@synoi/sraid 0.2.0 → 0.3.0

package/README.md

@@ -1,7 +1,7 @@
 # @synoi/sraid
 
 Reference TypeScript implementation of **SRAID (Self-Routing Addressable
-Identity Data)** — L0 of the SynOI SRAID Stack. MIT-licensed.
+Identity Data)**, L0 of the SynOI SRAID Stack. MIT-licensed.
 
 SRAID defines:
 
@@ -12,8 +12,8 @@ SRAID defines:
 - an **L3 Merkle-DAG lineage** layer (`prev` edge + typed `links[]`), hashed into the OID so a head id commits its whole reachable history, and
 - a supersession record, the **SRO** (Supersession Record Object), that links a successor CDRO to its predecessor.
 
-The three legacy supersession mechanisms — the self-asserted `supersedes`
-string, the standalone SRO, and the `prev` edge — are unified by the lineage
+The three legacy supersession mechanisms, the self-asserted `supersedes`
+string, the standalone SRO, and the `prev` edge, are unified by the lineage
 helpers (`lineageLinks`, `supersededOids`, `latestWins`). `latestWins` resolves
 a set of versions to its single head by following the identity-bound `prev`/
 `links` edges, giving a verifier a **latest-wins / monotone** rule instead of an
@@ -24,8 +24,8 @@ transparency-log property (DESIGN, not yet deployed). The `set_complete` field
 on `LatestWinsResult` is the local signal that lets a caller detect an
 incomplete (potentially withheld) set.
 
-Higher layers — Vault/Resolver (L1), Inference Broker/Resonance (L2), GAP (L3)
-— are built on SRAID objects. This package is intentionally tiny and has no
+Higher layers are built on SRAID objects: Vault/Resolver at L1, Inference
+Broker/Resonance at L2, GAP at L3. This package is intentionally tiny and has no
 storage, no HTTP surface, and no governance logic.
 
 ## Install
@@ -113,6 +113,51 @@ interface SRO                    { /* supersession record */ }
 interface SignatureEnvelope      { ed25519: string; ml_dsa_65: string; signer_kid: string }
 ```
 
+## Browser, Chrome extension, service worker
+
+The default (`.`) entry statically imports `node:crypto` in three places
+(`ed25519.ts`, `mldsa.ts`, `oid.ts`), so `import '@synoi/sraid'` breaks any
+browser bundle. Import the `./verify-browser` subpath instead. It carries exactly
+what a v2 hybrid DSSE receipt verifier needs, with no static `node:crypto`
+anywhere in its graph.
+
+```ts
+import { verifyAttestation, canonicalize, cdroContentCore } from '@synoi/sraid/verify-browser'
+
+const v = await verifyAttestation({
+  envelope:            receipt.attestation,
+  ed25519_pub,                                   // raw 32 bytes
+  ml_dsa_pub,                                    // raw 1952 bytes
+  expectedPayloadType: 'application/vnd.synoi.gap+json',
+})
+// { valid: true, reasons: [] } only when BOTH signatures verify over the PAE
+```
+
+```ts
+// The subpath surface. Four of these are ASYNC where the node entry is sync,
+// because WebCrypto is Promise-based. Everything else is shared byte-for-byte
+// with the node entry, so the two agree on the same input.
+verifyAttestation(input): Promise<{ valid: boolean; reasons: string[] }>   // ASYNC
+cdroOid(cdro: unknown): Promise<string>                                    // ASYNC
+oidOf(canonical: unknown): Promise<string>                                 // ASYNC
+oidOfCanonical(canonical: string | Uint8Array): Promise<string>            // ASYNC
+
+canonicalize(value: unknown): string          // pure, identical to the node entry
+cdroContentCore(cdro: unknown): Record<string, unknown>
+pae(payloadType: string, payload: string | Uint8Array): Uint8Array
+CDRO_ENVELOPE_FIELDS: readonly string[]
+ALG_ED25519, ALG_ML_DSA_65
+```
+
+Crypto backends, since browsers have no native ML-DSA and no `node:crypto`:
+Ed25519 verify on WebCrypto (RFC 8032 cofactored, matching the node path) with a
+`@noble/curves` fallback below the WebCrypto-Ed25519 support floor; ML-DSA-65
+verify on `@noble/post-quantum`; SHA-256 on WebCrypto `subtle.digest`.
+
+The node default entry is unchanged and keeps its synchronous `node:crypto` fast
+paths. This subpath is purely additive. Added in 0.3.0; earlier versions export
+only `.` and `./canonicalize`.
+
 ## Canonical form
 
 The canonical form is recursive JCS-lite JSON:
@@ -146,4 +191,4 @@ in this package returns `valid: true` only when BOTH succeed.
 
 ## License
 
-MIT — see [`LICENSE`](./LICENSE).
+MIT, see [`LICENSE`](./LICENSE).

package/dist/attestation.d.ts

@@ -30,57 +30,16 @@
  * Identity stability: signatures live in a detached `signatures[]` array and
  * are NEVER part of the OID hash input (see `cdroContentCore` in oid.ts), so
  * adding, rotating, or replacing a signature never changes the object's OID.
- */
-import type { AttestationEnvelope } from './types.js';
-/** The single supported algorithm identifiers for the JSON profile. */
-export declare const ALG_ED25519 = "ed25519";
-export declare const ALG_ML_DSA_65 = "ml-dsa-65";
-/**
- * The DSSE Pre-Authentication Encoding (PAE).
- *
- * Per the DSSE spec:
- *
- *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
- *
- * where:
- *   - SP is a single ASCII space (0x20),
- *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
- *   - type and body are the raw UTF-8 bytes (NOT base64).
  *
- * Binding the payloadType (and both lengths) into the signed bytes is what
- * makes a signature non-transferable across object types. Returns the raw
- * bytes to be signed/verified.
+ * NODE ENTRY: this module verifies via node:crypto (Ed25519 native, ML-DSA-65
+ * native-with-@noble-fallback) and is SYNCHRONOUS. The PAE, algorithm ids,
+ * types, AND-policy lookup, and envelope-shape predicate are shared with the
+ * browser verify surface via ./internal/attestation-core.ts (pure, no
+ * node:crypto); only the verify orchestration below is node-specific. The
+ * browser-safe async equivalent lives in ./verify-browser.ts.
  */
-export declare function pae(payloadType: string, payload: string | Uint8Array): Uint8Array;
-export interface VerifyAttestationInput {
-    /**
-     * The DSSE attestation envelope to verify. Its `payloadType` is bound into
-     * the PAE; its `payload` is the canonical UTF-8 string that was signed.
-     */
-    envelope: AttestationEnvelope;
-    /** Raw 32-byte Ed25519 public key. */
-    ed25519_pub: Uint8Array;
-    /** Raw ML-DSA-65 public key bytes. */
-    ml_dsa_pub: Uint8Array;
-    /**
-     * Optional. If supplied, the verifier asserts the envelope's `payloadType`
-     * equals this value before verifying signatures — an explicit type-pinning
-     * check on top of the structural PAE binding. A mismatch fails with
-     * `payload-type-mismatch`.
-     */
-    expectedPayloadType?: string;
-}
-export interface VerifyAttestationResult {
-    /** True only when BOTH required signatures verified over the same PAE. */
-    valid: boolean;
-    /**
-     * Human-readable failure reasons. Empty when valid. Possible values:
-     * 'envelope-malformed', 'payload-type-mismatch', 'missing-ed25519',
-     * 'missing-ml-dsa-65', 'ed25519-malformed', 'ml-dsa-malformed',
-     * 'ed25519-invalid', 'ml-dsa-invalid'.
-     */
-    reasons: string[];
-}
+import { ALG_ED25519, ALG_ML_DSA_65, pae, type VerifyAttestationInput, type VerifyAttestationResult } from './internal/attestation-core.js';
+export { ALG_ED25519, ALG_ML_DSA_65, pae, type VerifyAttestationInput, type VerifyAttestationResult, };
 /**
  * Verify a hybrid DSSE attestation envelope. Returns `valid: true` only when
  * the envelope carries BOTH an `ed25519` and an `ml-dsa-65` signature and

package/dist/attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAwB,MAAM,YAAY,CAAA;AAE3E,uEAAuE;AACvE,eAAO,MAAM,WAAW,YAAY,CAAA;AACpC,eAAO,MAAM,aAAa,cAAc,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAYjF;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,sCAAsC;IACtC,WAAW,EAAE,UAAU,CAAA;IACvB,sCAAsC;IACtC,UAAU,EAAE,UAAU,CAAA;IACtB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CAsExF"}
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,EACL,WAAW,EACX,aAAa,EAGb,GAAG,EACH,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAA;AAIvC,OAAO,EACL,WAAW,EACX,aAAa,EACb,GAAG,EACH,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CA+DxF"}

package/dist/attestation.js

@@ -30,39 +30,21 @@
  * Identity stability: signatures live in a detached `signatures[]` array and
  * are NEVER part of the OID hash input (see `cdroContentCore` in oid.ts), so
  * adding, rotating, or replacing a signature never changes the object's OID.
+ *
+ * NODE ENTRY: this module verifies via node:crypto (Ed25519 native, ML-DSA-65
+ * native-with-@noble-fallback) and is SYNCHRONOUS. The PAE, algorithm ids,
+ * types, AND-policy lookup, and envelope-shape predicate are shared with the
+ * browser verify surface via ./internal/attestation-core.ts (pure, no
+ * node:crypto); only the verify orchestration below is node-specific. The
+ * browser-safe async equivalent lives in ./verify-browser.ts.
  */
 import { verifyEd25519 } from './ed25519.js';
 import { decodeBase64Strict } from './internal/base64.js';
 import { verifyMlDsa65 } from './mldsa.js';
-/** The single supported algorithm identifiers for the JSON profile. */
-export const ALG_ED25519 = 'ed25519';
-export const ALG_ML_DSA_65 = 'ml-dsa-65';
-/**
- * The DSSE Pre-Authentication Encoding (PAE).
- *
- * Per the DSSE spec:
- *
- *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
- *
- * where:
- *   - SP is a single ASCII space (0x20),
- *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
- *   - type and body are the raw UTF-8 bytes (NOT base64).
- *
- * Binding the payloadType (and both lengths) into the signed bytes is what
- * makes a signature non-transferable across object types. Returns the raw
- * bytes to be signed/verified.
- */
-export function pae(payloadType, payload) {
-    const enc = new TextEncoder();
-    const typeBytes = enc.encode(payloadType);
-    const bodyBytes = typeof payload === 'string' ? enc.encode(payload) : payload;
-    const prefix = enc.encode(`DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `);
-    const out = new Uint8Array(prefix.length + bodyBytes.length);
-    out.set(prefix, 0);
-    out.set(bodyBytes, prefix.length);
-    return out;
-}
+import { ALG_ED25519, ALG_ML_DSA_65, findSig, isWellFormedEnvelope, pae, } from './internal/attestation-core.js';
+// Re-export the crypto-agnostic core so the public surface is unchanged:
+// `import { pae, ALG_ED25519, ALG_ML_DSA_65 } from '@synoi/sraid'` still works.
+export { ALG_ED25519, ALG_ML_DSA_65, pae, };
 /**
  * Verify a hybrid DSSE attestation envelope. Returns `valid: true` only when
  * the envelope carries BOTH an `ed25519` and an `ml-dsa-65` signature and
@@ -73,12 +55,7 @@ export function pae(payloadType, payload) {
 export function verifyAttestation(input) {
     const reasons = [];
     const env = input.envelope;
-    if (env === null ||
-        typeof env !== 'object' ||
-        typeof env.payloadType !== 'string' ||
-        env.payloadType.length === 0 ||
-        typeof env.payload !== 'string' ||
-        !Array.isArray(env.signatures)) {
+    if (!isWellFormedEnvelope(env)) {
         return { valid: false, reasons: ['envelope-malformed'] };
     }
     if (input.expectedPayloadType !== undefined &&
@@ -137,18 +114,10 @@ export function verifyAttestation(input) {
     return { valid: edOk && mlOk && !!edEntry && !!mlEntry, reasons };
 }
 // ── Helpers ───────────────────────────────────────────────────────────────────
-function findSig(sigs, alg) {
-    for (const s of sigs) {
-        if (s && typeof s === 'object' && s.alg === alg && typeof s.sig === 'string') {
-            return s;
-        }
-    }
-    return undefined;
-}
 // Strict standard base64. Throws Error('base64-malformed') on any deviation
-// (illegal char, bad length, bad padding) rather than silently truncating.
-// Both call sites wrap this in try/catch and map the throw to a *-malformed
-// reason, so verifyAttestation never throws.
+// (illegal char, bad length, bad padding) rather than silently truncating. The
+// call sites wrap this in try/catch and map the throw to a *-malformed reason,
+// so verifyAttestation never throws.
 function fromBase64(s) {
     return decodeBase64Strict(s);
 }

package/dist/attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG1C,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAA;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,OAA4B;IACnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAE7E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CACvB,UAAU,SAAS,CAAC,MAAM,IAAI,WAAW,IAAI,SAAS,CAAC,MAAM,GAAG,CACjE,CAAA;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAC5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAClB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,GAAG,CAAA;AACZ,CAAC;AAiCD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC1B,IACE,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC9B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,IACE,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACvC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAC7C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAA;IAC7D,CAAC;IAED,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAEjD,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAEtD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAE/C,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,IAAI,GAAG,KAAK,CAAA;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAA;AACnE,CAAC;AAED,iFAAiF;AAEjF,SAAS,OAAO,CACd,IAAqC,EACrC,GAAW;IAEX,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,6CAA6C;AAC7C,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EACL,WAAW,EACX,aAAa,EACb,OAAO,EACP,oBAAoB,EACpB,GAAG,GAGJ,MAAM,gCAAgC,CAAA;AAEvC,yEAAyE;AACzE,gFAAgF;AAChF,OAAO,EACL,WAAW,EACX,aAAa,EACb,GAAG,GAGJ,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC1B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,IACE,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACvC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAC7C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAA;IAC7D,CAAC;IAED,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAEjD,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAEtD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAE/C,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,IAAI,GAAG,KAAK,CAAA;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAA;AACnE,CAAC;AAED,iFAAiF;AAEjF,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,qCAAqC;AACrC,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAA;AAC9B,CAAC"}

package/dist/internal/attestation-core.d.ts

@@ -0,0 +1,85 @@
+/**
+ * @synoi/sraid — internal/attestation-core.ts
+ *
+ * The crypto-agnostic core of the L2 DSSE attestation profile: the PAE
+ * encoding, the algorithm identifiers, the public verify input/result types,
+ * the both-required signature lookup, and the envelope-shape predicate.
+ *
+ * This is a PURE module — no crypto, no node:crypto, no Buffer — so the same
+ * PAE bytes, AND-policy shape, and type contract are shared byte-for-byte by
+ * BOTH the node default entry (attestation.ts, node:crypto verifiers) and the
+ * browser verify surface (verify-browser.ts, WebCrypto + @noble verifiers).
+ * Divergent PAE or shape logic between the two would be a signature-validity
+ * hazard; keeping it in one place removes that risk.
+ *
+ * The verify ORCHESTRATION (decode each sig, run both verifiers, gate on the
+ * AND policy) is intentionally NOT here: the node path is synchronous
+ * (node:crypto verify) and the browser path is asynchronous (WebCrypto verify),
+ * so a single shared body cannot serve both. Each entry keeps its own thin
+ * orchestration and reuses these leaf helpers.
+ */
+import type { AttestationEnvelope, AttestationSignature } from '../types.js';
+/** The single supported algorithm identifiers for the JSON profile. */
+export declare const ALG_ED25519 = "ed25519";
+export declare const ALG_ML_DSA_65 = "ml-dsa-65";
+/**
+ * The DSSE Pre-Authentication Encoding (PAE).
+ *
+ * Per the DSSE spec:
+ *
+ *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
+ *
+ * where:
+ *   - SP is a single ASCII space (0x20),
+ *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
+ *   - type and body are the raw UTF-8 bytes (NOT base64).
+ *
+ * Binding the payloadType (and both lengths) into the signed bytes is what
+ * makes a signature non-transferable across object types. Returns the raw
+ * bytes to be signed/verified.
+ */
+export declare function pae(payloadType: string, payload: string | Uint8Array): Uint8Array;
+export interface VerifyAttestationInput {
+    /**
+     * The DSSE attestation envelope to verify. Its `payloadType` is bound into
+     * the PAE; its `payload` is the canonical UTF-8 string that was signed.
+     */
+    envelope: AttestationEnvelope;
+    /** Raw 32-byte Ed25519 public key. */
+    ed25519_pub: Uint8Array;
+    /** Raw ML-DSA-65 public key bytes. */
+    ml_dsa_pub: Uint8Array;
+    /**
+     * Optional. If supplied, the verifier asserts the envelope's `payloadType`
+     * equals this value before verifying signatures — an explicit type-pinning
+     * check on top of the structural PAE binding. A mismatch fails with
+     * `payload-type-mismatch`.
+     */
+    expectedPayloadType?: string;
+}
+export interface VerifyAttestationResult {
+    /** True only when BOTH required signatures verified over the same PAE. */
+    valid: boolean;
+    /**
+     * Human-readable failure reasons. Empty when valid. Possible values:
+     * 'envelope-malformed', 'payload-type-mismatch', 'missing-ed25519',
+     * 'missing-ml-dsa-65', 'ed25519-malformed', 'ml-dsa-malformed',
+     * 'ed25519-invalid', 'ml-dsa-invalid'.
+     */
+    reasons: string[];
+}
+/**
+ * Structural well-formedness of an attestation envelope: a non-null object with
+ * a non-empty string `payloadType`, a string `payload`, and an array
+ * `signatures`. A false result maps to the `envelope-malformed` reason. This is
+ * the SINGLE definition of envelope shape, shared by the node and browser
+ * verifiers so they reject the same inputs.
+ */
+export declare function isWellFormedEnvelope(env: unknown): env is AttestationEnvelope;
+/**
+ * Find the first well-formed signature entry for `alg` (a `{ alg, sig }` object
+ * whose `sig` is a string). Returns undefined when absent; the AND policy in
+ * each verifier turns a missing pair member into a `missing-*` reason.
+ */
+export declare function findSig(sigs: readonly AttestationSignature[], alg: string): AttestationSignature | undefined;
+//# sourceMappingURL=attestation-core.d.ts.map

package/dist/internal/attestation-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-core.d.ts","sourceRoot":"","sources":["../../src/internal/attestation-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAE5E,uEAAuE;AACvE,eAAO,MAAM,WAAW,YAAY,CAAA;AACpC,eAAO,MAAM,aAAa,cAAc,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAYjF;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,sCAAsC;IACtC,WAAW,EAAE,UAAU,CAAA;IACvB,sCAAsC;IACtC,UAAU,EAAE,UAAU,CAAA;IACtB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,mBAAmB,CAS7E;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,IAAI,EAAE,SAAS,oBAAoB,EAAE,EACrC,GAAG,EAAE,MAAM,GACV,oBAAoB,GAAG,SAAS,CAOlC"}

package/dist/internal/attestation-core.js

@@ -0,0 +1,78 @@
+/**
+ * @synoi/sraid — internal/attestation-core.ts
+ *
+ * The crypto-agnostic core of the L2 DSSE attestation profile: the PAE
+ * encoding, the algorithm identifiers, the public verify input/result types,
+ * the both-required signature lookup, and the envelope-shape predicate.
+ *
+ * This is a PURE module — no crypto, no node:crypto, no Buffer — so the same
+ * PAE bytes, AND-policy shape, and type contract are shared byte-for-byte by
+ * BOTH the node default entry (attestation.ts, node:crypto verifiers) and the
+ * browser verify surface (verify-browser.ts, WebCrypto + @noble verifiers).
+ * Divergent PAE or shape logic between the two would be a signature-validity
+ * hazard; keeping it in one place removes that risk.
+ *
+ * The verify ORCHESTRATION (decode each sig, run both verifiers, gate on the
+ * AND policy) is intentionally NOT here: the node path is synchronous
+ * (node:crypto verify) and the browser path is asynchronous (WebCrypto verify),
+ * so a single shared body cannot serve both. Each entry keeps its own thin
+ * orchestration and reuses these leaf helpers.
+ */
+/** The single supported algorithm identifiers for the JSON profile. */
+export const ALG_ED25519 = 'ed25519';
+export const ALG_ML_DSA_65 = 'ml-dsa-65';
+/**
+ * The DSSE Pre-Authentication Encoding (PAE).
+ *
+ * Per the DSSE spec:
+ *
+ *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
+ *
+ * where:
+ *   - SP is a single ASCII space (0x20),
+ *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
+ *   - type and body are the raw UTF-8 bytes (NOT base64).
+ *
+ * Binding the payloadType (and both lengths) into the signed bytes is what
+ * makes a signature non-transferable across object types. Returns the raw
+ * bytes to be signed/verified.
+ */
+export function pae(payloadType, payload) {
+    const enc = new TextEncoder();
+    const typeBytes = enc.encode(payloadType);
+    const bodyBytes = typeof payload === 'string' ? enc.encode(payload) : payload;
+    const prefix = enc.encode(`DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `);
+    const out = new Uint8Array(prefix.length + bodyBytes.length);
+    out.set(prefix, 0);
+    out.set(bodyBytes, prefix.length);
+    return out;
+}
+/**
+ * Structural well-formedness of an attestation envelope: a non-null object with
+ * a non-empty string `payloadType`, a string `payload`, and an array
+ * `signatures`. A false result maps to the `envelope-malformed` reason. This is
+ * the SINGLE definition of envelope shape, shared by the node and browser
+ * verifiers so they reject the same inputs.
+ */
+export function isWellFormedEnvelope(env) {
+    return (env !== null &&
+        typeof env === 'object' &&
+        typeof env.payloadType === 'string' &&
+        env.payloadType.length > 0 &&
+        typeof env.payload === 'string' &&
+        Array.isArray(env.signatures));
+}
+/**
+ * Find the first well-formed signature entry for `alg` (a `{ alg, sig }` object
+ * whose `sig` is a string). Returns undefined when absent; the AND policy in
+ * each verifier turns a missing pair member into a `missing-*` reason.
+ */
+export function findSig(sigs, alg) {
+    for (const s of sigs) {
+        if (s && typeof s === 'object' && s.alg === alg && typeof s.sig === 'string') {
+            return s;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=attestation-core.js.map

package/dist/internal/attestation-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-core.js","sourceRoot":"","sources":["../../src/internal/attestation-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAA;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,OAA4B;IACnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAE7E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CACvB,UAAU,SAAS,CAAC,MAAM,IAAI,WAAW,IAAI,SAAS,CAAC,MAAM,GAAG,CACjE,CAAA;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAC5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAClB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,GAAG,CAAA;AACZ,CAAC;AAiCD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAQ,GAA2B,CAAC,WAAW,KAAK,QAAQ;QAC3D,GAA2B,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACnD,OAAQ,GAA2B,CAAC,OAAO,KAAK,QAAQ;QACxD,KAAK,CAAC,OAAO,CAAE,GAA2B,CAAC,UAAU,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CACrB,IAAqC,EACrC,GAAW;IAEX,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/internal/base64-browser.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @synoi/sraid — internal/base64-browser.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode for the
+ * BROWSER verify surface.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * Why a separate decoder: the node decoder (./base64.ts `decodeBase64Strict`)
+ * finishes with `Buffer.from(s, 'base64')`. `Buffer` is a NODE global that does
+ * not exist in a browser / service-worker / Chrome-extension context — and,
+ * crucially, it is NOT a `node:` specifier, so an esbuild `node:`-reference scan
+ * would NOT catch it. A `Buffer`-based decode would bundle clean yet throw
+ * `ReferenceError: Buffer is not defined` at runtime. This decoder is
+ * Buffer-free: it reuses the pure `assertBase64` validation (regex/length/
+ * padding only, from ./base64-validate.js — NOT ./base64.js, whose graph pulls
+ * in the `Buffer` decode) and decodes via the standard `atob` global, which IS
+ * available in browsers, dedicated/shared workers, and MV3 extension service
+ * workers.
+ *
+ * Same strict contract as the node path: throws Error('base64-malformed') on
+ * any deviation (illegal char, bad length, bad padding) rather than silently
+ * truncating, so a malformed signature is rejected loudly, never decoded to a
+ * short prefix that then "verifies" against something unintended.
+ */
+/**
+ * Strictly decode standard base64 to raw bytes using only browser-safe globals.
+ * Throws Error('base64-malformed') on any non-conforming input.
+ */
+export declare function decodeBase64StrictBrowser(s: string): Uint8Array;
+//# sourceMappingURL=base64-browser.d.ts.map

package/dist/internal/base64-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-browser.d.ts","sourceRoot":"","sources":["../../src/internal/base64-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAM/D"}

package/dist/internal/base64-browser.js

@@ -0,0 +1,39 @@
+/**
+ * @synoi/sraid — internal/base64-browser.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode for the
+ * BROWSER verify surface.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * Why a separate decoder: the node decoder (./base64.ts `decodeBase64Strict`)
+ * finishes with `Buffer.from(s, 'base64')`. `Buffer` is a NODE global that does
+ * not exist in a browser / service-worker / Chrome-extension context — and,
+ * crucially, it is NOT a `node:` specifier, so an esbuild `node:`-reference scan
+ * would NOT catch it. A `Buffer`-based decode would bundle clean yet throw
+ * `ReferenceError: Buffer is not defined` at runtime. This decoder is
+ * Buffer-free: it reuses the pure `assertBase64` validation (regex/length/
+ * padding only, from ./base64-validate.js — NOT ./base64.js, whose graph pulls
+ * in the `Buffer` decode) and decodes via the standard `atob` global, which IS
+ * available in browsers, dedicated/shared workers, and MV3 extension service
+ * workers.
+ *
+ * Same strict contract as the node path: throws Error('base64-malformed') on
+ * any deviation (illegal char, bad length, bad padding) rather than silently
+ * truncating, so a malformed signature is rejected loudly, never decoded to a
+ * short prefix that then "verifies" against something unintended.
+ */
+import { assertBase64 } from './base64-validate.js';
+/**
+ * Strictly decode standard base64 to raw bytes using only browser-safe globals.
+ * Throws Error('base64-malformed') on any non-conforming input.
+ */
+export function decodeBase64StrictBrowser(s) {
+    assertBase64(s);
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+//# sourceMappingURL=base64-browser.js.map

package/dist/internal/base64-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-browser.js","sourceRoot":"","sources":["../../src/internal/base64-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,CAAS;IACjD,YAAY,CAAC,CAAC,CAAC,CAAA;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/internal/base64-validate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @synoi/sraid — internal/base64-validate.ts
+ *
+ * Pure strict standard-base64 (RFC 4648 §4, with `=` padding) VALIDATION.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * This is the Buffer-free, node:crypto-free half of base64 handling, split out
+ * so the browser decoder (./base64-browser.ts) can validate without importing
+ * ./base64.ts (whose `decodeBase64Strict` uses the node `Buffer` global — safe
+ * in node, a runtime `ReferenceError` in a browser). The node decoder re-uses
+ * this same validator, so both paths reject exactly the same inputs.
+ */
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export declare function assertBase64(s: string): void;
+//# sourceMappingURL=base64-validate.d.ts.map

package/dist/internal/base64-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-validate.d.ts","sourceRoot":"","sources":["../../src/internal/base64-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ5C"}

package/dist/internal/base64-validate.js

@@ -0,0 +1,33 @@
+/**
+ * @synoi/sraid — internal/base64-validate.ts
+ *
+ * Pure strict standard-base64 (RFC 4648 §4, with `=` padding) VALIDATION.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * This is the Buffer-free, node:crypto-free half of base64 handling, split out
+ * so the browser decoder (./base64-browser.ts) can validate without importing
+ * ./base64.ts (whose `decodeBase64Strict` uses the node `Buffer` global — safe
+ * in node, a runtime `ReferenceError` in a browser). The node decoder re-uses
+ * this same validator, so both paths reject exactly the same inputs.
+ */
+// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
+// must be a multiple of 4.
+const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/;
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export function assertBase64(s) {
+    if (typeof s !== 'string')
+        throw new Error('base64-malformed');
+    if (s.length % 4 !== 0)
+        throw new Error('base64-malformed');
+    if (!STD_B64.test(s))
+        throw new Error('base64-malformed');
+    // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
+    // at end already guarantees pad chars are contiguous and trailing, but a pad
+    // char earlier in the body would have been rejected by the alphabet class —
+    // so an in-body `=` cannot pass STD_B64. No extra check needed.
+}
+//# sourceMappingURL=base64-validate.js.map

package/dist/internal/base64-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-validate.js","sourceRoot":"","sources":["../../src/internal/base64-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAA;AAExC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACzD,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;AAClE,CAAC"}

package/dist/internal/base64.d.ts

@@ -14,12 +14,14 @@
  *
  * Canonical inputs carry no surrounding whitespace, so no trim is applied;
  * leading/trailing whitespace is itself a rejection.
+ *
+ * The strict VALIDATION (alphabet/length/padding) lives in the pure, Buffer-
+ * free ./base64-validate.ts so the browser decoder can share it; this module
+ * adds the node `Buffer`-based decode on top and re-exports `assertBase64` so
+ * existing importers of `./base64.js` are unchanged.
  */
-/**
- * Validate strict standard base64. Throws Error('base64-malformed') on any
- * non-conforming input.
- */
-export declare function assertBase64(s: string): void;
+import { assertBase64 } from './base64-validate.js';
+export { assertBase64 };
 /**
  * Strictly decode standard base64 to raw bytes. Throws
  * Error('base64-malformed') on any non-conforming input.

package/dist/internal/base64.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAGxD"}
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAGxD"}

package/dist/internal/base64.js

@@ -14,26 +14,14 @@
  *
  * Canonical inputs carry no surrounding whitespace, so no trim is applied;
  * leading/trailing whitespace is itself a rejection.
+ *
+ * The strict VALIDATION (alphabet/length/padding) lives in the pure, Buffer-
+ * free ./base64-validate.ts so the browser decoder can share it; this module
+ * adds the node `Buffer`-based decode on top and re-exports `assertBase64` so
+ * existing importers of `./base64.js` are unchanged.
  */
-// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
-// must be a multiple of 4.
-const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/;
-/**
- * Validate strict standard base64. Throws Error('base64-malformed') on any
- * non-conforming input.
- */
-export function assertBase64(s) {
-    if (typeof s !== 'string')
-        throw new Error('base64-malformed');
-    if (s.length % 4 !== 0)
-        throw new Error('base64-malformed');
-    if (!STD_B64.test(s))
-        throw new Error('base64-malformed');
-    // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
-    // at end already guarantees pad chars are contiguous and trailing, but a pad
-    // char earlier in the body would have been rejected by the alphabet class —
-    // so an in-body `=` cannot pass STD_B64. No extra check needed.
-}
+import { assertBase64 } from './base64-validate.js';
+export { assertBase64 };
 /**
  * Strictly decode standard base64 to raw bytes. Throws
  * Error('base64-malformed') on any non-conforming input.