@peac/audit 0.16.1 → 0.16.3

package/dist/index.d.ts

@@ -61,4 +61,6 @@ export { verifyBundle, serializeReport, formatReportText } from './verification-
 export type { CommerceEvidenceBundle, CommerceSummary, CreateCommerceBundleOptions, LifecycleBundle, LifecycleInputRecord, ProtocolEvidence, TimelineEntry, ObservedAmount, } from './commerce-bundle-types.js';
 export { COMMERCE_BUNDLE_VERSION, UNCLASSIFIED_LIFECYCLE_BUCKET } from './commerce-bundle-types.js';
 export { createCommerceEvidenceBundle, addProtocolEvidence, addTimelineEntry, addReceiptRef, computeCommerceSummary, serializeCommerceBundle, groupByLifecycle, } from './commerce-bundle.js';
+export type { Sha256DigestRef, ReceiptMerkleRoot, MerkleNodeHash, ReceiptMerkleCommitment, ReceiptMerkleInclusionProof, MerkleInputErrorCode, } from './merkle.js';
+export { MERKLE_TREE_ALG, MERKLE_HASH_ALG, MerkleInputError, buildReceiptMerkleCommitment, generateReceiptMerkleInclusionProof, verifyReceiptMerkleInclusion, } from './merkle.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAG9C,YAAY,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,cAAc,IAAI,yBAAyB,EAC3C,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG3F,YAAY,EACV,sBAAsB,EACtB,eAAe,EACf,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAEpG,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAG9C,YAAY,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,cAAc,IAAI,yBAAyB,EAC3C,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG3F,YAAY,EACV,sBAAsB,EACtB,eAAe,EACf,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAEpG,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,4BAA4B,EAC5B,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,aAAa,CAAC"}

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { createHash, randomBytes } from 'crypto';
+import { createHash, randomBytes, timingSafeEqual } from 'crypto';
 import { posix } from 'path';
 import { canonicalize, verify, CryptoError } from '@peac/crypto';
 import { BUNDLE_ERRORS } from '@peac/kernel';
@@ -1667,10 +1667,244 @@ function normalizeIat(iat) {
   if (!Number.isNaN(parsed)) return parsed;
   return 0;
 }
+var MERKLE_TREE_ALG = "peac.merkle.ct-sorted-set-sha256-v1";
+var MERKLE_HASH_ALG = "sha256";
+var MerkleInputError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "MerkleInputError";
+    this.code = code;
+  }
+};
+var DIGEST_REF_RE = /^sha256:[0-9a-f]{64}$/;
+var LEAF_PREFIX = 0;
+var NODE_PREFIX = 1;
+function assertDigestRef(value, code, label) {
+  if (typeof value !== "string" || !DIGEST_REF_RE.test(value)) {
+    throw new MerkleInputError(
+      code,
+      `${label} must match sha256:<hex64> (lowercase); received ${describe(value)}`
+    );
+  }
+}
+function describe(value) {
+  if (typeof value === "string") return value.length > 74 ? `${value.slice(0, 71)}...` : value;
+  return Object.prototype.toString.call(value);
+}
+function decodeDigest(ref) {
+  return Uint8Array.from(Buffer.from(ref.slice("sha256:".length), "hex"));
+}
+function encodeDigest(bytes) {
+  return `sha256:${Buffer.from(bytes).toString("hex")}`;
+}
+function sha256(...chunks) {
+  const h = createHash("sha256");
+  for (const c of chunks) h.update(c);
+  return Uint8Array.from(h.digest());
+}
+function leafHash(digest) {
+  return sha256(Uint8Array.of(LEAF_PREFIX), digest);
+}
+function nodeHash(left, right) {
+  return sha256(Uint8Array.of(NODE_PREFIX), left, right);
+}
+function largestPow2LessThan(n) {
+  let k = 1;
+  while (k * 2 < n) k *= 2;
+  return k;
+}
+function compareBytes(a, b) {
+  const len = Math.min(a.length, b.length);
+  for (let i = 0; i < len; i++) {
+    if (a[i] !== b[i]) return a[i] - b[i];
+  }
+  return a.length - b.length;
+}
+function bytesEqual(a, b) {
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function isSafePositiveInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+}
+function isSafeNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isOdd(value) {
+  return value % 2 === 1;
+}
+function halve(value) {
+  return Math.floor(value / 2);
+}
+function merkleTreeHash(digests, start, end) {
+  const n = end - start;
+  if (n === 1) return leafHash(digests[start]);
+  const k = largestPow2LessThan(n);
+  return nodeHash(
+    merkleTreeHash(digests, start, start + k),
+    merkleTreeHash(digests, start + k, end)
+  );
+}
+function inclusionPath(m, digests, start, end) {
+  const n = end - start;
+  if (n === 1) return [];
+  const k = largestPow2LessThan(n);
+  if (m < k) {
+    return [
+      ...inclusionPath(m, digests, start, start + k),
+      merkleTreeHash(digests, start + k, end)
+    ];
+  }
+  return [
+    ...inclusionPath(m - k, digests, start + k, end),
+    merkleTreeHash(digests, start, start + k)
+  ];
+}
+function foldInclusionProof(leaf, siblings, leafIndex, treeSize) {
+  if (leafIndex >= treeSize) return null;
+  let fn = leafIndex;
+  let sn = treeSize - 1;
+  let r = leaf;
+  for (const p of siblings) {
+    if (sn === 0) return null;
+    if (isOdd(fn) || fn === sn) {
+      r = nodeHash(p, r);
+      if (!isOdd(fn)) {
+        while (!isOdd(fn) && fn !== 0) {
+          fn = halve(fn);
+          sn = halve(sn);
+        }
+      }
+    } else {
+      r = nodeHash(r, p);
+    }
+    fn = halve(fn);
+    sn = halve(sn);
+  }
+  return sn === 0 ? r : null;
+}
+function toSortedDigests(refs) {
+  if (!Array.isArray(refs) || refs.length === 0) {
+    throw new MerkleInputError(
+      "audit.merkle.empty_input",
+      "refs must be a non-empty array of sha256:<hex64> receipt refs"
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const ref of refs) {
+    assertDigestRef(ref, "audit.merkle.invalid_receipt_ref", "receipt_ref");
+    if (seen.has(ref)) {
+      throw new MerkleInputError(
+        "audit.merkle.duplicate_receipt_ref",
+        `duplicate receipt_ref: ${ref}`
+      );
+    }
+    seen.add(ref);
+    entries.push({ ref, digest: decodeDigest(ref) });
+  }
+  entries.sort((a, b) => compareBytes(a.digest, b.digest));
+  return { sorted: entries.map((e) => e.digest), sortedRefs: entries.map((e) => e.ref) };
+}
+function buildReceiptMerkleCommitment(refs) {
+  const { sorted } = toSortedDigests(refs);
+  return {
+    tree_alg: MERKLE_TREE_ALG,
+    hash_alg: MERKLE_HASH_ALG,
+    root: encodeDigest(merkleTreeHash(sorted, 0, sorted.length)),
+    tree_size: sorted.length
+  };
+}
+function generateReceiptMerkleInclusionProof(refs, targetRef) {
+  assertDigestRef(targetRef, "audit.merkle.invalid_receipt_ref", "targetRef");
+  const { sorted, sortedRefs } = toSortedDigests(refs);
+  const leafIndex = sortedRefs.indexOf(targetRef);
+  if (leafIndex === -1) {
+    throw new MerkleInputError(
+      "audit.merkle.target_not_found",
+      `targetRef not in refs: ${targetRef}`
+    );
+  }
+  return {
+    tree_alg: MERKLE_TREE_ALG,
+    hash_alg: MERKLE_HASH_ALG,
+    leaf_index: leafIndex,
+    tree_size: sorted.length,
+    hashes: inclusionPath(leafIndex, sorted, 0, sorted.length).map(encodeDigest)
+  };
+}
+function verifyReceiptMerkleInclusion(commitment, targetRef, proof) {
+  if (commitment === null || typeof commitment !== "object") {
+    throw new MerkleInputError("audit.merkle.invalid_commitment", "commitment must be an object");
+  }
+  if (commitment.tree_alg !== MERKLE_TREE_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_tree_alg",
+      `unsupported commitment tree_alg: ${describe(commitment.tree_alg)}`
+    );
+  }
+  if (commitment.hash_alg !== MERKLE_HASH_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_hash_alg",
+      `unsupported commitment hash_alg: ${describe(commitment.hash_alg)}`
+    );
+  }
+  assertDigestRef(commitment.root, "audit.merkle.invalid_merkle_root", "commitment.root");
+  if (!isSafePositiveInteger(commitment.tree_size)) {
+    throw new MerkleInputError(
+      "audit.merkle.invalid_commitment",
+      `commitment.tree_size must be a positive safe integer; received ${describe(commitment.tree_size)}`
+    );
+  }
+  assertDigestRef(targetRef, "audit.merkle.invalid_receipt_ref", "targetRef");
+  if (proof === null || typeof proof !== "object") {
+    throw new MerkleInputError("audit.merkle.invalid_proof", "proof must be an object");
+  }
+  if (proof.tree_alg !== MERKLE_TREE_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_tree_alg",
+      `unsupported tree_alg: ${describe(proof.tree_alg)}`
+    );
+  }
+  if (proof.hash_alg !== MERKLE_HASH_ALG) {
+    throw new MerkleInputError(
+      "audit.merkle.unsupported_hash_alg",
+      `unsupported hash_alg: ${describe(proof.hash_alg)}`
+    );
+  }
+  if (!isSafePositiveInteger(proof.tree_size)) {
+    throw new MerkleInputError(
+      "audit.merkle.invalid_proof",
+      `tree_size must be a positive safe integer; received ${describe(proof.tree_size)}`
+    );
+  }
+  if (!isSafeNonNegativeInteger(proof.leaf_index) || proof.leaf_index >= proof.tree_size) {
+    throw new MerkleInputError(
+      "audit.merkle.invalid_proof",
+      `leaf_index must be a safe integer in [0, tree_size); received ${describe(proof.leaf_index)}`
+    );
+  }
+  if (!Array.isArray(proof.hashes)) {
+    throw new MerkleInputError("audit.merkle.invalid_proof", "proof.hashes must be an array");
+  }
+  const siblings = [];
+  for (const h of proof.hashes) {
+    assertDigestRef(h, "audit.merkle.invalid_proof_hash", "proof.hashes[]");
+    siblings.push(decodeDigest(h));
+  }
+  if (proof.tree_size !== commitment.tree_size) return false;
+  const recomputed = foldInclusionProof(
+    leafHash(decodeDigest(targetRef)),
+    siblings,
+    proof.leaf_index,
+    proof.tree_size
+  );
+  return recomputed !== null && bytesEqual(recomputed, decodeDigest(commitment.root));
+}
 
 // src/index.ts
 var AUDIT_PACKAGE_VERSION = "0.9.27";
 
-export { AUDIT_EVENT_TYPES, AUDIT_PACKAGE_VERSION, AUDIT_SEVERITIES, AUDIT_VERSION, BUNDLE_VERSION, COMMERCE_BUNDLE_VERSION, DISPUTE_BUNDLE_VERSION, BUNDLE_VERSION2 as DISPUTE_BUNDLE_VERSION_v2, UNCLASSIFIED_LIFECYCLE_BUCKET, VERIFICATION_REPORT_VERSION, addProtocolEvidence, addReceiptRef, addTimelineEntry, computeCommerceSummary, correlateByTrace, createAuditEntry, createCaseBundle, createCommerceEvidenceBundle, createDisputeBundle, createJsonlAppender, filterByDispute, filterByResource, filterByTimeRange, filterByTraceId, formatJsonl, formatJsonlLine, formatReportText, generateAuditId, generateBundleSummary, getBundleContentHash, groupByLifecycle, isValidAuditEntry, isValidTraceContext, isValidUlid, parseJsonl, parseJsonlLine, readDisputeBundle, serializeBundle, serializeCommerceBundle, serializeReport, validateAuditEntry, verifyBundle, verifyBundleIntegrity };
+export { AUDIT_EVENT_TYPES, AUDIT_PACKAGE_VERSION, AUDIT_SEVERITIES, AUDIT_VERSION, BUNDLE_VERSION, COMMERCE_BUNDLE_VERSION, DISPUTE_BUNDLE_VERSION, BUNDLE_VERSION2 as DISPUTE_BUNDLE_VERSION_v2, MERKLE_HASH_ALG, MERKLE_TREE_ALG, MerkleInputError, UNCLASSIFIED_LIFECYCLE_BUCKET, VERIFICATION_REPORT_VERSION, addProtocolEvidence, addReceiptRef, addTimelineEntry, buildReceiptMerkleCommitment, computeCommerceSummary, correlateByTrace, createAuditEntry, createCaseBundle, createCommerceEvidenceBundle, createDisputeBundle, createJsonlAppender, filterByDispute, filterByResource, filterByTimeRange, filterByTraceId, formatJsonl, formatJsonlLine, formatReportText, generateAuditId, generateBundleSummary, generateReceiptMerkleInclusionProof, getBundleContentHash, groupByLifecycle, isValidAuditEntry, isValidTraceContext, isValidUlid, parseJsonl, parseJsonlLine, readDisputeBundle, serializeBundle, serializeCommerceBundle, serializeReport, validateAuditEntry, verifyBundle, verifyBundleIntegrity, verifyReceiptMerkleInclusion };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map