enfinitos_auditor/lib.rs
1//! # enfinitos_auditor
2//!
3//! EnfinitOS **Auditor / Verifier SDK** — Rust port of the reference
4//! [`@enfinitos/sdk-auditor`] TypeScript implementation. The wire
5//! shapes, canonicalisation rules, and verification semantics are
6//! deliberately identical: a regulator auditing the same proof pack
7//! with either SDK MUST get the same VALID/INVALID verdict on every
8//! step.
9//!
10//! ## Trust model
11//!
12//! EnfinitOS issues signed evidence as part of every spatial-chain run:
13//! a proof receipt for every render, a metering summary projecting
14//! those proofs into billable units, and a settlement summary
15//! reconciling those units into invoiced amounts.
16//!
17//! The trust model is **"don't trust us — verify"**:
18//!
19//! 1. Every record is Ed25519-signed.
20//! 2. Every proof receipt carries `before_hash` / `after_hash` so the
21//! chain detects single-record tampering.
22//! 3. Metering is a deterministic projection of proof.
23//! 4. Settlement is a deterministic projection of metering.
24//! 5. The auditor SDK ships the same canonical-JSON encoder, projection
25//! formulae, and signature primitives, and so re-derives every claim
26//! the platform makes.
27//!
28//! The Rust crate is **offline-first** by design: it does not pull in
29//! an HTTP client. Callers feed in a `VerificationKey` set they've
30//! pinned themselves (the regulator audit posture).
31//!
32//! ## Example
33//!
34//! ```no_run
35//! use enfinitos_auditor::{Auditor, AuditBundle, SignedProofPack, VerificationKey};
36//! use std::fs;
37//!
38//! let pack_json = fs::read_to_string("pack.json").unwrap();
39//! let pack: SignedProofPack = serde_json::from_str(&pack_json).unwrap();
40//!
41//! let keys_json = fs::read_to_string("keys.json").unwrap();
42//! let keys: Vec<VerificationKey> = serde_json::from_str(&keys_json).unwrap();
43//!
44//! let auditor = Auditor::new(keys);
45//! let report = auditor.verify_all(&AuditBundle {
46//! pack,
47//! metering: None,
48//! settlement: None,
49//! });
50//! println!("verdict: {:?}", report.status);
51//! ```
52
53#![deny(rust_2018_idioms)]
54#![warn(clippy::all)]
55
56pub mod auditor;
57pub mod canonical_json;
58pub mod errors;
59pub mod hashing;
60pub mod keys;
61pub mod metering_audit;
62pub mod proof_chain;
63pub mod proof_pack;
64pub mod settlement_audit;
65pub mod tenant_chain;
66pub mod types;
67
68pub use auditor::Auditor;
69pub use errors::{AuditorError, AuditorErrorCode};
70pub use keys::KeyDirectory;
71pub use tenant_chain::{
72 canonicalise_tenant_chain_link, genesis_chain_tip, verify_tenant_chain,
73 TenantChainedRecord, TENANT_CHAIN_VERSION,
74};
75pub use types::{
76 AuditBundle, AuditReasonCode, AuditReport, AuditStep, AuditStepKind, AuditStepStatus,
77 ChainAuditReport, EnvelopeVersion, FullAuditReport, KeysSnapshot, MeterRecord,
78 MeterStatus, MeterUnitType, MeteringSummary, ProjectionAuditReport, ProofPack,
79 ProofReceiptPayload, ProofRecord, SettlementAuditReport, SettlementLine,
80 SettlementPartyRole, SettlementStatus, SettlementSummary, SettlementTotals,
81 SignatureAlgorithm, SignedProofPack, VerificationKey, SDK_VERSION,
82 SUPPORTED_ENVELOPE_VERSIONS, SUPPORTED_SIGNATURE_ALGORITHMS,
83};