@degenerate/sharedata 0.4.0 → 0.7.0

package/dist/share-data/share-data.js

@@ -31,6 +31,7 @@ class ShareData {
         this._signingCurve = signingCurve;
         this._structuralProofs = [];
         this._authorizedSigners = [];
+        this._ruleReferences = [];
     }
     /**
      * This initializes the cryptographic properties of the share data
@@ -150,6 +151,14 @@ class ShareData {
     get authorizedSigners() {
         return this._authorizedSigners;
     }
+    /**
+     * The library rule references governing this block. Each binding pairs a
+     * library reference (id + pinned `currentHash`) with the root property it
+     * governs. Frozen after `initialize()` like rules/functions.
+     */
+    get ruleReferences() {
+        return this._ruleReferences;
+    }
     /**
      * This gets the transaction history for the share block
      */
@@ -200,6 +209,64 @@ class ShareData {
         this._structuralProofs.push(cryptoProof);
         this._rules.push(rule);
     }
+    /**
+     * Registers a library rule reference governing this block. The reference
+     * (id + pinned `currentHash`) plus the governed `targettedProperty` are
+     * folded into the signed structure, so a tampered snapshot cannot add or
+     * retarget a rule reference without breaking the hash chain. Creation-time
+     * only (rejected once locked); verified against the pre-append state,
+     * mirroring `addRule` / `addFunction`.
+     */
+    addRuleReference(binding, cryptoProof) {
+        if (this._isLocked) {
+            throw new generic_1.ShareDataIsLockedError(this._id, generic_1.ShareDataTypes.RULE);
+        }
+        // Pre-append verification: the signer signed over the state before this
+        // reference was added.
+        this.verifyStructuralProof(cryptoProof);
+        this._structuralProofs.push(cryptoProof);
+        this._ruleReferences.push(binding);
+    }
+    /**
+     * Injects the library store used to resolve this block's rule references at
+     * change time. This is runtime infrastructure — it is NOT folded into the
+     * canonical hash or the signed structure, so setting it does not affect any
+     * proof. Replacing the store clears the resolved-rule cache.
+     */
+    setLibraryStore(store) {
+        this._libraryStore = store;
+        this._hydratedReferenceRules = undefined;
+    }
+    /**
+     * Resolves `_ruleReferences` into executable applied rules via the library
+     * store, materializing the lean "reference" block into the rules needed to
+     * evaluate a change. The result is cached (references are pinned to
+     * content-addressed versions, so the resolution is stable). Fail-closed: if
+     * references exist but no store was injected, evaluation refuses to proceed
+     * rather than silently dropping the governing rules.
+     */
+    async resolveReferenceRules() {
+        if (this._ruleReferences.length === 0) {
+            return [];
+        }
+        if (this._hydratedReferenceRules) {
+            return this._hydratedReferenceRules;
+        }
+        if (!this._libraryStore) {
+            throw new generic_1.ShareDataLibraryStoreNotSetError(this._id);
+        }
+        const resolved = [];
+        for (const binding of this._ruleReferences) {
+            const { version } = await (0, generic_1.resolveLibraryReference)(binding.reference, this._libraryStore);
+            // A rule entity's source is the canonical applied-rule DEFINITION;
+            // the binding carries the routed `targettedProperty` as a backstop
+            // for sources that predate embedding it.
+            const rule = JSON.parse(version.source);
+            resolved.push({ ...rule, targettedProperty: rule.targettedProperty ?? binding.targettedProperty });
+        }
+        this._hydratedReferenceRules = resolved;
+        return resolved;
+    }
     /**
      * Delegates `signerPublicKey` the right to propose runtime transactions for
      * the given `functionIds` (and ONLY those — least privilege). Creation-time
@@ -320,7 +387,7 @@ class ShareData {
      * @param proposedData the proposed data
      * @param transactionFunction the function that was attempted
      */
-    addTransactionNotValidated(proposedData, transactionFunction) {
+    async addTransactionNotValidated(proposedData, transactionFunction) {
         return this.evaluateAndApply(proposedData, transactionFunction);
     }
     /**
@@ -356,7 +423,7 @@ class ShareData {
      * @param transactionFunction the function producing `proposedData`
      * @param proof the transaction proposal proof authorizing the change
      */
-    addTransaction(proposedData, transactionFunction, proof) {
+    async addTransaction(proposedData, transactionFunction, proof) {
         // Gate 1: function registered on this block.
         if (!this._functions.includes(transactionFunction)) {
             throw new Error('The function is not known');
@@ -392,13 +459,28 @@ class ShareData {
      * (proof already verified by the caller). When `proof` is supplied it is
      * recorded on the history entry so the audit log carries the signature.
      */
-    evaluateAndApply(proposedData, transactionFunction, proof) {
+    async evaluateAndApply(proposedData, transactionFunction, proof) {
         // make sure the function is known.
         if (!this._functions.includes(transactionFunction)) {
             // throw ShareDataFunctionBeingAppliedDoesNotExistOnShareDataError
             throw new Error('The function is not known');
         }
-        const rulesOutcome = (0, rules_1.startRuleEvaluation)(this._id, transactionFunction, this.functions, this._rules, this._currentState, proposedData);
+        // Rule gate. The data must actually change (the engine's guard, inlined
+        // so the no-op path stays decoupled from the rules module), then the
+        // block's rules are evaluated in the SANDBOX (untrusted) under the
+        // engine's trusted per-property routing. `evaluateRulesViaSandbox` is
+        // faithfulness-proven to match `startRuleEvaluation`'s verdict.
+        if (JSON.stringify(this._currentState) === JSON.stringify(proposedData)) {
+            throw new generic_1.ShareDataCurrentAndProposalDataMatchesError(this._id);
+        }
+        // Hydrate any library rule references into executable rules and evaluate
+        // them alongside the inline `_rules`. When the block carries no
+        // references (every block today), this resolves to `_rules` unchanged.
+        const referenceRules = await this.resolveReferenceRules();
+        const effectiveRules = referenceRules.length > 0
+            ? [...this._rules, ...referenceRules]
+            : this._rules;
+        const rulesOutcome = await (0, rules_1.evaluateRulesViaSandbox)(effectiveRules, this._currentState, proposedData);
         const transactionTime = Date.now();
         const transactionId = (this._transactionHistory.length + 1).toString();
         const transaction = {
@@ -426,6 +508,9 @@ class ShareData {
         // return share data with a new ID
         const newShareData = new ShareData(`${this._id}-${transactionNumber}`, publicKey);
         newShareData._rules = [...this._rules];
+        newShareData._ruleReferences = [...this._ruleReferences];
+        // Carry the resolver so a copied block can still hydrate its references.
+        newShareData._libraryStore = this._libraryStore;
         newShareData._functions = [...this._functions];
         newShareData._transactionHistory = [...this._transactionHistory];
         newShareData._events = [...this._events];
@@ -448,8 +533,8 @@ class ShareData {
      * success; throws `ShareDataStructuralProofFailedError` on any mismatch
      * (hash, previousHash, signature, or purpose).
      */
-    verifyStructuralProof(proof, curve = this._signingCurve) {
-        return (0, verify_share_data_proposal_proof_1.verifyShareDataProposalProof)(proof, this, curve);
+    verifyStructuralProof(proof) {
+        return (0, verify_share_data_proposal_proof_1.verifyShareDataProposalProof)(proof, this);
     }
     /**
      * Verifies that `proof` authorizes applying a transaction that moves this
@@ -459,8 +544,8 @@ class ShareData {
      * verify against any other. Returns `true`; throws
      * `ShareDataTransactionProofFailedError` on any mismatch.
      */
-    verifyTransactionProof(proof, proposedData, curve = this._signingCurve) {
-        return (0, verify_transaction_proposal_proof_1.verifyTransactionProposalProof)(proof, this, proposedData, curve);
+    verifyTransactionProof(proof, proposedData) {
+        return (0, verify_transaction_proposal_proof_1.verifyTransactionProposalProof)(proof, this, proposedData);
     }
     //#endregion Crypto Proofs
     //#region Structure Proofs
@@ -485,6 +570,3 @@ class ShareData {
     }
 }
 exports.ShareData = ShareData;
-const itiem2 = new ShareData('1', '1234');
-const item = new ShareData('1', '1234');
-item.initialize();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@degenerate/sharedata",
-  "version": "0.4.0",
+  "version": "0.7.0",
   "description": "This contains the ShareData Adaptive Framework Ecosystem (SAFE) network core code",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -49,10 +49,10 @@
     "url": "https://github.com/syncrude/safe/issues"
   },
   "homepage": "https://github.com/syncrude/safe#readme",
-  "gitHead": "9453d9ab785e03fd01eb5b408ed0e3ca22baefd5",
+  "gitHead": "1f747e160c9022863c7b2d7b8a6a157f204be95b",
   "dependencies": {
-    "@degenerate/generic": "^0.4.0",
-    "@degenerate/rules": "^0.4.0",
+    "@degenerate/generic": "^0.7.0",
+    "@degenerate/rules": "^0.7.0",
     "zod": "^4.4.3"
   },
   "engines": {