soulprint-network 0.3.3 → 0.3.5

package/dist/code-hash.json

@@ -0,0 +1,25 @@
+{
+  "codeHash": "559c4b6036fc59ae758016efba130d9147d8a89d5f43aff68a0a00e788aec761",
+  "codeHashHex": "0x559c4b6036fc59ae758016efba130d9147d8a89d5f43aff68a0a00e788aec761",
+  "computedAt": "2026-02-24T21:00:59.352Z",
+  "fileCount": 17,
+  "files": [
+    "blockchain/blockchain-anchor.ts",
+    "blockchain/blockchain-client.ts",
+    "code-integrity.ts",
+    "consensus/attestation-consensus.ts",
+    "consensus/index.ts",
+    "consensus/nullifier-consensus.ts",
+    "consensus/state-sync.ts",
+    "credentials/email.ts",
+    "credentials/github.ts",
+    "credentials/index.ts",
+    "credentials/phone.ts",
+    "crypto/gossip-cipher.ts",
+    "crypto/peer-router.ts",
+    "index.ts",
+    "p2p.ts",
+    "server.ts",
+    "validator.ts"
+  ]
+}

package/dist/code-integrity.d.ts

@@ -0,0 +1,44 @@
+/**
+ * code-integrity.ts — Fix 2: Runtime code integrity verification
+ *
+ * Carga el hash computado en build-time y lo expone para:
+ *  1. Logging al arranque del nodo
+ *  2. GET /health (peers pueden verificar)
+ *  3. Comparación con hashes aprobados on-chain por governance
+ *
+ * GARANTÍA:
+ *  - Si alguien modifica src/ y recompila → el hash cambia
+ *  - Los peers pueden detectar que un nodo corre código diferente
+ *  - El GovernanceModule puede registrar hashes aprobados on-chain
+ *  - Si el hash no coincide con el aprobado → el nodo queda marcado como no confiable
+ *
+ * LIMITACIÓN (sin TEE):
+ *  - Un atacante con root puede modificar dist/ directamente o falsificar el hash
+ *  - La protección completa requiere TEE (Intel SGX / AMD SEV) — fase futura
+ */
+export interface CodeIntegrityInfo {
+    codeHash: string;
+    codeHashHex: string;
+    computedAt: string;
+    fileCount: number;
+    available: boolean;
+}
+/**
+ * Carga el code-hash.json generado en build time.
+ */
+export declare function getCodeIntegrity(): CodeIntegrityInfo;
+/**
+ * Verifica que el code hash del nodo actual coincide con uno aprobado.
+ * @param approvedHashes  Lista de hashes aprobados por governance
+ * @returns true si el hash actual está en la lista de aprobados
+ */
+export declare function isCodeApproved(approvedHashes: (string | null | undefined)[]): boolean;
+/**
+ * Computa un hash rápido del propio binario en tiempo real (fallback).
+ * Menos preciso que el hash del código fuente pero no requiere build step.
+ */
+export declare function computeRuntimeHash(): string;
+/**
+ * Log de integridad al arranque — llamar desde startServer().
+ */
+export declare function logCodeIntegrity(): void;

package/dist/code-integrity.js

@@ -0,0 +1,108 @@
+/**
+ * code-integrity.ts — Fix 2: Runtime code integrity verification
+ *
+ * Carga el hash computado en build-time y lo expone para:
+ *  1. Logging al arranque del nodo
+ *  2. GET /health (peers pueden verificar)
+ *  3. Comparación con hashes aprobados on-chain por governance
+ *
+ * GARANTÍA:
+ *  - Si alguien modifica src/ y recompila → el hash cambia
+ *  - Los peers pueden detectar que un nodo corre código diferente
+ *  - El GovernanceModule puede registrar hashes aprobados on-chain
+ *  - Si el hash no coincide con el aprobado → el nodo queda marcado como no confiable
+ *
+ * LIMITACIÓN (sin TEE):
+ *  - Un atacante con root puede modificar dist/ directamente o falsificar el hash
+ *  - La protección completa requiere TEE (Intel SGX / AMD SEV) — fase futura
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+const __dir = dirname(fileURLToPath(import.meta.url));
+let _cached = null;
+/**
+ * Carga el code-hash.json generado en build time.
+ */
+export function getCodeIntegrity() {
+    if (_cached)
+        return _cached;
+    const hashFile = join(__dir, "code-hash.json");
+    if (!existsSync(hashFile)) {
+        _cached = {
+            codeHash: "unavailable",
+            codeHashHex: "0x0000000000000000000000000000000000000000000000000000000000000000",
+            computedAt: new Date().toISOString(),
+            fileCount: 0,
+            available: false,
+        };
+        return _cached;
+    }
+    try {
+        const raw = JSON.parse(readFileSync(hashFile, "utf8"));
+        _cached = {
+            codeHash: raw.codeHash ?? "unknown",
+            codeHashHex: raw.codeHashHex ?? ("0x" + raw.codeHash),
+            computedAt: raw.computedAt ?? "unknown",
+            fileCount: raw.fileCount ?? 0,
+            available: true,
+        };
+    }
+    catch {
+        _cached = {
+            codeHash: "parse-error",
+            codeHashHex: "0x0000000000000000000000000000000000000000000000000000000000000001",
+            computedAt: new Date().toISOString(),
+            fileCount: 0,
+            available: false,
+        };
+    }
+    return _cached;
+}
+/**
+ * Verifica que el code hash del nodo actual coincide con uno aprobado.
+ * @param approvedHashes  Lista de hashes aprobados por governance
+ * @returns true si el hash actual está en la lista de aprobados
+ */
+export function isCodeApproved(approvedHashes) {
+    const info = getCodeIntegrity();
+    if (!info.available)
+        return false;
+    const h = info.codeHash.toLowerCase().replace("0x", "");
+    return approvedHashes.some(a => {
+        if (a == null || typeof a !== "string")
+            return false;
+        return a.toLowerCase().replace("0x", "") === h;
+    });
+}
+/**
+ * Computa un hash rápido del propio binario en tiempo real (fallback).
+ * Menos preciso que el hash del código fuente pero no requiere build step.
+ */
+export function computeRuntimeHash() {
+    try {
+        const selfPath = join(__dir, "validator.js");
+        if (!existsSync(selfPath))
+            return "no-binary";
+        const content = readFileSync(selfPath);
+        return createHash("sha256").update(content).digest("hex");
+    }
+    catch {
+        return "hash-error";
+    }
+}
+/**
+ * Log de integridad al arranque — llamar desde startServer().
+ */
+export function logCodeIntegrity() {
+    const info = getCodeIntegrity();
+    if (info.available) {
+        console.log(`[integrity] ✅ Code hash: ${info.codeHash.slice(0, 16)}... (${info.fileCount} files)`);
+        console.log(`[integrity]    Built at:  ${info.computedAt}`);
+    }
+    else {
+        console.warn(`[integrity] ⚠️  Code hash unavailable — run 'pnpm build' to compute`);
+        console.warn(`[integrity]    Without a code hash, peers cannot verify this node's integrity`);
+    }
+}

package/dist/validator.js

@@ -10,6 +10,7 @@ import { selectGossipPeers, routingStats } from "./crypto/peer-router.js";
 import { NullifierConsensus, AttestationConsensus, StateSyncManager } from "./consensus/index.js";
 import { BlockchainAnchor } from "./blockchain/blockchain-anchor.js";
 import { SoulprintBlockchainClient, loadBlockchainConfig, } from "./blockchain/blockchain-client.js";
+import { getCodeIntegrity, logCodeIntegrity, computeRuntimeHash } from "./code-integrity.js";
 import { publishAttestationP2P, onAttestationReceived, getP2PStats, } from "./p2p.js";
 // ── Config ────────────────────────────────────────────────────────────────────
 const PORT = parseInt(process.env.SOULPRINT_PORT ?? String(PROTOCOL.DEFAULT_HTTP_PORT));
@@ -748,6 +749,28 @@ export function startValidatorNode(port = PORT) {
             return handleGetReputation(res, decodeURIComponent(cleanUrl.replace("/reputation/", "")));
         if (cleanUrl.startsWith("/nullifier/") && req.method === "GET")
             return handleNullifierCheck(res, decodeURIComponent(cleanUrl.replace("/nullifier/", "")));
+        // ── Code integrity + health ───────────────────────────────────────────────
+        if (cleanUrl === "/health" && req.method === "GET") {
+            const integrity = getCodeIntegrity();
+            const govHash = await client?.getCurrentApprovedHash() ?? null;
+            return json(res, 200, {
+                status: "ok",
+                version: VERSION,
+                protocolHash: PROTOCOL_HASH,
+                codeHash: integrity.codeHash,
+                codeHashHex: integrity.codeHashHex,
+                codeHashAvailable: integrity.available,
+                codeBuiltAt: integrity.computedAt,
+                codeFileCount: integrity.fileCount,
+                runtimeHash: computeRuntimeHash(),
+                governanceApprovedHash: govHash,
+                blockchainConnected: !!client?.isConnected,
+                nodeCompatible: !govHash ||
+                    govHash.toLowerCase() === ("0x" + PROTOCOL_HASH).toLowerCase(),
+                uptime: process.uptime(),
+                ts: Date.now(),
+            });
+        }
         // ── Blockchain anchor status ──────────────────────────────────────────────
         if (cleanUrl === "/anchor/stats" && req.method === "GET") {
             return json(res, 200, anchor.getStats());
@@ -890,6 +913,7 @@ export function startValidatorNode(port = PORT) {
         json(res, 404, { error: "Not found" });
     });
     server.listen(port, () => {
+        logCodeIntegrity();
         console.log(`\n🌐 Soulprint Validator Node v${VERSION}`);
         console.log(`   Node DID:     ${nodeKeypair.did}`);
         console.log(`   Listening:    http://0.0.0.0:${port}`);
@@ -900,6 +924,7 @@ export function startValidatorNode(port = PORT) {
         console.log(`   Known peers:  ${peers.length}`);
         console.log(`\n   Core endpoints:`);
         console.log(`   POST /verify              verify ZK proof + co-sign`);
+        console.log(`   GET  /health              code integrity + governance status`);
         console.log(`   GET  /info                node info`);
         console.log(`   GET  /protocol            protocol constants (immutable)`);
         console.log(`   GET  /nullifier/:n        anti-sybil check`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soulprint-network",
-  "version": "0.3.3",
-  "description": "Soulprint validator node — HTTP server that verifies ZK proofs, co-signs SPTs, anti-Sybil registry",
+  "version": "0.3.5",
+  "description": "Soulprint validator node \u2014 HTTP server that verifies ZK proofs, co-signs SPTs, anti-Sybil registry",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
@@ -12,8 +12,9 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc",
-    "start": "node dist/server.js"
+    "build": "tsc && node scripts/compute-code-hash.mjs",
+    "start": "node dist/server.js",
+    "build:hash": "node scripts/compute-code-hash.mjs"
   },
   "publishConfig": {
     "access": "public"
@@ -67,4 +68,4 @@
       "types": "./dist/index.d.ts"
     }
   }
-}
+}