@totemsdk/proofgraph 1.0.1 → 1.1.0

package/dist/cjs/evidence.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Durable evidence-chain owner for @totemsdk/proofgraph (RFC-007 G8 / §4.3).
+ *
+ * Evidence *bytes* are owned by the minimal `ArtifactStore` over a pluggable
+ * backend; graph references alone do not satisfy the flight-evidence gate. This
+ * module wires a ProofGraph's `evidence` nodes to content-addressed artifacts,
+ * and restores the bytes on demand with commit-time digest verification.
+ *
+ * Restore semantics (RFC-007 §4.3): `corrupt` (bytes present but digest
+ * mismatch — tampered or truncated) is surfaced strictly, never collapsed into
+ * `not-found` (bytes absent); `unavailable` (backend unreachable, or the
+ * backend deleted a blob the local index still references) is also surfaced.
+ */
+import type { ProofGraph } from './types.js';
+import { ArtifactStore } from '@totemsdk/storage/artifacts';
+import type { ArtifactRef } from '@totemsdk/storage/artifacts';
+import type { StorageAdapter } from '@totemsdk/core';
+/**
+ * RFC-007 Amendment A (A3): the enforced binding between a claim's commitment
+ * and the artifact that addresses it.
+ *
+ * Invariant: `contentHash === artifact.digest`. `assertEvidenceBinding` throws
+ * `StorageError('corrupt')` when it does not hold, so an unrecoverable
+ * commitment cannot be constructed or restored.
+ */
+export interface EvidenceArtifactBinding {
+    readonly nodeId: string;
+    /** The commitment from the claim (hex, with or without `0x`). */
+    readonly contentHash: string;
+    /** The content-addressed artifact; `artifact.digest` must equal `contentHash`. */
+    readonly artifact: ArtifactRef;
+}
+export declare function normalizeEvidenceHash(hash: string): string;
+/** Throws `StorageError('corrupt')` unless `contentHash === artifact.digest`. */
+export declare function assertEvidenceBinding(binding: EvidenceArtifactBinding): void;
+export interface ProofGraphEvidenceStoreOptions {
+    /** Namespace the ArtifactStore writes artifact bytes under. */
+    namespace?: string;
+    /**
+     * true (default) — a `corrupt` or `unavailable` evidence read throws
+     * `StorageError` (never fail-open). `not-found` is always returned as a
+     * result, never thrown. Set false to return audit-able results instead.
+     */
+    strict?: boolean;
+}
+/** Per-evidence-node restore result. */
+export interface ProofGraphEvidenceResult {
+    nodeId: string;
+    status: 'ok' | 'not-found' | 'corrupt' | 'unavailable';
+    ref?: ArtifactRef;
+    /** The claim commitment this evidence is bound to, when known. */
+    contentHash?: string;
+    bytes?: Uint8Array;
+    message?: string;
+}
+export interface PutEvidenceOptions {
+    /**
+     * Explicit commitment per node. Falls back to the evidence node's
+     * `data.contentHash` (set by `addProof`). When a commitment is known, the
+     * stored bytes MUST hash to it and the artifact digest MUST equal it, or the
+     * put throws `StorageError('corrupt')`.
+     */
+    contentHashFor?: (nodeId: string) => string | undefined;
+    /**
+     * When true, every evidence node must have a commitment — a missing
+     * commitment throws. Default false (back-compat for nodes without one).
+     */
+    requireContentHash?: boolean;
+}
+export interface ProofGraphEvidenceStore {
+    /**
+     * Persist evidence bytes for every `evidence` node of `graph`.
+     * `bytesFor` maps a node id to the bytes to store; nodes with no bytes are
+     * skipped. When a commitment is known (node `data.contentHash` or
+     * `options.contentHashFor`), the claim→hash→artifact binding is enforced:
+     * `sha3_256(bytes) === contentHash === artifact.digest`.
+     * Returns the refs persisted, in graph node order.
+     */
+    putEvidence(graph: ProofGraph, bytesFor: (nodeId: string) => Uint8Array | undefined, options?: PutEvidenceOptions): Promise<ArtifactRef[]>;
+    /**
+     * Restore evidence bytes for every `evidence` node of `graph`, verifying
+     * each artifact's committed digest on read. With `strict` (default), corrupt
+     * or unavailable reads throw; otherwise a per-node result is returned.
+     */
+    restoreEvidence(graph: ProofGraph): Promise<ProofGraphEvidenceResult[]>;
+    /** Count of local index entries (persisted evidence mappings). */
+    listCount(): Promise<number>;
+}
+export declare function createProofGraphEvidenceStore(artifacts: ArtifactStore, index: StorageAdapter, options?: ProofGraphEvidenceStoreOptions): ProofGraphEvidenceStore;

package/dist/cjs/evidence.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Durable evidence-chain owner for @totemsdk/proofgraph (RFC-007 G8 / §4.3).
+ *
+ * Evidence *bytes* are owned by the minimal `ArtifactStore` over a pluggable
+ * backend; graph references alone do not satisfy the flight-evidence gate. This
+ * module wires a ProofGraph's `evidence` nodes to content-addressed artifacts,
+ * and restores the bytes on demand with commit-time digest verification.
+ *
+ * Restore semantics (RFC-007 §4.3): `corrupt` (bytes present but digest
+ * mismatch — tampered or truncated) is surfaced strictly, never collapsed into
+ * `not-found` (bytes absent); `unavailable` (backend unreachable, or the
+ * backend deleted a blob the local index still references) is also surfaced.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeEvidenceHash = normalizeEvidenceHash;
+exports.assertEvidenceBinding = assertEvidenceBinding;
+exports.createProofGraphEvidenceStore = createProofGraphEvidenceStore;
+const errors_1 = require("@totemsdk/storage/errors");
+const core_1 = require("@totemsdk/core");
+const DEFAULT_NS = 'totem-proofgraph-evidence';
+const INDEX_PREFIX = 'totem_proofgraph_evidence:v1:';
+function normalizeEvidenceHash(hash) {
+    return hash.replace(/^0x/i, '').toLowerCase();
+}
+/** Throws `StorageError('corrupt')` unless `contentHash === artifact.digest`. */
+function assertEvidenceBinding(binding) {
+    if (normalizeEvidenceHash(binding.contentHash) !== normalizeEvidenceHash(binding.artifact.digest)) {
+        throw new errors_1.StorageError(`evidence binding mismatch for node "${binding.nodeId}": contentHash ${binding.contentHash} !== artifact.digest ${binding.artifact.digest}`, 'corrupt', { key: binding.nodeId });
+    }
+}
+function evidenceNodeIds(graph) {
+    return graph.nodes.filter((node) => node.type === 'evidence').map((node) => node.id);
+}
+/** The claim commitment carried on an evidence node (`data.contentHash`). */
+function nodeContentHash(graph, nodeId) {
+    const value = graph.nodes.find((node) => node.id === nodeId)?.data?.contentHash;
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function createProofGraphEvidenceStore(artifacts, index, options = {}) {
+    if (!artifacts.capabilities.writable) {
+        throw new Error('createProofGraphEvidenceStore requires a writable artifact store');
+    }
+    const namespace = options.namespace ?? DEFAULT_NS;
+    const strict = options.strict ?? true;
+    const indexKey = (nodeId) => `${INDEX_PREFIX}${nodeId}`;
+    return {
+        async putEvidence(graph, bytesFor, options = {}) {
+            const refs = [];
+            for (const nodeId of evidenceNodeIds(graph)) {
+                const bytes = bytesFor(nodeId);
+                if (!bytes)
+                    continue;
+                const contentHash = options.contentHashFor?.(nodeId) ?? nodeContentHash(graph, nodeId);
+                if (!contentHash && options.requireContentHash) {
+                    throw new errors_1.StorageError(`evidence commitment missing for node "${nodeId}"`, 'corrupt', { key: indexKey(nodeId) });
+                }
+                // Byte-identity invariant: the stored bytes must hash to the commitment.
+                const digest = (0, core_1.toHex)((0, core_1.sha3_256)(bytes));
+                if (contentHash && normalizeEvidenceHash(contentHash) !== digest) {
+                    throw new errors_1.StorageError(`evidence commitment mismatch for node "${nodeId}": sha3(bytes) ${digest} !== contentHash ${contentHash}`, 'corrupt', { key: indexKey(nodeId) });
+                }
+                const receipt = await artifacts.put(namespace, bytes).catch((err) => {
+                    throw new errors_1.StorageError(`evidence put failed for node "${nodeId}": ${err.message}`, 'write-failed', { key: indexKey(nodeId), cause: err });
+                });
+                if (contentHash) {
+                    // The artifact must address exactly the committed hash.
+                    assertEvidenceBinding({ nodeId, contentHash, artifact: receipt.ref });
+                }
+                const entry = {
+                    ref: receipt.ref,
+                    ...(contentHash ? { contentHash: normalizeEvidenceHash(contentHash) } : {}),
+                };
+                await index.set(indexKey(nodeId), entry);
+                refs.push(receipt.ref);
+            }
+            return refs;
+        },
+        async restoreEvidence(graph) {
+            const results = [];
+            const fail = (err) => {
+                if (err instanceof errors_1.StorageError)
+                    throw err;
+                throw new errors_1.StorageError(`evidence read failed: ${err.message}`, 'unavailable', { cause: err });
+            };
+            for (const nodeId of evidenceNodeIds(graph)) {
+                const entry = await index.get(indexKey(nodeId));
+                if (!entry) {
+                    results.push({ nodeId, status: 'not-found', message: 'no evidence artifact persisted for node' });
+                    continue;
+                }
+                const { ref, contentHash } = entry;
+                if (contentHash) {
+                    // Index-tamper guard: the enforced binding must still hold.
+                    assertEvidenceBinding({ nodeId, contentHash, artifact: ref });
+                }
+                const read = await artifacts.get(ref).catch(fail);
+                switch (read.status) {
+                    case 'ok':
+                        results.push({ nodeId, status: 'ok', ref, ...(contentHash ? { contentHash } : {}), bytes: read.bytes });
+                        break;
+                    case 'corrupt':
+                        if (strict) {
+                            throw new errors_1.StorageError(`evidence artifact corrupt for node "${nodeId}": ${read.message ?? 'digest mismatch'}`, 'corrupt', { key: indexKey(nodeId) });
+                        }
+                        results.push({ nodeId, status: 'corrupt', ref, message: read.message ?? 'digest mismatch' });
+                        break;
+                    case 'unavailable':
+                        if (strict) {
+                            throw new errors_1.StorageError(`evidence artifact unavailable for node "${nodeId}": ${read.message ?? 'backend unavailable'}`, 'unavailable', { key: indexKey(nodeId) });
+                        }
+                        results.push({ nodeId, status: 'unavailable', ref, message: read.message ?? 'backend unavailable' });
+                        break;
+                    case 'not-found':
+                        results.push({ nodeId, status: 'not-found', ref, message: read.message ?? 'evidence artifact not found' });
+                        break;
+                }
+            }
+            return results;
+        },
+        async listCount() {
+            let count = 0;
+            for (const key of await index.keys()) {
+                if (key.startsWith(INDEX_PREFIX))
+                    count++;
+            }
+            return count;
+        },
+    };
+}

package/dist/cjs/graph.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Proof graph mutation functions — all pure, all returning NEW graphs.
+ *
+ * Immutable pattern: every mutation returns a brand-new ProofGraph with a
+ * recomputed graphId. Nodes and edges are deduplicated by ID so adding the
+ * same proof twice is idempotent.
+ */
+import type { SignedProof } from '@totemsdk/proof';
+import type { SignedIdentityClaim, TotemIdentityDocument } from '@totemsdk/identity';
+import type { SignedManifest } from '@totemsdk/manifest';
+import type { ProofGraph, ProofGraphEdge, ProofGraphEdgeType, ProofGraphNodeType, ReceiptLikeInput, AnchorInput } from './types.js';
+/**
+ * Create an empty ProofGraph.
+ */
+export declare function createProofGraph(metadata?: Record<string, unknown>): ProofGraph;
+/**
+ * Attach or replace mutable metadata. Does NOT affect graphId.
+ */
+export declare function setGraphMetadata(graph: ProofGraph, metadata: Record<string, unknown>): ProofGraph;
+/**
+ * Build a ProofGraphEdge with a deterministic ID from its fields.
+ * Convenience helper so callers don't need to import computeEdgeId.
+ */
+export declare function buildEdge(type: ProofGraphEdgeType, from: string, to: string, proofId?: string, data?: Record<string, unknown>): ProofGraphEdge;
+/**
+ * Add a node directly (type + refId pair). Idempotent — skipped if the node already exists.
+ */
+export declare function addNode(graph: ProofGraph, type: ProofGraphNodeType, refId: string, data?: Record<string, unknown>): ProofGraph;
+/**
+ * Append a ProofGraphEdge and recompute graphId. Idempotent by edge ID.
+ * Spec API: addEdge(graph, edge). Use buildEdge() to construct the edge object.
+ */
+export declare function addEdge(graph: ProofGraph, edge: ProofGraphEdge): ProofGraph;
+/**
+ * Index a TotemIdentityDocument into the graph.
+ * Creates an 'identity' node with refId = doc.id.
+ */
+export declare function addIdentityDocument(graph: ProofGraph, doc: TotemIdentityDocument): ProofGraph;
+/**
+ * Index a SignedProof into the graph.
+ *
+ * Nodes created:
+ *   proof      — proofId (stores the full SignedProof in .data)
+ *   identity   — signature.address (issuer key address)
+ *   subject    — proof.subject.id
+ *   evidence   — ev.id (one per evidence ref)
+ *   anchor     — anchor.hash (if present)
+ *
+ * Edges created (all referencing the proofId):
+ *   proves      proof → subject
+ *   issued_by   proof → identity (signer)
+ *   about       proof → subject
+ *   references  proof → evidence (one per evidence ref, in array order)
+ *   anchored_to proof → anchor (if present)
+ */
+export declare function addProof(graph: ProofGraph, signedProof: SignedProof): ProofGraph;
+/**
+ * Index a SignedIdentityClaim into the graph.
+ *
+ * Nodes created:
+ *   identity-claim — claim.id (stores the full signed claim in .data)
+ *   address        — issuer address
+ *   address/identity — target address (for delegates_to / rotates_to / revokes)
+ *
+ * Edges created based on claim.type:
+ *   all types    → issued_by  (claim-node → issuer address)
+ *   delegates_to → delegates_to edge (claim-node → delegated address)
+ *   revokes      → revokes edge      (claim-node → subject identity)
+ *   rotates_to   → controls edge     (claim-node → new address)
+ */
+export declare function addIdentityClaim(graph: ProofGraph, signedClaim: SignedIdentityClaim): ProofGraph;
+/**
+ * Index a SignedManifest into the graph.
+ *
+ * Nodes created:
+ *   manifest — computed manifest ID (stores manifest content in .data)
+ *   address  — resolved author/agent/operator address
+ *
+ * Edge created:
+ *   manifests_as  manifest → address
+ */
+export declare function addManifest(graph: ProofGraph, signedManifest: SignedManifest): ProofGraph;
+/**
+ * Add a signed manifest **revision** without collapsing other revisions.
+ *
+ * Creates:
+ *   manifest (logical)   refId = manifestId
+ *   manifest (revision)  refId = manifestEnvelopeId, data = { manifestId, manifestEnvelopeId, signedManifest }
+ *   address              resolved author/operator address
+ *   manifests_as         manifestId → address
+ *   revision_of          manifestEnvelopeId → manifestId
+ */
+export declare function addManifestRevision(graph: ProofGraph, signedManifest: SignedManifest): ProofGraph;
+/**
+ * Add a receipt-like node (payment, subscription, claim receipt) to the graph.
+ * If receipt.proofId is set, adds a 'supports' edge from the receipt to that proof.
+ */
+export declare function addReceiptLike(graph: ProofGraph, receipt: ReceiptLikeInput): ProofGraph;
+/**
+ * Add a standalone anchor node. If anchor.proofId is set, adds an 'anchored_to'
+ * edge from the proof to this anchor.
+ */
+export declare function addAnchor(graph: ProofGraph, anchor: AnchorInput): ProofGraph;

package/dist/cjs/graph.js

@@ -0,0 +1,298 @@
+"use strict";
+/**
+ * Proof graph mutation functions — all pure, all returning NEW graphs.
+ *
+ * Immutable pattern: every mutation returns a brand-new ProofGraph with a
+ * recomputed graphId. Nodes and edges are deduplicated by ID so adding the
+ * same proof twice is idempotent.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProofGraph = createProofGraph;
+exports.setGraphMetadata = setGraphMetadata;
+exports.buildEdge = buildEdge;
+exports.addNode = addNode;
+exports.addEdge = addEdge;
+exports.addIdentityDocument = addIdentityDocument;
+exports.addProof = addProof;
+exports.addIdentityClaim = addIdentityClaim;
+exports.addManifest = addManifest;
+exports.addManifestRevision = addManifestRevision;
+exports.addReceiptLike = addReceiptLike;
+exports.addAnchor = addAnchor;
+const manifest_1 = require("@totemsdk/manifest");
+const canonical_js_1 = require("./canonical.js");
+const evidence_js_1 = require("./evidence.js");
+function makeNode(type, refId, data) {
+    return {
+        id: (0, canonical_js_1.computeNodeId)(type, refId),
+        type,
+        refId,
+        ...(data !== undefined ? { data } : {}),
+        createdAt: Date.now(),
+    };
+}
+function makeEdge(type, from, to, proofId, data) {
+    return {
+        id: (0, canonical_js_1.computeEdgeId)(type, from, to, proofId, data),
+        type,
+        from,
+        to,
+        ...(proofId !== undefined ? { proofId } : {}),
+        ...(data !== undefined ? { data } : {}),
+    };
+}
+function mergeNodes(existing, incoming) {
+    const byId = new Map(existing.map((n) => [n.id, n]));
+    for (const node of incoming) {
+        if (!byId.has(node.id)) {
+            byId.set(node.id, node);
+        }
+    }
+    return Array.from(byId.values());
+}
+function mergeEdges(existing, incoming) {
+    const byId = new Map(existing.map((e) => [e.id, e]));
+    for (const edge of incoming) {
+        if (!byId.has(edge.id)) {
+            byId.set(edge.id, edge);
+        }
+    }
+    return Array.from(byId.values());
+}
+function rebuild(graph, newNodes, newEdges) {
+    const nodes = mergeNodes(graph.nodes, newNodes);
+    const edges = mergeEdges(graph.edges, newEdges);
+    return {
+        ...graph,
+        nodes,
+        edges,
+        graphId: (0, canonical_js_1.computeProofGraphId)(nodes, edges),
+    };
+}
+/**
+ * Create an empty ProofGraph.
+ */
+function createProofGraph(metadata) {
+    const nodes = [];
+    const edges = [];
+    return {
+        graphId: (0, canonical_js_1.computeProofGraphId)(nodes, edges),
+        nodes,
+        edges,
+        createdAt: Date.now(),
+        ...(metadata !== undefined ? { metadata } : {}),
+    };
+}
+/**
+ * Attach or replace mutable metadata. Does NOT affect graphId.
+ */
+function setGraphMetadata(graph, metadata) {
+    return { ...graph, metadata };
+}
+/**
+ * Build a ProofGraphEdge with a deterministic ID from its fields.
+ * Convenience helper so callers don't need to import computeEdgeId.
+ */
+function buildEdge(type, from, to, proofId, data) {
+    return makeEdge(type, from, to, proofId, data);
+}
+/**
+ * Add a node directly (type + refId pair). Idempotent — skipped if the node already exists.
+ */
+function addNode(graph, type, refId, data) {
+    return rebuild(graph, [makeNode(type, refId, data)], []);
+}
+/**
+ * Append a ProofGraphEdge and recompute graphId. Idempotent by edge ID.
+ * Spec API: addEdge(graph, edge). Use buildEdge() to construct the edge object.
+ */
+function addEdge(graph, edge) {
+    const edges = mergeEdges(graph.edges, [edge]);
+    return {
+        ...graph,
+        edges,
+        graphId: (0, canonical_js_1.computeProofGraphId)(graph.nodes, edges),
+    };
+}
+/**
+ * Index a TotemIdentityDocument into the graph.
+ * Creates an 'identity' node with refId = doc.id.
+ */
+function addIdentityDocument(graph, doc) {
+    return rebuild(graph, [makeNode('identity', doc.id, { ...doc })], []);
+}
+/**
+ * Index a SignedProof into the graph.
+ *
+ * Nodes created:
+ *   proof      — proofId (stores the full SignedProof in .data)
+ *   identity   — signature.address (issuer key address)
+ *   subject    — proof.subject.id
+ *   evidence   — ev.id (one per evidence ref)
+ *   anchor     — anchor.hash (if present)
+ *
+ * Edges created (all referencing the proofId):
+ *   proves      proof → subject
+ *   issued_by   proof → identity (signer)
+ *   about       proof → subject
+ *   references  proof → evidence (one per evidence ref, in array order)
+ *   anchored_to proof → anchor (if present)
+ */
+function addProof(graph, signedProof) {
+    const proofNode = makeNode('proof', signedProof.proofId, {
+        ...signedProof,
+    });
+    const identityNode = makeNode('identity', signedProof.signature.address);
+    const subjectNode = makeNode('subject', signedProof.subject.id);
+    const newNodes = [proofNode, identityNode, subjectNode];
+    const newEdges = [
+        makeEdge('proves', signedProof.proofId, signedProof.subject.id, signedProof.proofId),
+        makeEdge('issued_by', signedProof.proofId, signedProof.signature.address, signedProof.proofId),
+        makeEdge('about', signedProof.proofId, signedProof.subject.id, signedProof.proofId),
+    ];
+    if (signedProof.evidence) {
+        for (const ev of signedProof.evidence) {
+            // RFC-007 Amendment A (A3): carry the claim commitment on the evidence
+            // node so the evidence store can enforce claim→contentHash→artifact.
+            newNodes.push(makeNode('evidence', ev.id, ev.hash ? { contentHash: (0, evidence_js_1.normalizeEvidenceHash)(ev.hash) } : undefined));
+            newEdges.push(makeEdge('references', signedProof.proofId, ev.id, signedProof.proofId));
+        }
+    }
+    if (signedProof.anchor) {
+        newNodes.push(makeNode('anchor', signedProof.anchor.hash));
+        newEdges.push(makeEdge('anchored_to', signedProof.proofId, signedProof.anchor.hash, signedProof.proofId));
+    }
+    return rebuild(graph, newNodes, newEdges);
+}
+/**
+ * Index a SignedIdentityClaim into the graph.
+ *
+ * Nodes created:
+ *   identity-claim — claim.id (stores the full signed claim in .data)
+ *   address        — issuer address
+ *   address/identity — target address (for delegates_to / rotates_to / revokes)
+ *
+ * Edges created based on claim.type:
+ *   all types    → issued_by  (claim-node → issuer address)
+ *   delegates_to → delegates_to edge (claim-node → delegated address)
+ *   revokes      → revokes edge      (claim-node → subject identity)
+ *   rotates_to   → controls edge     (claim-node → new address)
+ */
+function addIdentityClaim(graph, signedClaim) {
+    const { claim } = signedClaim;
+    const claimNode = makeNode('identity-claim', claim.id, {
+        ...signedClaim,
+    });
+    const issuerNode = makeNode('address', claim.issuer);
+    const newNodes = [claimNode, issuerNode];
+    const newEdges = [
+        makeEdge('issued_by', claim.id, claim.issuer),
+    ];
+    if (claim.type === 'delegates_to') {
+        newNodes.push(makeNode('address', claim.object));
+        newEdges.push(makeEdge('delegates_to', claim.id, claim.object));
+    }
+    else if (claim.type === 'revokes') {
+        newNodes.push(makeNode('identity', claim.subject));
+        newEdges.push(makeEdge('revokes', claim.id, claim.subject));
+    }
+    else if (claim.type === 'rotates_to') {
+        newNodes.push(makeNode('address', claim.object));
+        newEdges.push(makeEdge('controls', claim.id, claim.object));
+    }
+    return rebuild(graph, newNodes, newEdges);
+}
+/**
+ * Resolve the author address from a manifest based on its type.
+ * AppManifest / DAppManifest → authorAddress
+ * CapabilityManifest         → agentAddress
+ * EdgeServiceManifest        → operatorAddress
+ * Falls back to signedManifest.authorAddress if the manifest type is unknown.
+ */
+function resolveManifestAddress(signedManifest) {
+    const m = signedManifest.manifest;
+    if (m['type'] === 'capability' && typeof m['agentAddress'] === 'string') {
+        return m['agentAddress'];
+    }
+    if (m['type'] === 'edge-service' && typeof m['operatorAddress'] === 'string') {
+        return m['operatorAddress'];
+    }
+    if (typeof m['authorAddress'] === 'string') {
+        return m['authorAddress'];
+    }
+    return signedManifest.authorAddress;
+}
+/**
+ * Index a SignedManifest into the graph.
+ *
+ * Nodes created:
+ *   manifest — computed manifest ID (stores manifest content in .data)
+ *   address  — resolved author/agent/operator address
+ *
+ * Edge created:
+ *   manifests_as  manifest → address
+ */
+function addManifest(graph, signedManifest) {
+    const manifestId = (0, manifest_1.computeManifestId)(signedManifest.manifest);
+    const address = resolveManifestAddress(signedManifest);
+    const manifestNode = makeNode('manifest', manifestId, {
+        ...signedManifest,
+    });
+    const addressNode = makeNode('address', address);
+    return rebuild(graph, [manifestNode, addressNode], [
+        makeEdge('manifests_as', manifestId, address),
+    ]);
+}
+/**
+ * Add a signed manifest **revision** without collapsing other revisions.
+ *
+ * Creates:
+ *   manifest (logical)   refId = manifestId
+ *   manifest (revision)  refId = manifestEnvelopeId, data = { manifestId, manifestEnvelopeId, signedManifest }
+ *   address              resolved author/operator address
+ *   manifests_as         manifestId → address
+ *   revision_of          manifestEnvelopeId → manifestId
+ */
+function addManifestRevision(graph, signedManifest) {
+    const manifestId = (0, manifest_1.computeManifestId)(signedManifest.manifest);
+    const manifestEnvelopeId = (0, manifest_1.computeManifestEnvelopeId)(signedManifest);
+    const address = resolveManifestAddress(signedManifest);
+    const logicalNode = makeNode('manifest', manifestId, { manifestId });
+    const revisionNode = makeNode('manifest', manifestEnvelopeId, {
+        manifestId,
+        manifestEnvelopeId,
+        signedManifest,
+    });
+    const addressNode = makeNode('address', address);
+    return rebuild(graph, [logicalNode, revisionNode, addressNode], [
+        makeEdge('manifests_as', manifestId, address),
+        makeEdge('revision_of', manifestEnvelopeId, manifestId),
+    ]);
+}
+/**
+ * Add a receipt-like node (payment, subscription, claim receipt) to the graph.
+ * If receipt.proofId is set, adds a 'supports' edge from the receipt to that proof.
+ */
+function addReceiptLike(graph, receipt) {
+    const { id, data, proofId } = receipt;
+    const receiptNode = makeNode('receipt', id, data);
+    const newEdges = [];
+    if (proofId !== undefined) {
+        newEdges.push(makeEdge('supports', id, proofId, proofId));
+    }
+    return rebuild(graph, [receiptNode], newEdges);
+}
+/**
+ * Add a standalone anchor node. If anchor.proofId is set, adds an 'anchored_to'
+ * edge from the proof to this anchor.
+ */
+function addAnchor(graph, anchor) {
+    const { hash, proofId, ...rest } = anchor;
+    const nodeData = { ...rest };
+    const anchorNode = makeNode('anchor', hash, Object.keys(nodeData).length > 0 ? nodeData : undefined);
+    const newEdges = [];
+    if (proofId !== undefined) {
+        newEdges.push(makeEdge('anchored_to', proofId, hash, proofId));
+    }
+    return rebuild(graph, [anchorNode], newEdges);
+}

package/dist/cjs/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @module @totemsdk/proofgraph
+ *
+ * Local deterministic proof relationship graph for Totem Edge.
+ *
+ * Indexes SignedProofs, SignedIdentityClaims, SignedManifests, identity
+ * documents, and custom evidence nodes into an immutable, queryable DAG
+ * keyed by a content-derived graphId. Pure package — no network, no DHT,
+ * no blockchain submission, no crypto reimplementation.
+ *
+ * Usage:
+ *   const g0 = createProofGraph();
+ *   const g1 = addProof(g0, signedProof);
+ *   const result = verifyProofGraph(g1);
+ */
+export type { ProofGraphNodeType, ProofGraphEdgeType, ProofGraphNode, ProofGraphEdge, ProofGraph, ProofGraphVerifyResult, ProofGraphStoragePort, ReceiptLikeInput, AnchorInput, } from './types.js';
+export { createDurableProofGraphStore, } from './durable-store.js';
+export type { DurableProofGraphStore, DurableProofGraphStoreOptions, ProofGraphRecoveryReport, } from './durable-store.js';
+export { createProofGraphEvidenceStore, assertEvidenceBinding, normalizeEvidenceHash, } from './evidence.js';
+export type { ProofGraphEvidenceStore, ProofGraphEvidenceStoreOptions, ProofGraphEvidenceResult, EvidenceArtifactBinding, PutEvidenceOptions, } from './evidence.js';
+export { toHex, canonicalJson, computeNodeId, computeEdgeId, computeProofGraphId, recomputeGraphId, } from './canonical.js';
+export { createProofGraph, setGraphMetadata, buildEdge, addNode, addEdge, addIdentityDocument, addProof, addIdentityClaim, addManifest, addManifestRevision, addReceiptLike, addAnchor, } from './graph.js';
+export { findNode, getEdgesFrom, getEdgesTo, getEdgesByType, getProofNodes, findProofsBySubject, findProofsByIssuer, findAnchorsForProof, findRevocations, findSupersessions, findConflicts, getEvidenceTrail, getProofLineage, resolveCurrentProofSet, getManifestRevisions, getManifestsForAddress, getEdgesBetween, reachableFrom, } from './query.js';
+export { verifyProofGraph, verifyGraphProofs, } from './verify.js';
+export { exportProofGraph, importProofGraph, } from './io.js';
+export * from './replicated-evidence.js';