@synoi/sraid 0.2.0

package/dist/sensitivity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitivity.d.ts","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAM7C,CAAA;AAEX,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,EAAE,eAAsB,CAAA;AAMxD,mDAAmD;AACnD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,eAAe,CAElE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAM7D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE,eAAe,EAClB,CAAC,EAAE,eAAe,GACjB,eAAe,CAEjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,aAAa,CAAC,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC,GACzD,eAAe,CAYjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,aAAa,CAAC,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC,GACzD;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,CAOpE"}

package/dist/sensitivity.js

@@ -0,0 +1,117 @@
+/**
+ * @synoi/sraid — sensitivity.ts
+ *
+ * L4 GOVERNANCE — the propagating sensitivity label (OBJECT_MODEL_CLEANSHEET
+ * §3.4, SRAID_FOUNDATION_PUNCHLIST A5). A single coarse, OPAQUE tier on the
+ * CDRO that retrieval, summarization, and consolidation MUST carry forward
+ * monotonically: a derived object inherits the HIGHEST tier among its sources,
+ * so a summary of high-sensitivity inputs cannot be downgraded.
+ *
+ * ── Why the tiers are OPAQUE ORDINALS, not literal categories ───────────────
+ *
+ * SPEC §7 is normative and explicit: the envelope is a NON-encrypted, signed,
+ * publicly visible surface. A literal classification label (e.g. `"phi"`,
+ * `"health"`, `"financial"`) on that surface would LEAK the nature of the
+ * encrypted `body` — an observer who cannot read the ciphertext could still
+ * read "this is health data" off the envelope. SPEC §7 therefore requires a
+ * "coarse, OPAQUE sensitivity classifier", and the §9 reserved note says the
+ * same.
+ *
+ * So the tier set here is a small, COARSE, ORDERED ladder of opaque levels
+ * (`s0` < `s1` < `s2` < `s3` < `s4`). It carries an ORDERING (needed for the
+ * monotone `max()` lattice — standard lattice-based information-flow labeling,
+ * Denning 1976) but NO semantic category. The mapping from a regulatory
+ * category (PHI, PII, secret, …) to a tier is a higher-layer POLICY concern
+ * kept OFF the public envelope: an operator's policy decides "PHI → s3"
+ * privately; the wire only ever shows `s3`. This is the "coarse, opaque tier
+ * (or opaque policy-scope handle)" required by the task and SPEC §7.
+ *
+ * The field is hashed into the OID (it is a content-core field; see
+ * `cdroContentCore` in oid.ts), so it cannot be silently stripped or
+ * downgraded without changing the OID and breaking the signature.
+ *
+ * NOTE on maturity (CLAIMS_DISCIPLINE): this module ships the FIELD, the
+ * lattice, the monotone `max()` carry-forward, and the validator, with
+ * vectors. The commitment-based selective-disclosure scheme that would
+ * CONCEAL the tier itself (SPEC §7 / §9) is reserved and NOT built here.
+ */
+/**
+ * The ordered tier ladder, lowest-first. The index IS the rank used by the
+ * `max()` lattice. Frozen so the ordering is immutable at runtime.
+ */
+export const SENSITIVITY_TIERS = Object.freeze([
+    's0',
+    's1',
+    's2',
+    's3',
+    's4',
+]);
+/** The default tier for an object that declares none — the lattice floor. */
+export const SENSITIVITY_DEFAULT = 's0';
+const RANK = new Map(SENSITIVITY_TIERS.map((t, i) => [t, i]));
+/** True iff `x` is a defined `SensitivityTier`. */
+export function isSensitivityTier(x) {
+    return typeof x === 'string' && RANK.has(x);
+}
+/**
+ * The ordinal rank of a tier (0 = lowest). Throws on an unknown tier so a
+ * typo can never silently rank as the floor (which would be a downgrade
+ * footgun in the lattice).
+ */
+export function sensitivityRank(tier) {
+    const r = RANK.get(tier);
+    if (r === undefined) {
+        throw new RangeError(`sensitivityRank: "${String(tier)}" is not a known tier`);
+    }
+    return r;
+}
+/**
+ * The monotone lattice join: the HIGHER (more restricted) of two tiers.
+ * `max('s1','s3') === 's3'`. This is the per-pair operation behind
+ * carry-forward.
+ */
+export function sensitivityMax(a, b) {
+    return sensitivityRank(a) >= sensitivityRank(b) ? a : b;
+}
+/**
+ * Carry-forward over a set of source tiers: the highest tier present.
+ *
+ * This is the rule that makes sensitivity MONOTONE under derivation
+ * (retrieval / summarization / consolidation): a derived object's tier =
+ * max(tiers of all its `consolidated_from` / `derived_from` sources). It can
+ * only ever go UP, never down — a summary of high-sensitivity inputs stays at
+ * the highest input tier.
+ *
+ * `undefined`/absent source tiers are treated as the floor (`s0`): a source
+ * that declared no tier cannot pull the result down, and an explicit higher
+ * source always wins. An empty input set returns the floor.
+ */
+export function sensitivityCarryForward(sources) {
+    let acc = SENSITIVITY_DEFAULT;
+    for (const s of sources) {
+        if (s === undefined || s === null)
+            continue;
+        if (!isSensitivityTier(s)) {
+            throw new RangeError(`sensitivityCarryForward: "${String(s)}" is not a known tier`);
+        }
+        acc = sensitivityMax(acc, s);
+    }
+    return acc;
+}
+/**
+ * Guard a proposed sensitivity assignment against monotone violation: the
+ * `proposed` tier of a derived object MUST be at least as high as the
+ * carry-forward of its `sources`. Returns the floor the derived object is NOT
+ * allowed to fall below, plus whether `proposed` honors it.
+ *
+ * Use this to REJECT an attempt to label a summary of `s3` inputs as `s1`.
+ */
+export function sensitivityMonotoneCheck(proposed, sources) {
+    const floor = sensitivityCarryForward(sources);
+    return {
+        ok: sensitivityRank(proposed) >= sensitivityRank(floor),
+        floor,
+        proposed,
+    };
+}
+//# sourceMappingURL=sensitivity.js.map

package/dist/sensitivity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitivity.js","sourceRoot":"","sources":["../src/sensitivity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAqBH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA+B,MAAM,CAAC,MAAM,CAAC;IACzE,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACI,CAAC,CAAA;AAEX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAoB,IAAI,CAAA;AAExD,MAAM,IAAI,GAAgC,IAAI,GAAG,CAC/C,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACxC,CAAA;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACxB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,UAAU,CAAC,qBAAqB,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,CAAkB,EAClB,CAAkB;IAElB,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0D;IAE1D,IAAI,GAAG,GAAoB,mBAAmB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,SAAQ;QAC3C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAClB,6BAA6B,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAC9D,CAAA;QACH,CAAC;QACD,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAyB,EACzB,OAA0D;IAE1D,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IAC9C,OAAO;QACL,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC;QACvD,KAAK;QACL,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/signature.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @synoi/sraid — signature.ts
+ *
+ * Hybrid ed25519 + ml-dsa-65 signature verification for CDRO envelopes.
+ *
+ * SynOI signs every Decision Receipt and every governance object with
+ * BOTH a classical Ed25519 signature and a post-quantum ML-DSA-65
+ * signature. The verifier in this package requires BOTH to be valid
+ * before returning `valid: true` — even though either alone is
+ * cryptographically meaningful, signed objects exit the system only when
+ * both check out.
+ *
+ * The signature bytes are computed over the canonical form of the object
+ * minus the `signature` field itself. Callers are expected to produce
+ * that canonical form (typically via `canonicalize()` in this package)
+ * and pass it as `canonical` here — verifiers MUST use the same exact
+ * bytes that the signer used, so callers control that contract.
+ */
+import type { SignatureEnvelope } from './types.js';
+export interface VerifySignatureInput {
+    /** The canonical bytes that were signed (string is utf-8 encoded). */
+    canonical: string | Uint8Array;
+    /** Signature envelope to verify. */
+    envelope: SignatureEnvelope;
+    /** Raw 32-byte Ed25519 public key. */
+    ed25519_pub: Uint8Array;
+    /** Raw ML-DSA-65 public key bytes. */
+    ml_dsa_pub: Uint8Array;
+}
+export interface VerifySignatureResult {
+    /** True only when BOTH signatures verified successfully. */
+    valid: boolean;
+    /**
+     * Human-readable reasons for failure. Empty when valid. Possible
+     * values: 'ed25519-invalid', 'ml-dsa-invalid', 'ed25519-malformed',
+     * 'ml-dsa-malformed', 'envelope-malformed'.
+     */
+    reasons: string[];
+}
+/**
+ * Verify a hybrid CDRO signature envelope. Returns `valid: true` only
+ * when both the Ed25519 and the ML-DSA-65 signatures verify against the
+ * supplied public keys and canonical bytes.
+ */
+export declare function verifySignature(input: VerifySignatureInput): VerifySignatureResult;
+//# sourceMappingURL=signature.d.ts.map

package/dist/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnD,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,SAAS,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,oCAAoC;IACpC,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,sCAAsC;IACtC,WAAW,EAAE,UAAU,CAAA;IACvB,sCAAsC;IACtC,UAAU,EAAE,UAAU,CAAA;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAA;IACd;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CAyDlF"}

package/dist/signature.js

@@ -0,0 +1,89 @@
+/**
+ * @synoi/sraid — signature.ts
+ *
+ * Hybrid ed25519 + ml-dsa-65 signature verification for CDRO envelopes.
+ *
+ * SynOI signs every Decision Receipt and every governance object with
+ * BOTH a classical Ed25519 signature and a post-quantum ML-DSA-65
+ * signature. The verifier in this package requires BOTH to be valid
+ * before returning `valid: true` — even though either alone is
+ * cryptographically meaningful, signed objects exit the system only when
+ * both check out.
+ *
+ * The signature bytes are computed over the canonical form of the object
+ * minus the `signature` field itself. Callers are expected to produce
+ * that canonical form (typically via `canonicalize()` in this package)
+ * and pass it as `canonical` here — verifiers MUST use the same exact
+ * bytes that the signer used, so callers control that contract.
+ */
+import { verifyEd25519 } from './ed25519.js';
+import { decodeBase64Strict } from './internal/base64.js';
+import { verifyMlDsa65 } from './mldsa.js';
+/**
+ * Verify a hybrid CDRO signature envelope. Returns `valid: true` only
+ * when both the Ed25519 and the ML-DSA-65 signatures verify against the
+ * supplied public keys and canonical bytes.
+ */
+export function verifySignature(input) {
+    const reasons = [];
+    if (!input.envelope ||
+        typeof input.envelope.ed25519 !== 'string' ||
+        typeof input.envelope.ml_dsa_65 !== 'string' ||
+        typeof input.envelope.signer_kid !== 'string') {
+        return { valid: false, reasons: ['envelope-malformed'] };
+    }
+    const message = typeof input.canonical === 'string'
+        ? new TextEncoder().encode(input.canonical)
+        : input.canonical;
+    // Decode the two signatures from base64. If either fails to decode,
+    // the envelope is malformed — but we still want to verify the OTHER
+    // signature so we can report both reasons in one pass.
+    let edSig = null;
+    let mlSig = null;
+    try {
+        edSig = fromBase64(input.envelope.ed25519);
+    }
+    catch {
+        reasons.push('ed25519-malformed');
+    }
+    try {
+        mlSig = fromBase64(input.envelope.ml_dsa_65);
+    }
+    catch {
+        reasons.push('ml-dsa-malformed');
+    }
+    let edOk = false;
+    let mlOk = false;
+    if (edSig) {
+        try {
+            edOk = verifyEd25519(edSig, message, input.ed25519_pub);
+        }
+        catch {
+            // Treat invalid signature shape as a verification failure rather
+            // than a thrown exception, so callers can rely on a clean result.
+            edOk = false;
+        }
+        if (!edOk)
+            reasons.push('ed25519-invalid');
+    }
+    if (mlSig) {
+        try {
+            mlOk = verifyMlDsa65(mlSig, message, input.ml_dsa_pub);
+        }
+        catch {
+            mlOk = false;
+        }
+        if (!mlOk)
+            reasons.push('ml-dsa-invalid');
+    }
+    return { valid: edOk && mlOk, reasons };
+}
+// ── Base64 helpers (standard, with `=` padding) ──────────────────────────────
+// Strict standard base64. Throws Error('base64-malformed') on any deviation
+// rather than silently truncating at the first illegal byte. Both call sites
+// wrap this in try/catch and map the throw to a *-malformed reason, so
+// verifySignature never throws.
+function fromBase64(s) {
+    return decodeBase64Strict(s);
+}
+//# sourceMappingURL=signature.js.map

package/dist/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAyB1C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,IACE,CAAC,KAAK,CAAC,QAAQ;QACf,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;QAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ;QAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAC7C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAA;IAErB,oEAAoE;IACpE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,KAAK,GAAsB,IAAI,CAAA;IACnC,IAAI,KAAK,GAAsB,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,IAAI,GAAG,KAAK,CAAA;IAChB,IAAI,IAAI,GAAG,KAAK,CAAA;IAEhB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,IAAI,GAAG,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC5C,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC3C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,CAAA;AACzC,CAAC;AAED,gFAAgF;AAEhF,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,gCAAgC;AAChC,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAA;AAC9B,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,313 @@
+/**
+ * @synoi/sraid — types.ts
+ *
+ * Type definitions for the SRAID (Self-Routing Addressable Identity Data) protocol — L0 of the
+ * SRAID Stack. Mirrors the shapes used by synoi-gateway and @synoi/vault so
+ * external implementations can interoperate without depending on the
+ * internal packages.
+ *
+ * CDRO objects are content-addressed: the OID is derived from the canonical
+ * form of the object (minus signature fields), so any byte-level change to
+ * the canonical content yields a different OID. Signatures are computed
+ * over the canonical bytes and attached after — they are NOT in the hash
+ * input, so signature rotation does not change the OID.
+ */
+/**
+ * The six GAP decision verbs. Authority records carry the full verb set;
+ * they are NOT folded to allow/deny/defer before persistence (SRAID
+ * Foundation Punch List item A4). When an authority block describes a
+ * decision (e.g. a Decision Receipt), `decision` is one of these.
+ *
+ *   allow    — the action was permitted outright
+ *   deny     — the action was refused
+ *   defer    — the decision was postponed (queued / pending)
+ *   step_up  — additional authentication / HITL was required
+ *   delegate — authority was passed to another actor
+ *   revoke   — a prior grant/decision was withdrawn
+ *
+ * The clean-sheet model (OBJECT_MODEL_CLEANSHEET §3.5) shows the core four
+ * (allow|deny|defer|step_up); delegate/revoke complete the AARM verb set
+ * so the enum does not have to widen later.
+ */
+export type AuthorityDecision = 'allow' | 'deny' | 'defer' | 'step_up' | 'delegate' | 'revoke';
+/**
+ * L4 GOVERNANCE — the authority block (the "authorized axis").
+ *
+ * This is the structural realization of the authorized axis
+ * (OBJECT_MODEL_CLEANSHEET §3.5, SRAID_FOUNDATION_PUNCHLIST A1): a state
+ * change or event is *normal* iff a governing authority record explains
+ * it. Every CDRO MAY carry an `authority` block referencing the GAP grant,
+ * the decision verb, and the session intent anchor that authorized it.
+ *
+ * IMPORTANT — identity-bound. The authority block lives physically INSIDE
+ * the hashed content core (it is one of the L4 fields hashed into the OID),
+ * so it cannot be silently stripped or swapped without changing the OID and
+ * therefore breaking the signature. Use `cdroOid` / `cdroContentCore` in
+ * `oid.ts` to compute identity over the content core (which includes
+ * `authority`), never `oidOf(body)` alone for a full CDRO.
+ *
+ * `decision` is `null`-able by design: a `state:change_event` carries
+ * `authority` with a null/absent decision until a correlation pass binds it
+ * to an authorizing receipt — a null authorized axis IS the orphan test
+ * (OBJECT_MODEL_CLEANSHEET R2.4). An absent `authority` field means the
+ * object asserts no authority; a present block with `grant_oid` asserts one.
+ */
+export interface AuthorityBlock {
+    /**
+     * OID of the GAP capability grant (or decision/intent record) that
+     * permitted this object to exist. `sha256:<hex>` form. Optional only for
+     * an as-yet-uncorrelated state-change event; for any object that claims
+     * to be authorized, this MUST be present.
+     */
+    grant_oid?: string;
+    /**
+     * The decision verb, when this object IS (or records) a decision. One of
+     * the six GAP verbs. May be null/absent for objects that merely reference
+     * an authorizing grant without themselves being a decision, or for an
+     * uncorrelated state-change event.
+     */
+    decision?: AuthorityDecision | null;
+    /**
+     * OID of the session / task intent anchor under which the authority was
+     * exercised. `sha256:<hex>` form. Optional.
+     */
+    intent_oid?: string;
+}
+/**
+ * Typed lineage edge relations (OBJECT_MODEL_CLEANSHEET §3.3,
+ * SRAID_FOUNDATION_PUNCHLIST A2). A `links[]` edge names *why* one object
+ * points at another. The taxonomy is the union the four products need; it
+ * is OPEN (a verifier ignores rels it does not understand) but these are the
+ * named, reserved relations.
+ *
+ *   supersedes        — this object replaces the target (the unified, witnessed
+ *                       form of the legacy self-asserted `supersedes` string and
+ *                       the standalone SRO). Combined with `prev`, gives a
+ *                       verifier a latest-wins / monotone rule instead of an
+ *                       unwitnessed pointer (fixes SRAID F10 / Adversary A3).
+ *   derived_from      — this object was derived/transformed from the target.
+ *   snapshot_of       — this object is a checkpoint snapshot of the target chain.
+ *   consolidated_from — Saga: a consolidated memory record built from raw chunks.
+ *   predecessor       — generic prior-version edge (when not a full supersession).
+ *   encounter_of      — Vitni: an encounter/disclosure references a prior one.
+ *   subject_digest    — Hlif: the content digest of the attested artifact.
+ *   invocation_of     — Althing: the GAP capability invocation this records.
+ *   hitl_evidence     — Althing: a HITL channel event backing a decision.
+ *   entity_of         — state-drift: the entity state-spine head this observes.
+ *   prev_observation  — state-drift: the prior observation of the same entity.
+ *
+ * Unknown rels are permitted (forward-compatible); validation only checks
+ * that each edge is well-formed (a non-empty `rel` + a `sha256:` `oid`).
+ */
+export type LinkRel = 'supersedes' | 'derived_from' | 'snapshot_of' | 'consolidated_from' | 'predecessor' | 'encounter_of' | 'subject_digest' | 'invocation_of' | 'hitl_evidence' | 'entity_of' | 'prev_observation' | (string & {});
+/**
+ * L3 LINEAGE — one typed Merkle-DAG edge.
+ *
+ * Both `prev` and every `links[]` edge are HASHED INTO THE OID (they live in
+ * the content core, see `cdroContentCore` in oid.ts), so lineage is
+ * identity-bound and tamper-evident: a node's OID transitively commits its
+ * entire reachable history (the Git/IPFS "head hash proves all history"
+ * property, OBJECT_MODEL_CLEANSHEET §3.3). An edge cannot be added, removed,
+ * or re-pointed without changing the OID and invalidating the signature.
+ */
+export interface LineageLink {
+    /** Why this edge exists. One of the reserved `LinkRel`s, or any string. */
+    rel: LinkRel;
+    /** OID of the target object. `sha256:<hex>` form. */
+    oid: string;
+}
+export type { SensitivityTier } from './sensitivity.js';
+import type { SensitivityTier } from './sensitivity.js';
+/**
+ * Hybrid signature envelope — LEGACY. Carries an Ed25519 signature
+ * (classical) and an ML-DSA-65 signature (post-quantum), both computed over
+ * the bare canonical bytes with NO payload-type binding. `verifySignature`
+ * in this package requires BOTH to be valid before returning `valid: true`.
+ *
+ * DEPRECATED in favour of the DSSE `AttestationEnvelope` (the L2 attestation
+ * layer). The bare-bytes form has no `payloadType` binding, which allows a
+ * signature minted for one object type to be replayed against a different
+ * type whose canonical bytes match (SRAID F7 / Adversary A4). New objects
+ * SHOULD carry an `attestation` (DSSE) envelope; `SignatureEnvelope` is
+ * retained only so existing callers and stored objects keep verifying during
+ * the migration.
+ *
+ * Encoded as base64 (standard, with `=` padding). `signer_kid` is a
+ * stable string that identifies which keypair produced the signatures.
+ */
+export interface SignatureEnvelope {
+    /** Base64-encoded 64-byte Ed25519 signature. */
+    ed25519: string;
+    /** Base64-encoded ML-DSA-65 signature. */
+    ml_dsa_65: string;
+    /** Key ID — opaque string identifying which keypair signed. */
+    signer_kid: string;
+}
+/**
+ * One signature entry inside a DSSE `AttestationEnvelope`. The signature is
+ * computed over the envelope's PAE (Pre-Authentication Encoding) — see
+ * `pae()` / `verifyAttestation()` in attestation.ts — so the `payloadType`
+ * is structurally bound into what each signature covers.
+ */
+export interface AttestationSignature {
+    /**
+     * Algorithm identifier. SynOI requires both `'ed25519'` and `'ml-dsa-65'`
+     * to be present (the hybrid AND policy). Other algs are ignored by the
+     * SynOI verifier but permitted in the array (DSSE is forward-compatible).
+     */
+    alg: 'ed25519' | 'ml-dsa-65' | (string & {});
+    /** Base64-encoded signature bytes over the PAE. */
+    sig: string;
+    /** Optional key ID — opaque string identifying which keypair signed. */
+    keyid?: string;
+}
+/**
+ * L2 ATTESTATION — a DSSE (Dead Simple Signing Envelope), JSON profile.
+ *
+ * Replaces the legacy `SignatureEnvelope`. Each signature in `signatures[]`
+ * covers `PAE(payloadType, payload)` rather than the bare payload bytes, so
+ * the payload TYPE is bound into the signed bytes — closing the cross-type
+ * confusion gap (SRAID F7 / Adversary A4). The hybrid both-required rule is
+ * preserved: a conformant SRAID attestation MUST carry both an `ed25519` and
+ * an `ml-dsa-65` entry over the same PAE, and `verifyAttestation` requires
+ * both to verify.
+ *
+ * `payload` is the canonical UTF-8 string of the content core (the same
+ * bytes `canonicalize()` produces and `oidOf` hashes). Because the envelope
+ * is detached (it is the CDRO's `attestation` field, excluded from the OID
+ * hash), adding/rotating a signature never changes the OID.
+ *
+ * A future CBOR profile would use COSE (RFC 9052); it is reserved, not
+ * implemented in this package.
+ */
+export interface AttestationEnvelope {
+    /**
+     * The payload media type, bound into the PAE. SynOI objects use
+     * `application/vnd.synoi.sraid+json`; Hlif supply-chain attestations use
+     * `application/vnd.in-toto+json` for in-toto/SLSA/Sigstore interop.
+     */
+    payloadType: string;
+    /** Canonical UTF-8 payload string (the signed content core). */
+    payload: string;
+    /** Detached signatures, each over `PAE(payloadType, payload)`. */
+    signatures: AttestationSignature[];
+}
+/**
+ * CDRO — Canonical Data Record Object.
+ *
+ * The base shape every signed CDRO object takes. The `oid` field is
+ * `sha256:` + hex(sha256(canonicalize(body))) where the body is the CDRO
+ * minus the `oid` and `signature` fields.
+ *
+ * Mirrors `GapCdroEnvelope` in synoi-gateway so a GAP object IS a CDRO.
+ * Higher-layer packages narrow `body` with their own type.
+ */
+export interface CDRO<TBody = unknown> {
+    /** "sha256:" + hex(sha256(canonicalize(cdro_minus_oid_and_signature))). */
+    oid: string;
+    /** Object type discriminator (e.g. "gap:capability_grant"). */
+    type: string;
+    /** SRAID protocol version. v2 is the only defined version today. */
+    sraid_version: '2.0';
+    /** Tenant that owns this object. */
+    tenant_id: string;
+    /** Unix ms timestamp of creation. */
+    created_at_ms: number;
+    /** OID of the actor (skill, user, device, …) that created the object. */
+    created_by: string;
+    /** Body — type-specific payload. Higher layers narrow this. */
+    body: TBody;
+    /**
+     * Optional L4 authority block — the authorized axis (§3.5). When present
+     * it is HASHED INTO THE OID (it is part of the content core), so it cannot
+     * be stripped without changing identity. See `AuthorityBlock` and the
+     * `cdroOid` helper in oid.ts.
+     */
+    authority?: AuthorityBlock;
+    /**
+     * Optional L4 propagating sensitivity tier — a COARSE, OPAQUE level
+     * (`s0`..`s4`, lowest-to-highest), NOT a literal content category (§3.4,
+     * SRAID_FOUNDATION_PUNCHLIST A5). It is OPAQUE on purpose: SPEC §7 forbids
+     * leaking the nature of an encrypted `body` via the public, signed
+     * envelope, so a literal label like `"phi"`/`"health"` is NOT allowed here;
+     * the regulatory-category → tier mapping is private higher-layer policy.
+     *
+     * HASHED INTO THE OID (it is a content-core field, see `cdroContentCore` in
+     * oid.ts), so the tier cannot be silently stripped or downgraded without
+     * changing identity and invalidating the signature. Carry-forward is
+     * monotone (`max`): a consolidated/summarized object inherits the HIGHEST
+     * tier among its sources — see `sensitivityCarryForward` in sensitivity.ts
+     * and the Vault consolidation path. Absent means "unclassified" (the floor,
+     * `s0`); it does not assert low sensitivity, only that none was declared.
+     */
+    sensitivity?: SensitivityTier;
+    /**
+     * Optional L3 lineage — the Merkle edge to the immediately superseded
+     * version (null/absent at a root object). HASHED INTO THE OID (it is part
+     * of the content core), so the predecessor link is identity-bound: a node's
+     * OID transitively commits its predecessor's OID and therefore its whole
+     * reachable history. This is the unified, witnessed replacement for the
+     * legacy self-asserted `supersedes` string — see `lineageLinks` /
+     * `latestWins` in lineage.ts for the latest-wins / monotone rule.
+     */
+    prev?: string;
+    /**
+     * Optional L3 lineage — typed Merkle-DAG edges (§3.3). HASHED INTO THE OID
+     * (content core), so every edge is identity-bound and tamper-evident. The
+     * standalone SRO and the self-asserted `supersedes` pointer both become
+     * expressible here as `{ rel: 'supersedes', oid }` edges, unifying the
+     * three legacy supersession mechanisms onto one model.
+     */
+    links?: LineageLink[];
+    /**
+     * Legacy supersession pointer — OID of the previous version. RETAINED for
+     * back-compat. It is now routed through the unified lineage model: treat it
+     * as equivalent to `prev` (and to a `{ rel: 'supersedes' }` link). New
+     * objects SHOULD set `prev`/`links` instead; `lineageLinks` in lineage.ts
+     * coalesces all three so a verifier sees one set of typed edges. Still
+     * hashed into the OID (it is a content-core field).
+     */
+    supersedes?: string;
+    /**
+     * Optional L2 attestation — the DSSE envelope (the preferred signing path).
+     * Carries `payloadType` + `signatures[]`, each over `PAE(payloadType,
+     * payload)`. Detached: NOT part of the OID hash (see `cdroContentCore` in
+     * oid.ts), so adding/rotating a signature never changes identity.
+     */
+    attestation?: AttestationEnvelope;
+    /**
+     * Optional LEGACY signature envelope (bare-bytes, no payload-type binding).
+     * Retained for back-compat with objects/callers minted before the DSSE
+     * `attestation` envelope. New objects SHOULD use `attestation`. May be
+     * absent on draft / unsigned objects.
+     */
+    signature?: SignatureEnvelope;
+}
+/**
+ * SRO — Mutation / Supersession Record.
+ *
+ * Links a successor CDRO to its predecessor and the actor that authorized
+ * the supersession. SROs are themselves CDRO objects (so they're CDROs with
+ * an `oid` and `signature`), but they have a specific body shape.
+ *
+ * Where CDROs are the "what" of the system, SROs are the "what changed."
+ * They form an append-only chain: every supersedes pointer in a CDRO is
+ * accompanied by an SRO that explains and witnesses the change.
+ */
+export interface SROBody {
+    /** OID of the predecessor object being superseded. */
+    predecessor_oid: string;
+    /** OID of the successor object that supersedes it. */
+    successor_oid: string;
+    /** Why the predecessor was superseded. Free-form short string. */
+    reason: string;
+    /** OID of the actor that authorized this mutation. */
+    authorized_by: string;
+    /** Optional list of supporting evidence OIDs (audit trail). */
+    evidence_oids?: string[];
+}
+/** SRO is just a CDRO with a fixed body type. */
+export type SRO = CDRO<SROBody> & {
+    type: 'sraid:sro';
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GACzB,OAAO,GACP,MAAM,GACN,OAAO,GACP,SAAS,GACT,UAAU,GACV,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACnC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAID;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,OAAO,GACf,YAAY,GACZ,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,WAAW,GACX,kBAAkB,GAClB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,GAAG,EAAE,OAAO,CAAA;IACZ,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAIvD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAA;IACjB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;CACnB;AAID;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,GAAG,EAAE,SAAS,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAC5C,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,UAAU,EAAE,oBAAoB,EAAE,CAAA;CACnC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,IAAI,CAAC,KAAK,GAAG,OAAO;IACnC,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,aAAa,EAAE,KAAK,CAAA;IACpB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,IAAI,EAAE,KAAK,CAAA;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;IAC1B;;;;;;;;;;;;;;;OAeG;IACH,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAA;IACrB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAID;;;;;;;;;;GAUG;AACH,MAAM,WAAW,OAAO;IACtB,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAA;IACrB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,iDAAiD;AACjD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAA"}

package/dist/types.js

@@ -0,0 +1,16 @@
+/**
+ * @synoi/sraid — types.ts
+ *
+ * Type definitions for the SRAID (Self-Routing Addressable Identity Data) protocol — L0 of the
+ * SRAID Stack. Mirrors the shapes used by synoi-gateway and @synoi/vault so
+ * external implementations can interoperate without depending on the
+ * internal packages.
+ *
+ * CDRO objects are content-addressed: the OID is derived from the canonical
+ * form of the object (minus signature fields), so any byte-level change to
+ * the canonical content yields a different OID. Signatures are computed
+ * over the canonical bytes and attached after — they are NOT in the hash
+ * input, so signature rotation does not change the OID.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}