@synoi/sraid 0.2.0 → 0.4.0

package/src/index.ts

@@ -1,17 +1,17 @@
 /**
  * @synoi/sraid — public surface.
  *
- * SRAID (Self-Routing Addressable Identity Data) is L0 of the SynOI SRAID Stack:
+ * SRAID is the object-identity layer: it defines what a signed object IS and
+ * how anyone re-derives and verifies its identity offline.
  *
- *   L0 SRAID            ← this package
- *   L1 Vault / Resolver
- *   L2 Inference Broker / Resonance
- *   L3 GAP (Governed Action Protocol)
- *   L4 Apps
+ * Scope, precisely:
+ *   IN   canonical serializer, OID computation, hybrid Ed25519 + ML-DSA-65
+ *        attestation verification, lineage resolution, shape validators.
+ *   OUT  storage, transport, key resolution, revocation, policy, enforcement.
  *
- * This package is intentionally small: types, canonical serializer,
- * OID computation, hybrid signature verification, and shape validators.
- * No storage, no HTTP, no governance — those are higher layers.
+ * It verifies SIGNATURES, not IDENTITIES: `signer_kid` is an opaque string
+ * this package never resolves, and nothing here checks revocation. Deciding
+ * whether a key was trusted at signing time is a caller/directory concern.
  */
 
 // Types
@@ -23,8 +23,6 @@ export type {
   CDRO,
   LineageLink,
   LinkRel,
-  SRO,
-  SROBody,
   SensitivityTier,
   SignatureEnvelope,
 } from './types.js'
@@ -53,7 +51,7 @@ export { verifyMlDsa65, isNativeMlDsaAvailable } from './mldsa.js'
 // rotated or compromised key cannot be served stale on a later verify.
 export { evictKeyFromCaches } from './internal/key-cache.js'
 
-// L2 DSSE attestation — PAE type-binding, hybrid Ed25519 + ML-DSA-65 both
+// DSSE attestation — PAE type-binding, hybrid Ed25519 + ML-DSA-65 both
 // required. The preferred signing path (replaces the legacy bare-bytes
 // SignatureEnvelope; closes the cross-type confusion gap SRAID F7 / A4).
 export {
@@ -65,7 +63,8 @@ export {
   type VerifyAttestationResult,
 } from './attestation.js'
 
-// L3 lineage (Merkle-DAG) — unify supersedes/SRO/prev; latest-wins resolution.
+// Lineage (Merkle-DAG) — unify the `supersedes` string with the identity-bound
+// `prev`/`links` edges; latest-wins resolution over a version set.
 export {
   lineageLinks,
   supersededOids,
@@ -73,7 +72,7 @@ export {
   type LatestWinsResult,
 } from './lineage.js'
 
-// L4 propagating sensitivity — coarse, opaque tier + monotone max() carry-forward.
+// Propagating sensitivity — coarse, opaque tier + monotone max() carry-forward.
 export {
   SENSITIVITY_TIERS,
   SENSITIVITY_DEFAULT,
@@ -84,35 +83,27 @@ export {
   sensitivityMonotoneCheck,
 } from './sensitivity.js'
 
-// L4 authority verification (the authorized axis).
-export {
-  verifyAuthority,
-  capabilityCovers,
-  type VerifyAuthorityInput,
-  type VerifyAuthorityResult,
-  type AuthorityResolver,
-  type GrantStatus,
-  type GrantBodyShape,
-} from './authority.js'
-
-// L4 delegation-chain verification (K2) — VERIFY-ONLY, offline, no enforcement.
-// Always reports revocation_checked/existence_checked false (no live claim).
-export {
-  verifyDelegationChain,
-  MAX_DELEGATION_DEPTH,
-  type VerifyDelegationChainInput,
-  type VerifyDelegationChainResult,
-  type HopResult,
-  type LinkPubkeys,
-} from './authority.js'
+// Capability matching + the live-grant-status contract. The leaf primitive a
+// grant store needs: pure string logic, no crypto, no I/O, no live claim.
+export { capabilityCovers } from './capability.js'
+export type { AuthorityResolver, GrantStatus } from './capability.js'
 
 // Shape validators.
 export {
   validateCdro,
-  validateSro,
   validateSignatureEnvelope,
   validateAttestationEnvelope,
   validateAuthorityBlock,
   validateLineageLink,
   type ValidationResult,
 } from './validate.js'
+
+// MOVED IN 0.4.0 — the grant and delegation-chain VERIFIERS (`verifyAuthority`,
+// `verifyDelegationChain`, `MAX_DELEGATION_DEPTH`) are authorization policy,
+// not object identity, and are no longer exported from this entry. They live
+// at the `@synoi/sraid/authority` subpath, unchanged and still verify-only.
+//
+// `capabilityCovers`, `AuthorityResolver` and `GrantStatus` did NOT move: they
+// are the leaf primitive and the contract, and are exported above.
+//
+// REMOVED IN 0.4.0 — `validateSro`, `SRO`, `SROBody`. See CHANGELOG 0.4.0.

package/src/internal/attestation-core.ts

@@ -0,0 +1,122 @@
+/**
+ * @synoi/sraid — internal/attestation-core.ts
+ *
+ * The crypto-agnostic core of the L2 DSSE attestation profile: the PAE
+ * encoding, the algorithm identifiers, the public verify input/result types,
+ * the both-required signature lookup, and the envelope-shape predicate.
+ *
+ * This is a PURE module — no crypto, no node:crypto, no Buffer — so the same
+ * PAE bytes, AND-policy shape, and type contract are shared byte-for-byte by
+ * BOTH the node default entry (attestation.ts, node:crypto verifiers) and the
+ * browser verify surface (verify-browser.ts, WebCrypto + @noble verifiers).
+ * Divergent PAE or shape logic between the two would be a signature-validity
+ * hazard; keeping it in one place removes that risk.
+ *
+ * The verify ORCHESTRATION (decode each sig, run both verifiers, gate on the
+ * AND policy) is intentionally NOT here: the node path is synchronous
+ * (node:crypto verify) and the browser path is asynchronous (WebCrypto verify),
+ * so a single shared body cannot serve both. Each entry keeps its own thin
+ * orchestration and reuses these leaf helpers.
+ */
+
+import type { AttestationEnvelope, AttestationSignature } from '../types.js'
+
+/** The single supported algorithm identifiers for the JSON profile. */
+export const ALG_ED25519 = 'ed25519'
+export const ALG_ML_DSA_65 = 'ml-dsa-65'
+
+/**
+ * The DSSE Pre-Authentication Encoding (PAE).
+ *
+ * Per the DSSE spec:
+ *
+ *   PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body
+ *
+ * where:
+ *   - SP is a single ASCII space (0x20),
+ *   - LEN(x) is the ASCII-decimal byte length of x's UTF-8 encoding,
+ *   - type and body are the raw UTF-8 bytes (NOT base64).
+ *
+ * Binding the payloadType (and both lengths) into the signed bytes is what
+ * makes a signature non-transferable across object types. Returns the raw
+ * bytes to be signed/verified.
+ */
+export function pae(payloadType: string, payload: string | Uint8Array): Uint8Array {
+  const enc = new TextEncoder()
+  const typeBytes = enc.encode(payloadType)
+  const bodyBytes = typeof payload === 'string' ? enc.encode(payload) : payload
+
+  const prefix = enc.encode(
+    `DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `,
+  )
+  const out = new Uint8Array(prefix.length + bodyBytes.length)
+  out.set(prefix, 0)
+  out.set(bodyBytes, prefix.length)
+  return out
+}
+
+export interface VerifyAttestationInput {
+  /**
+   * The DSSE attestation envelope to verify. Its `payloadType` is bound into
+   * the PAE; its `payload` is the canonical UTF-8 string that was signed.
+   */
+  envelope: AttestationEnvelope
+  /** Raw 32-byte Ed25519 public key. */
+  ed25519_pub: Uint8Array
+  /** Raw ML-DSA-65 public key bytes. */
+  ml_dsa_pub: Uint8Array
+  /**
+   * Optional. If supplied, the verifier asserts the envelope's `payloadType`
+   * equals this value before verifying signatures — an explicit type-pinning
+   * check on top of the structural PAE binding. A mismatch fails with
+   * `payload-type-mismatch`.
+   */
+  expectedPayloadType?: string
+}
+
+export interface VerifyAttestationResult {
+  /** True only when BOTH required signatures verified over the same PAE. */
+  valid: boolean
+  /**
+   * Human-readable failure reasons. Empty when valid. Possible values:
+   * 'envelope-malformed', 'payload-type-mismatch', 'missing-ed25519',
+   * 'missing-ml-dsa-65', 'ed25519-malformed', 'ml-dsa-malformed',
+   * 'ed25519-invalid', 'ml-dsa-invalid'.
+   */
+  reasons: string[]
+}
+
+/**
+ * Structural well-formedness of an attestation envelope: a non-null object with
+ * a non-empty string `payloadType`, a string `payload`, and an array
+ * `signatures`. A false result maps to the `envelope-malformed` reason. This is
+ * the SINGLE definition of envelope shape, shared by the node and browser
+ * verifiers so they reject the same inputs.
+ */
+export function isWellFormedEnvelope(env: unknown): env is AttestationEnvelope {
+  return (
+    env !== null &&
+    typeof env === 'object' &&
+    typeof (env as AttestationEnvelope).payloadType === 'string' &&
+    (env as AttestationEnvelope).payloadType.length > 0 &&
+    typeof (env as AttestationEnvelope).payload === 'string' &&
+    Array.isArray((env as AttestationEnvelope).signatures)
+  )
+}
+
+/**
+ * Find the first well-formed signature entry for `alg` (a `{ alg, sig }` object
+ * whose `sig` is a string). Returns undefined when absent; the AND policy in
+ * each verifier turns a missing pair member into a `missing-*` reason.
+ */
+export function findSig(
+  sigs: readonly AttestationSignature[],
+  alg: string,
+): AttestationSignature | undefined {
+  for (const s of sigs) {
+    if (s && typeof s === 'object' && s.alg === alg && typeof s.sig === 'string') {
+      return s
+    }
+  }
+  return undefined
+}

package/src/internal/base64-browser.ts

@@ -0,0 +1,39 @@
+/**
+ * @synoi/sraid — internal/base64-browser.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode for the
+ * BROWSER verify surface.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * Why a separate decoder: the node decoder (./base64.ts `decodeBase64Strict`)
+ * finishes with `Buffer.from(s, 'base64')`. `Buffer` is a NODE global that does
+ * not exist in a browser / service-worker / Chrome-extension context — and,
+ * crucially, it is NOT a `node:` specifier, so an esbuild `node:`-reference scan
+ * would NOT catch it. A `Buffer`-based decode would bundle clean yet throw
+ * `ReferenceError: Buffer is not defined` at runtime. This decoder is
+ * Buffer-free: it reuses the pure `assertBase64` validation (regex/length/
+ * padding only, from ./base64-validate.js — NOT ./base64.js, whose graph pulls
+ * in the `Buffer` decode) and decodes via the standard `atob` global, which IS
+ * available in browsers, dedicated/shared workers, and MV3 extension service
+ * workers.
+ *
+ * Same strict contract as the node path: throws Error('base64-malformed') on
+ * any deviation (illegal char, bad length, bad padding) rather than silently
+ * truncating, so a malformed signature is rejected loudly, never decoded to a
+ * short prefix that then "verifies" against something unintended.
+ */
+
+import { assertBase64 } from './base64-validate.js'
+
+/**
+ * Strictly decode standard base64 to raw bytes using only browser-safe globals.
+ * Throws Error('base64-malformed') on any non-conforming input.
+ */
+export function decodeBase64StrictBrowser(s: string): Uint8Array {
+  assertBase64(s)
+  const bin = atob(s)
+  const out = new Uint8Array(bin.length)
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i)
+  return out
+}

package/src/internal/base64-validate.ts

@@ -0,0 +1,31 @@
+/**
+ * @synoi/sraid — internal/base64-validate.ts
+ *
+ * Pure strict standard-base64 (RFC 4648 §4, with `=` padding) VALIDATION.
+ *
+ * INTERNAL: not exported from any public entry.
+ *
+ * This is the Buffer-free, node:crypto-free half of base64 handling, split out
+ * so the browser decoder (./base64-browser.ts) can validate without importing
+ * ./base64.ts (whose `decodeBase64Strict` uses the node `Buffer` global — safe
+ * in node, a runtime `ReferenceError` in a browser). The node decoder re-uses
+ * this same validator, so both paths reject exactly the same inputs.
+ */
+
+// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
+// must be a multiple of 4.
+const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/
+
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export function assertBase64(s: string): void {
+  if (typeof s !== 'string') throw new Error('base64-malformed')
+  if (s.length % 4 !== 0) throw new Error('base64-malformed')
+  if (!STD_B64.test(s)) throw new Error('base64-malformed')
+  // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
+  // at end already guarantees pad chars are contiguous and trailing, but a pad
+  // char earlier in the body would have been rejected by the alphabet class —
+  // so an in-body `=` cannot pass STD_B64. No extra check needed.
+}

package/src/internal/base64.ts

@@ -14,25 +14,16 @@
  *
  * Canonical inputs carry no surrounding whitespace, so no trim is applied;
  * leading/trailing whitespace is itself a rejection.
+ *
+ * The strict VALIDATION (alphabet/length/padding) lives in the pure, Buffer-
+ * free ./base64-validate.ts so the browser decoder can share it; this module
+ * adds the node `Buffer`-based decode on top and re-exports `assertBase64` so
+ * existing importers of `./base64.js` are unchanged.
  */
 
-// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
-// must be a multiple of 4.
-const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/
+import { assertBase64 } from './base64-validate.js'
 
-/**
- * Validate strict standard base64. Throws Error('base64-malformed') on any
- * non-conforming input.
- */
-export function assertBase64(s: string): void {
-  if (typeof s !== 'string') throw new Error('base64-malformed')
-  if (s.length % 4 !== 0) throw new Error('base64-malformed')
-  if (!STD_B64.test(s)) throw new Error('base64-malformed')
-  // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
-  // at end already guarantees pad chars are contiguous and trailing, but a pad
-  // char earlier in the body would have been rejected by the alphabet class —
-  // so an in-body `=` cannot pass STD_B64. No extra check needed.
-}
+export { assertBase64 }
 
 /**
  * Strictly decode standard base64 to raw bytes. Throws

package/src/internal/content-core.ts

@@ -0,0 +1,88 @@
+/**
+ * @synoi/sraid — internal/content-core.ts
+ *
+ * The CDRO OID content-core projection: the normative strip-set and the
+ * field-removal function that together define WHAT bytes an OID is computed
+ * over. This is a PURE module — no hashing, no node:crypto, no Buffer — so it
+ * is safe to import from both the node default entry (via oid.ts) and the
+ * browser verify surface (via verify-browser.ts) without dragging node
+ * builtins into a browser bundle.
+ *
+ * This is the SINGLE NORMATIVE SOURCE of the CDRO OID projection (ADR_019).
+ * oid.ts re-exports these symbols and layers the SHA-256 hashing on top; every
+ * other surface (GAP SDKs, the gateway signer, IMPLEMENTING.md) derives from
+ * THIS set, never re-lists it.
+ */
+
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export const CDRO_ENVELOPE_FIELDS: readonly string[] = Object.freeze([
+  'oid',
+  'signature',
+  'ml_dsa_signature',
+  'signature_key_id',
+  'signature_algorithm',
+  'attestation',
+])
+
+const CDRO_ENVELOPE_FIELD_SET: ReadonlySet<string> = new Set(CDRO_ENVELOPE_FIELDS)
+
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export function cdroContentCore(cdro: unknown): Record<string, unknown> {
+  if (cdro === null || typeof cdro !== 'object' || Array.isArray(cdro)) {
+    throw new TypeError('cdroContentCore: argument must be a CDRO object')
+  }
+  const core: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(cdro as Record<string, unknown>)) {
+    if (CDRO_ENVELOPE_FIELD_SET.has(k)) continue
+    core[k] = v
+  }
+  return core
+}

package/src/internal/ed25519-browser.ts

@@ -0,0 +1,85 @@
+/**
+ * @synoi/sraid — internal/ed25519-browser.ts
+ *
+ * Browser-safe Ed25519 verification. NO node:crypto.
+ *
+ * Primary path: WebCrypto (`globalThis.crypto.subtle`), which uses RFC 8032
+ * cofactored verification — the SAME rule OpenSSL/node:crypto uses on the node
+ * default entry, so the browser verifier accepts/rejects exactly what the node
+ * verifier does for every real signature.
+ *
+ * Fallback path: `@noble/curves` ed25519 (pure JS), used only when WebCrypto
+ * Ed25519 is unavailable (older embedded webviews / Chrome extensions below the
+ * WebCrypto-Ed25519 support floor, ~Chrome 137). @noble defaults to ZIP-215
+ * verification rules, which agree with cofactored on every well-formed
+ * signature and can differ only on deliberately malformed/malleable points that
+ * real signers never produce (see ed25519.ts for the same note). SynOI signs
+ * canonically, so the fallback is behavior-equivalent for legitimate inputs.
+ *
+ * ASYNC: WebCrypto verify is Promise-based, so this returns a Promise<boolean>.
+ * The browser attestation verifier is async as a result; the node path stays
+ * synchronous and unchanged.
+ *
+ * Returns false (never throws) on any malformed input or verification failure,
+ * matching the node `verifyEd25519` contract, so callers get a clean boolean.
+ */
+
+import { ed25519 } from '@noble/curves/ed25519.js'
+
+// Fixed DER prefix for an Ed25519 SubjectPublicKeyInfo (RFC 8410):
+//   SEQUENCE { SEQUENCE { OID 1.3.101.112 } BIT STRING (32 raw bytes) }
+// A plain Uint8Array literal (NOT Buffer, which is undefined in browsers). Used
+// only for the SPKI import fallback below.
+const ED25519_SPKI_PREFIX = new Uint8Array([
+  0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+])
+
+const ED25519_ALG = { name: 'Ed25519' } as const
+
+// Return type is inferred (webcrypto.CryptoKey); the bare `CryptoKey` global is
+// not declared by @types/node ^20, so it is deliberately left un-annotated.
+async function importPublicKey(publicKeyRaw: Uint8Array) {
+  const subtle = globalThis.crypto.subtle
+  try {
+    // Preferred: raw 32-byte import (Secure Curves spec).
+    return await subtle.importKey('raw', publicKeyRaw, ED25519_ALG, false, ['verify'])
+  } catch {
+    // Some engines only accept SPKI for Ed25519 import; wrap the raw key.
+    const spki = new Uint8Array(ED25519_SPKI_PREFIX.length + publicKeyRaw.length)
+    spki.set(ED25519_SPKI_PREFIX, 0)
+    spki.set(publicKeyRaw, ED25519_SPKI_PREFIX.length)
+    return await subtle.importKey('spki', spki, ED25519_ALG, false, ['verify'])
+  }
+}
+
+/**
+ * Verify a raw 64-byte Ed25519 signature over `message` against a raw 32-byte
+ * public key. Prefers WebCrypto (cofactored, matching the node path); falls
+ * back to @noble/curves only when WebCrypto Ed25519 is not supported. Returns
+ * false on any malformed input or verification failure; never throws.
+ */
+export async function verifyEd25519Browser(
+  signature: Uint8Array,
+  message: Uint8Array,
+  publicKeyRaw: Uint8Array,
+): Promise<boolean> {
+  if (publicKeyRaw.length !== 32) return false
+
+  const subtle = globalThis.crypto?.subtle
+  if (subtle) {
+    try {
+      const key = await importPublicKey(publicKeyRaw)
+      return await subtle.verify(ED25519_ALG, key, signature, message)
+    } catch {
+      // Fall through to @noble. A WebCrypto throw here is either an
+      // unsupported-algorithm signal or a malformed input; @noble resolves both
+      // correctly (a real bad signature/key verifies as false there too).
+    }
+  }
+
+  try {
+    return ed25519.verify(signature, message, publicKeyRaw)
+  } catch {
+    return false
+  }
+}

package/src/internal/mldsa-browser.ts

@@ -0,0 +1,39 @@
+/**
+ * @synoi/sraid — internal/mldsa-browser.ts
+ *
+ * Browser-safe ML-DSA-65 (FIPS 204) verification. NO node:crypto.
+ *
+ * Browsers ship no native ML-DSA, so there is only one path here: the pure-JS
+ * `@noble/post-quantum` implementation, which is fully browser-safe. The node
+ * default entry (mldsa.ts) uses a native OpenSSL fast path with this same
+ * @noble impl as its fallback, so both entries are byte-for-byte interoperable.
+ *
+ * IMPORTANT: import `ml_dsa65` DIRECTLY from `@noble/post-quantum/ml-dsa.js`,
+ * NOT from ./mldsa.ts — that module statically imports `node:crypto` (for its
+ * native fast path and the globalThis.crypto polyfill), which would poison a
+ * browser bundle. No globalThis.crypto polyfill is needed here: browsers,
+ * workers, and MV3 service workers all provide it natively, and ml_dsa65.verify
+ * is deterministic (it never calls getRandomValues; only keygen/sign do).
+ *
+ * Verification is SYNCHRONOUS. Returns false (never throws) on any malformed
+ * input or verification failure, matching the node `verifyMlDsa65` contract.
+ */
+
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js'
+
+/**
+ * Verify a raw ML-DSA-65 signature over `message` against a raw 1952-byte
+ * public key using @noble/post-quantum. Returns false on any malformed input or
+ * verification failure; never throws.
+ */
+export function verifyMlDsa65Browser(
+  signature: Uint8Array,
+  message: Uint8Array,
+  publicKeyRaw: Uint8Array,
+): boolean {
+  try {
+    return ml_dsa65.verify(signature, message, publicKeyRaw)
+  } catch {
+    return false
+  }
+}

package/src/internal/sha256-browser.ts

@@ -0,0 +1,28 @@
+/**
+ * @synoi/sraid — internal/sha256-browser.ts
+ *
+ * Browser-safe SHA-256 via WebCrypto (`globalThis.crypto.subtle.digest`). NO
+ * node:crypto. Used by the browser OID helpers in verify-browser.ts.
+ *
+ * ASYNC: subtle.digest is Promise-based, so the browser OID helpers are async
+ * (the node oid.ts helpers stay synchronous via node:crypto createHash and are
+ * unchanged). SHA-256 is byte-identical across any conformant implementation,
+ * so a browser-computed OID equals the node-computed one for the same input.
+ */
+
+function toHex(bytes: Uint8Array): string {
+  let out = ''
+  for (let i = 0; i < bytes.length; i++) {
+    out += (bytes[i] as number).toString(16).padStart(2, '0')
+  }
+  return out
+}
+
+/**
+ * Compute `sha256:` + lowercase hex of SHA-256(bytes) using WebCrypto. Mirrors
+ * the `sha256:`-prefixed output of the node oid.ts helpers.
+ */
+export async function sha256HexPrefixed(bytes: Uint8Array): Promise<string> {
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes)
+  return 'sha256:' + toHex(new Uint8Array(digest))
+}