@synoi/sraid 0.2.0 → 0.4.0

package/dist/validate.js

@@ -279,61 +279,4 @@ function validateAttestationEnvelopeShape(x) {
     }
     return errors;
 }
-// ── SRO validation ───────────────────────────────────────────────────────────
-/**
- * Validate that `x` matches the SRO shape — a CDRO whose `type` is
- * "sraid:sro" and whose `body` carries predecessor/successor pointers and
- * an authorizer. Reuses validateCdro and layers SRO-specific checks on
- * top.
- *
- *   [S01] envelope is not a valid CDRO
- *   [S02] type is not "sraid:sro"
- *   [S03] body.predecessor_oid not a canonical OID (sha256:<64 hex>)
- *   [S04] body.successor_oid not a canonical OID (sha256:<64 hex>)
- *   [S05] body.reason not a non-empty string
- *   [S06] body.authorized_by not a non-empty string
- *   [S07] body.evidence_oids, if present, not an array of non-empty strings
- */
-export function validateSro(x) {
-    const cdroResult = validateCdro(x);
-    if (!cdroResult.ok) {
-        return { ok: false, errors: cdroResult.errors.map((e) => '[S01] ' + e) };
-    }
-    const errors = [];
-    const o = x;
-    if (o.type !== 'sraid:sro') {
-        errors.push('[S02] type must be "sraid:sro" for an SRO');
-    }
-    if (o.body === null || typeof o.body !== 'object' || Array.isArray(o.body)) {
-        errors.push('[S01] body must be an object');
-        return { ok: false, errors };
-    }
-    const b = o.body;
-    if (!isCanonicalOid(b['predecessor_oid'])) {
-        errors.push('[S03] body.predecessor_oid must be a canonical OID (sha256:<64 hex>)');
-    }
-    if (!isCanonicalOid(b['successor_oid'])) {
-        errors.push('[S04] body.successor_oid must be a canonical OID (sha256:<64 hex>)');
-    }
-    if (typeof b['reason'] !== 'string' || b['reason'].length === 0) {
-        errors.push('[S05] body.reason must be a non-empty string');
-    }
-    if (typeof b['authorized_by'] !== 'string' || b['authorized_by'].length === 0) {
-        errors.push('[S06] body.authorized_by must be a non-empty string');
-    }
-    if (b['evidence_oids'] !== undefined) {
-        if (!Array.isArray(b['evidence_oids'])) {
-            errors.push('[S07] body.evidence_oids, if present, must be an array');
-        }
-        else {
-            const arr = b['evidence_oids'];
-            for (let i = 0; i < arr.length; i++) {
-                if (typeof arr[i] !== 'string' || arr[i].length === 0) {
-                    errors.push(`[S07] body.evidence_oids[${i}] must be a non-empty string`);
-                }
-            }
-        }
-    }
-    return { ok: errors.length === 0, errors };
-}
 //# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEvE,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,OAAO;IACP,MAAM;IACN,OAAO;IACP,SAAS;IACT,UAAU;IACV,QAAQ;CACT,CAAC,CAAA;AAEF,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAChD,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC;AAOD,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,mCAAmC,CAAC,EAAE,CAAA;IACrE,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IAEtC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACrD,CAAC;SAAM,IAAI,CAAE,CAAC,CAAC,KAAK,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,MAAM,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAClD,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,WAAW,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,eAAe,CAAC,CAAA;IACpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAY,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,MAAM,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;QACnE,CAAC;aAAM,IAAI,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,8BAA8B,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;QAChE,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,2BAA2B,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;QAC9D,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,gCAAgC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;QACpE,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,iDAAiD,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;gBAC7E,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,MAAM,MAAM,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAA;IAC7C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,2BAA2B,CAAC,CAAU;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC7C,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IAEtC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,WAAW,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,CAAE,CAAC,CAAC,WAAW,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1D,IACE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YACjC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAW,CAAC,EACvD,CAAC;YACD,MAAM,CAAC,IAAI,CACT,sFAAsF,CACvF,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAY,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpF,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAA;QAC7E,CAAC;aAAM,IAAI,CAAE,CAAC,CAAC,YAAY,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;IAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,wBAAwB,CAAC,CAAU;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,0CAA0C,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAE,CAAC,CAAC,KAAK,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACrE,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,MAAM,MAAM,GAAG,8BAA8B,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,8BAA8B,CAAC,CAAU;IAChD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,2CAA2C,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,SAAS,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,WAAW,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAY,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,MAAM,MAAM,GAAG,gCAAgC,CAAC,CAAC,CAAC,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,gCAAgC,CAAC,CAAU;IAClD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,oCAAoC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,aAAa,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACrD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAc,CAAA;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,uCAAuC,CAAC,CAAA;gBAC/E,SAAQ;YACV,CAAC;YACD,MAAM,EAAE,GAAG,CAA4B,CAAA;YACvC,IAAI,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,EAAE,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,kCAAkC,CAAC,CAAA;YAC5E,CAAC;YACD,IAAI,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,EAAE,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,yCAAyC,CAAC,CAAA;YACnF,CAAC;YACD,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,uCAAuC,CAAC,CAAA;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;IAClC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,CAAC,GAAG,CAAuC,CAAA;IAEjD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,IAA+B,CAAA;IAE3C,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,QAAQ,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,eAAe,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAA;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,CAAC,CAAC,eAAe,CAAc,CAAA;YAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,GAAG,CAAC,CAAC,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,8BAA8B,CAAC,CAAA;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEvE,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,OAAO;IACP,MAAM;IACN,OAAO;IACP,SAAS;IACT,UAAU;IACV,QAAQ;CACT,CAAC,CAAA;AAEF,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAChD,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC;AAOD,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,mCAAmC,CAAC,EAAE,CAAA;IACrE,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IAEtC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACrD,CAAC;SAAM,IAAI,CAAE,CAAC,CAAC,KAAK,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,MAAM,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAClD,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,WAAW,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,eAAe,CAAC,CAAA;IACpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAY,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,MAAM,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;QACnE,CAAC;aAAM,IAAI,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,8BAA8B,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;QAChE,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,2BAA2B,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;QAC9D,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,gCAAgC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;QACpE,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,iDAAiD,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;gBAC7E,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,MAAM,MAAM,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAA;IAC7C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,2BAA2B,CAAC,CAAU;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC7C,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IAEtC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,WAAW,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,CAAE,CAAC,CAAC,WAAW,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1D,IACE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YACjC,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAW,CAAC,EACvD,CAAC;YACD,MAAM,CAAC,IAAI,CACT,sFAAsF,CACvF,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAY,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpF,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAA;QAC7E,CAAC;aAAM,IAAI,CAAE,CAAC,CAAC,YAAY,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;IAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,wBAAwB,CAAC,CAAU;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,0CAA0C,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAE,CAAC,CAAC,KAAK,CAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACrE,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,MAAM,MAAM,GAAG,8BAA8B,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,8BAA8B,CAAC,CAAU;IAChD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,2CAA2C,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,SAAS,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,WAAW,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,YAAY,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,MAAM,MAAM,GAAG,gCAAgC,CAAC,CAAC,CAAC,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,gCAAgC,CAAC,CAAU;IAClD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,oCAAoC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,aAAa,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACrD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAc,CAAA;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,uCAAuC,CAAC,CAAA;gBAC/E,SAAQ;YACV,CAAC;YACD,MAAM,EAAE,GAAG,CAA4B,CAAA;YACvC,IAAI,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,EAAE,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,kCAAkC,CAAC,CAAA;YAC5E,CAAC;YACD,IAAI,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,EAAE,CAAC,KAAK,CAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,yCAAyC,CAAC,CAAA;YACnF,CAAC;YACD,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,uCAAuC,CAAC,CAAA;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/verify-browser.d.ts

@@ -0,0 +1,80 @@
+/**
+ * @synoi/sraid/verify-browser — browser / Chrome-extension / service-worker
+ * verify surface.
+ *
+ * The default (`.`) entry statically imports `node:crypto` in three places:
+ * ed25519.ts (node-only Ed25519 verify), mldsa.ts (native ML-DSA + polyfill),
+ * and oid.ts (createHash). `node:crypto` does not exist in a browser or
+ * service-worker context, so `import '@synoi/sraid'` breaks any browser bundle.
+ * This entry is the browser-safe alternative: it carries exactly what a v2
+ * hybrid DSSE receipt verifier needs, implemented WITHOUT any static
+ * node:crypto import.
+ *
+ * WHAT THIS EXPOSES (all browser-safe):
+ *   - canonicalize            — pure RFC 8785 JCS serializer (shared, unchanged).
+ *   - cdroContentCore,        — the CDRO OID content-core projection and its
+ *     CDRO_ENVELOPE_FIELDS       normative strip-set (pure; shared byte-for-byte
+ *                                with the node entry via internal/content-core).
+ *   - verifyAttestation       — hybrid DSSE verify (Ed25519 AND ML-DSA-65, both
+ *                                required over the PAE). ASYNC here: WebCrypto
+ *                                Ed25519 verify is Promise-based.
+ *   - pae, ALG_ED25519,       — the DSSE PAE encoder and algorithm ids (pure,
+ *     ALG_ML_DSA_65              shared with the node entry).
+ *   - cdroOid, oidOf,         — OID helpers over WebCrypto SHA-256. ASYNC here
+ *     oidOfCanonical             (subtle.digest is Promise-based).
+ *
+ * CRYPTO BACKENDS (browsers have no native ML-DSA and no node:crypto):
+ *   - Ed25519 verify  → WebCrypto (RFC 8032 cofactored, matching the node path),
+ *                       with a @noble/curves fallback below the WebCrypto-Ed25519
+ *                       support floor. See internal/ed25519-browser.ts.
+ *   - ML-DSA-65 verify → @noble/post-quantum (pure JS). See internal/mldsa-browser.ts.
+ *   - SHA-256          → WebCrypto subtle.digest. See internal/sha256-browser.ts.
+ *
+ * NODE PARITY: the node default entry (`@synoi/sraid`) is unchanged and stays
+ * synchronous with its node:crypto fast paths. This entry is purely additive.
+ * The only surface difference is async: verifyAttestation, cdroOid, oidOf, and
+ * oidOfCanonical return Promises here because WebCrypto is Promise-based.
+ *
+ * Downstream: @synoi/verify's browser build imports this subpath to bring v2
+ * hybrid DSSE verification (verifyReceiptV2) to the browser, replacing the
+ * fail-closed `v2-not-supported-in-browser-build` stub.
+ */
+import { ALG_ED25519, ALG_ML_DSA_65, pae, type VerifyAttestationInput, type VerifyAttestationResult } from './internal/attestation-core.js';
+export { canonicalize } from './canonicalize.js';
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js';
+export { pae, ALG_ED25519, ALG_ML_DSA_65, type VerifyAttestationInput, type VerifyAttestationResult, };
+/**
+ * Verify a hybrid DSSE attestation envelope in a browser context. Returns
+ * `valid: true` only when the envelope carries BOTH an `ed25519` and an
+ * `ml-dsa-65` signature and BOTH verify against the supplied public keys over
+ * `PAE(payloadType, payload)`. The payloadType is bound into the signed bytes,
+ * so a signature minted for a different payloadType will not verify.
+ *
+ * ASYNC counterpart of the node `verifyAttestation`: identical envelope shape,
+ * AND policy, PAE bytes, and reason strings — only the return is a Promise,
+ * because Ed25519 verify runs on WebCrypto. Never rejects: any malformed input
+ * or verification failure resolves to `{ valid: false, reasons: [...] }`.
+ */
+export declare function verifyAttestation(input: VerifyAttestationInput): Promise<VerifyAttestationResult>;
+/**
+ * Compute an OID over an arbitrary canonical-compatible value using WebCrypto
+ * SHA-256. Returns `sha256:` followed by 64 lowercase hex characters.
+ *
+ * ASYNC counterpart of the node `oidOf`: same canonical bytes and same
+ * `sha256:`-prefixed output, but returns a Promise because subtle.digest is
+ * Promise-based. Byte-identical result to the node entry for the same input.
+ */
+export declare function oidOf(canonical: unknown): Promise<string>;
+/**
+ * Compute an OID directly from already-canonicalized bytes using WebCrypto
+ * SHA-256. ASYNC counterpart of the node `oidOfCanonical`.
+ */
+export declare function oidOfCanonical(canonical: string | Uint8Array): Promise<string>;
+/**
+ * Compute the OID of a full CDRO over its content core (see `cdroContentCore`),
+ * using WebCrypto SHA-256. ASYNC counterpart of the node `cdroOid`; yields the
+ * SAME OID whether the object is pre- or post-attestation, and the SAME value
+ * the node entry produces for the same object.
+ */
+export declare function cdroOid(cdro: unknown): Promise<string>;
+//# sourceMappingURL=verify-browser.d.ts.map

package/dist/verify-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-browser.d.ts","sourceRoot":"","sources":["../src/verify-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAQH,OAAO,EACL,WAAW,EACX,aAAa,EAGb,GAAG,EACH,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAA;AAIvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EACL,GAAG,EACH,WAAW,EACX,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,CAAA;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA+DlC;AAID;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/D;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpF;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5D"}

package/dist/verify-browser.js

@@ -0,0 +1,157 @@
+/**
+ * @synoi/sraid/verify-browser — browser / Chrome-extension / service-worker
+ * verify surface.
+ *
+ * The default (`.`) entry statically imports `node:crypto` in three places:
+ * ed25519.ts (node-only Ed25519 verify), mldsa.ts (native ML-DSA + polyfill),
+ * and oid.ts (createHash). `node:crypto` does not exist in a browser or
+ * service-worker context, so `import '@synoi/sraid'` breaks any browser bundle.
+ * This entry is the browser-safe alternative: it carries exactly what a v2
+ * hybrid DSSE receipt verifier needs, implemented WITHOUT any static
+ * node:crypto import.
+ *
+ * WHAT THIS EXPOSES (all browser-safe):
+ *   - canonicalize            — pure RFC 8785 JCS serializer (shared, unchanged).
+ *   - cdroContentCore,        — the CDRO OID content-core projection and its
+ *     CDRO_ENVELOPE_FIELDS       normative strip-set (pure; shared byte-for-byte
+ *                                with the node entry via internal/content-core).
+ *   - verifyAttestation       — hybrid DSSE verify (Ed25519 AND ML-DSA-65, both
+ *                                required over the PAE). ASYNC here: WebCrypto
+ *                                Ed25519 verify is Promise-based.
+ *   - pae, ALG_ED25519,       — the DSSE PAE encoder and algorithm ids (pure,
+ *     ALG_ML_DSA_65              shared with the node entry).
+ *   - cdroOid, oidOf,         — OID helpers over WebCrypto SHA-256. ASYNC here
+ *     oidOfCanonical             (subtle.digest is Promise-based).
+ *
+ * CRYPTO BACKENDS (browsers have no native ML-DSA and no node:crypto):
+ *   - Ed25519 verify  → WebCrypto (RFC 8032 cofactored, matching the node path),
+ *                       with a @noble/curves fallback below the WebCrypto-Ed25519
+ *                       support floor. See internal/ed25519-browser.ts.
+ *   - ML-DSA-65 verify → @noble/post-quantum (pure JS). See internal/mldsa-browser.ts.
+ *   - SHA-256          → WebCrypto subtle.digest. See internal/sha256-browser.ts.
+ *
+ * NODE PARITY: the node default entry (`@synoi/sraid`) is unchanged and stays
+ * synchronous with its node:crypto fast paths. This entry is purely additive.
+ * The only surface difference is async: verifyAttestation, cdroOid, oidOf, and
+ * oidOfCanonical return Promises here because WebCrypto is Promise-based.
+ *
+ * Downstream: @synoi/verify's browser build imports this subpath to bring v2
+ * hybrid DSSE verification (verifyReceiptV2) to the browser, replacing the
+ * fail-closed `v2-not-supported-in-browser-build` stub.
+ */
+import { canonicalize } from './canonicalize.js';
+import { cdroContentCore } from './internal/content-core.js';
+import { decodeBase64StrictBrowser } from './internal/base64-browser.js';
+import { verifyEd25519Browser } from './internal/ed25519-browser.js';
+import { verifyMlDsa65Browser } from './internal/mldsa-browser.js';
+import { sha256HexPrefixed } from './internal/sha256-browser.js';
+import { ALG_ED25519, ALG_ML_DSA_65, findSig, isWellFormedEnvelope, pae, } from './internal/attestation-core.js';
+// ── Pure / shared re-exports (byte-for-byte identical to the node entry) ──────
+export { canonicalize } from './canonicalize.js';
+export { CDRO_ENVELOPE_FIELDS, cdroContentCore } from './internal/content-core.js';
+export { pae, ALG_ED25519, ALG_ML_DSA_65, };
+// ── Hybrid DSSE attestation verify (browser, ASYNC) ───────────────────────────
+/**
+ * Verify a hybrid DSSE attestation envelope in a browser context. Returns
+ * `valid: true` only when the envelope carries BOTH an `ed25519` and an
+ * `ml-dsa-65` signature and BOTH verify against the supplied public keys over
+ * `PAE(payloadType, payload)`. The payloadType is bound into the signed bytes,
+ * so a signature minted for a different payloadType will not verify.
+ *
+ * ASYNC counterpart of the node `verifyAttestation`: identical envelope shape,
+ * AND policy, PAE bytes, and reason strings — only the return is a Promise,
+ * because Ed25519 verify runs on WebCrypto. Never rejects: any malformed input
+ * or verification failure resolves to `{ valid: false, reasons: [...] }`.
+ */
+export async function verifyAttestation(input) {
+    const reasons = [];
+    const env = input.envelope;
+    if (!isWellFormedEnvelope(env)) {
+        return { valid: false, reasons: ['envelope-malformed'] };
+    }
+    if (input.expectedPayloadType !== undefined &&
+        env.payloadType !== input.expectedPayloadType) {
+        return { valid: false, reasons: ['payload-type-mismatch'] };
+    }
+    // The signed bytes: PAE binds payloadType + payload together.
+    const message = pae(env.payloadType, env.payload);
+    // Find the required hybrid pair. The AND policy: both must be present.
+    const edEntry = findSig(env.signatures, ALG_ED25519);
+    const mlEntry = findSig(env.signatures, ALG_ML_DSA_65);
+    if (!edEntry)
+        reasons.push('missing-ed25519');
+    if (!mlEntry)
+        reasons.push('missing-ml-dsa-65');
+    let edOk = false;
+    let mlOk = false;
+    if (edEntry) {
+        let edSig = null;
+        try {
+            edSig = decodeBase64StrictBrowser(edEntry.sig);
+        }
+        catch {
+            reasons.push('ed25519-malformed');
+        }
+        if (edSig) {
+            try {
+                edOk = await verifyEd25519Browser(edSig, message, input.ed25519_pub);
+            }
+            catch {
+                edOk = false;
+            }
+            if (!edOk)
+                reasons.push('ed25519-invalid');
+        }
+    }
+    if (mlEntry) {
+        let mlSig = null;
+        try {
+            mlSig = decodeBase64StrictBrowser(mlEntry.sig);
+        }
+        catch {
+            reasons.push('ml-dsa-malformed');
+        }
+        if (mlSig) {
+            try {
+                mlOk = verifyMlDsa65Browser(mlSig, message, input.ml_dsa_pub);
+            }
+            catch {
+                mlOk = false;
+            }
+            if (!mlOk)
+                reasons.push('ml-dsa-invalid');
+        }
+    }
+    return { valid: edOk && mlOk && !!edEntry && !!mlEntry, reasons };
+}
+// ── OID helpers (browser, ASYNC via WebCrypto SHA-256) ────────────────────────
+/**
+ * Compute an OID over an arbitrary canonical-compatible value using WebCrypto
+ * SHA-256. Returns `sha256:` followed by 64 lowercase hex characters.
+ *
+ * ASYNC counterpart of the node `oidOf`: same canonical bytes and same
+ * `sha256:`-prefixed output, but returns a Promise because subtle.digest is
+ * Promise-based. Byte-identical result to the node entry for the same input.
+ */
+export async function oidOf(canonical) {
+    const bytes = new TextEncoder().encode(canonicalize(canonical));
+    return sha256HexPrefixed(bytes);
+}
+/**
+ * Compute an OID directly from already-canonicalized bytes using WebCrypto
+ * SHA-256. ASYNC counterpart of the node `oidOfCanonical`.
+ */
+export async function oidOfCanonical(canonical) {
+    const bytes = typeof canonical === 'string' ? new TextEncoder().encode(canonical) : canonical;
+    return sha256HexPrefixed(bytes);
+}
+/**
+ * Compute the OID of a full CDRO over its content core (see `cdroContentCore`),
+ * using WebCrypto SHA-256. ASYNC counterpart of the node `cdroOid`; yields the
+ * SAME OID whether the object is pre- or post-attestation, and the SAME value
+ * the node entry produces for the same object.
+ */
+export async function cdroOid(cdro) {
+    return oidOf(cdroContentCore(cdro));
+}
+//# sourceMappingURL=verify-browser.js.map

package/dist/verify-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-browser.js","sourceRoot":"","sources":["../src/verify-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAwB,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EACL,WAAW,EACX,aAAa,EACb,OAAO,EACP,oBAAoB,EACpB,GAAG,GAGJ,MAAM,gCAAgC,CAAA;AAEvC,iFAAiF;AAEjF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EACL,GAAG,EACH,WAAW,EACX,aAAa,GAGd,CAAA;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC1B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,IACE,KAAK,CAAC,mBAAmB,KAAK,SAAS;QACvC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,EAC7C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAA;IAC7D,CAAC;IAED,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAEjD,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;IAEtD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAE/C,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,IAAI,GAAG,KAAK,CAAA;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACnC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,KAAK,GAAsB,IAAI,CAAA;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAA;AACnE,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,SAAkB;IAC5C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/D,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAA8B;IACjE,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjF,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAa;IACzC,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;AACrC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@synoi/sraid",
-  "version": "0.2.0",
-  "description": "Reference TypeScript library for the SynOI SRAID (Self-Routing Addressable Identity Data) protocol - types, canonical object serializer, OID computation, signature verification, and validators for L0 of the SRAID Stack.",
+  "version": "0.4.0",
+  "description": "SRAID reference implementation: canonical JSON serializer, content-addressed OIDs, hybrid Ed25519 + ML-DSA-65 signature verification, lineage, and shape validators. No storage, no transport, no policy.",
   "license": "MIT",
   "homepage": "https://synoi.systems",
   "repository": {
@@ -27,6 +27,23 @@
     "./canonicalize": {
       "types": "./dist/canonicalize.d.ts",
       "default": "./dist/canonicalize.js"
+    },
+    "./verify-browser": {
+      "types": "./dist/verify-browser.d.ts",
+      "browser": "./dist/verify-browser.js",
+      "import": "./dist/verify-browser.js",
+      "require": "./dist/verify-browser.js",
+      "default": "./dist/verify-browser.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "canonicalize": [
+        "dist/canonicalize.d.ts"
+      ],
+      "verify-browser": [
+        "dist/verify-browser.d.ts"
+      ]
     }
   },
   "files": [
@@ -40,7 +57,8 @@
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/run-all.ts"
+    "test": "npx tsx test/run-all.ts",
+    "prepublishOnly": "npm run build && npm test"
   },
   "dependencies": {
     "@noble/curves": "^1.9.7",
@@ -49,6 +67,7 @@
   },
   "devDependencies": {
     "@types/node": "^20.12.0",
+    "esbuild": "^0.28.0",
     "tsx": "^4.22.2",
     "typescript": "^5.4.5"
   },

package/src/attestation.ts

@@ -30,76 +30,36 @@
  * Identity stability: signatures live in a detached `signatures[]` array and
  * are NEVER part of the OID hash input (see `cdroContentCore` in oid.ts), so
  * adding, rotating, or replacing a signature never changes the object's OID.
+ *
+ * NODE ENTRY: this module verifies via node:crypto (Ed25519 native, ML-DSA-65
+ * native-with-@noble-fallback) and is SYNCHRONOUS. The PAE, algorithm ids,
+ * types, AND-policy lookup, and envelope-shape predicate are shared with the
+ * browser verify surface via ./internal/attestation-core.ts (pure, no
+ * node:crypto); only the verify orchestration below is node-specific. The
+ * browser-safe async equivalent lives in ./verify-browser.ts.
  */
 
 import { verifyEd25519 } from './ed25519.js'
 import { decodeBase64Strict } from './internal/base64.js'
 import { verifyMlDsa65 } from './mldsa.js'
-import type { AttestationEnvelope, AttestationSignature } from './types.js'
-
-/** The single supported algorithm identifiers for the JSON profile. */
-export const ALG_ED25519 = 'ed25519'
-export const ALG_ML_DSA_65 = 'ml-dsa-65'
-
-/**
- * The DSSE Pre-Authentication Encoding (PAE).
- *
- * Per the DSSE spec:
- *
- *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
- *
- * where:
- *   - SP is a single ASCII space (0x20),
- *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
- *   - type and body are the raw UTF-8 bytes (NOT base64).
- *
- * Binding the payloadType (and both lengths) into the signed bytes is what
- * makes a signature non-transferable across object types. Returns the raw
- * bytes to be signed/verified.
- */
-export function pae(payloadType: string, payload: string | Uint8Array): Uint8Array {
-  const enc = new TextEncoder()
-  const typeBytes = enc.encode(payloadType)
-  const bodyBytes = typeof payload === 'string' ? enc.encode(payload) : payload
-
-  const prefix = enc.encode(
-    `DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `,
-  )
-  const out = new Uint8Array(prefix.length + bodyBytes.length)
-  out.set(prefix, 0)
-  out.set(bodyBytes, prefix.length)
-  return out
-}
-
-export interface VerifyAttestationInput {
-  /**
-   * The DSSE attestation envelope to verify. Its `payloadType` is bound into
-   * the PAE; its `payload` is the canonical UTF-8 string that was signed.
-   */
-  envelope: AttestationEnvelope
-  /** Raw 32-byte Ed25519 public key. */
-  ed25519_pub: Uint8Array
-  /** Raw ML-DSA-65 public key bytes. */
-  ml_dsa_pub: Uint8Array
-  /**
-   * Optional. If supplied, the verifier asserts the envelope's `payloadType`
-   * equals this value before verifying signatures — an explicit type-pinning
-   * check on top of the structural PAE binding. A mismatch fails with
-   * `payload-type-mismatch`.
-   */
-  expectedPayloadType?: string
-}
-
-export interface VerifyAttestationResult {
-  /** True only when BOTH required signatures verified over the same PAE. */
-  valid: boolean
-  /**
-   * Human-readable failure reasons. Empty when valid. Possible values:
-   * 'envelope-malformed', 'payload-type-mismatch', 'missing-ed25519',
-   * 'missing-ml-dsa-65', 'ed25519-malformed', 'ml-dsa-malformed',
-   * 'ed25519-invalid', 'ml-dsa-invalid'.
-   */
-  reasons: string[]
+import {
+  ALG_ED25519,
+  ALG_ML_DSA_65,
+  findSig,
+  isWellFormedEnvelope,
+  pae,
+  type VerifyAttestationInput,
+  type VerifyAttestationResult,
+} from './internal/attestation-core.js'
+
+// Re-export the crypto-agnostic core so the public surface is unchanged:
+// `import { pae, ALG_ED25519, ALG_ML_DSA_65 } from '@synoi/sraid'` still works.
+export {
+  ALG_ED25519,
+  ALG_ML_DSA_65,
+  pae,
+  type VerifyAttestationInput,
+  type VerifyAttestationResult,
 }
 
 /**
@@ -113,14 +73,7 @@ export function verifyAttestation(input: VerifyAttestationInput): VerifyAttestat
   const reasons: string[] = []
 
   const env = input.envelope
-  if (
-    env === null ||
-    typeof env !== 'object' ||
-    typeof env.payloadType !== 'string' ||
-    env.payloadType.length === 0 ||
-    typeof env.payload !== 'string' ||
-    !Array.isArray(env.signatures)
-  ) {
+  if (!isWellFormedEnvelope(env)) {
     return { valid: false, reasons: ['envelope-malformed'] }
   }
 
@@ -183,22 +136,10 @@ export function verifyAttestation(input: VerifyAttestationInput): VerifyAttestat
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
-function findSig(
-  sigs: readonly AttestationSignature[],
-  alg: string,
-): AttestationSignature | undefined {
-  for (const s of sigs) {
-    if (s && typeof s === 'object' && s.alg === alg && typeof s.sig === 'string') {
-      return s
-    }
-  }
-  return undefined
-}
-
 // Strict standard base64. Throws Error('base64-malformed') on any deviation
-// (illegal char, bad length, bad padding) rather than silently truncating.
-// Both call sites wrap this in try/catch and map the throw to a *-malformed
-// reason, so verifyAttestation never throws.
+// (illegal char, bad length, bad padding) rather than silently truncating. The
+// call sites wrap this in try/catch and map the throw to a *-malformed reason,
+// so verifyAttestation never throws.
 function fromBase64(s: string): Uint8Array {
   return decodeBase64Strict(s)
 }

package/src/capability.ts

@@ -0,0 +1,69 @@
+/**
+ * @synoi/sraid — capability.ts
+ *
+ * Capability-pattern matching and the live-status contract.
+ *
+ * These stay in the core entry, while the grant/delegation VERIFIERS moved to
+ * `@synoi/sraid/authority` in 0.4.0, because they are different things:
+ *
+ *   - `capabilityCovers` is a pure, total string predicate with no crypto, no
+ *     I/O and no policy. It decides whether one dotted-taxonomy pattern covers
+ *     another, and it is the leaf primitive that grant stores build on
+ *     (synoi-app's `in-memory-engine.ts` and `app-store/store.ts` both call it
+ *     directly rather than going through a verifier).
+ *   - `GrantStatus` / `AuthorityResolver` are the CONTRACT for live grant
+ *     state. The contract is a type; satisfying it is somebody else's job.
+ *     Keeping it here lets a store, a resolver and a verifier agree on shape
+ *     without any of them depending on the verifier.
+ *
+ * Nothing in this module makes, or can make, a live claim.
+ */
+
+/**
+ * Match a capability `target` against a grant `pattern`. Pure string logic,
+ * re-stated here so the core stays dependency-free (the same rule lives in
+ * `@synoi/gap-types` `capabilityMatches`; the object layer must not depend on
+ * the protocol layer).
+ *
+ *   - exact match → true
+ *   - '*' → match-all
+ *   - 'skill.*' matches 'skill.create' and deeper (segment-boundary only).
+ *     A non-boundary 'admin.us*' must NOT match 'admin.users.delete'
+ *     (privilege-escalation footgun) — only a '.'-anchored '*' is a wildcard.
+ */
+export function capabilityCovers(pattern: string, target: string): boolean {
+  if (pattern === target) return true
+  if (pattern === '*') return true
+  if (pattern.endsWith('.*')) {
+    const prefix = pattern.slice(0, -1) // keep trailing '.', e.g. 'skill.'
+    return target.startsWith(prefix)
+  }
+  return false
+}
+
+/**
+ * The live-state interface that the OID Resolver implements. It is the ONLY
+ * source of truth for the two properties that cannot be checked offline:
+ * whether a grant currently exists (resolves) and whether it has been revoked.
+ *
+ * RESOLVER-DEPENDENT: undeployed today (SRAID_FOUNDATION_PUNCHLIST C). Defined
+ * here so callers, a future resolver, and the out-of-core verifier all agree
+ * on one contract.
+ */
+export interface AuthorityResolver {
+  /**
+   * Resolve a grant OID to its current status. Implementations should return
+   * `{ exists: false }` for an unknown OID and `{ exists: true, revoked: true,
+   * revoked_at_ms }` for a revoked one.
+   */
+  resolveGrantStatus(grantOid: string): Promise<GrantStatus> | GrantStatus
+}
+
+export interface GrantStatus {
+  /** Whether the grant OID resolves to a known, published grant. */
+  exists: boolean
+  /** Whether the grant has been revoked. Only meaningful when `exists`. */
+  revoked?: boolean
+  /** When the revocation took effect, if revoked. */
+  revoked_at_ms?: number
+}