@aikdna/kdna-core 0.36.0 → 0.37.1-rc.browser.1

package/src/public-contract/protected-browser.d.ts

@@ -0,0 +1,17 @@
+// Generated protected-browser definitions; schema validity is not authority.
+import type { CanonicalReadSnapshot, CoreAdmissionCatalogOnly, CoreAdmissionRejected } from './types.js';
+import type { ProtectionDiagnostic, ProtectionRuntimeDescriptor, ProtectedSignaturePolicy, TrustedProtectionProvider } from './protection-node.js';
+export type ConsumerUnlockSelection = { readonly "slotIndex": number; readonly "slot": string; readonly "kdf_profile": "scrypt-sha256" | "argon2id"; };
+export type ConsumerUnlockObservation = { readonly "kind": "consumer_unlock_observation"; readonly "proof": "observation_not_authority"; readonly "checked_at_ms": number; readonly "selection": ConsumerUnlockSelection; };
+export type ProtectedBrowserInput = { readonly "bytes": Uint8Array; readonly "plaintextPayload": Uint8Array; readonly "observation": ConsumerUnlockObservation; readonly "signaturePolicy"?: ProtectedSignaturePolicy; };
+export type ProtectedBrowserDisclosure = { readonly "slot_selection": ConsumerUnlockSelection; readonly "observation_not_authority": true; readonly "provenance": "host_supplied_triple"; };
+export type ProtectedBrowserAccepted = { readonly "status": "accepted"; readonly "snapshot": CanonicalReadSnapshot; readonly "disclosure": ProtectedBrowserDisclosure; };
+export type ProtectedBrowserCatalogOnly = { readonly "status": "catalog_only"; readonly "catalog": CoreAdmissionCatalogOnly; readonly "disclosure": ProtectedBrowserDisclosure; };
+export type ProtectedBrowserCoreRejected = { readonly "status": "core_rejected"; readonly "stage": "container" | "manifest" | "payload" | "interpretation"; readonly "core": CoreAdmissionRejected; };
+export type ProtectedBrowserFailed = { readonly "status": "protection_failed"; readonly "diagnostic": ProtectedBrowserDiagnostic; };
+// The observation-phase codes are the reviewed family extension settled under
+// D-CBPA-IMPL-3 (2026-10-06); the shared node codes keep their stages.
+export type ProtectedBrowserDiagnostic = (ProtectionDiagnostic | { readonly "code": "PROTECTION_OBSERVATION_INVALID"; readonly "stage": "observation"; } | { readonly "code": "PROTECTION_OBSERVATION_BINDING_INVALID"; readonly "stage": "binding"; } | { readonly "code": "PROTECTION_NOT_DECLARED"; readonly "stage": "declaration"; });
+export type ProtectedBrowserAdmissionResult = (ProtectedBrowserAccepted | ProtectedBrowserCatalogOnly | ProtectedBrowserCoreRejected | ProtectedBrowserFailed);
+export declare function getProtectionContract(): ProtectionRuntimeDescriptor;
+export declare function admitProtectedBrowser(input: ProtectedBrowserInput, provider: TrustedProtectionProvider): Promise<ProtectedBrowserAdmissionResult>;

package/src/public-contract/protected-browser.js

@@ -0,0 +1,4 @@
+'use strict';
+const { getProtectionContract } = require('./protection-declaration.js');
+const { admitProtectedBrowser } = require('./protection-admission-browser.js');
+module.exports = { getProtectionContract, admitProtectedBrowser };

package/src/public-contract/protected-browser.mjs

@@ -0,0 +1,2 @@
+import api from './protected-browser.js';
+export const { getProtectionContract, admitProtectedBrowser } = api;

package/src/public-contract/protected-sections-browser.d.ts

@@ -0,0 +1,11 @@
+import type { CanonicalReadSnapshot } from './types.js';
+import type { BrowserProtectedRequestAdmission, AdmittedBrowserProtectedRequest, BrowserProtectedRequest, BrowserProtectedAuthorityContext, BrowserProtectedReadAuthority, BrowserProtectedAdmissionResult, BrowserProtectedSnapshot, BrowserProtectedSnapshotData, BrowserProtectedOperation } from './protected-browser-contract/types.js';
+export type * from './protected-browser-contract/types.js';
+export declare function admitProtectedPayloadRequestJson(requestJson: string): BrowserProtectedRequestAdmission;
+export declare function inspectProtectedPayloadRequest(request: AdmittedBrowserProtectedRequest): Readonly<BrowserProtectedRequest> | null;
+export declare function createProtectedPayloadReadAuthorityJson(callback: (context: Readonly<BrowserProtectedAuthorityContext>) => boolean | Promise<boolean>, signaturePolicyJson?: string): BrowserProtectedReadAuthority;
+// Consumes one genuine admitProtectedBrowser origin. No new decryption or physical read.
+export declare function admitProtectedSectionBrowser(snapshot: CanonicalReadSnapshot, request: AdmittedBrowserProtectedRequest, authority: BrowserProtectedReadAuthority): Promise<BrowserProtectedAdmissionResult>;
+export declare function inspectProtectedPayloadSnapshot(snapshot: BrowserProtectedSnapshot): Readonly<BrowserProtectedSnapshotData> | null;
+export declare function bindProtectedPayloadRequest(operation: BrowserProtectedOperation, requestJson: string): BrowserProtectedRequestAdmission;
+export declare function disposeProtectedSectionOperation(operation: BrowserProtectedOperation): void;

package/src/public-contract/protected-sections-browser.js

@@ -0,0 +1,22 @@
+'use strict';
+const S = require('./browser-protected/state.js'), R = require('./browser-protected/request.js');
+function bindProtectedPayloadRequest(operation, requestJson) {
+  const record = S.operation(operation);
+  if (!record) return R.failure(null);
+  const admitted = R.admit(requestJson);
+  if (admitted.channel !== 'admitted_request') return admitted;
+  try {
+    const token = S.normalized(S.request(admitted.request), record.view);
+    S.pairRequest(token, operation);
+    return Object.freeze({ channel: 'admitted_request', request: token });
+  } catch { return R.failure(S.inspectRequest(admitted.request)); }
+}
+module.exports = {
+  admitProtectedPayloadRequestJson: R.admit,
+  inspectProtectedPayloadRequest: S.inspectRequest,
+  createProtectedPayloadReadAuthorityJson: S.createAuthority,
+  admitProtectedSectionBrowser: S.admit,
+  inspectProtectedPayloadSnapshot: S.inspectSnapshot,
+  bindProtectedPayloadRequest,
+  disposeProtectedSectionOperation: S.dispose
+};

package/src/public-contract/protected-sections-browser.mjs

@@ -0,0 +1,2 @@
+import api from './protected-sections-browser.js';
+export const { admitProtectedPayloadRequestJson, inspectProtectedPayloadRequest, createProtectedPayloadReadAuthorityJson, admitProtectedSectionBrowser, inspectProtectedPayloadSnapshot, bindProtectedPayloadRequest, disposeProtectedSectionOperation } = api;

package/src/public-contract/protected-source-contract.generated.json

@@ -1,6 +1,6 @@
 {
   "api_typescript": "export type ProtectedSourceContractIdentity = { readonly id: 'kdna.protected-source/1'; readonly version: '1.0.0'; readonly definition_digest: import('./types.js').Digest };\nexport type ProtectedSourceRuntimeDescriptor = { readonly contract: ProtectedSourceContractIdentity; readonly implementation: { readonly package: '@aikdna/kdna-core'; readonly version: string }; readonly profiles: ReadonlyArray<'kdna.envelope.aead/0.1.0' | 'kdna.envelope.external-grant/0.1.0'>; readonly callables: ReadonlyArray<'getProtectedSourceContract' | 'createTrustedProtectedSourceHost' | 'withProtectedSourceNode' | 'commitProtectedSourceTransport' | 'previewProtectedSourceRevision' | 'produceProtectedSourceRevision'>; readonly limits: { readonly container_bytes: 26214400; readonly entries: 128; readonly entry_bytes: 8388608; readonly total_uncompressed_bytes: 12582912; readonly delivered_plaintext_bytes: 8388608; readonly documented_raw_byte_bound: 20971520; readonly timeout_ms_max: 60000 }; readonly proof_limits: ReadonlyArray<string> };\nexport type SourceHostObservationContext = { readonly context_id: string | null; readonly epoch: string | null; readonly asset_digest: string; readonly scope: 'complete_source'; readonly purpose: string; readonly requested_at_ms: number };\nexport type ProtectedSourceMember = { readonly name: string; readonly type: 'file'; readonly mode: number; readonly bytes: Uint8Array };\nexport type ProtectedSourceInventoryEntry = { readonly name: string; readonly type: 'file'; readonly mode: number; readonly size: number; readonly sha256: string };\nexport type ProtectedSourceBundle = { readonly identity: { readonly A: string; readonly C: string; readonly E: string }; readonly manifest: unknown; readonly payload: unknown; readonly original_members: ReadonlyArray<ProtectedSourceMember>; readonly original_inventory: ReadonlyArray<ProtectedSourceInventoryEntry>; readonly plaintext_payload: { readonly entry: 'payload.kdnab'; readonly bytes: Uint8Array; readonly sha256: string }; readonly prior_snapshot: unknown; readonly host_observation: unknown; readonly proof_limits: ReadonlyArray<string> };\nexport type ProtectedSourceRevisionContext = { readonly [brand: symbol]: true };\nexport type ProtectedSourcePreparedDelivery = { readonly [brand: symbol]: true };\nexport type ProtectedSourceHostCallbacks = { readonly observe: (context: SourceHostObservationContext) => SourceHostObservation | Promise<SourceHostObservation>; readonly deliver: (bundle: ProtectedSourceBundle, prepared: ProtectedSourcePreparedDelivery, context: ProtectedSourceRevisionContext) => boolean | Promise<boolean> };\nexport type TrustedProtectedSourceHost = { readonly [brand: symbol]: true };\nexport type ProtectedSourceRevisionOptions = { readonly admission: import('./protection-node.js').ProtectedAdmissionOptions; readonly expected_A: string; readonly timeout_ms: number };\nexport type TrustedProtectedSourceTransport = { readonly observeScope: () => SourceHostObservation | Promise<SourceHostObservation>; readonly commit: (bundle: ProtectedSourceBundle | null) => boolean };\nexport type ProtectedSourceCommitResult = { readonly status: 'source_committed'; readonly disclosure: import('./protection-node.js').ProtectionDisclosure; readonly body: null; readonly body_bytes: 0 } | SourceFailed;\nexport type ProtectedSourcePolicy = ({ readonly kind: 'password'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'password'; readonly offline?: boolean; readonly revocable?: boolean }; readonly slots: ReadonlyArray<{ readonly slot: string; readonly kdf_profile: 'scrypt-sha256' | 'argon2id' }> } | { readonly kind: 'external-grant'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'account' | 'org'; readonly offline?: boolean; readonly revocable?: boolean }; readonly key_ref: string; readonly issuer_key_id: string }) & { readonly checksums: boolean; readonly signature: 'none' | 'ed25519' };\nexport type ProtectedSourceEdits = { readonly manifest?: unknown; readonly payload?: unknown };\nexport type ProtectedSourceProviderRequest = { readonly source_A: string; readonly edits_digest: string; readonly policy_digest: string; readonly kind: 'password' | 'external-grant'; readonly signature: 'none' | 'ed25519' };\nexport type ProtectedSourceOutputSecrets = { readonly passwords?: ReadonlyArray<{ readonly slot: string; readonly password: Uint8Array }>; readonly signingSeed?: Uint8Array; readonly issuerRootKey?: Uint8Array };\nexport type SourceRevisionEvidence = { readonly contract: ProtectedSourceContractIdentity; readonly implementation: { readonly package: '@aikdna/kdna-core'; readonly version: string }; readonly source_A: string; readonly output: { readonly A: string; readonly C: string; readonly E: string }; readonly profile: { readonly id: string; readonly version: string }; readonly entry: 'payload.kdnab'; readonly member_actions: { readonly [name: string]: 'added' | 'replaced' | 'removed' }; readonly integrity: unknown; readonly payload_source: 'explicit_edit' | 'original_decrypted_cbor'; readonly proof: 'producer_observation_not_consumer_admission'; readonly output_delivery: 'not_published' | 'trusted_host'; readonly output_A: string | null };\nexport type ProtectedSourceRevisionResult = { readonly status: 'revision_produced'; readonly bytes: Uint8Array; readonly evidence: SourceRevisionEvidence; readonly body_bytes: number } | { readonly status: 'revision_rejected'; readonly diagnostic: SourceDiagnostic; readonly body: null; readonly body_bytes: 0 };\nexport declare function getProtectedSourceContract(): ProtectedSourceRuntimeDescriptor;\nexport declare function createTrustedProtectedSourceHost(callbacks: ProtectedSourceHostCallbacks): TrustedProtectedSourceHost;\nexport declare function withProtectedSourceNode(input: string | Uint8Array, options: ProtectedSourceRevisionOptions, protectionProvider: import('./protection-node.js').TrustedProtectionProvider, sourceHost: TrustedProtectedSourceHost): Promise<ProtectedSourceObservation>;\nexport declare function commitProtectedSourceTransport(prepared: ProtectedSourcePreparedDelivery, transport: TrustedProtectedSourceTransport): Promise<ProtectedSourceCommitResult>;\nexport declare function previewProtectedSourceRevision(context: ProtectedSourceRevisionContext, edits: ProtectedSourceEdits, policy: ProtectedSourcePolicy): Promise<ProtectedSourceRevisionPreviewResult>;\nexport declare function produceProtectedSourceRevision(context: ProtectedSourceRevisionContext, edits: ProtectedSourceEdits, policy: ProtectedSourcePolicy, outputSecretProvider: (request: ProtectedSourceProviderRequest) => ProtectedSourceOutputSecrets | Promise<ProtectedSourceOutputSecrets>): Promise<ProtectedSourceRevisionResult>;\n",
-  "definition_digest": "sha256:86abadc6c0276ce39ae09bb02ac75b732da2858450397f93c79def6f85841897",
+  "definition_digest": "sha256:6a0c62e9908100fcd03b9f9b735bb0d928fa340fbe57fb894f501968aac188a8",
   "id": "kdna.protected-source/1",
   "limits": {
     "container_bytes": 26214400,
@@ -29,8 +29,8 @@
   ],
   "schema_binding": {
     "package_versions": {
-      "@aikdna/kdna-core": "0.36.0",
-      "@aikdna/kdna-read": "0.11.0"
+      "@aikdna/kdna-core": "0.37.1-rc.browser.1",
+      "@aikdna/kdna-read": "0.11.2-rc.browser.1"
     },
     "version_tuple": {
       "container": "0.5.0",
@@ -45,8 +45,8 @@
       "trace": "kdna.judgment-trace/0.3.1"
     }
   },
-  "schema_id": "urn:kdna:schema:protected-source:1.0.0:binding:r2:7",
-  "schema_path": "specs/protected-source-r2-binding-7.schema.json",
+  "schema_id": "urn:kdna:schema:protected-source:1.0.0:binding:r2:8",
+  "schema_path": "specs/protected-source-r2-binding-8.schema.json",
   "types": {
     "AccessMode": {
       "enum": [
@@ -9260,7 +9260,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0",
+              "const": "0.37.1-rc.browser.1",
               "type": "string"
             }
           },
@@ -10632,7 +10632,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0",
+              "const": "0.37.1-rc.browser.1",
               "type": "string"
             }
           },
@@ -13783,7 +13783,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0",
+              "const": "0.37.1-rc.browser.1",
               "type": "string"
             }
           },

package/src/public-contract/protected-source-node.d.ts

@@ -10,7 +10,7 @@ export type ProtectedSourceCatalog = { readonly "status": "catalog_only"; readon
 export type SourceCoreRejected = { readonly "status": "core_rejected"; readonly "stage": "admission"; readonly "core": CoreAdmissionRejected; readonly "disclosure": ProtectionDisclosure; readonly "body": null; readonly "body_bytes": 0; };
 export type ProtectedSourceObservation = (ProtectedSourceDelivered | ProtectedSourceCatalog | SourceCoreRejected | SourceFailed);
 export type SourceHostObservation = { readonly "context_id": Identifier; readonly "epoch": Identifier; readonly "asset_digest": Digest; readonly "permission": "allowed" | "denied"; readonly "scope": "complete_source"; readonly "current_ms": UInt; readonly "expires_at_ms": UInt; readonly "revoked": boolean; };
-export type SourcePreviewValidation = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "name": "@aikdna/kdna-core"; readonly "version": "0.36.0"; }; readonly "source_A": Digest; readonly "original_payload_digest": Digest; readonly "edits_digest": Digest; readonly "policy_digest": Digest; readonly "semantic_status": "valid"; readonly "proof": "semantic_validation_not_ciphertext_admission"; };
+export type SourcePreviewValidation = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "name": "@aikdna/kdna-core"; readonly "version": "0.37.1-rc.browser.1"; }; readonly "source_A": Digest; readonly "original_payload_digest": Digest; readonly "edits_digest": Digest; readonly "policy_digest": Digest; readonly "semantic_status": "valid"; readonly "proof": "semantic_validation_not_ciphertext_admission"; };
 export type SourcePreviewValid = { readonly "status": "preview_valid"; readonly "validation": SourcePreviewValidation; readonly "body": null; readonly "body_bytes": 0; };
 export type SourcePreviewRejected = { readonly "status": "preview_rejected"; readonly "diagnostic": SourceDiagnostic; readonly "body": null; readonly "body_bytes": 0; };
 export type ProtectedSourceRevisionPreviewResult = (SourcePreviewValid | SourcePreviewRejected);

package/src/public-contract/protection-admission-browser.js

@@ -0,0 +1,132 @@
+'use strict';
+// Browser protected admission core (case A: an independent browser entry).
+//
+// The host supplies the container bytes, the payload plaintext bytes and the
+// unlock observation; nothing here decrypts, and the observation is never
+// authority (its provenance limit is named in the disclosure). The five-step
+// admission mirrors the retained node entry's structure and codes; the kdsig
+// face follows the browser family route (globalThis.crypto subtle, same
+// kdsig.ed25519:0.1.0 framing as the node helper), and the checksums document
+// is verified against a verbatim local port of protection-integrity.makeChecksums
+// (that module is node-bound by its kdsig helper import).
+const { parseJson, canonicalJson, freeze, uint, identifier } = require('./strict-input.js');
+const { parseContainer } = require('./container.js');
+const { inflate } = require('./browser-native/portable-inflate.js');
+const { utf8, fromHex } = require('./browser-native/bytes.js');
+const { digest, contentTreePreimage, runtimeEntryPreimage, runtimeEntryNames } = require('./digests.js');
+const { validate } = require('./validate.js');
+const { rejected } = require('./admit.js');
+const { decodeValidatedPayload, assertContentBindings, finishAdmission } = require('./semantic-admission.js');
+const { fail, failure, isFailure, closed, provider, assetProtectionDeclaration } = require('./protection-declaration.js');
+const { decodeEnvelope, validateEnvelopeShape } = require('./protection-envelope-codec.js');
+const { signatureContentPreimage } = require('./browser-native/signature-domain.js');
+const { ChecksumsDocument1: checksumsShape } = require('./protection-validators.generated.js');
+function checkDeclaration(manifest) {
+  const profile = assetProtectionDeclaration(manifest);
+  if (!profile) fail('NOT_DECLARED', 'declaration');
+  if (profile.id !== 'kdna.envelope.aead') fail('PROFILE_UNSUPPORTED', 'declaration');
+  if (manifest.entitlement.offline === false || manifest.entitlement.revocable === true) fail('DECLARATION_CONFLICT', 'authorization');
+  return profile;
+}
+function inputs(value, inputProvider) {
+  closed(value, ['bytes', 'plaintextPayload', 'observation'], ['signaturePolicy']);
+  const containerBytes = value.bytes, suppliedPlaintext = value.plaintextPayload;
+  if (!(containerBytes instanceof Uint8Array) || !(suppliedPlaintext instanceof Uint8Array)) fail('INPUT_INVALID', 'input');
+  const policy = value.signaturePolicy === undefined ? { requireSignature: false, expectedPublicKeyHex: null } : closed(value.signaturePolicy, ['requireSignature', 'expectedPublicKeyHex']);
+  if (typeof policy.requireSignature !== 'boolean' || (policy.expectedPublicKeyHex !== null && (typeof policy.expectedPublicKeyHex !== 'string' || !/^[0-9a-f]{64}$/.test(policy.expectedPublicKeyHex)))) fail('INPUT_INVALID', 'input');
+  const o = closed(value.observation, ['kind', 'proof', 'checked_at_ms', 'selection']);
+  if (o.kind !== 'consumer_unlock_observation' || o.proof !== 'observation_not_authority' || !uint(o.checked_at_ms)) fail('OBSERVATION_INVALID', 'observation');
+  const s = closed(o.selection, ['slotIndex', 'slot', 'kdf_profile']);
+  if (!uint(s.slotIndex) || !identifier(s.slot) || !['scrypt-sha256', 'argon2id'].includes(s.kdf_profile)) fail('OBSERVATION_INVALID', 'observation');
+  const trustedProvider = provider(inputProvider, 'password');
+  // Finish every caller-owned metadata access before allocating the plaintext
+  // copy. The caller may still throw while a Proxy supplies a data property.
+  const copied = { observation: { kind: o.kind, proof: o.proof, checked_at_ms: o.checked_at_ms, selection: { slotIndex: s.slotIndex, slot: s.slot, kdf_profile: s.kdf_profile } }, signaturePolicy: { ...policy }, trustedProvider };
+  const observed = copied.observation, selected = observed.selection, signaturePolicy = copied.signaturePolicy;
+  if (observed.kind !== 'consumer_unlock_observation' || observed.proof !== 'observation_not_authority' || !uint(observed.checked_at_ms) || !uint(selected.slotIndex) || !identifier(selected.slot) || !['scrypt-sha256', 'argon2id'].includes(selected.kdf_profile)) fail('OBSERVATION_INVALID', 'observation');
+  if (typeof signaturePolicy.requireSignature !== 'boolean' || (signaturePolicy.expectedPublicKeyHex !== null && (typeof signaturePolicy.expectedPublicKeyHex !== 'string' || !/^[0-9a-f]{64}$/.test(signaturePolicy.expectedPublicKeyHex)))) fail('INPUT_INVALID', 'input');
+  return { ...copied, bytes: new Uint8Array(containerBytes), plaintext: new Uint8Array(suppliedPlaintext) };
+}
+function assertObservationBinding(observation, envelope) {
+  const slots = envelope.key_slots;
+  if (observation.selection.slotIndex >= slots.length) fail('OBSERVATION_BINDING_INVALID', 'binding');
+  const slot = slots[observation.selection.slotIndex];
+  if (slot.slot !== observation.selection.slot || slot.kdf_profile !== observation.selection.kdf_profile) fail('OBSERVATION_BINDING_INVALID', 'binding');
+}
+// Verbatim port of protection-integrity.makeChecksums (node-bound there).
+function makeChecksums(entries, manifest, E) {
+  const names = runtimeEntryNames(entries, manifest);
+  return { profile: 'kdna.checksums.document/1', profile_version: '1.0.0', algorithm: 'sha256', digest_profile: 'kdna.digest-basis.runtime-entry-set', digest_profile_version: '0.2.0', covered_entries: names, entries: names.map(name => ({ name, bytes: entries[name].length, digest: digest(entries[name]) })), entry_set_digest: E };
+}
+function parseKdsigBundle(raw) {
+  // The same bundle domain the node helper and the browser section verifier accept.
+  if (raw.length < 3 || raw.length > 1048576) fail('SIGNATURE_INVALID', 'integrity');
+  if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf) fail('SIGNATURE_INVALID', 'integrity');
+  let value;
+  try { value = parseJson(raw); } catch { fail('SIGNATURE_INVALID', 'integrity'); }
+  const fields = ['algorithm', 'content_digest', 'profile', 'profile_version', 'public_key', 'signature'];
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== fields.length || !fields.every(k => Object.hasOwn(value, k) && typeof value[k] === 'string')) fail('SIGNATURE_INVALID', 'integrity');
+  if (!/^sha256:[0-9a-f]{64}$/.test(value.content_digest) || !/^[0-9a-f]{64}$/.test(value.public_key) || !/^[0-9a-f]{128}$/.test(value.signature)) fail('SIGNATURE_INVALID', 'integrity');
+  if (value.profile !== 'kdsig.ed25519' || value.profile_version !== '0.1.0' || value.algorithm !== 'ed25519') fail('PROFILE_UNSUPPORTED', 'integrity');
+  return value;
+}
+async function verifyIntegrityBrowser(entries, manifest, E, policy) {
+  const integrity = { checksums: 'absent', signature: 'absent', signature_content_digest: null, public_key: null };
+  if (Object.hasOwn(entries, 'checksums.json')) {
+    const raw = entries['checksums.json']; let value;
+    try { if (raw.length > 1048576) throw Error(); value = parseJson(raw); } catch { fail('CHECKSUMS_INVALID', 'integrity'); }
+    if (value?.profile !== 'kdna.checksums.document/1' || value?.profile_version !== '1.0.0') fail('PROFILE_UNSUPPORTED', 'integrity');
+    if (!checksumsShape(value) || canonicalJson(value) !== canonicalJson(makeChecksums(entries, manifest, E))) fail('CHECKSUMS_INVALID', 'integrity');
+    integrity.checksums = 'verified_document_1';
+  }
+  if (Object.hasOwn(entries, 'signature.kdsig')) {
+    const bundle = parseKdsigBundle(entries['signature.kdsig']);
+    if (policy.expectedPublicKeyHex !== null && bundle.public_key !== policy.expectedPublicKeyHex) fail('SIGNATURE_PIN_MISMATCH', 'integrity');
+    const signatureDigest = digest(signatureContentPreimage(entries));
+    if (bundle.content_digest !== signatureDigest) fail('SIGNATURE_INVALID', 'integrity');
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle || typeof subtle.importKey !== 'function' || typeof subtle.verify !== 'function') throw Object.assign(new Error('WebCrypto Ed25519 unavailable'), { reason: 'READ_CORE_CAPABILITY_UNAVAILABLE' });
+    try {
+      const key = await subtle.importKey('raw', fromHex(bundle.public_key), 'Ed25519', false, ['verify']);
+      const ok = await subtle.verify('Ed25519', key, fromHex(bundle.signature), utf8('kdsig.ed25519:0.1.0:' + signatureDigest));
+      if (ok !== true) fail('SIGNATURE_INVALID', 'integrity');
+    } catch (error) { if (isFailure(error)) throw error; throw Object.assign(new Error('WebCrypto Ed25519 failed'), { reason: 'READ_CORE_CAPABILITY_UNAVAILABLE' }); }
+    integrity.signature = policy.expectedPublicKeyHex === null ? 'verified_self_key' : 'verified_pinned_key';
+    integrity.signature_content_digest = signatureDigest;
+    integrity.public_key = bundle.public_key;
+  } else if (policy.requireSignature || policy.expectedPublicKeyHex !== null) fail('SIGNATURE_INVALID', 'integrity');
+  return integrity;
+}
+async function admitProtectedBrowser(input, inputProvider) {
+  let copied, plaintext, stage = 'input';
+  try {
+    copied = inputs(input, inputProvider); plaintext = copied.plaintext; const bytes = copied.bytes;
+    stage = 'container'; const entries = parseContainer(bytes, inflate);
+    stage = 'manifest'; const manifest = validate('Manifest', parseJson(entries['kdna.json']));
+    const profile = checkDeclaration(manifest);
+    const digests = { A: digest(bytes), C: digest(contentTreePreimage(entries)), E: digest(runtimeEntryPreimage(entries, manifest)) };
+    assertContentBindings(manifest, digests.C);
+    const integrity = await verifyIntegrityBrowser(entries, manifest, digests.E, copied.signaturePolicy);
+    const envelope = validateEnvelopeShape(decodeEnvelope(entries['payload.kdnab']), profile);
+    assertObservationBinding(copied.observation, envelope);
+    stage = 'payload'; const payload = decodeValidatedPayload(manifest, plaintext);
+    stage = 'interpretation'; const result = finishAdmission(manifest, payload, entries, digests, integrity.checksums === 'verified_document_1' ? digests.E : null);
+    const disclosure = freeze({ slot_selection: { ...copied.observation.selection }, observation_not_authority: true, provenance: 'host_supplied_triple' });
+    if (result.status === 'accepted') {
+      const view = require('./brand.js').inspectSnapshot(result.snapshot);
+      require('./browser-protected/state.js').register(result.snapshot, {
+        provider: copied.trustedProvider, integrity, disclosure,
+        observation: { snapshot_id: view.snapshot_id, tuple: view.tuple, asset: view.asset,
+          ...digests, ir_digest: view.ir_digest, integrity, unlock_observation: copied.observation,
+          disclosure, physical_reads: 'none', new_decryption: false }
+      });
+    }
+    return freeze(result.status === 'accepted' ? { status: 'accepted', snapshot: result.snapshot, disclosure } : { status: 'catalog_only', catalog: result, disclosure });
+  } catch (error) {
+    if (isFailure(error) || stage === 'input') return failure(error);
+    return freeze({ status: 'core_rejected', stage, core: rejected(error?.code === 'MODULE_NOT_FOUND' ? 'READ_CORE_CAPABILITY_UNAVAILABLE' : error?.reason ?? 'READ_CORE_INVALID', error.component_failure ?? null, error.diagnostic ?? null) });
+  } finally {
+    plaintext?.fill(0);
+  }
+}
+module.exports = { admitProtectedBrowser };

package/src/public-contract/protection-contract.generated.json

@@ -1,5 +1,6 @@
 {
   "api_typescript": "export type ProtectedSignaturePolicy = { readonly requireSignature: boolean; readonly expectedPublicKeyHex: string | null };\nexport type ProtectionGrantExpectations = { readonly issuer: string; readonly signing_key_id: string; readonly issuer_public_key: string; readonly account_id: string; readonly entitlement_id: string; readonly entitlement_profile: 'account' | 'org'; readonly device_id: string; readonly device_agreement_public_key: string; readonly device_signing_public_key: string };\nexport type ProtectedCredential = { readonly kind: 'none' } | { readonly kind: 'password'; readonly password: Uint8Array; readonly slotIndex?: number } | { readonly kind: 'external-grant'; readonly grantBytes: Uint8Array; readonly deviceAgreementPrivateKeyPkcs8: Uint8Array; readonly mode: 'online' | 'offline'; readonly expected: ProtectionGrantExpectations };\nexport type ProtectedAdmissionOptions = { readonly credential: ProtectedCredential; readonly signaturePolicy: ProtectedSignaturePolicy };\nexport type ProtectionStateScope = { readonly issuer: string; readonly account_id: string; readonly entitlement_id: string };\nexport type ProtectionHighWater = { readonly scope: ProtectionStateScope; readonly highest_status_version: number; readonly status: 'active' | 'revoked' | 'expired'; readonly last_trusted_time_ms: number; readonly revision: number };\nexport type ProtectionStateAdvance = { readonly scope: ProtectionStateScope; readonly device_id: string; readonly verified: { readonly grant_digest: string; readonly status_version: number; readonly status: 'active' | 'revoked' | 'expired'; readonly observed_at_ms: number } };\nexport type ProtectionRefreshContext = ProtectionStateScope & { readonly device_id: string; readonly A: string; readonly grant_id: string; readonly status_version: number; readonly purpose: 'authorization' | 'projection' | 'host_handoff' | 'transport_commit' };\nexport type TrustedProtectionProvider = { readonly kind: 'local'; readonly clock: () => number } | { readonly kind: 'external'; readonly clock: () => number; readonly capabilities: { readonly offline: boolean; readonly status_refresh: boolean; readonly revocation: boolean }; readonly readAdvance: (input: ProtectionStateAdvance) => Promise<ProtectionHighWater>; readonly refresh?: (context: ProtectionRefreshContext) => Promise<Uint8Array> };\nexport type ProtectionPhase = 'projection' | 'host_observation' | 'host_handoff' | 'read_return' | 'transport_commit' | 'execution';\nexport type ProtectionCurrent = { readonly status: 'current'; readonly receipt: ProtectionReceipt };\nexport type ProtectionObserved = ProtectionCurrent & { readonly checkpoint: ProtectionCheckpoint };\nexport type ProtectionSource = { readonly kind: 'snapshot'; readonly snapshot: CanonicalReadSnapshot } | { readonly kind: 'catalog'; readonly catalog: CoreAdmissionCatalogOnly };\nexport type ProtectionBindingResult = { readonly status: 'bound'; readonly binding: ProtectionBinding } | ProtectedAdmissionFailed;\nexport type ProtectedExportOptions = ({ readonly kind: 'integrity' } | { readonly kind: 'password'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'password'; readonly offline?: boolean; readonly revocable?: boolean }; readonly slots: ReadonlyArray<{ readonly slot: string; readonly kdf_profile: 'scrypt-sha256' | 'argon2id' }> } | { readonly kind: 'external-grant'; readonly asset_uid: string; readonly entitlement: { readonly profile: 'account' | 'org'; readonly offline?: boolean; readonly revocable?: boolean }; readonly key_ref: string; readonly issuer_key_id: string }) & { readonly checksums: boolean; readonly signature: 'none' | 'ed25519' };\nexport type ProtectedProducerSecrets = { readonly passwords: ReadonlyArray<{ readonly slot: string; readonly password: Uint8Array }>; readonly signingSeed?: Uint8Array; readonly issuerRootKey?: never } | { readonly issuerRootKey: Uint8Array; readonly signingSeed?: Uint8Array; readonly passwords?: never } | { readonly signingSeed?: Uint8Array; readonly issuerRootKey?: never; readonly passwords?: never };\nexport type ProtectedExportResult = { readonly status: 'produced'; readonly bytes: Uint8Array; readonly evidence: ProtectedExportEvidence } | ProtectedCoreRejected | ProtectedAdmissionFailed;\nexport declare function getProtectionContract(): ProtectionRuntimeDescriptor;\nexport declare function admitProtectedNode(input: string | Uint8Array, options: ProtectedAdmissionOptions, provider: TrustedProtectionProvider): Promise<ProtectedAdmissionResult>;\nexport declare function bindProtectionOperation(operation: ProtectionOperation): ProtectionBindingResult;\nexport declare function disposeProtectionOperation(operation: ProtectionOperation): void;\nexport declare function protectSourceBytes(input: Uint8Array, options: ProtectedExportOptions, secrets: ProtectedProducerSecrets): Promise<ProtectedExportResult>;\n",
+  "browser_api_typescript": "import type { CanonicalReadSnapshot, CoreAdmissionCatalogOnly, CoreAdmissionRejected } from './types.js';\nimport type { ProtectionDiagnostic, ProtectionRuntimeDescriptor, ProtectedSignaturePolicy, TrustedProtectionProvider } from './protection-node.js';\nexport type ConsumerUnlockSelection = { readonly \"slotIndex\": number; readonly \"slot\": string; readonly \"kdf_profile\": \"scrypt-sha256\" | \"argon2id\"; };\nexport type ConsumerUnlockObservation = { readonly \"kind\": \"consumer_unlock_observation\"; readonly \"proof\": \"observation_not_authority\"; readonly \"checked_at_ms\": number; readonly \"selection\": ConsumerUnlockSelection; };\nexport type ProtectedBrowserInput = { readonly \"bytes\": Uint8Array; readonly \"plaintextPayload\": Uint8Array; readonly \"observation\": ConsumerUnlockObservation; readonly \"signaturePolicy\"?: ProtectedSignaturePolicy; };\nexport type ProtectedBrowserDisclosure = { readonly \"slot_selection\": ConsumerUnlockSelection; readonly \"observation_not_authority\": true; readonly \"provenance\": \"host_supplied_triple\"; };\nexport type ProtectedBrowserAccepted = { readonly \"status\": \"accepted\"; readonly \"snapshot\": CanonicalReadSnapshot; readonly \"disclosure\": ProtectedBrowserDisclosure; };\nexport type ProtectedBrowserCatalogOnly = { readonly \"status\": \"catalog_only\"; readonly \"catalog\": CoreAdmissionCatalogOnly; readonly \"disclosure\": ProtectedBrowserDisclosure; };\nexport type ProtectedBrowserCoreRejected = { readonly \"status\": \"core_rejected\"; readonly \"stage\": \"container\" | \"manifest\" | \"payload\" | \"interpretation\"; readonly \"core\": CoreAdmissionRejected; };\nexport type ProtectedBrowserFailed = { readonly \"status\": \"protection_failed\"; readonly \"diagnostic\": ProtectedBrowserDiagnostic; };\n// The observation-phase codes are the reviewed family extension settled under\n// D-CBPA-IMPL-3 (2026-10-06); the shared node codes keep their stages.\nexport type ProtectedBrowserDiagnostic = (ProtectionDiagnostic | { readonly \"code\": \"PROTECTION_OBSERVATION_INVALID\"; readonly \"stage\": \"observation\"; } | { readonly \"code\": \"PROTECTION_OBSERVATION_BINDING_INVALID\"; readonly \"stage\": \"binding\"; } | { readonly \"code\": \"PROTECTION_NOT_DECLARED\"; readonly \"stage\": \"declaration\"; });\nexport type ProtectedBrowserAdmissionResult = (ProtectedBrowserAccepted | ProtectedBrowserCatalogOnly | ProtectedBrowserCoreRejected | ProtectedBrowserFailed);\nexport declare function getProtectionContract(): ProtectionRuntimeDescriptor;\nexport declare function admitProtectedBrowser(input: ProtectedBrowserInput, provider: TrustedProtectionProvider): Promise<ProtectedBrowserAdmissionResult>;",
   "capability_shapes": {
     "ProtectionBinding": "{ readonly source: () => ProtectionSource | ProtectedAdmissionFailed; readonly observe: (phase: ProtectionPhase) => Promise<ProtectionObserved | ProtectionCurrentFailure>; readonly assertCurrent: (checkpoint: ProtectionCheckpoint) => ProtectionCurrent | ProtectionCurrentFailure }"
   },
@@ -13,7 +14,7 @@
     "schema_path": "specs/checksums-document-1.schema.json",
     "version": "1.0.0"
   },
-  "definition_digest": "sha256:fc6e6b3108e15c8caf84de08d3bb77d96138c1dcff6d67e0d9ca450f10e7b797",
+  "definition_digest": "sha256:7257adf964aadbce546b1403a059852b72f5df269503d6b58445d1f549e2252d",
   "delivery_history": {
     "acknowledgement": "Only literal synchronous true confirms the configured trusted transport handoff. False/throw/thenable/invalid return leaves outcome_unknown. Never await or execute an untrusted then method to improve the result. Callback itself may already have sent data.",
     "disposal": "Disposal closes authority and clears secrets best effort but retains the redacted per-token delivery history while its token/owning Read remains reachable, so a later failure cannot erase past attempts.",
@@ -177,8 +178,8 @@
         "packages/kdna-core/src/public-contract/protection-declaration.js:1-75",
         "packages/kdna-core/src/public-contract/protection-admission.js:1-94",
         "packages/kdna-core/src/public-contract/protection-producer.js:1-75",
-        "packages/kdna-core/src/public-contract/protection-crypto.js:1-91",
-        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-78"
+        "packages/kdna-core/src/public-contract/protection-crypto.js:1-82",
+        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-138"
       ],
       "proof": [
         {
@@ -707,8 +708,8 @@
         "packages/kdna-core/src/public-contract/protection-declaration.js:1-75",
         "packages/kdna-core/src/public-contract/protection-admission.js:1-94",
         "packages/kdna-core/src/public-contract/protection-producer.js:1-75",
-        "packages/kdna-core/src/public-contract/protection-crypto.js:1-91",
-        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-78"
+        "packages/kdna-core/src/public-contract/protection-crypto.js:1-82",
+        "packages/kdna-core/src/public-contract/protection-envelope-codec.js:1-138"
       ]
     },
     "PROTECTION-RESULTS": {
@@ -801,8 +802,8 @@
   "runtime_not_implemented": [],
   "schema_binding": {
     "package_versions": {
-      "@aikdna/kdna-core": "0.36.0",
-      "@aikdna/kdna-read": "0.11.0"
+      "@aikdna/kdna-core": "0.37.1-rc.browser.1",
+      "@aikdna/kdna-read": "0.11.2-rc.browser.1"
     },
     "version_tuple": {
       "container": "0.5.0",
@@ -817,12 +818,12 @@
       "trace": "kdna.judgment-trace/0.3.1"
     }
   },
-  "schema_id": "urn:kdna:schema:protection-admission:1.0.0:binding:r2:7",
-  "schema_path": "specs/protection-admission-r2-binding-7.schema.json",
+  "schema_id": "urn:kdna:schema:protection-admission:1.0.0:binding:r2:8",
+  "schema_path": "specs/protection-admission-r2-binding-8.schema.json",
   "specification": {
-    "bytes": 37902,
+    "bytes": 38180,
     "path": "specs/protection-admission.md",
-    "sha256": "e8665e8c325e5743d4cce7acbb5b36ae3581d8eb2c261e09c66f0683ece99835"
+    "sha256": "35180f6583ac97302096a8e2ff786f1c7a9a0c10caabc3a4fa627affd1640bef"
   },
   "types": {
     "ChecksumsDocument1": {
@@ -1059,7 +1060,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0",
+              "const": "0.37.1-rc.browser.1",
               "type": "string"
             }
           },
@@ -2294,7 +2295,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0",
+              "const": "0.37.1-rc.browser.1",
               "type": "string"
             }
           },

package/src/public-contract/protection-crypto.js

@@ -4,28 +4,18 @@ const { fail } = require('./protection-declaration.js');
 const { aesWrap, aesUnwrap } = require('../crypto-profile.js');
 const { externalEnvelopeAad, deriveExternalAssetCek } = require('../external-key-grant.js');
 const { digest } = require('./digests.js');
-const { PasswordEnvelope: passwordShape, ExternalEnvelope: externalShape } = require('./protection-validators.generated.js');
+const { decode64Bytes, validateEnvelopeShape, passwordAadBytes } = require('./protection-envelope-codec.js');
+// The pure shapes live in the codec module (browser-reusable); these wrappers keep the
+// retained result identities (Buffer outputs, same verdicts, same codes) so every existing
+// caller in this package stays unchanged.
 function decode64(value, length = null, url = false) {
-  const encoding = url ? 'base64url' : 'base64';
-  if (typeof value !== 'string') fail('ENVELOPE_INVALID','envelope');
-  const decoded = Buffer.from(value,encoding);
-  if (decoded.toString(encoding) !== value || (length !== null && decoded.length !== length)) fail('ENVELOPE_INVALID','envelope');
-  return decoded;
+  return Buffer.from(decode64Bytes(value, length, url));
 }
 function validateEnvelope(value, profile) {
-  if (value?.profile !== profile.id || (value.profile_version ?? value.contract_version) !== profile.version) fail('PROFILE_UNSUPPORTED','envelope');
-  if (profile.id === 'kdna.envelope.aead') {
-    if (!passwordShape(value) || value.kdf_profile !== value.key_slots[0].kdf_profile) fail('ENVELOPE_INVALID','envelope');
-    for (const slot of value.key_slots) { decode64(slot.kdf_params.salt,16); decode64(slot.wrapped_key,40); }
-    decode64(value.iv,12); decode64(value.tag,16); decode64(value.ciphertext);
-  } else {
-    if (!externalShape(value) || value.entry_path !== 'payload.kdnab') fail('ENVELOPE_INVALID','envelope');
-    decode64(value.iv,12,true); decode64(value.tag,16,true); decode64(value.ciphertext,null,true);
-  }
-  return value;
+  return validateEnvelopeShape(value, profile);
 }
 function passwordAad(manifest) {
-  return Buffer.from(['kdna.envelope.aead','0.1.0',manifest.asset_uid,manifest.asset_id,manifest.version,'payload.kdnab',manifest.access,manifest.entitlement.profile].join('\n'));
+  return Buffer.from(passwordAadBytes(manifest));
 }
 function deriveKek(password, slot) {
   const salt = decode64(slot.kdf_params.salt,16);

package/src/public-contract/protection-envelope-codec.js

@@ -1,30 +1,34 @@
 'use strict';
 const fail = (code, stage) => require('./protection-declaration.js').fail(code, stage);
+const { utf8, equal, concat } = require('./browser-native/bytes.js');
 const LIMIT = 8 * 1024 * 1024;
 function invalid() { fail('ENVELOPE_INVALID','envelope'); }
 function head(major, n) {
   if (!Number.isSafeInteger(n) || n < 0) invalid();
-  if (n < 24) return Buffer.from([(major << 5) | n]);
+  if (n < 24) return Uint8Array.of((major << 5) | n);
   const width = n <= 255 ? 1 : n <= 65535 ? 2 : n <= 4294967295 ? 4 : 8;
-  const out = Buffer.alloc(width + 1); out[0] = (major << 5) | ({1:24,2:25,4:26,8:27})[width];
-  if (width === 8) out.writeBigUInt64BE(BigInt(n),1); else out.writeUIntBE(n,1,width);
+  const out = new Uint8Array(width + 1), view = new DataView(out.buffer); out[0] = (major << 5) | ({1:24,2:25,4:26,8:27})[width];
+  if (width === 8) view.setBigUint64(1,BigInt(n),false);
+  else if (width === 4) view.setUint32(1,n,false);
+  else if (width === 2) view.setUint16(1,n,false);
+  else out[1]=n;
   return out;
 }
-function compare(a,b) { return a.length - b.length || Buffer.compare(a,b); }
+function compare(a,b) { if(a.length!==b.length)return a.length-b.length;for(let i=0;i<a.length;i++)if(a[i]!==b[i])return a[i]-b[i];return 0; }
 function encodeEnvelope(value) {
   let count = 0;
   function encode(v, depth) {
     if (++count > 100000 || depth > 16) invalid();
     if (typeof v === 'string') {
       if (!v.isWellFormed()) invalid();
-      const bytes = Buffer.from(v); if (bytes.length > LIMIT) invalid();
-      return Buffer.concat([head(3,bytes.length),bytes]);
+      const bytes = utf8(v); if (bytes.length > LIMIT) invalid();
+      return concat([head(3,bytes.length),bytes]);
     }
     if (Number.isSafeInteger(v) && v >= 0) return head(0,v);
-    if (Array.isArray(v)) return Buffer.concat([head(4,v.length), ...v.map(x=>encode(x,depth+1))]);
+    if (Array.isArray(v)) return concat([head(4,v.length), ...v.map(x=>encode(x,depth+1))]);
     if (v && typeof v === 'object' && [Object.prototype,null].includes(Object.getPrototypeOf(v))) {
       const members = Object.keys(v).map(k => [encode(k,depth+1), encode(v[k],depth+1)]).sort((a,b)=>compare(a[0],b[0]));
-      return Buffer.concat([head(5,members.length), ...members.flat()]);
+      return concat([head(5,members.length), ...members.flat()]);
     }
     invalid();
   }
@@ -34,7 +38,7 @@ function encodeEnvelope(value) {
 // It never decodes Payload: authenticated plaintext goes to the sole Payload codec.
 function decodeEnvelope(input) {
   if (!(input instanceof Uint8Array) || !input.length || input.length > LIMIT) invalid();
-  const bytes = Buffer.from(input); let offset = 0, count = 0;
+  const bytes = new Uint8Array(input), view = new DataView(bytes.buffer); let offset = 0, count = 0;
   const decoder = new TextDecoder('utf-8',{fatal:true});
   function read(depth) {
     if (++count > 100000 || depth > 16 || offset >= bytes.length) invalid();
@@ -43,7 +47,7 @@ function decodeEnvelope(input) {
     let n = add;
     if (add >= 24) {
       const width = 2 ** (add - 24); if (offset + width > bytes.length) invalid();
-      n = width === 8 ? Number(bytes.readBigUInt64BE(offset)) : bytes.readUIntBE(offset,width); offset += width;
+      n = width === 8 ? Number(view.getBigUint64(offset,false)) : width === 4 ? view.getUint32(offset,false) : width === 2 ? view.getUint16(offset,false) : bytes[offset]; offset += width;
       if (!Number.isSafeInteger(n) || n < (width === 1 ? 24 : 2 ** (8 * width / 2))) invalid();
     }
     if (major === 0) return n;
@@ -63,7 +67,7 @@ function decodeEnvelope(input) {
     }
     return value;
   }
-  const value = read(0); if (offset !== bytes.length || !encodeEnvelope(value).equals(bytes)) invalid(); return value;
+  const value = read(0); if (offset !== bytes.length || !equal(encodeEnvelope(value),bytes)) invalid(); return value;
 }
 // The frozen RFC18 ciphertext pattern is strict canonical padded base64. Native
 // RegExp's repeated four-character group can exhaust the VM stack on an otherwise
@@ -71,8 +75,67 @@ function decodeEnvelope(input) {
 // (including padding bits) in bounded linear memory; all other patterns stay native.
 const CIPHERTEXT_PATTERN = '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/][AQgw]==|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=)?$';
 function envelopeRegExp(pattern, flags) {
-  if(pattern===CIPHERTEXT_PATTERN)return {test:value=>typeof value==='string'&&Buffer.from(value,'base64').toString('base64')===value};
+  if(pattern===CIPHERTEXT_PATTERN)return {test:value=>{try {decode64Bytes(value);return true;}catch{return false;}}};
   return new RegExp(pattern,flags);
 }
 envelopeRegExp.code = "require('./protection-envelope-codec.js').envelopeRegExp";
-module.exports = { encodeEnvelope, decodeEnvelope, envelopeRegExp };
+// Pure base64/base64url codec for the frozen envelope domain: exactly the recognize-or-reject
+// language of the retained Node buffer codec (strict canonical round-trip plus an optional
+// length pin), with no Buffer/atob dependency so browser consumers can reuse it.
+const B64_ALPHABETS = { std: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/', url: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_' };
+const B64_MAPS = {};
+function b64Map(url) {
+  const key = url ? 'url' : 'std';
+  if (!B64_MAPS[key]) { const map = new Int16Array(128).fill(-1); const alphabet = B64_ALPHABETS[key]; for (let i = 0; i < 64; i++) map[alphabet.charCodeAt(i)] = i; B64_MAPS[key] = map; }
+  return B64_MAPS[key];
+}
+function b64Encode(bytes, url) {
+  const alphabet = B64_ALPHABETS[url ? 'url' : 'std']; let out = '';
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i], b1 = bytes[i + 1], b2 = bytes[i + 2];
+    out += alphabet[b0 >> 2] + alphabet[((b0 & 3) << 4) | (b1 === undefined ? 0 : b1 >> 4)];
+    if (b1 === undefined) { if (!url) out += '=='; break; }
+    out += alphabet[((b1 & 15) << 2) | (b2 === undefined ? 0 : b2 >> 6)];
+    if (b2 === undefined) { if (!url) out += '='; break; }
+    out += alphabet[b2 & 63];
+  }
+  return out;
+}
+function decode64Bytes(value, length = null, url = false) {
+  if (typeof value !== 'string') invalid();
+  const map = b64Map(url), n = value.length;
+  if (n % 4 === 1) invalid();
+  const out = new Uint8Array(((n + 3) >> 2) * 3);
+  let o = 0, acc = 0, bits = 0, padded = false;
+  for (let i = 0; i < n; i++) {
+    const code = value.charCodeAt(i);
+    if (code === 61) { padded = true; continue; }
+    if (padded) invalid();
+    const v = code < 128 ? map[code] : -1;
+    if (v < 0) invalid();
+    acc = ((acc << 6) | v) & 0xFFFFFF; bits += 6;
+    if (bits >= 8) { bits -= 8; out[o++] = (acc >> bits) & 0xff; }
+  }
+  const bytes = out.subarray(0, o);
+  if (b64Encode(bytes, url) !== value) invalid();
+  if (length !== null && bytes.length !== length) invalid();
+  return bytes;
+}
+function validateEnvelopeShape(value, profile) {
+  if (value?.profile !== profile.id || (value.profile_version ?? value.contract_version) !== profile.version) fail('PROFILE_UNSUPPORTED','envelope');
+  // Lazy: the generated validators require this module for the frozen ciphertext recognizer.
+  const { PasswordEnvelope: passwordShape, ExternalEnvelope: externalShape } = require('./protection-validators.generated.js');
+  if (profile.id === 'kdna.envelope.aead') {
+    if (!passwordShape(value) || value.kdf_profile !== value.key_slots[0].kdf_profile) fail('ENVELOPE_INVALID','envelope');
+    for (const slot of value.key_slots) { decode64Bytes(slot.kdf_params.salt,16); decode64Bytes(slot.wrapped_key,40); }
+    decode64Bytes(value.iv,12); decode64Bytes(value.tag,16); decode64Bytes(value.ciphertext);
+  } else {
+    if (!externalShape(value) || value.entry_path !== 'payload.kdnab') fail('ENVELOPE_INVALID','envelope');
+    decode64Bytes(value.iv,12,true); decode64Bytes(value.tag,16,true); decode64Bytes(value.ciphertext,null,true);
+  }
+  return value;
+}
+function passwordAadBytes(manifest) {
+  return new TextEncoder().encode(['kdna.envelope.aead','0.1.0',manifest.asset_uid,manifest.asset_id,manifest.version,'payload.kdnab',manifest.access,manifest.entitlement.profile].join('\n'));
+}
+module.exports = { encodeEnvelope, decodeEnvelope, envelopeRegExp, decode64Bytes, validateEnvelopeShape, passwordAadBytes };

package/src/public-contract/protection-node.d.ts

@@ -39,8 +39,8 @@ declare const ProtectionCheckpointBrand: unique symbol;
 export type ProtectionCheckpoint = { readonly [ProtectionCheckpointBrand]: true };
 declare const ProtectedHostReadProviderBrand: unique symbol;
 export type ProtectedHostReadProvider = { readonly [ProtectedHostReadProviderBrand]: true };
-export type ProtectionRuntimeDescriptor = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "package": "@aikdna/kdna-core"; readonly "version": "0.36.0"; }; readonly "profiles": ReadonlyArray<"kdna.envelope.aead/0.1.0" | "kdna.envelope.external-grant/0.1.0" | "kdna.checksums.document/1@1.0.0" | "kdsig.ed25519/0.1.0">; readonly "kdfs": ReadonlyArray<"scrypt-sha256" | "argon2id">; readonly "capabilities": ReadonlyArray<"protected_admission" | "protected_operation" | "protected_production">; };
-export type ProtectedExportEvidence = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "package": "@aikdna/kdna-core"; readonly "version": "0.36.0"; }; readonly "source_A": Digest; readonly "output": { readonly "A": Digest; readonly "C": Digest; readonly "E": Digest; }; readonly "profile": (ProtectionProfile | null); readonly "entry": "payload.kdnab"; readonly "integrity": ProtectionIntegrity; readonly "proof": "producer_observation_not_consumer_admission"; };
+export type ProtectionRuntimeDescriptor = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "package": "@aikdna/kdna-core"; readonly "version": "0.37.1-rc.browser.1"; }; readonly "profiles": ReadonlyArray<"kdna.envelope.aead/0.1.0" | "kdna.envelope.external-grant/0.1.0" | "kdna.checksums.document/1@1.0.0" | "kdsig.ed25519/0.1.0">; readonly "kdfs": ReadonlyArray<"scrypt-sha256" | "argon2id">; readonly "capabilities": ReadonlyArray<"protected_admission" | "protected_operation" | "protected_production">; };
+export type ProtectedExportEvidence = { readonly "contract": ProtectionContractIdentity; readonly "implementation": { readonly "package": "@aikdna/kdna-core"; readonly "version": "0.37.1-rc.browser.1"; }; readonly "source_A": Digest; readonly "output": { readonly "A": Digest; readonly "C": Digest; readonly "E": Digest; }; readonly "profile": (ProtectionProfile | null); readonly "entry": "payload.kdnab"; readonly "integrity": ProtectionIntegrity; readonly "proof": "producer_observation_not_consumer_admission"; };
 export type ProtectedRequestVersionRejected = { readonly "channel": "read_envelope"; readonly "envelope": ReadEnvelopeRejected; readonly "admission_rejection": null; readonly "control": null; readonly "transport_failure": null; };
 export type ProtectionCurrentFailure = { readonly "status": "protection_failed"; readonly "diagnostic": ProtectionDiagnostic; readonly "checked_at_ms": (UInt | null); };
 export type ProtectedSignaturePolicy = { readonly requireSignature: boolean; readonly expectedPublicKeyHex: string | null };