@synoi/sraid 0.2.0

package/dist/lineage.d.ts

@@ -0,0 +1,104 @@
+/**
+ * @synoi/sraid — lineage.ts
+ *
+ * L3 lineage helpers (the Merkle-DAG layer). Two jobs:
+ *
+ *   1. UNIFY the three legacy supersession mechanisms — the self-asserted
+ *      `supersedes` string on a CDRO, the standalone SRO object, and the
+ *      `prev` edge — into ONE set of typed lineage edges, so every consumer
+ *      reads supersession the same way (SRAID_FOUNDATION_PUNCHLIST A2,
+ *      OBJECT_MODEL_CLEANSHEET §3.3).
+ *
+ *   2. Give a verifier a LATEST-WINS / MONOTONE rule over a set of versions.
+ *      The legacy `supersedes` string was an unwitnessed pointer: nothing
+ *      stopped an attacker from re-presenting a superseded object as current
+ *      (SRAID F10 / Adversary A3 rollback-replay). Because `prev`/`links`
+ *      are hashed into the OID (see oid.ts `cdroContentCore`), the lineage
+ *      edges are identity-bound and tamper-evident, and `latestWins` resolves
+ *      a version set to its single head by following those edges — given the
+ *      complete in-set version history, a superseded version is detectably NOT
+ *      the head. Full rollback-replay resistance additionally requires that the
+ *      superseding object cannot be withheld; that is a Resolver / transparency-
+ *      log property (DESIGN, not yet deployed in this package). `set_complete`
+ *      on `LatestWinsResult` is the local signal for callers to detect an
+ *      incomplete (potentially withheld) set.
+ *
+ * Pure functions, no I/O. Reachability/coverage of the referenced objects
+ * (do they exist, are they signed, are they unrevoked) is a resolver concern
+ * and out of scope here, exactly as for `verifyAuthority`.
+ */
+import type { CDRO, LineageLink } from './types.js';
+/**
+ * Coalesce a CDRO's three legacy supersession mechanisms into one
+ * de-duplicated list of typed lineage edges:
+ *
+ *   - `prev`              → `{ rel: 'supersedes', oid: prev }`
+ *   - `supersedes`        → `{ rel: 'supersedes', oid: supersedes }`
+ *   - each `links[]` edge → kept as-is
+ *
+ * `prev` and `supersedes` that point at the same OID collapse to a single
+ * `supersedes` edge, and an explicit `{ rel: 'supersedes' }` link to the same
+ * OID is not duplicated. The result is the canonical typed-edge view of an
+ * object's lineage that every consumer (verifier, resolver, drift engine)
+ * should read instead of poking at the three fields individually.
+ *
+ * Order: synthesized supersession edges (from `prev`/`supersedes`) first,
+ * then the object's own `links[]` in declared order, minus duplicates.
+ */
+export declare function lineageLinks(cdro: Pick<CDRO, 'prev' | 'supersedes' | 'links'>): LineageLink[];
+/**
+ * The set of predecessor OIDs this object claims to supersede, drawn from the
+ * unified edge view (`prev`, legacy `supersedes`, and any
+ * `{ rel: 'supersedes' }` links). De-duplicated.
+ */
+export declare function supersededOids(cdro: Pick<CDRO, 'prev' | 'supersedes' | 'links'>): string[];
+/** A CDRO that already carries its own OID (needed to resolve a version set). */
+type Identified = Pick<CDRO, 'oid' | 'prev' | 'supersedes' | 'links'>;
+export interface LatestWinsResult {
+    /** True iff the version set resolves to exactly one head with no cycle. */
+    ok: boolean;
+    /** The head object's OID (the latest version), when `ok`. */
+    head?: string;
+    /**
+     * True iff every in-set version is reachable from the head via supersedes
+     * edges, i.e. the set is one connected monotone chain/DAG with no unreachable
+     * fragment. Always false when `ok` is false. `ok && set_complete` is the
+     * strict signal that this set IS the complete version history from a single
+     * unambiguous head.
+     */
+    set_complete: boolean;
+    /** Machine-readable reasons when not ok or not set_complete. */
+    reasons: string[];
+}
+/**
+ * LATEST-WINS / MONOTONE resolution over a set of versions of the same
+ * logical record. Given the candidate objects, find the single head: the one
+ * object that is not superseded by any other object in the set, where the
+ * supersession edges form an acyclic DAG.
+ *
+ * Given the complete in-set version history, an attacker who re-presents a
+ * superseded version cannot make it the head, because some other object in the
+ * set carries a hashed (identity-bound) `supersedes` edge pointing at it. The
+ * rule is monotone: presenting MORE of the version set can only move the head
+ * forward (toward a newer object), never backward. Note: this guarantee is
+ * scoped to the provided set. Withholding the superseding object is a separate
+ * concern (Resolver / transparency-log layer; DESIGN, not yet deployed).
+ * `set_complete` signals whether every in-set node is reachable from the head.
+ *
+ *   - 0 heads  → a supersession cycle (no monotone order); `ok: false`.
+ *   - 1 head   → the unambiguous latest; `ok: true, head`.
+ *   - >1 heads → a fork (concurrent versions, no single latest); `ok: false`
+ *                with all fork heads listed in `reasons`.
+ *
+ * Diamond merges (a head supersedes two predecessors that share a common
+ * ancestor) are legal and do not trigger a cycle error. Only a back-edge in
+ * the DFS (a node encountered on the active stack) is a true cycle.
+ *
+ * Edges that point OUTSIDE the provided set are ignored for head-finding (the
+ * predecessor may simply not be in hand); they do not make an in-set object a
+ * non-head. Only an in-set object being superseded by another in-set object
+ * removes it from head candidacy.
+ */
+export declare function latestWins(versions: readonly Identified[]): LatestWinsResult;
+export {};
+//# sourceMappingURL=lineage.d.ts.map

package/dist/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../src/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAW,MAAM,YAAY,CAAA;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,OAAO,CAAC,GAAG,WAAW,EAAE,CAwB7F;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,OAAO,CAAC,GAAG,MAAM,EAAE,CAU1F;AAED,iFAAiF;AACjF,KAAK,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,YAAY,GAAG,OAAO,CAAC,CAAA;AAErE,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,EAAE,EAAE,OAAO,CAAA;IACX,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG,gBAAgB,CA4F5E"}

package/dist/lineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.js","sourceRoot":"","sources":["../src/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,IAAiD;IAC5E,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,GAAW,EAAQ,EAAE;QAC/C,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IACxB,CAAC,CAAA;IAED,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpF,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiD;IAC9E,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACf,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,UAAU,CAAC,QAA+B;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAA;IAC3E,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAA;QAChG,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACrB,CAAC;IAED,2EAA2E;IAC3E,cAAc;IACd,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,IAAI,OAAO,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;oBACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAA;gBAC5F,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK;YACrC,OAAO,EAAE,CAAC,iEAAiE,GAAG,GAAG,CAAC,EAAE,CAAA;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK;YACrC,OAAO,EAAE,CAAC,SAAS,KAAK,CAAC,MAAM,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAA;IAE/B,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA,CAAE,gBAAgB;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAA,CAAiB,2CAA2C;IAGxF,MAAM,KAAK,GAAY,EAAE,CAAA;IACzB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/E,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAClD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAElB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;QAClC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAE,CAAA;YAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,+DAA+D;gBAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK;oBACrC,OAAO,EAAE,CAAC,uBAAuB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;YAC5D,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;gBAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;gBAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1F,CAAC;YACD,iEAAiE;QACnE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YACnB,OAAO,CAAC,GAAG,EAAE,CAAA;YACb,KAAK,CAAC,GAAG,EAAE,CAAA;QACb,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;YAC1C,OAAO,EAAE,CAAC,yBAAyB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;IAClE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAC5D,CAAC"}

package/dist/mldsa.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @synoi/sraid — mldsa.ts
+ *
+ * ML-DSA-65 (FIPS 204) verification with a native fast path.
+ *
+ * When the runtime ships OpenSSL 3.5+ (Node 24+), node:crypto exposes a
+ * native `ml-dsa-65` key type whose verify is materially faster than the
+ * pure-JS @noble/post-quantum implementation: ~207µs vs ~1.6ms verify, a
+ * ~7.8x op-level speedup measured on Node 24.16.0 / OpenSSL 3.5.6
+ * (bench/mldsa-verify.mjs).
+ *
+ * This module feature-detects native ML-DSA-65 support ONCE at first use and
+ * routes verification accordingly:
+ *   • native available  → node:crypto (OpenSSL)
+ *   • native absent      → @noble/post-quantum fallback
+ *
+ * Both paths are byte-for-byte interoperable: a signature minted by either
+ * implementation verifies identically under the other, and tampered or
+ * wrong-key inputs fail under both (see test/mldsa-kat.test.ts cross-impl
+ * known-answer vectors). The native path is therefore a transparent
+ * performance swap, NOT a behavior change. Node < 24 keeps working unchanged.
+ *
+ * The public API takes a RAW ML-DSA-65 public key (1952 bytes) and a RAW
+ * signature (3309 bytes), matching the @noble surface. The native path wraps
+ * the raw key in the fixed SubjectPublicKeyInfo DER prefix to build a
+ * KeyObject; @noble consumes the raw bytes directly.
+ */
+/**
+ * True when this runtime verifies ML-DSA-65 via native node:crypto (OpenSSL
+ * 3.5+, Node 24+). False when it falls back to @noble/post-quantum. Exposed
+ * for benchmarks, diagnostics, and tests that must exercise both paths.
+ */
+export declare function isNativeMlDsaAvailable(): boolean;
+/**
+ * Verify a raw ML-DSA-65 signature over `message` against a raw 1952-byte
+ * public key. Uses the native node:crypto path when available, otherwise
+ * @noble/post-quantum. Returns false (never throws) on any malformed input or
+ * verification failure, so callers get a clean boolean.
+ */
+export declare function verifyMlDsa65(signature: Uint8Array, message: Uint8Array, publicKeyRaw: Uint8Array): boolean;
+//# sourceMappingURL=mldsa.d.ts.map

package/dist/mldsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mldsa.d.ts","sourceRoot":"","sources":["../src/mldsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAsDH;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAoBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,UAAU,GACvB,OAAO,CAaT"}

package/dist/mldsa.js

@@ -0,0 +1,119 @@
+/**
+ * @synoi/sraid — mldsa.ts
+ *
+ * ML-DSA-65 (FIPS 204) verification with a native fast path.
+ *
+ * When the runtime ships OpenSSL 3.5+ (Node 24+), node:crypto exposes a
+ * native `ml-dsa-65` key type whose verify is materially faster than the
+ * pure-JS @noble/post-quantum implementation: ~207µs vs ~1.6ms verify, a
+ * ~7.8x op-level speedup measured on Node 24.16.0 / OpenSSL 3.5.6
+ * (bench/mldsa-verify.mjs).
+ *
+ * This module feature-detects native ML-DSA-65 support ONCE at first use and
+ * routes verification accordingly:
+ *   • native available  → node:crypto (OpenSSL)
+ *   • native absent      → @noble/post-quantum fallback
+ *
+ * Both paths are byte-for-byte interoperable: a signature minted by either
+ * implementation verifies identically under the other, and tampered or
+ * wrong-key inputs fail under both (see test/mldsa-kat.test.ts cross-impl
+ * known-answer vectors). The native path is therefore a transparent
+ * performance swap, NOT a behavior change. Node < 24 keeps working unchanged.
+ *
+ * The public API takes a RAW ML-DSA-65 public key (1952 bytes) and a RAW
+ * signature (3309 bytes), matching the @noble surface. The native path wraps
+ * the raw key in the fixed SubjectPublicKeyInfo DER prefix to build a
+ * KeyObject; @noble consumes the raw bytes directly.
+ */
+import { createPublicKey, verify as nodeVerify } from 'node:crypto';
+import { webcrypto } from 'node:crypto';
+// Node 18 doesn't expose globalThis.crypto.getRandomValues by default, and the
+// @noble libraries expect it during module initialization. Idempotent polyfill
+// — MUST run BEFORE the @noble/post-quantum import below so ml_dsa65's
+// module-init sees a populated globalThis.crypto.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+if (!globalThis.crypto)
+    globalThis.crypto = webcrypto;
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+import { BoundedKeyCache, KEY_CACHE_MAX } from './internal/key-cache.js';
+// Fixed DER prefix for an ML-DSA-65 SubjectPublicKeyInfo
+// (draft-ietf-lamps-dilithium-certificates):
+//   SEQUENCE {
+//     SEQUENCE { OID 2.16.840.1.101.3.4.3.18  (id-ml-dsa-65) }
+//     BIT STRING (0 unused bits || 1952 raw public-key bytes)
+//   }
+// The only variable part is the 1952-byte key, so the 22-byte header is
+// constant for every ML-DSA-65 key.
+const MLDSA65_SPKI_PREFIX = Buffer.from('308207b2300b0609608648016503040312038207a100', 'hex');
+const MLDSA65_PUBKEY_LEN = 1952;
+// One-time capability detection. `undefined` = not yet probed.
+let nativeAvailable;
+/**
+ * Detect (once, then cache) whether this runtime's node:crypto can build a
+ * native ML-DSA-65 public key. We probe by constructing a KeyObject from a
+ * structurally-valid dummy SPKI: OpenSSL 3.5+ accepts it and reports
+ * asymmetricKeyType === 'ml-dsa-65'; older OpenSSL throws ("Failed to read
+ * asymmetric key"). The probe does NOT verify anything, so a dummy key body
+ * is fine — only the algorithm support is being detected.
+ */
+function detectNative() {
+    if (nativeAvailable !== undefined)
+        return nativeAvailable;
+    try {
+        const dummy = Buffer.concat([MLDSA65_SPKI_PREFIX, Buffer.alloc(MLDSA65_PUBKEY_LEN)]);
+        const ko = createPublicKey({ key: dummy, format: 'der', type: 'spki' });
+        // @types/node ^20 predates the ml-dsa-* key types, so widen to string.
+        nativeAvailable = ko.asymmetricKeyType === 'ml-dsa-65';
+    }
+    catch {
+        nativeAvailable = false;
+    }
+    return nativeAvailable;
+}
+/**
+ * True when this runtime verifies ML-DSA-65 via native node:crypto (OpenSSL
+ * 3.5+, Node 24+). False when it falls back to @noble/post-quantum. Exposed
+ * for benchmarks, diagnostics, and tests that must exercise both paths.
+ */
+export function isNativeMlDsaAvailable() {
+    return detectNative();
+}
+// Small bounded LRU: building a KeyObject parses DER, so cache by raw-key hex.
+// Bounded so an attacker streaming distinct keys cannot grow it without limit.
+const keyCache = new BoundedKeyCache(KEY_CACHE_MAX);
+function keyObjectFromRaw(raw) {
+    if (raw.length !== MLDSA65_PUBKEY_LEN) {
+        throw new Error(`ml-dsa-65 public key must be ${MLDSA65_PUBKEY_LEN} bytes`);
+    }
+    const hex = Buffer.from(raw).toString('hex');
+    let ko = keyCache.get(hex);
+    if (!ko) {
+        const der = Buffer.concat([MLDSA65_SPKI_PREFIX, Buffer.from(raw)]);
+        ko = createPublicKey({ key: der, format: 'der', type: 'spki' });
+        keyCache.set(hex, ko);
+    }
+    return ko;
+}
+/**
+ * Verify a raw ML-DSA-65 signature over `message` against a raw 1952-byte
+ * public key. Uses the native node:crypto path when available, otherwise
+ * @noble/post-quantum. Returns false (never throws) on any malformed input or
+ * verification failure, so callers get a clean boolean.
+ */
+export function verifyMlDsa65(signature, message, publicKeyRaw) {
+    if (detectNative()) {
+        try {
+            return nodeVerify(null, message, keyObjectFromRaw(publicKeyRaw), signature);
+        }
+        catch {
+            return false;
+        }
+    }
+    try {
+        return ml_dsa65.verify(signature, message, publicKeyRaw);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=mldsa.js.map

package/dist/mldsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mldsa.js","sourceRoot":"","sources":["../src/mldsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAkB,MAAM,aAAa,CAAA;AAEnF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,kDAAkD;AAClD,8DAA8D;AAC9D,IAAI,CAAE,UAAkB,CAAC,MAAM;IAAG,UAAkB,CAAC,MAAM,GAAG,SAAS,CAAA;AAEvE,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAExE,yDAAyD;AACzD,6CAA6C;AAC7C,eAAe;AACf,+DAA+D;AAC/D,8DAA8D;AAC9D,MAAM;AACN,wEAAwE;AACxE,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CACrC,8CAA8C,EAC9C,KAAK,CACN,CAAA;AACD,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B,+DAA+D;AAC/D,IAAI,eAAoC,CAAA;AAExC;;;;;;;GAOG;AACH,SAAS,YAAY;IACnB,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,eAAe,CAAA;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACvE,uEAAuE;QACvE,eAAe,GAAI,EAAE,CAAC,iBAA4B,KAAK,WAAW,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,eAAe,GAAG,KAAK,CAAA;IACzB,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,YAAY,EAAE,CAAA;AACvB,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAY,aAAa,CAAC,CAAA;AAE9D,SAAS,gBAAgB,CAAC,GAAe;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,kBAAkB,QAAQ,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAClE,EAAE,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC/D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAqB,EACrB,OAAmB,EACnB,YAAwB;IAExB,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/oid.d.ts

@@ -0,0 +1,109 @@
+/**
+ * @synoi/sraid — oid.ts
+ *
+ * OID (Object IDentifier) computation. An OID is a content-addressed
+ * identifier for a CDRO object:
+ *
+ *     OID = "sha256:" + hex(sha256(canonicalize(content)))
+ *
+ * The hash input is the canonical form of the OBJECT MINUS the six detached
+ * signature / envelope fields (see `CDRO_ENVELOPE_FIELDS`). Higher-layer code
+ * (e.g. GAP) typically passes the object's `body` directly; this function
+ * accepts any value and canonicalizes it without further interpretation, so
+ * callers stay in control of what enters the hash.
+ *
+ * This module is the SINGLE NORMATIVE SOURCE of the CDRO OID projection
+ * (ADR_019). The strip-set and number rule are specified in prose in
+ * PROJECTION_SPEC.md; all other surfaces derive from here.
+ *
+ * This matches the gateway's `computeGapOid` (src/gap/oid.ts) and
+ * `payloadOid` (src/inference/receipts.ts) byte-for-byte.
+ */
+/**
+ * Compute an OID over an arbitrary canonical-compatible value.
+ *
+ *   oidOf({ a: 1, b: 2 }) === oidOf({ b: 2, a: 1 })
+ *
+ * Returns `sha256:` followed by 64 lowercase hex characters.
+ *
+ * Uses the platform SHA-256 (node:crypto / OpenSSL), which is byte-identical
+ * to any conformant SHA-256 and materially faster than a pure-JS hash. The
+ * output contract is unchanged.
+ */
+export declare function oidOf(canonical: unknown): string;
+/**
+ * Compute an OID directly from already-canonicalized bytes. Useful when
+ * the caller has produced the canonical string itself (for example, when
+ * the same bytes will also feed into a signature) and wants to avoid
+ * canonicalizing twice.
+ */
+export declare function oidOfCanonical(canonical: string | Uint8Array): string;
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export declare const CDRO_ENVELOPE_FIELDS: readonly string[];
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export declare function cdroContentCore(cdro: unknown): Record<string, unknown>;
+/**
+ * Compute the OID of a full CDRO over its content core (see
+ * `cdroContentCore`). This is the correct way to derive identity for a
+ * complete CDRO: it hashes `authority`, `supersedes`, `gap_version`, `body`,
+ * and every other content field, so the L4 authority block is identity-bound
+ * and cannot be silently dropped.
+ *
+ * INVARIANT (ADR_019): `cdroOid(obj)` yields the SAME OID whether `obj` is
+ * pre- or post-attestation, because the detached envelope fields are stripped
+ * (see `CDRO_ENVELOPE_FIELDS`). This is what lets a third party recompute the
+ * OID of a signed receipt and match the value the signer stamped.
+ *
+ * Note this differs from `oidOf(cdro.body)`: a CDRO's identity is over the
+ * whole content core, not just its body.
+ */
+export declare function cdroOid(cdro: unknown): string;
+//# sourceMappingURL=oid.d.ts.map

package/dist/oid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oid.d.ts","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH;;;;;;;;;;GAUG;AACH,wBAAgB,KAAK,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAMrE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOhD,CAAA;AAIF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAE7C"}

package/dist/oid.js

@@ -0,0 +1,140 @@
+/**
+ * @synoi/sraid — oid.ts
+ *
+ * OID (Object IDentifier) computation. An OID is a content-addressed
+ * identifier for a CDRO object:
+ *
+ *     OID = "sha256:" + hex(sha256(canonicalize(content)))
+ *
+ * The hash input is the canonical form of the OBJECT MINUS the six detached
+ * signature / envelope fields (see `CDRO_ENVELOPE_FIELDS`). Higher-layer code
+ * (e.g. GAP) typically passes the object's `body` directly; this function
+ * accepts any value and canonicalizes it without further interpretation, so
+ * callers stay in control of what enters the hash.
+ *
+ * This module is the SINGLE NORMATIVE SOURCE of the CDRO OID projection
+ * (ADR_019). The strip-set and number rule are specified in prose in
+ * PROJECTION_SPEC.md; all other surfaces derive from here.
+ *
+ * This matches the gateway's `computeGapOid` (src/gap/oid.ts) and
+ * `payloadOid` (src/inference/receipts.ts) byte-for-byte.
+ */
+import { createHash } from 'node:crypto';
+import { canonicalize } from './canonicalize.js';
+/**
+ * Compute an OID over an arbitrary canonical-compatible value.
+ *
+ *   oidOf({ a: 1, b: 2 }) === oidOf({ b: 2, a: 1 })
+ *
+ * Returns `sha256:` followed by 64 lowercase hex characters.
+ *
+ * Uses the platform SHA-256 (node:crypto / OpenSSL), which is byte-identical
+ * to any conformant SHA-256 and materially faster than a pure-JS hash. The
+ * output contract is unchanged.
+ */
+export function oidOf(canonical) {
+    const bytes = new TextEncoder().encode(canonicalize(canonical));
+    return 'sha256:' + createHash('sha256').update(bytes).digest('hex');
+}
+/**
+ * Compute an OID directly from already-canonicalized bytes. Useful when
+ * the caller has produced the canonical string itself (for example, when
+ * the same bytes will also feed into a signature) and wants to avoid
+ * canonicalizing twice.
+ */
+export function oidOfCanonical(canonical) {
+    const bytes = typeof canonical === 'string'
+        ? new TextEncoder().encode(canonical)
+        : canonical;
+    return 'sha256:' + createHash('sha256').update(bytes).digest('hex');
+}
+/**
+ * The detached-signature / envelope fields removed by `cdroContentCore`
+ * before hashing. This is the SINGLE NORMATIVE strip-set for the CDRO OID
+ * projection (ADR_019 decision 1); every other surface (GAP SDKs, the
+ * gateway signer, IMPLEMENTING.md) derives from THIS set, never re-lists it.
+ *
+ * The set is defined SEMANTICALLY: it is "every field produced BY the signer
+ * after canonicalization, plus the OID output itself." Concretely:
+ *
+ *   oid                  — the projection OUTPUT (cannot be an input to itself).
+ *   signature            — legacy hybrid SignatureEnvelope (attaches after hash).
+ *   ml_dsa_signature     — detached PQ signature (attaches after hash).
+ *   signature_key_id     — signer-stamped key id (produced by the signer).
+ *   signature_algorithm  — signer-stamped alg id (produced by the signer).
+ *   attestation          — DSSE AttestationEnvelope (attaches after hash).
+ *
+ * EVERYTHING ELSE IS KEPT and hashed into the OID, including in particular:
+ *   - `gap_version` — IN identity so a protocol downgrade is OID-detectable.
+ *   - `supersedes`  — IN identity because the SRAID Merkle-DAG head-proves-
+ *                     history property requires every lineage edge inside the
+ *                     hash. Superseding mints a NEW object; it never mutates
+ *                     the old one's bytes, so keeping it here is safe and
+ *                     makes the lineage edge tamper-evident.
+ *   - `type`, `sraid_version`, `tenant_id`, `created_at_ms`, `created_by`,
+ *     `body`, `authority`, `sensitivity`, `prev`, `links`, and any other
+ *     content field.
+ *
+ * This is the ONE projection that yields the SAME OID whether the object is
+ * pre- or post-attestation: attaching an `attestation` (or `signature`,
+ * `ml_dsa_signature`, `signature_key_id`, `signature_algorithm`) after hashing
+ * is stripped back out here, so `cdroOid(obj)` is invariant across signing.
+ *
+ * It is FROZEN so no caller can mutate the normative set at runtime.
+ */
+export const CDRO_ENVELOPE_FIELDS = Object.freeze([
+    'oid',
+    'signature',
+    'ml_dsa_signature',
+    'signature_key_id',
+    'signature_algorithm',
+    'attestation',
+]);
+const CDRO_ENVELOPE_FIELD_SET = new Set(CDRO_ENVELOPE_FIELDS);
+/**
+ * Build the OID content core of a full CDRO: the object with EXACTLY the six
+ * detached-signature / envelope fields in `CDRO_ENVELOPE_FIELDS` removed at
+ * the top level, and everything else kept.
+ *
+ * This is the mechanism that makes the L4 `authority` block, the L3 lineage
+ * edges (`prev`, `links`, `supersedes`), the propagating `sensitivity` tier,
+ * and `gap_version` tamper-evident: they are hashed into identity by
+ * construction, so a field cannot be added, stripped, re-pointed, or
+ * downgraded without producing a different OID (and invalidating the
+ * signature, which is computed over these same bytes). Because `prev`/`links`/
+ * `supersedes` OIDs are inside the hash, a node's OID transitively commits its
+ * whole reachable history (the Merkle-DAG "head proves history" property).
+ *
+ * Returns a plain object suitable for `canonicalize` / `oidOf`.
+ */
+export function cdroContentCore(cdro) {
+    if (cdro === null || typeof cdro !== 'object' || Array.isArray(cdro)) {
+        throw new TypeError('cdroContentCore: argument must be a CDRO object');
+    }
+    const core = {};
+    for (const [k, v] of Object.entries(cdro)) {
+        if (CDRO_ENVELOPE_FIELD_SET.has(k))
+            continue;
+        core[k] = v;
+    }
+    return core;
+}
+/**
+ * Compute the OID of a full CDRO over its content core (see
+ * `cdroContentCore`). This is the correct way to derive identity for a
+ * complete CDRO: it hashes `authority`, `supersedes`, `gap_version`, `body`,
+ * and every other content field, so the L4 authority block is identity-bound
+ * and cannot be silently dropped.
+ *
+ * INVARIANT (ADR_019): `cdroOid(obj)` yields the SAME OID whether `obj` is
+ * pre- or post-attestation, because the detached envelope fields are stripped
+ * (see `CDRO_ENVELOPE_FIELDS`). This is what lets a third party recompute the
+ * OID of a signed receipt and match the value the signer stamped.
+ *
+ * Note this differs from `oidOf(cdro.body)`: a CDRO's identity is over the
+ * whole content core, not just its body.
+ */
+export function cdroOid(cdro) {
+    return oidOf(cdroContentCore(cdro));
+}
+//# sourceMappingURL=oid.js.map

package/dist/oid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,KAAK,CAAC,SAAkB;IACtC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/D,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAA8B;IAC3D,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;QACrC,CAAC,CAAC,SAAS,CAAA;IACf,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,KAAK;IACL,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAA;AAEF,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAA;AAElF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;QACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC5C,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,IAAa;IACnC,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;AACrC,CAAC"}

package/dist/sensitivity.d.ts

@@ -0,0 +1,104 @@
+/**
+ * @synoi/sraid — sensitivity.ts
+ *
+ * L4 GOVERNANCE — the propagating sensitivity label (OBJECT_MODEL_CLEANSHEET
+ * §3.4, SRAID_FOUNDATION_PUNCHLIST A5). A single coarse, OPAQUE tier on the
+ * CDRO that retrieval, summarization, and consolidation MUST carry forward
+ * monotonically: a derived object inherits the HIGHEST tier among its sources,
+ * so a summary of high-sensitivity inputs cannot be downgraded.
+ *
+ * ── Why the tiers are OPAQUE ORDINALS, not literal categories ───────────────
+ *
+ * SPEC §7 is normative and explicit: the envelope is a NON-encrypted, signed,
+ * publicly visible surface. A literal classification label (e.g. `"phi"`,
+ * `"health"`, `"financial"`) on that surface would LEAK the nature of the
+ * encrypted `body` — an observer who cannot read the ciphertext could still
+ * read "this is health data" off the envelope. SPEC §7 therefore requires a
+ * "coarse, OPAQUE sensitivity classifier", and the §9 reserved note says the
+ * same.
+ *
+ * So the tier set here is a small, COARSE, ORDERED ladder of opaque levels
+ * (`s0` < `s1` < `s2` < `s3` < `s4`). It carries an ORDERING (needed for the
+ * monotone `max()` lattice — standard lattice-based information-flow labeling,
+ * Denning 1976) but NO semantic category. The mapping from a regulatory
+ * category (PHI, PII, secret, …) to a tier is a higher-layer POLICY concern
+ * kept OFF the public envelope: an operator's policy decides "PHI → s3"
+ * privately; the wire only ever shows `s3`. This is the "coarse, opaque tier
+ * (or opaque policy-scope handle)" required by the task and SPEC §7.
+ *
+ * The field is hashed into the OID (it is a content-core field; see
+ * `cdroContentCore` in oid.ts), so it cannot be silently stripped or
+ * downgraded without changing the OID and breaking the signature.
+ *
+ * NOTE on maturity (CLAIMS_DISCIPLINE): this module ships the FIELD, the
+ * lattice, the monotone `max()` carry-forward, and the validator, with
+ * vectors. The commitment-based selective-disclosure scheme that would
+ * CONCEAL the tier itself (SPEC §7 / §9) is reserved and NOT built here.
+ */
+/**
+ * The coarse, opaque sensitivity tiers, lowest to highest. These are ORDINAL
+ * and OPAQUE by design — they convey relative sensitivity for the monotone
+ * propagation lattice WITHOUT naming a content category (per SPEC §7, a
+ * literal category on the public envelope would leak what the encrypted body
+ * is). The mapping of a real-world classification to a tier is private policy,
+ * not part of this taxonomy.
+ *
+ *   s0 — lowest / unclassified (the default floor; freely shareable)
+ *   s1 — low
+ *   s2 — moderate
+ *   s3 — high
+ *   s4 — highest / most restricted
+ *
+ * Five coarse levels is deliberate: enough granularity for a useful lattice,
+ * few enough to stay coarse (so the tier alone is weakly distinguishing).
+ */
+export type SensitivityTier = 's0' | 's1' | 's2' | 's3' | 's4';
+/**
+ * The ordered tier ladder, lowest-first. The index IS the rank used by the
+ * `max()` lattice. Frozen so the ordering is immutable at runtime.
+ */
+export declare const SENSITIVITY_TIERS: readonly SensitivityTier[];
+/** The default tier for an object that declares none — the lattice floor. */
+export declare const SENSITIVITY_DEFAULT: SensitivityTier;
+/** True iff `x` is a defined `SensitivityTier`. */
+export declare function isSensitivityTier(x: unknown): x is SensitivityTier;
+/**
+ * The ordinal rank of a tier (0 = lowest). Throws on an unknown tier so a
+ * typo can never silently rank as the floor (which would be a downgrade
+ * footgun in the lattice).
+ */
+export declare function sensitivityRank(tier: SensitivityTier): number;
+/**
+ * The monotone lattice join: the HIGHER (more restricted) of two tiers.
+ * `max('s1','s3') === 's3'`. This is the per-pair operation behind
+ * carry-forward.
+ */
+export declare function sensitivityMax(a: SensitivityTier, b: SensitivityTier): SensitivityTier;
+/**
+ * Carry-forward over a set of source tiers: the highest tier present.
+ *
+ * This is the rule that makes sensitivity MONOTONE under derivation
+ * (retrieval / summarization / consolidation): a derived object's tier =
+ * max(tiers of all its `consolidated_from` / `derived_from` sources). It can
+ * only ever go UP, never down — a summary of high-sensitivity inputs stays at
+ * the highest input tier.
+ *
+ * `undefined`/absent source tiers are treated as the floor (`s0`): a source
+ * that declared no tier cannot pull the result down, and an explicit higher
+ * source always wins. An empty input set returns the floor.
+ */
+export declare function sensitivityCarryForward(sources: ReadonlyArray<SensitivityTier | undefined | null>): SensitivityTier;
+/**
+ * Guard a proposed sensitivity assignment against monotone violation: the
+ * `proposed` tier of a derived object MUST be at least as high as the
+ * carry-forward of its `sources`. Returns the floor the derived object is NOT
+ * allowed to fall below, plus whether `proposed` honors it.
+ *
+ * Use this to REJECT an attempt to label a summary of `s3` inputs as `s1`.
+ */
+export declare function sensitivityMonotoneCheck(proposed: SensitivityTier, sources: ReadonlyArray<SensitivityTier | undefined | null>): {
+    ok: boolean;
+    floor: SensitivityTier;
+    proposed: SensitivityTier;
+};
+//# sourceMappingURL=sensitivity.d.ts.map