@totemsdk/proofgraph 1.0.1 → 1.1.0

package/dist/cjs/replicated-evidence.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * RFC-057 Phase 4 — replicated proofgraph evidence adapter.
+ *
+ * Keeps the authoritative proofgraph evidence store local while allowing a
+ * replicated index to locate the same digest-verified artifacts on other
+ * peers. The replicated index is never trusted for bytes: every read
+ * re-verifies the artifact digest.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createReplicatedProofGraphEvidenceStore = createReplicatedProofGraphEvidenceStore;
+const core_1 = require("@totemsdk/core");
+const errors_1 = require("@totemsdk/storage/errors");
+const KEY_PREFIX = 'proofgraph:evidence:';
+const DEFAULT_NAMESPACE = 'totem-proofgraph-evidence';
+function normalizeHash(value) {
+    return value.replace(/^0x/i, '').toLowerCase();
+}
+function evidenceNodes(graph) {
+    return graph.nodes.filter((node) => node.type === 'evidence');
+}
+function contentHashOf(node) {
+    const value = node.data?.contentHash;
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function createReplicatedProofGraphEvidenceStore(options) {
+    if (!options.artifacts.capabilities.writable) {
+        throw new Error('replicated evidence store requires a writable artifact store');
+    }
+    const namespace = options.namespace ?? DEFAULT_NAMESPACE;
+    const key = (nodeId) => `${KEY_PREFIX}${nodeId}`;
+    return {
+        async putEvidence(graph, bytesFor) {
+            const refs = [];
+            for (const node of evidenceNodes(graph)) {
+                const bytes = bytesFor(node.id);
+                if (!bytes)
+                    continue;
+                const digest = (0, core_1.toHex)((0, core_1.sha3_256)(bytes));
+                const contentHash = contentHashOf(node);
+                if (contentHash && normalizeHash(contentHash) !== digest) {
+                    throw new errors_1.StorageError(`evidence commitment mismatch for node "${node.id}"`, 'corrupt', {
+                        key: key(node.id),
+                    });
+                }
+                const receipt = await options.artifacts.put(namespace, bytes);
+                if (contentHash && normalizeHash(contentHash) !== receipt.ref.digest) {
+                    throw new errors_1.StorageError(`artifact digest mismatch for node "${node.id}"`, 'corrupt', {
+                        key: key(node.id),
+                    });
+                }
+                await options.index.put(key(node.id), {
+                    nodeId: node.id,
+                    ref: receipt.ref,
+                    contentHash: contentHash ?? receipt.ref.digest,
+                    storedAt: Date.now(),
+                });
+                refs.push(receipt.ref);
+            }
+            return refs;
+        },
+        async getEvidence(nodeId) {
+            const raw = await options.index.get(key(nodeId));
+            if (!raw)
+                return { nodeId, status: 'not-found' };
+            const entry = raw;
+            const read = await options.artifacts.get(entry.ref);
+            if (read.status !== 'ok' || !read.bytes) {
+                return {
+                    nodeId,
+                    status: read.status,
+                    ref: entry.ref,
+                    ...(read.message ? { message: read.message } : {}),
+                };
+            }
+            const digest = (0, core_1.toHex)((0, core_1.sha3_256)(read.bytes));
+            if (normalizeHash(entry.contentHash) !== digest) {
+                return {
+                    nodeId,
+                    status: 'corrupt',
+                    ref: entry.ref,
+                    message: `evidence digest mismatch: ${digest} !== ${entry.contentHash}`,
+                };
+            }
+            return { nodeId, status: 'ok', ref: entry.ref, bytes: read.bytes };
+        },
+        async verifyEvidence(nodeId) {
+            return (await this.getEvidence(nodeId)).status === 'ok';
+        },
+        async *listEvidence() {
+            if (!options.index.list)
+                return;
+            for await (const entry of options.index.list(KEY_PREFIX)) {
+                yield entry.value;
+            }
+        },
+    };
+}

package/dist/cjs/types.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @totemsdk/proofgraph — Type definitions
+ *
+ * Pure schema — no network, no DHT, no blockchain submission, no crypto.
+ */
+export type ProofGraphNodeType = 'proof' | 'identity' | 'identity-claim' | 'manifest' | 'address' | 'subject' | 'evidence' | 'anchor' | 'receipt' | 'payment' | 'device' | 'service' | 'policy' | 'custom';
+export type ProofGraphEdgeType = 'proves' | 'issued_by' | 'signed_by' | 'about' | 'references' | 'derived_from' | 'supports' | 'contradicts' | 'supersedes' | 'revokes' | 'anchored_to' | 'delegates_to' | 'controls' | 'depends_on' | 'manifests_as' | 'revision_of' | 'conflicts_with';
+export interface ProofGraphNode {
+    id: string;
+    type: ProofGraphNodeType;
+    refId: string;
+    data?: Record<string, unknown>;
+    createdAt: number;
+}
+export interface ProofGraphEdge {
+    id: string;
+    type: ProofGraphEdgeType;
+    from: string;
+    to: string;
+    proofId?: string;
+    data?: Record<string, unknown>;
+}
+export interface ProofGraph {
+    graphId: string;
+    nodes: ProofGraphNode[];
+    edges: ProofGraphEdge[];
+    createdAt: number;
+    metadata?: Record<string, unknown>;
+}
+export interface ProofGraphVerifyResult {
+    valid: boolean;
+    invalidProofs: string[];
+    reason?: string;
+}
+/**
+ * Input object for addReceiptLike.
+ */
+export interface ReceiptLikeInput {
+    id: string;
+    data?: Record<string, unknown>;
+    proofId?: string;
+}
+/**
+ * Input object for addAnchor.
+ */
+export interface AnchorInput {
+    hash: string;
+    provider?: string;
+    txId?: string;
+    confirmedAt?: number;
+    metadata?: Record<string, unknown>;
+    proofId?: string;
+}
+/**
+ * Storage port — interface only, no concrete implementation in this package.
+ * Adapters (SQLite, LevelDB, in-memory) live in consumer packages.
+ */
+export interface ProofGraphStoragePort {
+    save(graph: ProofGraph): Promise<void>;
+    load(graphId: string): Promise<ProofGraph | null>;
+    findByNodeId(id: string): Promise<ProofGraph | null>;
+}

package/dist/cjs/types.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * @totemsdk/proofgraph — Type definitions
+ *
+ * Pure schema — no network, no DHT, no blockchain submission, no crypto.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/verify.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Graph-level verification.
+ *
+ * verifyProofGraph: iterates proof nodes, recovers SignedProof from node.data,
+ * and delegates to @totemsdk/proof's verifyProof for each one.
+ * Never reimplements cryptography.
+ *
+ * verifyGraphProofs: same logic, returns the list of invalid proof IDs (string[]).
+ */
+import type { ProofGraph, ProofGraphVerifyResult } from './types.js';
+/**
+ * Verify every proof node stored in the graph.
+ *
+ * Iterates nodes of type 'proof', casts node.data back to SignedProof,
+ * and calls proofModule.verifyProof() from @totemsdk/proof.
+ * Returns { valid: true } if ALL proofs pass; otherwise lists the failing proofIds.
+ */
+export declare function verifyProofGraph(graph: ProofGraph, _options?: Record<string, unknown>): ProofGraphVerifyResult;
+/**
+ * Returns the list of invalid proof IDs in the graph.
+ * Equivalent to verifyProofGraph(graph).invalidProofs.
+ */
+export declare function verifyGraphProofs(graph: ProofGraph): string[];

package/dist/cjs/verify.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Graph-level verification.
+ *
+ * verifyProofGraph: iterates proof nodes, recovers SignedProof from node.data,
+ * and delegates to @totemsdk/proof's verifyProof for each one.
+ * Never reimplements cryptography.
+ *
+ * verifyGraphProofs: same logic, returns the list of invalid proof IDs (string[]).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyProofGraph = verifyProofGraph;
+exports.verifyGraphProofs = verifyGraphProofs;
+const proofModule = __importStar(require("@totemsdk/proof"));
+/**
+ * Verify every proof node stored in the graph.
+ *
+ * Iterates nodes of type 'proof', casts node.data back to SignedProof,
+ * and calls proofModule.verifyProof() from @totemsdk/proof.
+ * Returns { valid: true } if ALL proofs pass; otherwise lists the failing proofIds.
+ */
+function verifyProofGraph(graph, _options) {
+    const invalidProofs = [];
+    for (const node of graph.nodes) {
+        if (node.type !== 'proof' || !node.data)
+            continue;
+        const signedProof = node.data;
+        const result = proofModule.verifyProof(signedProof);
+        if (!result.valid) {
+            invalidProofs.push(node.refId);
+        }
+    }
+    return {
+        valid: invalidProofs.length === 0,
+        invalidProofs,
+    };
+}
+/**
+ * Returns the list of invalid proof IDs in the graph.
+ * Equivalent to verifyProofGraph(graph).invalidProofs.
+ */
+function verifyGraphProofs(graph) {
+    return verifyProofGraph(graph).invalidProofs;
+}

package/dist/durable-store.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Durable `ProofGraphStoragePort` adapter for @totemsdk/proofgraph.
  *
@@ -16,11 +15,9 @@
  * recomputes the graphId — a tampered or truncated record surfaces as
  * `StorageError` `corrupt`, never as `not-found` (RFC-007 §4.2 strict).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createDurableProofGraphStore = createDurableProofGraphStore;
-const types_1 = require("@totemsdk/storage/types");
-const errors_1 = require("@totemsdk/storage/errors");
-const io_js_1 = require("./io.js");
+import { assertCapabilities } from '@totemsdk/storage/types';
+import { StorageError } from '@totemsdk/storage/errors';
+import { exportProofGraph, importProofGraph } from './io.js';
 const DEFAULT_NAMESPACE = 'totem_proofgraph:v1:';
 const GRAPH_PREFIX = 'graph:';
 const NODE_PREFIX = 'node:';
@@ -45,10 +42,10 @@ function isCasStore(adapter) {
  * so concurrent saves never clobber a newer graph. A non-CAS or low-durability
  * adapter is rejected at construction (RFC-007 §4.2 no-silent-downgrade).
  */
-function createDurableProofGraphStore(adapter, options = {}) {
+export function createDurableProofGraphStore(adapter, options = {}) {
     const namespace = options.namespace ?? DEFAULT_NAMESPACE;
     if (typeof adapter.capabilities === 'object') {
-        (0, types_1.assertCapabilities)(adapter, {
+        assertCapabilities(adapter, {
             acknowledge: options.requireAckMode ?? 'durably-acknowledged',
             atomic: true,
             conditional: true,
@@ -70,14 +67,14 @@ function createDurableProofGraphStore(adapter, options = {}) {
     };
     function parseGraph(graphId, raw) {
         if (typeof raw !== 'string' && (typeof raw !== 'object' || raw === null || typeof raw.json !== 'string')) {
-            throw new errors_1.StorageError(`proofgraph record "${graphId}" is malformed`, 'corrupt', { key: graphKey(graphId) });
+            throw new StorageError(`proofgraph record "${graphId}" is malformed`, 'corrupt', { key: graphKey(graphId) });
         }
         const json = typeof raw === 'string' ? raw : raw.json;
         try {
-            return (0, io_js_1.importProofGraph)(json);
+            return importProofGraph(json);
         }
         catch (err) {
-            throw new errors_1.StorageError(`proofgraph record "${graphId}" failed validation: ${err.message}`, 'corrupt', { key: graphKey(graphId), cause: err });
+            throw new StorageError(`proofgraph record "${graphId}" failed validation: ${err.message}`, 'corrupt', { key: graphKey(graphId), cause: err });
         }
     }
     async function loadUnchecked(graphId) {
@@ -104,7 +101,7 @@ function createDurableProofGraphStore(adapter, options = {}) {
             const savedAt = nextSavedAt();
             return withStorageLock(adapter, async () => {
                 // Immutable content-addressed record first (idempotent, safe on retry).
-                const record = { json: (0, io_js_1.exportProofGraph)(graph), savedAt };
+                const record = { json: exportProofGraph(graph), savedAt };
                 await adapter.set(graphKey(graph.graphId), record);
                 // Reverse index: most-recent snapshot wins (CAS, never clobbers newer).
                 for (const node of graph.nodes) {

package/dist/evidence.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Durable evidence-chain owner for @totemsdk/proofgraph (RFC-007 G8 / §4.3).
  *
@@ -12,21 +11,17 @@
  * `not-found` (bytes absent); `unavailable` (backend unreachable, or the
  * backend deleted a blob the local index still references) is also surfaced.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeEvidenceHash = normalizeEvidenceHash;
-exports.assertEvidenceBinding = assertEvidenceBinding;
-exports.createProofGraphEvidenceStore = createProofGraphEvidenceStore;
-const errors_1 = require("@totemsdk/storage/errors");
-const core_1 = require("@totemsdk/core");
+import { StorageError } from '@totemsdk/storage/errors';
+import { sha3_256, toHex } from '@totemsdk/core';
 const DEFAULT_NS = 'totem-proofgraph-evidence';
 const INDEX_PREFIX = 'totem_proofgraph_evidence:v1:';
-function normalizeEvidenceHash(hash) {
+export function normalizeEvidenceHash(hash) {
     return hash.replace(/^0x/i, '').toLowerCase();
 }
 /** Throws `StorageError('corrupt')` unless `contentHash === artifact.digest`. */
-function assertEvidenceBinding(binding) {
+export function assertEvidenceBinding(binding) {
     if (normalizeEvidenceHash(binding.contentHash) !== normalizeEvidenceHash(binding.artifact.digest)) {
-        throw new errors_1.StorageError(`evidence binding mismatch for node "${binding.nodeId}": contentHash ${binding.contentHash} !== artifact.digest ${binding.artifact.digest}`, 'corrupt', { key: binding.nodeId });
+        throw new StorageError(`evidence binding mismatch for node "${binding.nodeId}": contentHash ${binding.contentHash} !== artifact.digest ${binding.artifact.digest}`, 'corrupt', { key: binding.nodeId });
     }
 }
 function evidenceNodeIds(graph) {
@@ -37,7 +32,7 @@ function nodeContentHash(graph, nodeId) {
     const value = graph.nodes.find((node) => node.id === nodeId)?.data?.contentHash;
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
-function createProofGraphEvidenceStore(artifacts, index, options = {}) {
+export function createProofGraphEvidenceStore(artifacts, index, options = {}) {
     if (!artifacts.capabilities.writable) {
         throw new Error('createProofGraphEvidenceStore requires a writable artifact store');
     }
@@ -53,15 +48,15 @@ function createProofGraphEvidenceStore(artifacts, index, options = {}) {
                     continue;
                 const contentHash = options.contentHashFor?.(nodeId) ?? nodeContentHash(graph, nodeId);
                 if (!contentHash && options.requireContentHash) {
-                    throw new errors_1.StorageError(`evidence commitment missing for node "${nodeId}"`, 'corrupt', { key: indexKey(nodeId) });
+                    throw new StorageError(`evidence commitment missing for node "${nodeId}"`, 'corrupt', { key: indexKey(nodeId) });
                 }
                 // Byte-identity invariant: the stored bytes must hash to the commitment.
-                const digest = (0, core_1.toHex)((0, core_1.sha3_256)(bytes));
+                const digest = toHex(sha3_256(bytes));
                 if (contentHash && normalizeEvidenceHash(contentHash) !== digest) {
-                    throw new errors_1.StorageError(`evidence commitment mismatch for node "${nodeId}": sha3(bytes) ${digest} !== contentHash ${contentHash}`, 'corrupt', { key: indexKey(nodeId) });
+                    throw new StorageError(`evidence commitment mismatch for node "${nodeId}": sha3(bytes) ${digest} !== contentHash ${contentHash}`, 'corrupt', { key: indexKey(nodeId) });
                 }
                 const receipt = await artifacts.put(namespace, bytes).catch((err) => {
-                    throw new errors_1.StorageError(`evidence put failed for node "${nodeId}": ${err.message}`, 'write-failed', { key: indexKey(nodeId), cause: err });
+                    throw new StorageError(`evidence put failed for node "${nodeId}": ${err.message}`, 'write-failed', { key: indexKey(nodeId), cause: err });
                 });
                 if (contentHash) {
                     // The artifact must address exactly the committed hash.
@@ -79,9 +74,9 @@ function createProofGraphEvidenceStore(artifacts, index, options = {}) {
         async restoreEvidence(graph) {
             const results = [];
             const fail = (err) => {
-                if (err instanceof errors_1.StorageError)
+                if (err instanceof StorageError)
                     throw err;
-                throw new errors_1.StorageError(`evidence read failed: ${err.message}`, 'unavailable', { cause: err });
+                throw new StorageError(`evidence read failed: ${err.message}`, 'unavailable', { cause: err });
             };
             for (const nodeId of evidenceNodeIds(graph)) {
                 const entry = await index.get(indexKey(nodeId));
@@ -101,13 +96,13 @@ function createProofGraphEvidenceStore(artifacts, index, options = {}) {
                         break;
                     case 'corrupt':
                         if (strict) {
-                            throw new errors_1.StorageError(`evidence artifact corrupt for node "${nodeId}": ${read.message ?? 'digest mismatch'}`, 'corrupt', { key: indexKey(nodeId) });
+                            throw new StorageError(`evidence artifact corrupt for node "${nodeId}": ${read.message ?? 'digest mismatch'}`, 'corrupt', { key: indexKey(nodeId) });
                         }
                         results.push({ nodeId, status: 'corrupt', ref, message: read.message ?? 'digest mismatch' });
                         break;
                     case 'unavailable':
                         if (strict) {
-                            throw new errors_1.StorageError(`evidence artifact unavailable for node "${nodeId}": ${read.message ?? 'backend unavailable'}`, 'unavailable', { key: indexKey(nodeId) });
+                            throw new StorageError(`evidence artifact unavailable for node "${nodeId}": ${read.message ?? 'backend unavailable'}`, 'unavailable', { key: indexKey(nodeId) });
                         }
                         results.push({ nodeId, status: 'unavailable', ref, message: read.message ?? 'backend unavailable' });
                         break;

package/dist/graph.d.ts

@@ -80,6 +80,17 @@ export declare function addIdentityClaim(graph: ProofGraph, signedClaim: SignedI
  *   manifests_as  manifest → address
  */
 export declare function addManifest(graph: ProofGraph, signedManifest: SignedManifest): ProofGraph;
+/**
+ * Add a signed manifest **revision** without collapsing other revisions.
+ *
+ * Creates:
+ *   manifest (logical)   refId = manifestId
+ *   manifest (revision)  refId = manifestEnvelopeId, data = { manifestId, manifestEnvelopeId, signedManifest }
+ *   address              resolved author/operator address
+ *   manifests_as         manifestId → address
+ *   revision_of          manifestEnvelopeId → manifestId
+ */
+export declare function addManifestRevision(graph: ProofGraph, signedManifest: SignedManifest): ProofGraph;
 /**
  * Add a receipt-like node (payment, subscription, claim receipt) to the graph.
  * If receipt.proofId is set, adds a 'supports' edge from the receipt to that proof.

package/dist/graph.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Proof graph mutation functions — all pure, all returning NEW graphs.
  *
@@ -6,24 +5,12 @@
  * recomputed graphId. Nodes and edges are deduplicated by ID so adding the
  * same proof twice is idempotent.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createProofGraph = createProofGraph;
-exports.setGraphMetadata = setGraphMetadata;
-exports.buildEdge = buildEdge;
-exports.addNode = addNode;
-exports.addEdge = addEdge;
-exports.addIdentityDocument = addIdentityDocument;
-exports.addProof = addProof;
-exports.addIdentityClaim = addIdentityClaim;
-exports.addManifest = addManifest;
-exports.addReceiptLike = addReceiptLike;
-exports.addAnchor = addAnchor;
-const manifest_1 = require("@totemsdk/manifest");
-const canonical_js_1 = require("./canonical.js");
-const evidence_js_1 = require("./evidence.js");
+import { computeManifestId, computeManifestEnvelopeId } from '@totemsdk/manifest';
+import { computeNodeId, computeEdgeId, computeProofGraphId } from './canonical.js';
+import { normalizeEvidenceHash } from './evidence.js';
 function makeNode(type, refId, data) {
     return {
-        id: (0, canonical_js_1.computeNodeId)(type, refId),
+        id: computeNodeId(type, refId),
         type,
         refId,
         ...(data !== undefined ? { data } : {}),
@@ -32,7 +19,7 @@ function makeNode(type, refId, data) {
 }
 function makeEdge(type, from, to, proofId, data) {
     return {
-        id: (0, canonical_js_1.computeEdgeId)(type, from, to, proofId, data),
+        id: computeEdgeId(type, from, to, proofId, data),
         type,
         from,
         to,
@@ -65,17 +52,17 @@ function rebuild(graph, newNodes, newEdges) {
         ...graph,
         nodes,
         edges,
-        graphId: (0, canonical_js_1.computeProofGraphId)(nodes, edges),
+        graphId: computeProofGraphId(nodes, edges),
     };
 }
 /**
  * Create an empty ProofGraph.
  */
-function createProofGraph(metadata) {
+export function createProofGraph(metadata) {
     const nodes = [];
     const edges = [];
     return {
-        graphId: (0, canonical_js_1.computeProofGraphId)(nodes, edges),
+        graphId: computeProofGraphId(nodes, edges),
         nodes,
         edges,
         createdAt: Date.now(),
@@ -85,39 +72,39 @@ function createProofGraph(metadata) {
 /**
  * Attach or replace mutable metadata. Does NOT affect graphId.
  */
-function setGraphMetadata(graph, metadata) {
+export function setGraphMetadata(graph, metadata) {
     return { ...graph, metadata };
 }
 /**
  * Build a ProofGraphEdge with a deterministic ID from its fields.
  * Convenience helper so callers don't need to import computeEdgeId.
  */
-function buildEdge(type, from, to, proofId, data) {
+export function buildEdge(type, from, to, proofId, data) {
     return makeEdge(type, from, to, proofId, data);
 }
 /**
  * Add a node directly (type + refId pair). Idempotent — skipped if the node already exists.
  */
-function addNode(graph, type, refId, data) {
+export function addNode(graph, type, refId, data) {
     return rebuild(graph, [makeNode(type, refId, data)], []);
 }
 /**
  * Append a ProofGraphEdge and recompute graphId. Idempotent by edge ID.
  * Spec API: addEdge(graph, edge). Use buildEdge() to construct the edge object.
  */
-function addEdge(graph, edge) {
+export function addEdge(graph, edge) {
     const edges = mergeEdges(graph.edges, [edge]);
     return {
         ...graph,
         edges,
-        graphId: (0, canonical_js_1.computeProofGraphId)(graph.nodes, edges),
+        graphId: computeProofGraphId(graph.nodes, edges),
     };
 }
 /**
  * Index a TotemIdentityDocument into the graph.
  * Creates an 'identity' node with refId = doc.id.
  */
-function addIdentityDocument(graph, doc) {
+export function addIdentityDocument(graph, doc) {
     return rebuild(graph, [makeNode('identity', doc.id, { ...doc })], []);
 }
 /**
@@ -137,7 +124,7 @@ function addIdentityDocument(graph, doc) {
  *   references  proof → evidence (one per evidence ref, in array order)
  *   anchored_to proof → anchor (if present)
  */
-function addProof(graph, signedProof) {
+export function addProof(graph, signedProof) {
     const proofNode = makeNode('proof', signedProof.proofId, {
         ...signedProof,
     });
@@ -153,7 +140,7 @@ function addProof(graph, signedProof) {
         for (const ev of signedProof.evidence) {
             // RFC-007 Amendment A (A3): carry the claim commitment on the evidence
             // node so the evidence store can enforce claim→contentHash→artifact.
-            newNodes.push(makeNode('evidence', ev.id, ev.hash ? { contentHash: (0, evidence_js_1.normalizeEvidenceHash)(ev.hash) } : undefined));
+            newNodes.push(makeNode('evidence', ev.id, ev.hash ? { contentHash: normalizeEvidenceHash(ev.hash) } : undefined));
             newEdges.push(makeEdge('references', signedProof.proofId, ev.id, signedProof.proofId));
         }
     }
@@ -177,7 +164,7 @@ function addProof(graph, signedProof) {
  *   revokes      → revokes edge      (claim-node → subject identity)
  *   rotates_to   → controls edge     (claim-node → new address)
  */
-function addIdentityClaim(graph, signedClaim) {
+export function addIdentityClaim(graph, signedClaim) {
     const { claim } = signedClaim;
     const claimNode = makeNode('identity-claim', claim.id, {
         ...signedClaim,
@@ -231,8 +218,8 @@ function resolveManifestAddress(signedManifest) {
  * Edge created:
  *   manifests_as  manifest → address
  */
-function addManifest(graph, signedManifest) {
-    const manifestId = (0, manifest_1.computeManifestId)(signedManifest.manifest);
+export function addManifest(graph, signedManifest) {
+    const manifestId = computeManifestId(signedManifest.manifest);
     const address = resolveManifestAddress(signedManifest);
     const manifestNode = makeNode('manifest', manifestId, {
         ...signedManifest,
@@ -242,11 +229,37 @@ function addManifest(graph, signedManifest) {
         makeEdge('manifests_as', manifestId, address),
     ]);
 }
+/**
+ * Add a signed manifest **revision** without collapsing other revisions.
+ *
+ * Creates:
+ *   manifest (logical)   refId = manifestId
+ *   manifest (revision)  refId = manifestEnvelopeId, data = { manifestId, manifestEnvelopeId, signedManifest }
+ *   address              resolved author/operator address
+ *   manifests_as         manifestId → address
+ *   revision_of          manifestEnvelopeId → manifestId
+ */
+export function addManifestRevision(graph, signedManifest) {
+    const manifestId = computeManifestId(signedManifest.manifest);
+    const manifestEnvelopeId = computeManifestEnvelopeId(signedManifest);
+    const address = resolveManifestAddress(signedManifest);
+    const logicalNode = makeNode('manifest', manifestId, { manifestId });
+    const revisionNode = makeNode('manifest', manifestEnvelopeId, {
+        manifestId,
+        manifestEnvelopeId,
+        signedManifest,
+    });
+    const addressNode = makeNode('address', address);
+    return rebuild(graph, [logicalNode, revisionNode, addressNode], [
+        makeEdge('manifests_as', manifestId, address),
+        makeEdge('revision_of', manifestEnvelopeId, manifestId),
+    ]);
+}
 /**
  * Add a receipt-like node (payment, subscription, claim receipt) to the graph.
  * If receipt.proofId is set, adds a 'supports' edge from the receipt to that proof.
  */
-function addReceiptLike(graph, receipt) {
+export function addReceiptLike(graph, receipt) {
     const { id, data, proofId } = receipt;
     const receiptNode = makeNode('receipt', id, data);
     const newEdges = [];
@@ -259,7 +272,7 @@ function addReceiptLike(graph, receipt) {
  * Add a standalone anchor node. If anchor.proofId is set, adds an 'anchored_to'
  * edge from the proof to this anchor.
  */
-function addAnchor(graph, anchor) {
+export function addAnchor(graph, anchor) {
     const { hash, proofId, ...rest } = anchor;
     const nodeData = { ...rest };
     const anchorNode = makeNode('anchor', hash, Object.keys(nodeData).length > 0 ? nodeData : undefined);

package/dist/index.d.ts

@@ -19,7 +19,8 @@ export type { DurableProofGraphStore, DurableProofGraphStoreOptions, ProofGraphR
 export { createProofGraphEvidenceStore, assertEvidenceBinding, normalizeEvidenceHash, } from './evidence.js';
 export type { ProofGraphEvidenceStore, ProofGraphEvidenceStoreOptions, ProofGraphEvidenceResult, EvidenceArtifactBinding, PutEvidenceOptions, } from './evidence.js';
 export { toHex, canonicalJson, computeNodeId, computeEdgeId, computeProofGraphId, recomputeGraphId, } from './canonical.js';
-export { createProofGraph, setGraphMetadata, buildEdge, addNode, addEdge, addIdentityDocument, addProof, addIdentityClaim, addManifest, addReceiptLike, addAnchor, } from './graph.js';
-export { findNode, getEdgesFrom, getEdgesTo, getEdgesByType, getProofNodes, findProofsBySubject, findProofsByIssuer, findAnchorsForProof, findRevocations, findSupersessions, findConflicts, getEvidenceTrail, getProofLineage, resolveCurrentProofSet, getManifestsForAddress, getEdgesBetween, reachableFrom, } from './query.js';
+export { createProofGraph, setGraphMetadata, buildEdge, addNode, addEdge, addIdentityDocument, addProof, addIdentityClaim, addManifest, addManifestRevision, addReceiptLike, addAnchor, } from './graph.js';
+export { findNode, getEdgesFrom, getEdgesTo, getEdgesByType, getProofNodes, findProofsBySubject, findProofsByIssuer, findAnchorsForProof, findRevocations, findSupersessions, findConflicts, getEvidenceTrail, getProofLineage, resolveCurrentProofSet, getManifestRevisions, getManifestsForAddress, getEdgesBetween, reachableFrom, } from './query.js';
 export { verifyProofGraph, verifyGraphProofs, } from './verify.js';
 export { exportProofGraph, importProofGraph, } from './io.js';
+export * from './replicated-evidence.js';