zeropoint-node 1.0.1 → 1.0.3

package/src/integrity/content-uuid.ts

@@ -0,0 +1,123 @@
+/**
+ * Content-addressable UUID — learned from erpax Law 8.
+ * JCS → SHA-256 → uuidv8. FNV toUuid stays in src/0 for cheap folds;
+ * this module seals cryptographic identity for proofs/manifests.
+ */
+
+import { createHash } from 'node:crypto'
+import { merge, toUuid } from '../0/index.ts'
+
+export type ContentUuid<T> = string & { readonly __contentUuidOf: T }
+
+export const NON_CONTENT_FIELDS: ReadonlySet<string> = new Set([
+  'uuid',
+  'id',
+  'createdAt',
+  'updatedAt',
+  '_status',
+  '_version',
+  'autosave',
+])
+
+export const ZEROPOINT_NAMESPACE_ROOT = '6ba7b810-9dad-11d1-80b4-00c04fd430c8'
+
+export function jcsCanonicalize(value: unknown): string {
+  if (value === null) return 'null'
+  if (typeof value === 'boolean') return value ? 'true' : 'false'
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) throw new Error('jcsCanonicalize: non-finite number')
+    return JSON.stringify(value)
+  }
+  if (typeof value === 'string') return JSON.stringify(value)
+  if (Array.isArray(value)) {
+    return '[' + value.map(jcsCanonicalize).join(',') + ']'
+  }
+  if (typeof value === 'object') {
+    const obj = value as Record<string, unknown>
+    const keys = Object.keys(obj)
+      .filter((k) => obj[k] !== undefined)
+      .sort()
+    return '{' + keys.map((k) => JSON.stringify(k) + ':' + jcsCanonicalize(obj[k])).join(',') + '}'
+  }
+  throw new Error(`jcsCanonicalize: unsupported value type ${typeof value}`)
+}
+
+export function stripNonContentFields<T extends Record<string, unknown>>(
+  obj: T,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(obj)) {
+    if (NON_CONTENT_FIELDS.has(k)) continue
+    out[k] = v
+  }
+  return out
+}
+
+function bytesToUuidString(bytes: Buffer): string {
+  const hex = bytes.toString('hex')
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20, 32),
+  ].join('-')
+}
+
+function nameHashBytes(namespaceUuid: string, name: string): Buffer {
+  const nsBytes = Buffer.from(namespaceUuid.replace(/-/g, ''), 'hex')
+  if (nsBytes.length !== 16) throw new Error(`invalid namespace UUID: ${namespaceUuid}`)
+  return createHash('sha256').update(nsBytes).update(Buffer.from(name, 'utf8')).digest()
+}
+
+export function nameUuid(namespaceUuid: string, name: string): string {
+  const bytes = Buffer.from(nameHashBytes(namespaceUuid, name).subarray(0, 16))
+  bytes[6] = (bytes[6]! & 0x0f) | 0x80
+  bytes[8] = (bytes[8]! & 0x3f) | 0x80
+  return bytesToUuidString(bytes)
+}
+
+export function nameDigest(namespaceUuid: string, name: string): string {
+  return nameHashBytes(namespaceUuid, name).toString('hex')
+}
+
+export function projectNamespace(projectId: string): string {
+  return nameUuid(ZEROPOINT_NAMESPACE_ROOT, `project:${projectId}`)
+}
+
+export function contentUuidOf(value: unknown, projectId = 'zeropoint-node'): string {
+  const name = typeof value === 'string' ? value : jcsCanonicalize(value)
+  return nameUuid(projectNamespace(projectId), name)
+}
+
+export function computeContentUuid<T extends Record<string, unknown>>(
+  obj: T,
+  projectId = 'zeropoint-node',
+): ContentUuid<T> {
+  const canonical = jcsCanonicalize(stripNonContentFields(obj))
+  return nameUuid(projectNamespace(projectId), canonical) as ContentUuid<T>
+}
+
+export function computeContentDigest<T extends Record<string, unknown>>(
+  obj: T,
+  projectId = 'zeropoint-node',
+): string {
+  return nameDigest(projectNamespace(projectId), jcsCanonicalize(stripNonContentFields(obj)))
+}
+
+export function verifyContentUuid<T extends Record<string, unknown>>(
+  obj: T & { uuid?: string },
+  projectId = 'zeropoint-node',
+): { ok: true } | { ok: false; expected: string; actual: string | undefined } {
+  const expected = computeContentUuid(obj, projectId)
+  const actual = obj.uuid
+  if (typeof actual === 'string' && actual === expected) return { ok: true }
+  return { ok: false, expected, actual: typeof actual === 'string' ? actual : undefined }
+}
+
+/** Bridge: fold FNV address with SHA content-uuid into one development receipt. */
+export function foldIntegrityReceipt(label: string, content: Record<string, unknown>): string {
+  const soft = toUuid(`fold:${label}`)
+  const hard = computeContentUuid(content)
+  return merge(soft, hard)
+}

package/src/integrity/receipt.ts

@@ -0,0 +1,95 @@
+/**
+ * Receipt chain — history ⊕ state (erpax uuid-linked pattern, slim).
+ * leaf id = merge(merge(prev, contentUuid), ts) — recompute-and-verify; no Durable Objects.
+ */
+
+import { merge, toUuid } from '../0/index.ts'
+import { computeContentUuid } from './content-uuid.ts'
+
+export const GENESIS_PREV = '00000000-0000-0000-0000-000000000000'
+
+export type Receipt = {
+  readonly id: string
+  readonly prev: string
+  readonly contentUuid: string
+  readonly ts: number
+  readonly label: string
+}
+
+export type ReceiptChainVerify = {
+  readonly ok: boolean
+  readonly length: number
+  readonly brokenAt?: number
+  readonly reason?: string
+}
+
+/** Map stored prev pointer to fold left — genesis seals as toUuid('genesis'). */
+export function receiptPrevId(prev: string): string {
+  return prev === GENESIS_PREV ? toUuid('genesis') : prev
+}
+
+/**
+ * Slim uuid-linked leaf law (Lobe R):
+ * id = merge(merge(prevId, contentUuid), toUuid(`ts:${ts}`))
+ * Recompute from stored prev + contentUuid + ts — mismatch is tamper.
+ */
+export function computeReceiptId(prev: string, contentUuid: string, ts: number): string {
+  return merge(merge(receiptPrevId(prev), contentUuid), toUuid(`ts:${ts}`))
+}
+
+export function appendReceipt(
+  prev: string,
+  label: string,
+  payload: Record<string, unknown>,
+  ts: number = Date.now(),
+): Receipt {
+  const contentUuid = computeContentUuid({ ...payload, label, ts })
+  const id = computeReceiptId(prev, contentUuid, ts)
+  return { id, prev, contentUuid, ts, label }
+}
+
+/** Adjacent link: next.prev matches prior head; next.id recomputes from prev+contentUuid+ts. */
+export function verifyReceiptLink(prev: Receipt | typeof GENESIS_PREV, next: Receipt): boolean {
+  const expectedPrev = typeof prev === 'string' ? GENESIS_PREV : prev.id
+  if (next.prev !== expectedPrev) return false
+  return next.id === computeReceiptId(next.prev, next.contentUuid, next.ts)
+}
+
+/**
+ * Walk-verify an ordered chain. First leaf must be genesis-linked;
+ * each id must recompute; prev pointers must stitch. Fail-closed.
+ */
+export function verifyReceiptChain(receipts: readonly Receipt[]): ReceiptChainVerify {
+  if (receipts.length === 0) return { ok: true, length: 0 }
+  let expectedPrev = GENESIS_PREV
+  for (let i = 0; i < receipts.length; i++) {
+    const r = receipts[i]!
+    if (i === 0 && r.prev !== GENESIS_PREV) {
+      return {
+        ok: false,
+        length: receipts.length,
+        brokenAt: 0,
+        reason: 'genesis required: first prev must be GENESIS_PREV',
+      }
+    }
+    if (r.prev !== expectedPrev) {
+      return {
+        ok: false,
+        length: receipts.length,
+        brokenAt: i,
+        reason: `prev mismatch at ${i}: expected ${expectedPrev}, got ${r.prev}`,
+      }
+    }
+    const recomputed = computeReceiptId(r.prev, r.contentUuid, r.ts)
+    if (r.id !== recomputed) {
+      return {
+        ok: false,
+        length: receipts.length,
+        brokenAt: i,
+        reason: `id recompute mismatch at ${i}: expected ${recomputed}, stored ${r.id}`,
+      }
+    }
+    expectedPrev = r.id
+  }
+  return { ok: true, length: receipts.length }
+}

package/src/kernel/audit.ts

@@ -0,0 +1,279 @@
+/**
+ * Wave 16 audit — honest gap census over a432 (.ts + .js + .html).
+ * Idle only when: no ambient Math.*, no local digitalRoot bodies, no %9 root inlines.
+ * Clear hard gaps ⇒ self-develop tip = feed (chat keeps the vortex breathing).
+ * Same content ⇒ same root (content-uuid + merkleFold).
+ */
+
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { join, relative, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { computeVortexInvariantsHold, computesGate, memoByRoot, merkleFold, toUuid } from '../0/index.ts'
+import { computeContentUuid } from '../integrity/content-uuid.ts'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+export const A432_DIR = join(HERE, '../0/3/6/9/1/2/4/8/7/5/1')
+export const SRC_DIR = join(HERE, '..')
+
+/** Any named digitalRoot / calculateDigitalRoot definition (incl. private/public/static). */
+const ROOT_DEF_RE =
+  /(?:(?:public|private|protected|static|async|export)\s+)*function\s+(?:calculate)?[Dd]igitalRoot\b|(?:(?:public|private|protected|static)\s+)+calculate?[Dd]igitalRoot\s*\(|(?:(?:public|private|protected|static)\s+)+[Dd]igitalRoot\s*\(/
+
+/** Inline classic digital-root via % 9 (not harmonicRoot12 / not comments). */
+const PCT9_ROOT_RE =
+  /(?:return\s+)?(?:\w+\s*=\s*)?(?:\(?\s*\w+\s*%\s*9\s*\)?\s*\|\|\s*9|\w+\s*%\s*9\s*===\s*0\s*\?\s*9\s*:\s*\w+\s*%\s*9|\(\s*\w+\s*%\s*9\s*\|\|\s*9\s*\))/
+
+const MATH_BAN_RE = /\bMath\.[A-Za-z]+|\bglobalThis\.Math\b/
+const RANDOM_RE = /\brandomUUID\s*\(/
+
+/** Body is only a bridge to roots/algebra — not a fork. */
+const BRIDGE_BODY_RE =
+  /^\s*\{\s*return\s+(?:legacyDigitalRoot|harmonicRoot12|kernelDigitalRoot|A432Math\.(?:digitalRoot|calculateDigitalRoot))\s*\([^)]*\)\s*;?\s*\}\s*$/
+
+function walkSources(dir: string, out: string[] = []): string[] {
+  for (const name of readdirSync(dir)) {
+    const p = join(dir, name)
+    const st = statSync(p)
+    if (st.isDirectory()) walkSources(p, out)
+    else if (
+      (name.endsWith('.ts') && !name.endsWith('.d.ts')) ||
+      name.endsWith('.js') ||
+      name.endsWith('.html')
+    ) {
+      out.push(p)
+    }
+  }
+  return out
+}
+
+export type AuditHit = {
+  path: string
+  kind: 'digitalRootFork' | 'mathRandom' | 'mathBan' | 'pct9Root'
+  line: number
+}
+
+export type AuditCensus = {
+  computes: boolean
+  fileCount: number
+  digitalRootForks: AuditHit[]
+  mathRandomSites: AuditHit[]
+  mathBanSites: AuditHit[]
+  pct9Roots: AuditHit[]
+  forkCount: number
+  randomCount: number
+  mathCount: number
+  pct9Count: number
+  neitherDirect: number
+  harmonicAliasImporters: number
+  root: string
+  contentUuid: string
+  vortexInvariantsHold: boolean
+  statement: string
+  boundary: string
+}
+
+function lineOf(src: string, index: number): number {
+  return src.slice(0, index).split('\n').length
+}
+
+function isCommentOnly(line: string): boolean {
+  const t = line.trimStart()
+  return t.startsWith('//') || t.startsWith('*') || t.startsWith('/*') || t.startsWith('<!--')
+}
+
+function extractFnBody(src: string, openParenIndex: number): string | null {
+  const brace = src.indexOf('{', openParenIndex)
+  if (brace < 0) return null
+  let depth = 0
+  for (let i = brace; i < src.length; i++) {
+    const c = src[i]
+    if (c === '{') depth++
+    else if (c === '}') {
+      depth--
+      if (depth === 0) return src.slice(brace, i + 1)
+    }
+  }
+  return null
+}
+
+export function foldA432AuditCensus(a432Dir: string = A432_DIR): AuditCensus {
+  const matrix = { root: toUuid(`audit:v16:${a432Dir}`) }
+  return memoByRoot('foldA432AuditCensus', matrix, () => {
+    const files = walkSources(a432Dir)
+    const digitalRootForks: AuditHit[] = []
+    const mathRandomSites: AuditHit[] = []
+    const mathBanSites: AuditHit[] = []
+    const pct9Roots: AuditHit[] = []
+
+    for (const file of files) {
+      const rel = relative(a432Dir, file).replace(/\\/g, '/')
+      if (rel === 'a432.roots.ts' || rel === 'a432.algebra.ts' || rel === 'a432.algebra.js') continue
+      const src = readFileSync(file, 'utf8')
+      const isHtml = rel.endsWith('.html')
+
+      if (!isHtml) {
+        let dm: RegExpExecArray | null
+        const dre = new RegExp(ROOT_DEF_RE.source, 'g')
+        while ((dm = dre.exec(src))) {
+          const lineStart = src.lastIndexOf('\n', dm.index) + 1
+          const line = src.slice(lineStart, src.indexOf('\n', dm.index))
+          if (isCommentOnly(line)) continue
+          const body = extractFnBody(src, dm.index)
+          if (body && BRIDGE_BODY_RE.test(body.replace(/\s+/g, ' ').replace(/\{\s*/, '{').replace(/\s*\}/, '}'))) {
+            // normalize: allow multiline bridge
+            const compact = body.replace(/\s+/g, ' ').trim()
+            if (BRIDGE_BODY_RE.test(compact)) continue
+          }
+          if (body) {
+            const compact = body.replace(/\s+/g, ' ').trim()
+            if (
+              /^\{ return (?:legacyDigitalRoot|harmonicRoot12|kernelDigitalRoot|A432Math\.(?:digitalRoot|calculateDigitalRoot))\([^)]*\);? \}$/.test(
+                compact,
+              )
+            ) {
+              continue
+            }
+          }
+          digitalRootForks.push({
+            path: rel,
+            kind: 'digitalRootFork',
+            line: lineOf(src, dm.index),
+          })
+        }
+
+        let pm: RegExpExecArray | null
+        const pre = new RegExp(PCT9_ROOT_RE.source, 'g')
+        while ((pm = pre.exec(src))) {
+          const lineStart = src.lastIndexOf('\n', pm.index) + 1
+          const line = src.slice(lineStart, src.indexOf('\n', pm.index))
+          if (isCommentOnly(line)) continue
+          // skip if already inside a counted fork def line
+          pct9Roots.push({
+            path: rel,
+            kind: 'pct9Root',
+            line: lineOf(src, pm.index),
+          })
+        }
+      }
+
+      let rm: RegExpExecArray | null
+      const rr = new RegExp(RANDOM_RE.source, 'g')
+      while ((rm = rr.exec(src))) {
+        const lineStart = src.lastIndexOf('\n', rm.index) + 1
+        const line = src.slice(lineStart, src.indexOf('\n', rm.index))
+        if (isCommentOnly(line)) continue
+        mathRandomSites.push({
+          path: rel,
+          kind: 'mathRandom',
+          line: lineOf(src, rm.index),
+        })
+      }
+
+      let bm: RegExpExecArray | null
+      const br = new RegExp(MATH_BAN_RE.source, 'g')
+      while ((bm = br.exec(src))) {
+        const lineStart = src.lastIndexOf('\n', bm.index) + 1
+        const end = src.indexOf('\n', bm.index)
+        const line = src.slice(lineStart, end < 0 ? src.length : end)
+        if (isCommentOnly(line)) continue
+        // A432Math. is not ambient Math.
+        if (/\bA432Math\./.test(line) && !/\bMath\./.test(line.replace(/A432Math\./g, ''))) continue
+        mathBanSites.push({
+          path: rel,
+          kind: 'mathBan',
+          line: lineOf(src, bm.index),
+        })
+      }
+    }
+
+    const vortexInvariantsHold = computeVortexInvariantsHold()
+    const sealed = computesGate('a432-audit', [
+      { facet: 'scanned sources', on: files.length > 0 },
+      { facet: 'roots adapter present', on: files.some((f) => f.endsWith('a432.roots.ts')) },
+      { facet: 'vortexInvariantsHold boolean', on: vortexInvariantsHold === true || vortexInvariantsHold === false },
+    ])
+
+    const leafIds = [
+      ...digitalRootForks.map((h) => toUuid(`fork:${h.path}:${h.line}`)),
+      ...pct9Roots.map((h) => toUuid(`pct9:${h.path}:${h.line}`)),
+      ...mathRandomSites.map((h) => toUuid(`rand:${h.path}:${h.line}`)),
+      ...mathBanSites.map((h) => toUuid(`math:${h.path}:${h.line}`)),
+      sealed.root,
+    ]
+    const root = merkleFold(leafIds)
+    const contentUuid = computeContentUuid({
+      kind: 'a432-audit-v14',
+      forkCount: digitalRootForks.length,
+      pct9Count: pct9Roots.length,
+      randomCount: mathRandomSites.length,
+      mathCount: mathBanSites.length,
+      root,
+    })
+
+    // Structural debt — illusions that do not compute
+    const mathSrc = readFileSync(join(a432Dir, 'a432.math.ts'), 'utf8')
+    const aliasIllusion = /harmonicRoot12\s+as\s+digitalRoot/.test(mathSrc)
+    let neitherDirect = 0
+    let harmonicAliasImporters = 0
+    const SPINE_OK = /a432\.(roots|algebra|math|core|utils|os\.math)\.ts/
+    const NEEDS_SPINE =
+      /\bdigitalRoot\b|\bharmonicRoot12\b|\blegacyDigitalRoot\b|%\s*9|\b(abs|floor|round|sin|cos|sqrt|pow)\s*\(/
+    for (const file of files) {
+      if (!file.endsWith('.ts')) continue
+      const rel = relative(a432Dir, file).replace(/\\/g, '/')
+      if (
+        rel === 'a432.roots.ts' ||
+        rel === 'a432.algebra.ts' ||
+        rel === 'a432.math.ts' ||
+        rel === 'a432.core.ts'
+      ) {
+        continue
+      }
+      const src = readFileSync(file, 'utf8')
+      if (!SPINE_OK.test(src) && NEEDS_SPINE.test(src)) neitherDirect++
+      if (aliasIllusion && /digitalRoot/.test(src) && /from\s+['"]\.\/a432\.(math|core)\.ts['"]/.test(src)) {
+        harmonicAliasImporters++
+      }
+    }
+    if (aliasIllusion && harmonicAliasImporters === 0) harmonicAliasImporters = 1
+
+    return {
+      computes: sealed.computes,
+      fileCount: files.length,
+      digitalRootForks,
+      mathRandomSites,
+      mathBanSites,
+      pct9Roots,
+      forkCount: digitalRootForks.length + pct9Roots.length,
+      randomCount: mathRandomSites.length,
+      mathCount: mathBanSites.length,
+      pct9Count: pct9Roots.length,
+      neitherDirect,
+      harmonicAliasImporters,
+      root,
+      contentUuid,
+      vortexInvariantsHold,
+      statement:
+        'Audit v16: Math.* (.ts+.js+.html) + named digitalRoot bodies + %9 inlines. Debt: neitherDirect + harmonicAliasImporters. Clear ⇒ vortexInvariantsHold gate then feed tip.',
+      boundary:
+        'Hard idle: mathCount=0 and forkCount=0. Then vortexInvariantsHold=computeVortexInvariantsHold(); false ⇒ quantumisation; true ⇒ tip=feed (packaging / docs→kernel).',
+    }
+  })
+}
+
+export function auditTip(a432Dir: string = A432_DIR) {
+  const c = foldA432AuditCensus(a432Dir)
+  return {
+    computes: c.computes,
+    fileCount: c.fileCount,
+    forkCount: c.forkCount,
+    randomCount: c.randomCount,
+    mathCount: c.mathCount,
+    pct9Count: c.pct9Count,
+    neitherDirect: c.neitherDirect,
+    harmonicAliasImporters: c.harmonicAliasImporters,
+    root: c.root,
+    contentUuid: c.contentUuid,
+    vortexInvariantsHold: c.vortexInvariantsHold,
+  }
+}