@totemsdk/proofgraph 0.1.0 → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Totem SDK Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,246 @@
+# @totemsdk/proofgraph
+
+Local deterministic proof relationship graph for Totem Edge — indexes proofs, identities, manifests, anchors, and subjects into a queryable, content-addressed DAG.
+
+No network. No storage. Pure in-memory immutable graph with SHA3-256 content addressing.
+
+## Installation
+
+```bash
+npm install @totemsdk/proofgraph
+```
+
+## Overview
+
+`@totemsdk/proofgraph` takes `SignedProof` objects (from [`@totemsdk/proof`](https://www.npmjs.com/package/@totemsdk/proof)) and builds a local relationship graph you can query and verify. Every mutation returns a new graph with a recomputed `graphId` — the ID is a deterministic SHA3-256 over node and edge content, so the same logical graph always produces the same ID regardless of when it was built.
+
+Key properties:
+
+- **Immutable** — every add/mutation returns a new `ProofGraph`; originals are never modified
+- **Idempotent** — adding the same node or edge twice has no effect (deduplication by content ID)
+- **Content-deterministic** — `graphId` excludes `createdAt` timestamps so identical content always hashes identically
+- **Interface-only storage** — `ProofGraphStoragePort` is an interface; no concrete adapter ships in this package
+
+## All exports
+
+### Graph construction
+
+| Export | Description |
+|--------|-------------|
+| `createProofGraph()` | Create an empty graph |
+| `setGraphMetadata(graph, metadata)` | Attach mutable metadata; recomputes `graphId` |
+| `addProof(graph, signed)` | Add a `SignedProof` with all its linked nodes and edges |
+| `addIdentityDocument(graph, doc)` | Add a `TotemIdentityDocument` node |
+| `addIdentityClaim(graph, signed)` | Add a `SignedIdentityClaim` with its edge type |
+| `addManifest(graph, signed)` | Add a `SignedManifest` with `manifests_as` address edges |
+| `addReceiptLike(graph, receipt)` | Add a receipt node; optionally link to a proof |
+| `addAnchor(graph, anchor)` | Add a standalone anchor node; optionally link to a proof |
+| `addNode(graph, node)` | Low-level: add a pre-built `ProofGraphNode` |
+| `addEdge(graph, edge)` | Low-level: add a pre-built `ProofGraphEdge` |
+| `buildEdge(type, from, to, contextId?)` | Construct an edge without adding it |
+
+### Query
+
+| Export | Description |
+|--------|-------------|
+| `findNode(graph, refId)` | Find a node by its `refId` |
+| `getProofNodes(graph)` | All nodes of type `'proof'` |
+| `findProofsBySubject(graph, subjectId)` | Proofs where the subject matches (via `about` or `proves` edges) |
+| `findProofsByIssuer(graph, issuer)` | Proofs issued by a given address |
+| `findAnchorsForProof(graph, proofId)` | Anchor nodes linked to a proof via `anchored_to` edges |
+| `findRevocations(graph, proofId)` | Proofs that revoke a given proof |
+| `findSupersessions(graph, proofId)` | Proofs that supersede a given proof |
+| `findConflicts(graph)` | All subject nodes targeted by more than one proof |
+| `getEvidenceTrail(graph, proofId)` | Evidence nodes linked to a proof, in insertion order |
+| `getProofLineage(graph, proofId)` | Walk `derived_from` chain; returns ancestor nodes (cycle-safe) |
+| `resolveCurrentProofSet(graph)` | Active proofs — revoked and superseded proofs are excluded |
+| `getManifestsForAddress(graph, address)` | Manifest nodes linked to an address |
+| `getEdgesFrom(graph, refId)` | All edges originating from a node |
+| `getEdgesTo(graph, refId)` | All edges terminating at a node |
+| `getEdgesByType(graph, type)` | All edges of a given type |
+| `getEdgesBetween(graph, fromId, toId)` | All edges between two specific nodes |
+| `reachableFrom(graph, startId, edgeTypes?)` | BFS reachability from a node, optionally filtered by edge type |
+
+### Verification
+
+| Export | Description |
+|--------|-------------|
+| `verifyProofGraph(graph)` | Verify all proof nodes; returns `ProofGraphVerifyResult` |
+| `verifyGraphProofs(graph)` | Returns `string[]` — IDs of proofs that fail verification |
+
+### Import / Export
+
+| Export | Description |
+|--------|-------------|
+| `exportProofGraph(graph)` | Serialize to JSON string |
+| `importProofGraph(json)` | Deserialize and verify `graphId` integrity — throws on tamper |
+
+### Canonical helpers
+
+| Export | Description |
+|--------|-------------|
+| `computeNodeId(type, refId, data?)` | Deterministic SHA3-256 node ID |
+| `computeEdgeId(type, from, to)` | Deterministic SHA3-256 edge ID |
+| `computeProofGraphId(graph)` | SHA3-256 of all node and edge IDs (excludes `createdAt`, `metadata`) |
+| `recomputeGraphId(graph)` | Return a new graph with a freshly computed `graphId` |
+| `toHex(bytes)` | Uint8Array → lowercase hex (no 0x prefix) |
+| `canonicalJson(value)` | Deterministic JSON — sorted keys, no `undefined` |
+
+## Type reference
+
+### `ProofGraph`
+
+```typescript
+interface ProofGraph {
+  graphId: string;           // SHA3-256 over all node/edge content IDs
+  nodes: ProofGraphNode[];
+  edges: ProofGraphEdge[];
+  createdAt: number;         // Unix ms — excluded from graphId
+  metadata?: Record<string, unknown>;  // Also excluded from graphId
+}
+```
+
+### `ProofGraphNode`
+
+```typescript
+interface ProofGraphNode {
+  id: string;                // computeNodeId(type, refId, data)
+  type: ProofGraphNodeType;
+  refId: string;             // External ID (proofId, address, evidenceId, …)
+  createdAt: number;         // Unix ms — excluded from graphId hash
+  data?: Record<string, unknown>;
+}
+
+type ProofGraphNodeType =
+  | 'proof' | 'subject' | 'issuer' | 'evidence'
+  | 'anchor' | 'manifest' | 'address' | 'identity'
+  | 'receipt';
+```
+
+### `ProofGraphEdge`
+
+```typescript
+interface ProofGraphEdge {
+  id: string;                // computeEdgeId(type, from, to)
+  type: ProofGraphEdgeType;
+  from: string;              // source node refId
+  to: string;                // target node refId
+  contextId?: string;        // e.g. the proofId that caused this edge
+}
+
+type ProofGraphEdgeType =
+  | 'issued_by' | 'about' | 'proves' | 'has_evidence'
+  | 'anchored_to' | 'revokes' | 'supersedes' | 'delegates_to'
+  | 'derived_from' | 'manifests_as' | 'controls' | 'supports';
+```
+
+### `ProofGraphVerifyResult`
+
+```typescript
+interface ProofGraphVerifyResult {
+  valid: boolean;
+  invalidProofs: string[];   // proofIds that failed verification
+  checkedCount: number;
+}
+```
+
+### `ReceiptLikeInput` / `AnchorInput`
+
+```typescript
+interface ReceiptLikeInput {
+  id: string;
+  data?: Record<string, unknown>;
+  proofId?: string;          // If set, adds a 'supports' edge from receipt → proof
+}
+
+interface AnchorInput {
+  hash: string;              // Used as the node's refId
+  proofId?: string;          // If set, adds an 'anchored_to' edge from proof → anchor
+  [key: string]: unknown;    // Additional fields stored as node data
+}
+```
+
+## Usage
+
+```typescript
+import {
+  createProofGraph,
+  addProof,
+  addAnchor,
+  verifyProofGraph,
+  findProofsBySubject,
+  resolveCurrentProofSet,
+  exportProofGraph,
+  importProofGraph,
+} from '@totemsdk/proofgraph';
+import { createProof, signProof, createAnchorCommitment } from '@totemsdk/proof';
+
+// 1. Build a signed proof
+const unsigned = createProof({
+  kind: 'ownership',
+  subject: { id: 'totem:subject:asset:nft-001', kind: 'nft' },
+  issuer: 'MxROOT...',
+});
+const signed = signProof(unsigned, seed, keyIndex);
+
+// 2. Build the graph
+let graph = createProofGraph();
+graph = addProof(graph, signed);
+
+// 3. Add an on-chain anchor
+graph = addAnchor(graph, {
+  hash: createAnchorCommitment(signed),
+  proofId: signed.proofId,
+  txId: '0xabc...',
+});
+
+// 4. Query
+const forAsset = findProofsBySubject(graph, 'totem:subject:asset:nft-001');
+console.log('Proofs:', forAsset.length);
+
+const active = resolveCurrentProofSet(graph);
+console.log('Active proofs:', active.length);
+
+// 5. Verify all signatures
+const result = verifyProofGraph(graph);
+console.assert(result.valid, result.invalidProofs);
+
+// 6. Serialize / deserialize (graphId is verified on import)
+const json = exportProofGraph(graph);
+const restored = importProofGraph(json);
+console.assert(restored.graphId === graph.graphId);
+```
+
+## Design notes
+
+### Content-deterministic `graphId`
+
+`computeProofGraphId` excludes `node.createdAt` and `graph.metadata` from the hash. Two graphs built at different times from identical proofs will have the same `graphId`. This makes the ID suitable as a stable content address for caching and deduplication.
+
+### Immutable + idempotent mutations
+
+Every function that modifies a graph (`addProof`, `addEdge`, etc.) returns a new `ProofGraph` with a recomputed `graphId`. Calling the same add function twice with the same arguments returns a graph identical to calling it once — duplicate nodes and edges are silently ignored.
+
+### `ProofGraphStoragePort`
+
+This package exports a `ProofGraphStoragePort` interface only. If you need persistent storage, implement the interface in your own adapter:
+
+```typescript
+import type { ProofGraphStoragePort, ProofGraph } from '@totemsdk/proofgraph';
+
+class MyStorage implements ProofGraphStoragePort {
+  async save(graph: ProofGraph): Promise<void> { /* ... */ }
+  async load(graphId: string): Promise<ProofGraph | null> { /* ... */ }
+}
+```
+
+## Related packages
+
+- [`@totemsdk/proof`](https://www.npmjs.com/package/@totemsdk/proof) — signed proof creation and verification
+- [`@totemsdk/proof-integritas`](https://www.npmjs.com/package/@totemsdk/proof-integritas) — Integritas v2 on-chain anchoring
+- [`@totemsdk/identity`](https://www.npmjs.com/package/@totemsdk/identity) — identity documents and claims
+- [`@totemsdk/core`](https://www.npmjs.com/package/@totemsdk/core) — WOTS signing primitives
+
+## License
+
+MIT

package/dist/canonical.d.ts

@@ -1,8 +1,8 @@
 /**
  * Canonical JSON and ID rules for @totemsdk/proofgraph.
  *
- * canonicalJson is implemented fresh — @totemsdk/identity and @totemsdk/proof
- * each have their own copy; none of them export it publicly.
+ * canonicalJson and toHex are re-exported from @totemsdk/proof, which is the
+ * canonical implementation across the Totem SDK.
  *
  * ID rules:
  *   Node:  type + ":" + refId  (e.g. "proof:totem:proof:abc123")
@@ -10,9 +10,9 @@
  *   Graph: sha3_256("totem-proofgraph" + canonicalJson(nodeHashes) + canonicalJson(sortedEdges))
  *          — node.createdAt and graph.metadata excluded from graphId (time-variant / mutable)
  */
+import { canonicalJson, toHex } from '@totemsdk/proof';
 import type { ProofGraphNode, ProofGraphEdge } from './types.js';
-export declare function toHex(bytes: Uint8Array): string;
-export declare function canonicalJson(value: unknown): string;
+export { canonicalJson, toHex };
 export declare function computeNodeId(type: string, refId: string): string;
 export declare function computeEdgeId(type: string, from: string, to: string, proofId: string | undefined, data: Record<string, unknown> | undefined): string;
 export declare function computeProofGraphId(nodes: ProofGraphNode[], edges: ProofGraphEdge[]): string;

package/dist/canonical.js

@@ -2,8 +2,8 @@
 /**
  * Canonical JSON and ID rules for @totemsdk/proofgraph.
  *
- * canonicalJson is implemented fresh — @totemsdk/identity and @totemsdk/proof
- * each have their own copy; none of them export it publicly.
+ * canonicalJson and toHex are re-exported from @totemsdk/proof, which is the
+ * canonical implementation across the Totem SDK.
  *
  * ID rules:
  *   Node:  type + ":" + refId  (e.g. "proof:totem:proof:abc123")
@@ -12,37 +12,22 @@
  *          — node.createdAt and graph.metadata excluded from graphId (time-variant / mutable)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toHex = toHex;
-exports.canonicalJson = canonicalJson;
+exports.toHex = exports.canonicalJson = void 0;
 exports.computeNodeId = computeNodeId;
 exports.computeEdgeId = computeEdgeId;
 exports.computeProofGraphId = computeProofGraphId;
 exports.recomputeGraphId = recomputeGraphId;
-const sha3_js_1 = require("@noble/hashes/sha3.js");
-function toHex(bytes) {
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, '0'))
-        .join('');
-}
-function canonicalJson(value) {
-    if (value === null || typeof value !== 'object') {
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value)) {
-        return '[' + value.map(canonicalJson).join(',') + ']';
-    }
-    const obj = value;
-    const keys = Object.keys(obj).sort();
-    const pairs = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`);
-    return '{' + pairs.join(',') + '}';
-}
+const core_1 = require("@totemsdk/core");
+const proof_1 = require("@totemsdk/proof");
+Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return proof_1.canonicalJson; } });
+Object.defineProperty(exports, "toHex", { enumerable: true, get: function () { return proof_1.toHex; } });
 function computeNodeId(type, refId) {
     return `${type}:${refId}`;
 }
 function computeEdgeId(type, from, to, proofId, data) {
-    const canonicalDataHash = toHex((0, sha3_js_1.sha3_256)(new TextEncoder().encode(canonicalJson(data ?? {}))));
+    const canonicalDataHash = (0, proof_1.toHex)((0, core_1.sha3_256)(new TextEncoder().encode((0, proof_1.canonicalJson)(data ?? {}))));
     const input = 'totem-proofgraph-edge' + type + from + to + (proofId ?? '') + canonicalDataHash;
-    return toHex((0, sha3_js_1.sha3_256)(new TextEncoder().encode(input)));
+    return (0, proof_1.toHex)((0, core_1.sha3_256)(new TextEncoder().encode(input)));
 }
 /**
  * Content-stable projection of a node for graphId computation.
@@ -58,8 +43,8 @@ function computeProofGraphId(nodes, edges) {
         .sort((a, b) => a.id.localeCompare(b.id))
         .map(nodeForHashing);
     const sortedEdges = [...edges].sort((a, b) => a.id.localeCompare(b.id));
-    const input = 'totem-proofgraph' + canonicalJson(sortedNodes) + canonicalJson(sortedEdges);
-    return toHex((0, sha3_js_1.sha3_256)(new TextEncoder().encode(input)));
+    const input = 'totem-proofgraph' + (0, proof_1.canonicalJson)(sortedNodes) + (0, proof_1.canonicalJson)(sortedEdges);
+    return (0, proof_1.toHex)((0, core_1.sha3_256)(new TextEncoder().encode(input)));
 }
 function recomputeGraphId(graph) {
     return computeProofGraphId(graph.nodes, graph.edges);

package/dist/index.js

@@ -16,7 +16,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.importProofGraph = exports.exportProofGraph = exports.verifyGraphProofs = exports.verifyProofGraph = exports.reachableFrom = exports.getEdgesBetween = exports.getManifestsForAddress = exports.resolveCurrentProofSet = exports.getProofLineage = exports.getEvidenceTrail = exports.findConflicts = exports.findSupersessions = exports.findRevocations = exports.findAnchorsForProof = exports.findProofsByIssuer = exports.findProofsBySubject = exports.getProofNodes = exports.getEdgesByType = exports.getEdgesTo = exports.getEdgesFrom = exports.findNode = exports.addAnchor = exports.addReceiptLike = exports.addManifest = exports.addIdentityClaim = exports.addProof = exports.addIdentityDocument = exports.addEdge = exports.addNode = exports.buildEdge = exports.setGraphMetadata = exports.createProofGraph = exports.recomputeGraphId = exports.computeProofGraphId = exports.computeEdgeId = exports.computeNodeId = exports.canonicalJson = exports.toHex = void 0;
-var canonical_js_1 = require("./canonical.js");
+var canonical_js_1 = require("./canonical.js"); // canonicalJson / toHex re-exported from @totemsdk/proof
 Object.defineProperty(exports, "toHex", { enumerable: true, get: function () { return canonical_js_1.toHex; } });
 Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return canonical_js_1.canonicalJson; } });
 Object.defineProperty(exports, "computeNodeId", { enumerable: true, get: function () { return canonical_js_1.computeNodeId; } });

package/dist/io.d.ts

@@ -2,9 +2,11 @@
  * Serialization helpers for ProofGraph.
  *
  * exportProofGraph:  JSON-stringify the graph for storage or transport.
- * importProofGraph:  parse JSON, recompute graphId, throw if it doesn't match.
+ * importProofGraph:  parse JSON, validate every node/edge, recompute graphId,
+ *                    and throw if verification fails.
  *
- * The graphId guards against silent corruption in transit.
+ * The graphId guards against silent corruption in transit. Node/edge
+ * validation prevents hostile or malformed input from entering the system.
  */
 import type { ProofGraph } from './types.js';
 /**
@@ -15,9 +17,10 @@ export declare function exportProofGraph(graph: ProofGraph): string;
 /**
  * Deserialize a ProofGraph from a JSON string.
  *
- * Recomputes the graphId from nodes + edges. Throws if the recomputed value
- * does not match the stored graphId — indicates tampering or data corruption.
+ * Validates every node and edge against structural constraints, then
+ * recomputes the graphId from nodes + edges. Throws if any constraint
+ * is violated or if the recomputed graphId does not match the stored value.
  *
- * @throws Error if graphId verification fails.
+ * @throws Error if parsing, validation, or graphId verification fails.
  */
 export declare function importProofGraph(json: string): ProofGraph;

package/dist/io.js

@@ -3,14 +3,120 @@
  * Serialization helpers for ProofGraph.
  *
  * exportProofGraph:  JSON-stringify the graph for storage or transport.
- * importProofGraph:  parse JSON, recompute graphId, throw if it doesn't match.
+ * importProofGraph:  parse JSON, validate every node/edge, recompute graphId,
+ *                    and throw if verification fails.
  *
- * The graphId guards against silent corruption in transit.
+ * The graphId guards against silent corruption in transit. Node/edge
+ * validation prevents hostile or malformed input from entering the system.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exportProofGraph = exportProofGraph;
 exports.importProofGraph = importProofGraph;
 const canonical_js_1 = require("./canonical.js");
+const VALID_NODE_TYPES = new Set([
+    'proof', 'identity', 'identity-claim', 'manifest', 'address',
+    'subject', 'evidence', 'anchor', 'receipt', 'payment', 'device',
+    'service', 'policy', 'custom',
+]);
+const VALID_EDGE_TYPES = new Set([
+    'proves', 'issued_by', 'signed_by', 'about', 'references',
+    'derived_from', 'supports', 'contradicts', 'supersedes', 'revokes',
+    'anchored_to', 'delegates_to', 'controls', 'depends_on',
+    'manifests_as', 'conflicts_with',
+]);
+const MAX_NODES = 10000;
+const MAX_EDGES = 50000;
+const MAX_STRING_LENGTH = 4096;
+const MAX_DATA_DEPTH = 10;
+const MAX_DATA_KEYS = 256;
+/**
+ * Validate a single ProofGraphNode.
+ * Throws if the node violates structural constraints.
+ */
+function validateNode(node, index) {
+    if (!node || typeof node !== 'object') {
+        throw new Error(`importProofGraph: nodes[${index}] is not an object`);
+    }
+    const n = node;
+    if (typeof n.id !== 'string' || n.id.length === 0) {
+        throw new Error(`importProofGraph: nodes[${index}] missing or empty id`);
+    }
+    if (typeof n.refId !== 'string' || n.refId.length === 0) {
+        throw new Error(`importProofGraph: nodes[${index}] missing or empty refId`);
+    }
+    if (n.id.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: nodes[${index}].id exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (n.refId.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: nodes[${index}].refId exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (!VALID_NODE_TYPES.has(String(n.type))) {
+        throw new Error(`importProofGraph: nodes[${index}] invalid type "${String(n.type)}"`);
+    }
+    if (typeof n.createdAt !== 'number' || n.createdAt < 0 || !Number.isFinite(n.createdAt)) {
+        throw new Error(`importProofGraph: nodes[${index}] invalid or negative createdAt`);
+    }
+    if (n.data !== undefined && n.data !== null) {
+        if (typeof n.data !== 'object') {
+            throw new Error(`importProofGraph: nodes[${index}].data must be an object`);
+        }
+        const keys = Object.keys(n.data);
+        if (keys.length > MAX_DATA_KEYS) {
+            throw new Error(`importProofGraph: nodes[${index}].data exceeds ${MAX_DATA_KEYS} keys`);
+        }
+        checkDepth(n.data, 0, MAX_DATA_DEPTH, `nodes[${index}].data`);
+    }
+}
+/**
+ * Validate a single ProofGraphEdge.
+ * Throws if the edge violates structural constraints.
+ */
+function validateEdge(edge, index) {
+    if (!edge || typeof edge !== 'object') {
+        throw new Error(`importProofGraph: edges[${index}] is not an object`);
+    }
+    const e = edge;
+    if (typeof e.id !== 'string' || e.id.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty id`);
+    }
+    if (typeof e.from !== 'string' || e.from.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty from`);
+    }
+    if (typeof e.to !== 'string' || e.to.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty to`);
+    }
+    if (e.id.length > MAX_STRING_LENGTH || e.from.length > MAX_STRING_LENGTH || e.to.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: edges[${index}] string field exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (!VALID_EDGE_TYPES.has(String(e.type))) {
+        throw new Error(`importProofGraph: edges[${index}] invalid type "${String(e.type)}"`);
+    }
+    if (e.proofId !== undefined && typeof e.proofId !== 'string') {
+        throw new Error(`importProofGraph: edges[${index}].proofId must be a string`);
+    }
+    if (e.data !== undefined && e.data !== null) {
+        if (typeof e.data !== 'object') {
+            throw new Error(`importProofGraph: edges[${index}].data must be an object`);
+        }
+        checkDepth(e.data, 0, MAX_DATA_DEPTH, `edges[${index}].data`);
+    }
+}
+/**
+ * Recursive depth check on nested data objects to prevent deep-object attacks.
+ */
+function checkDepth(obj, depth, maxDepth, path) {
+    if (depth > maxDepth) {
+        throw new Error(`importProofGraph: ${path} exceeds max nesting depth of ${maxDepth}`);
+    }
+    for (const [key, value] of Object.entries(obj)) {
+        if (typeof key === 'string' && key.length > MAX_STRING_LENGTH) {
+            throw new Error(`importProofGraph: ${path} key exceeds ${MAX_STRING_LENGTH} chars`);
+        }
+        if (value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Uint8Array)) {
+            checkDepth(value, depth + 1, maxDepth, `${path}.${key}`);
+        }
+    }
+}
 /**
  * Serialize a ProofGraph to a JSON string.
  * The stored graphId was computed at mutation time and is included as-is.
@@ -21,10 +127,11 @@ function exportProofGraph(graph) {
 /**
  * Deserialize a ProofGraph from a JSON string.
  *
- * Recomputes the graphId from nodes + edges. Throws if the recomputed value
- * does not match the stored graphId — indicates tampering or data corruption.
+ * Validates every node and edge against structural constraints, then
+ * recomputes the graphId from nodes + edges. Throws if any constraint
+ * is violated or if the recomputed graphId does not match the stored value.
  *
- * @throws Error if graphId verification fails.
+ * @throws Error if parsing, validation, or graphId verification fails.
  */
 function importProofGraph(json) {
     let parsed;
@@ -41,9 +148,26 @@ function importProofGraph(json) {
     if (!Array.isArray(graph.nodes) || !Array.isArray(graph.edges)) {
         throw new Error('importProofGraph: missing nodes or edges arrays');
     }
+    if (graph.nodes.length > MAX_NODES) {
+        throw new Error(`importProofGraph: node count ${graph.nodes.length} exceeds limit ${MAX_NODES}`);
+    }
+    if (graph.edges.length > MAX_EDGES) {
+        throw new Error(`importProofGraph: edge count ${graph.edges.length} exceeds limit ${MAX_EDGES}`);
+    }
+    // Validate every node and edge
+    for (let i = 0; i < graph.nodes.length; i++) {
+        validateNode(graph.nodes[i], i);
+    }
+    for (let i = 0; i < graph.edges.length; i++) {
+        validateEdge(graph.edges[i], i);
+    }
+    // Recompute and verify graphId
+    const originalId = typeof graph.graphId === 'string' ? graph.graphId : '';
     const recomputed = (0, canonical_js_1.recomputeGraphId)(graph);
-    if (recomputed !== graph.graphId) {
-        throw new Error(`importProofGraph: graphId mismatch — stored="${graph.graphId}" recomputed="${recomputed}"`);
+    // If a stored graphId exists, verify it matches
+    if (originalId !== '' && recomputed !== originalId) {
+        throw new Error(`importProofGraph: graphId mismatch — stored="${originalId}" recomputed="${recomputed}"`);
     }
-    return graph;
+    // Return with graphId set to the recomputed value for consistency
+    return { ...graph, graphId: recomputed };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@totemsdk/proofgraph",
-  "version": "0.1.0",
-  "description": "Local deterministic proof relationship graph for Totem Edge — indexes proofs, identities, manifests, and subjects into a queryable DAG",
+  "version": "0.1.2",
+  "description": "Local deterministic proof relationship graph for Totem Edge — indexes proofs, identities, manifests, and subjects into a queryable content-addressed DAG",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -13,30 +13,23 @@
   },
   "files": [
     "dist",
+    "rust/pkg/",
+    "rust/pkg-node/",
     "README.md",
     "LICENSE"
   ],
   "dependencies": {
-    "@totemsdk/proof": "0.1.0",
-    "@totemsdk/core": "1.1.0",
-    "@totemsdk/manifest": "0.1.2",
-    "@totemsdk/identity": "0.1.2"
-  },
-  "peerDependencies": {
-    "@noble/hashes": "^2.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@noble/hashes": {
-      "optional": false
-    }
+    "@totemsdk/core": "^1.2.8",
+    "@totemsdk/proof": "^0.1.2",
+    "@totemsdk/manifest": "^0.1.3",
+    "@totemsdk/identity": "^0.1.4"
   },
   "devDependencies": {
-    "@noble/hashes": "^2.2.0",
-    "@types/jest": "^29.0.0",
+    "@types/jest": "^30.0.0",
     "@types/node": "^20.0.0",
-    "jest": "^29.0.0",
+    "jest": "^30.4.2",
     "ts-jest": "^29.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -46,19 +39,35 @@
   },
   "license": "MIT",
   "author": "Totem SDK",
-  "homepage": "https://totemsdk.com",
+  "homepage": "https://totem.ing",
+  "bugs": {
+    "url": "https://github.com/totem-sdk/totem-sdk/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/totem-sdk/totem-sdk.git",
+    "directory": "packages/proofgraph"
+  },
   "keywords": [
     "totem",
     "totemsdk",
     "minima",
+    "blockchain",
+    "quantum-resistant",
+    "wots",
+    "utxo",
     "proof",
     "graph",
     "dag",
-    "identity"
+    "identity",
+    "attestation",
+    "verification",
+    "content-addressed"
   ],
   "scripts": {
-    "build": "tsc",
-    "clean": "rm -rf dist",
-    "test": "jest --passWithNoTests"
+    "build": "npm run build:wasm && tsc && node ../../scripts/clean-wasm-output-ignores.mjs",
+    "build:wasm": "cd rust && wasm-pack build --target bundler --out-dir pkg && wasm-pack build --target nodejs --out-dir pkg-node",
+    "clean": "rm -rf dist rust/pkg rust/pkg-node rust/target",
+    "test": "jest"
   }
 }