@mikeargento/bitgraph 1.1.0

package/dist/policy.d.ts

@@ -0,0 +1,68 @@
+import type { PolicyBinding } from "@mikeargento/bitgraph-verify";
+export interface PolicyDocument {
+    /** Human-readable policy name (from "# Policy: <name>"). */
+    name: string;
+    /** Version identifier (from "version: <version>"). */
+    version: string;
+    /** Structured rules parsed from the document. */
+    rules: PolicyRules;
+    /** The original raw markdown text. */
+    raw: string;
+}
+export interface PolicyRules {
+    /** Always true — BitGraph is default-deny. */
+    defaultDeny: true;
+    /** Tool names explicitly allowed by the policy. */
+    allowedTools?: string[] | undefined;
+    /** Maximum total actions permitted under this policy. */
+    maxActions?: number | undefined;
+    /** Maximum actions per minute. */
+    rateLimit?: number | undefined;
+    /** Allowed hours of operation (24h clock, 0-23). */
+    timeWindow?: {
+        start: number;
+        end: number;
+    } | undefined;
+    /** Tool names that require multi-sig / human approval. */
+    requireApproval?: string[] | undefined;
+    /** Arbitrary extension metadata. */
+    metadata?: Record<string, unknown> | undefined;
+}
+/**
+ * Parse a markdown policy document into structured rules.
+ *
+ * Extracts the policy name, version, and rule sections from a
+ * human-readable markdown format.
+ */
+export declare function parsePolicy(markdown: string): PolicyDocument;
+/**
+ * Compute the SHA-256 hash of a policy document's raw text.
+ *
+ * Returns a Base64-standard (RFC 4648 §4) encoded digest suitable for
+ * inclusion in the proof's policy.digestB64 field.
+ */
+export declare function hashPolicy(markdown: string): string;
+/**
+ * Create a PolicyBinding from a raw markdown policy document.
+ *
+ * Convenience function that parses the document for name/version and
+ * computes the SHA-256 digest in one call.
+ */
+export declare function createPolicyBinding(markdown: string): PolicyBinding;
+export interface ActionValidationResult {
+    /** Whether the action is permitted under the policy rules. */
+    valid: boolean;
+    /** Human-readable reason when valid is false. */
+    reason?: string | undefined;
+}
+/**
+ * Validate that an action complies with the policy rules.
+ *
+ * Checks tool allowlist and time window constraints. Rate limiting
+ * and action counting require external state and are not checked here.
+ */
+export declare function validateAction(action: {
+    tool: string;
+    timestamp?: number | undefined;
+}, rules: PolicyRules): ActionValidationResult;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,KAAK,EAAE,WAAW,CAAC;IACnB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,WAAW,EAAE,IAAI,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACpC,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oDAAoD;IACpD,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACxD,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAChD;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAoD5D;AA+BD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAQnE;AAMD,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,KAAK,EAAE,OAAO,CAAC;IACf,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACxD,KAAK,EAAE,WAAW,GACjB,sBAAsB,CAiCxB"}

package/dist/policy.js

@@ -0,0 +1,176 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+/**
+ * bitgraph-core Policy — parse, hash, and validate markdown policy documents.
+ *
+ * Policy documents are human-readable markdown files that define what an
+ * agent is allowed to do. The SHA-256 hash of the raw document bytes is
+ * included in the proof's signed body, cryptographically binding the
+ * proof to the exact policy that governed the action.
+ *
+ * Format:
+ *   # Policy: <name>
+ *   version: <version>
+ *
+ *   ## Allowed Tools
+ *   - tool_a
+ *   - tool_b
+ *
+ *   ## Limits
+ *   - max_actions: 500
+ *   - rate_limit: 10/min
+ *
+ *   ## Time Window
+ *   - hours: 9-17
+ *
+ *   ## Require Approval
+ *   - send_email
+ */
+import { sha256 } from "@noble/hashes/sha256";
+// ---------------------------------------------------------------------------
+// Parsing
+// ---------------------------------------------------------------------------
+/**
+ * Parse a markdown policy document into structured rules.
+ *
+ * Extracts the policy name, version, and rule sections from a
+ * human-readable markdown format.
+ */
+export function parsePolicy(markdown) {
+    const lines = markdown.split("\n");
+    const name = extractField(lines, /^#\s+Policy:\s*(.+)/);
+    const version = extractField(lines, /^version:\s*(.+)/);
+    const rules = { defaultDeny: true };
+    // Parse allowed tools section
+    const toolsSection = extractSection(lines, "Allowed Tools");
+    if (toolsSection.length > 0) {
+        rules.allowedTools = toolsSection
+            .map((line) => line.replace(/^[-*]\s*/, "").trim())
+            .filter(Boolean);
+    }
+    // Parse limits
+    const limitsSection = extractSection(lines, "Limits");
+    for (const line of limitsSection) {
+        const clean = line.replace(/^[-*]\s*/, "").trim();
+        const maxMatch = clean.match(/max_actions:\s*(\d+)/);
+        if (maxMatch?.[1])
+            rules.maxActions = parseInt(maxMatch[1], 10);
+        const rateMatch = clean.match(/rate_limit:\s*(\d+)/);
+        if (rateMatch?.[1])
+            rules.rateLimit = parseInt(rateMatch[1], 10);
+    }
+    // Parse time window
+    const timeSection = extractSection(lines, "Time Window");
+    for (const line of timeSection) {
+        const clean = line.replace(/^[-*]\s*/, "").trim();
+        const hoursMatch = clean.match(/hours:\s*(\d+)-(\d+)/);
+        if (hoursMatch?.[1] && hoursMatch[2]) {
+            rules.timeWindow = {
+                start: parseInt(hoursMatch[1], 10),
+                end: parseInt(hoursMatch[2], 10),
+            };
+        }
+    }
+    // Parse require approval
+    const approvalSection = extractSection(lines, "Require Approval");
+    if (approvalSection.length > 0) {
+        rules.requireApproval = approvalSection
+            .map((line) => line.replace(/^[-*]\s*/, "").trim())
+            .filter(Boolean);
+    }
+    return {
+        name: name ?? "Unnamed Policy",
+        version: version ?? "1.0",
+        rules,
+        raw: markdown,
+    };
+}
+function extractField(lines, pattern) {
+    for (const line of lines) {
+        const match = line.match(pattern);
+        if (match?.[1])
+            return match[1].trim();
+    }
+    return undefined;
+}
+function extractSection(lines, sectionName) {
+    const result = [];
+    let inSection = false;
+    for (const line of lines) {
+        if (line.match(new RegExp(`^##\\s+${sectionName}`, "i"))) {
+            inSection = true;
+            continue;
+        }
+        if (inSection && line.match(/^##\s+/))
+            break; // next section
+        if (inSection && line.trim())
+            result.push(line);
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Hashing
+// ---------------------------------------------------------------------------
+/**
+ * Compute the SHA-256 hash of a policy document's raw text.
+ *
+ * Returns a Base64-standard (RFC 4648 §4) encoded digest suitable for
+ * inclusion in the proof's policy.digestB64 field.
+ */
+export function hashPolicy(markdown) {
+    const bytes = new TextEncoder().encode(markdown);
+    const hash = sha256(bytes);
+    return Buffer.from(hash).toString("base64");
+}
+/**
+ * Create a PolicyBinding from a raw markdown policy document.
+ *
+ * Convenience function that parses the document for name/version and
+ * computes the SHA-256 digest in one call.
+ */
+export function createPolicyBinding(markdown) {
+    const doc = parsePolicy(markdown);
+    const binding = {
+        digestB64: hashPolicy(markdown),
+    };
+    if (doc.name !== "Unnamed Policy")
+        binding.name = doc.name;
+    if (doc.version !== "1.0")
+        binding.version = doc.version;
+    return binding;
+}
+/**
+ * Validate that an action complies with the policy rules.
+ *
+ * Checks tool allowlist and time window constraints. Rate limiting
+ * and action counting require external state and are not checked here.
+ */
+export function validateAction(action, rules) {
+    // Default deny — tool must be in allowed list
+    if (rules.allowedTools && !rules.allowedTools.includes(action.tool)) {
+        return {
+            valid: false,
+            reason: `Tool "${action.tool}" not in allowed list`,
+        };
+    }
+    // Time window check
+    if (rules.timeWindow && action.timestamp !== undefined) {
+        const hour = new Date(action.timestamp).getHours();
+        if (hour < rules.timeWindow.start || hour >= rules.timeWindow.end) {
+            return {
+                valid: false,
+                reason: `Action outside allowed hours (${rules.timeWindow.start}-${rules.timeWindow.end})`,
+            };
+        }
+    }
+    // Require approval check (advisory — returns valid but flags the tool)
+    // Actual approval enforcement happens at the proxy layer
+    if (rules.requireApproval &&
+        rules.requireApproval.includes(action.tool)) {
+        return {
+            valid: true,
+            reason: `Tool "${action.tool}" requires approval`,
+        };
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAmC9C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAExD,MAAM,KAAK,GAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEjD,8BAA8B;IAC9B,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,YAAY;aAC9B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAClD,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,eAAe;IACf,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACrD,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,oBAAoB;IACpB,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,UAAU,GAAG;gBACjB,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAClC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAClE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,eAAe,GAAG,eAAe;aACpC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAClD,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,IAAI,gBAAgB;QAC9B,OAAO,EAAE,OAAO,IAAI,KAAK;QACzB,KAAK;QACL,GAAG,EAAE,QAAQ;KACd,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,KAAe,EACf,OAAe;IAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAe,EAAE,WAAmB;IAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACzD,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,eAAe;QAC7D,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAkB;QAC7B,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC;KAChC,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAC3D,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IACzD,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAwD,EACxD,KAAkB;IAElB,8CAA8C;IAC9C,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,SAAS,MAAM,CAAC,IAAI,uBAAuB;SACpD,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,IAAI,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;YAClE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG;aAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yDAAyD;IACzD,IACE,KAAK,CAAC,eAAe;QACrB,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,SAAS,MAAM,CAAC,IAAI,qBAAqB;SAClD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/proof-hash.d.ts

@@ -0,0 +1,9 @@
+import type { BitGraphProof } from "./types.js";
+/**
+ * Compute the canonical hash of a BitGraph proof's signed body.
+ *
+ * @param proof - The full BitGraphProof object (or equivalent Record)
+ * @returns Base64-standard encoded SHA-256 hash
+ */
+export declare function computeProofHash(proof: BitGraphProof | Record<string, unknown>): string;
+//# sourceMappingURL=proof-hash.d.ts.map

package/dist/proof-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-hash.d.ts","sourceRoot":"","sources":["../src/proof-hash.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAqCvF"}

package/dist/proof-hash.js

@@ -0,0 +1,75 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+/**
+ * bitgraph-core proof hash
+ *
+ * Canonical, deterministic proof hash computation.
+ *
+ * The proof hash covers the SIGNED BODY — the fields that are
+ * cryptographically signed by the enclave. This matches what the
+ * Ed25519 signature covers, making the hash verifiable.
+ *
+ * Signed body fields:
+ *   - version, artifact, commit
+ *   - publicKeyB64 (from signer)
+ *   - enforcement, measurement (from environment)
+ *   - attribution (if present)
+ *   - attestationFormat (if attestation present)
+ *
+ * This hash is used for:
+ *   - prevB64 chain linking
+ *   - S3 ledger key generation
+ *   - Ethereum anchor binding
+ *   - Proof deduplication and verification
+ *
+ * Algorithm:
+ *   1. Extract signed body fields
+ *   2. canonicalize(signedBody) — recursive key sort, compact JSON, UTF-8
+ *   3. SHA-256 of canonical bytes
+ *   4. Base64-standard encode (RFC 4648 §4)
+ *
+ * IMPORTANT: All call sites MUST use this function. Do NOT compute
+ * proof hashes ad-hoc with JSON.stringify or Object.keys().sort().
+ * Non-recursive key sorting diverges on nested objects.
+ */
+import { canonicalize } from "./canonical.js";
+import { sha256 } from "@noble/hashes/sha256";
+/**
+ * Compute the canonical hash of a BitGraph proof's signed body.
+ *
+ * @param proof - The full BitGraphProof object (or equivalent Record)
+ * @returns Base64-standard encoded SHA-256 hash
+ */
+export function computeProofHash(proof) {
+    const p = proof;
+    const signer = p.signer;
+    const env = p.environment;
+    const signedBody = {
+        version: p.version,
+        artifact: p.artifact,
+        commit: p.commit,
+        publicKeyB64: signer?.publicKeyB64,
+        enforcement: env?.enforcement,
+        measurement: env?.measurement,
+    };
+    // Include attribution if present
+    if (p.attribution) {
+        signedBody.attribution = p.attribution;
+    }
+    // Include attestation format if present
+    if (env?.attestation) {
+        signedBody.attestationFormat = env.attestation.format;
+    }
+    const bytes = canonicalize(signedBody);
+    const hash = sha256(bytes);
+    // Base64 encode (works in both Node.js and browser)
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(hash).toString("base64");
+    }
+    // Browser fallback
+    let binary = "";
+    for (let i = 0; i < hash.length; i++) {
+        binary += String.fromCharCode(hash[i]);
+    }
+    return btoa(binary);
+}
+//# sourceMappingURL=proof-hash.js.map

package/dist/proof-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-hash.js","sourceRoot":"","sources":["../src/proof-hash.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA8C;IAC7E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,MAA8C,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAC,WAAyG,CAAC;IAExH,MAAM,UAAU,GAA4B;QAC1C,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,MAAM,EAAE,YAAY;QAClC,WAAW,EAAE,GAAG,EAAE,WAAW;QAC7B,WAAW,EAAE,GAAG,EAAE,WAAW;KAC9B,CAAC;IAEF,iCAAiC;IACjC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClB,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,wCAAwC;IACxC,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC;QACrB,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,UAAsC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3B,oDAAoD;IACpD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,mBAAmB;IACnB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}