@synoi/sraid 0.2.0 → 0.4.0

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,IAAI,EACJ,WAAW,EACX,OAAO,EACP,GAAG,EACH,OAAO,EACP,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGhD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAGhG,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAA;AAKvB,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAMlE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,WAAW,EACX,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAA;AAGrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,IAAI,EACJ,WAAW,EACX,OAAO,EACP,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGhD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAGhG,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAA;AAKvB,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAMlE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,WAAW,EACX,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAA;AAIzB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAA;AAGrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAIzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAGrE,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -1,17 +1,17 @@
 /**
  * @synoi/sraid — public surface.
  *
- * SRAID (Self-Routing Addressable Identity Data) is L0 of the SynOI SRAID Stack:
+ * SRAID is the object-identity layer: it defines what a signed object IS and
+ * how anyone re-derives and verifies its identity offline.
  *
- *   L0 SRAID            ← this package
- *   L1 Vault / Resolver
- *   L2 Inference Broker / Resonance
- *   L3 GAP (Governed Action Protocol)
- *   L4 Apps
+ * Scope, precisely:
+ *   IN   canonical serializer, OID computation, hybrid Ed25519 + ML-DSA-65
+ *        attestation verification, lineage resolution, shape validators.
+ *   OUT  storage, transport, key resolution, revocation, policy, enforcement.
  *
- * This package is intentionally small: types, canonical serializer,
- * OID computation, hybrid signature verification, and shape validators.
- * No storage, no HTTP, no governance — those are higher layers.
+ * It verifies SIGNATURES, not IDENTITIES: `signer_kid` is an opaque string
+ * this package never resolves, and nothing here checks revocation. Deciding
+ * whether a key was trusted at signing time is a caller/directory concern.
  */
 // Canonical serializer — byte-identical to synoi-gateway + @synoi/vault.
 export { canonicalize } from './canonicalize.js';
@@ -28,19 +28,27 @@ export { verifyMlDsa65, isNativeMlDsaAvailable } from './mldsa.js';
 // bytes; `evictKeyFromCaches(keyId)` drops that entry from every cache so a
 // rotated or compromised key cannot be served stale on a later verify.
 export { evictKeyFromCaches } from './internal/key-cache.js';
-// L2 DSSE attestation — PAE type-binding, hybrid Ed25519 + ML-DSA-65 both
+// DSSE attestation — PAE type-binding, hybrid Ed25519 + ML-DSA-65 both
 // required. The preferred signing path (replaces the legacy bare-bytes
 // SignatureEnvelope; closes the cross-type confusion gap SRAID F7 / A4).
 export { verifyAttestation, pae, ALG_ED25519, ALG_ML_DSA_65, } from './attestation.js';
-// L3 lineage (Merkle-DAG) — unify supersedes/SRO/prev; latest-wins resolution.
+// Lineage (Merkle-DAG) — unify the `supersedes` string with the identity-bound
+// `prev`/`links` edges; latest-wins resolution over a version set.
 export { lineageLinks, supersededOids, latestWins, } from './lineage.js';
-// L4 propagating sensitivity — coarse, opaque tier + monotone max() carry-forward.
+// Propagating sensitivity — coarse, opaque tier + monotone max() carry-forward.
 export { SENSITIVITY_TIERS, SENSITIVITY_DEFAULT, isSensitivityTier, sensitivityRank, sensitivityMax, sensitivityCarryForward, sensitivityMonotoneCheck, } from './sensitivity.js';
-// L4 authority verification (the authorized axis).
-export { verifyAuthority, capabilityCovers, } from './authority.js';
-// L4 delegation-chain verification (K2) — VERIFY-ONLY, offline, no enforcement.
-// Always reports revocation_checked/existence_checked false (no live claim).
-export { verifyDelegationChain, MAX_DELEGATION_DEPTH, } from './authority.js';
+// Capability matching + the live-grant-status contract. The leaf primitive a
+// grant store needs: pure string logic, no crypto, no I/O, no live claim.
+export { capabilityCovers } from './capability.js';
 // Shape validators.
-export { validateCdro, validateSro, validateSignatureEnvelope, validateAttestationEnvelope, validateAuthorityBlock, validateLineageLink, } from './validate.js';
+export { validateCdro, validateSignatureEnvelope, validateAttestationEnvelope, validateAuthorityBlock, validateLineageLink, } from './validate.js';
+// MOVED IN 0.4.0 — the grant and delegation-chain VERIFIERS (`verifyAuthority`,
+// `verifyDelegationChain`, `MAX_DELEGATION_DEPTH`) are authorization policy,
+// not object identity, and are no longer exported from this entry. They live
+// at the `@synoi/sraid/authority` subpath, unchanged and still verify-only.
+//
+// `capabilityCovers`, `AuthorityResolver` and `GrantStatus` did NOT move: they
+// are the leaf primitive and the contract, and are exported above.
+//
+// REMOVED IN 0.4.0 — `validateSro`, `SRO`, `SROBody`. See CHANGELOG 0.4.0.
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiBH,yEAAyE;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,oEAAoE;AACpE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEhG,8EAA8E;AAC9E,OAAO,EACL,eAAe,GAGhB,MAAM,gBAAgB,CAAA;AAEvB,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAElE,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,WAAW,EACX,aAAa,GAGd,MAAM,kBAAkB,CAAA;AAEzB,+EAA+E;AAC/E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,UAAU,GAEX,MAAM,cAAc,CAAA;AAErB,mFAAmF;AACnF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAEzB,mDAAmD;AACnD,OAAO,EACL,eAAe,EACf,gBAAgB,GAMjB,MAAM,gBAAgB,CAAA;AAEvB,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAKrB,MAAM,gBAAgB,CAAA;AAEvB,oBAAoB;AACpB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH,yEAAyE;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,oEAAoE;AACpE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEhG,8EAA8E;AAC9E,OAAO,EACL,eAAe,GAGhB,MAAM,gBAAgB,CAAA;AAEvB,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAElE,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,WAAW,EACX,aAAa,GAGd,MAAM,kBAAkB,CAAA;AAEzB,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,UAAU,GAEX,MAAM,cAAc,CAAA;AAErB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAEzB,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAGlD,oBAAoB;AACpB,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,eAAe,CAAA;AAEtB,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,2EAA2E"}

package/dist/internal/attestation-core.d.ts

@@ -0,0 +1,85 @@
+/**
+ * @synoi/sraid — internal/attestation-core.ts
+ *
+ * The crypto-agnostic core of the L2 DSSE attestation profile: the PAE
+ * encoding, the algorithm identifiers, the public verify input/result types,
+ * the both-required signature lookup, and the envelope-shape predicate.
+ *
+ * This is a PURE module — no crypto, no node:crypto, no Buffer — so the same
+ * PAE bytes, AND-policy shape, and type contract are shared byte-for-byte by
+ * BOTH the node default entry (attestation.ts, node:crypto verifiers) and the
+ * browser verify surface (verify-browser.ts, WebCrypto + @noble verifiers).
+ * Divergent PAE or shape logic between the two would be a signature-validity
+ * hazard; keeping it in one place removes that risk.
+ *
+ * The verify ORCHESTRATION (decode each sig, run both verifiers, gate on the
+ * AND policy) is intentionally NOT here: the node path is synchronous
+ * (node:crypto verify) and the browser path is asynchronous (WebCrypto verify),
+ * so a single shared body cannot serve both. Each entry keeps its own thin
+ * orchestration and reuses these leaf helpers.
+ */
+import type { AttestationEnvelope, AttestationSignature } from '../types.js';
+/** The single supported algorithm identifiers for the JSON profile. */
+export declare const ALG_ED25519 = "ed25519";
+export declare const ALG_ML_DSA_65 = "ml-dsa-65";
+/**
+ * The DSSE Pre-Authentication Encoding (PAE).
+ *
+ * Per the DSSE spec:
+ *
+ *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
+ *
+ * where:
+ *   - SP is a single ASCII space (0x20),
+ *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
+ *   - type and body are the raw UTF-8 bytes (NOT base64).
+ *
+ * Binding the payloadType (and both lengths) into the signed bytes is what
+ * makes a signature non-transferable across object types. Returns the raw
+ * bytes to be signed/verified.
+ */
+export declare function pae(payloadType: string, payload: string | Uint8Array): Uint8Array;
+export interface VerifyAttestationInput {
+    /**
+     * The DSSE attestation envelope to verify. Its `payloadType` is bound into
+     * the PAE; its `payload` is the canonical UTF-8 string that was signed.
+     */
+    envelope: AttestationEnvelope;
+    /** Raw 32-byte Ed25519 public key. */
+    ed25519_pub: Uint8Array;
+    /** Raw ML-DSA-65 public key bytes. */
+    ml_dsa_pub: Uint8Array;
+    /**
+     * Optional. If supplied, the verifier asserts the envelope's `payloadType`
+     * equals this value before verifying signatures — an explicit type-pinning
+     * check on top of the structural PAE binding. A mismatch fails with
+     * `payload-type-mismatch`.
+     */
+    expectedPayloadType?: string;
+}
+export interface VerifyAttestationResult {
+    /** True only when BOTH required signatures verified over the same PAE. */
+    valid: boolean;
+    /**
+     * Human-readable failure reasons. Empty when valid. Possible values:
+     * 'envelope-malformed', 'payload-type-mismatch', 'missing-ed25519',
+     * 'missing-ml-dsa-65', 'ed25519-malformed', 'ml-dsa-malformed',
+     * 'ed25519-invalid', 'ml-dsa-invalid'.
+     */
+    reasons: string[];
+}
+/**
+ * Structural well-formedness of an attestation envelope: a non-null object with
+ * a non-empty string `payloadType`, a string `payload`, and an array
+ * `signatures`. A false result maps to the `envelope-malformed` reason. This is
+ * the SINGLE definition of envelope shape, shared by the node and browser
+ * verifiers so they reject the same inputs.
+ */
+export declare function isWellFormedEnvelope(env: unknown): env is AttestationEnvelope;
+/**
+ * Find the first well-formed signature entry for `alg` (a `{ alg, sig }` object
+ * whose `sig` is a string). Returns undefined when absent; the AND policy in
+ * each verifier turns a missing pair member into a `missing-*` reason.
+ */
+export declare function findSig(sigs: readonly AttestationSignature[], alg: string): AttestationSignature | undefined;
+//# sourceMappingURL=attestation-core.d.ts.map

package/dist/internal/attestation-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-core.d.ts","sourceRoot":"","sources":["../../src/internal/attestation-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAE5E,uEAAuE;AACvE,eAAO,MAAM,WAAW,YAAY,CAAA;AACpC,eAAO,MAAM,aAAa,cAAc,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAYjF;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,sCAAsC;IACtC,WAAW,EAAE,UAAU,CAAA;IACvB,sCAAsC;IACtC,UAAU,EAAE,UAAU,CAAA;IACtB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAA;IACd;;;;;OAKG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,mBAAmB,CAS7E;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,IAAI,EAAE,SAAS,oBAAoB,EAAE,EACrC,GAAG,EAAE,MAAM,GACV,oBAAoB,GAAG,SAAS,CAOlC"}

package/dist/internal/attestation-core.js

@@ -0,0 +1,78 @@
+/**
+ * @synoi/sraid — internal/attestation-core.ts
+ *
+ * The crypto-agnostic core of the L2 DSSE attestation profile: the PAE
+ * encoding, the algorithm identifiers, the public verify input/result types,
+ * the both-required signature lookup, and the envelope-shape predicate.
+ *
+ * This is a PURE module — no crypto, no node:crypto, no Buffer — so the same
+ * PAE bytes, AND-policy shape, and type contract are shared byte-for-byte by
+ * BOTH the node default entry (attestation.ts, node:crypto verifiers) and the
+ * browser verify surface (verify-browser.ts, WebCrypto + @noble verifiers).
+ * Divergent PAE or shape logic between the two would be a signature-validity
+ * hazard; keeping it in one place removes that risk.
+ *
+ * The verify ORCHESTRATION (decode each sig, run both verifiers, gate on the
+ * AND policy) is intentionally NOT here: the node path is synchronous
+ * (node:crypto verify) and the browser path is asynchronous (WebCrypto verify),
+ * so a single shared body cannot serve both. Each entry keeps its own thin
+ * orchestration and reuses these leaf helpers.
+ */
+/** The single supported algorithm identifiers for the JSON profile. */
+export const ALG_ED25519 = 'ed25519';
+export const ALG_ML_DSA_65 = 'ml-dsa-65';
+/**
+ * The DSSE Pre-Authentication Encoding (PAE).
+ *
+ * Per the DSSE spec:
+ *
+ *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
+ *
+ * where:
+ *   - SP is a single ASCII space (0x20),
+ *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
+ *   - type and body are the raw UTF-8 bytes (NOT base64).
+ *
+ * Binding the payloadType (and both lengths) into the signed bytes is what
+ * makes a signature non-transferable across object types. Returns the raw
+ * bytes to be signed/verified.
+ */
+export function pae(payloadType, payload) {
+    const enc = new TextEncoder();
+    const typeBytes = enc.encode(payloadType);
+    const bodyBytes = typeof payload === 'string' ? enc.encode(payload) : payload;
+    const prefix = enc.encode(`DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `);
+    const out = new Uint8Array(prefix.length + bodyBytes.length);
+    out.set(prefix, 0);
+    out.set(bodyBytes, prefix.length);
+    return out;
+}
+/**
+ * Structural well-formedness of an attestation envelope: a non-null object with
+ * a non-empty string `payloadType`, a string `payload`, and an array
+ * `signatures`. A false result maps to the `envelope-malformed` reason. This is
+ * the SINGLE definition of envelope shape, shared by the node and browser
+ * verifiers so they reject the same inputs.
+ */
+export function isWellFormedEnvelope(env) {
+    return (env !== null &&
+        typeof env === 'object' &&
+        typeof env.payloadType === 'string' &&
+        env.payloadType.length > 0 &&
+        typeof env.payload === 'string' &&
+        Array.isArray(env.signatures));
+}
+/**
+ * Find the first well-formed signature entry for `alg` (a `{ alg, sig }` object
+ * whose `sig` is a string). Returns undefined when absent; the AND policy in
+ * each verifier turns a missing pair member into a `missing-*` reason.
+ */
+export function findSig(sigs, alg) {
+    for (const s of sigs) {
+        if (s && typeof s === 'object' && s.alg === alg && typeof s.sig === 'string') {
+            return s;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=attestation-core.js.map

package/dist/internal/attestation-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-core.js","sourceRoot":"","sources":["../../src/internal/attestation-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAA;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAA;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,OAA4B;IACnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAE7E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CACvB,UAAU,SAAS,CAAC,MAAM,IAAI,WAAW,IAAI,SAAS,CAAC,MAAM,GAAG,CACjE,CAAA;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAC5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAClB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,GAAG,CAAA;AACZ,CAAC;AAiCD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAQ,GAA2B,CAAC,WAAW,KAAK,QAAQ;QAC3D,GAA2B,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACnD,OAAQ,GAA2B,CAAC,OAAO,KAAK,QAAQ;QACxD,KAAK,CAAC,OAAO,CAAE,GAA2B,CAAC,UAAU,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CACrB,IAAqC,EACrC,GAAW;IAEX,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/internal/base64-browser.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @synoi/sraid — internal/base64-browser.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode for the
+ * BROWSER verify surface.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * Why a separate decoder: the node decoder (./base64.ts `decodeBase64Strict`)
+ * finishes with `Buffer.from(s, 'base64')`. `Buffer` is a NODE global that does
+ * not exist in a browser / service-worker / Chrome-extension context — and,
+ * crucially, it is NOT a `node:` specifier, so an esbuild `node:`-reference scan
+ * would NOT catch it. A `Buffer`-based decode would bundle clean yet throw
+ * `ReferenceError: Buffer is not defined` at runtime. This decoder is
+ * Buffer-free: it reuses the pure `assertBase64` validation (regex/length/
+ * padding only, from ./base64-validate.js — NOT ./base64.js, whose graph pulls
+ * in the `Buffer` decode) and decodes via the standard `atob` global, which IS
+ * available in browsers, dedicated/shared workers, and MV3 extension service
+ * workers.
+ *
+ * Same strict contract as the node path: throws Error('base64-malformed') on
+ * any deviation (illegal char, bad length, bad padding) rather than silently
+ * truncating, so a malformed signature is rejected loudly, never decoded to a
+ * short prefix that then "verifies" against something unintended.
+ */
+/**
+ * Strictly decode standard base64 to raw bytes using only browser-safe globals.
+ * Throws Error('base64-malformed') on any non-conforming input.
+ */
+export declare function decodeBase64StrictBrowser(s: string): Uint8Array;
+//# sourceMappingURL=base64-browser.d.ts.map

package/dist/internal/base64-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-browser.d.ts","sourceRoot":"","sources":["../../src/internal/base64-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAM/D"}

package/dist/internal/base64-browser.js

@@ -0,0 +1,39 @@
+/**
+ * @synoi/sraid — internal/base64-browser.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode for the
+ * BROWSER verify surface.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * Why a separate decoder: the node decoder (./base64.ts `decodeBase64Strict`)
+ * finishes with `Buffer.from(s, 'base64')`. `Buffer` is a NODE global that does
+ * not exist in a browser / service-worker / Chrome-extension context — and,
+ * crucially, it is NOT a `node:` specifier, so an esbuild `node:`-reference scan
+ * would NOT catch it. A `Buffer`-based decode would bundle clean yet throw
+ * `ReferenceError: Buffer is not defined` at runtime. This decoder is
+ * Buffer-free: it reuses the pure `assertBase64` validation (regex/length/
+ * padding only, from ./base64-validate.js — NOT ./base64.js, whose graph pulls
+ * in the `Buffer` decode) and decodes via the standard `atob` global, which IS
+ * available in browsers, dedicated/shared workers, and MV3 extension service
+ * workers.
+ *
+ * Same strict contract as the node path: throws Error('base64-malformed') on
+ * any deviation (illegal char, bad length, bad padding) rather than silently
+ * truncating, so a malformed signature is rejected loudly, never decoded to a
+ * short prefix that then "verifies" against something unintended.
+ */
+import { assertBase64 } from './base64-validate.js';
+/**
+ * Strictly decode standard base64 to raw bytes using only browser-safe globals.
+ * Throws Error('base64-malformed') on any non-conforming input.
+ */
+export function decodeBase64StrictBrowser(s) {
+    assertBase64(s);
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+//# sourceMappingURL=base64-browser.js.map

package/dist/internal/base64-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-browser.js","sourceRoot":"","sources":["../../src/internal/base64-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,CAAS;IACjD,YAAY,CAAC,CAAC,CAAC,CAAA;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/internal/base64-validate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @synoi/sraid — internal/base64-validate.ts
+ *
+ * Pure strict standard-base64 (RFC 4648 §4, with `=` padding) VALIDATION.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * This is the Buffer-free, node:crypto-free half of base64 handling, split out
+ * so the browser decoder (./base64-browser.ts) can validate without importing
+ * ./base64.ts (whose `decodeBase64Strict` uses the node `Buffer` global — safe
+ * in node, a runtime `ReferenceError` in a browser). The node decoder re-uses
+ * this same validator, so both paths reject exactly the same inputs.
+ */
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export declare function assertBase64(s: string): void;
+//# sourceMappingURL=base64-validate.d.ts.map

package/dist/internal/base64-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-validate.d.ts","sourceRoot":"","sources":["../../src/internal/base64-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ5C"}

package/dist/internal/base64-validate.js

@@ -0,0 +1,33 @@
+/**
+ * @synoi/sraid — internal/base64-validate.ts
+ *
+ * Pure strict standard-base64 (RFC 4648 §4, with `=` padding) VALIDATION.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * This is the Buffer-free, node:crypto-free half of base64 handling, split out
+ * so the browser decoder (./base64-browser.ts) can validate without importing
+ * ./base64.ts (whose `decodeBase64Strict` uses the node `Buffer` global — safe
+ * in node, a runtime `ReferenceError` in a browser). The node decoder re-uses
+ * this same validator, so both paths reject exactly the same inputs.
+ */
+// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
+// must be a multiple of 4.
+const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/;
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export function assertBase64(s) {
+    if (typeof s !== 'string')
+        throw new Error('base64-malformed');
+    if (s.length % 4 !== 0)
+        throw new Error('base64-malformed');
+    if (!STD_B64.test(s))
+        throw new Error('base64-malformed');
+    // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
+    // at end already guarantees pad chars are contiguous and trailing, but a pad
+    // char earlier in the body would have been rejected by the alphabet class —
+    // so an in-body `=` cannot pass STD_B64. No extra check needed.
+}
+//# sourceMappingURL=base64-validate.js.map

package/dist/internal/base64-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64-validate.js","sourceRoot":"","sources":["../../src/internal/base64-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAA;AAExC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACzD,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;AAClE,CAAC"}

package/dist/internal/base64.d.ts

@@ -14,12 +14,14 @@
  *
  * Canonical inputs carry no surrounding whitespace, so no trim is applied;
  * leading/trailing whitespace is itself a rejection.
+ *
+ * The strict VALIDATION (alphabet/length/padding) lives in the pure, Buffer-
+ * free ./base64-validate.ts so the browser decoder can share it; this module
+ * adds the node `Buffer`-based decode on top and re-exports `assertBase64` so
+ * existing importers of `./base64.js` are unchanged.
  */
-/**
- * Validate strict standard base64. Throws Error('base64-malformed') on any
- * non-conforming input.
- */
-export declare function assertBase64(s: string): void;
+import { assertBase64 } from './base64-validate.js';
+export { assertBase64 };
 /**
  * Strictly decode standard base64 to raw bytes. Throws
  * Error('base64-malformed') on any non-conforming input.

package/dist/internal/base64.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAGxD"}
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAGxD"}

package/dist/internal/base64.js

@@ -14,26 +14,14 @@
  *
  * Canonical inputs carry no surrounding whitespace, so no trim is applied;
  * leading/trailing whitespace is itself a rejection.
+ *
+ * The strict VALIDATION (alphabet/length/padding) lives in the pure, Buffer-
+ * free ./base64-validate.ts so the browser decoder can share it; this module
+ * adds the node `Buffer`-based decode on top and re-exports `assertBase64` so
+ * existing importers of `./base64.js` are unchanged.
  */
-// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
-// must be a multiple of 4.
-const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/;
-/**
- * Validate strict standard base64. Throws Error('base64-malformed') on any
- * non-conforming input.
- */
-export function assertBase64(s) {
-    if (typeof s !== 'string')
-        throw new Error('base64-malformed');
-    if (s.length % 4 !== 0)
-        throw new Error('base64-malformed');
-    if (!STD_B64.test(s))
-        throw new Error('base64-malformed');
-    // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
-    // at end already guarantees pad chars are contiguous and trailing, but a pad
-    // char earlier in the body would have been rejected by the alphabet class —
-    // so an in-body `=` cannot pass STD_B64. No extra check needed.
-}
+import { assertBase64 } from './base64-validate.js';
+export { assertBase64 };
 /**
  * Strictly decode standard base64 to raw bytes. Throws
  * Error('base64-malformed') on any non-conforming input.

package/dist/internal/base64.js.map

@@ -1 +1 @@
-{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAA;AAExC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACzD,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,YAAY,CAAC,CAAC,CAAC,CAAA;IACf,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AACjD,CAAC"}
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,YAAY,CAAC,CAAC,CAAC,CAAA;IACf,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AACjD,CAAC"}

package/dist/internal/content-core.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @synoi/sraid — internal/content-core.ts
+ *
+ * The CDRO OID content-core projection: the normative strip-set and the
+ * field-removal function that together define WHAT bytes an OID is computed
+ * over. This is a PURE module — no hashing, no node:crypto, no Buffer — so it
+ * is safe to import from both the node default entry (via oid.ts) and the
+ * browser verify surface (via verify-browser.ts) without dragging node
+ * builtins into a browser bundle.
+ *
+ * This is the SINGLE NORMATIVE SOURCE of the CDRO OID projection (ADR_019).
+ * oid.ts re-exports these symbols and layers the SHA-256 hashing on top; every
+ * other surface (GAP SDKs, the gateway signer, IMPLEMENTING.md) derives from
+ * THIS set, never re-lists it.
+ */
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export declare const CDRO_ENVELOPE_FIELDS: readonly string[];
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export declare function cdroContentCore(cdro: unknown): Record<string, unknown>;
+//# sourceMappingURL=content-core.d.ts.map

package/dist/internal/content-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-core.d.ts","sourceRoot":"","sources":["../../src/internal/content-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOhD,CAAA;AAIF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtE"}

package/dist/internal/content-core.js

@@ -0,0 +1,87 @@
+/**
+ * @synoi/sraid — internal/content-core.ts
+ *
+ * The CDRO OID content-core projection: the normative strip-set and the
+ * field-removal function that together define WHAT bytes an OID is computed
+ * over. This is a PURE module — no hashing, no node:crypto, no Buffer — so it
+ * is safe to import from both the node default entry (via oid.ts) and the
+ * browser verify surface (via verify-browser.ts) without dragging node
+ * builtins into a browser bundle.
+ *
+ * This is the SINGLE NORMATIVE SOURCE of the CDRO OID projection (ADR_019).
+ * oid.ts re-exports these symbols and layers the SHA-256 hashing on top; every
+ * other surface (GAP SDKs, the gateway signer, IMPLEMENTING.md) derives from
+ * THIS set, never re-lists it.
+ */
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export const CDRO_ENVELOPE_FIELDS = Object.freeze([
+    'oid',
+    'signature',
+    'ml_dsa_signature',
+    'signature_key_id',
+    'signature_algorithm',
+    'attestation',
+]);
+const CDRO_ENVELOPE_FIELD_SET = new Set(CDRO_ENVELOPE_FIELDS);
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export function cdroContentCore(cdro) {
+    if (cdro === null || typeof cdro !== 'object' || Array.isArray(cdro)) {
+        throw new TypeError('cdroContentCore: argument must be a CDRO object');
+    }
+    const core = {};
+    for (const [k, v] of Object.entries(cdro)) {
+        if (CDRO_ENVELOPE_FIELD_SET.has(k))
+            continue;
+        core[k] = v;
+    }
+    return core;
+}
+//# sourceMappingURL=content-core.js.map

package/dist/internal/content-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-core.js","sourceRoot":"","sources":["../../src/internal/content-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,KAAK;IACL,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAA;AAElF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC5C,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}