proofseal 0.0.1 → 0.1.0

package/dist/history/jsonl.js

@@ -0,0 +1,71 @@
+/**
+ * Append-only JSONL history (proofs/history.jsonl) — ADR-0001 §5.5.
+ *
+ * JSONL hygiene (extraction-map pitfall 9): reads tolerate blank lines
+ * and a missing trailing newline; writes emit exactly one '\n' per line;
+ * parse errors surface 1-indexed line numbers.
+ */
+import { appendFileSync, existsSync, readFileSync } from 'node:fs';
+/** Was this claim verified at seal time? (per-type semantics) */
+export function claimVerified(claim) {
+    switch (claim.type) {
+        case 'file-hash':
+            return !!claim.sha256;
+        case 'marker':
+            return claim.markerVerified === true;
+        case 'harness':
+            return !!claim.expectedSha256;
+    }
+}
+function claimSnapshotHash(claim) {
+    if (claim.type === 'harness')
+        return claim.expectedSha256 ?? '';
+    return claim.sha256 ?? '';
+}
+/** Append a compact snapshot of a sealed manifest. Exactly one '\n' per line. */
+export function appendHistory(historyPath, manifest, manifestHash) {
+    const claims = {};
+    for (const c of manifest.claims) {
+        claims[c.id] = { sha256: claimSnapshotHash(c), verified: claimVerified(c) };
+    }
+    const entry = {
+        v: 1,
+        commit: manifest.gitCommit,
+        issuedAt: manifest.issuedAt,
+        branch: manifest.branch,
+        manifestHash,
+        summary: manifest.summary,
+        claims,
+    };
+    const line = JSON.stringify(entry);
+    if (/[\r\n]/.test(line)) {
+        throw new Error('history entry serialized with embedded newline — refusing to corrupt JSONL');
+    }
+    appendFileSync(historyPath, line + '\n');
+    return entry;
+}
+/**
+ * Load JSONL history in FILE order. File order is not chronology (union
+ * merges can interleave branches) — queries sort by issuedAt via
+ * sortByIssuedAt(). Tolerates blank lines / no trailing newline.
+ */
+export function loadHistory(historyPath) {
+    if (!existsSync(historyPath))
+        return [];
+    const raw = readFileSync(historyPath, 'utf8');
+    const out = [];
+    const lines = raw.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i].replace(/\r$/, '').trim();
+        if (!line)
+            continue; // blank lines tolerated
+        try {
+            out.push(JSON.parse(line));
+        }
+        catch (e) {
+            throw new Error(`history parse error at line ${i + 1}: ${e.message}`);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=jsonl.js.map

package/dist/history/jsonl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonl.js","sourceRoot":"","sources":["../../src/history/jsonl.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAkBnE,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,KAAiC;IAC7D,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW;YACd,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC;QACvC,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiC;IAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;IAChE,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,QAAkB,EAAE,YAAoB;IACzF,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAiB;QAC1B,CAAC,EAAE,CAAC;QACJ,MAAM,EAAE,QAAQ,CAAC,SAAS;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,YAAY;QACZ,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM;KACP,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,cAAc,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,wBAAwB;QAC7C,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/history/queries.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Temporal history queries — ported from ruflo witness lib.mjs
+ * (fixTimeline, diffLatest, findRegressionIntroductions), generalized
+ * from fixes to claims.
+ */
+import type { HistoryEntry } from './jsonl.js';
+/**
+ * Chronological order = `issuedAt` (ISO 8601 → lexicographic compare), with
+ * file order as the tie-break. Raw file-line order is NOT chronology: two
+ * branches sealing concurrently and union-merging proofs/history.jsonl can
+ * interleave lines arbitrarily. Stable sort keeps same-timestamp entries in
+ * file order.
+ */
+export declare function sortByIssuedAt(history: HistoryEntry[]): HistoryEntry[];
+export interface RegressionIntroduction {
+    id: string;
+    lastPassCommit: string | null;
+    lastPassIssuedAt: string | null;
+    regressedAtCommit: string;
+    regressedAtIssuedAt: string;
+}
+/**
+ * For each claim currently regressed (verified=false in the latest entry),
+ * walk backwards to the most recent pass; the entry after it localizes
+ * the regression-introducing commit range. "Latest" = max issuedAt, not
+ * last file line (see sortByIssuedAt).
+ */
+export declare function findRegressionIntroductions(unordered: HistoryEntry[]): RegressionIntroduction[];
+export interface TimelinePoint {
+    commit: string;
+    issuedAt: string;
+    status: 'pass' | 'regressed' | 'absent';
+}
+/** Status timeline for a single claim across all history entries (issuedAt order). */
+export declare function fixTimeline(unordered: HistoryEntry[], claimId: string): TimelinePoint[];
+export interface LatestDiff {
+    newlyRegressed: string[];
+    newlyPassing: string[];
+    added: string[];
+    removed: string[];
+}
+/** Compare the latest entry to the previous (by issuedAt) and report transitions. */
+export declare function diffLatest(unordered: HistoryEntry[]): LatestDiff;

package/dist/history/queries.js

@@ -0,0 +1,86 @@
+/**
+ * Chronological order = `issuedAt` (ISO 8601 → lexicographic compare), with
+ * file order as the tie-break. Raw file-line order is NOT chronology: two
+ * branches sealing concurrently and union-merging proofs/history.jsonl can
+ * interleave lines arbitrarily. Stable sort keeps same-timestamp entries in
+ * file order.
+ */
+export function sortByIssuedAt(history) {
+    return history
+        .map((entry, fileIndex) => ({ entry, fileIndex }))
+        .sort((a, b) => {
+        if (a.entry.issuedAt < b.entry.issuedAt)
+            return -1;
+        if (a.entry.issuedAt > b.entry.issuedAt)
+            return 1;
+        return a.fileIndex - b.fileIndex;
+    })
+        .map((x) => x.entry);
+}
+/**
+ * For each claim currently regressed (verified=false in the latest entry),
+ * walk backwards to the most recent pass; the entry after it localizes
+ * the regression-introducing commit range. "Latest" = max issuedAt, not
+ * last file line (see sortByIssuedAt).
+ */
+export function findRegressionIntroductions(unordered) {
+    if (unordered.length === 0)
+        return [];
+    const history = sortByIssuedAt(unordered);
+    const latest = history[history.length - 1];
+    const out = [];
+    for (const [id, state] of Object.entries(latest.claims)) {
+        if (state.verified)
+            continue;
+        let lastPass = null;
+        let regressedAt = latest;
+        for (let i = history.length - 2; i >= 0; i--) {
+            const e = history[i];
+            const s = e.claims[id];
+            if (s && s.verified) {
+                lastPass = e;
+                break;
+            }
+            regressedAt = e;
+        }
+        out.push({
+            id,
+            lastPassCommit: lastPass?.commit ?? null,
+            lastPassIssuedAt: lastPass?.issuedAt ?? null,
+            regressedAtCommit: regressedAt.commit,
+            regressedAtIssuedAt: regressedAt.issuedAt,
+        });
+    }
+    return out;
+}
+/** Status timeline for a single claim across all history entries (issuedAt order). */
+export function fixTimeline(unordered, claimId) {
+    return sortByIssuedAt(unordered).map((e) => ({
+        commit: e.commit,
+        issuedAt: e.issuedAt,
+        status: e.claims[claimId] ? (e.claims[claimId].verified ? 'pass' : 'regressed') : 'absent',
+    }));
+}
+/** Compare the latest entry to the previous (by issuedAt) and report transitions. */
+export function diffLatest(unordered) {
+    if (unordered.length < 2)
+        return { newlyRegressed: [], newlyPassing: [], added: [], removed: [] };
+    const history = sortByIssuedAt(unordered);
+    const prev = history[history.length - 2];
+    const curr = history[history.length - 1];
+    const diff = { newlyRegressed: [], newlyPassing: [], added: [], removed: [] };
+    for (const id of Object.keys(curr.claims)) {
+        if (!(id in prev.claims))
+            diff.added.push(id);
+        else if (prev.claims[id].verified && !curr.claims[id].verified)
+            diff.newlyRegressed.push(id);
+        else if (!prev.claims[id].verified && curr.claims[id].verified)
+            diff.newlyPassing.push(id);
+    }
+    for (const id of Object.keys(prev.claims)) {
+        if (!(id in curr.claims))
+            diff.removed.push(id);
+    }
+    return diff;
+}
+//# sourceMappingURL=queries.js.map

package/dist/history/queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../src/history/queries.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB;IACpD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;SACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAyB;IACnE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC7B,IAAI,QAAQ,GAAwB,IAAI,CAAC;QACzC,IAAI,WAAW,GAAiB,MAAM,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACpB,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;YACD,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,cAAc,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI;YACxC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI;YAC5C,iBAAiB,EAAE,WAAW,CAAC,MAAM;YACrC,mBAAmB,EAAE,WAAW,CAAC,QAAQ;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,SAAyB,EAAE,OAAe;IACpE,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ;KAC3F,CAAC,CAAC,CAAC;AACN,CAAC;AASD,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,SAAyB;IAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClG,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAe,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1F,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aACzC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aACxF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ;YAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * ProofSeal public library API (ADR-0001 §4.3 — published contract).
+ * CLI and MCP server are thin wrappers over these exports.
+ */
+export { canonicalize } from './core/canonical.js';
+export { sha256Hex, sha256Bytes, fileSha256, fileSha256CrlfNormalized, fileContains, markerPresent, markerOccurrences } from './core/hash.js';
+export { normalizeClaimPath } from './core/paths.js';
+export { lintMarker } from './core/marker-lint.js';
+export { deriveKey, signBytes, verifyBytes, SEED_DERIVATION, type DerivedKey } from './keys/derive.js';
+export { seal, refreshClaim, type SealOptions, type SealResult, type SealWarning } from './manifest/seal.js';
+export { verify, checkSignature, classifyFileClaim, toVerifyJson, THREAT_MODEL_NOTE, CRLF_DETAIL, REFERENCE_VECTOR_HINT, type VerifyOptions, type VerifyResult, type VerifyJson, type ClaimResult, type VerifySummary, type SignatureCheck, } from './manifest/verify.js';
+export { SCHEMA_ID, ClaimSchema, ManifestSchema, PlatformSchema, WitnessSchema, ConfigSchema, type ManifestPlatform, type Claim, type ClaimState, type ClaimStatus, type FileHashClaim, type MarkerClaim, type HarnessClaim, type Manifest, type ManifestSummary, type Witness, type Integrity, type Tolerance, type ProofSealConfig, } from './manifest/schema.js';
+export { loadHistory, appendHistory, claimVerified, type HistoryEntry, type HistoryClaimState, } from './history/jsonl.js';
+export { fixTimeline, diffLatest, findRegressionIntroductions, sortByIssuedAt, type TimelinePoint, type LatestDiff, type RegressionIntroduction, } from './history/queries.js';
+export { enrichRegressionsWithGit, UNREACHABLE_TAG, type RegressionGitInfo, type EnrichedRegression, } from './history/gitinfo.js';
+export { runHarness, parseNumericOutput, type HarnessDef, type HarnessResult, type HarnessStatus, } from './harness/run.js';
+export { roundHalfEven, quantizeValues, packLEFloat64, hashQuantized, allClose, DEFAULT_DECIMALS, DEFAULT_TOLERANCE, type AllCloseResult, } from './harness/quantize.js';
+export { loadConfig, saveConfig, defaultConfig, CONFIG_FILENAME, type ResolvedConfig, } from './config.js';

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * ProofSeal public library API (ADR-0001 §4.3 — published contract).
+ * CLI and MCP server are thin wrappers over these exports.
+ */
+export { canonicalize } from './core/canonical.js';
+export { sha256Hex, sha256Bytes, fileSha256, fileSha256CrlfNormalized, fileContains, markerPresent, markerOccurrences } from './core/hash.js';
+export { normalizeClaimPath } from './core/paths.js';
+export { lintMarker } from './core/marker-lint.js';
+export { deriveKey, signBytes, verifyBytes, SEED_DERIVATION } from './keys/derive.js';
+export { seal, refreshClaim } from './manifest/seal.js';
+export { verify, checkSignature, classifyFileClaim, toVerifyJson, THREAT_MODEL_NOTE, CRLF_DETAIL, REFERENCE_VECTOR_HINT, } from './manifest/verify.js';
+export { SCHEMA_ID, ClaimSchema, ManifestSchema, PlatformSchema, WitnessSchema, ConfigSchema, } from './manifest/schema.js';
+export { loadHistory, appendHistory, claimVerified, } from './history/jsonl.js';
+export { fixTimeline, diffLatest, findRegressionIntroductions, sortByIssuedAt, } from './history/queries.js';
+export { enrichRegressionsWithGit, UNREACHABLE_TAG, } from './history/gitinfo.js';
+export { runHarness, parseNumericOutput, } from './harness/run.js';
+export { roundHalfEven, quantizeValues, packLEFloat64, hashQuantized, allClose, DEFAULT_DECIMALS, DEFAULT_TOLERANCE, } from './harness/quantize.js';
+export { loadConfig, saveConfig, defaultConfig, CONFIG_FILENAME, } from './config.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC9I,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAmB,MAAM,kBAAkB,CAAC;AAEvG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAuD,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EACL,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,qBAAqB,GAOtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EACT,WAAW,EACX,cAAc,EACd,cAAc,EACd,aAAa,EACb,YAAY,GAcb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,WAAW,EACX,aAAa,EACb,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,UAAU,EACV,2BAA2B,EAC3B,cAAc,GAIf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,UAAU,EACV,kBAAkB,GAInB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,aAAa,EACb,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,eAAe,GAEhB,MAAM,aAAa,CAAC"}

package/dist/keys/derive.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Deterministic, commit-bound Ed25519 keys — zero key management.
+ *
+ *   seed      = sha256(gitCommit + ':' + salt + ':proofseal/v1')
+ *   privKey   = PKCS#8(seed)        (node:crypto raw-seed import)
+ *   publicKey = SPKI DER last 32 bytes, lowercase hex
+ *
+ * IMPORTANT (threat model): anyone at the same commit can re-derive the
+ * private key. This is tamper-EVIDENCE bound to a git commit, NOT
+ * third-party authentication. The salt prevents cross-repo manifest
+ * splicing between forks at identical commits.
+ */
+import { type KeyObject } from 'node:crypto';
+export declare const SEED_DERIVATION = "sha256(gitCommit + ':' + salt + ':proofseal/v1')";
+export interface DerivedKey {
+    /** 32-byte raw seed. */
+    seed: Buffer;
+    /** Raw Ed25519 public key, lowercase hex (64 chars). */
+    publicKeyHex: string;
+    /** node:crypto private key object, ready for sign(). */
+    privateKey: KeyObject;
+}
+/** Derive the commit-bound Ed25519 keypair for a repo. */
+export declare function deriveKey(gitCommit: string, salt: string): DerivedKey;
+/** Ed25519-sign raw message bytes; returns lowercase hex (128 chars). */
+export declare function signBytes(privateKey: KeyObject, message: Buffer): string;
+/** Verify an Ed25519 signature (hex) over raw message bytes with a raw hex pubkey. */
+export declare function verifyBytes(publicKeyHex: string, message: Buffer, signatureHex: string): boolean;

package/dist/keys/derive.js

@@ -0,0 +1,59 @@
+/**
+ * Deterministic, commit-bound Ed25519 keys — zero key management.
+ *
+ *   seed      = sha256(gitCommit + ':' + salt + ':proofseal/v1')
+ *   privKey   = PKCS#8(seed)        (node:crypto raw-seed import)
+ *   publicKey = SPKI DER last 32 bytes, lowercase hex
+ *
+ * IMPORTANT (threat model): anyone at the same commit can re-derive the
+ * private key. This is tamper-EVIDENCE bound to a git commit, NOT
+ * third-party authentication. The salt prevents cross-repo manifest
+ * splicing between forks at identical commits.
+ */
+import { createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify, createHash, } from 'node:crypto';
+/** PKCS#8 DER prefix for a raw 32-byte Ed25519 seed. */
+const PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
+/** SPKI DER prefix for a raw 32-byte Ed25519 public key. */
+const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+export const SEED_DERIVATION = "sha256(gitCommit + ':' + salt + ':proofseal/v1')";
+/** Derive the commit-bound Ed25519 keypair for a repo. */
+export function deriveKey(gitCommit, salt) {
+    const seed = createHash('sha256')
+        .update(`${gitCommit}:${salt}:proofseal/v1`)
+        .digest();
+    const privateKey = createPrivateKey({
+        key: Buffer.concat([PKCS8_PREFIX, seed]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    const publicKey = createPublicKey(privateKey);
+    const der = publicKey.export({ format: 'der', type: 'spki' });
+    return {
+        seed,
+        publicKeyHex: der.subarray(der.length - 32).toString('hex'),
+        privateKey,
+    };
+}
+/** Ed25519-sign raw message bytes; returns lowercase hex (128 chars). */
+export function signBytes(privateKey, message) {
+    return cryptoSign(null, message, privateKey).toString('hex');
+}
+/** Verify an Ed25519 signature (hex) over raw message bytes with a raw hex pubkey. */
+export function verifyBytes(publicKeyHex, message, signatureHex) {
+    if (!/^[0-9a-f]{64}$/.test(publicKeyHex))
+        return false;
+    if (!/^[0-9a-f]{128}$/.test(signatureHex))
+        return false;
+    try {
+        const publicKey = createPublicKey({
+            key: Buffer.concat([SPKI_PREFIX, Buffer.from(publicKeyHex, 'hex')]),
+            format: 'der',
+            type: 'spki',
+        });
+        return cryptoVerify(null, message, publicKey, Buffer.from(signatureHex, 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=derive.js.map

package/dist/keys/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../src/keys/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,IAAI,IAAI,UAAU,EAClB,MAAM,IAAI,YAAY,EACtB,UAAU,GAEX,MAAM,aAAa,CAAC;AAErB,wDAAwD;AACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AAC5E,4DAA4D;AAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,eAAe,GAAG,kDAAkD,CAAC;AAWlF,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,eAAe,CAAC;SAC3C,MAAM,EAAE,CAAC;IACZ,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAW,CAAC;IACxE,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3D,UAAU;KACX,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,UAAqB,EAAE,OAAe;IAC9D,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,YAAoB,EAAE,OAAe,EAAE,YAAoB;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC;YAChC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}