Cross-Domain Receipt Graph Architecture

import { createHash } from 'crypto';
import { verify } from 'jsonwebtoken';

// Verify receipt signature (offline, no API call)
function verifyReceipt(receipt: Receipt, publicKey: string): boolean {
  // 1. Recompute hash
  const computedHash = createHash('sha256')
    .update(JSON.stringify({
      id: receipt.id,
      type: receipt.type,
      data: receipt.data,
      parentIds: receipt.parentIds,
      timestamp: receipt.timestamp
    }))
    .digest('hex');

  // 2. Verify hash matches
  if (computedHash !== receipt.hash) {
    return false;
  }

  // 3. Verify ES256 signature
  try {
    verify(receipt.signature, publicKey, {
      algorithms: ['ES256']
    });
    return true;
  } catch {
    return false;
  }
}

// Verify entire graph chain
function verifyReceiptChain(receipts: Receipt[]): boolean {
  const receiptMap = new Map(receipts.map(r => [r.id, r]));

  for (const receipt of receipts) {
    // Verify this receipt
    if (!verifyReceipt(receipt, PUBLIC_KEY)) {
      return false;
    }

    // Verify parent links
    for (const parentId of receipt.parentIds) {
      const parent = receiptMap.get(parentId);
      if (!parent || parent.depth >= receipt.depth) {
        return false; // Invalid DAG structure
      }
    }
  }

  return true;
}