@itechsmart/prooflink-verifier 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 iTechSmart Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,196 @@
+# ProofLink™ Verifier
+
+**Open-source cryptographic verification logic for iTechSmart UAIO receipts.**
+
+> Don't trust our AI. Trust the math.
+
+---
+
+## What is this?
+
+When iTechSmart's UAIO platform autonomously remediates infrastructure — restarting a crashed pod, patching a misconfiguration, rolling back a bad deployment — it generates a **ProofLink receipt**: a cryptographically signed, hash-chained record of exactly what happened, when, and why.
+
+This repository contains the **open-source verification logic** that anyone can use to independently confirm those receipts haven't been tampered with.
+
+You don't need to trust us. You can verify the math yourself.
+
+---
+
+## How it works
+
+Each ProofLink receipt contains:
+
+1. **SHA-256 hash** — computed over all fields of the receipt (deterministic, canonical JSON)
+2. **Previous hash** — the SHA-256 of the preceding receipt, creating a tamper-evident chain
+3. **Chain position** — sequential integer; gaps indicate missing receipts
+4. **Timestamp** — ISO 8601, must be chronologically ordered
+
+Altering **any** receipt in the chain invalidates **every subsequent receipt** — the same principle as Bitcoin's blockchain, applied to infrastructure audit trails.
+
+```
+Receipt 0 (genesis)           Receipt 1                    Receipt 2
+┌─────────────────────┐       ┌─────────────────────┐      ┌─────────────────────┐
+│ sha256: abc123...   │──────▶│ prev_hash: abc123... │─────▶│ prev_hash: def456...│
+│ prev_hash: null     │       │ sha256: def456...    │      │ sha256: ghi789...   │
+│ chain_position: 0   │       │ chain_position: 1    │      │ chain_position: 2   │
+└─────────────────────┘       └─────────────────────┘      └─────────────────────┘
+```
+
+If you alter Receipt 1's `action` field:
+- Its computed SHA-256 changes → `sha256` field no longer matches → **tamper detected**
+- Receipt 2's `prev_hash` no longer matches → **chain broken**
+
+---
+
+## Installation
+
+```bash
+npm install @itechsmart/prooflink-verifier
+```
+
+Or clone and use directly:
+
+```bash
+git clone https://github.com/Iteksmart/prooflink-verifier
+cd prooflink-verifier
+npm install
+```
+
+---
+
+## Usage
+
+### Verify a single receipt
+
+```typescript
+import { verifyReceipt } from '@itechsmart/prooflink-verifier'
+
+const result = verifyReceipt(receipt, previousReceipt)
+
+console.log(result.valid)           // true/false
+console.log(result.tamper_detected) // true if hash or chain broken
+console.log(result.checks)          // detailed check results
+console.log(result.errors)          // list of failures
+```
+
+### Verify an entire chain
+
+```typescript
+import { verifyChain } from '@itechsmart/prooflink-verifier'
+
+const receipts = await fetchReceiptsFromLedger()
+const result = verifyChain(receipts)
+
+console.log(result.chain_valid)      // true if all receipts intact
+console.log(result.tamper_detected)  // true if any tampering found
+console.log(result.tamper_position)  // which position was altered
+console.log(result.summary)          // human-readable summary
+```
+
+### Compute a hash yourself
+
+```typescript
+import { computeReceiptHash } from '@itechsmart/prooflink-verifier'
+
+const { sha256, ...receiptWithoutHash } = receipt
+const computed = computeReceiptHash(receiptWithoutHash)
+
+console.log(computed === receipt.sha256) // true if untampered
+```
+
+---
+
+## The canonical hash function
+
+The hash is computed over a deterministic JSON serialization of all fields **except** `sha256` itself:
+
+```typescript
+export function computeReceiptHash(receipt: Omit<ProofLinkReceipt, 'sha256'>): string {
+  const canonical = JSON.stringify({
+    receipt_id: receipt.receipt_id,
+    version: receipt.version,
+    timestamp: receipt.timestamp,
+    container: receipt.container,
+    executor: receipt.executor,
+    trigger: receipt.trigger,
+    action: receipt.action,
+    action_parameters: receipt.action_parameters,
+    before_state: receipt.before_state,
+    after_state: receipt.after_state,
+    nist_controls: receipt.nist_controls,
+    human_input: receipt.human_input,
+    arbiter_policy: receipt.arbiter_policy,
+    previous_hash: receipt.previous_hash,
+    chain_position: receipt.chain_position,
+  }, null, 0)
+
+  return crypto.createHash('sha256').update(canonical, 'utf8').digest('hex')
+}
+```
+
+The field ordering is fixed and documented. You can reimplement this in any language and verify receipts independently.
+
+---
+
+## Verification checks
+
+For each receipt, the verifier runs 5 checks:
+
+| Check | What it verifies |
+|-------|-----------------|
+| `schema_valid` | All required fields present |
+| `receipt_integrity` | Stored SHA-256 matches recomputed hash |
+| `chain_link` | `previous_hash` matches prior receipt's `sha256` |
+| `chain_position` | Position is sequential (no gaps) |
+| `timestamp_order` | Timestamps are chronologically ordered |
+
+---
+
+## Live receipts
+
+Verify real receipts from iTechSmart's production ledger:
+
+```
+https://verify.itechsmart.dev
+https://api.itechsmart.dev/api/v1/prooflink/receipts
+```
+
+---
+
+## Try the sandbox
+
+See UAIO detect, fix, and prove a live Kubernetes OOMKilled crash:
+
+```
+https://itechsmart.dev/break-it
+```
+
+---
+
+## Contributing
+
+This verifier is intentionally minimal. The goal is auditable simplicity — not feature bloat.
+
+PRs welcome for:
+- Additional language implementations (Python, Go, Rust)
+- OpenTimestamps proof verification
+- CLI tool
+- Test vectors
+
+---
+
+## License
+
+MIT — use freely, audit openly, verify everything.
+
+---
+
+## About iTechSmart
+
+iTechSmart builds UAIO (Unified Autonomous IT Operations) — the first enterprise platform that autonomously detects, remediates, and cryptographically proves every infrastructure action.
+
+- Website: [itechsmart.dev](https://itechsmart.dev)
+- Verify receipts: [verify.itechsmart.dev](https://verify.itechsmart.dev)
+- Whitepaper: [whitepaper.itechsmart.dev](https://whitepaper.itechsmart.dev)
+
+SDVOSB · CAGE: 172W2 · NVIDIA Inception · NIST CSF 96/100

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './prooflink-verifier';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./prooflink-verifier"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC"}

package/dist/prooflink-verifier.d.ts

@@ -0,0 +1,99 @@
+/**
+ * ProofLink™ Verifier
+ * Open-source cryptographic verification logic for iTechSmart UAIO receipts
+ *
+ * Don't trust our AI. Trust the math.
+ *
+ * MIT License — https://github.com/Iteksmart/prooflink-verifier
+ */
+export interface ProofLinkReceipt {
+    receipt_id: string;
+    version: string;
+    timestamp: string;
+    container: string;
+    executor: string;
+    trigger: string;
+    action: string;
+    action_parameters: Record<string, unknown>;
+    before_state: SystemState;
+    after_state: SystemState;
+    nist_controls: string[];
+    human_input: 'ZERO' | 'APPROVAL_REQUIRED' | 'MANUAL';
+    arbiter_policy: string;
+    sha256: string;
+    previous_hash: string | null;
+    chain_position: number;
+    opentimestamps_proof?: string;
+}
+export interface SystemState {
+    snapshot_hash: string;
+    healthy: boolean;
+    metrics: Record<string, number | string>;
+}
+export interface VerificationResult {
+    valid: boolean;
+    receipt_id: string;
+    checks: VerificationCheck[];
+    chain_position: number;
+    tamper_detected: boolean;
+    errors: string[];
+}
+export interface VerificationCheck {
+    name: string;
+    passed: boolean;
+    detail: string;
+}
+/**
+ * Compute the expected SHA-256 hash for a receipt.
+ * The hash covers all fields EXCEPT the sha256 field itself.
+ * This is the canonical hash function — open for inspection.
+ */
+export declare function computeReceiptHash(receipt: Omit<ProofLinkReceipt, 'sha256'>): string;
+/**
+ * Verify a single receipt's internal integrity.
+ * Returns true if the stored hash matches the recomputed hash.
+ */
+export declare function verifyReceiptIntegrity(receipt: ProofLinkReceipt): VerificationCheck;
+/**
+ * Verify that a receipt's previous_hash matches the prior receipt's sha256.
+ * This is what makes the chain tamper-evident — altering any receipt
+ * breaks every subsequent link.
+ */
+export declare function verifyChainLink(receipt: ProofLinkReceipt, previousReceipt: ProofLinkReceipt | null): VerificationCheck;
+/**
+ * Verify that the chain_position is sequential.
+ */
+export declare function verifyChainPosition(receipt: ProofLinkReceipt, previousReceipt: ProofLinkReceipt | null): VerificationCheck;
+/**
+ * Verify timestamp ordering — receipts must be chronologically ordered.
+ */
+export declare function verifyTimestampOrder(receipt: ProofLinkReceipt, previousReceipt: ProofLinkReceipt | null): VerificationCheck;
+/**
+ * Verify the receipt schema has all required fields.
+ */
+export declare function verifyReceiptSchema(receipt: unknown): VerificationCheck;
+/**
+ * Full verification of a single receipt.
+ * Pass previousReceipt=null for genesis (first) receipt.
+ */
+export declare function verifyReceipt(receipt: ProofLinkReceipt, previousReceipt?: ProofLinkReceipt | null): VerificationResult;
+/**
+ * Verify an entire chain of receipts.
+ * Returns a result for each receipt plus an overall chain validity boolean.
+ */
+export declare function verifyChain(receipts: ProofLinkReceipt[]): {
+    chain_valid: boolean;
+    tamper_detected: boolean;
+    tamper_position: number | null;
+    results: VerificationResult[];
+    summary: string;
+};
+export declare const ProofLinkVerifier: {
+    computeHash: typeof computeReceiptHash;
+    verifyReceipt: typeof verifyReceipt;
+    verifyChain: typeof verifyChain;
+    verifyIntegrity: typeof verifyReceiptIntegrity;
+    verifyChainLink: typeof verifyChainLink;
+};
+export default ProofLinkVerifier;
+//# sourceMappingURL=prooflink-verifier.d.ts.map

package/dist/prooflink-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prooflink-verifier.d.ts","sourceRoot":"","sources":["../src/prooflink-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,YAAY,EAAE,WAAW,CAAA;IACzB,WAAW,EAAE,WAAW,CAAA;IACxB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,EAAE,MAAM,GAAG,mBAAmB,GAAG,QAAQ,CAAA;IACpD,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,OAAO,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,MAAM,CAoBpF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAYnF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,eAAe,EAAE,gBAAgB,GAAG,IAAI,GACvC,iBAAiB,CA4BnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,gBAAgB,EACzB,eAAe,EAAE,gBAAgB,GAAG,IAAI,GACvC,iBAAiB,CAqBnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,eAAe,EAAE,gBAAgB,GAAG,IAAI,GACvC,iBAAiB,CAgBnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAkBvE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,gBAAgB,EACzB,eAAe,GAAE,gBAAgB,GAAG,IAAW,GAC9C,kBAAkB,CAwBpB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG;IACzD,WAAW,EAAE,OAAO,CAAA;IACpB,eAAe,EAAE,OAAO,CAAA;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,CAsCA;AAMD,eAAO,MAAM,iBAAiB;;;;;;CAM7B,CAAA;AAED,eAAe,iBAAiB,CAAA"}

package/dist/prooflink-verifier.js

@@ -0,0 +1,235 @@
+"use strict";
+/**
+ * ProofLink™ Verifier
+ * Open-source cryptographic verification logic for iTechSmart UAIO receipts
+ *
+ * Don't trust our AI. Trust the math.
+ *
+ * MIT License — https://github.com/Iteksmart/prooflink-verifier
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProofLinkVerifier = void 0;
+exports.computeReceiptHash = computeReceiptHash;
+exports.verifyReceiptIntegrity = verifyReceiptIntegrity;
+exports.verifyChainLink = verifyChainLink;
+exports.verifyChainPosition = verifyChainPosition;
+exports.verifyTimestampOrder = verifyTimestampOrder;
+exports.verifyReceiptSchema = verifyReceiptSchema;
+exports.verifyReceipt = verifyReceipt;
+exports.verifyChain = verifyChain;
+const crypto_1 = __importDefault(require("crypto"));
+// ─────────────────────────────────────────────
+// Core Verification Logic
+// ─────────────────────────────────────────────
+/**
+ * Compute the expected SHA-256 hash for a receipt.
+ * The hash covers all fields EXCEPT the sha256 field itself.
+ * This is the canonical hash function — open for inspection.
+ */
+function computeReceiptHash(receipt) {
+    const canonical = JSON.stringify({
+        receipt_id: receipt.receipt_id,
+        version: receipt.version,
+        timestamp: receipt.timestamp,
+        container: receipt.container,
+        executor: receipt.executor,
+        trigger: receipt.trigger,
+        action: receipt.action,
+        action_parameters: receipt.action_parameters,
+        before_state: receipt.before_state,
+        after_state: receipt.after_state,
+        nist_controls: receipt.nist_controls,
+        human_input: receipt.human_input,
+        arbiter_policy: receipt.arbiter_policy,
+        previous_hash: receipt.previous_hash,
+        chain_position: receipt.chain_position,
+    }, null, 0); // deterministic — no pretty printing
+    return crypto_1.default.createHash('sha256').update(canonical, 'utf8').digest('hex');
+}
+/**
+ * Verify a single receipt's internal integrity.
+ * Returns true if the stored hash matches the recomputed hash.
+ */
+function verifyReceiptIntegrity(receipt) {
+    const { sha256, ...rest } = receipt;
+    const computed = computeReceiptHash(rest);
+    const passed = computed === sha256;
+    return {
+        name: 'receipt_integrity',
+        passed,
+        detail: passed
+            ? `Hash matches: ${sha256.substring(0, 16)}...`
+            : `Hash mismatch. Expected ${computed.substring(0, 16)}..., got ${sha256.substring(0, 16)}...`,
+    };
+}
+/**
+ * Verify that a receipt's previous_hash matches the prior receipt's sha256.
+ * This is what makes the chain tamper-evident — altering any receipt
+ * breaks every subsequent link.
+ */
+function verifyChainLink(receipt, previousReceipt) {
+    if (receipt.chain_position === 0) {
+        const passed = receipt.previous_hash === null;
+        return {
+            name: 'chain_link',
+            passed,
+            detail: passed
+                ? 'Genesis receipt — no previous hash required'
+                : `Genesis receipt should have null previous_hash, got: ${receipt.previous_hash}`,
+        };
+    }
+    if (!previousReceipt) {
+        return {
+            name: 'chain_link',
+            passed: false,
+            detail: `Cannot verify chain — previous receipt (position ${receipt.chain_position - 1}) not provided`,
+        };
+    }
+    const passed = receipt.previous_hash === previousReceipt.sha256;
+    return {
+        name: 'chain_link',
+        passed,
+        detail: passed
+            ? `Chain intact: links to receipt ${previousReceipt.receipt_id.substring(0, 8)}...`
+            : `Chain BROKEN: expected ${previousReceipt.sha256.substring(0, 16)}..., got ${receipt.previous_hash?.substring(0, 16)}...`,
+    };
+}
+/**
+ * Verify that the chain_position is sequential.
+ */
+function verifyChainPosition(receipt, previousReceipt) {
+    if (receipt.chain_position === 0) {
+        return { name: 'chain_position', passed: true, detail: 'Genesis position: 0' };
+    }
+    if (!previousReceipt) {
+        return {
+            name: 'chain_position',
+            passed: false,
+            detail: 'Cannot verify position without previous receipt',
+        };
+    }
+    const passed = receipt.chain_position === previousReceipt.chain_position + 1;
+    return {
+        name: 'chain_position',
+        passed,
+        detail: passed
+            ? `Position ${receipt.chain_position} follows ${previousReceipt.chain_position}`
+            : `Position gap detected: ${previousReceipt.chain_position} → ${receipt.chain_position}`,
+    };
+}
+/**
+ * Verify timestamp ordering — receipts must be chronologically ordered.
+ */
+function verifyTimestampOrder(receipt, previousReceipt) {
+    if (!previousReceipt) {
+        return { name: 'timestamp_order', passed: true, detail: 'No previous receipt to compare' };
+    }
+    const current = new Date(receipt.timestamp).getTime();
+    const previous = new Date(previousReceipt.timestamp).getTime();
+    const passed = current >= previous;
+    return {
+        name: 'timestamp_order',
+        passed,
+        detail: passed
+            ? `Timestamp order valid: ${receipt.timestamp} >= ${previousReceipt.timestamp}`
+            : `Timestamp order INVALID: ${receipt.timestamp} precedes ${previousReceipt.timestamp}`,
+    };
+}
+/**
+ * Verify the receipt schema has all required fields.
+ */
+function verifyReceiptSchema(receipt) {
+    const required = [
+        'receipt_id', 'version', 'timestamp', 'container', 'executor',
+        'trigger', 'action', 'before_state', 'after_state',
+        'sha256', 'chain_position', 'human_input',
+    ];
+    const r = receipt;
+    const missing = required.filter(field => !(field in r) || r[field] === undefined);
+    const passed = missing.length === 0;
+    return {
+        name: 'schema_valid',
+        passed,
+        detail: passed
+            ? 'All required fields present'
+            : `Missing required fields: ${missing.join(', ')}`,
+    };
+}
+/**
+ * Full verification of a single receipt.
+ * Pass previousReceipt=null for genesis (first) receipt.
+ */
+function verifyReceipt(receipt, previousReceipt = null) {
+    const checks = [
+        verifyReceiptSchema(receipt),
+        verifyReceiptIntegrity(receipt),
+        verifyChainLink(receipt, previousReceipt),
+        verifyChainPosition(receipt, previousReceipt),
+        verifyTimestampOrder(receipt, previousReceipt),
+    ];
+    const errors = checks
+        .filter(c => !c.passed)
+        .map(c => `[${c.name}] ${c.detail}`);
+    const tamperDetected = !checks.find(c => c.name === 'receipt_integrity')?.passed ||
+        !checks.find(c => c.name === 'chain_link')?.passed;
+    return {
+        valid: errors.length === 0,
+        receipt_id: receipt.receipt_id,
+        checks,
+        chain_position: receipt.chain_position,
+        tamper_detected: tamperDetected,
+        errors,
+    };
+}
+/**
+ * Verify an entire chain of receipts.
+ * Returns a result for each receipt plus an overall chain validity boolean.
+ */
+function verifyChain(receipts) {
+    if (receipts.length === 0) {
+        return {
+            chain_valid: false,
+            tamper_detected: false,
+            tamper_position: null,
+            results: [],
+            summary: 'Empty chain — nothing to verify',
+        };
+    }
+    // Sort by chain_position
+    const sorted = [...receipts].sort((a, b) => a.chain_position - b.chain_position);
+    const results = [];
+    let tamperPosition = null;
+    for (let i = 0; i < sorted.length; i++) {
+        const result = verifyReceipt(sorted[i], i > 0 ? sorted[i - 1] : null);
+        results.push(result);
+        if (result.tamper_detected && tamperPosition === null) {
+            tamperPosition = sorted[i].chain_position;
+        }
+    }
+    const chainValid = results.every(r => r.valid);
+    const tamperDetected = tamperPosition !== null;
+    return {
+        chain_valid: chainValid,
+        tamper_detected: tamperDetected,
+        tamper_position: tamperPosition,
+        results,
+        summary: chainValid
+            ? `Chain valid — ${receipts.length} receipts verified, no tampering detected`
+            : `Chain INVALID — tampering detected at position ${tamperPosition}`,
+    };
+}
+// ─────────────────────────────────────────────
+// Public API
+// ─────────────────────────────────────────────
+exports.ProofLinkVerifier = {
+    computeHash: computeReceiptHash,
+    verifyReceipt,
+    verifyChain,
+    verifyIntegrity: verifyReceiptIntegrity,
+    verifyChainLink,
+};
+exports.default = exports.ProofLinkVerifier;
+//# sourceMappingURL=prooflink-verifier.js.map

package/dist/prooflink-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prooflink-verifier.js","sourceRoot":"","sources":["../src/prooflink-verifier.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;AA0DH,gDAoBC;AAMD,wDAYC;AAOD,0CA+BC;AAKD,kDAwBC;AAKD,oDAmBC;AAKD,kDAkBC;AAMD,sCA2BC;AAMD,kCA4CC;AAnSD,oDAA2B;AA+C3B,gDAAgD;AAChD,0BAA0B;AAC1B,gDAAgD;AAEhD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAyC;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,qCAAqC;IAEjD,OAAO,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,OAAyB;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IACnC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAA;IAElC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,MAAM;QACN,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC,iBAAiB,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;YAC/C,CAAC,CAAC,2BAA2B,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;KACjG,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,OAAyB,EACzB,eAAwC;IAExC,IAAI,OAAO,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAA;QAC7C,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM;YACN,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,wDAAwD,OAAO,CAAC,aAAa,EAAE;SACpF,CAAA;IACH,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,oDAAoD,OAAO,CAAC,cAAc,GAAG,CAAC,gBAAgB;SACvG,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,KAAK,eAAe,CAAC,MAAM,CAAA;IAC/D,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM;QACN,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC,kCAAkC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK;YACnF,CAAC,CAAC,0BAA0B,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;KAC9H,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,OAAyB,EACzB,eAAwC;IAExC,IAAI,OAAO,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAChF,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,iDAAiD;SAC1D,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,KAAK,eAAe,CAAC,cAAc,GAAG,CAAC,CAAA;IAC5E,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,MAAM;QACN,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC,YAAY,OAAO,CAAC,cAAc,YAAY,eAAe,CAAC,cAAc,EAAE;YAChF,CAAC,CAAC,0BAA0B,eAAe,CAAC,cAAc,MAAM,OAAO,CAAC,cAAc,EAAE;KAC3F,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,OAAyB,EACzB,eAAwC;IAExC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAA;IACrD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAA;IAC9D,MAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,CAAA;IAElC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC,0BAA0B,OAAO,CAAC,SAAS,OAAO,eAAe,CAAC,SAAS,EAAE;YAC/E,CAAC,CAAC,4BAA4B,OAAO,CAAC,SAAS,aAAa,eAAe,CAAC,SAAS,EAAE;KAC1F,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,MAAM,QAAQ,GAAG;QACf,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU;QAC7D,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa;QAClD,QAAQ,EAAE,gBAAgB,EAAE,aAAa;KAC1C,CAAA;IAED,MAAM,CAAC,GAAG,OAAkC,CAAA;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAA;IAEjF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAA;IACnC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,MAAM;QACN,MAAM,EAAE,MAAM;YACZ,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACrD,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAC3B,OAAyB,EACzB,kBAA2C,IAAI;IAE/C,MAAM,MAAM,GAAwB;QAClC,mBAAmB,CAAC,OAAO,CAAC;QAC5B,sBAAsB,CAAC,OAAO,CAAC;QAC/B,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC;QACzC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC;QAC7C,oBAAoB,CAAC,OAAO,EAAE,eAAe,CAAC;KAC/C,CAAA;IAED,MAAM,MAAM,GAAG,MAAM;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IAEtC,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,EAAE,MAAM;QAC9E,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,MAAM,CAAA;IAEpD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,cAAc;QAC/B,MAAM;KACP,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,QAA4B;IAOtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,KAAK;YACtB,eAAe,EAAE,IAAI;YACrB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,iCAAiC;SAC3C,CAAA;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAA;IAEhF,MAAM,OAAO,GAAyB,EAAE,CAAA;IACxC,IAAI,cAAc,GAAkB,IAAI,CAAA;IAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAEpB,IAAI,MAAM,CAAC,eAAe,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YACtD,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,cAAc,GAAG,cAAc,KAAK,IAAI,CAAA;IAE9C,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,cAAc;QAC/B,eAAe,EAAE,cAAc;QAC/B,OAAO;QACP,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,iBAAiB,QAAQ,CAAC,MAAM,2CAA2C;YAC7E,CAAC,CAAC,kDAAkD,cAAc,EAAE;KACvE,CAAA;AACH,CAAC;AAED,gDAAgD;AAChD,aAAa;AACb,gDAAgD;AAEnC,QAAA,iBAAiB,GAAG;IAC/B,WAAW,EAAE,kBAAkB;IAC/B,aAAa;IACb,WAAW;IACX,eAAe,EAAE,sBAAsB;IACvC,eAAe;CAChB,CAAA;AAED,kBAAe,yBAAiB,CAAA"}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@itechsmart/prooflink-verifier",
+  "version": "1.0.0",
+  "description": "Open-source cryptographic verification for iTechSmart UAIO ProofLink receipts — don't trust our AI, trust the math.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "prooflink",
+    "uaio",
+    "itechsmart",
+    "cryptographic-verification",
+    "audit",
+    "sha256",
+    "hash-chain",
+    "tamper-evident"
+  ],
+  "author": "iTechSmart Inc.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Iteksmart/prooflink-verifier.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Iteksmart/prooflink-verifier/issues"
+  },
+  "homepage": "https://github.com/Iteksmart/prooflink-verifier#readme",
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^1.6.0"
+  }
+}