@mikeargento/bitgraph 1.9.0 → 1.9.2

package/src/__tests__/fuse-roundtrip.test.ts

@@ -1,243 +0,0 @@
-// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
-
-/**
- * BitGraph Fuse: reconstruction round trips (spec 15.3). A placement enters
- * the registry only with this test passing: original plus proof rebuilds
- * bytes whose hash equals the artifact digest, from fixed vectors.
- */
-
-import { describe, test } from "node:test";
-import * as assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { sha256 } from "@noble/hashes/sha256";
-import { PLACEMENTS, getPlacement, computeSlotCommitment, bytesToBase64, buildFrame, parseFrame, readFrameMarker, readFuseAttribution, fuseAttribution } from "@mikeargento/bitgraph-verify";
-import type { BitGraphProof } from "@mikeargento/bitgraph-verify";
-
-const FIX = fileURLToPath(new URL("../../src/__tests__/fuse-fixtures/", import.meta.url));
-const bytes = (name: string) => new Uint8Array(readFileSync(FIX + name));
-const proofOf = (name: string) => JSON.parse(readFileSync(FIX + name, "utf8")) as BitGraphProof;
-
-describe("registry", () => {
-  test("fixed order and ids", () => {
-    assert.deepEqual(PLACEMENTS.map((p) => p.id), ["trailer/1", "container/1", "container/2", "produced/1"]);
-    assert.deepEqual(PLACEMENTS.map((p) => p.byteExact), [true, true, true, false]);
-    assert.equal(getPlacement("xmp/9"), undefined);
-    assert.equal(getPlacement(""), undefined);
-  });
-});
-
-describe("trailer/1", () => {
-  const p = getPlacement("trailer/1")!;
-  test("original + proof rebuilds the committed bytes", () => {
-    const proof = proofOf("trailer.proof.json");
-    const rebuilt = p.build({ original: bytes("original.txt"), commitment: computeSlotCommitment(proof.slotAllocation!) });
-    assert.deepEqual(rebuilt, bytes("fused-trailer.bin"));
-    assert.equal(bytesToBase64(sha256(rebuilt)), proof.artifact.digestB64);
-  });
-  test("locate returns the commitment and the exact original prefix", () => {
-    const proof = proofOf("trailer.proof.json");
-    const l = p.locate(bytes("fused-trailer.bin"))!;
-    assert.deepEqual(l.commitment, computeSlotCommitment(proof.slotAllocation!));
-    assert.deepEqual(l.originalBytes, bytes("original.txt"));
-    assert.equal(l.originDigest, undefined, "trailer/1 writes no origin digest");
-  });
-  test("locate refuses short input, wrong magic, non-zero reserved bytes", () => {
-    assert.equal(p.locate(new Uint8Array(47)), null);
-    const f = bytes("fused-trailer.bin");
-    const magic = f.slice(); magic[magic.length - 48] = 0x58;
-    assert.equal(p.locate(magic), null);
-    const reserved = f.slice(); reserved[reserved.length - 40] = 1;
-    assert.equal(p.locate(reserved), null);
-    assert.equal(p.locate(bytes("original.txt")), null, "an unfused file has no trailer");
-  });
-  test("build refuses a bad commitment length and a missing original", () => {
-    assert.throws(() => p.build({ commitment: new Uint8Array(32) }), /original/);
-    assert.throws(() => p.build({ original: new Uint8Array(1), commitment: new Uint8Array(31) }), /32 bytes/);
-  });
-});
-
-describe("container/1", () => {
-  const p = getPlacement("container/1")!;
-  test("original + proof rebuilds the committed archive byte for byte, twice", () => {
-    const proof = proofOf("container.proof.json");
-    const c = computeSlotCommitment(proof.slotAllocation!);
-    const a = p.build({ original: bytes("image.png"), commitment: c });
-    const b = p.build({ original: bytes("image.png"), commitment: c });
-    assert.deepEqual(a, b, "deterministic");
-    assert.deepEqual(a, bytes("fused-container.tar"));
-    assert.equal(bytesToBase64(sha256(a)), proof.artifact.digestB64);
-  });
-  test("locate returns commitment, origin digest and the original bytes", () => {
-    const proof = proofOf("container.proof.json");
-    const l = p.locate(bytes("fused-container.tar"))!;
-    assert.deepEqual(l.commitment, computeSlotCommitment(proof.slotAllocation!));
-    assert.deepEqual(l.originDigest, sha256(bytes("image.png")));
-    assert.deepEqual(l.originalBytes, bytes("image.png"));
-  });
-  test("locate refuses any deviation from the fixed layout", () => {
-    const f = bytes("fused-container.tar");
-    const mtime = f.slice(); mtime[136] = 0x31;                         // manifest header mtime
-    assert.equal(p.locate(mtime), null, "non-zero mtime");
-    const uid = f.slice(); uid[108] = 0x31;
-    assert.equal(p.locate(uid), null, "uid");
-    const truncated = f.subarray(0, f.length - 512);
-    assert.equal(p.locate(truncated), null, "missing end block");
-    const extra = new Uint8Array(f.length + 512); extra.set(f);
-    assert.equal(p.locate(extra), null, "extra trailing block");
-    // Swap entry order: rebuild with the original first is not this placement.
-    const swapped = f.slice(); swapped[0] = 0x78;                        // corrupt the manifest name
-    assert.equal(p.locate(swapped), null, "wrong entry name");
-    assert.equal(p.locate(bytes("image.png")), null, "not a tar");
-    assert.equal(p.locate(bytes("fused-trailer.bin")), null);
-  });
-  test("an archive with a wrong manifest origin does not locate", () => {
-    const proof = proofOf("container.proof.json");
-    const c = computeSlotCommitment(proof.slotAllocation!);
-    const lying = p.build({ original: bytes("image.png"), originDigest: sha256(bytes("original.txt")), commitment: c });
-    // build accepts a caller-supplied origin digest; locate returns what is written,
-    // and the verifier compares it against the marker and the original's hash.
-    const l = p.locate(lying)!;
-    assert.deepEqual(l.originDigest, sha256(bytes("original.txt")));
-    assert.notDeepEqual(l.originDigest, sha256(l.originalBytes!));
-  });
-});
-
-describe("produced/1", () => {
-  const p = getPlacement("produced/1")!;
-  test("build and locate agree, with and without an origin", () => {
-    for (const [name, proofName] of [["produced-origin.json", "produced-origin.proof.json"], ["produced-bare.json", "produced-bare.proof.json"]] as const) {
-      const proof = proofOf(proofName);
-      const l = p.locate(bytes(name))!;
-      assert.deepEqual(l.commitment, computeSlotCommitment(proof.slotAllocation!));
-      assert.equal(bytesToBase64(sha256(bytes(name))), proof.artifact.digestB64);
-    }
-    assert.equal(p.locate(bytes("original.txt")), null);
-    assert.throws(() => p.build({ original: new Uint8Array(1), commitment: new Uint8Array(32) }), /no original/);
-  });
-});
-
-describe("legacy files that carry a nonce line", () => {
-  test("a file with a 'nonce:' line and no trailer, container or payload locates nothing", () => {
-    // ~/BitGraph holds recordings whose bytes begin with a test label and a line
-    // "nonce: <hex>" (the proto pattern, minted 2026-06-27 and 2026-08-06). That
-    // line is content, not a commitment: every registered placement must miss.
-    const legacy = new TextEncoder().encode("BitGraph test subject folder-02 file-02\nnonce: e317096692576a308263bc283d66b42e\nuoJjpYb8igrEhhSlczKKTKDyw6guO2iU5iHdBRF+mPELQqBfjrO2WZYrSWyHEuKK\n");
-    for (const p of PLACEMENTS) assert.equal(p.locate(legacy), null, p.id);
-  });
-});
-
-describe("attribution and Frame", () => {
-  test("fused attribution carries placement in title and origin in message (standard base64)", () => {
-    const origin = sha256(bytes("original.txt"));
-    const a = fuseAttribution("trailer/1", origin);
-    assert.deepEqual(a, { name: "bitgraph-fuse/1", title: "trailer/1", message: bytesToBase64(origin) });
-    assert.deepEqual(fuseAttribution("produced/1"), { name: "bitgraph-fuse/1", title: "produced/1" });
-    const proof = proofOf("trailer.proof.json");
-    const m = readFuseAttribution(proof)!;
-    assert.equal(m.placement, "trailer/1");
-    assert.equal(m.placementSource, "attribution");
-    assert.equal(m.source, "attribution");
-    assert.deepEqual(m.originDigest, origin);
-    assert.equal(m.originSource, "attribution");
-    const bare = readFuseAttribution(proofOf("trailer-undeclared.proof.json"))!;
-    assert.equal(bare.originDigest, undefined);
-    assert.equal(bare.originSource, undefined);
-    assert.equal(readFuseAttribution(proofOf("recorded.proof.json")), null, "an ordinary proof has no marker");
-  });
-  test("a Frame parses regardless of outer formatting and the nested proof is untouched", () => {
-    const text = readFileSync(FIX + "trailer.bitgraph-fuse.json", "utf8");
-    const a = parseFrame(text)!;
-    const b = parseFrame(JSON.stringify(JSON.parse(text)))!;
-    assert.deepEqual(a, b);
-    assert.equal(a.manifest.placement, "trailer/1");
-    assert.deepEqual(a.proof, proofOf("trailer.proof.json"));
-    const marker = readFrameMarker(a);
-    assert.equal(marker.source, "manifest");
-    assert.equal(marker.placementSource, "manifest");
-    assert.deepEqual(marker.originDigest, sha256(bytes("original.txt")));
-    const undeclared = parseFrame({ type: "bitgraph-fuse/1", manifest: { artifact: { algorithm: "sha256", digest: "00".repeat(32) }, fusedFile: null }, proof: proofOf("trailer.proof.json") })!;
-    assert.equal(readFrameMarker(undeclared).placement, null, "a manifest may leave the placement undeclared");
-    assert.equal(parseFrame(proofOf("trailer.proof.json")), null, "a bare proof is not a Frame");
-    assert.equal(parseFrame("{not json"), null);
-    assert.equal(parseFrame({ type: "bitgraph-fuse/1", manifest: { placement: "trailer/1", artifact: { algorithm: "sha256", digest: "zz" }, fusedFile: null }, proof: {} }), null);
-  });
-  test("a Frame is never proof-shaped", () => {
-    const f = JSON.parse(readFileSync(FIX + "produced-origin.bitgraph-fuse.json", "utf8")) as Record<string, unknown>;
-    assert.equal(f.version, undefined);
-    assert.equal(f.artifact, undefined);
-    assert.equal(f.signer, undefined);
-    assert.equal(f.type, "bitgraph-fuse/1");
-    assert.ok(f.fusePayload, "Form C frames carry the parsed payload view");
-    assert.throws(() => buildFrame({ proof: proofOf("produced-origin.proof.json"), placement: "produced/1", artifactDigest: new Uint8Array(32), fusedFile: null, fusePayload: new Uint8Array([1]) }), /canonical/);
-  });
-});
-
-describe("container/2: the original first, then the manifest", () => {
-  const p = getPlacement("container/2")!;
-  const commitment = new Uint8Array(32).fill(0x5a);
-  const other = new Uint8Array(32).fill(0xa5);
-  const sizes = [0, 1, 511, 512, 513, 1023, 1024, 1025, 100_000, 1_048_579];
-  const filled = (n: number) => { const b = new Uint8Array(n); for (let i = 0; i < n; i++) b[i] = (i * 13 + 7) & 0xff; return b; };
-
-  test("build carries the original whole and first; locate reads it back and each container refuses the other's bytes", () => {
-    for (const n of sizes) {
-      const original = filled(n);
-      const fused = p.build({ original, commitment });
-      assert.equal(new TextDecoder().decode(fused.subarray(0, 22)), "bitgraph-fuse/original");
-      const l = p.locate(fused);
-      assert.ok(l, `locate ${n}`);
-      assert.deepEqual(l!.commitment, commitment);
-      assert.deepEqual(l!.originDigest, sha256(original));
-      assert.deepEqual(l!.originalBytes, original);
-      const c1 = getPlacement("container/1")!.build({ original, commitment });
-      assert.equal(p.locate(c1), null, `container/2 refuses container/1 bytes (${n})`);
-      assert.equal(getPlacement("container/1")!.locate(fused), null, `container/1 refuses container/2 bytes (${n})`);
-      const tampered = new Uint8Array(fused); tampered[tampered.length - 600] = (tampered[tampered.length - 600] ?? 0) ^ 1;
-      assert.equal(p.locate(tampered), null);
-    }
-  });
-
-  test("frame: prefix, original, suffix is the build, byte for byte, for every Form A and B placement and size", () => {
-    for (const id of ["trailer/1", "container/1", "container/2"] as const) {
-      const q = getPlacement(id)!;
-      for (const n of sizes) {
-        const original = filled(n);
-        const originDigest = sha256(original);
-        for (const c of [commitment, other]) {
-          const f = q.frame!({ originalSize: n, originDigest, commitment: c });
-          const joined = new Uint8Array(f.prefix.length + n + f.suffix.length);
-          joined.set(f.prefix, 0); joined.set(original, f.prefix.length); joined.set(f.suffix, f.prefix.length + n);
-          assert.deepEqual(joined, q.build({ original, originDigest, commitment: c }), `${id} ${n}`);
-        }
-      }
-    }
-  });
-
-  test("scanPrefix: fixed for trailer/1 (empty) and container/2 (the original's header), null for container/1 whose prefix carries the commitment", () => {
-    for (const n of sizes) {
-      const originDigest = sha256(filled(n));
-      assert.deepEqual(getPlacement("trailer/1")!.scanPrefix!(n), new Uint8Array(0));
-      const pre = p.scanPrefix!(n)!;
-      assert.equal(pre.length, 512);
-      for (const c of [commitment, other]) assert.deepEqual(p.frame!({ originalSize: n, originDigest, commitment: c }).prefix, pre, `the same prefix under any commitment (${n})`);
-      assert.equal(getPlacement("container/1")!.scanPrefix!(n), null);
-    }
-    assert.equal(getPlacement("produced/1")!.frame, undefined);
-    assert.equal(getPlacement("set/1")!.frame, undefined);
-  });
-
-  test("a hasher state saved after prefix and original, finished with the suffix, is the fused digest: the file is read once", () => {
-    for (const n of [0, 1, 511, 512, 513, 100_000]) {
-      const original = filled(n);
-      const originDigest = sha256(original);
-      const h = sha256.create();
-      h.update(p.scanPrefix!(n)!);
-      h.update(original);
-      for (const c of [commitment, other]) {
-        const finished = h.clone().update(p.frame!({ originalSize: n, originDigest, commitment: c }).suffix).digest();
-        assert.deepEqual(finished, sha256(p.build({ original, originDigest, commitment: c })), `${n} bytes`);
-      }
-    }
-  });
-});

package/src/__tests__/fuse-sdk.test.ts

@@ -1,142 +0,0 @@
-// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
-
-/**
- * fuse() against a fake transport built from real fixture proofs (minted
- * through the local enclave harness). Every refusal path runs.
- */
-
-import { describe, test } from "node:test";
-import * as assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { fuse, builderFor, FuseError } from "../fuse.js";
-import type { BitGraphProof, SlotAllocation } from "../fuse.js";
-
-const FIX = fileURLToPath(new URL("../../src/__tests__/fuse-fixtures/", import.meta.url));
-const bytes = (name: string) => new Uint8Array(readFileSync(FIX + name));
-const proofOf = (name: string) => JSON.parse(readFileSync(FIX + name, "utf8")) as BitGraphProof;
-
-interface Call { path: string; body: unknown }
-
-/** A transport that hands out `slot` and answers the commit with `answer`. */
-function fakeTransport(slot: SlotAllocation, answer: (calls: Call[], body: unknown) => { status: number; json: unknown }, lookup?: (calls: Call[]) => { status: number; json: unknown }) {
-  const calls: Call[] = [];
-  const f: typeof fetch = async (input, init) => {
-    const url = String(input);
-    const path = url.replace(/^https?:\/\/[^/]+/, "");
-    const body = init?.body ? JSON.parse(String(init.body)) : undefined;
-    calls.push({ path, body });
-    const reply = (r: { status: number; json: unknown }) => new Response(JSON.stringify(r.json), { status: r.status, headers: { "Content-Type": "application/json" } });
-    if (path === "/api/fuse/allocate") return reply({ status: 200, json: { slotId: slot.nonceB64, slot, chainId: "bitgraph:main" } });
-    if (path === "/api/fuse/commit") return reply(answer(calls, body));
-    if (path.startsWith("/api/proofs/")) return reply(lookup ? lookup(calls) : { status: 200, json: { proofs: [] } });
-    return reply({ status: 404, json: { error: "no route" } });
-  };
-  return { calls, transport: { baseUrl: "https://example.test", fetch: f, recoveryAttempts: 2, recoveryDelayMs: 1 } };
-}
-
-describe("fuse(): the four beats", () => {
-  test("trailer/1 over an existing original: allocate, fuse, hash, fill; Frame carries the unchanged proof", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const { calls, transport } = fakeTransport(proof.slotAllocation!, () => ({ status: 200, json: { proof } }));
-    const original = bytes("original.txt");
-    const r = await fuse(builderFor("trailer/1", original), { placement: "trailer/1", original, fusedFile: "photo.jpg", transport });
-    assert.equal(r.artifactDigestB64, proof.artifact.digestB64);
-    assert.deepEqual(r.proof, proof);
-    assert.equal(r.frame.type, "bitgraph-fuse/1");
-    assert.equal(r.frame.manifest.placement, "trailer/1");
-    assert.equal(r.frame.manifest.fusedFile, "photo.jpg");
-    assert.deepEqual(r.frame.proof, proof);
-    assert.equal(r.recovered, false);
-    assert.equal(r.verification.category, "FUSED_DIRECT");
-    assert.equal(r.fusedBytes, undefined, "byte-exact placements evaporate by default");
-    // The commit carried the placement and origin in the attribution, and named the slot.
-    const commit = calls.find((c) => c.path === "/api/fuse/commit")!.body as Record<string, unknown>;
-    assert.equal(commit.slotId, proof.slotAllocation!.nonceB64);
-    assert.deepEqual(commit.attribution, { name: "bitgraph-fuse/1", title: "trailer/1", message: r.originDigestB64 });
-    assert.deepEqual(commit.digests, [{ digestB64: proof.artifact.digestB64, hashAlg: "sha256" }]);
-    assert.equal(commit.chainId, "bitgraph:main");
-    // The raw nonce appears in no error and nowhere but the slot field it must ride in.
-    assert.ok(!JSON.stringify(commit.attribution).includes(proof.slotAllocation!.nonceB64));
-  });
-
-  test("produced/1 keeps its bytes and its payload view in the Frame", async () => {
-    const proof = proofOf("produced-origin.proof.json");
-    const { transport } = fakeTransport(proof.slotAllocation!, () => ({ status: 200, json: [proof] }));
-    const originDigest = new Uint8Array(Buffer.from(proof.attribution!.message!, "base64"));
-    const r = await fuse(builderFor("produced/1"), { placement: "produced/1", originDigest, transport });
-    assert.ok(r.fusedBytes, "Form C keeps the fused bytes");
-    assert.deepEqual(r.fusedBytes, bytes("produced-origin.json"));
-    assert.ok(r.frame.fusePayload);
-    assert.equal(r.frame.fusePayload!.type, "bitgraph-fuse/1");
-  });
-
-  test("a builder that drops the commitment is refused BEFORE any commit; the slot is left to expire", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const { calls, transport } = fakeTransport(proof.slotAllocation!, () => ({ status: 200, json: { proof } }));
-    await assert.rejects(
-      fuse(() => bytes("original.txt"), { placement: "trailer/1", original: bytes("original.txt"), transport }),
-      (e: FuseError) => e.code === "commitment-missing",
-    );
-    assert.equal(calls.filter((c) => c.path === "/api/fuse/commit").length, 0, "no commit was attempted");
-  });
-
-  test("a proof under a different slot is never labelled fused", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const other = proofOf("trailer-undeclared.proof.json");
-    const { transport } = fakeTransport(proof.slotAllocation!, () => ({ status: 200, json: { proof: other } }));
-    await assert.rejects(
-      fuse(builderFor("trailer/1", bytes("original.txt")), { placement: "trailer/1", original: bytes("original.txt"), transport }),
-      (e: FuseError) => e.code === "slot-mismatch",
-    );
-  });
-
-  test("409 slot-unavailable: the proof is read back by digest and matched on slotHashB64; nothing is re-allocated", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const decoy = proofOf("trailer-undeclared.proof.json");
-    const { calls, transport } = fakeTransport(
-      proof.slotAllocation!,
-      () => ({ status: 409, json: { error: "gone", code: "slot-unavailable" } }),
-      () => ({ status: 200, json: { proofs: [{ proof: decoy }, { proof }] } }),
-    );
-    const r = await fuse(builderFor("trailer/1", bytes("original.txt")), { placement: "trailer/1", original: bytes("original.txt"), transport });
-    assert.equal(r.recovered, true);
-    assert.deepEqual(r.proof, proof);
-    assert.equal(calls.filter((c) => c.path === "/api/fuse/allocate").length, 1, "allocated exactly once");
-  });
-
-  test("409 with no matching proof on the ledger is reported as slot-unavailable, not retried into a new slot", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const { calls, transport } = fakeTransport(proof.slotAllocation!, () => ({ status: 409, json: { error: "gone", code: "slot-unavailable" } }));
-    await assert.rejects(
-      fuse(builderFor("trailer/1", bytes("original.txt")), { placement: "trailer/1", original: bytes("original.txt"), transport }),
-      (e: FuseError) => e.code === "slot-unavailable" && !e.message.includes(proof.slotAllocation!.nonceB64),
-    );
-    assert.equal(calls.filter((c) => c.path === "/api/fuse/allocate").length, 1);
-  });
-
-  test("tee-restarting on commit: read back first, then report; a network failure after send does the same", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const a = fakeTransport(proof.slotAllocation!, () => ({ status: 503, json: { error: "restarting", code: "tee-restarting" } }), () => ({ status: 200, json: { proofs: [{ proof }] } }));
-    const r = await fuse(builderFor("trailer/1", bytes("original.txt")), { placement: "trailer/1", original: bytes("original.txt"), transport: a.transport });
-    assert.equal(r.recovered, true);
-    const b = fakeTransport(proof.slotAllocation!, () => ({ status: 503, json: { error: "restarting", code: "tee-restarting" } }));
-    await assert.rejects(fuse(builderFor("trailer/1", bytes("original.txt")), { placement: "trailer/1", original: bytes("original.txt"), transport: b.transport }), (e: FuseError) => e.code === "tee-restarting");
-  });
-
-  test("bad inputs are refused before any request", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const { calls, transport } = fakeTransport(proof.slotAllocation!, () => ({ status: 200, json: { proof } }));
-    await assert.rejects(fuse(builderFor("trailer/1", bytes("original.txt")), { placement: "xmp/9" as never, original: bytes("original.txt"), transport }), (e: FuseError) => e.code === "bad-placement");
-    await assert.rejects(fuse(builderFor("trailer/1"), { placement: "trailer/1", transport }), (e: FuseError) => e.code === "bad-input");
-    await assert.rejects(fuse(builderFor("produced/1"), { placement: "produced/1", original: bytes("original.txt"), transport }), (e: FuseError) => e.code === "bad-input");
-    assert.equal(calls.length, 0);
-    assert.throws(() => builderFor("nope/1" as never), (e: FuseError) => e.code === "bad-placement");
-  });
-
-  test("a slot off the anchored chain is refused", async () => {
-    const proof = proofOf("trailer.proof.json");
-    const { transport } = fakeTransport({ ...proof.slotAllocation!, chainId: "global" }, () => ({ status: 200, json: { proof } }));
-    await assert.rejects(fuse(builderFor("trailer/1", bytes("original.txt")), { placement: "trailer/1", original: bytes("original.txt"), transport }), (e: FuseError) => e.code === "allocate-failed" && /anchored chain/.test(e.message));
-  });
-});