@synoi/sraid 0.2.0 → 0.3.0

package/dist/internal/base64.js.map

@@ -1 +1 @@
-{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAA;AAExC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACzD,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,YAAY,CAAC,CAAC,CAAC,CAAA;IACf,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AACjD,CAAC"}
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,YAAY,CAAC,CAAC,CAAC,CAAA;IACf,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AACjD,CAAC"}

package/dist/internal/content-core.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @synoi/sraid — internal/content-core.ts
+ *
+ * The CDRO OID content-core projection: the normative strip-set and the
+ * field-removal function that together define WHAT bytes an OID is computed
+ * over. This is a PURE module — no hashing, no node:crypto, no Buffer — so it
+ * is safe to import from both the node default entry (via oid.ts) and the
+ * browser verify surface (via verify-browser.ts) without dragging node
+ * builtins into a browser bundle.
+ *
+ * This is the SINGLE NORMATIVE SOURCE of the CDRO OID projection (ADR_019).
+ * oid.ts re-exports these symbols and layers the SHA-256 hashing on top; every
+ * other surface (GAP SDKs, the gateway signer, IMPLEMENTING.md) derives from
+ * THIS set, never re-lists it.
+ */
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export declare const CDRO_ENVELOPE_FIELDS: readonly string[];
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export declare function cdroContentCore(cdro: unknown): Record<string, unknown>;
+//# sourceMappingURL=content-core.d.ts.map

package/dist/internal/content-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-core.d.ts","sourceRoot":"","sources":["../../src/internal/content-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOhD,CAAA;AAIF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtE"}

package/dist/internal/content-core.js

@@ -0,0 +1,87 @@
+/**
+ * @synoi/sraid — internal/content-core.ts
+ *
+ * The CDRO OID content-core projection: the normative strip-set and the
+ * field-removal function that together define WHAT bytes an OID is computed
+ * over. This is a PURE module — no hashing, no node:crypto, no Buffer — so it
+ * is safe to import from both the node default entry (via oid.ts) and the
+ * browser verify surface (via verify-browser.ts) without dragging node
+ * builtins into a browser bundle.
+ *
+ * This is the SINGLE NORMATIVE SOURCE of the CDRO OID projection (ADR_019).
+ * oid.ts re-exports these symbols and layers the SHA-256 hashing on top; every
+ * other surface (GAP SDKs, the gateway signer, IMPLEMENTING.md) derives from
+ * THIS set, never re-lists it.
+ */
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export const CDRO_ENVELOPE_FIELDS = Object.freeze([
+    'oid',
+    'signature',
+    'ml_dsa_signature',
+    'signature_key_id',
+    'signature_algorithm',
+    'attestation',
+]);
+const CDRO_ENVELOPE_FIELD_SET = new Set(CDRO_ENVELOPE_FIELDS);
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export function cdroContentCore(cdro) {
+    if (cdro === null || typeof cdro !== 'object' || Array.isArray(cdro)) {
+        throw new TypeError('cdroContentCore: argument must be a CDRO object');
+    }
+    const core = {};
+    for (const [k, v] of Object.entries(cdro)) {
+        if (CDRO_ENVELOPE_FIELD_SET.has(k))
+            continue;
+        core[k] = v;
+    }
+    return core;
+}
+//# sourceMappingURL=content-core.js.map

package/dist/internal/content-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-core.js","sourceRoot":"","sources":["../../src/internal/content-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,KAAK;IACL,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAA;AAElF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC5C,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/internal/ed25519-browser.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @synoi/sraid — internal/ed25519-browser.ts
+ *
+ * Browser-safe Ed25519 verification. NO node:crypto.
+ *
+ * Primary path: WebCrypto (`globalThis.crypto.subtle`), which uses RFC 8032
+ * cofactored verification — the SAME rule OpenSSL/node:crypto uses on the node
+ * default entry, so the browser verifier accepts/rejects exactly what the node
+ * verifier does for every real signature.
+ *
+ * Fallback path: `@noble/curves` ed25519 (pure JS), used only when WebCrypto
+ * Ed25519 is unavailable (older embedded webviews / Chrome extensions below the
+ * WebCrypto-Ed25519 support floor, ~Chrome 137). @noble defaults to ZIP-215
+ * verification rules, which agree with cofactored on every well-formed
+ * signature and can differ only on deliberately malformed/malleable points that
+ * real signers never produce (see ed25519.ts for the same note). SynOI signs
+ * canonically, so the fallback is behavior-equivalent for legitimate inputs.
+ *
+ * ASYNC: WebCrypto verify is Promise-based, so this returns a Promise<boolean>.
+ * The browser attestation verifier is async as a result; the node path stays
+ * synchronous and unchanged.
+ *
+ * Returns false (never throws) on any malformed input or verification failure,
+ * matching the node `verifyEd25519` contract, so callers get a clean boolean.
+ */
+/**
+ * Verify a raw 64-byte Ed25519 signature over `message` against a raw 32-byte
+ * public key. Prefers WebCrypto (cofactored, matching the node path); falls
+ * back to @noble/curves only when WebCrypto Ed25519 is not supported. Returns
+ * false on any malformed input or verification failure; never throws.
+ */
+export declare function verifyEd25519Browser(signature: Uint8Array, message: Uint8Array, publicKeyRaw: Uint8Array): Promise<boolean>;
+//# sourceMappingURL=ed25519-browser.d.ts.map

package/dist/internal/ed25519-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-browser.d.ts","sourceRoot":"","sources":["../../src/internal/ed25519-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA8BH;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,OAAO,CAAC,CAoBlB"}

package/dist/internal/ed25519-browser.js

@@ -0,0 +1,79 @@
+/**
+ * @synoi/sraid — internal/ed25519-browser.ts
+ *
+ * Browser-safe Ed25519 verification. NO node:crypto.
+ *
+ * Primary path: WebCrypto (`globalThis.crypto.subtle`), which uses RFC 8032
+ * cofactored verification — the SAME rule OpenSSL/node:crypto uses on the node
+ * default entry, so the browser verifier accepts/rejects exactly what the node
+ * verifier does for every real signature.
+ *
+ * Fallback path: `@noble/curves` ed25519 (pure JS), used only when WebCrypto
+ * Ed25519 is unavailable (older embedded webviews / Chrome extensions below the
+ * WebCrypto-Ed25519 support floor, ~Chrome 137). @noble defaults to ZIP-215
+ * verification rules, which agree with cofactored on every well-formed
+ * signature and can differ only on deliberately malformed/malleable points that
+ * real signers never produce (see ed25519.ts for the same note). SynOI signs
+ * canonically, so the fallback is behavior-equivalent for legitimate inputs.
+ *
+ * ASYNC: WebCrypto verify is Promise-based, so this returns a Promise<boolean>.
+ * The browser attestation verifier is async as a result; the node path stays
+ * synchronous and unchanged.
+ *
+ * Returns false (never throws) on any malformed input or verification failure,
+ * matching the node `verifyEd25519` contract, so callers get a clean boolean.
+ */
+import { ed25519 } from '@noble/curves/ed25519.js';
+// Fixed DER prefix for an Ed25519 SubjectPublicKeyInfo (RFC 8410):
+//   SEQUENCE { SEQUENCE { OID 1.3.101.112 } BIT STRING (32 raw bytes) }
+// A plain Uint8Array literal (NOT Buffer, which is undefined in browsers). Used
+// only for the SPKI import fallback below.
+const ED25519_SPKI_PREFIX = new Uint8Array([
+    0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+]);
+const ED25519_ALG = { name: 'Ed25519' };
+// Return type is inferred (webcrypto.CryptoKey); the bare `CryptoKey` global is
+// not declared by @types/node ^20, so it is deliberately left un-annotated.
+async function importPublicKey(publicKeyRaw) {
+    const subtle = globalThis.crypto.subtle;
+    try {
+        // Preferred: raw 32-byte import (Secure Curves spec).
+        return await subtle.importKey('raw', publicKeyRaw, ED25519_ALG, false, ['verify']);
+    }
+    catch {
+        // Some engines only accept SPKI for Ed25519 import; wrap the raw key.
+        const spki = new Uint8Array(ED25519_SPKI_PREFIX.length + publicKeyRaw.length);
+        spki.set(ED25519_SPKI_PREFIX, 0);
+        spki.set(publicKeyRaw, ED25519_SPKI_PREFIX.length);
+        return await subtle.importKey('spki', spki, ED25519_ALG, false, ['verify']);
+    }
+}
+/**
+ * Verify a raw 64-byte Ed25519 signature over `message` against a raw 32-byte
+ * public key. Prefers WebCrypto (cofactored, matching the node path); falls
+ * back to @noble/curves only when WebCrypto Ed25519 is not supported. Returns
+ * false on any malformed input or verification failure; never throws.
+ */
+export async function verifyEd25519Browser(signature, message, publicKeyRaw) {
+    if (publicKeyRaw.length !== 32)
+        return false;
+    const subtle = globalThis.crypto?.subtle;
+    if (subtle) {
+        try {
+            const key = await importPublicKey(publicKeyRaw);
+            return await subtle.verify(ED25519_ALG, key, signature, message);
+        }
+        catch {
+            // Fall through to @noble. A WebCrypto throw here is either an
+            // unsupported-algorithm signal or a malformed input; @noble resolves both
+            // correctly (a real bad signature/key verifies as false there too).
+        }
+    }
+    try {
+        return ed25519.verify(signature, message, publicKeyRaw);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ed25519-browser.js.map

package/dist/internal/ed25519-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-browser.js","sourceRoot":"","sources":["../../src/internal/ed25519-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA;AAElD,mEAAmE;AACnE,wEAAwE;AACxE,gFAAgF;AAChF,2CAA2C;AAC3C,MAAM,mBAAmB,GAAG,IAAI,UAAU,CAAC;IACzC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACvE,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAA;AAEhD,gFAAgF;AAChF,4EAA4E;AAC5E,KAAK,UAAU,eAAe,CAAC,YAAwB;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAA;IACvC,IAAI,CAAC;QACH,sDAAsD;QACtD,OAAO,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7E,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAA;QAChC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAA;QAClD,OAAO,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAqB,EACrB,OAAmB,EACnB,YAAwB;IAExB,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IAE5C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAA;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAA;YAC/C,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,0EAA0E;YAC1E,oEAAoE;QACtE,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/internal/mldsa-browser.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @synoi/sraid — internal/mldsa-browser.ts
+ *
+ * Browser-safe ML-DSA-65 (FIPS 204) verification. NO node:crypto.
+ *
+ * Browsers ship no native ML-DSA, so there is only one path here: the pure-JS
+ * `@noble/post-quantum` implementation, which is fully browser-safe. The node
+ * default entry (mldsa.ts) uses a native OpenSSL fast path with this same
+ * @noble impl as its fallback, so both entries are byte-for-byte interoperable.
+ *
+ * IMPORTANT: import `ml_dsa65` DIRECTLY from `@noble/post-quantum/ml-dsa.js`,
+ * NOT from ./mldsa.ts — that module statically imports `node:crypto` (for its
+ * native fast path and the globalThis.crypto polyfill), which would poison a
+ * browser bundle. No globalThis.crypto polyfill is needed here: browsers,
+ * workers, and MV3 service workers all provide it natively, and ml_dsa65.verify
+ * is deterministic (it never calls getRandomValues; only keygen/sign do).
+ *
+ * Verification is SYNCHRONOUS. Returns false (never throws) on any malformed
+ * input or verification failure, matching the node `verifyMlDsa65` contract.
+ */
+/**
+ * Verify a raw ML-DSA-65 signature over `message` against a raw 1952-byte
+ * public key using @noble/post-quantum. Returns false on any malformed input or
+ * verification failure; never throws.
+ */
+export declare function verifyMlDsa65Browser(signature: Uint8Array, message: Uint8Array, publicKeyRaw: Uint8Array): boolean;
+//# sourceMappingURL=mldsa-browser.d.ts.map

package/dist/internal/mldsa-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mldsa-browser.d.ts","sourceRoot":"","sources":["../../src/internal/mldsa-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,UAAU,GACvB,OAAO,CAMT"}

package/dist/internal/mldsa-browser.js

@@ -0,0 +1,35 @@
+/**
+ * @synoi/sraid — internal/mldsa-browser.ts
+ *
+ * Browser-safe ML-DSA-65 (FIPS 204) verification. NO node:crypto.
+ *
+ * Browsers ship no native ML-DSA, so there is only one path here: the pure-JS
+ * `@noble/post-quantum` implementation, which is fully browser-safe. The node
+ * default entry (mldsa.ts) uses a native OpenSSL fast path with this same
+ * @noble impl as its fallback, so both entries are byte-for-byte interoperable.
+ *
+ * IMPORTANT: import `ml_dsa65` DIRECTLY from `@noble/post-quantum/ml-dsa.js`,
+ * NOT from ./mldsa.ts — that module statically imports `node:crypto` (for its
+ * native fast path and the globalThis.crypto polyfill), which would poison a
+ * browser bundle. No globalThis.crypto polyfill is needed here: browsers,
+ * workers, and MV3 service workers all provide it natively, and ml_dsa65.verify
+ * is deterministic (it never calls getRandomValues; only keygen/sign do).
+ *
+ * Verification is SYNCHRONOUS. Returns false (never throws) on any malformed
+ * input or verification failure, matching the node `verifyMlDsa65` contract.
+ */
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+/**
+ * Verify a raw ML-DSA-65 signature over `message` against a raw 1952-byte
+ * public key using @noble/post-quantum. Returns false on any malformed input or
+ * verification failure; never throws.
+ */
+export function verifyMlDsa65Browser(signature, message, publicKeyRaw) {
+    try {
+        return ml_dsa65.verify(signature, message, publicKeyRaw);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=mldsa-browser.js.map

package/dist/internal/mldsa-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mldsa-browser.js","sourceRoot":"","sources":["../../src/internal/mldsa-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAA;AAExD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAqB,EACrB,OAAmB,EACnB,YAAwB;IAExB,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/internal/sha256-browser.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @synoi/sraid — internal/sha256-browser.ts
+ *
+ * Browser-safe SHA-256 via WebCrypto (`globalThis.crypto.subtle.digest`). NO
+ * node:crypto. Used by the browser OID helpers in verify-browser.ts.
+ *
+ * ASYNC: subtle.digest is Promise-based, so the browser OID helpers are async
+ * (the node oid.ts helpers stay synchronous via node:crypto createHash and are
+ * unchanged). SHA-256 is byte-identical across any conformant implementation,
+ * so a browser-computed OID equals the node-computed one for the same input.
+ */
+/**
+ * Compute `sha256:` + lowercase hex of SHA-256(bytes) using WebCrypto. Mirrors
+ * the `sha256:`-prefixed output of the node oid.ts helpers.
+ */
+export declare function sha256HexPrefixed(bytes: Uint8Array): Promise<string>;
+//# sourceMappingURL=sha256-browser.d.ts.map

package/dist/internal/sha256-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256-browser.d.ts","sourceRoot":"","sources":["../../src/internal/sha256-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E"}

package/dist/internal/sha256-browser.js

@@ -0,0 +1,27 @@
+/**
+ * @synoi/sraid — internal/sha256-browser.ts
+ *
+ * Browser-safe SHA-256 via WebCrypto (`globalThis.crypto.subtle.digest`). NO
+ * node:crypto. Used by the browser OID helpers in verify-browser.ts.
+ *
+ * ASYNC: subtle.digest is Promise-based, so the browser OID helpers are async
+ * (the node oid.ts helpers stay synchronous via node:crypto createHash and are
+ * unchanged). SHA-256 is byte-identical across any conformant implementation,
+ * so a browser-computed OID equals the node-computed one for the same input.
+ */
+function toHex(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i++) {
+        out += bytes[i].toString(16).padStart(2, '0');
+    }
+    return out;
+}
+/**
+ * Compute `sha256:` + lowercase hex of SHA-256(bytes) using WebCrypto. Mirrors
+ * the `sha256:`-prefixed output of the node oid.ts helpers.
+ */
+export async function sha256HexPrefixed(bytes) {
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+    return 'sha256:' + toHex(new Uint8Array(digest));
+}
+//# sourceMappingURL=sha256-browser.js.map

package/dist/internal/sha256-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256-browser.js","sourceRoot":"","sources":["../../src/internal/sha256-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACtE,OAAO,SAAS,GAAG,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAClD,CAAC"}

package/dist/oid.d.ts

@@ -19,6 +19,8 @@
  * This matches the gateway's `computeGapOid` (src/gap/oid.ts) and
  * `payloadOid` (src/inference/receipts.ts) byte-for-byte.
  */
+import { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js';
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore };
 /**
  * Compute an OID over an arbitrary canonical-compatible value.
  *
@@ -38,58 +40,6 @@ export declare function oidOf(canonical: unknown): string;
  * canonicalizing twice.
  */
 export declare function oidOfCanonical(canonical: string | Uint8Array): string;
-/**
- * The detached-signature / envelope fields removed by `cdroContentCore`
- * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
- * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
- * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
- *
- * The set is defined SEMANTICALLY: it is "every field produced BY the signer
- * after canonicalization, plus the OID output itself." Concretely:
- *
- *   oid                  — the projection OUTPUT (cannot be an input to itself).
- *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
- *   ml_dsa_signature     — detached PQ signature (attaches after hash).
- *   signature_key_id     — signer-stamped key id (produced by the signer).
- *   signature_algorithm  — signer-stamped alg id (produced by the signer).
- *   attestation          — DSSE AttestationEnvelope (attaches after hash).
- *
- * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
- *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
- *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
- *                     history property requires every lineage edge inside the
- *                     hash. Superseding mints a NEW object; it never mutates
- *                     the old one's bytes, so keeping it here is safe and
- *                     makes the lineage edge tamper-evident.
- *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
- *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
- *     content field.
- *
- * This is the ONE projection that yields the SAME OID whether the object is
- * pre- or post-attestation: attaching an `attestation` (or `signature`,
- * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
- * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
- *
- * It is FROZEN so no caller can mutate the normative set at runtime.
- */
-export declare const CDRO_ENVELOPE_FIELDS: readonly string[];
-/**
- * Build the OID content core of a full CDRO: the object with EXACTLY the six
- * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
- * the top level, and everything else kept.
- *
- * This is the mechanism that makes the L4 `authority` block, the L3 lineage
- * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
- * and `gap_version` tamper-evident: they are hashed into identity by
- * construction, so a field cannot be added, stripped, re-pointed, or
- * downgraded without producing a different OID (and invalidating the
- * signature, which is computed over these same bytes). Because `prev`/`links`/
- * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
- * whole reachable history (the Merkle-DAG "head proves history" property).
- *
- * Returns a plain object suitable for `canonicalize` / `oidOf`.
- */
-export declare function cdroContentCore(cdro: unknown): Record<string, unknown>;
 /**
  * Compute the OID of a full CDRO over its content core (see
  * `cdroContentCore`). This is the correct way to derive identity for a

package/dist/oid.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oid.d.ts","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH;;;;;;;;;;GAUG;AACH,wBAAgB,KAAK,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAMrE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOhD,CAAA;AAIF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAE7C"}
+{"version":3,"file":"oid.d.ts","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AASlF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,wBAAgB,KAAK,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAMrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAE7C"}

package/dist/oid.js

@@ -21,6 +21,15 @@
  */
 import { createHash } from 'node:crypto';
 import { canonicalize } from './canonicalize.js';
+import { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js';
+// The CDRO strip-set and its content-core projection are the SINGLE NORMATIVE
+// SOURCE (ADR_019) and live in the PURE ./internal/content-core module (no
+// node:crypto), so the browser verify surface can share them byte-for-byte.
+// oid.ts re-exports them and layers the SHA-256 hashing (below) on top; this
+// keeps the public surface (`import { cdroContentCore, CDRO_ENVELOPE_FIELDS }
+// from '@synoi/sraid'`) unchanged. See ./internal/content-core.ts for the
+// normative strip-set documentation; do not re-list it here.
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore };
 /**
  * Compute an OID over an arbitrary canonical-compatible value.
  *
@@ -48,77 +57,6 @@ export function oidOfCanonical(canonical) {
         : canonical;
     return 'sha256:' + createHash('sha256').update(bytes).digest('hex');
 }
-/**
- * The detached-signature / envelope fields removed by `cdroContentCore`
- * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
- * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
- * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
- *
- * The set is defined SEMANTICALLY: it is "every field produced BY the signer
- * after canonicalization, plus the OID output itself." Concretely:
- *
- *   oid                  — the projection OUTPUT (cannot be an input to itself).
- *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
- *   ml_dsa_signature     — detached PQ signature (attaches after hash).
- *   signature_key_id     — signer-stamped key id (produced by the signer).
- *   signature_algorithm  — signer-stamped alg id (produced by the signer).
- *   attestation          — DSSE AttestationEnvelope (attaches after hash).
- *
- * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
- *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
- *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
- *                     history property requires every lineage edge inside the
- *                     hash. Superseding mints a NEW object; it never mutates
- *                     the old one's bytes, so keeping it here is safe and
- *                     makes the lineage edge tamper-evident.
- *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
- *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
- *     content field.
- *
- * This is the ONE projection that yields the SAME OID whether the object is
- * pre- or post-attestation: attaching an `attestation` (or `signature`,
- * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
- * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
- *
- * It is FROZEN so no caller can mutate the normative set at runtime.
- */
-export const CDRO_ENVELOPE_FIELDS = Object.freeze([
-    'oid',
-    'signature',
-    'ml_dsa_signature',
-    'signature_key_id',
-    'signature_algorithm',
-    'attestation',
-]);
-const CDRO_ENVELOPE_FIELD_SET = new Set(CDRO_ENVELOPE_FIELDS);
-/**
- * Build the OID content core of a full CDRO: the object with EXACTLY the six
- * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
- * the top level, and everything else kept.
- *
- * This is the mechanism that makes the L4 `authority` block, the L3 lineage
- * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
- * and `gap_version` tamper-evident: they are hashed into identity by
- * construction, so a field cannot be added, stripped, re-pointed, or
- * downgraded without producing a different OID (and invalidating the
- * signature, which is computed over these same bytes). Because `prev`/`links`/
- * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
- * whole reachable history (the Merkle-DAG "head proves history" property).
- *
- * Returns a plain object suitable for `canonicalize` / `oidOf`.
- */
-export function cdroContentCore(cdro) {
-    if (cdro === null || typeof cdro !== 'object' || Array.isArray(cdro)) {
-        throw new TypeError('cdroContentCore: argument must be a CDRO object');
-    }
-    const core = {};
-    for (const [k, v] of Object.entries(cdro)) {
-        if (CDRO_ENVELOPE_FIELD_SET.has(k))
-            continue;
-        core[k] = v;
-    }
-    return core;
-}
 /**
  * Compute the OID of a full CDRO over its content core (see
  * `cdroContentCore`). This is the correct way to derive identity for a

package/dist/oid.js.map

@@ -1 +1 @@
-{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,KAAK,CAAC,SAAkB;IACtC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/D,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAA8B;IAC3D,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;QACrC,CAAC,CAAC,SAAS,CAAA;IACf,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,KAAK;IACL,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAA;AAElF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC5C,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,IAAa;IACnC,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;AACrC,CAAC"}
+{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAElF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,KAAK,CAAC,SAAkB;IACtC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/D,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAA8B;IAC3D,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;QACrC,CAAC,CAAC,SAAS,CAAA;IACf,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,IAAa;IACnC,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;AACrC,CAAC"}