@mikeargento/bitgraph 1.1.1 → 1.2.0

package/dist/fuse.js

@@ -0,0 +1,273 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+/**
+ * fuse(builder, options): the producer interface of the bitgraph-fuse/1
+ * profile (working name; outwardly this is simply BitGraph).
+ *
+ * The four beats, in order, with nothing else in between:
+ *   1. nonce:  allocate a slot; the enclave signs a record that contains no
+ *              artifact data and hands back a nonce that is a bearer ticket
+ *              until it is consumed.
+ *   2. fuse:   hand the COMMITMENT to that record (never the raw nonce) to the
+ *              builder, which writes it into the artifact it is producing and
+ *              returns the finished bytes.
+ *   3. hash:   SHA-256 of the fused bytes.
+ *   4. fill:   commit that digest under the same slot, with the placement id
+ *              and the origin digest in the signed attribution.
+ *
+ * What this module never does: write the nonce anywhere but process memory,
+ * put it in a message, or fall back to an ordinary recording when the fused
+ * commit fails. A failure is reported as a failure and the slot expires on
+ * its own.
+ *
+ * Transport: the site's proxy routes by default (POST /api/fuse/allocate and
+ * /api/fuse/commit, behind the anchor-first gate), configurable so a licensee
+ * can point it at a parent directly.
+ */
+import { sha256 } from "@noble/hashes/sha256";
+import { buildFrame, bytesToBase64, bytesToHex, computeSlotCommitment, computeSlotRecordHash, fuseAttribution, getPlacement, verifyFuse, base64ToBytes, } from "@mikeargento/bitgraph-verify";
+export class FuseError extends Error {
+    code;
+    status;
+    constructor(code, message, status = null) {
+        super(message);
+        this.name = "FuseError";
+        this.code = code;
+        this.status = status;
+    }
+}
+/** A builder for a registered placement over an existing original (Forms A and B), or for a bare Form C payload. */
+export function builderFor(placement, original) {
+    const p = getPlacement(placement);
+    if (p === undefined)
+        throw new FuseError("bad-placement", `placement "${placement}" is not registered`);
+    return ({ commitment, originDigest }) => {
+        if (original !== undefined)
+            return p.build({ original, originDigest: originDigest ?? sha256(original), commitment });
+        return p.build(originDigest !== undefined ? { originDigest, commitment } : { commitment });
+    };
+}
+const DEFAULTS = {
+    baseUrl: "https://bitgraph.ing",
+    allocatePath: "/api/fuse/allocate",
+    commitPath: "/api/fuse/commit",
+    lookupPath: "/api/proofs/",
+    timeoutMs: 30_000,
+    recoveryAttempts: 5,
+    recoveryDelayMs: 1_500,
+};
+const B64_32 = /^[A-Za-z0-9+/]{43}=$/;
+const B64_64 = /^[A-Za-z0-9+/]{86}==$/;
+function isSlotRecord(x) {
+    if (x === null || typeof x !== "object" || Array.isArray(x))
+        return false;
+    const s = x;
+    return (s.version === "bitgraph/slot/1" &&
+        typeof s.nonceB64 === "string" && B64_32.test(s.nonceB64) &&
+        typeof s.counter === "string" && /^(0|[1-9][0-9]*)$/.test(s.counter) &&
+        typeof s.epochId === "string" && typeof s.publicKeyB64 === "string" &&
+        typeof s.signatureB64 === "string" && B64_64.test(s.signatureB64));
+}
+function toUrlSafe(b64) {
+    return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function request(t, path, init) {
+    const f = t.fetch ?? fetch;
+    const headers = {};
+    if (init.body !== undefined)
+        headers["Content-Type"] = "application/json";
+    if (t.apiKey)
+        headers["Authorization"] = `Bearer ${t.apiKey}`;
+    let res;
+    try {
+        res = await f(`${t.baseUrl}${path}`, {
+            method: init.method,
+            headers,
+            ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+            signal: AbortSignal.timeout(t.timeoutMs),
+        });
+    }
+    catch (err) {
+        throw new FuseError("network", `request failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const text = await res.text();
+    let json = null;
+    try {
+        json = text.length > 0 ? JSON.parse(text) : null;
+    }
+    catch {
+        json = text;
+    }
+    return { status: res.status, json, headers: res.headers };
+}
+function messageOf(json, fallback) {
+    return json !== null && typeof json === "object" && typeof json.error === "string" ? json.error : fallback;
+}
+function codeOf(json) {
+    return json !== null && typeof json === "object" && typeof json.code === "string" ? json.code : null;
+}
+/**
+ * Read the proof back by digest after a lost or refused commit: the ONE proof
+ * whose commit.slotHashB64 is the hash of the slot record we hold. Any other
+ * proof of the same digest is a different recording under a different slot.
+ * Never allocates.
+ */
+async function recover(t, artifactDigestB64, slot) {
+    const expectedSlotHash = bytesToBase64(computeSlotRecordHash(slot));
+    for (let attempt = 0; attempt < t.recoveryAttempts; attempt++) {
+        if (attempt > 0)
+            await sleep(t.recoveryDelayMs);
+        let r;
+        try {
+            r = await request(t, `${t.lookupPath}${encodeURIComponent(toUrlSafe(artifactDigestB64))}`, { method: "GET" });
+        }
+        catch {
+            continue;
+        }
+        if (r.status !== 200)
+            continue;
+        const proofs = r.json?.proofs;
+        if (!Array.isArray(proofs))
+            continue;
+        for (const entry of proofs) {
+            const p = entry?.proof;
+            if (p && p.commit?.slotHashB64 === expectedSlotHash && p.commit?.nonceB64 === slot.nonceB64)
+                return p;
+        }
+    }
+    return null;
+}
+/**
+ * Allocate, fuse, hash, fill. Returns the Frame with the unchanged proof, or
+ * throws a FuseError; it never returns an ordinary recording in place of a
+ * fused one.
+ */
+export async function fuse(builder, options) {
+    const placement = getPlacement(options.placement);
+    if (placement === undefined)
+        throw new FuseError("bad-placement", `placement "${options.placement}" is not registered`);
+    if (placement.form !== "C" && options.original === undefined)
+        throw new FuseError("bad-input", `${placement.id} needs the original bytes`);
+    if (placement.form === "C" && options.original !== undefined)
+        throw new FuseError("bad-input", "produced/1 takes no original; pass originDigest to name a source");
+    if (options.originDigest !== undefined && options.originDigest.length !== 32)
+        throw new FuseError("bad-input", "originDigest must be 32 bytes");
+    const t = { ...DEFAULTS, ...(options.transport ?? {}) };
+    const originDigest = options.original !== undefined ? sha256(options.original) : options.originDigest;
+    const originDigestB64 = originDigest !== undefined ? bytesToBase64(originDigest) : null;
+    // 1. nonce
+    const alloc = await request(t, t.allocatePath, { method: "POST", body: {} });
+    if (alloc.status === 503 && codeOf(alloc.json) === "tee-restarting")
+        throw new FuseError("tee-restarting", messageOf(alloc.json, "the boundary is restarting"), 503);
+    if (alloc.status !== 200)
+        throw new FuseError("allocate-failed", messageOf(alloc.json, `allocation failed (${alloc.status})`), alloc.status);
+    const slotId = alloc.json?.slotId;
+    const slot = alloc.json?.slot;
+    if (!isSlotRecord(slot) || slotId !== slot.nonceB64)
+        throw new FuseError("allocate-failed", "the allocation response is not a slot record", alloc.status);
+    if (slot.chainId !== "bitgraph:main")
+        throw new FuseError("allocate-failed", "the slot is not on the anchored chain; a fused floor needs bitgraph:main");
+    // 2. fuse
+    const commitment = computeSlotCommitment(slot);
+    let fused;
+    try {
+        fused = await builder({ commitment, commitmentHex: bytesToHex(commitment), ...(originDigest !== undefined ? { originDigest } : {}), slot });
+    }
+    catch (err) {
+        throw new FuseError("builder-failed", `the builder threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!(fused instanceof Uint8Array))
+        throw new FuseError("builder-failed", "the builder must return a Uint8Array");
+    // Fail closed: never commit bytes that do not carry the commitment.
+    const located = placement.locate(fused);
+    if (located === null || bytesToHex(located.commitment) !== bytesToHex(commitment)) {
+        throw new FuseError("commitment-missing", `the fused bytes do not carry the ${placement.id} commitment; nothing was committed and the slot will expire`);
+    }
+    // 3. hash
+    const artifactDigest = sha256(fused);
+    const artifactDigestB64 = bytesToBase64(artifactDigest);
+    // 4. fill
+    const attribution = fuseAttribution(placement.id, originDigest);
+    const body = {
+        digests: [{ digestB64: artifactDigestB64, hashAlg: "sha256" }],
+        slotId: slot.nonceB64,
+        slot,
+        chainId: "bitgraph:main",
+        attribution,
+    };
+    if (options.agency !== undefined)
+        body.agency = options.agency;
+    let proof = null;
+    let recovered = false;
+    let commit = null;
+    try {
+        commit = await request(t, t.commitPath, { method: "POST", body });
+    }
+    catch (err) {
+        // The request may have reached the boundary. Read back before giving up; never allocate again.
+        proof = await recover(t, artifactDigestB64, slot);
+        if (proof === null)
+            throw err;
+        recovered = true;
+    }
+    if (proof === null && commit !== null) {
+        if (commit.status === 200) {
+            const j = commit.json;
+            proof = Array.isArray(j) ? (j[0] ?? null) : (j?.proof ?? null);
+            if (proof === null)
+                throw new FuseError("commit-refused", "the commit response carried no proof", 200);
+        }
+        else if (commit.status === 409 && codeOf(commit.json) === "slot-unavailable") {
+            proof = await recover(t, artifactDigestB64, slot);
+            if (proof === null)
+                throw new FuseError("slot-unavailable", messageOf(commit.json, "the slot is no longer available"), 409);
+            recovered = true;
+        }
+        else if (commit.status === 503 && codeOf(commit.json) === "tee-restarting") {
+            proof = await recover(t, artifactDigestB64, slot);
+            if (proof === null)
+                throw new FuseError("tee-restarting", messageOf(commit.json, "the boundary is restarting"), 503);
+            recovered = true;
+        }
+        else {
+            throw new FuseError("commit-refused", messageOf(commit.json, `commit refused (${commit.status})`), commit.status);
+        }
+    }
+    if (proof === null)
+        throw new FuseError("transport", "no proof");
+    // Never label as fused a proof under any other slot.
+    if (proof.slotAllocation?.nonceB64 !== slot.nonceB64 || proof.commit?.nonceB64 !== slot.nonceB64) {
+        throw new FuseError("slot-mismatch", "the boundary returned a proof under a different slot; nothing is labelled fused");
+    }
+    // A minted proof is verified by a reader before it is called a proof.
+    const verification = await verifyFuse({ proof, bytes: fused });
+    if (verification.category !== "FUSED_DIRECT") {
+        throw new FuseError("verification-failed", `the returned proof does not verify as fused: ${verification.category}${verification.reason ? ` (${verification.reason})` : ""}`);
+    }
+    const frame = buildFrame({
+        proof,
+        placement: placement.id,
+        artifactDigest,
+        ...(originDigest !== undefined ? { originDigest } : {}),
+        fusedFile: options.fusedFile ?? null,
+        ...(placement.form === "C" ? { fusePayload: fused } : {}),
+    });
+    const keep = options.keepFused ?? !placement.byteExact;
+    return {
+        frame,
+        proof,
+        artifactDigestB64,
+        originDigestB64,
+        ...(keep ? { fusedBytes: fused } : {}),
+        recovered,
+        verification,
+    };
+}
+/** Decode a standard-base64 digest, for callers holding one as text. */
+export function digestFromBase64(b64) {
+    const d = base64ToBytes(b64);
+    if (d === null || d.length !== 32)
+        throw new FuseError("bad-input", "not a 32-byte base64 digest");
+    return d;
+}
+//# sourceMappingURL=fuse.js.map

package/dist/fuse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fuse.js","sourceRoot":"","sources":["../src/fuse.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,UAAU,EACV,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,8BAA8B,CAAC;AAgFtC,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAgB;IACpB,MAAM,CAAgB;IAC/B,YAAY,IAAmB,EAAE,OAAe,EAAE,SAAwB,IAAI;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,oHAAoH;AACpH,MAAM,UAAU,UAAU,CAAC,SAAsB,EAAE,QAAqB;IACtE,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,cAAc,SAAS,qBAAqB,CAAC,CAAC;IACxG,OAAO,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACrH,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,sBAAsB;IAC/B,YAAY,EAAE,oBAAoB;IAClC,UAAU,EAAE,kBAAkB;IAC9B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,CAAC;IACnB,eAAe,EAAE,KAAK;CACd,CAAC;AAEX,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,MAAM,GAAG,uBAAuB,CAAC;AAEvC,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,iBAAiB;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzD,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QACpE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QACnE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE,KAAK,UAAU,OAAO,CACpB,CAAyE,EACzE,IAAY,EACZ,IAAgD;IAEhD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;IAC3B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC1E,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,SAAS,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC;IAAC,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,QAAgB;IAChD,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7J,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC3B,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACrJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CACpB,CAAiI,EACjI,iBAAyB,EACzB,IAAoB;IAEpB,MAAM,gBAAgB,GAAG,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAoC,CAAC;QACzC,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,SAAS;QAC/B,MAAM,MAAM,GAAI,CAAC,CAAC,IAA6D,EAAE,MAAM,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,KAAK,gBAAgB,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB,EAAE,OAAoB;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,cAAc,OAAO,CAAC,SAAS,qBAAqB,CAAC,CAAC;IACxH,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAC3I,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,kEAAkE,CAAC,CAAC;IACnK,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IAEhJ,MAAM,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACtG,MAAM,eAAe,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,WAAW;IACX,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,gBAAgB;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;IACrK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7I,MAAM,MAAM,GAAI,KAAK,CAAC,IAAoC,EAAE,MAAM,CAAC;IACnE,MAAM,IAAI,GAAI,KAAK,CAAC,IAAkC,EAAE,IAAI,CAAC;IAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,8CAA8C,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1J,IAAI,IAAI,CAAC,OAAO,KAAK,eAAe;QAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,0EAA0E,CAAC,CAAC;IAEzJ,UAAU;IACV,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9I,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IAClH,oEAAoE;IACpE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,oCAAoC,SAAS,CAAC,EAAE,6DAA6D,CAAC,CAAC;IAC3J,CAAC;IAED,UAAU;IACV,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAExD,UAAU;IACV,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,IAAI,GAA4B;QACpC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC9D,MAAM,EAAE,IAAI,CAAC,QAAQ;QACrB,IAAI;QACJ,OAAO,EAAE,eAAe;QACxB,WAAW;KACZ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE/D,IAAI,KAAK,GAAyB,IAAI,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAAM,GAA6C,IAAI,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+FAA+F;QAC/F,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,GAAG,CAAC;QAC9B,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAA0D,CAAC;YAC5E,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;YAC/D,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACzG,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC/E,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5H,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC7E,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;YACrH,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAEjE,qDAAqD;IACrD,IAAI,KAAK,CAAC,cAAc,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,iFAAiF,CAAC,CAAC;IAC1H,CAAC;IACD,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,IAAI,YAAY,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,gDAAgD,YAAY,CAAC,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/K,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,EAAE;QACvB,cAAc;QACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IACvD,OAAO;QACL,KAAK;QACL,KAAK;QACL,iBAAiB;QACjB,eAAe;QACf,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -15,6 +15,8 @@ export { computeProofHash } from "@mikeargento/bitgraph-verify";
 export { canonicalize, canonicalizeToString, constantTimeEqual } from "@mikeargento/bitgraph-verify";
 export type { HostCapabilities } from "./host.js";
 export { Constructor } from "./constructor.js";
+export { fuse, builderFor, FuseError, digestFromBase64 } from "./fuse.js";
+export type { FuseBuilder, BuilderInput, FuseOptions, FuseResult, FuseTransport, FuseErrorCode } from "./fuse.js";
 export { parsePolicy, hashPolicy, createPolicyBinding, validateAction, } from "./policy.js";
 export type { PolicyDocument, PolicyRules, ActionValidationResult, } from "./policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAGH,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGrG,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,WAAW,EACX,sBAAsB,GACvB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAGH,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGrG,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAK/C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1E,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGlH,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,WAAW,EACX,sBAAsB,GACvB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -4,6 +4,10 @@ export { computeProofHash } from "@mikeargento/bitgraph-verify";
 export { canonicalize, canonicalizeToString, constantTimeEqual } from "@mikeargento/bitgraph-verify";
 // Constructor (write path)
 export { Constructor } from "./constructor.js";
+// The producer profile over the primitive (working name Fuse): allocate a
+// slot, write a commitment to it into the artifact, hash, commit under the
+// same slot. The resulting proof is ordinary bitgraph/1.
+export { fuse, builderFor, FuseError, digestFromBase64 } from "./fuse.js";
 // Policy parsing, hashing, and validation
 export { parsePolicy, hashPolicy, createPolicyBinding, validateAction, } from "./policy.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AA4BhE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKrG,2BAA2B;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,0CAA0C;AAC1C,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AA4BhE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKrG,2BAA2B;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,0EAA0E;AAC1E,2EAA2E;AAC3E,yDAAyD;AACzD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG1E,0CAA0C;AAC1C,OAAO,EACL,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikeargento/bitgraph",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Portable cryptographic proof of construction for digital artifacts.",
   "type": "module",
@@ -17,21 +17,23 @@
     "src",
     "README.md",
     "LICENSE",
-    "NOTICE"
+    "NOTICE",
+    "!src/__tests__/fuse-fixtures"
   ],
   "scripts": {
     "build": "npm run build --workspace=packages/verify && npm run build --workspace=packages/audit && npm run build --workspace=packages/player && npm run build --workspace=packages/mcp && tsc",
     "typecheck": "npm run build --workspace=packages/verify && npm run build --workspace=packages/audit && npm run typecheck --workspace=packages/mcp && tsc --noEmit",
-    "test:core": "npm run build && node --test dist/__tests__/canonical.test.js dist/__tests__/constructor.test.js dist/__tests__/verifier.test.js dist/__tests__/proof-integrity.test.js dist/__tests__/audit-ingest.test.js dist/__tests__/audit-tiers.test.js dist/__tests__/audit-reconstruct.test.js dist/__tests__/audit-anomalies.test.js dist/__tests__/audit-anchors.test.js dist/__tests__/audit-witness.test.js dist/__tests__/audit-temporal.test.js dist/__tests__/audit-attestation.test.js dist/__tests__/audit-report.test.js dist/__tests__/audit-cli.test.js dist/__tests__/audit-property.test.js dist/__tests__/audit-real-fixtures.test.js dist/__tests__/audit-dependencies.test.js dist/__tests__/audit-bench-smoke.test.js dist/__tests__/audit-roundtrip.test.js dist/__tests__/audit-real-live.test.js dist/__tests__/chain-hash-anchor.test.js dist/__tests__/audit-boundary.test.js dist/__tests__/audit-witness-real.test.js dist/__tests__/audit-memory-ingest.test.js",
-    "test": "npm run test:core"
+    "test:core": "npm run build && node --test dist/__tests__/canonical.test.js dist/__tests__/constructor.test.js dist/__tests__/verifier.test.js dist/__tests__/proof-integrity.test.js dist/__tests__/audit-ingest.test.js dist/__tests__/audit-tiers.test.js dist/__tests__/audit-reconstruct.test.js dist/__tests__/audit-anomalies.test.js dist/__tests__/audit-anchors.test.js dist/__tests__/audit-witness.test.js dist/__tests__/audit-temporal.test.js dist/__tests__/audit-attestation.test.js dist/__tests__/audit-report.test.js dist/__tests__/audit-cli.test.js dist/__tests__/audit-property.test.js dist/__tests__/audit-real-fixtures.test.js dist/__tests__/audit-dependencies.test.js dist/__tests__/audit-bench-smoke.test.js dist/__tests__/audit-roundtrip.test.js dist/__tests__/audit-real-live.test.js dist/__tests__/chain-hash-anchor.test.js dist/__tests__/audit-boundary.test.js dist/__tests__/audit-witness-real.test.js dist/__tests__/audit-memory-ingest.test.js dist/__tests__/fuse-vectors.test.js dist/__tests__/fuse-roundtrip.test.js dist/__tests__/fuse-verify.test.js dist/__tests__/fuse-sdk.test.js",
+    "test": "npm run test:core",
+    "prepack": "npm run build"
   },
   "dependencies": {
-    "@mikeargento/bitgraph-verify": "^1.0.0",
+    "@mikeargento/bitgraph-verify": "^1.4.0",
     "@noble/ed25519": "^2.1.0",
     "@noble/hashes": "^1.4.0"
   },
   "devDependencies": {
-    "@mikeargento/bitgraph-audit": "^0.1.0",
+    "@mikeargento/bitgraph-audit": "^0.4.0",
     "@types/node": "^20.0.0",
     "typescript": "^5.4.0"
   },
@@ -41,5 +43,8 @@
     "packages/mcp",
     "packages/player",
     "packages/titles"
-  ]
+  ],
+  "bin": {
+    "bitgraph-fuse": "./dist/fuse-cli.js"
+  }
 }

package/src/__tests__/fuse-roundtrip.test.ts

@@ -0,0 +1,174 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+
+/**
+ * BitGraph Fuse: reconstruction round trips (spec 15.3). A placement enters
+ * the registry only with this test passing: original plus proof rebuilds
+ * bytes whose hash equals the artifact digest, from fixed vectors.
+ */
+
+import { describe, test } from "node:test";
+import * as assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { sha256 } from "@noble/hashes/sha256";
+import { PLACEMENTS, getPlacement, computeSlotCommitment, bytesToBase64, buildFrame, parseFrame, readFrameMarker, readFuseAttribution, fuseAttribution } from "@mikeargento/bitgraph-verify";
+import type { BitGraphProof } from "@mikeargento/bitgraph-verify";
+
+const FIX = fileURLToPath(new URL("../../src/__tests__/fuse-fixtures/", import.meta.url));
+const bytes = (name: string) => new Uint8Array(readFileSync(FIX + name));
+const proofOf = (name: string) => JSON.parse(readFileSync(FIX + name, "utf8")) as BitGraphProof;
+
+describe("registry", () => {
+  test("fixed order and ids", () => {
+    assert.deepEqual(PLACEMENTS.map((p) => p.id), ["trailer/1", "container/1", "produced/1"]);
+    assert.deepEqual(PLACEMENTS.map((p) => p.byteExact), [true, true, false]);
+    assert.equal(getPlacement("xmp/9"), undefined);
+    assert.equal(getPlacement(""), undefined);
+  });
+});
+
+describe("trailer/1", () => {
+  const p = getPlacement("trailer/1")!;
+  test("original + proof rebuilds the committed bytes", () => {
+    const proof = proofOf("trailer.proof.json");
+    const rebuilt = p.build({ original: bytes("original.txt"), commitment: computeSlotCommitment(proof.slotAllocation!) });
+    assert.deepEqual(rebuilt, bytes("fused-trailer.bin"));
+    assert.equal(bytesToBase64(sha256(rebuilt)), proof.artifact.digestB64);
+  });
+  test("locate returns the commitment and the exact original prefix", () => {
+    const proof = proofOf("trailer.proof.json");
+    const l = p.locate(bytes("fused-trailer.bin"))!;
+    assert.deepEqual(l.commitment, computeSlotCommitment(proof.slotAllocation!));
+    assert.deepEqual(l.originalBytes, bytes("original.txt"));
+    assert.equal(l.originDigest, undefined, "trailer/1 writes no origin digest");
+  });
+  test("locate refuses short input, wrong magic, non-zero reserved bytes", () => {
+    assert.equal(p.locate(new Uint8Array(47)), null);
+    const f = bytes("fused-trailer.bin");
+    const magic = f.slice(); magic[magic.length - 48] = 0x58;
+    assert.equal(p.locate(magic), null);
+    const reserved = f.slice(); reserved[reserved.length - 40] = 1;
+    assert.equal(p.locate(reserved), null);
+    assert.equal(p.locate(bytes("original.txt")), null, "an unfused file has no trailer");
+  });
+  test("build refuses a bad commitment length and a missing original", () => {
+    assert.throws(() => p.build({ commitment: new Uint8Array(32) }), /original/);
+    assert.throws(() => p.build({ original: new Uint8Array(1), commitment: new Uint8Array(31) }), /32 bytes/);
+  });
+});
+
+describe("container/1", () => {
+  const p = getPlacement("container/1")!;
+  test("original + proof rebuilds the committed archive byte for byte, twice", () => {
+    const proof = proofOf("container.proof.json");
+    const c = computeSlotCommitment(proof.slotAllocation!);
+    const a = p.build({ original: bytes("image.png"), commitment: c });
+    const b = p.build({ original: bytes("image.png"), commitment: c });
+    assert.deepEqual(a, b, "deterministic");
+    assert.deepEqual(a, bytes("fused-container.tar"));
+    assert.equal(bytesToBase64(sha256(a)), proof.artifact.digestB64);
+  });
+  test("locate returns commitment, origin digest and the original bytes", () => {
+    const proof = proofOf("container.proof.json");
+    const l = p.locate(bytes("fused-container.tar"))!;
+    assert.deepEqual(l.commitment, computeSlotCommitment(proof.slotAllocation!));
+    assert.deepEqual(l.originDigest, sha256(bytes("image.png")));
+    assert.deepEqual(l.originalBytes, bytes("image.png"));
+  });
+  test("locate refuses any deviation from the fixed layout", () => {
+    const f = bytes("fused-container.tar");
+    const mtime = f.slice(); mtime[136] = 0x31;                         // manifest header mtime
+    assert.equal(p.locate(mtime), null, "non-zero mtime");
+    const uid = f.slice(); uid[108] = 0x31;
+    assert.equal(p.locate(uid), null, "uid");
+    const truncated = f.subarray(0, f.length - 512);
+    assert.equal(p.locate(truncated), null, "missing end block");
+    const extra = new Uint8Array(f.length + 512); extra.set(f);
+    assert.equal(p.locate(extra), null, "extra trailing block");
+    // Swap entry order: rebuild with the original first is not this placement.
+    const swapped = f.slice(); swapped[0] = 0x78;                        // corrupt the manifest name
+    assert.equal(p.locate(swapped), null, "wrong entry name");
+    assert.equal(p.locate(bytes("image.png")), null, "not a tar");
+    assert.equal(p.locate(bytes("fused-trailer.bin")), null);
+  });
+  test("an archive with a wrong manifest origin does not locate", () => {
+    const proof = proofOf("container.proof.json");
+    const c = computeSlotCommitment(proof.slotAllocation!);
+    const lying = p.build({ original: bytes("image.png"), originDigest: sha256(bytes("original.txt")), commitment: c });
+    // build accepts a caller-supplied origin digest; locate returns what is written,
+    // and the verifier compares it against the marker and the original's hash.
+    const l = p.locate(lying)!;
+    assert.deepEqual(l.originDigest, sha256(bytes("original.txt")));
+    assert.notDeepEqual(l.originDigest, sha256(l.originalBytes!));
+  });
+});
+
+describe("produced/1", () => {
+  const p = getPlacement("produced/1")!;
+  test("build and locate agree, with and without an origin", () => {
+    for (const [name, proofName] of [["produced-origin.json", "produced-origin.proof.json"], ["produced-bare.json", "produced-bare.proof.json"]] as const) {
+      const proof = proofOf(proofName);
+      const l = p.locate(bytes(name))!;
+      assert.deepEqual(l.commitment, computeSlotCommitment(proof.slotAllocation!));
+      assert.equal(bytesToBase64(sha256(bytes(name))), proof.artifact.digestB64);
+    }
+    assert.equal(p.locate(bytes("original.txt")), null);
+    assert.throws(() => p.build({ original: new Uint8Array(1), commitment: new Uint8Array(32) }), /no original/);
+  });
+});
+
+describe("legacy files that carry a nonce line", () => {
+  test("a file with a 'nonce:' line and no trailer, container or payload locates nothing", () => {
+    // ~/BitGraph holds recordings whose bytes begin with a test label and a line
+    // "nonce: <hex>" (the proto pattern, minted 2026-06-27 and 2026-08-06). That
+    // line is content, not a commitment: every registered placement must miss.
+    const legacy = new TextEncoder().encode("BitGraph test subject folder-02 file-02\nnonce: e317096692576a308263bc283d66b42e\nuoJjpYb8igrEhhSlczKKTKDyw6guO2iU5iHdBRF+mPELQqBfjrO2WZYrSWyHEuKK\n");
+    for (const p of PLACEMENTS) assert.equal(p.locate(legacy), null, p.id);
+  });
+});
+
+describe("attribution and Frame", () => {
+  test("fused attribution carries placement in title and origin in message (standard base64)", () => {
+    const origin = sha256(bytes("original.txt"));
+    const a = fuseAttribution("trailer/1", origin);
+    assert.deepEqual(a, { name: "bitgraph-fuse/1", title: "trailer/1", message: bytesToBase64(origin) });
+    assert.deepEqual(fuseAttribution("produced/1"), { name: "bitgraph-fuse/1", title: "produced/1" });
+    const proof = proofOf("trailer.proof.json");
+    const m = readFuseAttribution(proof)!;
+    assert.equal(m.placement, "trailer/1");
+    assert.equal(m.placementSource, "attribution");
+    assert.equal(m.source, "attribution");
+    assert.deepEqual(m.originDigest, origin);
+    assert.equal(m.originSource, "attribution");
+    const bare = readFuseAttribution(proofOf("trailer-undeclared.proof.json"))!;
+    assert.equal(bare.originDigest, undefined);
+    assert.equal(bare.originSource, undefined);
+    assert.equal(readFuseAttribution(proofOf("recorded.proof.json")), null, "an ordinary proof has no marker");
+  });
+  test("a Frame parses regardless of outer formatting and the nested proof is untouched", () => {
+    const text = readFileSync(FIX + "trailer.bitgraph-fuse.json", "utf8");
+    const a = parseFrame(text)!;
+    const b = parseFrame(JSON.stringify(JSON.parse(text)))!;
+    assert.deepEqual(a, b);
+    assert.equal(a.manifest.placement, "trailer/1");
+    assert.deepEqual(a.proof, proofOf("trailer.proof.json"));
+    const marker = readFrameMarker(a);
+    assert.equal(marker.source, "manifest");
+    assert.equal(marker.placementSource, "manifest");
+    assert.deepEqual(marker.originDigest, sha256(bytes("original.txt")));
+    const undeclared = parseFrame({ type: "bitgraph-fuse/1", manifest: { artifact: { algorithm: "sha256", digest: "00".repeat(32) }, fusedFile: null }, proof: proofOf("trailer.proof.json") })!;
+    assert.equal(readFrameMarker(undeclared).placement, null, "a manifest may leave the placement undeclared");
+    assert.equal(parseFrame(proofOf("trailer.proof.json")), null, "a bare proof is not a Frame");
+    assert.equal(parseFrame("{not json"), null);
+    assert.equal(parseFrame({ type: "bitgraph-fuse/1", manifest: { placement: "trailer/1", artifact: { algorithm: "sha256", digest: "zz" }, fusedFile: null }, proof: {} }), null);
+  });
+  test("a Frame is never proof-shaped", () => {
+    const f = JSON.parse(readFileSync(FIX + "produced-origin.bitgraph-fuse.json", "utf8")) as Record<string, unknown>;
+    assert.equal(f.version, undefined);
+    assert.equal(f.artifact, undefined);
+    assert.equal(f.signer, undefined);
+    assert.equal(f.type, "bitgraph-fuse/1");
+    assert.ok(f.fusePayload, "Form C frames carry the parsed payload view");
+    assert.throws(() => buildFrame({ proof: proofOf("produced-origin.proof.json"), placement: "produced/1", artifactDigest: new Uint8Array(32), fusedFile: null, fusePayload: new Uint8Array([1]) }), /canonical/);
+  });
+});