@peac/audit 0.16.1 → 0.16.3

package/dist/index.cjs

@@ -1690,6 +1690,240 @@ function normalizeIat(iat) {
   if (!Number.isNaN(parsed)) return parsed;
   return 0;
 }
+var MERKLE_TREE_ALG = "peac.merkle.ct-sorted-set-sha256-v1";
+var MERKLE_HASH_ALG = "sha256";
+var MerkleInputError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "MerkleInputError";
+    this.code = code;
+  }
+};
+var DIGEST_REF_RE = /^sha256:[0-9a-f]{64}$/;
+var LEAF_PREFIX = 0;
+var NODE_PREFIX = 1;
+function assertDigestRef(value, code, label) {
+  if (typeof value !== "string" || !DIGEST_REF_RE.test(value)) {
+    throw new MerkleInputError(
+      code,
+      `${label} must match sha256:<hex64> (lowercase); received ${describe(value)}`
+    );
+  }
+}
+function describe(value) {
+  if (typeof value === "string") return value.length > 74 ? `${value.slice(0, 71)}...` : value;
+  return Object.prototype.toString.call(value);
+}
+function decodeDigest(ref) {
+  return Uint8Array.from(Buffer.from(ref.slice("sha256:".length), "hex"));
+}
+function encodeDigest(bytes) {
+  return `sha256:${Buffer.from(bytes).toString("hex")}`;
+}
+function sha256(...chunks) {
+  const h = crypto$1.createHash("sha256");
+  for (const c of chunks) h.update(c);
+  return Uint8Array.from(h.digest());
+}
+function leafHash(digest) {
+  return sha256(Uint8Array.of(LEAF_PREFIX), digest);
+}
+function nodeHash(left, right) {
+  return sha256(Uint8Array.of(NODE_PREFIX), left, right);
+}
+function largestPow2LessThan(n) {
+  let k = 1;
+  while (k * 2 < n) k *= 2;
+  return k;
+}
+function compareBytes(a, b) {
+  const len = Math.min(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    if (a[i] !== b[i]) return a[i] - b[i];
+  }
+  return a.length - b.length;
+}
+function bytesEqual(a, b) {
+  return a.length === b.length && crypto$1.timingSafeEqual(a, b);
+}
+function isSafePositiveInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+}
+function isSafeNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isOdd(value) {
+  return value % 2 === 1;
+}
+function halve(value) {
+  return Math.floor(value / 2);
+}
+function merkleTreeHash(digests, start, end) {
+  const n = end - start;
+  if (n === 1) return leafHash(digests[start]);
+  const k = largestPow2LessThan(n);
+  return nodeHash(
+    merkleTreeHash(digests, start, start + k),
+    merkleTreeHash(digests, start + k, end)
+  );
+}
+function inclusionPath(m, digests, start, end) {
+  const n = end - start;
+  if (n === 1) return [];
+  const k = largestPow2LessThan(n);
+  if (m < k) {
+    return [
+      ...inclusionPath(m, digests, start, start + k),
+      merkleTreeHash(digests, start + k, end)
+    ];
+  }
+  return [
+    ...inclusionPath(m - k, digests, start + k, end),
+    merkleTreeHash(digests, start, start + k)
+  ];
+}
+function foldInclusionProof(leaf, siblings, leafIndex, treeSize) {
+  if (leafIndex >= treeSize) return null;
+  let fn = leafIndex;
+  let sn = treeSize - 1;
+  let r = leaf;
+  for (const p of siblings) {
+    if (sn === 0) return null;
+    if (isOdd(fn) || fn === sn) {
+      r = nodeHash(p, r);
+      if (!isOdd(fn)) {
+        while (!isOdd(fn) && fn !== 0) {
+          fn = halve(fn);
+          sn = halve(sn);
+        }
+      }
+    } else {
+      r = nodeHash(r, p);
+    }
+    fn = halve(fn);
+    sn = halve(sn);
+  }
+  return sn === 0 ? r : null;
+}
+function toSortedDigests(refs) {
+  if (!Array.isArray(refs) || refs.length === 0) {
+    throw new MerkleInputError(
+      "audit.merkle.empty_input",
+      "refs must be a non-empty array of sha256:<hex64> receipt refs"
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const ref of refs) {
+    assertDigestRef(ref, "audit.merkle.invalid_receipt_ref", "receipt_ref");
+    if (seen.has(ref)) {
+      throw new MerkleInputError(
+        "audit.merkle.duplicate_receipt_ref",
+        `duplicate receipt_ref: ${ref}`
+      );
+    }
+    seen.add(ref);
+    entries.push({ ref, digest: decodeDigest(ref) });
+  }
+  entries.sort((a, b) => compareBytes(a.digest, b.digest));
+  return { sorted: entries.map((e) => e.digest), sortedRefs: entries.map((e) => e.ref) };
+}
+function buildReceiptMerkleCommitment(refs) {
+  const { sorted } = toSortedDigests(refs);
+  return {
+    tree_alg: MERKLE_TREE_ALG,
+    hash_alg: MERKLE_HASH_ALG,
+    root: encodeDigest(merkleTreeHash(sorted, 0, sorted.length)),
+    tree_size: sorted.length
+  };
+}
+function generateReceiptMerkleInclusionProof(refs, targetRef) {
+  assertDigestRef(targetRef, "audit.merkle.invalid_receipt_ref", "targetRef");
+  const { sorted, sortedRefs } = toSortedDigests(refs);
+  const leafIndex = sortedRefs.indexOf(targetRef);
+  if (leafIndex === -1) {
+    throw new MerkleInputError(
+      "audit.merkle.target_not_found",
+      `targetRef not in refs: ${targetRef}`
+    );
+  }
+  return {
+    tree_alg: MERKLE_TREE_ALG,
+    hash_alg: MERKLE_HASH_ALG,
+    leaf_index: leafIndex,
+    tree_size: sorted.length,
+    hashes: inclusionPath(leafIndex, sorted, 0, sorted.length).map(encodeDigest)
+  };
+}
+function verifyReceiptMerkleInclusion(commitment, targetRef, proof) {
+  if (commitment === null || typeof commitment !== "object") {
+    throw new MerkleInputError("audit.merkle.invalid_commitment", "commitment must be an object");
+  }
+  if (commitment.tree_alg !== MERKLE_TREE_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_tree_alg",
+      `unsupported commitment tree_alg: ${describe(commitment.tree_alg)}`
+    );
+  }
+  if (commitment.hash_alg !== MERKLE_HASH_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_hash_alg",
+      `unsupported commitment hash_alg: ${describe(commitment.hash_alg)}`
+    );
+  }
+  assertDigestRef(commitment.root, "audit.merkle.invalid_merkle_root", "commitment.root");
+  if (!isSafePositiveInteger(commitment.tree_size)) {
+    throw new MerkleInputError(
+      "audit.merkle.invalid_commitment",
+      `commitment.tree_size must be a positive safe integer; received ${describe(commitment.tree_size)}`
+    );
+  }
+  assertDigestRef(targetRef, "audit.merkle.invalid_receipt_ref", "targetRef");
+  if (proof === null || typeof proof !== "object") {
+    throw new MerkleInputError("audit.merkle.invalid_proof", "proof must be an object");
+  }
+  if (proof.tree_alg !== MERKLE_TREE_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_tree_alg",
+      `unsupported tree_alg: ${describe(proof.tree_alg)}`
+    );
+  }
+  if (proof.hash_alg !== MERKLE_HASH_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_hash_alg",
+      `unsupported hash_alg: ${describe(proof.hash_alg)}`
+    );
+  }
+  if (!isSafePositiveInteger(proof.tree_size)) {
+    throw new MerkleInputError(
+      "audit.merkle.invalid_proof",
+      `tree_size must be a positive safe integer; received ${describe(proof.tree_size)}`
+    );
+  }
+  if (!isSafeNonNegativeInteger(proof.leaf_index) || proof.leaf_index >= proof.tree_size) {
+    throw new MerkleInputError(
+      "audit.merkle.invalid_proof",
+      `leaf_index must be a safe integer in [0, tree_size); received ${describe(proof.leaf_index)}`
+    );
+  }
+  if (!Array.isArray(proof.hashes)) {
+    throw new MerkleInputError("audit.merkle.invalid_proof", "proof.hashes must be an array");
+  }
+  const siblings = [];
+  for (const h of proof.hashes) {
+    assertDigestRef(h, "audit.merkle.invalid_proof_hash", "proof.hashes[]");
+    siblings.push(decodeDigest(h));
+  }
+  if (proof.tree_size !== commitment.tree_size) return false;
+  const recomputed = foldInclusionProof(
+    leafHash(decodeDigest(targetRef)),
+    siblings,
+    proof.leaf_index,
+    proof.tree_size
+  );
+  return recomputed !== null && bytesEqual(recomputed, decodeDigest(commitment.root));
+}
 
 // src/index.ts
 var AUDIT_PACKAGE_VERSION = "0.9.27";
@@ -1702,11 +1936,15 @@ exports.BUNDLE_VERSION = BUNDLE_VERSION;
 exports.COMMERCE_BUNDLE_VERSION = COMMERCE_BUNDLE_VERSION;
 exports.DISPUTE_BUNDLE_VERSION = DISPUTE_BUNDLE_VERSION;
 exports.DISPUTE_BUNDLE_VERSION_v2 = BUNDLE_VERSION2;
+exports.MERKLE_HASH_ALG = MERKLE_HASH_ALG;
+exports.MERKLE_TREE_ALG = MERKLE_TREE_ALG;
+exports.MerkleInputError = MerkleInputError;
 exports.UNCLASSIFIED_LIFECYCLE_BUCKET = UNCLASSIFIED_LIFECYCLE_BUCKET;
 exports.VERIFICATION_REPORT_VERSION = VERIFICATION_REPORT_VERSION;
 exports.addProtocolEvidence = addProtocolEvidence;
 exports.addReceiptRef = addReceiptRef;
 exports.addTimelineEntry = addTimelineEntry;
+exports.buildReceiptMerkleCommitment = buildReceiptMerkleCommitment;
 exports.computeCommerceSummary = computeCommerceSummary;
 exports.correlateByTrace = correlateByTrace;
 exports.createAuditEntry = createAuditEntry;
@@ -1723,6 +1961,7 @@ exports.formatJsonlLine = formatJsonlLine;
 exports.formatReportText = formatReportText;
 exports.generateAuditId = generateAuditId;
 exports.generateBundleSummary = generateBundleSummary;
+exports.generateReceiptMerkleInclusionProof = generateReceiptMerkleInclusionProof;
 exports.getBundleContentHash = getBundleContentHash;
 exports.groupByLifecycle = groupByLifecycle;
 exports.isValidAuditEntry = isValidAuditEntry;
@@ -1737,5 +1976,6 @@ exports.serializeReport = serializeReport;
 exports.validateAuditEntry = validateAuditEntry;
 exports.verifyBundle = verifyBundle;
 exports.verifyBundleIntegrity = verifyBundleIntegrity;
+exports.verifyReceiptMerkleInclusion = verifyReceiptMerkleInclusion;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map