@totemsdk/proofgraph 0.1.1 → 1.0.0

package/dist/canonical.d.ts

@@ -1,8 +1,8 @@
 /**
  * Canonical JSON and ID rules for @totemsdk/proofgraph.
  *
- * canonicalJson is implemented fresh — @totemsdk/identity and @totemsdk/proof
- * each have their own copy; none of them export it publicly.
+ * canonicalJson and toHex are re-exported from @totemsdk/proof, which is the
+ * canonical implementation across the Totem SDK.
  *
  * ID rules:
  *   Node:  type + ":" + refId  (e.g. "proof:totem:proof:abc123")
@@ -10,9 +10,9 @@
  *   Graph: sha3_256("totem-proofgraph" + canonicalJson(nodeHashes) + canonicalJson(sortedEdges))
  *          — node.createdAt and graph.metadata excluded from graphId (time-variant / mutable)
  */
+import { canonicalJson, toHex } from '@totemsdk/proof';
 import type { ProofGraphNode, ProofGraphEdge } from './types.js';
-export declare function toHex(bytes: Uint8Array): string;
-export declare function canonicalJson(value: unknown): string;
+export { canonicalJson, toHex };
 export declare function computeNodeId(type: string, refId: string): string;
 export declare function computeEdgeId(type: string, from: string, to: string, proofId: string | undefined, data: Record<string, unknown> | undefined): string;
 export declare function computeProofGraphId(nodes: ProofGraphNode[], edges: ProofGraphEdge[]): string;

package/dist/canonical.js

@@ -2,8 +2,8 @@
 /**
  * Canonical JSON and ID rules for @totemsdk/proofgraph.
  *
- * canonicalJson is implemented fresh — @totemsdk/identity and @totemsdk/proof
- * each have their own copy; none of them export it publicly.
+ * canonicalJson and toHex are re-exported from @totemsdk/proof, which is the
+ * canonical implementation across the Totem SDK.
  *
  * ID rules:
  *   Node:  type + ":" + refId  (e.g. "proof:totem:proof:abc123")
@@ -12,37 +12,22 @@
  *          — node.createdAt and graph.metadata excluded from graphId (time-variant / mutable)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toHex = toHex;
-exports.canonicalJson = canonicalJson;
+exports.toHex = exports.canonicalJson = void 0;
 exports.computeNodeId = computeNodeId;
 exports.computeEdgeId = computeEdgeId;
 exports.computeProofGraphId = computeProofGraphId;
 exports.recomputeGraphId = recomputeGraphId;
-const sha3_js_1 = require("@noble/hashes/sha3.js");
-function toHex(bytes) {
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, '0'))
-        .join('');
-}
-function canonicalJson(value) {
-    if (value === null || typeof value !== 'object') {
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value)) {
-        return '[' + value.map(canonicalJson).join(',') + ']';
-    }
-    const obj = value;
-    const keys = Object.keys(obj).sort();
-    const pairs = keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`);
-    return '{' + pairs.join(',') + '}';
-}
+const core_1 = require("@totemsdk/core");
+const proof_1 = require("@totemsdk/proof");
+Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return proof_1.canonicalJson; } });
+Object.defineProperty(exports, "toHex", { enumerable: true, get: function () { return proof_1.toHex; } });
 function computeNodeId(type, refId) {
     return `${type}:${refId}`;
 }
 function computeEdgeId(type, from, to, proofId, data) {
-    const canonicalDataHash = toHex((0, sha3_js_1.sha3_256)(new TextEncoder().encode(canonicalJson(data ?? {}))));
+    const canonicalDataHash = (0, proof_1.toHex)((0, core_1.sha3_256)(new TextEncoder().encode((0, proof_1.canonicalJson)(data ?? {}))));
     const input = 'totem-proofgraph-edge' + type + from + to + (proofId ?? '') + canonicalDataHash;
-    return toHex((0, sha3_js_1.sha3_256)(new TextEncoder().encode(input)));
+    return (0, proof_1.toHex)((0, core_1.sha3_256)(new TextEncoder().encode(input)));
 }
 /**
  * Content-stable projection of a node for graphId computation.
@@ -58,8 +43,8 @@ function computeProofGraphId(nodes, edges) {
         .sort((a, b) => a.id.localeCompare(b.id))
         .map(nodeForHashing);
     const sortedEdges = [...edges].sort((a, b) => a.id.localeCompare(b.id));
-    const input = 'totem-proofgraph' + canonicalJson(sortedNodes) + canonicalJson(sortedEdges);
-    return toHex((0, sha3_js_1.sha3_256)(new TextEncoder().encode(input)));
+    const input = 'totem-proofgraph' + (0, proof_1.canonicalJson)(sortedNodes) + (0, proof_1.canonicalJson)(sortedEdges);
+    return (0, proof_1.toHex)((0, core_1.sha3_256)(new TextEncoder().encode(input)));
 }
 function recomputeGraphId(graph) {
     return computeProofGraphId(graph.nodes, graph.edges);

package/dist/index.js

@@ -16,7 +16,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.importProofGraph = exports.exportProofGraph = exports.verifyGraphProofs = exports.verifyProofGraph = exports.reachableFrom = exports.getEdgesBetween = exports.getManifestsForAddress = exports.resolveCurrentProofSet = exports.getProofLineage = exports.getEvidenceTrail = exports.findConflicts = exports.findSupersessions = exports.findRevocations = exports.findAnchorsForProof = exports.findProofsByIssuer = exports.findProofsBySubject = exports.getProofNodes = exports.getEdgesByType = exports.getEdgesTo = exports.getEdgesFrom = exports.findNode = exports.addAnchor = exports.addReceiptLike = exports.addManifest = exports.addIdentityClaim = exports.addProof = exports.addIdentityDocument = exports.addEdge = exports.addNode = exports.buildEdge = exports.setGraphMetadata = exports.createProofGraph = exports.recomputeGraphId = exports.computeProofGraphId = exports.computeEdgeId = exports.computeNodeId = exports.canonicalJson = exports.toHex = void 0;
-var canonical_js_1 = require("./canonical.js");
+var canonical_js_1 = require("./canonical.js"); // canonicalJson / toHex re-exported from @totemsdk/proof
 Object.defineProperty(exports, "toHex", { enumerable: true, get: function () { return canonical_js_1.toHex; } });
 Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return canonical_js_1.canonicalJson; } });
 Object.defineProperty(exports, "computeNodeId", { enumerable: true, get: function () { return canonical_js_1.computeNodeId; } });

package/dist/io.d.ts

@@ -2,9 +2,11 @@
  * Serialization helpers for ProofGraph.
  *
  * exportProofGraph:  JSON-stringify the graph for storage or transport.
- * importProofGraph:  parse JSON, recompute graphId, throw if it doesn't match.
+ * importProofGraph:  parse JSON, validate every node/edge, recompute graphId,
+ *                    and throw if verification fails.
  *
- * The graphId guards against silent corruption in transit.
+ * The graphId guards against silent corruption in transit. Node/edge
+ * validation prevents hostile or malformed input from entering the system.
  */
 import type { ProofGraph } from './types.js';
 /**
@@ -15,9 +17,10 @@ export declare function exportProofGraph(graph: ProofGraph): string;
 /**
  * Deserialize a ProofGraph from a JSON string.
  *
- * Recomputes the graphId from nodes + edges. Throws if the recomputed value
- * does not match the stored graphId — indicates tampering or data corruption.
+ * Validates every node and edge against structural constraints, then
+ * recomputes the graphId from nodes + edges. Throws if any constraint
+ * is violated or if the recomputed graphId does not match the stored value.
  *
- * @throws Error if graphId verification fails.
+ * @throws Error if parsing, validation, or graphId verification fails.
  */
 export declare function importProofGraph(json: string): ProofGraph;

package/dist/io.js

@@ -3,14 +3,120 @@
  * Serialization helpers for ProofGraph.
  *
  * exportProofGraph:  JSON-stringify the graph for storage or transport.
- * importProofGraph:  parse JSON, recompute graphId, throw if it doesn't match.
+ * importProofGraph:  parse JSON, validate every node/edge, recompute graphId,
+ *                    and throw if verification fails.
  *
- * The graphId guards against silent corruption in transit.
+ * The graphId guards against silent corruption in transit. Node/edge
+ * validation prevents hostile or malformed input from entering the system.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exportProofGraph = exportProofGraph;
 exports.importProofGraph = importProofGraph;
 const canonical_js_1 = require("./canonical.js");
+const VALID_NODE_TYPES = new Set([
+    'proof', 'identity', 'identity-claim', 'manifest', 'address',
+    'subject', 'evidence', 'anchor', 'receipt', 'payment', 'device',
+    'service', 'policy', 'custom',
+]);
+const VALID_EDGE_TYPES = new Set([
+    'proves', 'issued_by', 'signed_by', 'about', 'references',
+    'derived_from', 'supports', 'contradicts', 'supersedes', 'revokes',
+    'anchored_to', 'delegates_to', 'controls', 'depends_on',
+    'manifests_as', 'conflicts_with',
+]);
+const MAX_NODES = 10000;
+const MAX_EDGES = 50000;
+const MAX_STRING_LENGTH = 4096;
+const MAX_DATA_DEPTH = 10;
+const MAX_DATA_KEYS = 256;
+/**
+ * Validate a single ProofGraphNode.
+ * Throws if the node violates structural constraints.
+ */
+function validateNode(node, index) {
+    if (!node || typeof node !== 'object') {
+        throw new Error(`importProofGraph: nodes[${index}] is not an object`);
+    }
+    const n = node;
+    if (typeof n.id !== 'string' || n.id.length === 0) {
+        throw new Error(`importProofGraph: nodes[${index}] missing or empty id`);
+    }
+    if (typeof n.refId !== 'string' || n.refId.length === 0) {
+        throw new Error(`importProofGraph: nodes[${index}] missing or empty refId`);
+    }
+    if (n.id.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: nodes[${index}].id exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (n.refId.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: nodes[${index}].refId exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (!VALID_NODE_TYPES.has(String(n.type))) {
+        throw new Error(`importProofGraph: nodes[${index}] invalid type "${String(n.type)}"`);
+    }
+    if (typeof n.createdAt !== 'number' || n.createdAt < 0 || !Number.isFinite(n.createdAt)) {
+        throw new Error(`importProofGraph: nodes[${index}] invalid or negative createdAt`);
+    }
+    if (n.data !== undefined && n.data !== null) {
+        if (typeof n.data !== 'object') {
+            throw new Error(`importProofGraph: nodes[${index}].data must be an object`);
+        }
+        const keys = Object.keys(n.data);
+        if (keys.length > MAX_DATA_KEYS) {
+            throw new Error(`importProofGraph: nodes[${index}].data exceeds ${MAX_DATA_KEYS} keys`);
+        }
+        checkDepth(n.data, 0, MAX_DATA_DEPTH, `nodes[${index}].data`);
+    }
+}
+/**
+ * Validate a single ProofGraphEdge.
+ * Throws if the edge violates structural constraints.
+ */
+function validateEdge(edge, index) {
+    if (!edge || typeof edge !== 'object') {
+        throw new Error(`importProofGraph: edges[${index}] is not an object`);
+    }
+    const e = edge;
+    if (typeof e.id !== 'string' || e.id.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty id`);
+    }
+    if (typeof e.from !== 'string' || e.from.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty from`);
+    }
+    if (typeof e.to !== 'string' || e.to.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty to`);
+    }
+    if (e.id.length > MAX_STRING_LENGTH || e.from.length > MAX_STRING_LENGTH || e.to.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: edges[${index}] string field exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (!VALID_EDGE_TYPES.has(String(e.type))) {
+        throw new Error(`importProofGraph: edges[${index}] invalid type "${String(e.type)}"`);
+    }
+    if (e.proofId !== undefined && typeof e.proofId !== 'string') {
+        throw new Error(`importProofGraph: edges[${index}].proofId must be a string`);
+    }
+    if (e.data !== undefined && e.data !== null) {
+        if (typeof e.data !== 'object') {
+            throw new Error(`importProofGraph: edges[${index}].data must be an object`);
+        }
+        checkDepth(e.data, 0, MAX_DATA_DEPTH, `edges[${index}].data`);
+    }
+}
+/**
+ * Recursive depth check on nested data objects to prevent deep-object attacks.
+ */
+function checkDepth(obj, depth, maxDepth, path) {
+    if (depth > maxDepth) {
+        throw new Error(`importProofGraph: ${path} exceeds max nesting depth of ${maxDepth}`);
+    }
+    for (const [key, value] of Object.entries(obj)) {
+        if (typeof key === 'string' && key.length > MAX_STRING_LENGTH) {
+            throw new Error(`importProofGraph: ${path} key exceeds ${MAX_STRING_LENGTH} chars`);
+        }
+        if (value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Uint8Array)) {
+            checkDepth(value, depth + 1, maxDepth, `${path}.${key}`);
+        }
+    }
+}
 /**
  * Serialize a ProofGraph to a JSON string.
  * The stored graphId was computed at mutation time and is included as-is.
@@ -21,10 +127,11 @@ function exportProofGraph(graph) {
 /**
  * Deserialize a ProofGraph from a JSON string.
  *
- * Recomputes the graphId from nodes + edges. Throws if the recomputed value
- * does not match the stored graphId — indicates tampering or data corruption.
+ * Validates every node and edge against structural constraints, then
+ * recomputes the graphId from nodes + edges. Throws if any constraint
+ * is violated or if the recomputed graphId does not match the stored value.
  *
- * @throws Error if graphId verification fails.
+ * @throws Error if parsing, validation, or graphId verification fails.
  */
 function importProofGraph(json) {
     let parsed;
@@ -41,9 +148,26 @@ function importProofGraph(json) {
     if (!Array.isArray(graph.nodes) || !Array.isArray(graph.edges)) {
         throw new Error('importProofGraph: missing nodes or edges arrays');
     }
+    if (graph.nodes.length > MAX_NODES) {
+        throw new Error(`importProofGraph: node count ${graph.nodes.length} exceeds limit ${MAX_NODES}`);
+    }
+    if (graph.edges.length > MAX_EDGES) {
+        throw new Error(`importProofGraph: edge count ${graph.edges.length} exceeds limit ${MAX_EDGES}`);
+    }
+    // Validate every node and edge
+    for (let i = 0; i < graph.nodes.length; i++) {
+        validateNode(graph.nodes[i], i);
+    }
+    for (let i = 0; i < graph.edges.length; i++) {
+        validateEdge(graph.edges[i], i);
+    }
+    // Recompute and verify graphId
+    const originalId = typeof graph.graphId === 'string' ? graph.graphId : '';
     const recomputed = (0, canonical_js_1.recomputeGraphId)(graph);
-    if (recomputed !== graph.graphId) {
-        throw new Error(`importProofGraph: graphId mismatch — stored="${graph.graphId}" recomputed="${recomputed}"`);
+    // If a stored graphId exists, verify it matches
+    if (originalId !== '' && recomputed !== originalId) {
+        throw new Error(`importProofGraph: graphId mismatch — stored="${originalId}" recomputed="${recomputed}"`);
     }
-    return graph;
+    // Return with graphId set to the recomputed value for consistency
+    return { ...graph, graphId: recomputed };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totemsdk/proofgraph",
-  "version": "0.1.1",
+  "version": "1.0.0",
   "description": "Local deterministic proof relationship graph for Totem Edge — indexes proofs, identities, manifests, and subjects into a queryable content-addressed DAG",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,30 +13,23 @@
   },
   "files": [
     "dist",
+    "rust/pkg/",
+    "rust/pkg-node/",
     "README.md",
     "LICENSE"
   ],
   "dependencies": {
-    "@totemsdk/core": "1.1.0",
-    "@totemsdk/proof": "0.1.1",
-    "@totemsdk/manifest": "0.1.2",
-    "@totemsdk/identity": "0.1.2"
-  },
-  "peerDependencies": {
-    "@noble/hashes": "^2.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@noble/hashes": {
-      "optional": false
-    }
+    "@totemsdk/core": "^1.2.9",
+    "@totemsdk/proof": "^1.0.0",
+    "@totemsdk/manifest": "^1.0.0",
+    "@totemsdk/identity": "^1.0.0"
   },
   "devDependencies": {
-    "@noble/hashes": "^2.2.0",
-    "@types/jest": "^29.0.0",
+    "@types/jest": "^30.0.0",
     "@types/node": "^20.0.0",
-    "jest": "^29.0.0",
+    "jest": "^30.4.2",
     "ts-jest": "^29.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -46,20 +39,23 @@
   },
   "license": "MIT",
   "author": "Totem SDK",
-  "homepage": "https://totemsdk.com",
+  "homepage": "https://totem.ing",
   "bugs": {
-    "url": "https://github.com/MrGheek/axia-totem/issues"
+    "url": "https://github.com/Totem-Edge/totem-sdk/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/MrGheek/axia-totem.git",
-    "directory": "packages/totem-sdk/packages/proofgraph"
+    "url": "git+https://github.com/Totem-Edge/totem-sdk.git",
+    "directory": "packages/proofgraph"
   },
   "keywords": [
     "totem",
     "totemsdk",
     "minima",
     "blockchain",
+    "quantum-resistant",
+    "wots",
+    "utxo",
     "proof",
     "graph",
     "dag",
@@ -69,8 +65,9 @@
     "content-addressed"
   ],
   "scripts": {
-    "build": "tsc",
-    "clean": "rm -rf dist",
-    "test": "jest --passWithNoTests"
+    "build": "npm run build:wasm && tsc && node ../../scripts/clean-wasm-output-ignores.mjs",
+    "build:wasm": "cd rust && wasm-pack build --target bundler --out-dir pkg && wasm-pack build --target nodejs --out-dir pkg-node",
+    "clean": "rm -rf dist rust/pkg rust/pkg-node rust/target",
+    "test": "jest"
   }
 }

package/rust/pkg/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "proofgraph-wasm",
+  "type": "module",
+  "collaborators": [
+    "Totem SDK Contributors"
+  ],
+  "description": "Local deterministic proof relationship graph — content-addressed DAG, node/edge ID computation, graph ID hashing, import/export validation (Rust/WASM)",
+  "version": "0.1.0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Totem-Edge/totem-sdk"
+  },
+  "files": [
+    "proofgraph_wasm_bg.wasm",
+    "proofgraph_wasm.js",
+    "proofgraph_wasm_bg.js",
+    "proofgraph_wasm.d.ts"
+  ],
+  "main": "proofgraph_wasm.js",
+  "homepage": "https://totem.ing",
+  "types": "proofgraph_wasm.d.ts",
+  "sideEffects": [
+    "./proofgraph_wasm.js",
+    "./snippets/*"
+  ]
+}

package/rust/pkg/proofgraph_wasm.d.ts

@@ -0,0 +1,30 @@
+/* tslint:disable */
+/* eslint-disable */
+
+export function add_edge_wasm(graph_js: any, edge_js: any): any;
+
+export function add_node_wasm(graph_js: any, node_type: string, ref_id: string, data_js: any | null | undefined, created_at: bigint): any;
+
+export function canonical_json_wasm(value_js: any): string;
+
+export function compute_edge_id_wasm(edge_type: string, from: string, to: string, proof_id?: string | null, data_js?: any | null): string;
+
+export function compute_node_id_wasm(node_type: string, ref_id: string): string;
+
+export function compute_proof_graph_id_wasm(nodes_js: any, edges_js: any): string;
+
+export function create_proof_graph_wasm(metadata_js: any | null | undefined, created_at: bigint): any;
+
+export function find_node_wasm(graph_js: any, id: string): any;
+
+export function find_proofs_by_subject_wasm(graph_js: any, subject_id: string): any;
+
+export function get_edges_from_wasm(graph_js: any, node_id: string): any;
+
+export function init(): void;
+
+export function reachable_from_wasm(graph_js: any, start_ref_id: string): any;
+
+export function resolve_current_proof_set_wasm(graph_js: any): any;
+
+export function to_hex_wasm(bytes: Uint8Array): string;

package/rust/pkg/proofgraph_wasm.js

@@ -0,0 +1,9 @@
+/* @ts-self-types="./proofgraph_wasm.d.ts" */
+import * as wasm from "./proofgraph_wasm_bg.wasm";
+import { __wbg_set_wasm } from "./proofgraph_wasm_bg.js";
+
+__wbg_set_wasm(wasm);
+wasm.__wbindgen_start();
+export {
+    add_edge_wasm, add_node_wasm, canonical_json_wasm, compute_edge_id_wasm, compute_node_id_wasm, compute_proof_graph_id_wasm, create_proof_graph_wasm, find_node_wasm, find_proofs_by_subject_wasm, get_edges_from_wasm, init, reachable_from_wasm, resolve_current_proof_set_wasm, to_hex_wasm
+} from "./proofgraph_wasm_bg.js";