@mikeargento/bitgraph 1.9.1 → 1.10.0

package/dist/canonical.js

@@ -1,119 +0,0 @@
-// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
-/**
- * bitgraph-core canonical serialization
- *
- * Produces a deterministic, UTF-8 encoded JSON byte sequence from an
- * arbitrary JavaScript value.  The output is used as the signing input
- * for BitGraphProof signatures and must be reproduced identically by any
- * verifier regardless of platform or runtime.
- *
- * Algorithm:
- *   1. Recursively sort object keys lexicographically (Unicode code-point order)
- *   2. Serialize with JSON.stringify (no whitespace)
- *   3. Encode the resulting string as UTF-8
- *
- * Constraints satisfied:
- *   - Deterministic key ordering
- *   - No whitespace variance
- *   - Stable numeric formatting (JSON.stringify uses shortest representation)
- *   - UTF-8 output (TextEncoder default)
- *   - Rejects undefined, functions, and symbols, which have no JSON repr
- *
- * Limitations:
- *   - BigInt is not serializable via JSON.stringify; callers must convert
- *     to string before passing (consistent with the `counter` field type).
- *   - NaN and Infinity serialize as `null` in JSON; callers must validate
- *     numeric fields upstream.
- *   - Object prototype chains are not walked; only own enumerable keys.
- *
- * This module has zero dependencies on other bitgraph-core modules so that it
- * can be used standalone for testing and external verification tooling.
- */
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/**
- * Serialize `obj` to canonical JSON and return UTF-8 encoded bytes.
- *
- * Throws if `obj` contains values that cannot survive a JSON round-trip
- * without information loss (undefined top-level, functions, symbols, BigInt).
- */
-export function canonicalize(obj) {
-    const json = canonicalizeToString(obj);
-    return new TextEncoder().encode(json);
-}
-/**
- * Serialize `obj` to a canonical JSON string.
- * Exposed for debugging and test assertions.
- */
-export function canonicalizeToString(obj) {
-    return JSON.stringify(sortedReplacer(obj));
-}
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
-/**
- * Recursively produce a value suitable for JSON.stringify that has its
- * object keys sorted lexicographically at every level of nesting.
- *
- * Arrays preserve element order (ordering arrays would change semantics).
- * Primitives are returned as-is.
- */
-function sortedReplacer(value) {
-    if (value === null || typeof value !== "object") {
-        // Primitive or null: no key ordering needed.
-        // Reject types that serialize to undefined in JSON.
-        if (typeof value === "undefined") {
-            throw new TypeError("bitgraph-core/canonical: undefined values are not serializable to canonical JSON");
-        }
-        if (typeof value === "function" || typeof value === "symbol") {
-            throw new TypeError(`bitgraph-core/canonical: ${typeof value} values are not serializable to canonical JSON`);
-        }
-        if (typeof value === "bigint") {
-            throw new TypeError("bitgraph-core/canonical: BigInt values are not serializable to canonical JSON; " +
-                "convert to string (decimal) before canonicalizing");
-        }
-        return value;
-    }
-    if (Array.isArray(value)) {
-        // Recurse into elements; preserve order.
-        return value.map(sortedReplacer);
-    }
-    // Plain object: sort own enumerable string keys and recurse.
-    const sorted = {};
-    for (const key of Object.keys(value).sort()) {
-        const child = value[key];
-        // Skip undefined values (JSON.stringify would omit them anyway,
-        // but we skip explicitly to avoid surprising iteration behavior).
-        if (typeof child === "undefined") {
-            continue;
-        }
-        sorted[key] = sortedReplacer(child);
-    }
-    return sorted;
-}
-// ---------------------------------------------------------------------------
-// Utility: constant-time Uint8Array equality
-// ---------------------------------------------------------------------------
-/**
- * Compare two Uint8Arrays in constant time.
- *
- * Returns true iff `a` and `b` have the same length and identical contents.
- * Resistance against timing side-channels is important when comparing
- * digests and signatures in the verifier.
- *
- * Note: JavaScript runtimes may still optimize this; a native binding would
- * provide stronger guarantees.  For v0.1 this is a reasonable best-effort.
- */
-export function constantTimeEqual(a, b) {
-    if (a.length !== b.length) {
-        return false;
-    }
-    let diff = 0;
-    for (let i = 0; i < a.length; i++) {
-        // biome-ignore: non-null assertion safe because lengths are equal
-        diff |= a[i] ^ b[i];
-    }
-    return diff === 0;
-}
-//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,6CAA6C;QAC7C,oDAAoD;QACpD,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,SAAS,CACjB,4BAA4B,OAAO,KAAK,gDAAgD,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,iFAAiF;gBAC/E,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,yCAAyC;QACzC,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC;IAED,6DAA6D;IAC7D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;QACtD,gEAAgE;QAChE,kEAAkE;QAClE,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,kEAAkE;QAClE,IAAI,IAAK,CAAC,CAAC,CAAC,CAAY,GAAI,CAAC,CAAC,CAAC,CAAY,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/proof-hash.d.ts

@@ -1,9 +0,0 @@
-import type { BitGraphProof } from "./types.js";
-/**
- * Compute the canonical hash of a BitGraph proof's signed body.
- *
- * @param proof - The full BitGraphProof object (or equivalent Record)
- * @returns Base64-standard encoded SHA-256 hash
- */
-export declare function computeProofHash(proof: BitGraphProof | Record<string, unknown>): string;
-//# sourceMappingURL=proof-hash.d.ts.map

package/dist/proof-hash.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"proof-hash.d.ts","sourceRoot":"","sources":["../src/proof-hash.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAqCvF"}

package/dist/proof-hash.js

@@ -1,75 +0,0 @@
-// Copyright (c) Mike Argento. All rights reserved. See LICENSE.
-/**
- * bitgraph-core proof hash
- *
- * Canonical, deterministic proof hash computation.
- *
- * The proof hash covers the SIGNED BODY — the fields that are
- * cryptographically signed by the enclave. This matches what the
- * Ed25519 signature covers, making the hash verifiable.
- *
- * Signed body fields:
- *   - version, artifact, commit
- *   - publicKeyB64 (from signer)
- *   - enforcement, measurement (from environment)
- *   - attribution (if present)
- *   - attestationFormat (if attestation present)
- *
- * This hash is used for:
- *   - prevB64 chain linking
- *   - S3 ledger key generation
- *   - Ethereum anchor binding
- *   - Proof deduplication and verification
- *
- * Algorithm:
- *   1. Extract signed body fields
- *   2. canonicalize(signedBody) — recursive key sort, compact JSON, UTF-8
- *   3. SHA-256 of canonical bytes
- *   4. Base64-standard encode (RFC 4648 §4)
- *
- * IMPORTANT: All call sites MUST use this function. Do NOT compute
- * proof hashes ad-hoc with JSON.stringify or Object.keys().sort().
- * Non-recursive key sorting diverges on nested objects.
- */
-import { canonicalize } from "./canonical.js";
-import { sha256 } from "@noble/hashes/sha256";
-/**
- * Compute the canonical hash of a BitGraph proof's signed body.
- *
- * @param proof - The full BitGraphProof object (or equivalent Record)
- * @returns Base64-standard encoded SHA-256 hash
- */
-export function computeProofHash(proof) {
-    const p = proof;
-    const signer = p.signer;
-    const env = p.environment;
-    const signedBody = {
-        version: p.version,
-        artifact: p.artifact,
-        commit: p.commit,
-        publicKeyB64: signer?.publicKeyB64,
-        enforcement: env?.enforcement,
-        measurement: env?.measurement,
-    };
-    // Include attribution if present
-    if (p.attribution) {
-        signedBody.attribution = p.attribution;
-    }
-    // Include attestation format if present
-    if (env?.attestation) {
-        signedBody.attestationFormat = env.attestation.format;
-    }
-    const bytes = canonicalize(signedBody);
-    const hash = sha256(bytes);
-    // Base64 encode (works in both Node.js and browser)
-    if (typeof Buffer !== "undefined") {
-        return Buffer.from(hash).toString("base64");
-    }
-    // Browser fallback
-    let binary = "";
-    for (let i = 0; i < hash.length; i++) {
-        binary += String.fromCharCode(hash[i]);
-    }
-    return btoa(binary);
-}
-//# sourceMappingURL=proof-hash.js.map

package/dist/proof-hash.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"proof-hash.js","sourceRoot":"","sources":["../src/proof-hash.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA8C;IAC7E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,MAA8C,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAC,WAAyG,CAAC;IAExH,MAAM,UAAU,GAA4B;QAC1C,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,MAAM,EAAE,YAAY;QAClC,WAAW,EAAE,GAAG,EAAE,WAAW;QAC7B,WAAW,EAAE,GAAG,EAAE,WAAW;KAC9B,CAAC;IAEF,iCAAiC;IACjC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClB,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,wCAAwC;IACxC,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC;QACrB,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,UAAsC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3B,oDAAoD;IACpD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,mBAAmB;IACnB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}