@totemsdk/proofgraph 1.0.1 → 1.1.1

package/dist/cjs/graph.js

@@ -0,0 +1,298 @@
+"use strict";
+/**
+ * Proof graph mutation functions — all pure, all returning NEW graphs.
+ *
+ * Immutable pattern: every mutation returns a brand-new ProofGraph with a
+ * recomputed graphId. Nodes and edges are deduplicated by ID so adding the
+ * same proof twice is idempotent.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProofGraph = createProofGraph;
+exports.setGraphMetadata = setGraphMetadata;
+exports.buildEdge = buildEdge;
+exports.addNode = addNode;
+exports.addEdge = addEdge;
+exports.addIdentityDocument = addIdentityDocument;
+exports.addProof = addProof;
+exports.addIdentityClaim = addIdentityClaim;
+exports.addManifest = addManifest;
+exports.addManifestRevision = addManifestRevision;
+exports.addReceiptLike = addReceiptLike;
+exports.addAnchor = addAnchor;
+const manifest_1 = require("@totemsdk/manifest");
+const canonical_js_1 = require("./canonical.js");
+const evidence_js_1 = require("./evidence.js");
+function makeNode(type, refId, data) {
+    return {
+        id: (0, canonical_js_1.computeNodeId)(type, refId),
+        type,
+        refId,
+        ...(data !== undefined ? { data } : {}),
+        createdAt: Date.now(),
+    };
+}
+function makeEdge(type, from, to, proofId, data) {
+    return {
+        id: (0, canonical_js_1.computeEdgeId)(type, from, to, proofId, data),
+        type,
+        from,
+        to,
+        ...(proofId !== undefined ? { proofId } : {}),
+        ...(data !== undefined ? { data } : {}),
+    };
+}
+function mergeNodes(existing, incoming) {
+    const byId = new Map(existing.map((n) => [n.id, n]));
+    for (const node of incoming) {
+        if (!byId.has(node.id)) {
+            byId.set(node.id, node);
+        }
+    }
+    return Array.from(byId.values());
+}
+function mergeEdges(existing, incoming) {
+    const byId = new Map(existing.map((e) => [e.id, e]));
+    for (const edge of incoming) {
+        if (!byId.has(edge.id)) {
+            byId.set(edge.id, edge);
+        }
+    }
+    return Array.from(byId.values());
+}
+function rebuild(graph, newNodes, newEdges) {
+    const nodes = mergeNodes(graph.nodes, newNodes);
+    const edges = mergeEdges(graph.edges, newEdges);
+    return {
+        ...graph,
+        nodes,
+        edges,
+        graphId: (0, canonical_js_1.computeProofGraphId)(nodes, edges),
+    };
+}
+/**
+ * Create an empty ProofGraph.
+ */
+function createProofGraph(metadata) {
+    const nodes = [];
+    const edges = [];
+    return {
+        graphId: (0, canonical_js_1.computeProofGraphId)(nodes, edges),
+        nodes,
+        edges,
+        createdAt: Date.now(),
+        ...(metadata !== undefined ? { metadata } : {}),
+    };
+}
+/**
+ * Attach or replace mutable metadata. Does NOT affect graphId.
+ */
+function setGraphMetadata(graph, metadata) {
+    return { ...graph, metadata };
+}
+/**
+ * Build a ProofGraphEdge with a deterministic ID from its fields.
+ * Convenience helper so callers don't need to import computeEdgeId.
+ */
+function buildEdge(type, from, to, proofId, data) {
+    return makeEdge(type, from, to, proofId, data);
+}
+/**
+ * Add a node directly (type + refId pair). Idempotent — skipped if the node already exists.
+ */
+function addNode(graph, type, refId, data) {
+    return rebuild(graph, [makeNode(type, refId, data)], []);
+}
+/**
+ * Append a ProofGraphEdge and recompute graphId. Idempotent by edge ID.
+ * Spec API: addEdge(graph, edge). Use buildEdge() to construct the edge object.
+ */
+function addEdge(graph, edge) {
+    const edges = mergeEdges(graph.edges, [edge]);
+    return {
+        ...graph,
+        edges,
+        graphId: (0, canonical_js_1.computeProofGraphId)(graph.nodes, edges),
+    };
+}
+/**
+ * Index a TotemIdentityDocument into the graph.
+ * Creates an 'identity' node with refId = doc.id.
+ */
+function addIdentityDocument(graph, doc) {
+    return rebuild(graph, [makeNode('identity', doc.id, { ...doc })], []);
+}
+/**
+ * Index a SignedProof into the graph.
+ *
+ * Nodes created:
+ *   proof      — proofId (stores the full SignedProof in .data)
+ *   identity   — signature.address (issuer key address)
+ *   subject    — proof.subject.id
+ *   evidence   — ev.id (one per evidence ref)
+ *   anchor     — anchor.hash (if present)
+ *
+ * Edges created (all referencing the proofId):
+ *   proves      proof → subject
+ *   issued_by   proof → identity (signer)
+ *   about       proof → subject
+ *   references  proof → evidence (one per evidence ref, in array order)
+ *   anchored_to proof → anchor (if present)
+ */
+function addProof(graph, signedProof) {
+    const proofNode = makeNode('proof', signedProof.proofId, {
+        ...signedProof,
+    });
+    const identityNode = makeNode('identity', signedProof.signature.address);
+    const subjectNode = makeNode('subject', signedProof.subject.id);
+    const newNodes = [proofNode, identityNode, subjectNode];
+    const newEdges = [
+        makeEdge('proves', signedProof.proofId, signedProof.subject.id, signedProof.proofId),
+        makeEdge('issued_by', signedProof.proofId, signedProof.signature.address, signedProof.proofId),
+        makeEdge('about', signedProof.proofId, signedProof.subject.id, signedProof.proofId),
+    ];
+    if (signedProof.evidence) {
+        for (const ev of signedProof.evidence) {
+            // RFC-007 Amendment A (A3): carry the claim commitment on the evidence
+            // node so the evidence store can enforce claim→contentHash→artifact.
+            newNodes.push(makeNode('evidence', ev.id, ev.hash ? { contentHash: (0, evidence_js_1.normalizeEvidenceHash)(ev.hash) } : undefined));
+            newEdges.push(makeEdge('references', signedProof.proofId, ev.id, signedProof.proofId));
+        }
+    }
+    if (signedProof.anchor) {
+        newNodes.push(makeNode('anchor', signedProof.anchor.hash));
+        newEdges.push(makeEdge('anchored_to', signedProof.proofId, signedProof.anchor.hash, signedProof.proofId));
+    }
+    return rebuild(graph, newNodes, newEdges);
+}
+/**
+ * Index a SignedIdentityClaim into the graph.
+ *
+ * Nodes created:
+ *   identity-claim — claim.id (stores the full signed claim in .data)
+ *   address        — issuer address
+ *   address/identity — target address (for delegates_to / rotates_to / revokes)
+ *
+ * Edges created based on claim.type:
+ *   all types    → issued_by  (claim-node → issuer address)
+ *   delegates_to → delegates_to edge (claim-node → delegated address)
+ *   revokes      → revokes edge      (claim-node → subject identity)
+ *   rotates_to   → controls edge     (claim-node → new address)
+ */
+function addIdentityClaim(graph, signedClaim) {
+    const { claim } = signedClaim;
+    const claimNode = makeNode('identity-claim', claim.id, {
+        ...signedClaim,
+    });
+    const issuerNode = makeNode('address', claim.issuer);
+    const newNodes = [claimNode, issuerNode];
+    const newEdges = [
+        makeEdge('issued_by', claim.id, claim.issuer),
+    ];
+    if (claim.type === 'delegates_to') {
+        newNodes.push(makeNode('address', claim.object));
+        newEdges.push(makeEdge('delegates_to', claim.id, claim.object));
+    }
+    else if (claim.type === 'revokes') {
+        newNodes.push(makeNode('identity', claim.subject));
+        newEdges.push(makeEdge('revokes', claim.id, claim.subject));
+    }
+    else if (claim.type === 'rotates_to') {
+        newNodes.push(makeNode('address', claim.object));
+        newEdges.push(makeEdge('controls', claim.id, claim.object));
+    }
+    return rebuild(graph, newNodes, newEdges);
+}
+/**
+ * Resolve the author address from a manifest based on its type.
+ * AppManifest / DAppManifest → authorAddress
+ * CapabilityManifest         → agentAddress
+ * EdgeServiceManifest        → operatorAddress
+ * Falls back to signedManifest.authorAddress if the manifest type is unknown.
+ */
+function resolveManifestAddress(signedManifest) {
+    const m = signedManifest.manifest;
+    if (m['type'] === 'capability' && typeof m['agentAddress'] === 'string') {
+        return m['agentAddress'];
+    }
+    if (m['type'] === 'edge-service' && typeof m['operatorAddress'] === 'string') {
+        return m['operatorAddress'];
+    }
+    if (typeof m['authorAddress'] === 'string') {
+        return m['authorAddress'];
+    }
+    return signedManifest.authorAddress;
+}
+/**
+ * Index a SignedManifest into the graph.
+ *
+ * Nodes created:
+ *   manifest — computed manifest ID (stores manifest content in .data)
+ *   address  — resolved author/agent/operator address
+ *
+ * Edge created:
+ *   manifests_as  manifest → address
+ */
+function addManifest(graph, signedManifest) {
+    const manifestId = (0, manifest_1.computeManifestId)(signedManifest.manifest);
+    const address = resolveManifestAddress(signedManifest);
+    const manifestNode = makeNode('manifest', manifestId, {
+        ...signedManifest,
+    });
+    const addressNode = makeNode('address', address);
+    return rebuild(graph, [manifestNode, addressNode], [
+        makeEdge('manifests_as', manifestId, address),
+    ]);
+}
+/**
+ * Add a signed manifest **revision** without collapsing other revisions.
+ *
+ * Creates:
+ *   manifest (logical)   refId = manifestId
+ *   manifest (revision)  refId = manifestEnvelopeId, data = { manifestId, manifestEnvelopeId, signedManifest }
+ *   address              resolved author/operator address
+ *   manifests_as         manifestId → address
+ *   revision_of          manifestEnvelopeId → manifestId
+ */
+function addManifestRevision(graph, signedManifest) {
+    const manifestId = (0, manifest_1.computeManifestId)(signedManifest.manifest);
+    const manifestEnvelopeId = (0, manifest_1.computeManifestEnvelopeId)(signedManifest);
+    const address = resolveManifestAddress(signedManifest);
+    const logicalNode = makeNode('manifest', manifestId, { manifestId });
+    const revisionNode = makeNode('manifest', manifestEnvelopeId, {
+        manifestId,
+        manifestEnvelopeId,
+        signedManifest,
+    });
+    const addressNode = makeNode('address', address);
+    return rebuild(graph, [logicalNode, revisionNode, addressNode], [
+        makeEdge('manifests_as', manifestId, address),
+        makeEdge('revision_of', manifestEnvelopeId, manifestId),
+    ]);
+}
+/**
+ * Add a receipt-like node (payment, subscription, claim receipt) to the graph.
+ * If receipt.proofId is set, adds a 'supports' edge from the receipt to that proof.
+ */
+function addReceiptLike(graph, receipt) {
+    const { id, data, proofId } = receipt;
+    const receiptNode = makeNode('receipt', id, data);
+    const newEdges = [];
+    if (proofId !== undefined) {
+        newEdges.push(makeEdge('supports', id, proofId, proofId));
+    }
+    return rebuild(graph, [receiptNode], newEdges);
+}
+/**
+ * Add a standalone anchor node. If anchor.proofId is set, adds an 'anchored_to'
+ * edge from the proof to this anchor.
+ */
+function addAnchor(graph, anchor) {
+    const { hash, proofId, ...rest } = anchor;
+    const nodeData = { ...rest };
+    const anchorNode = makeNode('anchor', hash, Object.keys(nodeData).length > 0 ? nodeData : undefined);
+    const newEdges = [];
+    if (proofId !== undefined) {
+        newEdges.push(makeEdge('anchored_to', proofId, hash, proofId));
+    }
+    return rebuild(graph, [anchorNode], newEdges);
+}

package/dist/cjs/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @module @totemsdk/proofgraph
+ *
+ * Local deterministic proof relationship graph for Totem Edge.
+ *
+ * Indexes SignedProofs, SignedIdentityClaims, SignedManifests, identity
+ * documents, and custom evidence nodes into an immutable, queryable DAG
+ * keyed by a content-derived graphId. Pure package — no network, no DHT,
+ * no blockchain submission, no crypto reimplementation.
+ *
+ * Usage:
+ *   const g0 = createProofGraph();
+ *   const g1 = addProof(g0, signedProof);
+ *   const result = verifyProofGraph(g1);
+ */
+export type { ProofGraphNodeType, ProofGraphEdgeType, ProofGraphNode, ProofGraphEdge, ProofGraph, ProofGraphVerifyResult, ProofGraphStoragePort, ReceiptLikeInput, AnchorInput, } from './types.js';
+export { createDurableProofGraphStore, } from './durable-store.js';
+export type { DurableProofGraphStore, DurableProofGraphStoreOptions, ProofGraphRecoveryReport, } from './durable-store.js';
+export { createProofGraphEvidenceStore, assertEvidenceBinding, normalizeEvidenceHash, } from './evidence.js';
+export type { ProofGraphEvidenceStore, ProofGraphEvidenceStoreOptions, ProofGraphEvidenceResult, EvidenceArtifactBinding, PutEvidenceOptions, } from './evidence.js';
+export { toHex, canonicalJson, computeNodeId, computeEdgeId, computeProofGraphId, recomputeGraphId, } from './canonical.js';
+export { createProofGraph, setGraphMetadata, buildEdge, addNode, addEdge, addIdentityDocument, addProof, addIdentityClaim, addManifest, addManifestRevision, addReceiptLike, addAnchor, } from './graph.js';
+export { findNode, getEdgesFrom, getEdgesTo, getEdgesByType, getProofNodes, findProofsBySubject, findProofsByIssuer, findAnchorsForProof, findRevocations, findSupersessions, findConflicts, getEvidenceTrail, getProofLineage, resolveCurrentProofSet, getManifestRevisions, getManifestsForAddress, getEdgesBetween, reachableFrom, } from './query.js';
+export { verifyProofGraph, verifyGraphProofs, } from './verify.js';
+export { exportProofGraph, importProofGraph, } from './io.js';
+export * from './replicated-evidence.js';

package/dist/cjs/index.js

@@ -0,0 +1,84 @@
+"use strict";
+/**
+ * @module @totemsdk/proofgraph
+ *
+ * Local deterministic proof relationship graph for Totem Edge.
+ *
+ * Indexes SignedProofs, SignedIdentityClaims, SignedManifests, identity
+ * documents, and custom evidence nodes into an immutable, queryable DAG
+ * keyed by a content-derived graphId. Pure package — no network, no DHT,
+ * no blockchain submission, no crypto reimplementation.
+ *
+ * Usage:
+ *   const g0 = createProofGraph();
+ *   const g1 = addProof(g0, signedProof);
+ *   const result = verifyProofGraph(g1);
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importProofGraph = exports.exportProofGraph = exports.verifyGraphProofs = exports.verifyProofGraph = exports.reachableFrom = exports.getEdgesBetween = exports.getManifestsForAddress = exports.getManifestRevisions = exports.resolveCurrentProofSet = exports.getProofLineage = exports.getEvidenceTrail = exports.findConflicts = exports.findSupersessions = exports.findRevocations = exports.findAnchorsForProof = exports.findProofsByIssuer = exports.findProofsBySubject = exports.getProofNodes = exports.getEdgesByType = exports.getEdgesTo = exports.getEdgesFrom = exports.findNode = exports.addAnchor = exports.addReceiptLike = exports.addManifestRevision = exports.addManifest = exports.addIdentityClaim = exports.addProof = exports.addIdentityDocument = exports.addEdge = exports.addNode = exports.buildEdge = exports.setGraphMetadata = exports.createProofGraph = exports.recomputeGraphId = exports.computeProofGraphId = exports.computeEdgeId = exports.computeNodeId = exports.canonicalJson = exports.toHex = exports.normalizeEvidenceHash = exports.assertEvidenceBinding = exports.createProofGraphEvidenceStore = exports.createDurableProofGraphStore = void 0;
+var durable_store_js_1 = require("./durable-store.js");
+Object.defineProperty(exports, "createDurableProofGraphStore", { enumerable: true, get: function () { return durable_store_js_1.createDurableProofGraphStore; } });
+var evidence_js_1 = require("./evidence.js");
+Object.defineProperty(exports, "createProofGraphEvidenceStore", { enumerable: true, get: function () { return evidence_js_1.createProofGraphEvidenceStore; } });
+Object.defineProperty(exports, "assertEvidenceBinding", { enumerable: true, get: function () { return evidence_js_1.assertEvidenceBinding; } });
+Object.defineProperty(exports, "normalizeEvidenceHash", { enumerable: true, get: function () { return evidence_js_1.normalizeEvidenceHash; } });
+var canonical_js_1 = require("./canonical.js"); // canonicalJson / toHex re-exported from @totemsdk/proof
+Object.defineProperty(exports, "toHex", { enumerable: true, get: function () { return canonical_js_1.toHex; } });
+Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return canonical_js_1.canonicalJson; } });
+Object.defineProperty(exports, "computeNodeId", { enumerable: true, get: function () { return canonical_js_1.computeNodeId; } });
+Object.defineProperty(exports, "computeEdgeId", { enumerable: true, get: function () { return canonical_js_1.computeEdgeId; } });
+Object.defineProperty(exports, "computeProofGraphId", { enumerable: true, get: function () { return canonical_js_1.computeProofGraphId; } });
+Object.defineProperty(exports, "recomputeGraphId", { enumerable: true, get: function () { return canonical_js_1.recomputeGraphId; } });
+var graph_js_1 = require("./graph.js");
+Object.defineProperty(exports, "createProofGraph", { enumerable: true, get: function () { return graph_js_1.createProofGraph; } });
+Object.defineProperty(exports, "setGraphMetadata", { enumerable: true, get: function () { return graph_js_1.setGraphMetadata; } });
+Object.defineProperty(exports, "buildEdge", { enumerable: true, get: function () { return graph_js_1.buildEdge; } });
+Object.defineProperty(exports, "addNode", { enumerable: true, get: function () { return graph_js_1.addNode; } });
+Object.defineProperty(exports, "addEdge", { enumerable: true, get: function () { return graph_js_1.addEdge; } });
+Object.defineProperty(exports, "addIdentityDocument", { enumerable: true, get: function () { return graph_js_1.addIdentityDocument; } });
+Object.defineProperty(exports, "addProof", { enumerable: true, get: function () { return graph_js_1.addProof; } });
+Object.defineProperty(exports, "addIdentityClaim", { enumerable: true, get: function () { return graph_js_1.addIdentityClaim; } });
+Object.defineProperty(exports, "addManifest", { enumerable: true, get: function () { return graph_js_1.addManifest; } });
+Object.defineProperty(exports, "addManifestRevision", { enumerable: true, get: function () { return graph_js_1.addManifestRevision; } });
+Object.defineProperty(exports, "addReceiptLike", { enumerable: true, get: function () { return graph_js_1.addReceiptLike; } });
+Object.defineProperty(exports, "addAnchor", { enumerable: true, get: function () { return graph_js_1.addAnchor; } });
+var query_js_1 = require("./query.js");
+Object.defineProperty(exports, "findNode", { enumerable: true, get: function () { return query_js_1.findNode; } });
+Object.defineProperty(exports, "getEdgesFrom", { enumerable: true, get: function () { return query_js_1.getEdgesFrom; } });
+Object.defineProperty(exports, "getEdgesTo", { enumerable: true, get: function () { return query_js_1.getEdgesTo; } });
+Object.defineProperty(exports, "getEdgesByType", { enumerable: true, get: function () { return query_js_1.getEdgesByType; } });
+Object.defineProperty(exports, "getProofNodes", { enumerable: true, get: function () { return query_js_1.getProofNodes; } });
+Object.defineProperty(exports, "findProofsBySubject", { enumerable: true, get: function () { return query_js_1.findProofsBySubject; } });
+Object.defineProperty(exports, "findProofsByIssuer", { enumerable: true, get: function () { return query_js_1.findProofsByIssuer; } });
+Object.defineProperty(exports, "findAnchorsForProof", { enumerable: true, get: function () { return query_js_1.findAnchorsForProof; } });
+Object.defineProperty(exports, "findRevocations", { enumerable: true, get: function () { return query_js_1.findRevocations; } });
+Object.defineProperty(exports, "findSupersessions", { enumerable: true, get: function () { return query_js_1.findSupersessions; } });
+Object.defineProperty(exports, "findConflicts", { enumerable: true, get: function () { return query_js_1.findConflicts; } });
+Object.defineProperty(exports, "getEvidenceTrail", { enumerable: true, get: function () { return query_js_1.getEvidenceTrail; } });
+Object.defineProperty(exports, "getProofLineage", { enumerable: true, get: function () { return query_js_1.getProofLineage; } });
+Object.defineProperty(exports, "resolveCurrentProofSet", { enumerable: true, get: function () { return query_js_1.resolveCurrentProofSet; } });
+Object.defineProperty(exports, "getManifestRevisions", { enumerable: true, get: function () { return query_js_1.getManifestRevisions; } });
+Object.defineProperty(exports, "getManifestsForAddress", { enumerable: true, get: function () { return query_js_1.getManifestsForAddress; } });
+Object.defineProperty(exports, "getEdgesBetween", { enumerable: true, get: function () { return query_js_1.getEdgesBetween; } });
+Object.defineProperty(exports, "reachableFrom", { enumerable: true, get: function () { return query_js_1.reachableFrom; } });
+var verify_js_1 = require("./verify.js");
+Object.defineProperty(exports, "verifyProofGraph", { enumerable: true, get: function () { return verify_js_1.verifyProofGraph; } });
+Object.defineProperty(exports, "verifyGraphProofs", { enumerable: true, get: function () { return verify_js_1.verifyGraphProofs; } });
+var io_js_1 = require("./io.js");
+Object.defineProperty(exports, "exportProofGraph", { enumerable: true, get: function () { return io_js_1.exportProofGraph; } });
+Object.defineProperty(exports, "importProofGraph", { enumerable: true, get: function () { return io_js_1.importProofGraph; } });
+__exportStar(require("./replicated-evidence.js"), exports);

package/dist/cjs/io.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Serialization helpers for ProofGraph.
+ *
+ * exportProofGraph:  JSON-stringify the graph for storage or transport.
+ * importProofGraph:  parse JSON, validate every node/edge, recompute graphId,
+ *                    and throw if verification fails.
+ *
+ * The graphId guards against silent corruption in transit. Node/edge
+ * validation prevents hostile or malformed input from entering the system.
+ */
+import type { ProofGraph } from './types.js';
+/**
+ * Serialize a ProofGraph to a JSON string.
+ * The stored graphId was computed at mutation time and is included as-is.
+ */
+export declare function exportProofGraph(graph: ProofGraph): string;
+/**
+ * Deserialize a ProofGraph from a JSON string.
+ *
+ * Validates every node and edge against structural constraints, then
+ * recomputes the graphId from nodes + edges. Throws if any constraint
+ * is violated or if the recomputed graphId does not match the stored value.
+ *
+ * @throws Error if parsing, validation, or graphId verification fails.
+ */
+export declare function importProofGraph(json: string): ProofGraph;

package/dist/cjs/io.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * Serialization helpers for ProofGraph.
+ *
+ * exportProofGraph:  JSON-stringify the graph for storage or transport.
+ * importProofGraph:  parse JSON, validate every node/edge, recompute graphId,
+ *                    and throw if verification fails.
+ *
+ * The graphId guards against silent corruption in transit. Node/edge
+ * validation prevents hostile or malformed input from entering the system.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportProofGraph = exportProofGraph;
+exports.importProofGraph = importProofGraph;
+const canonical_js_1 = require("./canonical.js");
+const VALID_NODE_TYPES = new Set([
+    'proof', 'identity', 'identity-claim', 'manifest', 'address',
+    'subject', 'evidence', 'anchor', 'receipt', 'payment', 'device',
+    'service', 'policy', 'custom',
+]);
+const VALID_EDGE_TYPES = new Set([
+    'proves', 'issued_by', 'signed_by', 'about', 'references',
+    'derived_from', 'supports', 'contradicts', 'supersedes', 'revokes',
+    'anchored_to', 'delegates_to', 'controls', 'depends_on',
+    'manifests_as', 'conflicts_with',
+]);
+const MAX_NODES = 10000;
+const MAX_EDGES = 50000;
+const MAX_STRING_LENGTH = 4096;
+const MAX_DATA_DEPTH = 10;
+const MAX_DATA_KEYS = 256;
+/**
+ * Validate a single ProofGraphNode.
+ * Throws if the node violates structural constraints.
+ */
+function validateNode(node, index) {
+    if (!node || typeof node !== 'object') {
+        throw new Error(`importProofGraph: nodes[${index}] is not an object`);
+    }
+    const n = node;
+    if (typeof n.id !== 'string' || n.id.length === 0) {
+        throw new Error(`importProofGraph: nodes[${index}] missing or empty id`);
+    }
+    if (typeof n.refId !== 'string' || n.refId.length === 0) {
+        throw new Error(`importProofGraph: nodes[${index}] missing or empty refId`);
+    }
+    if (n.id.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: nodes[${index}].id exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (n.refId.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: nodes[${index}].refId exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (!VALID_NODE_TYPES.has(String(n.type))) {
+        throw new Error(`importProofGraph: nodes[${index}] invalid type "${String(n.type)}"`);
+    }
+    if (typeof n.createdAt !== 'number' || n.createdAt < 0 || !Number.isFinite(n.createdAt)) {
+        throw new Error(`importProofGraph: nodes[${index}] invalid or negative createdAt`);
+    }
+    if (n.data !== undefined && n.data !== null) {
+        if (typeof n.data !== 'object') {
+            throw new Error(`importProofGraph: nodes[${index}].data must be an object`);
+        }
+        const keys = Object.keys(n.data);
+        if (keys.length > MAX_DATA_KEYS) {
+            throw new Error(`importProofGraph: nodes[${index}].data exceeds ${MAX_DATA_KEYS} keys`);
+        }
+        checkDepth(n.data, 0, MAX_DATA_DEPTH, `nodes[${index}].data`);
+    }
+}
+/**
+ * Validate a single ProofGraphEdge.
+ * Throws if the edge violates structural constraints.
+ */
+function validateEdge(edge, index) {
+    if (!edge || typeof edge !== 'object') {
+        throw new Error(`importProofGraph: edges[${index}] is not an object`);
+    }
+    const e = edge;
+    if (typeof e.id !== 'string' || e.id.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty id`);
+    }
+    if (typeof e.from !== 'string' || e.from.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty from`);
+    }
+    if (typeof e.to !== 'string' || e.to.length === 0) {
+        throw new Error(`importProofGraph: edges[${index}] missing or empty to`);
+    }
+    if (e.id.length > MAX_STRING_LENGTH || e.from.length > MAX_STRING_LENGTH || e.to.length > MAX_STRING_LENGTH) {
+        throw new Error(`importProofGraph: edges[${index}] string field exceeds ${MAX_STRING_LENGTH} chars`);
+    }
+    if (!VALID_EDGE_TYPES.has(String(e.type))) {
+        throw new Error(`importProofGraph: edges[${index}] invalid type "${String(e.type)}"`);
+    }
+    if (e.proofId !== undefined && typeof e.proofId !== 'string') {
+        throw new Error(`importProofGraph: edges[${index}].proofId must be a string`);
+    }
+    if (e.data !== undefined && e.data !== null) {
+        if (typeof e.data !== 'object') {
+            throw new Error(`importProofGraph: edges[${index}].data must be an object`);
+        }
+        checkDepth(e.data, 0, MAX_DATA_DEPTH, `edges[${index}].data`);
+    }
+}
+/**
+ * Recursive depth check on nested data objects to prevent deep-object attacks.
+ */
+function checkDepth(obj, depth, maxDepth, path) {
+    if (depth > maxDepth) {
+        throw new Error(`importProofGraph: ${path} exceeds max nesting depth of ${maxDepth}`);
+    }
+    for (const [key, value] of Object.entries(obj)) {
+        if (typeof key === 'string' && key.length > MAX_STRING_LENGTH) {
+            throw new Error(`importProofGraph: ${path} key exceeds ${MAX_STRING_LENGTH} chars`);
+        }
+        if (value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Uint8Array)) {
+            checkDepth(value, depth + 1, maxDepth, `${path}.${key}`);
+        }
+    }
+}
+/**
+ * Serialize a ProofGraph to a JSON string.
+ * The stored graphId was computed at mutation time and is included as-is.
+ */
+function exportProofGraph(graph) {
+    return JSON.stringify(graph);
+}
+/**
+ * Deserialize a ProofGraph from a JSON string.
+ *
+ * Validates every node and edge against structural constraints, then
+ * recomputes the graphId from nodes + edges. Throws if any constraint
+ * is violated or if the recomputed graphId does not match the stored value.
+ *
+ * @throws Error if parsing, validation, or graphId verification fails.
+ */
+function importProofGraph(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch (err) {
+        throw new Error(`importProofGraph: invalid JSON — ${err.message}`);
+    }
+    const graph = parsed;
+    if (!graph || typeof graph !== 'object') {
+        throw new Error('importProofGraph: parsed value is not an object');
+    }
+    if (!Array.isArray(graph.nodes) || !Array.isArray(graph.edges)) {
+        throw new Error('importProofGraph: missing nodes or edges arrays');
+    }
+    if (graph.nodes.length > MAX_NODES) {
+        throw new Error(`importProofGraph: node count ${graph.nodes.length} exceeds limit ${MAX_NODES}`);
+    }
+    if (graph.edges.length > MAX_EDGES) {
+        throw new Error(`importProofGraph: edge count ${graph.edges.length} exceeds limit ${MAX_EDGES}`);
+    }
+    // Validate every node and edge
+    for (let i = 0; i < graph.nodes.length; i++) {
+        validateNode(graph.nodes[i], i);
+    }
+    for (let i = 0; i < graph.edges.length; i++) {
+        validateEdge(graph.edges[i], i);
+    }
+    // Recompute and verify graphId
+    const originalId = typeof graph.graphId === 'string' ? graph.graphId : '';
+    const recomputed = (0, canonical_js_1.recomputeGraphId)(graph);
+    // If a stored graphId exists, verify it matches
+    if (originalId !== '' && recomputed !== originalId) {
+        throw new Error(`importProofGraph: graphId mismatch — stored="${originalId}" recomputed="${recomputed}"`);
+    }
+    // Return with graphId set to the recomputed value for consistency
+    return { ...graph, graphId: recomputed };
+}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}