@synoi/sraid 0.2.0 → 0.3.0

package/src/internal/content-core.ts

@@ -0,0 +1,88 @@
+/**
+ * @synoi/sraid — internal/content-core.ts
+ *
+ * The CDRO OID content-core projection: the normative strip-set and the
+ * field-removal function that together define WHAT bytes an OID is computed
+ * over. This is a PURE module — no hashing, no node:crypto, no Buffer — so it
+ * is safe to import from both the node default entry (via oid.ts) and the
+ * browser verify surface (via verify-browser.ts) without dragging node
+ * builtins into a browser bundle.
+ *
+ * This is the SINGLE NORMATIVE SOURCE of the CDRO OID projection (ADR_019).
+ * oid.ts re-exports these symbols and layers the SHA-256 hashing on top; every
+ * other surface (GAP SDKs, the gateway signer, IMPLEMENTING.md) derives from
+ * THIS set, never re-lists it.
+ */
+
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export const CDRO_ENVELOPE_FIELDS: readonly string[] = Object.freeze([
+  'oid',
+  'signature',
+  'ml_dsa_signature',
+  'signature_key_id',
+  'signature_algorithm',
+  'attestation',
+])
+
+const CDRO_ENVELOPE_FIELD_SET: ReadonlySet<string> = new Set(CDRO_ENVELOPE_FIELDS)
+
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export function cdroContentCore(cdro: unknown): Record<string, unknown> {
+  if (cdro === null || typeof cdro !== 'object' || Array.isArray(cdro)) {
+    throw new TypeError('cdroContentCore: argument must be a CDRO object')
+  }
+  const core: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(cdro as Record<string, unknown>)) {
+    if (CDRO_ENVELOPE_FIELD_SET.has(k)) continue
+    core[k] = v
+  }
+  return core
+}

package/src/internal/ed25519-browser.ts

@@ -0,0 +1,85 @@
+/**
+ * @synoi/sraid — internal/ed25519-browser.ts
+ *
+ * Browser-safe Ed25519 verification. NO node:crypto.
+ *
+ * Primary path: WebCrypto (`globalThis.crypto.subtle`), which uses RFC 8032
+ * cofactored verification — the SAME rule OpenSSL/node:crypto uses on the node
+ * default entry, so the browser verifier accepts/rejects exactly what the node
+ * verifier does for every real signature.
+ *
+ * Fallback path: `@noble/curves` ed25519 (pure JS), used only when WebCrypto
+ * Ed25519 is unavailable (older embedded webviews / Chrome extensions below the
+ * WebCrypto-Ed25519 support floor, ~Chrome 137). @noble defaults to ZIP-215
+ * verification rules, which agree with cofactored on every well-formed
+ * signature and can differ only on deliberately malformed/malleable points that
+ * real signers never produce (see ed25519.ts for the same note). SynOI signs
+ * canonically, so the fallback is behavior-equivalent for legitimate inputs.
+ *
+ * ASYNC: WebCrypto verify is Promise-based, so this returns a Promise<boolean>.
+ * The browser attestation verifier is async as a result; the node path stays
+ * synchronous and unchanged.
+ *
+ * Returns false (never throws) on any malformed input or verification failure,
+ * matching the node `verifyEd25519` contract, so callers get a clean boolean.
+ */
+
+import { ed25519 } from '@noble/curves/ed25519.js'
+
+// Fixed DER prefix for an Ed25519 SubjectPublicKeyInfo (RFC 8410):
+//   SEQUENCE { SEQUENCE { OID 1.3.101.112 } BIT STRING (32 raw bytes) }
+// A plain Uint8Array literal (NOT Buffer, which is undefined in browsers). Used
+// only for the SPKI import fallback below.
+const ED25519_SPKI_PREFIX = new Uint8Array([
+  0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+])
+
+const ED25519_ALG = { name: 'Ed25519' } as const
+
+// Return type is inferred (webcrypto.CryptoKey); the bare `CryptoKey` global is
+// not declared by @types/node ^20, so it is deliberately left un-annotated.
+async function importPublicKey(publicKeyRaw: Uint8Array) {
+  const subtle = globalThis.crypto.subtle
+  try {
+    // Preferred: raw 32-byte import (Secure Curves spec).
+    return await subtle.importKey('raw', publicKeyRaw, ED25519_ALG, false, ['verify'])
+  } catch {
+    // Some engines only accept SPKI for Ed25519 import; wrap the raw key.
+    const spki = new Uint8Array(ED25519_SPKI_PREFIX.length + publicKeyRaw.length)
+    spki.set(ED25519_SPKI_PREFIX, 0)
+    spki.set(publicKeyRaw, ED25519_SPKI_PREFIX.length)
+    return await subtle.importKey('spki', spki, ED25519_ALG, false, ['verify'])
+  }
+}
+
+/**
+ * Verify a raw 64-byte Ed25519 signature over `message` against a raw 32-byte
+ * public key. Prefers WebCrypto (cofactored, matching the node path); falls
+ * back to @noble/curves only when WebCrypto Ed25519 is not supported. Returns
+ * false on any malformed input or verification failure; never throws.
+ */
+export async function verifyEd25519Browser(
+  signature: Uint8Array,
+  message: Uint8Array,
+  publicKeyRaw: Uint8Array,
+): Promise<boolean> {
+  if (publicKeyRaw.length !== 32) return false
+
+  const subtle = globalThis.crypto?.subtle
+  if (subtle) {
+    try {
+      const key = await importPublicKey(publicKeyRaw)
+      return await subtle.verify(ED25519_ALG, key, signature, message)
+    } catch {
+      // Fall through to @noble. A WebCrypto throw here is either an
+      // unsupported-algorithm signal or a malformed input; @noble resolves both
+      // correctly (a real bad signature/key verifies as false there too).
+    }
+  }
+
+  try {
+    return ed25519.verify(signature, message, publicKeyRaw)
+  } catch {
+    return false
+  }
+}

package/src/internal/mldsa-browser.ts

@@ -0,0 +1,39 @@
+/**
+ * @synoi/sraid — internal/mldsa-browser.ts
+ *
+ * Browser-safe ML-DSA-65 (FIPS 204) verification. NO node:crypto.
+ *
+ * Browsers ship no native ML-DSA, so there is only one path here: the pure-JS
+ * `@noble/post-quantum` implementation, which is fully browser-safe. The node
+ * default entry (mldsa.ts) uses a native OpenSSL fast path with this same
+ * @noble impl as its fallback, so both entries are byte-for-byte interoperable.
+ *
+ * IMPORTANT: import `ml_dsa65` DIRECTLY from `@noble/post-quantum/ml-dsa.js`,
+ * NOT from ./mldsa.ts — that module statically imports `node:crypto` (for its
+ * native fast path and the globalThis.crypto polyfill), which would poison a
+ * browser bundle. No globalThis.crypto polyfill is needed here: browsers,
+ * workers, and MV3 service workers all provide it natively, and ml_dsa65.verify
+ * is deterministic (it never calls getRandomValues; only keygen/sign do).
+ *
+ * Verification is SYNCHRONOUS. Returns false (never throws) on any malformed
+ * input or verification failure, matching the node `verifyMlDsa65` contract.
+ */
+
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js'
+
+/**
+ * Verify a raw ML-DSA-65 signature over `message` against a raw 1952-byte
+ * public key using @noble/post-quantum. Returns false on any malformed input or
+ * verification failure; never throws.
+ */
+export function verifyMlDsa65Browser(
+  signature: Uint8Array,
+  message: Uint8Array,
+  publicKeyRaw: Uint8Array,
+): boolean {
+  try {
+    return ml_dsa65.verify(signature, message, publicKeyRaw)
+  } catch {
+    return false
+  }
+}

package/src/internal/sha256-browser.ts

@@ -0,0 +1,28 @@
+/**
+ * @synoi/sraid — internal/sha256-browser.ts
+ *
+ * Browser-safe SHA-256 via WebCrypto (`globalThis.crypto.subtle.digest`). NO
+ * node:crypto. Used by the browser OID helpers in verify-browser.ts.
+ *
+ * ASYNC: subtle.digest is Promise-based, so the browser OID helpers are async
+ * (the node oid.ts helpers stay synchronous via node:crypto createHash and are
+ * unchanged). SHA-256 is byte-identical across any conformant implementation,
+ * so a browser-computed OID equals the node-computed one for the same input.
+ */
+
+function toHex(bytes: Uint8Array): string {
+  let out = ''
+  for (let i = 0; i < bytes.length; i++) {
+    out += (bytes[i] as number).toString(16).padStart(2, '0')
+  }
+  return out
+}
+
+/**
+ * Compute `sha256:` + lowercase hex of SHA-256(bytes) using WebCrypto. Mirrors
+ * the `sha256:`-prefixed output of the node oid.ts helpers.
+ */
+export async function sha256HexPrefixed(bytes: Uint8Array): Promise<string> {
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes)
+  return 'sha256:' + toHex(new Uint8Array(digest))
+}

package/src/oid.ts

@@ -22,6 +22,16 @@
 
 import { createHash } from 'node:crypto'
 import { canonicalize } from './canonicalize.js'
+import { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js'
+
+// The CDRO strip-set and its content-core projection are the SINGLE NORMATIVE
+// SOURCE (ADR_019) and live in the PURE ./internal/content-core module (no
+// node:crypto), so the browser verify surface can share them byte-for-byte.
+// oid.ts re-exports them and layers the SHA-256 hashing (below) on top; this
+// keeps the public surface (`import { cdroContentCore, CDRO_ENVELOPE_FIELDS }
+// from '@synoi/sraid'`) unchanged. See ./internal/content-core.ts for the
+// normative strip-set documentation; do not re-list it here.
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore }
 
 /**
  * Compute an OID over an arbitrary canonical-compatible value.
@@ -53,79 +63,6 @@ export function oidOfCanonical(canonical: string | Uint8Array): string {
   return 'sha256:' + createHash('sha256').update(bytes).digest('hex')
 }
 
-/**
- * The detached-signature / envelope fields removed by `cdroContentCore`
- * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
- * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
- * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
- *
- * The set is defined SEMANTICALLY: it is "every field produced BY the signer
- * after canonicalization, plus the OID output itself." Concretely:
- *
- *   oid                  — the projection OUTPUT (cannot be an input to itself).
- *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
- *   ml_dsa_signature     — detached PQ signature (attaches after hash).
- *   signature_key_id     — signer-stamped key id (produced by the signer).
- *   signature_algorithm  — signer-stamped alg id (produced by the signer).
- *   attestation          — DSSE AttestationEnvelope (attaches after hash).
- *
- * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
- *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
- *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
- *                     history property requires every lineage edge inside the
- *                     hash. Superseding mints a NEW object; it never mutates
- *                     the old one's bytes, so keeping it here is safe and
- *                     makes the lineage edge tamper-evident.
- *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
- *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
- *     content field.
- *
- * This is the ONE projection that yields the SAME OID whether the object is
- * pre- or post-attestation: attaching an `attestation` (or `signature`,
- * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
- * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
- *
- * It is FROZEN so no caller can mutate the normative set at runtime.
- */
-export const CDRO_ENVELOPE_FIELDS: readonly string[] = Object.freeze([
-  'oid',
-  'signature',
-  'ml_dsa_signature',
-  'signature_key_id',
-  'signature_algorithm',
-  'attestation',
-])
-
-const CDRO_ENVELOPE_FIELD_SET: ReadonlySet<string> = new Set(CDRO_ENVELOPE_FIELDS)
-
-/**
- * Build the OID content core of a full CDRO: the object with EXACTLY the six
- * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
- * the top level, and everything else kept.
- *
- * This is the mechanism that makes the L4 `authority` block, the L3 lineage
- * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
- * and `gap_version` tamper-evident: they are hashed into identity by
- * construction, so a field cannot be added, stripped, re-pointed, or
- * downgraded without producing a different OID (and invalidating the
- * signature, which is computed over these same bytes). Because `prev`/`links`/
- * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
- * whole reachable history (the Merkle-DAG "head proves history" property).
- *
- * Returns a plain object suitable for `canonicalize` / `oidOf`.
- */
-export function cdroContentCore(cdro: unknown): Record<string, unknown> {
-  if (cdro === null || typeof cdro !== 'object' || Array.isArray(cdro)) {
-    throw new TypeError('cdroContentCore: argument must be a CDRO object')
-  }
-  const core: Record<string, unknown> = {}
-  for (const [k, v] of Object.entries(cdro as Record<string, unknown>)) {
-    if (CDRO_ENVELOPE_FIELD_SET.has(k)) continue
-    core[k] = v
-  }
-  return core
-}
-
 /**
  * Compute the OID of a full CDRO over its content core (see
  * `cdroContentCore`). This is the correct way to derive identity for a

package/src/verify-browser.ts

@@ -0,0 +1,185 @@
+/**
+ * @synoi/sraid/verify-browser — browser / Chrome-extension / service-worker
+ * verify surface.
+ *
+ * The default (`.`) entry statically imports `node:crypto` in three places:
+ * ed25519.ts (node-only Ed25519 verify), mldsa.ts (native ML-DSA + polyfill),
+ * and oid.ts (createHash). `node:crypto` does not exist in a browser or
+ * service-worker context, so `import '@synoi/sraid'` breaks any browser bundle.
+ * This entry is the browser-safe alternative: it carries exactly what a v2
+ * hybrid DSSE receipt verifier needs, implemented WITHOUT any static
+ * node:crypto import.
+ *
+ * WHAT THIS EXPOSES (all browser-safe):
+ *   - canonicalize            — pure RFC 8785 JCS serializer (shared, unchanged).
+ *   - cdroContentCore,        — the CDRO OID content-core projection and its
+ *     CDRO_ENVELOPE_FIELDS       normative strip-set (pure; shared byte-for-byte
+ *                                with the node entry via internal/content-core).
+ *   - verifyAttestation       — hybrid DSSE verify (Ed25519 AND ML-DSA-65, both
+ *                                required over the PAE). ASYNC here: WebCrypto
+ *                                Ed25519 verify is Promise-based.
+ *   - pae, ALG_ED25519,       — the DSSE PAE encoder and algorithm ids (pure,
+ *     ALG_ML_DSA_65              shared with the node entry).
+ *   - cdroOid, oidOf,         — OID helpers over WebCrypto SHA-256. ASYNC here
+ *     oidOfCanonical             (subtle.digest is Promise-based).
+ *
+ * CRYPTO BACKENDS (browsers have no native ML-DSA and no node:crypto):
+ *   - Ed25519 verify  → WebCrypto (RFC 8032 cofactored, matching the node path),
+ *                       with a @noble/curves fallback below the WebCrypto-Ed25519
+ *                       support floor. See internal/ed25519-browser.ts.
+ *   - ML-DSA-65 verify → @noble/post-quantum (pure JS). See internal/mldsa-browser.ts.
+ *   - SHA-256          → WebCrypto subtle.digest. See internal/sha256-browser.ts.
+ *
+ * NODE PARITY: the node default entry (`@synoi/sraid`) is unchanged and stays
+ * synchronous with its node:crypto fast paths. This entry is purely additive.
+ * The only surface difference is async: verifyAttestation, cdroOid, oidOf, and
+ * oidOfCanonical return Promises here because WebCrypto is Promise-based.
+ *
+ * Downstream: @synoi/verify's browser build imports this subpath to bring v2
+ * hybrid DSSE verification (verifyReceiptV2) to the browser, replacing the
+ * fail-closed `v2-not-supported-in-browser-build` stub.
+ */
+
+import { canonicalize } from './canonicalize.js'
+import { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js'
+import { decodeBase64StrictBrowser } from './internal/base64-browser.js'
+import { verifyEd25519Browser } from './internal/ed25519-browser.js'
+import { verifyMlDsa65Browser } from './internal/mldsa-browser.js'
+import { sha256HexPrefixed } from './internal/sha256-browser.js'
+import {
+  ALG_ED25519,
+  ALG_ML_DSA_65,
+  findSig,
+  isWellFormedEnvelope,
+  pae,
+  type VerifyAttestationInput,
+  type VerifyAttestationResult,
+} from './internal/attestation-core.js'
+
+// ── Pure / shared re-exports (byte-for-byte identical to the node entry) ──────
+
+export { canonicalize } from './canonicalize.js'
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js'
+export {
+  pae,
+  ALG_ED25519,
+  ALG_ML_DSA_65,
+  type VerifyAttestationInput,
+  type VerifyAttestationResult,
+}
+
+// ── Hybrid DSSE attestation verify (browser, ASYNC) ───────────────────────────
+
+/**
+ * Verify a hybrid DSSE attestation envelope in a browser context. Returns
+ * `valid: true` only when the envelope carries BOTH an `ed25519` and an
+ * `ml-dsa-65` signature and BOTH verify against the supplied public keys over
+ * `PAE(payloadType, payload)`. The payloadType is bound into the signed bytes,
+ * so a signature minted for a different payloadType will not verify.
+ *
+ * ASYNC counterpart of the node `verifyAttestation`: identical envelope shape,
+ * AND policy, PAE bytes, and reason strings — only the return is a Promise,
+ * because Ed25519 verify runs on WebCrypto. Never rejects: any malformed input
+ * or verification failure resolves to `{ valid: false, reasons: [...] }`.
+ */
+export async function verifyAttestation(
+  input: VerifyAttestationInput,
+): Promise<VerifyAttestationResult> {
+  const reasons: string[] = []
+
+  const env = input.envelope
+  if (!isWellFormedEnvelope(env)) {
+    return { valid: false, reasons: ['envelope-malformed'] }
+  }
+
+  if (
+    input.expectedPayloadType !== undefined &&
+    env.payloadType !== input.expectedPayloadType
+  ) {
+    return { valid: false, reasons: ['payload-type-mismatch'] }
+  }
+
+  // The signed bytes: PAE binds payloadType + payload together.
+  const message = pae(env.payloadType, env.payload)
+
+  // Find the required hybrid pair. The AND policy: both must be present.
+  const edEntry = findSig(env.signatures, ALG_ED25519)
+  const mlEntry = findSig(env.signatures, ALG_ML_DSA_65)
+
+  if (!edEntry) reasons.push('missing-ed25519')
+  if (!mlEntry) reasons.push('missing-ml-dsa-65')
+
+  let edOk = false
+  let mlOk = false
+
+  if (edEntry) {
+    let edSig: Uint8Array | null = null
+    try {
+      edSig = decodeBase64StrictBrowser(edEntry.sig)
+    } catch {
+      reasons.push('ed25519-malformed')
+    }
+    if (edSig) {
+      try {
+        edOk = await verifyEd25519Browser(edSig, message, input.ed25519_pub)
+      } catch {
+        edOk = false
+      }
+      if (!edOk) reasons.push('ed25519-invalid')
+    }
+  }
+
+  if (mlEntry) {
+    let mlSig: Uint8Array | null = null
+    try {
+      mlSig = decodeBase64StrictBrowser(mlEntry.sig)
+    } catch {
+      reasons.push('ml-dsa-malformed')
+    }
+    if (mlSig) {
+      try {
+        mlOk = verifyMlDsa65Browser(mlSig, message, input.ml_dsa_pub)
+      } catch {
+        mlOk = false
+      }
+      if (!mlOk) reasons.push('ml-dsa-invalid')
+    }
+  }
+
+  return { valid: edOk && mlOk && !!edEntry && !!mlEntry, reasons }
+}
+
+// ── OID helpers (browser, ASYNC via WebCrypto SHA-256) ────────────────────────
+
+/**
+ * Compute an OID over an arbitrary canonical-compatible value using WebCrypto
+ * SHA-256. Returns `sha256:` followed by 64 lowercase hex characters.
+ *
+ * ASYNC counterpart of the node `oidOf`: same canonical bytes and same
+ * `sha256:`-prefixed output, but returns a Promise because subtle.digest is
+ * Promise-based. Byte-identical result to the node entry for the same input.
+ */
+export async function oidOf(canonical: unknown): Promise<string> {
+  const bytes = new TextEncoder().encode(canonicalize(canonical))
+  return sha256HexPrefixed(bytes)
+}
+
+/**
+ * Compute an OID directly from already-canonicalized bytes using WebCrypto
+ * SHA-256. ASYNC counterpart of the node `oidOfCanonical`.
+ */
+export async function oidOfCanonical(canonical: string | Uint8Array): Promise<string> {
+  const bytes =
+    typeof canonical === 'string' ? new TextEncoder().encode(canonical) : canonical
+  return sha256HexPrefixed(bytes)
+}
+
+/**
+ * Compute the OID of a full CDRO over its content core (see `cdroContentCore`),
+ * using WebCrypto SHA-256. ASYNC counterpart of the node `cdroOid`; yields the
+ * SAME OID whether the object is pre- or post-attestation, and the SAME value
+ * the node entry produces for the same object.
+ */
+export async function cdroOid(cdro: unknown): Promise<string> {
+  return oidOf(cdroContentCore(cdro))
+}