
+ * is itself synchronous.
+ */
+const verifyTransactionProposalProof = (proof, shareData, proposedState, ellipticalCurve = generic_1.EllipticalCurvesSigning.Curve25519) => {
+    // Step 1: current-state hash matches what the proof claims. The purpose
+    // (functionId) comes from the proof itself, so a tampered purpose
+    // produces a different hash and is caught here.
+    const currentString = (0, calculate_share_data_string_1.calculateShareDataString)(shareData, undefined, { purpose: proof.purpose });
+    const recomputedCurrentHash = (0, generic_1.calculateHash)(currentString);
+    if (recomputedCurrentHash !== proof.shareDataHash) {
+        throw new generic_1.ShareDataTransactionProofFailedError(shareData.id);
+    }
+    // Step 2: hash the proposed state being applied so it can be folded into
+    // the reconstructed signature payload.
+    const proposedStateHash = (0, hash_proposed_state_1.hashProposedState)(proposedState);
+    // Step 3: previous-hash matches the chain.
+    let recomputedPreviousHash;
+    try {
+        recomputedPreviousHash = (0, get_previous_hash_from_share_data_1.getPreviousHashFromShareData)(shareData);
+    }
+    catch {
+        // ShareDataPreviousHashNotAvailableError — chain has no previous hash;
+        // the proof should not be claiming one either.
+        throw new generic_1.ShareDataTransactionProofFailedError(shareData.id);
+    }
+    if (recomputedPreviousHash !== proof.shareDataPreviousHash) {
+        throw new generic_1.ShareDataTransactionProofFailedError(shareData.id);
+    }
+    // Step 4: signature verifies over the full transaction payload (which
+    // includes the proposed-state hash and the `tx:` discriminator).
+    const signedString = (0, create_transaction_proposal_string_to_sign_1.createTransactionProposalStringToSign)(proof.shareDataHash, proposedStateHash, proof.purpose, proof.shareDataPreviousHash, proof.timestamp);
+    let signatureValid;
+    try {
+        // eslint-disable-next-line new-cap
+        const key = new elliptic.ec(ellipticalCurve).keyFromPublic(proof.publicKey, 'hex');
+        // Mirror the hash-before-sign step in `createEllipticalCurveSignature`
+        // so the verifier operates on the same fixed-size digest the signer
+        // did. Without this, elliptic's ECDSA on ed25519 silently truncates
+        // long inputs and stops binding the trailing bytes.
+        const digest = (0, generic_1.calculateHash)(signedString);
+        signatureValid = key.verify(digest, proof.shareDataSignature);
+    }
+    catch {
+        // elliptic throws on malformed signature/key strings rather than
+        // returning false — normalize to a single rejection mode.
+        throw new generic_1.ShareDataTransactionProofFailedError(shareData.id);
+    }
+    if (!signatureValid) {
+        throw new generic_1.ShareDataTransactionProofFailedError(shareData.id);
+    }
+    return true;
+};
+exports.verifyTransactionProposalProof = verifyTransactionProposalProof;