gitchain-sol 0.1.0 → 0.2.0

package/dist/gitchain.mjs

@@ -99,12 +99,12 @@ GitChain initialized for "${projectName}"
 }
 
 // src/commands/publish.ts
-import chalk2 from "chalk";
+import chalk3 from "chalk";
 import { resolve as resolve2 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
 import { execSync } from "node:child_process";
-import { SystemProgram } from "@solana/web3.js";
+import { PublicKey as PublicKey2, SystemProgram } from "@solana/web3.js";
 
 // ../fingerprint/dist/hash.js
 import { createHash } from "node:crypto";
@@ -321,12 +321,42 @@ var IDL = {
         { name: "parent", type: "pubkey" },
         { name: "origin", type: "pubkey" }
       ]
+    },
+    {
+      name: "register_file_hashes",
+      discriminator: [13, 82, 71, 30, 119, 55, 218, 3],
+      accounts: [
+        { name: "file_hash_registry", writable: true },
+        { name: "project_record" },
+        { name: "creator", writable: true, signer: true },
+        { name: "system_program", address: "11111111111111111111111111111111" }
+      ],
+      args: [
+        { name: "file_hashes", type: { vec: { array: ["u8", 32] } } }
+      ]
+    },
+    {
+      name: "update_file_hashes",
+      discriminator: [201, 150, 255, 217, 36, 176, 27, 116],
+      accounts: [
+        { name: "file_hash_registry", writable: true },
+        { name: "project_record" },
+        { name: "creator", writable: true, signer: true },
+        { name: "system_program", address: "11111111111111111111111111111111" }
+      ],
+      args: [
+        { name: "file_hashes", type: { vec: { array: ["u8", 32] } } }
+      ]
     }
   ],
   accounts: [
     {
       name: "ProjectRecord",
       discriminator: [93, 174, 112, 203, 231, 123, 92, 56]
+    },
+    {
+      name: "FileHashRegistry",
+      discriminator: [25, 208, 115, 130, 234, 247, 70, 166]
     }
   ],
   types: [
@@ -348,6 +378,18 @@ var IDL = {
           { name: "bump", type: "u8" }
         ]
       }
+    },
+    {
+      name: "FileHashRegistry",
+      type: {
+        kind: "struct",
+        fields: [
+          { name: "project", type: "pubkey" },
+          { name: "creator", type: "pubkey" },
+          { name: "hash_count", type: "u16" },
+          { name: "hashes", type: { vec: { array: ["u8", 32] } } }
+        ]
+      }
     }
   ]
 };
@@ -372,6 +414,12 @@ function deriveProjectPda(creatorPubkey, projectName) {
     getProgramId()
   );
 }
+function deriveFileHashPda(projectRecordPda) {
+  return PublicKey.findProgramAddressSync(
+    [Buffer.from("filehashes"), projectRecordPda.toBuffer()],
+    getProgramId()
+  );
+}
 function getProgram(connection, keypair) {
   const wallet = new Wallet(keypair);
   const provider = new AnchorProvider(connection, wallet, {
@@ -387,6 +435,13 @@ function hexToBytes32(hex) {
 async function fetchAllProjectsViaProgram(program2) {
   return await program2.account.projectRecord.all();
 }
+async function fetchAllFileHashRegistries(program2) {
+  try {
+    return await program2.account.fileHashRegistry.all();
+  } catch {
+    return [];
+  }
+}
 var STATUS_LABELS = {
   0: "Registered",
   1: "Verified Original",
@@ -395,38 +450,138 @@ var STATUS_LABELS = {
   4: "Provenance Stripped"
 };
 
+// src/utils/lineage.ts
+import chalk2 from "chalk";
+function scanForLineage(localFingerprint, onChainProjects) {
+  let bestMatch = null;
+  for (const project of onChainProjects) {
+    const onChainFp = {
+      merkleRoot: project.merkleRoot,
+      fileHashes: {},
+      contentHashes: [...project.fileHashes].sort(),
+      fileCount: project.fileCount
+    };
+    project.fileHashes.forEach((h, i) => {
+      onChainFp.fileHashes[`onchain_${i}`] = h;
+    });
+    const result = compareFingerprints(onChainFp, localFingerprint);
+    if (result.fileOverlapPercent >= 30) {
+      if (!bestMatch || result.fileOverlapPercent > bestMatch.overlapPercent) {
+        bestMatch = {
+          pubkey: project.pubkey,
+          projectName: project.projectName,
+          creator: project.creator,
+          registeredAt: project.registeredAt,
+          repoUrl: project.repoUrl,
+          overlapPercent: result.fileOverlapPercent,
+          matchedFiles: result.matchedFiles,
+          merkleMatch: result.merkleMatch,
+          status: result.status,
+          confidence: result.confidence,
+          parentProject: project.parentProject,
+          originProject: project.originProject
+        };
+      }
+    }
+  }
+  return bestMatch;
+}
+function getAutoStatus(overlapPercent) {
+  if (overlapPercent >= 90) return 3;
+  if (overlapPercent >= 60) return 2;
+  return 0;
+}
+function printLineageWarning(match) {
+  const tierLabel = match.overlapPercent >= 90 ? "DISPUTED ORIGIN" : match.overlapPercent >= 60 ? "VERIFIED DERIVATIVE" : "POSSIBLE DERIVATION";
+  const color = match.overlapPercent >= 90 ? chalk2.red : match.overlapPercent >= 60 ? chalk2.yellow : chalk2.cyan;
+  console.log(color(`
+  Lineage detected: ${tierLabel}`));
+  console.log(color(`  ${match.overlapPercent.toFixed(1)}% file overlap with "${match.projectName}"`));
+  console.log(chalk2.gray(`    Creator:    ${match.creator.substring(0, 8)}...${match.creator.substring(match.creator.length - 4)}`));
+  console.log(chalk2.gray(`    Registered: ${new Date(match.registeredAt * 1e3).toISOString().substring(0, 10)}`));
+  if (match.repoUrl) {
+    console.log(chalk2.gray(`    Repo:       ${match.repoUrl}`));
+  }
+  console.log(chalk2.gray(`    Matched:    ${match.matchedFiles} files`));
+}
+
 // src/commands/publish.ts
 async function publishCommand(remote, branch, options) {
   const projectPath = resolve2(options.path || ".");
   if (!isInitialized(projectPath)) {
-    console.error(chalk2.red("Error: Not initialized. Run 'gitchain init' first."));
+    console.error(chalk3.red("Error: Not initialized. Run 'gitchain init' first."));
     process.exit(1);
   }
   const config = readConfig(projectPath);
   if (!existsSync2(config.walletPath)) {
-    console.error(chalk2.red(`Error: Wallet not found at ${config.walletPath}`));
-    console.error(chalk2.gray("Generate one with: solana-keygen new"));
+    console.error(chalk3.red(`Error: Wallet not found at ${config.walletPath}`));
+    console.error(chalk3.gray("Generate one with: solana-keygen new"));
     process.exit(1);
   }
-  console.log(chalk2.gray("Fingerprinting project..."));
+  console.log(chalk3.gray("Fingerprinting project..."));
   const fingerprint = await fingerprintDirectory(projectPath);
-  console.log(chalk2.gray(`  Files scanned: ${fingerprint.fileCount}`));
-  console.log(chalk2.gray(`  Merkle root:   ${fingerprint.merkleRoot.substring(0, 16)}...`));
+  console.log(chalk3.gray(`  Files scanned: ${fingerprint.fileCount}`));
+  console.log(chalk3.gray(`  Merkle root:   ${fingerprint.merkleRoot.substring(0, 16)}...`));
+  console.log(chalk3.gray("\nConnecting to Solana..."));
+  const keypair = loadKeypair(config.walletPath);
+  const connection = getConnection(config.rpcUrl);
+  const program2 = getProgram(connection, keypair);
+  const [pda] = deriveProjectPda(keypair.publicKey, config.projectName);
+  console.log(chalk3.gray(`  Wallet:  ${keypair.publicKey.toString()}`));
+  console.log(chalk3.gray(`  PDA:     ${pda.toString()}`));
+  console.log(chalk3.gray("\nScanning on-chain registry for overlaps..."));
+  const allProjects = await fetchAllProjectsViaProgram(program2);
+  const allFileHashRegs = await fetchAllFileHashRegistries(program2);
+  const fileHashMap = /* @__PURE__ */ new Map();
+  for (const reg of allFileHashRegs) {
+    const projectKey = reg.account.project.toString();
+    const hashes = reg.account.hashes.map(
+      (h) => Buffer.from(h).toString("hex")
+    );
+    fileHashMap.set(projectKey, hashes);
+  }
+  const projectsWithHashes = [];
+  for (const item of allProjects) {
+    const pubkey = item.pubkey.toString();
+    const account = item.account;
+    const hashes = fileHashMap.get(pubkey) || [];
+    if (pubkey === pda.toString()) continue;
+    if (hashes.length === 0) continue;
+    const registeredAt = account.registeredAt.toNumber ? account.registeredAt.toNumber() : Number(account.registeredAt);
+    projectsWithHashes.push({
+      pubkey,
+      projectName: account.projectName,
+      creator: account.creator.toString(),
+      merkleRoot: Buffer.from(account.merkleRoot).toString("hex"),
+      fileCount: account.fileCount,
+      status: account.status,
+      parentProject: account.parentProject.toString(),
+      originProject: account.originProject.toString(),
+      registeredAt,
+      repoUrl: account.repoUrl || "",
+      fileHashes: hashes
+    });
+  }
+  console.log(chalk3.gray(`  Scanned ${projectsWithHashes.length} registered project(s)`));
+  const lineageMatch = scanForLineage(fingerprint, projectsWithHashes);
+  if (lineageMatch && lineageMatch.overlapPercent >= 60) {
+    printLineageWarning(lineageMatch);
+  }
   const provenance = readProvenance(projectPath);
   const codeChanged = provenance.merkleRoot !== fingerprint.merkleRoot;
   if (!codeChanged && provenance.published) {
-    console.log(chalk2.yellow("\nNo code changes since last publish. Skipping Solana registration."));
-    console.log(chalk2.gray(`Pushing to ${remote}/${branch}...
+    console.log(chalk3.yellow("\nNo code changes since last publish. Skipping Solana registration."));
+    console.log(chalk3.gray(`Pushing to ${remote}/${branch}...
 `));
     try {
       execSync(`git push ${remote} ${branch}`, {
         cwd: projectPath,
         stdio: "inherit"
       });
-      console.log(chalk2.green(`
+      console.log(chalk3.green(`
 Pushed to ${remote}/${branch}.`));
     } catch {
-      console.error(chalk2.red(`
+      console.error(chalk3.red(`
 git push failed. Resolve the issue and retry.`));
       process.exit(1);
     }
@@ -438,13 +593,6 @@ git push failed. Resolve the issue and retry.`));
     )
   );
   const fileHashesHash = createHash3("sha256").update(fileHashesJson).digest("hex");
-  console.log(chalk2.gray("\nConnecting to Solana..."));
-  const keypair = loadKeypair(config.walletPath);
-  const connection = getConnection(config.rpcUrl);
-  const program2 = getProgram(connection, keypair);
-  const [pda] = deriveProjectPda(keypair.publicKey, config.projectName);
-  console.log(chalk2.gray(`  Wallet:  ${keypair.publicKey.toString()}`));
-  console.log(chalk2.gray(`  PDA:     ${pda.toString()}`));
   let alreadyRegistered = false;
   try {
     const existing = await program2.account.projectRecord.fetch(pda);
@@ -453,7 +601,7 @@ git push failed. Resolve the issue and retry.`));
   }
   let txSignature = provenance.txSignature || "";
   if (!alreadyRegistered) {
-    console.log(chalk2.gray("\nRegistering on Solana..."));
+    console.log(chalk3.gray("\nRegistering on Solana..."));
     try {
       txSignature = await program2.methods.registerProject(
         config.projectName,
@@ -466,15 +614,15 @@ git push failed. Resolve the issue and retry.`));
         creator: keypair.publicKey,
         systemProgram: SystemProgram.programId
       }).rpc();
-      console.log(chalk2.green("  Solana registration successful."));
+      console.log(chalk3.green("  Solana registration successful."));
     } catch (err) {
-      console.error(chalk2.red(`
+      console.error(chalk3.red(`
 Solana transaction failed: ${err.message}`));
-      console.error(chalk2.red("Aborting push. Fix the issue and retry."));
+      console.error(chalk3.red("Aborting push. Fix the issue and retry."));
       process.exit(1);
     }
   } else {
-    console.log(chalk2.gray("\nUpdating fingerprint on Solana..."));
+    console.log(chalk3.gray("\nUpdating fingerprint on Solana..."));
     try {
       txSignature = await program2.methods.updateFingerprint(
         hexToBytes32(fingerprint.merkleRoot),
@@ -484,15 +632,15 @@ Solana transaction failed: ${err.message}`));
         projectRecord: pda,
         creator: keypair.publicKey
       }).rpc();
-      console.log(chalk2.green("  Fingerprint updated on Solana."));
+      console.log(chalk3.green("  Fingerprint updated on Solana."));
     } catch (err) {
-      console.error(chalk2.red(`
+      console.error(chalk3.red(`
 Solana update failed: ${err.message}`));
-      console.error(chalk2.red("Aborting push. Fix the issue and retry."));
+      console.error(chalk3.red("Aborting push. Fix the issue and retry."));
       process.exit(1);
     }
   }
-  console.log(chalk2.gray(`
+  console.log(chalk3.gray(`
 Pushing to ${remote}/${branch}...`));
   try {
     execSync(`git push ${remote} ${branch}`, {
@@ -500,11 +648,55 @@ Pushing to ${remote}/${branch}...`));
       stdio: "inherit"
     });
   } catch {
-    console.error(chalk2.red(`
+    console.error(chalk3.red(`
 git push failed. Your code IS registered on Solana.`));
-    console.error(chalk2.gray("Resolve the git issue and run: git push " + remote + " " + branch));
+    console.error(chalk3.gray("Resolve the git issue and run: git push " + remote + " " + branch));
     process.exit(1);
   }
+  console.log(chalk3.gray("\nUploading file hashes to Solana..."));
+  const sortedHashes = Object.values(fingerprint.fileHashes).sort();
+  const hashesAsBytes = sortedHashes.map((h) => hexToBytes32(h));
+  const [fileHashPda] = deriveFileHashPda(pda);
+  let fileHashRegistryExists = false;
+  try {
+    await program2.account.fileHashRegistry.fetch(fileHashPda);
+    fileHashRegistryExists = true;
+  } catch {
+  }
+  try {
+    if (!fileHashRegistryExists) {
+      await program2.methods.registerFileHashes(hashesAsBytes).accounts({
+        fileHashRegistry: fileHashPda,
+        projectRecord: pda,
+        creator: keypair.publicKey,
+        systemProgram: SystemProgram.programId
+      }).rpc();
+    } else {
+      await program2.methods.updateFileHashes(hashesAsBytes).accounts({
+        fileHashRegistry: fileHashPda,
+        projectRecord: pda,
+        creator: keypair.publicKey,
+        systemProgram: SystemProgram.programId
+      }).rpc();
+    }
+    console.log(chalk3.green(`  ${sortedHashes.length} file hashes stored on-chain.`));
+  } catch (err) {
+    console.log(chalk3.yellow(`  Warning: Could not upload file hashes: ${err.message}`));
+  }
+  if (lineageMatch && lineageMatch.overlapPercent >= 60) {
+    const autoStatus = getAutoStatus(lineageMatch.overlapPercent);
+    const parentPda = new PublicKey2(lineageMatch.pubkey);
+    const originPda = lineageMatch.originProject !== PublicKey2.default.toString() ? new PublicKey2(lineageMatch.originProject) : parentPda;
+    try {
+      await program2.methods.updateStatus(autoStatus, parentPda, originPda).accounts({
+        projectRecord: pda,
+        creator: keypair.publicKey
+      }).rpc();
+      console.log(chalk3.gray(`  Lineage status set on-chain (parent: ${lineageMatch.projectName})`));
+    } catch (err) {
+      console.log(chalk3.yellow(`  Warning: Could not set lineage status: ${err.message}`));
+    }
+  }
   writeProvenance(projectPath, {
     published: true,
     merkleRoot: fingerprint.merkleRoot,
@@ -512,15 +704,20 @@ git push failed. Your code IS registered on Solana.`));
     fileCount: fingerprint.fileCount,
     txSignature,
     pdaAddress: pda.toString(),
-    publishedAt: (/* @__PURE__ */ new Date()).toISOString()
+    publishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...lineageMatch && lineageMatch.overlapPercent >= 60 ? {
+      parentProject: lineageMatch.projectName,
+      parentPda: lineageMatch.pubkey,
+      overlapPercent: lineageMatch.overlapPercent
+    } : {}
   });
-  console.log(chalk2.green("\nPublished & pushed!\n"));
-  console.log(`  ${chalk2.bold("Merkle Root:")} ${fingerprint.merkleRoot}`);
-  console.log(`  ${chalk2.bold("Files:")}       ${fingerprint.fileCount}`);
-  console.log(`  ${chalk2.bold("Solana TX:")}   ${txSignature}`);
-  console.log(`  ${chalk2.bold("Pushed to:")}   ${remote}/${branch}`);
+  console.log(chalk3.green("\nPublished & pushed!\n"));
+  console.log(`  ${chalk3.bold("Merkle Root:")} ${fingerprint.merkleRoot}`);
+  console.log(`  ${chalk3.bold("Files:")}       ${fingerprint.fileCount}`);
+  console.log(`  ${chalk3.bold("Solana TX:")}   ${txSignature}`);
+  console.log(`  ${chalk3.bold("Pushed to:")}   ${remote}/${branch}`);
   console.log(
-    chalk2.gray(`
+    chalk3.gray(`
   Explorer: https://explorer.solana.com/tx/${txSignature}?cluster=devnet`)
   );
 }
@@ -533,7 +730,7 @@ function getRepoUrl(projectPath) {
 }
 
 // src/commands/clone.ts
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 import { resolve as resolve3, basename as basename2 } from "node:path";
 import { existsSync as existsSync3 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
@@ -544,10 +741,10 @@ var DEFAULT_PROGRAM_ID2 = "5bHSYFLoEtoxQnqi6vuDvjFGbcuwnLJbi6wJbHmHW8R4";
 async function cloneCommand(url, options) {
   const repoName = extractRepoName(url);
   const targetDir = resolve3(options.directory || repoName);
-  console.log(chalk3.bold(`
+  console.log(chalk4.bold(`
 GitChain Clone: ${repoName}
 `));
-  console.log(chalk3.gray("Checking on-chain provenance..."));
+  console.log(chalk4.gray("Checking on-chain provenance..."));
   let onChainRecord = null;
   try {
     if (existsSync3(DEFAULT_WALLET_PATH2)) {
@@ -576,35 +773,35 @@ GitChain Clone: ${repoName}
       }
     }
   } catch (err) {
-    console.log(chalk3.gray(`  Could not query Solana: ${err.message}`));
+    console.log(chalk4.gray(`  Could not query Solana: ${err.message}`));
   }
   if (onChainRecord) {
     const statusLabel = STATUS_LABELS[onChainRecord.status] || "Unknown";
-    console.log(chalk3.green("\n  On-chain provenance found:\n"));
-    console.log(`    ${chalk3.bold("Project:")}    ${onChainRecord.projectName}`);
-    console.log(`    ${chalk3.bold("Creator:")}    ${onChainRecord.creator.substring(0, 8)}...${onChainRecord.creator.substring(onChainRecord.creator.length - 4)}`);
-    console.log(`    ${chalk3.bold("Registered:")} ${new Date(onChainRecord.registeredAt * 1e3).toISOString().substring(0, 10)}`);
-    console.log(`    ${chalk3.bold("Status:")}     ${statusLabel}`);
-    console.log(`    ${chalk3.bold("Files:")}      ${onChainRecord.fileCount}`);
-    console.log(`    ${chalk3.bold("Merkle Root:")} ${onChainRecord.merkleRoot.substring(0, 16)}...`);
+    console.log(chalk4.green("\n  On-chain provenance found:\n"));
+    console.log(`    ${chalk4.bold("Project:")}    ${onChainRecord.projectName}`);
+    console.log(`    ${chalk4.bold("Creator:")}    ${onChainRecord.creator.substring(0, 8)}...${onChainRecord.creator.substring(onChainRecord.creator.length - 4)}`);
+    console.log(`    ${chalk4.bold("Registered:")} ${new Date(onChainRecord.registeredAt * 1e3).toISOString().substring(0, 10)}`);
+    console.log(`    ${chalk4.bold("Status:")}     ${statusLabel}`);
+    console.log(`    ${chalk4.bold("Files:")}      ${onChainRecord.fileCount}`);
+    console.log(`    ${chalk4.bold("Merkle Root:")} ${onChainRecord.merkleRoot.substring(0, 16)}...`);
   } else {
-    console.log(chalk3.yellow("\n  Warning: No provenance record found for this repository."));
-    console.log(chalk3.yellow("  Origin is unverified.\n"));
+    console.log(chalk4.yellow("\n  Warning: No provenance record found for this repository."));
+    console.log(chalk4.yellow("  Origin is unverified.\n"));
   }
-  console.log(chalk3.gray(`
+  console.log(chalk4.gray(`
 Cloning ${url}...`));
   const cloneArgs = options.directory ? `${url} ${options.directory}` : url;
   try {
     execSync2(`git clone ${cloneArgs}`, { stdio: "inherit" });
   } catch {
-    console.error(chalk3.red("\ngit clone failed."));
+    console.error(chalk4.red("\ngit clone failed."));
     process.exit(1);
   }
   if (onChainRecord) {
-    console.log(chalk3.gray("\nVerifying cloned code against on-chain fingerprint..."));
+    console.log(chalk4.gray("\nVerifying cloned code against on-chain fingerprint..."));
     const clonedFp = await fingerprintDirectory(targetDir);
     if (clonedFp.merkleRoot === onChainRecord.merkleRoot) {
-      console.log(chalk3.green("\n  Verified: code matches on-chain fingerprint."));
+      console.log(chalk4.green("\n  Verified: code matches on-chain fingerprint."));
     } else {
       const fileHashesJson = JSON.stringify(
         Object.fromEntries(
@@ -613,15 +810,15 @@ Cloning ${url}...`));
       );
       const clonedHashesHash = createHash4("sha256").update(fileHashesJson).digest("hex");
       if (clonedHashesHash === onChainRecord.fileHashesHash) {
-        console.log(chalk3.green("\n  Verified: file content matches on-chain commitment."));
+        console.log(chalk4.green("\n  Verified: file content matches on-chain commitment."));
       } else {
-        console.log(chalk3.yellow("\n  Warning: code does NOT match registered fingerprint."));
-        console.log(chalk3.yellow("  The repository may have been modified since registration."));
-        console.log(chalk3.gray("  Run 'gitchain verify' for detailed analysis."));
+        console.log(chalk4.yellow("\n  Warning: code does NOT match registered fingerprint."));
+        console.log(chalk4.yellow("  The repository may have been modified since registration."));
+        console.log(chalk4.gray("  Run 'gitchain verify' for detailed analysis."));
       }
     }
   }
-  console.log(chalk3.gray("\nInitializing GitChain in cloned repository..."));
+  console.log(chalk4.gray("\nInitializing GitChain in cloned repository..."));
   const cloneConfig = {
     projectName: onChainRecord?.projectName || repoName,
     walletPath: DEFAULT_WALLET_PATH2,
@@ -636,12 +833,12 @@ Cloning ${url}...`));
     publishedAt: onChainRecord ? new Date(onChainRecord.registeredAt * 1e3).toISOString() : void 0
   });
   ensureGitignore(targetDir);
-  console.log(chalk3.green(`
+  console.log(chalk4.green(`
 Done! Repository cloned to ${targetDir}`));
   if (onChainRecord) {
-    console.log(chalk3.gray("  GitChain provenance data imported from Solana."));
+    console.log(chalk4.gray("  GitChain provenance data imported from Solana."));
   } else {
-    console.log(chalk3.gray("  GitChain initialized (no provenance data available)."));
+    console.log(chalk4.gray("  GitChain initialized (no provenance data available)."));
   }
   console.log();
 }
@@ -651,14 +848,13 @@ function extractRepoName(url) {
 }
 
 // src/commands/verify.ts
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 import { resolve as resolve4 } from "node:path";
 import { existsSync as existsSync4 } from "node:fs";
-import { createHash as createHash5 } from "node:crypto";
 async function verifyCommand(targetPath, options) {
   const resolvedTarget = resolve4(targetPath);
   if (!existsSync4(resolvedTarget)) {
-    console.error(chalk4.red(`Error: Path not found: ${resolvedTarget}`));
+    console.error(chalk5.red(`Error: Path not found: ${resolvedTarget}`));
     process.exit(1);
   }
   const configPath = resolve4(options.path || ".");
@@ -671,11 +867,11 @@ async function verifyCommand(targetPath, options) {
     walletPath = config.walletPath;
     programId = config.programId;
   }
-  console.log(chalk4.gray("Fingerprinting target code..."));
+  console.log(chalk5.gray("Fingerprinting target code..."));
   const suspectFingerprint = await fingerprintDirectory(resolvedTarget);
-  console.log(chalk4.gray(`  Files: ${suspectFingerprint.fileCount}`));
-  console.log(chalk4.gray(`  Merkle root: ${suspectFingerprint.merkleRoot.substring(0, 16)}...`));
-  console.log(chalk4.gray("\nFetching on-chain lineage records..."));
+  console.log(chalk5.gray(`  Files: ${suspectFingerprint.fileCount}`));
+  console.log(chalk5.gray(`  Merkle root: ${suspectFingerprint.merkleRoot.substring(0, 16)}...`));
+  console.log(chalk5.gray("\nFetching on-chain lineage records..."));
   const keypair = loadKeypair(walletPath);
   const connection = getConnection(rpcUrl);
   const program2 = getProgram(connection, keypair);
@@ -683,138 +879,119 @@ async function verifyCommand(targetPath, options) {
   try {
     allProjects = await fetchAllProjectsViaProgram(program2);
   } catch (err) {
-    console.error(chalk4.red(`Failed to fetch on-chain records: ${err.message}`));
+    console.error(chalk5.red(`Failed to fetch on-chain records: ${err.message}`));
     process.exit(1);
   }
   if (allProjects.length === 0) {
-    console.log(chalk4.yellow("\nNo projects registered on-chain yet."));
-    console.log(chalk4.gray("Register a project first with 'gitchain publish'."));
+    console.log(chalk5.yellow("\nNo projects registered on-chain yet."));
+    console.log(chalk5.gray("Register a project first with 'gitchain publish'."));
     return;
   }
-  console.log(chalk4.gray(`  Found ${allProjects.length} registered project(s)
+  console.log(chalk5.gray(`  Found ${allProjects.length} registered project(s)
 `));
-  let bestMatch = null;
+  const allFileHashRegs = await fetchAllFileHashRegistries(program2);
+  const fileHashMap = /* @__PURE__ */ new Map();
+  for (const reg of allFileHashRegs) {
+    const projectKey = reg.account.project.toString();
+    const hashes = reg.account.hashes.map(
+      (h) => Buffer.from(h).toString("hex")
+    );
+    fileHashMap.set(projectKey, hashes);
+  }
+  const projectsWithHashes = [];
   for (const item of allProjects) {
-    const pubkey = item.publicKey ?? item.pubkey;
+    const pubkey = item.pubkey.toString();
     const account = item.account;
-    const onChainMerkle = Buffer.from(account.merkleRoot).toString("hex");
-    const merkleMatch = onChainMerkle === suspectFingerprint.merkleRoot;
-    let fileOverlapPercent = 0;
-    let confidence = 0;
-    if (merkleMatch) {
-      fileOverlapPercent = 100;
-      confidence = 100;
-    } else {
-      const suspectHashesHash = computeFileHashesHash(suspectFingerprint);
-      const onChainHashesHash = Buffer.from(account.fileHashesHash).toString("hex");
-      if (suspectHashesHash === onChainHashesHash) {
-        fileOverlapPercent = 100;
-        confidence = 99;
-      }
-    }
-    const overlapForRanking = merkleMatch ? 100 : fileOverlapPercent;
-    if (!bestMatch || overlapForRanking > bestMatch.fileOverlapPercent) {
-      bestMatch = {
-        projectName: account.projectName,
-        creator: account.creator.toString(),
-        registeredAt: account.registeredAt.toNumber ? account.registeredAt.toNumber() : Number(account.registeredAt),
-        merkleMatch,
-        fileOverlapPercent: overlapForRanking,
-        confidence: merkleMatch ? 100 : confidence,
-        status: merkleMatch ? "Disputed Origin" : fileOverlapPercent >= 90 ? "Disputed Origin" : "Checking...",
-        repoUrl: account.repoUrl || "",
-        pda: pubkey.toString()
-      };
-    }
+    const hashes = fileHashMap.get(pubkey) || [];
+    const registeredAt = account.registeredAt.toNumber ? account.registeredAt.toNumber() : Number(account.registeredAt);
+    projectsWithHashes.push({
+      pubkey,
+      projectName: account.projectName,
+      creator: account.creator.toString(),
+      merkleRoot: Buffer.from(account.merkleRoot).toString("hex"),
+      fileCount: account.fileCount,
+      status: account.status,
+      parentProject: account.parentProject.toString(),
+      originProject: account.originProject.toString(),
+      registeredAt,
+      repoUrl: account.repoUrl || "",
+      fileHashes: hashes
+    });
   }
-  if (bestMatch && bestMatch.fileOverlapPercent === 0) {
-    console.log(chalk4.gray("  No Merkle or commitment match. Trying local comparison...\n"));
-    if (isInitialized(configPath)) {
-      const localFp = await fingerprintDirectory(configPath);
-      const comparison = compareFingerprints(localFp, suspectFingerprint);
-      if (comparison.fileOverlapPercent > (bestMatch?.fileOverlapPercent || 0)) {
-        const config = readConfig(configPath);
-        bestMatch = {
-          projectName: config.projectName,
-          creator: keypair.publicKey.toString(),
-          registeredAt: Date.now() / 1e3,
-          merkleMatch: comparison.merkleMatch,
-          fileOverlapPercent: comparison.fileOverlapPercent,
-          confidence: comparison.confidence,
-          status: comparison.status,
-          repoUrl: "",
-          pda: bestMatch?.pda || "local"
-        };
-      }
-    }
+  const lineageMatch = scanForLineage(suspectFingerprint, projectsWithHashes);
+  let bestMatch = null;
+  if (lineageMatch) {
+    bestMatch = {
+      projectName: lineageMatch.projectName,
+      creator: lineageMatch.creator,
+      registeredAt: lineageMatch.registeredAt,
+      merkleMatch: lineageMatch.merkleMatch,
+      fileOverlapPercent: lineageMatch.overlapPercent,
+      confidence: lineageMatch.confidence,
+      status: lineageMatch.status,
+      repoUrl: lineageMatch.repoUrl,
+      pda: lineageMatch.pubkey
+    };
   }
-  console.log(chalk4.bold("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  console.log(chalk4.bold("\u2551     Lineage Analysis Result          \u2551"));
-  console.log(chalk4.bold("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D\n"));
+  console.log(chalk5.bold("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+  console.log(chalk5.bold("\u2551     Lineage Analysis Result          \u2551"));
+  console.log(chalk5.bold("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D\n"));
   if (!bestMatch || bestMatch.fileOverlapPercent === 0) {
-    console.log(chalk4.green("  Status: No known lineage match found."));
-    console.log(chalk4.gray("  This code does not match any registered project."));
+    console.log(chalk5.green("  Status: No known lineage match found."));
+    console.log(chalk5.gray("  This code does not match any registered project."));
     return;
   }
-  console.log(`  ${chalk4.bold("Closest Known Origin:")} ${bestMatch.projectName}`);
-  console.log(`  ${chalk4.bold("Creator:")}              ${bestMatch.creator.substring(0, 8)}...${bestMatch.creator.substring(bestMatch.creator.length - 4)}`);
-  console.log(`  ${chalk4.bold("Registered:")}           ${new Date(bestMatch.registeredAt * 1e3).toISOString().substring(0, 10)}`);
+  console.log(`  ${chalk5.bold("Closest Known Origin:")} ${bestMatch.projectName}`);
+  console.log(`  ${chalk5.bold("Creator:")}              ${bestMatch.creator.substring(0, 8)}...${bestMatch.creator.substring(bestMatch.creator.length - 4)}`);
+  console.log(`  ${chalk5.bold("Registered:")}           ${new Date(bestMatch.registeredAt * 1e3).toISOString().substring(0, 10)}`);
   if (bestMatch.repoUrl) {
-    console.log(`  ${chalk4.bold("Repo:")}                 ${bestMatch.repoUrl}`);
+    console.log(`  ${chalk5.bold("Repo:")}                 ${bestMatch.repoUrl}`);
   }
-  console.log(chalk4.bold("\n  Signals:"));
+  console.log(chalk5.bold("\n  Signals:"));
   console.log(`    Exact File Overlap:   ${formatPercent(bestMatch.fileOverlapPercent)}`);
-  console.log(`    Merkle Root Match:    ${bestMatch.merkleMatch ? chalk4.red("Yes (exact copy)") : "No"}`);
-  console.log(chalk4.bold("\n  Conclusion:"));
-  const statusColor = bestMatch.fileOverlapPercent >= 60 ? chalk4.red : chalk4.yellow;
-  console.log(`    ${chalk4.bold("Status:")}     ${statusColor(bestMatch.status)}`);
-  console.log(`    ${chalk4.bold("Confidence:")} ${bestMatch.confidence}%
+  console.log(`    Merkle Root Match:    ${bestMatch.merkleMatch ? chalk5.red("Yes (exact copy)") : "No"}`);
+  console.log(chalk5.bold("\n  Conclusion:"));
+  const statusColor = bestMatch.fileOverlapPercent >= 60 ? chalk5.red : chalk5.yellow;
+  console.log(`    ${chalk5.bold("Status:")}     ${statusColor(bestMatch.status)}`);
+  console.log(`    ${chalk5.bold("Confidence:")} ${bestMatch.confidence}%
 `);
 }
 function formatPercent(value) {
   const formatted = `${value.toFixed(1)}%`;
-  if (value >= 90) return chalk4.red(formatted);
-  if (value >= 60) return chalk4.yellow(formatted);
-  if (value >= 30) return chalk4.cyan(formatted);
-  return chalk4.green(formatted);
-}
-function computeFileHashesHash(fp) {
-  const sorted = JSON.stringify(
-    Object.fromEntries(
-      Object.entries(fp.fileHashes).sort(([a], [b]) => a.localeCompare(b))
-    )
-  );
-  return createHash5("sha256").update(sorted).digest("hex");
+  if (value >= 90) return chalk5.red(formatted);
+  if (value >= 60) return chalk5.yellow(formatted);
+  if (value >= 30) return chalk5.cyan(formatted);
+  return chalk5.green(formatted);
 }
 
 // src/commands/status.ts
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 import { resolve as resolve5 } from "node:path";
 import { existsSync as existsSync5 } from "node:fs";
 async function statusCommand(options) {
   const projectPath = resolve5(options.path || ".");
   if (!isInitialized(projectPath)) {
-    console.error(chalk5.red("Error: Not initialized. Run 'gitchain init' first."));
+    console.error(chalk6.red("Error: Not initialized. Run 'gitchain init' first."));
     process.exit(1);
   }
   const config = readConfig(projectPath);
   const provenance = readProvenance(projectPath);
-  console.log(chalk5.bold(`
+  console.log(chalk6.bold(`
 GitChain Status: ${config.projectName}
 `));
   if (!provenance.published) {
-    console.log(chalk5.yellow("  Not published."));
-    console.log(chalk5.gray("  Run 'gitchain publish' to register on Solana.\n"));
+    console.log(chalk6.yellow("  Not published."));
+    console.log(chalk6.gray("  Run 'gitchain publish' to register on Solana.\n"));
     return;
   }
-  console.log(chalk5.gray("  Local State:"));
+  console.log(chalk6.gray("  Local State:"));
   console.log(`    Merkle Root:  ${provenance.merkleRoot?.substring(0, 32)}...`);
   console.log(`    Files:        ${provenance.fileCount}`);
   console.log(`    Published:    ${provenance.publishedAt}`);
   console.log(`    PDA:          ${provenance.pdaAddress}`);
   console.log(`    TX:           ${provenance.txSignature}`);
   if (existsSync5(config.walletPath)) {
-    console.log(chalk5.gray("\n  On-Chain State:"));
+    console.log(chalk6.gray("\n  On-Chain State:"));
     try {
       const keypair = loadKeypair(config.walletPath);
       const connection = getConnection(config.rpcUrl);
@@ -832,11 +1009,123 @@ GitChain Status: ${config.projectName}
         console.log(`    Repo:         ${account.repoUrl}`);
       }
       console.log(
-        chalk5.gray(`
+        chalk6.gray(`
   Explorer: https://explorer.solana.com/address/${pda.toString()}?cluster=devnet`)
       );
     } catch (err) {
-      console.log(chalk5.yellow(`    Could not fetch on-chain data: ${err.message}`));
+      console.log(chalk6.yellow(`    Could not fetch on-chain data: ${err.message}`));
+    }
+  }
+  console.log();
+}
+
+// src/commands/lineage.ts
+import chalk7 from "chalk";
+import { resolve as resolve6 } from "node:path";
+async function lineageCommand(options) {
+  const projectPath = resolve6(options.path || ".");
+  if (!isInitialized(projectPath)) {
+    console.error(chalk7.red("Error: Not initialized. Run 'gitchain init' first."));
+    process.exit(1);
+  }
+  const config = readConfig(projectPath);
+  const provenance = readProvenance(projectPath);
+  if (!provenance.published) {
+    console.log(chalk7.yellow("\nNot published yet. Run 'gitchain publish' first.\n"));
+    return;
+  }
+  console.log(chalk7.bold(`
+Lineage Tree: ${config.projectName}
+`));
+  const keypair = loadKeypair(config.walletPath);
+  const connection = getConnection(config.rpcUrl);
+  const program2 = getProgram(connection, keypair);
+  let allProjects;
+  try {
+    allProjects = await fetchAllProjectsViaProgram(program2);
+  } catch (err) {
+    console.error(chalk7.red(`Failed to fetch on-chain records: ${err.message}`));
+    process.exit(1);
+  }
+  const projectMap = /* @__PURE__ */ new Map();
+  for (const item of allProjects) {
+    const pubkey = item.pubkey.toString();
+    const account = item.account;
+    const registeredAt = account.registeredAt.toNumber ? account.registeredAt.toNumber() : Number(account.registeredAt);
+    projectMap.set(pubkey, {
+      name: account.projectName,
+      creator: account.creator.toString(),
+      status: account.status,
+      parent: account.parentProject.toString(),
+      origin: account.originProject.toString(),
+      registeredAt,
+      repoUrl: account.repoUrl || ""
+    });
+  }
+  const [myPda] = deriveProjectPda(keypair.publicKey, config.projectName);
+  const myPdaStr = myPda.toString();
+  const myProject = projectMap.get(myPdaStr);
+  if (!myProject) {
+    console.log(chalk7.yellow("  Project not found on-chain.\n"));
+    return;
+  }
+  const NULL_KEY = "11111111111111111111111111111111";
+  const chain = [];
+  let currentPda = myPdaStr;
+  const visited = /* @__PURE__ */ new Set();
+  while (currentPda && currentPda !== NULL_KEY && !visited.has(currentPda)) {
+    visited.add(currentPda);
+    const proj = projectMap.get(currentPda);
+    if (!proj) break;
+    chain.push({
+      pda: currentPda,
+      name: proj.name,
+      creator: proj.creator,
+      status: proj.status,
+      registeredAt: proj.registeredAt,
+      repoUrl: proj.repoUrl
+    });
+    currentPda = proj.parent;
+  }
+  const children = [];
+  for (const [pda, proj] of projectMap) {
+    if (proj.parent === myPdaStr && pda !== myPdaStr) {
+      children.push({
+        pda,
+        name: proj.name,
+        creator: proj.creator,
+        status: proj.status,
+        registeredAt: proj.registeredAt
+      });
+    }
+  }
+  if (chain.length <= 1 && children.length === 0) {
+    console.log(chalk7.green("  This project has no known lineage."));
+    console.log(chalk7.gray("  It is an original, standalone project.\n"));
+    return;
+  }
+  const ancestors = chain.slice(1).reverse();
+  if (ancestors.length > 0) {
+    console.log(chalk7.gray("  Ancestry (oldest first):\n"));
+    for (let i = 0; i < ancestors.length; i++) {
+      const a = ancestors[i];
+      const prefix = i === 0 ? "  " : "  " + "  ".repeat(i);
+      const statusLabel = STATUS_LABELS[a.status] || "Unknown";
+      console.log(`${prefix}${chalk7.bold(a.name)} ${chalk7.gray(`(${statusLabel})`)}`);
+      console.log(`${prefix}${chalk7.gray(`by ${a.creator.substring(0, 8)}... | ${new Date(a.registeredAt * 1e3).toISOString().substring(0, 10)}`)}`);
+      console.log(`${prefix}${chalk7.gray("\u2502")}`);
+    }
+  }
+  const indent = ancestors.length > 0 ? "  " + "  ".repeat(ancestors.length) : "  ";
+  const myStatus = STATUS_LABELS[myProject.status] || "Unknown";
+  console.log(`${indent}${chalk7.bold.cyan(`\u25BA ${config.projectName}`)} ${chalk7.gray(`(${myStatus})`)}`);
+  console.log(`${indent}${chalk7.gray(`  by ${myProject.creator.substring(0, 8)}... | ${new Date(myProject.registeredAt * 1e3).toISOString().substring(0, 10)}`)}`);
+  if (children.length > 0) {
+    console.log(`${indent}${chalk7.gray("\u2502")}`);
+    for (const child of children) {
+      const childStatus = STATUS_LABELS[child.status] || "Unknown";
+      console.log(`${indent}\u251C\u2500\u2500 ${chalk7.yellow(child.name)} ${chalk7.gray(`(${childStatus})`)}`);
+      console.log(`${indent}\u2502   ${chalk7.gray(`by ${child.creator.substring(0, 8)}... | ${new Date(child.registeredAt * 1e3).toISOString().substring(0, 10)}`)}`);
     }
   }
   console.log();
@@ -844,10 +1133,11 @@ GitChain Status: ${config.projectName}
 
 // src/index.ts
 var program = new Command();
-program.name("gitchain").description("Software provenance & lineage protocol on Solana").version("0.1.0");
+program.name("gitchain").description("Software provenance & lineage protocol on Solana").version("0.2.0");
 program.command("init").description("Initialize GitChain tracking for this repository").option("-p, --path <path>", "Path to Git repository", ".").action(initCommand);
 program.command("publish <remote> <branch>").description("Fingerprint, register on Solana, then push to remote").option("-p, --path <path>", "Path to Git repository", ".").action(publishCommand);
 program.command("clone <url>").description("Check on-chain provenance, then clone repository").option("-d, --directory <dir>", "Target directory for clone").action(cloneCommand);
 program.command("verify <target-path>").description("Verify code against on-chain lineage records").option("-p, --path <path>", "Path to initialized GitChain project for config", ".").action(verifyCommand);
 program.command("status").description("Show GitChain provenance status").option("-p, --path <path>", "Path to GitChain project", ".").action(statusCommand);
+program.command("lineage").description("Show lineage tree for this project").option("-p, --path <path>", "Path to GitChain project", ".").action(lineageCommand);
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitchain-sol",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Software provenance & lineage protocol on Solana — fingerprint, register, and verify code on-chain",
   "type": "module",
   "bin": {