@synoi/sraid 0.2.0

package/dist/canonicalize.js

@@ -0,0 +1,151 @@
+/**
+ * @synoi/sraid — canonicalize.ts
+ *
+ * Strict RFC 8785 (JCS) serializer for SRAID objects. Produces
+ * byte-identical output to any other conformant RFC 8785 implementation
+ * given the same input, making this the normative canonical form for OID
+ * derivation and signing.
+ *
+ * Rules (strict RFC 8785 JCS):
+ *   - Primitives are emitted via JSON.stringify (strings are escaped with
+ *     standard JSON string escaping; booleans and null are literals).
+ *   - Numbers must be FINITE INTEGERS (ADR_019 decision 2). NaN, Infinity
+ *     (positive or negative), and any non-integer (float) are REJECTED with
+ *     a thrown TypeError BEFORE hashing. Forbidding floats everywhere matches
+ *     GAP-TS / GAP-Python and removes the hardest RFC 8785 cross-language
+ *     serialization trap from the signed byte string; the product only emits
+ *     integer minor-unit money and integer ms timestamps. Legal integers use
+ *     the ECMAScript number-to-string serialization of RFC 8785 §3.2.2.3
+ *     (equivalent to JS's default toString for integer values).
+ *   - Arrays preserve element order; elements are recursively canonicalized.
+ *   - Objects emit their keys sorted in ascending lexicographic
+ *     (UTF-16 code-unit) order — this is the order produced by
+ *     Array.prototype.sort(), which is exactly what RFC 8785 §3.2.3
+ *     specifies for implementations whose host language uses UTF-16
+ *     string encoding (including ECMAScript/TypeScript).
+ *   - Object properties whose value is `undefined` are OMITTED entirely.
+ *     (JSON has no undefined; this matches JSON.stringify semantics.)
+ *   - No whitespace anywhere. Separators are bare `,` and `:`.
+ *   - `null` is preserved as `null`.
+ *
+ * Stability invariant: any change to this function breaks every signed
+ * receipt, every OID, every grant — so it must NEVER be changed without
+ * a coordinated migration. The output bytes for a given input are a
+ * cross-package contract.
+ */
+/**
+ * Canonicalize an arbitrary JSON-compatible value into a deterministic
+ * UTF-8 string following RFC 8785 (JCS). The output is suitable as input
+ * to SHA-256 (or any other hash) for OID derivation and as the byte string
+ * signed by Ed25519 / ML-DSA-65 envelopes.
+ *
+ * Reject-loud contract: a TypeError is thrown for any value that is not a
+ * JSON value, rather than silently producing a wrong or invalid canonical
+ * form (which would corrupt an OID or signature):
+ *   - NaN / Infinity / -Infinity (RFC 8785 forbids non-finite numbers).
+ *   - non-integer numbers / floats (ADR_019 forbids them; use integer minor
+ *     units). e.g. 1.5, 0.1, 2e-3 all throw.
+ *   - undefined / function / symbol / bigint anywhere they appear as a value,
+ *     including as an ARRAY element (previously these produced invalid JSON
+ *     like "[1,,2]").
+ *   - objects with a toJSON() method (e.g. Date), which a bare keys-walk would
+ *     silently mis-serialize (a Date became "{}"). Convert to a JSON value
+ *     (e.g. an ISO string) first.
+ * Object properties whose value is `undefined` are OMITTED (matches
+ * JSON.stringify); an undefined array element throws (it cannot be omitted).
+ *
+ * @example
+ *   canonicalize({ b: 2, a: 1 })            // '{"a":1,"b":2}'
+ *   canonicalize({ a: undefined, b: 1 })    // '{"b":1}'  (object undefined omitted)
+ *   canonicalize([3, 1, 2])                 // '[3,1,2]'
+ *   canonicalize([1, null, 2])              // '[1,null,2]'
+ *   canonicalize({ foo: 1, bar: 'hi' })     // '{"bar":"hi","foo":1}'
+ *   canonicalize(NaN)                       // throws TypeError
+ *   canonicalize(Infinity)                  // throws TypeError
+ *   canonicalize(1.5)                       // throws TypeError (floats forbidden, ADR_019)
+ *   canonicalize([1, undefined, 2])         // throws TypeError (no empty slots)
+ *   canonicalize(new Date())                // throws TypeError (serialize first)
+ */
+export function canonicalize(value) {
+    const t = typeof value;
+    if (t === 'number') {
+        if (!isFinite(value)) {
+            throw new TypeError(`canonicalize: RFC 8785 forbids non-finite numbers; received ${String(value)}`);
+        }
+        // ADR_019 decision 2: FORBID non-integer numbers everywhere. A number is
+        // legal iff it is a finite integer. Floats are rejected BEFORE hashing,
+        // matching GAP-TS / GAP-Python, so a float-bearing object cannot mint an
+        // OID on one surface that another surface declares malformed. This kills
+        // the hardest RFC 8785 cross-language trap (float shortest-round-trip
+        // serialization) on a signed byte string; the product only ever emits
+        // integer minor-unit money and integer millisecond timestamps.
+        //
+        // Number.isInteger(-0) is true and, with floats forbidden, -0 can only
+        // arise as an explicit input; JSON.stringify(-0) === '0', so the former
+        // -0 special-case is now redundant and is DELETED (removing a divergence
+        // source per ADR_019 rather than carrying a rule that can never fire on
+        // legal input).
+        if (!Number.isInteger(value)) {
+            throw new TypeError(`canonicalize: non-integer numbers are forbidden (ADR_019); received ${String(value)}. ` +
+                'Represent fractional quantities as integer minor units (e.g. cents) before canonicalizing.');
+        }
+        return JSON.stringify(value);
+    }
+    if (value === null)
+        return 'null';
+    if (t === 'string' || t === 'boolean')
+        return JSON.stringify(value);
+    // Reject-loud: a value that is not a JSON value MUST throw, never silently
+    // produce wrong or invalid output. Previously these fell through to
+    // JSON.stringify, which returns the JS value `undefined` for undefined /
+    // function / symbol — corrupting an array element into invalid JSON like
+    // "[1,,2]" — and throws for bigint. An OID/signature must never be derived
+    // from a corrupted or out-of-domain canonical form.
+    if (t === 'undefined' || t === 'function' || t === 'symbol' || t === 'bigint') {
+        throw new TypeError(`canonicalize: value of type "${t}" is not a JSON value and cannot be canonicalized`);
+    }
+    // value is a non-null object from here.
+    if (Array.isArray(value)) {
+        // Each element is canonicalized recursively. We walk by index rather than
+        // Array.prototype.map because map SKIPS holes in a sparse array — a hole
+        // (`[1, , 2]`, distinct from an explicit `[1, undefined, 2]`) is never
+        // visited by map, so it would slip past the reject-loud element checks and
+        // join() would emit invalid, index-shifting JSON like "[1,,2]". A hole is
+        // out-of-domain input (JSON has no concept of a missing element); per the
+        // reject-loud contract it throws, exactly as an explicit undefined element
+        // does, rather than silently coercing to null.
+        const parts = [];
+        for (let i = 0; i < value.length; i++) {
+            if (!(i in value)) {
+                throw new TypeError(`canonicalize: sparse array hole at index ${i} is not a JSON value and ` +
+                    'cannot be canonicalized (it would produce invalid JSON like "[1,,2]"); ' +
+                    'fill the slot with an explicit value (e.g. null) before canonicalizing');
+            }
+            parts.push(canonicalize(value[i]));
+        }
+        return '[' + parts.join(',') + ']';
+    }
+    // Reject objects that define their own JSON projection (Date, Buffer,
+    // Decimal, BigNumber, ...). RFC 8785 / JSON.stringify call toJSON() first; a
+    // bare keys-walk does not, so a Date would silently canonicalize to "{}" and
+    // fork the OID. Callers must convert to a JSON value (e.g. an ISO string)
+    // before canonicalizing.
+    if (typeof value.toJSON === 'function') {
+        throw new TypeError('canonicalize: objects with a toJSON() method (e.g. Date) are not accepted; ' +
+            'serialize them to a JSON value (e.g. an ISO string) before canonicalizing');
+    }
+    const obj = value;
+    // Object properties whose value is `undefined` are OMITTED (matches
+    // JSON.stringify and the JSON data model). This is the one omission we honor;
+    // an undefined ARRAY element throws (above), because dropping it would shift
+    // indices and silently change meaning.
+    const keys = Object.keys(obj)
+        .filter((k) => obj[k] !== undefined)
+        .sort();
+    return ('{' +
+        keys
+            .map((k) => JSON.stringify(k) + ':' + canonicalize(obj[k]))
+            .join(',') +
+        '}');
+}
+//# sourceMappingURL=canonicalize.js.map

package/dist/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../src/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,CAAC,GAAG,OAAO,KAAK,CAAA;IAEtB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,SAAS,CACjB,+DAA+D,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/E,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,+DAA+D;QAC/D,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,gBAAgB;QAChB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CACjB,uEAAuE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACtF,4FAA4F,CAC/F,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAyB,CAAC,CAAA;IAEvF,2EAA2E;IAC3E,oEAAoE;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CACjB,gCAAgC,CAAC,mDAAmD,CACrF,CAAA;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,SAAS,CACjB,4CAA4C,CAAC,2BAA2B;oBACtE,yEAAyE;oBACzE,wEAAwE,CAC3E,CAAA;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IACpC,CAAC;IAED,sEAAsE;IACtE,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,yBAAyB;IACzB,IAAI,OAAQ,KAA8B,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,SAAS,CACjB,6EAA6E;YAC3E,2EAA2E,CAC9E,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,oEAAoE;IACpE,8EAA8E;IAC9E,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACnC,IAAI,EAAE,CAAA;IACT,OAAO,CACL,GAAG;QACH,IAAI;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aAC1D,IAAI,CAAC,GAAG,CAAC;QACZ,GAAG,CACJ,CAAA;AACH,CAAC"}

package/dist/ed25519.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @synoi/sraid — ed25519.ts
+ *
+ * Native Ed25519 verification via node:crypto (OpenSSL). Verifying RFC 8032
+ * Ed25519 signatures with the platform crypto is materially faster than a
+ * pure-JS implementation (~30x on the verify op) and produces the same
+ * accept/reject result for all standard signatures.
+ *
+ * NOTE on verification semantics: node:crypto / OpenSSL uses RFC 8032
+ * cofactored verification. Some pure-JS libraries (e.g. @noble) default to
+ * ZIP-215 batch-compatible rules, which accept a slightly larger set of
+ * non-canonical edge-case points. The two agree on every well-formed
+ * signature; they can differ only on deliberately malformed/malleable points
+ * that real signers never produce. SynOI signs canonically, so this is a
+ * tightening, not a behavior change, but it is called out for maintainers.
+ *
+ * The public API takes a RAW 32-byte Ed25519 public key; this module wraps it
+ * in the fixed SPKI DER prefix to build a KeyObject.
+ */
+/**
+ * Verify a raw 64-byte Ed25519 signature over `message` against a raw 32-byte
+ * public key. Returns false (never throws) on any malformed input or
+ * verification failure, so callers get a clean boolean.
+ */
+export declare function verifyEd25519(signature: Uint8Array, message: Uint8Array, publicKeyRaw: Uint8Array): boolean;
+//# sourceMappingURL=ed25519.d.ts.map

package/dist/ed25519.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA0BH;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,UAAU,GACvB,OAAO,CAMT"}

package/dist/ed25519.js

@@ -0,0 +1,53 @@
+/**
+ * @synoi/sraid — ed25519.ts
+ *
+ * Native Ed25519 verification via node:crypto (OpenSSL). Verifying RFC 8032
+ * Ed25519 signatures with the platform crypto is materially faster than a
+ * pure-JS implementation (~30x on the verify op) and produces the same
+ * accept/reject result for all standard signatures.
+ *
+ * NOTE on verification semantics: node:crypto / OpenSSL uses RFC 8032
+ * cofactored verification. Some pure-JS libraries (e.g. @noble) default to
+ * ZIP-215 batch-compatible rules, which accept a slightly larger set of
+ * non-canonical edge-case points. The two agree on every well-formed
+ * signature; they can differ only on deliberately malformed/malleable points
+ * that real signers never produce. SynOI signs canonically, so this is a
+ * tightening, not a behavior change, but it is called out for maintainers.
+ *
+ * The public API takes a RAW 32-byte Ed25519 public key; this module wraps it
+ * in the fixed SPKI DER prefix to build a KeyObject.
+ */
+import { createPublicKey, verify as nodeVerify } from 'node:crypto';
+import { BoundedKeyCache, KEY_CACHE_MAX } from './internal/key-cache.js';
+// Fixed DER prefix for an Ed25519 SubjectPublicKeyInfo (RFC 8410):
+//   SEQUENCE { SEQUENCE { OID 1.3.101.112 } BIT STRING (32 raw bytes) }
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+// Small bounded LRU: building a KeyObject parses DER, so cache by raw-key hex.
+// Bounded so an attacker streaming distinct keys cannot grow it without limit.
+const keyCache = new BoundedKeyCache(KEY_CACHE_MAX);
+function keyObjectFromRaw(raw) {
+    if (raw.length !== 32)
+        throw new Error('ed25519 public key must be 32 bytes');
+    const hex = Buffer.from(raw).toString('hex');
+    let ko = keyCache.get(hex);
+    if (!ko) {
+        const der = Buffer.concat([ED25519_SPKI_PREFIX, Buffer.from(raw)]);
+        ko = createPublicKey({ key: der, format: 'der', type: 'spki' });
+        keyCache.set(hex, ko);
+    }
+    return ko;
+}
+/**
+ * Verify a raw 64-byte Ed25519 signature over `message` against a raw 32-byte
+ * public key. Returns false (never throws) on any malformed input or
+ * verification failure, so callers get a clean boolean.
+ */
+export function verifyEd25519(signature, message, publicKeyRaw) {
+    try {
+        return nodeVerify(null, message, keyObjectFromRaw(publicKeyRaw), signature);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ed25519.js.map

package/dist/ed25519.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAkB,MAAM,aAAa,CAAA;AAEnF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAExE,mEAAmE;AACnE,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAE1E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAY,aAAa,CAAC,CAAA;AAE9D,SAAS,gBAAgB,CAAC,GAAe;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAClE,EAAE,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC/D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAqB,EACrB,OAAmB,EACnB,YAAwB;IAExB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @synoi/sraid — public surface.
+ *
+ * SRAID (Self-Routing Addressable Identity Data) is L0 of the SynOI SRAID Stack:
+ *
+ *   L0 SRAID            ← this package
+ *   L1 Vault / Resolver
+ *   L2 Inference Broker / Resonance
+ *   L3 GAP (Governed Action Protocol)
+ *   L4 Apps
+ *
+ * This package is intentionally small: types, canonical serializer,
+ * OID computation, hybrid signature verification, and shape validators.
+ * No storage, no HTTP, no governance — those are higher layers.
+ */
+export type { AttestationEnvelope, AttestationSignature, AuthorityBlock, AuthorityDecision, CDRO, LineageLink, LinkRel, SRO, SROBody, SensitivityTier, SignatureEnvelope, } from './types.js';
+export { canonicalize } from './canonicalize.js';
+export { oidOf, oidOfCanonical, cdroOid, cdroContentCore, CDRO_ENVELOPE_FIELDS } from './oid.js';
+export { verifySignature, type VerifySignatureInput, type VerifySignatureResult, } from './signature.js';
+export { verifyMlDsa65, isNativeMlDsaAvailable } from './mldsa.js';
+export { evictKeyFromCaches } from './internal/key-cache.js';
+export { verifyAttestation, pae, ALG_ED25519, ALG_ML_DSA_65, type VerifyAttestationInput, type VerifyAttestationResult, } from './attestation.js';
+export { lineageLinks, supersededOids, latestWins, type LatestWinsResult, } from './lineage.js';
+export { SENSITIVITY_TIERS, SENSITIVITY_DEFAULT, isSensitivityTier, sensitivityRank, sensitivityMax, sensitivityCarryForward, sensitivityMonotoneCheck, } from './sensitivity.js';
+export { verifyAuthority, capabilityCovers, type VerifyAuthorityInput, type VerifyAuthorityResult, type AuthorityResolver, type GrantStatus, type GrantBodyShape, } from './authority.js';
+export { verifyDelegationChain, MAX_DELEGATION_DEPTH, type VerifyDelegationChainInput, type VerifyDelegationChainResult, type HopResult, type LinkPubkeys, } from './authority.js';
+export { validateCdro, validateSro, validateSignatureEnvelope, validateAttestationEnvelope, validateAuthorityBlock, validateLineageLink, type ValidationResult, } from './validate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,IAAI,EACJ,WAAW,EACX,OAAO,EACP,GAAG,EACH,OAAO,EACP,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGhD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAGhG,OAAO,EACL,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAA;AAKvB,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAMlE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,WAAW,EACX,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAA;AAGrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,46 @@
+/**
+ * @synoi/sraid — public surface.
+ *
+ * SRAID (Self-Routing Addressable Identity Data) is L0 of the SynOI SRAID Stack:
+ *
+ *   L0 SRAID            ← this package
+ *   L1 Vault / Resolver
+ *   L2 Inference Broker / Resonance
+ *   L3 GAP (Governed Action Protocol)
+ *   L4 Apps
+ *
+ * This package is intentionally small: types, canonical serializer,
+ * OID computation, hybrid signature verification, and shape validators.
+ * No storage, no HTTP, no governance — those are higher layers.
+ */
+// Canonical serializer — byte-identical to synoi-gateway + @synoi/vault.
+export { canonicalize } from './canonicalize.js';
+// OID computation — value-level and full-CDRO content-core helpers.
+export { oidOf, oidOfCanonical, cdroOid, cdroContentCore, CDRO_ENVELOPE_FIELDS } from './oid.js';
+// Hybrid Ed25519 + ML-DSA-65 signature verification (LEGACY bare-bytes path).
+export { verifySignature, } from './signature.js';
+// ML-DSA-65 verification with a native node:crypto fast path (OpenSSL 3.5+ /
+// Node 24+) and a transparent @noble fallback on older runtimes. Both paths
+// are byte-identical; `isNativeMlDsaAvailable()` reports which is active.
+export { verifyMlDsa65, isNativeMlDsaAvailable } from './mldsa.js';
+// Coordinated key-cache revocation. The internal bounded LRU key caches
+// (ed25519 + ml-dsa-65) are keyed by lowercase hex of the RAW public-key
+// bytes; `evictKeyFromCaches(keyId)` drops that entry from every cache so a
+// rotated or compromised key cannot be served stale on a later verify.
+export { evictKeyFromCaches } from './internal/key-cache.js';
+// L2 DSSE attestation — PAE type-binding, hybrid Ed25519 + ML-DSA-65 both
+// required. The preferred signing path (replaces the legacy bare-bytes
+// SignatureEnvelope; closes the cross-type confusion gap SRAID F7 / A4).
+export { verifyAttestation, pae, ALG_ED25519, ALG_ML_DSA_65, } from './attestation.js';
+// L3 lineage (Merkle-DAG) — unify supersedes/SRO/prev; latest-wins resolution.
+export { lineageLinks, supersededOids, latestWins, } from './lineage.js';
+// L4 propagating sensitivity — coarse, opaque tier + monotone max() carry-forward.
+export { SENSITIVITY_TIERS, SENSITIVITY_DEFAULT, isSensitivityTier, sensitivityRank, sensitivityMax, sensitivityCarryForward, sensitivityMonotoneCheck, } from './sensitivity.js';
+// L4 authority verification (the authorized axis).
+export { verifyAuthority, capabilityCovers, } from './authority.js';
+// L4 delegation-chain verification (K2) — VERIFY-ONLY, offline, no enforcement.
+// Always reports revocation_checked/existence_checked false (no live claim).
+export { verifyDelegationChain, MAX_DELEGATION_DEPTH, } from './authority.js';
+// Shape validators.
+export { validateCdro, validateSro, validateSignatureEnvelope, validateAttestationEnvelope, validateAuthorityBlock, validateLineageLink, } from './validate.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiBH,yEAAyE;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,oEAAoE;AACpE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAEhG,8EAA8E;AAC9E,OAAO,EACL,eAAe,GAGhB,MAAM,gBAAgB,CAAA;AAEvB,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAElE,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,WAAW,EACX,aAAa,GAGd,MAAM,kBAAkB,CAAA;AAEzB,+EAA+E;AAC/E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,UAAU,GAEX,MAAM,cAAc,CAAA;AAErB,mFAAmF;AACnF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAEzB,mDAAmD;AACnD,OAAO,EACL,eAAe,EACf,gBAAgB,GAMjB,MAAM,gBAAgB,CAAA;AAEvB,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAKrB,MAAM,gBAAgB,CAAA;AAEvB,oBAAoB;AACpB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,eAAe,CAAA"}

package/dist/internal/base64.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @synoi/sraid — internal/base64.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode.
+ *
+ * INTERNAL: not exported from index.ts.
+ *
+ * Why strict: `Buffer.from(s, 'base64')` silently TRUNCATES at the first byte
+ * outside the alphabet and tolerates missing/extra padding. On a signature-
+ * verification path that is dangerous — a malformed envelope must be rejected
+ * loudly, not decoded to a short prefix that then "verifies" against something
+ * unintended. `decodeBase64Strict` validates the alphabet, length, and padding
+ * BEFORE decoding and throws on any deviation.
+ *
+ * Canonical inputs carry no surrounding whitespace, so no trim is applied;
+ * leading/trailing whitespace is itself a rejection.
+ */
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export declare function assertBase64(s: string): void;
+/**
+ * Strictly decode standard base64 to raw bytes. Throws
+ * Error('base64-malformed') on any non-conforming input.
+ */
+export declare function decodeBase64Strict(s: string): Uint8Array;
+//# sourceMappingURL=base64.d.ts.map

package/dist/internal/base64.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAGxD"}

package/dist/internal/base64.js

@@ -0,0 +1,45 @@
+/**
+ * @synoi/sraid — internal/base64.ts
+ *
+ * Strict standard-base64 (RFC 4648 §4, with `=` padding) decode.
+ *
+ * INTERNAL: not exported from index.ts.
+ *
+ * Why strict: `Buffer.from(s, 'base64')` silently TRUNCATES at the first byte
+ * outside the alphabet and tolerates missing/extra padding. On a signature-
+ * verification path that is dangerous — a malformed envelope must be rejected
+ * loudly, not decoded to a short prefix that then "verifies" against something
+ * unintended. `decodeBase64Strict` validates the alphabet, length, and padding
+ * BEFORE decoding and throws on any deviation.
+ *
+ * Canonical inputs carry no surrounding whitespace, so no trim is applied;
+ * leading/trailing whitespace is itself a rejection.
+ */
+// Standard base64 alphabet; `=` only as 1-2 trailing pad chars. Total length
+// must be a multiple of 4.
+const STD_B64 = /^[A-Za-z0-9+/]*={0,2}$/;
+/**
+ * Validate strict standard base64. Throws Error('base64-malformed') on any
+ * non-conforming input.
+ */
+export function assertBase64(s) {
+    if (typeof s !== 'string')
+        throw new Error('base64-malformed');
+    if (s.length % 4 !== 0)
+        throw new Error('base64-malformed');
+    if (!STD_B64.test(s))
+        throw new Error('base64-malformed');
+    // `=` may appear only in the final 1-2 positions. The regex `={0,2}` anchored
+    // at end already guarantees pad chars are contiguous and trailing, but a pad
+    // char earlier in the body would have been rejected by the alphabet class —
+    // so an in-body `=` cannot pass STD_B64. No extra check needed.
+}
+/**
+ * Strictly decode standard base64 to raw bytes. Throws
+ * Error('base64-malformed') on any non-conforming input.
+ */
+export function decodeBase64Strict(s) {
+    assertBase64(s);
+    return new Uint8Array(Buffer.from(s, 'base64'));
+}
+//# sourceMappingURL=base64.js.map

package/dist/internal/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../src/internal/base64.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,OAAO,GAAG,wBAAwB,CAAA;AAExC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACzD,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,YAAY,CAAC,CAAC,CAAC,CAAA;IACf,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AACjD,CAAC"}

package/dist/internal/key-cache.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @synoi/sraid — internal/key-cache.ts
+ *
+ * Bounded, insertion-order LRU for cached KeyObjects, plus a registry so a
+ * single revocation call can fan out across every live cache.
+ *
+ * INTERNAL: not exported from index.ts. Only `evictKeyFromCaches` is public.
+ *
+ * Why a hand-rolled LRU and not `lru-cache`: this package is deliberately
+ * zero-runtime-dependency (only @noble/* dev/peer surface). Pulling an npm LRU
+ * to bound a key cache would widen the supply-chain attack surface of the exact
+ * L0 library whose value is a minimal, auditable core. A ~40-line insertion-
+ * order LRU costs nothing and keeps that posture.
+ *
+ * The cache key is the lowercase hex of the RAW public-key bytes — the same
+ * string mldsa.ts and ed25519.ts already use as their Map key. It is NOT an
+ * OID, DID, or kid. ed25519 keys (32B hex) and ml-dsa-65 keys (1952B hex)
+ * never collide, so the two caches share one key namespace safely and a
+ * cross-cache evict is a harmless no-op when the key is absent.
+ */
+/** Per-cache capacity. At 1952 bytes/ml-dsa-key this bounds raw-key-equivalent
+ * residency near ~2MB plus KeyObject overhead — bounded and safe. */
+export declare const KEY_CACHE_MAX = 1000;
+/**
+ * Insertion-order LRU. Map preserves insertion order, so the oldest live entry
+ * is always `keys().next()`. A `get` hit re-inserts (delete + set) to promote
+ * the entry to most-recently-used. `set` evicts the oldest when at capacity.
+ */
+export declare class BoundedKeyCache<V> {
+    readonly max: number;
+    private readonly map;
+    constructor(max?: number);
+    get size(): number;
+    get(key: string): V | undefined;
+    set(key: string, value: V): void;
+    delete(key: string): boolean;
+}
+/**
+ * Evict a key from every live cache. Use for coordinated key revocation: when a
+ * signing key is rotated or compromised, drop any cached KeyObject for it so a
+ * later verify cannot be served a stale entry.
+ *
+ * @param keyId lowercase hex of the RAW public-key bytes (the cache key). Not
+ *              an OID/DID/kid. Deleting an absent key is a harmless no-op.
+ */
+export declare function evictKeyFromCaches(keyId: string): void;
+//# sourceMappingURL=key-cache.d.ts.map

package/dist/internal/key-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-cache.d.ts","sourceRoot":"","sources":["../../src/internal/key-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;qEACqE;AACrE,eAAO,MAAM,aAAa,OAAO,CAAA;AAKjC;;;;GAIG;AACH,qBAAa,eAAe,CAAC,CAAC;IAGhB,QAAQ,CAAC,GAAG,EAAE,MAAM;IAFhC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuB;gBAEtB,GAAG,GAAE,MAAsB;IAIhD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAS/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAUhC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;CAG7B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEtD"}

package/dist/internal/key-cache.js

@@ -0,0 +1,77 @@
+/**
+ * @synoi/sraid — internal/key-cache.ts
+ *
+ * Bounded, insertion-order LRU for cached KeyObjects, plus a registry so a
+ * single revocation call can fan out across every live cache.
+ *
+ * INTERNAL: not exported from index.ts. Only `evictKeyFromCaches` is public.
+ *
+ * Why a hand-rolled LRU and not `lru-cache`: this package is deliberately
+ * zero-runtime-dependency (only @noble/* dev/peer surface). Pulling an npm LRU
+ * to bound a key cache would widen the supply-chain attack surface of the exact
+ * L0 library whose value is a minimal, auditable core. A ~40-line insertion-
+ * order LRU costs nothing and keeps that posture.
+ *
+ * The cache key is the lowercase hex of the RAW public-key bytes — the same
+ * string mldsa.ts and ed25519.ts already use as their Map key. It is NOT an
+ * OID, DID, or kid. ed25519 keys (32B hex) and ml-dsa-65 keys (1952B hex)
+ * never collide, so the two caches share one key namespace safely and a
+ * cross-cache evict is a harmless no-op when the key is absent.
+ */
+/** Per-cache capacity. At 1952 bytes/ml-dsa-key this bounds raw-key-equivalent
+ * residency near ~2MB plus KeyObject overhead — bounded and safe. */
+export const KEY_CACHE_MAX = 1000;
+/** Registry of every live cache, for coordinated eviction. */
+const registry = [];
+/**
+ * Insertion-order LRU. Map preserves insertion order, so the oldest live entry
+ * is always `keys().next()`. A `get` hit re-inserts (delete + set) to promote
+ * the entry to most-recently-used. `set` evicts the oldest when at capacity.
+ */
+export class BoundedKeyCache {
+    max;
+    map = new Map();
+    constructor(max = KEY_CACHE_MAX) {
+        this.max = max;
+        registry.push(this);
+    }
+    get size() {
+        return this.map.size;
+    }
+    get(key) {
+        const v = this.map.get(key);
+        if (v === undefined)
+            return undefined;
+        // Promote to most-recently-used.
+        this.map.delete(key);
+        this.map.set(key, v);
+        return v;
+    }
+    set(key, value) {
+        // If present, drop first so re-insert lands at the MRU end.
+        if (this.map.has(key))
+            this.map.delete(key);
+        else if (this.map.size >= this.max) {
+            const oldest = this.map.keys().next().value;
+            if (oldest !== undefined)
+                this.map.delete(oldest);
+        }
+        this.map.set(key, value);
+    }
+    delete(key) {
+        return this.map.delete(key);
+    }
+}
+/**
+ * Evict a key from every live cache. Use for coordinated key revocation: when a
+ * signing key is rotated or compromised, drop any cached KeyObject for it so a
+ * later verify cannot be served a stale entry.
+ *
+ * @param keyId lowercase hex of the RAW public-key bytes (the cache key). Not
+ *              an OID/DID/kid. Deleting an absent key is a harmless no-op.
+ */
+export function evictKeyFromCaches(keyId) {
+    for (const cache of registry)
+        cache.delete(keyId);
+}
+//# sourceMappingURL=key-cache.js.map

package/dist/internal/key-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-cache.js","sourceRoot":"","sources":["../../src/internal/key-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;qEACqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAA;AAEjC,8DAA8D;AAC9D,MAAM,QAAQ,GAA+B,EAAE,CAAA;AAE/C;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAGL;IAFJ,GAAG,GAAG,IAAI,GAAG,EAAa,CAAA;IAE3C,YAAqB,MAAc,aAAa;QAA3B,QAAG,GAAH,GAAG,CAAwB;QAC9C,QAAQ,CAAC,IAAI,CAAC,IAAgC,CAAC,CAAA;IACjD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAA;IACtB,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACrC,iCAAiC;QACjC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,CAAC,CAAA;IACV,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAQ;QACvB,4DAA4D;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;aACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,KAAK,MAAM,KAAK,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACnD,CAAC"}