@mikeargento/bitgraph 1.2.0 → 1.4.0

package/dist/proof-hash.js

@@ -0,0 +1,75 @@
+// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
+/**
+ * bitgraph-core proof hash
+ *
+ * Canonical, deterministic proof hash computation.
+ *
+ * The proof hash covers the SIGNED BODY — the fields that are
+ * cryptographically signed by the enclave. This matches what the
+ * Ed25519 signature covers, making the hash verifiable.
+ *
+ * Signed body fields:
+ *   - version, artifact, commit
+ *   - publicKeyB64 (from signer)
+ *   - enforcement, measurement (from environment)
+ *   - attribution (if present)
+ *   - attestationFormat (if attestation present)
+ *
+ * This hash is used for:
+ *   - prevB64 chain linking
+ *   - S3 ledger key generation
+ *   - Ethereum anchor binding
+ *   - Proof deduplication and verification
+ *
+ * Algorithm:
+ *   1. Extract signed body fields
+ *   2. canonicalize(signedBody) — recursive key sort, compact JSON, UTF-8
+ *   3. SHA-256 of canonical bytes
+ *   4. Base64-standard encode (RFC 4648 §4)
+ *
+ * IMPORTANT: All call sites MUST use this function. Do NOT compute
+ * proof hashes ad-hoc with JSON.stringify or Object.keys().sort().
+ * Non-recursive key sorting diverges on nested objects.
+ */
+import { canonicalize } from "./canonical.js";
+import { sha256 } from "@noble/hashes/sha256";
+/**
+ * Compute the canonical hash of a BitGraph proof's signed body.
+ *
+ * @param proof - The full BitGraphProof object (or equivalent Record)
+ * @returns Base64-standard encoded SHA-256 hash
+ */
+export function computeProofHash(proof) {
+    const p = proof;
+    const signer = p.signer;
+    const env = p.environment;
+    const signedBody = {
+        version: p.version,
+        artifact: p.artifact,
+        commit: p.commit,
+        publicKeyB64: signer?.publicKeyB64,
+        enforcement: env?.enforcement,
+        measurement: env?.measurement,
+    };
+    // Include attribution if present
+    if (p.attribution) {
+        signedBody.attribution = p.attribution;
+    }
+    // Include attestation format if present
+    if (env?.attestation) {
+        signedBody.attestationFormat = env.attestation.format;
+    }
+    const bytes = canonicalize(signedBody);
+    const hash = sha256(bytes);
+    // Base64 encode (works in both Node.js and browser)
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(hash).toString("base64");
+    }
+    // Browser fallback
+    let binary = "";
+    for (let i = 0; i < hash.length; i++) {
+        binary += String.fromCharCode(hash[i]);
+    }
+    return btoa(binary);
+}
+//# sourceMappingURL=proof-hash.js.map

package/dist/proof-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-hash.js","sourceRoot":"","sources":["../src/proof-hash.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA8C;IAC7E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,MAA8C,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAC,WAAyG,CAAC;IAExH,MAAM,UAAU,GAA4B;QAC1C,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,MAAM,EAAE,YAAY;QAClC,WAAW,EAAE,GAAG,EAAE,WAAW;QAC7B,WAAW,EAAE,GAAG,EAAE,WAAW;KAC9B,CAAC;IAEF,iCAAiC;IACjC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClB,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,wCAAwC;IACxC,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC;QACrB,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,UAAsC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3B,oDAAoD;IACpD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,mBAAmB;IACnB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}