@synoi/sraid 0.2.0 → 0.3.0

package/dist/verify-browser.d.ts

@@ -0,0 +1,80 @@
+/**
+ * @synoi/sraid/verify-browser — browser / Chrome-extension / service-worker
+ * verify surface.
+ *
+ * The default (`.`) entry statically imports `node:crypto` in three places:
+ * ed25519.ts (node-only Ed25519 verify), mldsa.ts (native ML-DSA + polyfill),
+ * and oid.ts (createHash). `node:crypto` does not exist in a browser or
+ * service-worker context, so `import '@synoi/sraid'` breaks any browser bundle.
+ * This entry is the browser-safe alternative: it carries exactly what a v2
+ * hybrid DSSE receipt verifier needs, implemented WITHOUT any static
+ * node:crypto import.
+ *
+ * WHAT THIS EXPOSES (all browser-safe):
+ *   - canonicalize            — pure RFC 8785 JCS serializer (shared, unchanged).
+ *   - cdroContentCore,        — the CDRO OID content-core projection and its
+ *     CDRO_ENVELOPE_FIELDS       normative strip-set (pure; shared byte-for-byte
+ *                                with the node entry via internal/content-core).
+ *   - verifyAttestation       — hybrid DSSE verify (Ed25519 AND ML-DSA-65, both
+ *                                required over the PAE). ASYNC here: WebCrypto
+ *                                Ed25519 verify is Promise-based.
+ *   - pae, ALG_ED25519,       — the DSSE PAE encoder and algorithm ids (pure,
+ *     ALG_ML_DSA_65              shared with the node entry).
+ *   - cdroOid, oidOf,         — OID helpers over WebCrypto SHA-256. ASYNC here
+ *     oidOfCanonical             (subtle.digest is Promise-based).
+ *
+ * CRYPTO BACKENDS (browsers have no native ML-DSA and no node:crypto):
+ *   - Ed25519 verify  → WebCrypto (RFC 8032 cofactored, matching the node path),
+ *                       with a @noble/curves fallback below the WebCrypto-Ed25519
+ *                       support floor. See internal/ed25519-browser.ts.
+ *   - ML-DSA-65 verify → @noble/post-quantum (pure JS). See internal/mldsa-browser.ts.
+ *   - SHA-256          → WebCrypto subtle.digest. See internal/sha256-browser.ts.
+ *
+ * NODE PARITY: the node default entry (`@synoi/sraid`) is unchanged and stays
+ * synchronous with its node:crypto fast paths. This entry is purely additive.
+ * The only surface difference is async: verifyAttestation, cdroOid, oidOf, and
+ * oidOfCanonical return Promises here because WebCrypto is Promise-based.
+ *
+ * Downstream: @synoi/verify's browser build imports this subpath to bring v2
+ * hybrid DSSE verification (verifyReceiptV2) to the browser, replacing the
+ * fail-closed `v2-not-supported-in-browser-build` stub.
+ */
+import { ALG_ED25519, ALG_ML_DSA_65, pae, type VerifyAttestationInput, type VerifyAttestationResult } from './internal/attestation-core.js';
+export { canonicalize } from './canonicalize.js';
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js';
+export { pae, ALG_ED25519, ALG_ML_DSA_65, type VerifyAttestationInput, type VerifyAttestationResult, };
+/**
+ * Verify a hybrid DSSE attestation envelope in a browser context. Returns
+ * `valid: true` only when the envelope carries BOTH an `ed25519` and an
+ * `ml-dsa-65` signature and BOTH verify against the supplied public keys over
+ * `PAE(payloadType, payload)`. The payloadType is bound into the signed bytes,
+ * so a signature minted for a different payloadType will not verify.
+ *
+ * ASYNC counterpart of the node `verifyAttestation`: identical envelope shape,
+ * AND policy, PAE bytes, and reason strings — only the return is a Promise,
+ * because Ed25519 verify runs on WebCrypto. Never rejects: any malformed input
+ * or verification failure resolves to `{ valid: false, reasons: [...] }`.
+ */
+export declare function verifyAttestation(input: VerifyAttestationInput): Promise<VerifyAttestationResult>;
+/**
+ * Compute an OID over an arbitrary canonical-compatible value using WebCrypto
+ * SHA-256. Returns `sha256:` followed by 64 lowercase hex characters.
+ *
+ * ASYNC counterpart of the node `oidOf`: same canonical bytes and same
+ * `sha256:`-prefixed output, but returns a Promise because subtle.digest is
+ * Promise-based. Byte-identical result to the node entry for the same input.
+ */
+export declare function oidOf(canonical: unknown): Promise<string>;
+/**
+ * Compute an OID directly from already-canonicalized bytes using WebCrypto
+ * SHA-256. ASYNC counterpart of the node `oidOfCanonical`.
+ */
+export declare function oidOfCanonical(canonical: string | Uint8Array): Promise<string>;
+/**
+ * Compute the OID of a full CDRO over its content core (see `cdroContentCore`),
+ * using WebCrypto SHA-256. ASYNC counterpart of the node `cdroOid`; yields the
+ * SAME OID whether the object is pre- or post-attestation, and the SAME value
+ * the node entry produces for the same object.
+ */
+export declare function cdroOid(cdro: unknown): Promise<string>;
+//# sourceMappingURL=verify-browser.d.ts.map

package/dist/verify-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-browser.d.ts","sourceRoot":"","sources":["../src/verify-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAQH,OAAO,EACL,WAAW,EACX,aAAa,EAGb,GAAG,EACH,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAA;AAIvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EACL,GAAG,EACH,WAAW,EACX,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,CAAA;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA+DlC;AAID;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/D;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpF;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5D"}

package/dist/verify-browser.js

@@ -0,0 +1,157 @@
+/**
+ * @synoi/sraid/verify-browser — browser / Chrome-extension / service-worker
+ * verify surface.
+ *
+ * The default (`.`) entry statically imports `node:crypto` in three places:
+ * ed25519.ts (node-only Ed25519 verify), mldsa.ts (native ML-DSA + polyfill),
+ * and oid.ts (createHash). `node:crypto` does not exist in a browser or
+ * service-worker context, so `import '@synoi/sraid'` breaks any browser bundle.
+ * This entry is the browser-safe alternative: it carries exactly what a v2
+ * hybrid DSSE receipt verifier needs, implemented WITHOUT any static
+ * node:crypto import.
+ *
+ * WHAT THIS EXPOSES (all browser-safe):
+ *   - canonicalize            — pure RFC 8785 JCS serializer (shared, unchanged).
+ *   - cdroContentCore,        — the CDRO OID content-core projection and its
+ *     CDRO_ENVELOPE_FIELDS       normative strip-set (pure; shared byte-for-byte
+ *                                with the node entry via internal/content-core).
+ *   - verifyAttestation       — hybrid DSSE verify (Ed25519 AND ML-DSA-65, both
+ *                                required over the PAE). ASYNC here: WebCrypto
+ *                                Ed25519 verify is Promise-based.
+ *   - pae, ALG_ED25519,       — the DSSE PAE encoder and algorithm ids (pure,
+ *     ALG_ML_DSA_65              shared with the node entry).
+ *   - cdroOid, oidOf,         — OID helpers over WebCrypto SHA-256. ASYNC here
+ *     oidOfCanonical             (subtle.digest is Promise-based).
+ *
+ * CRYPTO BACKENDS (browsers have no native ML-DSA and no node:crypto):
+ *   - Ed25519 verify  → WebCrypto (RFC 8032 cofactored, matching the node path),
+ *                       with a @noble/curves fallback below the WebCrypto-Ed25519
+ *                       support floor. See internal/ed25519-browser.ts.
+ *   - ML-DSA-65 verify → @noble/post-quantum (pure JS). See internal/mldsa-browser.ts.
+ *   - SHA-256          → WebCrypto subtle.digest. See internal/sha256-browser.ts.
+ *
+ * NODE PARITY: the node default entry (`@synoi/sraid`) is unchanged and stays
+ * synchronous with its node:crypto fast paths. This entry is purely additive.
+ * The only surface difference is async: verifyAttestation, cdroOid, oidOf, and
+ * oidOfCanonical return Promises here because WebCrypto is Promise-based.
+ *
+ * Downstream: @synoi/verify's browser build imports this subpath to bring v2
+ * hybrid DSSE verification (verifyReceiptV2) to the browser, replacing the
+ * fail-closed `v2-not-supported-in-browser-build` stub.
+ */
+import { canonicalize } from './canonicalize.js';
+import { cdroContentCore } from './internal/content-core.js';
+import { decodeBase64StrictBrowser } from './internal/base64-browser.js';
+import { verifyEd25519Browser } from './internal/ed25519-browser.js';
+import { verifyMlDsa65Browser } from './internal/mldsa-browser.js';
+import { sha256HexPrefixed } from './internal/sha256-browser.js';
+import { ALG_ED25519, ALG_ML_DSA_65, findSig, isWellFormedEnvelope, pae, } from './internal/attestation-core.js';
+// ── Pure / shared re-exports (byte-for-byte identical to the node entry) ──────
+export { canonicalize } from './canonicalize.js';
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js';
+export { pae, ALG_ED25519, ALG_ML_DSA_65, };
+// ── Hybrid DSSE attestation verify (browser, ASYNC) ───────────────────────────
+/**
+ * Verify a hybrid DSSE attestation envelope in a browser context. Returns
+ * `valid: true` only when the envelope carries BOTH an `ed25519` and an
+ * `ml-dsa-65` signature and BOTH verify against the supplied public keys over
+ * `PAE(payloadType, payload)`. The payloadType is bound into the signed bytes,
+ * so a signature minted for a different payloadType will not verify.
+ *
+ * ASYNC counterpart of the node `verifyAttestation`: identical envelope shape,
+ * AND policy, PAE bytes, and reason strings — only the return is a Promise,
+ * because Ed25519 verify runs on WebCrypto. Never rejects: any malformed input
+ * or verification failure resolves to `{ valid: false, reasons: [...] }`.
+ */
+export async function verifyAttestation(input) {
+    const reasons = [];
+    const env = input.envelope;
+    if (!isWellFormedEnvelope(env)) {
+        return { valid: false, reasons: ['envelope-malformed'] };
+    }
+    if (input.expectedPayloadType !== undefined &&
+        env.payloadType !== input.expectedPayloadType) {
+        return { valid: false, reasons: ['payload-type-mismatch'] };
+    }
+    // The signed bytes: PAE binds payloadType + payload together.
+    const message = pae(env.payloadType, env.payload);
+    // Find the required hybrid pair. The AND policy: both must be present.
+    const edEntry = findSig(env.signatures, ALG_ED25519);
+    const mlEntry = findSig(env.signatures, ALG_ML_DSA_65);
+    if (!edEntry)
+        reasons.push('missing-ed25519');
+    if (!mlEntry)
+        reasons.push('missing-ml-dsa-65');
+    let edOk = false;
+    let mlOk = false;
+    if (edEntry) {
+        let edSig = null;
+        try {
+            edSig = decodeBase64StrictBrowser(edEntry.sig);
+        }
+        catch {
+            reasons.push('ed25519-malformed');
+        }
+        if (edSig) {
+            try {
+                edOk = await verifyEd25519Browser(edSig, message, input.ed25519_pub);
+            }
+            catch {
+                edOk = false;
+            }
+            if (!edOk)
+                reasons.push('ed25519-invalid');
+        }
+    }
+    if (mlEntry) {
+        let mlSig = null;
+        try {
+            mlSig = decodeBase64StrictBrowser(mlEntry.sig);
+        }
+        catch {
+            reasons.push('ml-dsa-malformed');
+        }
+        if (mlSig) {
+            try {
+                mlOk = verifyMlDsa65Browser(mlSig, message, input.ml_dsa_pub);
+            }
+            catch {
+                mlOk = false;
+            }
+            if (!mlOk)
+                reasons.push('ml-dsa-invalid');
+        }
+    }
+    return { valid: edOk && mlOk && !!edEntry && !!mlEntry, reasons };
+}
+// ── OID helpers (browser, ASYNC via WebCrypto SHA-256) ────────────────────────
+/**
+ * Compute an OID over an arbitrary canonical-compatible value using WebCrypto
+ * SHA-256. Returns `sha256:` followed by 64 lowercase hex characters.
+ *
+ * ASYNC counterpart of the node `oidOf`: same canonical bytes and same
+ * `sha256:`-prefixed output, but returns a Promise because subtle.digest is
+ * Promise-based. Byte-identical result to the node entry for the same input.
+ */
+export async function oidOf(canonical) {
+    const bytes = new TextEncoder().encode(canonicalize(canonical));
+    return sha256HexPrefixed(bytes);
+}
+/**
+ * Compute an OID directly from already-canonicalized bytes using WebCrypto
+ * SHA-256. ASYNC counterpart of the node `oidOfCanonical`.
+ */
+export async function oidOfCanonical(canonical) {
+    const bytes = typeof canonical === 'string' ? new TextEncoder().encode(canonical) : canonical;
+    return sha256HexPrefixed(bytes);
+}
+/**
+ * Compute the OID of a full CDRO over its content core (see `cdroContentCore`),
+ * using WebCrypto SHA-256. ASYNC counterpart of the node `cdroOid`; yields the
+ * SAME OID whether the object is pre- or post-attestation, and the SAME value
+ * the node entry produces for the same object.
+ */
+export async function cdroOid(cdro) {
+    return oidOf(cdroContentCore(cdro));
+}
+//# sourceMappingURL=verify-browser.js.map

package/dist/verify-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-browser.js","sourceRoot":"","sources":["../src/verify-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAwB,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EACL,WAAW,EACX,aAAa,EACb,OAAO,EACP,oBAAoB,EACpB,GAAG,GAGJ,MAAM,gCAAgC,CAAA;AAEvC,iFAAiF;AAEjF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EACL,GAAG,EACH,WAAW,EACX,aAAa,GAGd,CAAA;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC1B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,IACE,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACvC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAC7C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAA;IAC7D,CAAC;IAED,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAEjD,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAEtD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAE/C,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,IAAI,GAAG,KAAK,CAAA;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAA;AACnE,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,SAAkB;IAC5C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/D,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAA8B;IACjE,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjF,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAa;IACzC,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;AACrC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synoi/sraid",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Reference TypeScript library for the SynOI SRAID (Self-Routing Addressable Identity Data) protocol - types, canonical object serializer, OID computation, signature verification, and validators for L0 of the SRAID Stack.",
   "license": "MIT",
   "homepage": "https://synoi.systems",
@@ -27,6 +27,23 @@
     "./canonicalize": {
       "types": "./dist/canonicalize.d.ts",
       "default": "./dist/canonicalize.js"
+    },
+    "./verify-browser": {
+      "types": "./dist/verify-browser.d.ts",
+      "browser": "./dist/verify-browser.js",
+      "import": "./dist/verify-browser.js",
+      "require": "./dist/verify-browser.js",
+      "default": "./dist/verify-browser.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "canonicalize": [
+        "dist/canonicalize.d.ts"
+      ],
+      "verify-browser": [
+        "dist/verify-browser.d.ts"
+      ]
     }
   },
   "files": [
@@ -40,7 +57,8 @@
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/run-all.ts"
+    "test": "npx tsx test/run-all.ts",
+    "prepublishOnly": "npm run build && npm test"
   },
   "dependencies": {
     "@noble/curves": "^1.9.7",
@@ -49,6 +67,7 @@
   },
   "devDependencies": {
     "@types/node": "^20.12.0",
+    "esbuild": "^0.28.0",
     "tsx": "^4.22.2",
     "typescript": "^5.4.5"
   },

package/src/attestation.ts

@@ -30,76 +30,36 @@
  * Identity stability: signatures live in a detached `signatures[]` array and
  * are NEVER part of the OID hash input (see `cdroContentCore` in oid.ts), so
  * adding, rotating, or replacing a signature never changes the object's OID.
+ *
+ * NODE ENTRY: this module verifies via node:crypto (Ed25519 native, ML-DSA-65
+ * native-with-@noble-fallback) and is SYNCHRONOUS. The PAE, algorithm ids,
+ * types, AND-policy lookup, and envelope-shape predicate are shared with the
+ * browser verify surface via ./internal/attestation-core.ts (pure, no
+ * node:crypto); only the verify orchestration below is node-specific. The
+ * browser-safe async equivalent lives in ./verify-browser.ts.
  */
 
 import { verifyEd25519 } from './ed25519.js'
 import { decodeBase64Strict } from './internal/base64.js'
 import { verifyMlDsa65 } from './mldsa.js'
-import type { AttestationEnvelope, AttestationSignature } from './types.js'
-
-/** The single supported algorithm identifiers for the JSON profile. */
-export const ALG_ED25519 = 'ed25519'
-export const ALG_ML_DSA_65 = 'ml-dsa-65'
-
-/**
- * The DSSE Pre-Authentication Encoding (PAE).
- *
- * Per the DSSE spec:
- *
- *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
- *
- * where:
- *   - SP is a single ASCII space (0x20),
- *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
- *   - type and body are the raw UTF-8 bytes (NOT base64).
- *
- * Binding the payloadType (and both lengths) into the signed bytes is what
- * makes a signature non-transferable across object types. Returns the raw
- * bytes to be signed/verified.
- */
-export function pae(payloadType: string, payload: string | Uint8Array): Uint8Array {
-  const enc = new TextEncoder()
-  const typeBytes = enc.encode(payloadType)
-  const bodyBytes = typeof payload === 'string' ? enc.encode(payload) : payload
-
-  const prefix = enc.encode(
-    `DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `,
-  )
-  const out = new Uint8Array(prefix.length + bodyBytes.length)
-  out.set(prefix, 0)
-  out.set(bodyBytes, prefix.length)
-  return out
-}
-
-export interface VerifyAttestationInput {
-  /**
-   * The DSSE attestation envelope to verify. Its `payloadType` is bound into
-   * the PAE; its `payload` is the canonical UTF-8 string that was signed.
-   */
-  envelope: AttestationEnvelope
-  /** Raw 32-byte Ed25519 public key. */
-  ed25519_pub: Uint8Array
-  /** Raw ML-DSA-65 public key bytes. */
-  ml_dsa_pub: Uint8Array
-  /**
-   * Optional. If supplied, the verifier asserts the envelope's `payloadType`
-   * equals this value before verifying signatures — an explicit type-pinning
-   * check on top of the structural PAE binding. A mismatch fails with
-   * `payload-type-mismatch`.
-   */
-  expectedPayloadType?: string
-}
-
-export interface VerifyAttestationResult {
-  /** True only when BOTH required signatures verified over the same PAE. */
-  valid: boolean
-  /**
-   * Human-readable failure reasons. Empty when valid. Possible values:
-   * 'envelope-malformed', 'payload-type-mismatch', 'missing-ed25519',
-   * 'missing-ml-dsa-65', 'ed25519-malformed', 'ml-dsa-malformed',
-   * 'ed25519-invalid', 'ml-dsa-invalid'.
-   */
-  reasons: string[]
+import {
+  ALG_ED25519,
+  ALG_ML_DSA_65,
+  findSig,
+  isWellFormedEnvelope,
+  pae,
+  type VerifyAttestationInput,
+  type VerifyAttestationResult,
+} from './internal/attestation-core.js'
+
+// Re-export the crypto-agnostic core so the public surface is unchanged:
+// `import { pae, ALG_ED25519, ALG_ML_DSA_65 } from '@synoi/sraid'` still works.
+export {
+  ALG_ED25519,
+  ALG_ML_DSA_65,
+  pae,
+  type VerifyAttestationInput,
+  type VerifyAttestationResult,
 }
 
 /**
@@ -113,14 +73,7 @@ export function verifyAttestation(input: VerifyAttestationInput): VerifyAttestat
   const reasons: string[] = []
 
   const env = input.envelope
-  if (
-    env === null ||
-    typeof env !== 'object' ||
-    typeof env.payloadType !== 'string' ||
-    env.payloadType.length === 0 ||
-    typeof env.payload !== 'string' ||
-    !Array.isArray(env.signatures)
-  ) {
+  if (!isWellFormedEnvelope(env)) {
     return { valid: false, reasons: ['envelope-malformed'] }
   }
 
@@ -183,22 +136,10 @@ export function verifyAttestation(input: VerifyAttestationInput): VerifyAttestat
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
-function findSig(
-  sigs: readonly AttestationSignature[],
-  alg: string,
-): AttestationSignature | undefined {
-  for (const s of sigs) {
-    if (s && typeof s === 'object' && s.alg === alg && typeof s.sig === 'string') {
-      return s
-    }
-  }
-  return undefined
-}
-
 // Strict standard base64. Throws Error('base64-malformed') on any deviation
-// (illegal char, bad length, bad padding) rather than silently truncating.
-// Both call sites wrap this in try/catch and map the throw to a *-malformed
-// reason, so verifyAttestation never throws.
+// (illegal char, bad length, bad padding) rather than silently truncating. The
+// call sites wrap this in try/catch and map the throw to a *-malformed reason,
+// so verifyAttestation never throws.
 function fromBase64(s: string): Uint8Array {
   return decodeBase64Strict(s)
 }

package/src/internal/attestation-core.ts

@@ -0,0 +1,122 @@
+/**
+ * @synoi/sraid — internal/attestation-core.ts
+ *
+ * The crypto-agnostic core of the L2 DSSE attestation profile: the PAE
+ * encoding, the algorithm identifiers, the public verify input/result types,
+ * the both-required signature lookup, and the envelope-shape predicate.
+ *
+ * This is a PURE module — no crypto, no node:crypto, no Buffer — so the same
+ * PAE bytes, AND-policy shape, and type contract are shared byte-for-byte by
+ * BOTH the node default entry (attestation.ts, node:crypto verifiers) and the
+ * browser verify surface (verify-browser.ts, WebCrypto + @noble verifiers).
+ * Divergent PAE or shape logic between the two would be a signature-validity
+ * hazard; keeping it in one place removes that risk.
+ *
+ * The verify ORCHESTRATION (decode each sig, run both verifiers, gate on the
+ * AND policy) is intentionally NOT here: the node path is synchronous
+ * (node:crypto verify) and the browser path is asynchronous (WebCrypto verify),
+ * so a single shared body cannot serve both. Each entry keeps its own thin
+ * orchestration and reuses these leaf helpers.
+ */
+
+import type { AttestationEnvelope, AttestationSignature } from '../types.js'
+
+/** The single supported algorithm identifiers for the JSON profile. */
+export const ALG_ED25519 = 'ed25519'
+export const ALG_ML_DSA_65 = 'ml-dsa-65'
+
+/**
+ * The DSSE Pre-Authentication Encoding (PAE).
+ *
+ * Per the DSSE spec:
+ *
+ *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
+ *
+ * where:
+ *   - SP is a single ASCII space (0x20),
+ *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
+ *   - type and body are the raw UTF-8 bytes (NOT base64).
+ *
+ * Binding the payloadType (and both lengths) into the signed bytes is what
+ * makes a signature non-transferable across object types. Returns the raw
+ * bytes to be signed/verified.
+ */
+export function pae(payloadType: string, payload: string | Uint8Array): Uint8Array {
+  const enc = new TextEncoder()
+  const typeBytes = enc.encode(payloadType)
+  const bodyBytes = typeof payload === 'string' ? enc.encode(payload) : payload
+
+  const prefix = enc.encode(
+    `DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `,
+  )
+  const out = new Uint8Array(prefix.length + bodyBytes.length)
+  out.set(prefix, 0)
+  out.set(bodyBytes, prefix.length)
+  return out
+}
+
+export interface VerifyAttestationInput {
+  /**
+   * The DSSE attestation envelope to verify. Its `payloadType` is bound into
+   * the PAE; its `payload` is the canonical UTF-8 string that was signed.
+   */
+  envelope: AttestationEnvelope
+  /** Raw 32-byte Ed25519 public key. */
+  ed25519_pub: Uint8Array
+  /** Raw ML-DSA-65 public key bytes. */
+  ml_dsa_pub: Uint8Array
+  /**
+   * Optional. If supplied, the verifier asserts the envelope's `payloadType`
+   * equals this value before verifying signatures — an explicit type-pinning
+   * check on top of the structural PAE binding. A mismatch fails with
+   * `payload-type-mismatch`.
+   */
+  expectedPayloadType?: string
+}
+
+export interface VerifyAttestationResult {
+  /** True only when BOTH required signatures verified over the same PAE. */
+  valid: boolean
+  /**
+   * Human-readable failure reasons. Empty when valid. Possible values:
+   * 'envelope-malformed', 'payload-type-mismatch', 'missing-ed25519',
+   * 'missing-ml-dsa-65', 'ed25519-malformed', 'ml-dsa-malformed',
+   * 'ed25519-invalid', 'ml-dsa-invalid'.
+   */
+  reasons: string[]
+}
+
+/**
+ * Structural well-formedness of an attestation envelope: a non-null object with
+ * a non-empty string `payloadType`, a string `payload`, and an array
+ * `signatures`. A false result maps to the `envelope-malformed` reason. This is
+ * the SINGLE definition of envelope shape, shared by the node and browser
+ * verifiers so they reject the same inputs.
+ */
+export function isWellFormedEnvelope(env: unknown): env is AttestationEnvelope {
+  return (
+    env !== null &&
+    typeof env === 'object' &&
+    typeof (env as AttestationEnvelope).payloadType === 'string' &&
+    (env as AttestationEnvelope).payloadType.length > 0 &&
+    typeof (env as AttestationEnvelope).payload === 'string' &&
+    Array.isArray((env as AttestationEnvelope).signatures)
+  )
+}
+
+/**
+ * Find the first well-formed signature entry for `alg` (a `{ alg, sig }` object
+ * whose `sig` is a string). Returns undefined when absent; the AND policy in
+ * each verifier turns a missing pair member into a `missing-*` reason.
+ */
+export function findSig(
+  sigs: readonly AttestationSignature[],
+  alg: string,
+): AttestationSignature | undefined {
+  for (const s of sigs) {
+    if (s && typeof s === 'object' && s.alg === alg && typeof s.sig === 'string') {
+      return s
+    }
+  }
+  return undefined
+}

package/src/internal/base64-browser.ts

@@ -0,0 +1,39 @@
+/**
+ * @synoi/sraid — internal/base64-browser.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode for the
+ * BROWSER verify surface.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * Why a separate decoder: the node decoder (./base64.ts `decodeBase64Strict`)
+ * finishes with `Buffer.from(s, 'base64')`. `Buffer` is a NODE global that does
+ * not exist in a browser / service-worker / Chrome-extension context — and,
+ * crucially, it is NOT a `node:` specifier, so an esbuild `node:`-reference scan
+ * would NOT catch it. A `Buffer`-based decode would bundle clean yet throw
+ * `ReferenceError: Buffer is not defined` at runtime. This decoder is
+ * Buffer-free: it reuses the pure `assertBase64` validation (regex/length/
+ * padding only, from ./base64-validate.js — NOT ./base64.js, whose graph pulls
+ * in the `Buffer` decode) and decodes via the standard `atob` global, which IS
+ * available in browsers, dedicated/shared workers, and MV3 extension service
+ * workers.
+ *
+ * Same strict contract as the node path: throws Error('base64-malformed') on
+ * any deviation (illegal char, bad length, bad padding) rather than silently
+ * truncating, so a malformed signature is rejected loudly, never decoded to a
+ * short prefix that then "verifies" against something unintended.
+ */
+
+import { assertBase64 } from './base64-validate.js'
+
+/**
+ * Strictly decode standard base64 to raw bytes using only browser-safe globals.
+ * Throws Error('base64-malformed') on any non-conforming input.
+ */
+export function decodeBase64StrictBrowser(s: string): Uint8Array {
+  assertBase64(s)
+  const bin = atob(s)
+  const out = new Uint8Array(bin.length)
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i)
+  return out
+}

package/src/internal/base64-validate.ts

@@ -0,0 +1,31 @@
+/**
+ * @synoi/sraid — internal/base64-validate.ts
+ *
+ * Pure strict standard-base64 (RFC 4648 §4, with `=` padding) VALIDATION.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * This is the Buffer-free, node:crypto-free half of base64 handling, split out
+ * so the browser decoder (./base64-browser.ts) can validate without importing
+ * ./base64.ts (whose `decodeBase64Strict` uses the node `Buffer` global — safe
+ * in node, a runtime `ReferenceError` in a browser). The node decoder re-uses
+ * this same validator, so both paths reject exactly the same inputs.
+ */
+
+// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
+// must be a multiple of 4.
+const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/
+
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export function assertBase64(s: string): void {
+  if (typeof s !== 'string') throw new Error('base64-malformed')
+  if (s.length % 4 !== 0) throw new Error('base64-malformed')
+  if (!STD_B64.test(s)) throw new Error('base64-malformed')
+  // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
+  // at end already guarantees pad chars are contiguous and trailing, but a pad
+  // char earlier in the body would have been rejected by the alphabet class —
+  // so an in-body `=` cannot pass STD_B64. No extra check needed.
+}

package/src/internal/base64.ts

@@ -14,25 +14,16 @@
  *
  * Canonical inputs carry no surrounding whitespace, so no trim is applied;
  * leading/trailing whitespace is itself a rejection.
+ *
+ * The strict VALIDATION (alphabet/length/padding) lives in the pure, Buffer-
+ * free ./base64-validate.ts so the browser decoder can share it; this module
+ * adds the node `Buffer`-based decode on top and re-exports `assertBase64` so
+ * existing importers of `./base64.js` are unchanged.
  */
 
-// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
-// must be a multiple of 4.
-const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/
+import { assertBase64 } from './base64-validate.js'
 
-/**
- * Validate strict standard base64. Throws Error('base64-malformed') on any
- * non-conforming input.
- */
-export function assertBase64(s: string): void {
-  if (typeof s !== 'string') throw new Error('base64-malformed')
-  if (s.length % 4 !== 0) throw new Error('base64-malformed')
-  if (!STD_B64.test(s)) throw new Error('base64-malformed')
-  // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
-  // at end already guarantees pad chars are contiguous and trailing, but a pad
-  // char earlier in the body would have been rejected by the alphabet class —
-  // so an in-body `=` cannot pass STD_B64. No extra check needed.
-}
+export { assertBase64 }
 
 /**
  * Strictly decode standard base64 to raw bytes. Throws