phaedo-mcp 0.2.2 → 0.3.0

package/signing-audit.js

@@ -0,0 +1,111 @@
+// §8.3 signing audit — "what did I sign, and when."
+//
+// A signed mandate is a CREDENTIAL asserted to a third party, so minting one is at least as
+// audit-worthy as a consultation. But it is NOT a §10.6 consultation receipt: it has no
+// signal, no deference level, and it must not feed the act-as-me learning loop or the
+// agreement-rate metric (which would corrupt both). So this is its OWN small append-only,
+// encrypted-at-rest log — the same atomic-write + domain-separated-key discipline as
+// receipts.js, but a separate artifact.
+//
+// It records a DIGEST of what was signed plus coarse metadata (grant count, expiry,
+// requesting client) — never the full mandate, never the signature bytes. The digest is the
+// stable reference: given the mandate later, an auditor recomputes it and confirms it is the
+// object that was signed.
+
+import { mkdir, writeFile, readFile, rename, chmod } from 'fs/promises';
+import { existsSync } from 'fs';
+import { createHash, randomUUID } from 'crypto';
+import { join } from 'path';
+import { Phaedo } from './lib/phaedo-crypto.js';
+import { getOrCreateCacheKey } from './cache.js';
+import { signingInput } from './signing.js';
+
+const { Envelope } = Phaedo;
+
+export const SIGNING_AUDIT_CONTEXT = 'phaedo:signing-audit:enc:v0.1';
+export const DEFAULT_CAP = 5000;
+const FILE = 'signing-audit.enc';
+
+function auditPath(stateDir) { return join(stateDir, FILE); }
+
+async function deriveKey(stateDir) {
+  const root = await getOrCreateCacheKey(stateDir);
+  const ikm = await crypto.subtle.importKey('raw', root, 'HKDF', false, ['deriveBits']);
+  const bits = await crypto.subtle.deriveBits(
+    { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: new TextEncoder().encode(SIGNING_AUDIT_CONTEXT) },
+    ikm, 32 * 8,
+  );
+  return new Uint8Array(bits);
+}
+
+async function readStore(stateDir) {
+  const p = auditPath(stateDir);
+  if (!existsSync(p)) return { records: [] };
+  const key = await deriveKey(stateDir);
+  const { envelope } = JSON.parse(await readFile(p, 'utf8'));
+  const plaintext = await Envelope.unwrap(envelope, key);
+  try {
+    const store = JSON.parse(new TextDecoder().decode(plaintext));
+    return Array.isArray(store?.records) ? store : { records: [] };
+  } finally {
+    plaintext.fill(0);
+  }
+}
+
+async function writeStore(stateDir, store, now) {
+  await mkdir(stateDir, { recursive: true, mode: 0o700 });
+  const key = await deriveKey(stateDir);
+  const plaintext = new TextEncoder().encode(JSON.stringify(store));
+  const envelope = await Envelope.wrap(plaintext, key, {
+    artifact_kind: 'signing_audit',
+    count: store.records.length,
+    created_at: new Date(now).toISOString(),
+  });
+  plaintext.fill(0);
+  const p = auditPath(stateDir);
+  const tmp = `${p}.tmp`;
+  await writeFile(tmp, JSON.stringify({ envelope }), { mode: 0o600 });
+  await chmod(tmp, 0o600);
+  await rename(tmp, p);   // atomic on POSIX
+}
+
+/**
+ * Build a signing-audit record from a signed mandate. Records the digest of the SIGNED bytes
+ * (§6 canonical form, `signature` omitted) — not the mandate content and not the signature.
+ */
+export function buildSigningAuditRecord({ requestId, mandate, clientId, agentId, now = Date.now() }) {
+  const digest = createHash('sha256').update(signingInput(mandate, { field: 'signature' })).digest('base64url');
+  const grants = Array.isArray(mandate?.grants) ? mandate.grants.length : 0;
+  return {
+    audit_id: randomUUID(),
+    signed_at: typeof mandate?.signed_at === 'string' ? mandate.signed_at : new Date(now).toISOString(),
+    request_id: typeof requestId === 'string' ? requestId : null,
+    // WHO the credential was minted for: the paired client that served the ceremony.
+    client_id: typeof clientId === 'string' && clientId ? clientId : null,
+    // WHO claimed to ask (self-asserted, audit label only — mirrors §10.6).
+    agent_id: typeof agentId === 'string' && agentId ? agentId : null,
+    mandate_digest: digest,
+    grant_count: grants,
+    mandate_expires_at: typeof mandate?.expires_at === 'string' ? mandate.expires_at : null,
+  };
+}
+
+let _chain = Promise.resolve();
+/**
+ * Append a signing-audit record. Serialized per process (like receipts) so two concurrent
+ * signs can't clobber the store. Best-effort by contract at the call site: a failed audit
+ * write must never make a real signature look unsigned — the caller logs and continues.
+ */
+export async function appendSigningAudit(stateDir, record, { cap = DEFAULT_CAP, now = Date.now() } = {}) {
+  _chain = _chain.then(async () => {
+    const store = await readStore(stateDir).catch(() => ({ records: [] }));
+    store.records.push(record);
+    if (store.records.length > cap) store.records = store.records.slice(-cap);
+    await writeStore(stateDir, store, now);
+  });
+  return _chain;
+}
+
+export async function readSigningAudit(stateDir) {
+  return (await readStore(stateDir).catch(() => ({ records: [] }))).records;
+}

package/signing-request.js

@@ -0,0 +1,217 @@
+// §8.3 signing ceremony — the MCP (server) half of the round-trip.
+//
+// The server holds the mandate; the phone holds the only key that can sign it. This module
+// deposits a SIGN REQUEST for the subject, polls for the signed result, and VERIFIES it —
+// reusing the escalation transport (relay lane, envelope crypto, first-answer-wins,
+// push-to-wake) but NOT its semantics. An escalation answer is approve/deny/modify — a
+// decision internal to the subject's system. A signature is a credential asserted to a
+// third party. Conflating them is the §10.2 action_binding failure mode one layer up, so
+// the request carries a distinct `kind` and the response is a signature or an explicit
+// refusal, never a decision verb.
+//
+// SIGN WHAT YOU SEE. The request carries the mandate OBJECT, not pre-computed bytes. The
+// phone renders that object AND derives the signing input from it, so it cannot be shown
+// one thing and made to sign another. The server re-derives the same bytes here and
+// verifies against them, which independently confirms the phone signed the mandate the
+// server actually built.
+
+import { Phaedo, b64uDec } from './lib/phaedo-crypto.js';
+import { signingInput, verifyEs256 } from './signing.js';
+
+const { Kdf, Envelope } = Phaedo;
+const DEFAULT_RELAY = 'https://phaedo-relay.fly.dev';
+
+const SIGN_REQUEST_KIND = 'sign_request';
+const SIGN_RESPONSE_KIND = 'sign_response';
+// AP2 mandates omit `signature` from the signing input (the field the signature fills).
+const AP2_SIGNATURE_FIELD = 'signature';
+
+export function relayBaseFromEnv(env = process.env) {
+  // PHAEDO_RELAY is the name every other lane reads (escalation, receipts, capture, delegation).
+  // This one read PHAEDO_RELAY_URL alone, so a self-hosted relay silently did NOT cover the §8.3
+  // signing ceremony — sign requests kept going to the default host. The old name is still
+  // honoured so an existing setup does not break.
+  return env.PHAEDO_RELAY || env.PHAEDO_RELAY_URL || DEFAULT_RELAY;
+}
+
+function relayAuthHeader(pairing) {
+  const id = pairing && pairing.relay_device_id;
+  const secret = pairing && pairing.relay_device_secret;
+  return id && secret ? { authorization: `Bearer ${id}:${secret}` } : {};
+}
+
+function genRequestId() {
+  if (typeof crypto !== 'undefined' && crypto.randomUUID) return crypto.randomUUID();
+  return `sig-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+
+/**
+ * Build the encrypted SIGN REQUEST deposit body. Sealed under fp_sync_key, exactly like an
+ * escalation request, and posted to the same relay lane — the phone routes on `kind`.
+ * `mandate` is the object to be signed (unsigned; the `signature` field stays null/absent).
+ */
+export async function buildSignRequestDeposit(pairKeyB64u, requestId, mandate, { windowMs, now = () => new Date().toISOString() } = {}) {
+  const pairKey = b64uDec(pairKeyB64u);
+  let fpSyncKey;
+  try {
+    fpSyncKey = await Kdf.deriveFpSyncKey(pairKey);
+  } finally {
+    pairKey.fill(0);
+  }
+  try {
+    const inner = { kind: SIGN_REQUEST_KIND, request_id: requestId, data: { mandate } };
+    const plaintext = new TextEncoder().encode(JSON.stringify(inner));
+    const envelope = await Envelope.wrap(plaintext, fpSyncKey, { artifact_kind: SIGN_REQUEST_KIND, created_at: now() });
+    plaintext.fill(0);
+    return { request_id: requestId, envelope, ...(windowMs ? { window_ms: windowMs } : {}) };
+  } finally {
+    if (fpSyncKey && fpSyncKey.fill) fpSyncKey.fill(0);
+  }
+}
+
+/**
+ * Decrypt the phone's SIGN RESPONSE. Returns the inner data — either
+ * `{ signature, encoding, signed_at }` or `{ refused: true, reason? }` — or null on any
+ * failure. A malformed or forged response must never crash the agent's resume path.
+ */
+export async function unwrapSignResponse(pairKeyB64u, body) {
+  if (!body || !body.envelope) return null;
+  const pairKey = b64uDec(pairKeyB64u);
+  let fpSyncKey;
+  try {
+    fpSyncKey = await Kdf.deriveFpSyncKey(pairKey);
+  } catch { pairKey.fill(0); return null; }
+  pairKey.fill(0);
+  try {
+    const plaintext = await Envelope.unwrap(body.envelope, fpSyncKey);
+    const inner = JSON.parse(new TextDecoder().decode(plaintext));
+    if (inner && inner.kind === SIGN_RESPONSE_KIND && inner.data) return inner.data;
+    return null;
+  } catch {
+    return null;
+  } finally {
+    if (fpSyncKey && fpSyncKey.fill) fpSyncKey.fill(0);
+  }
+}
+
+/**
+ * Verify a signed mandate. The mandate is re-canonicalized here (signature field omitted)
+ * and checked against the subject's published signing key — so a valid result means BOTH
+ * that the signature is genuine AND that the phone signed the exact mandate the server
+ * built. Returns { verified, reason? }.
+ *
+ * `signingPublicKey` is the base64 X9.63 point from `phaedo_signing_public_key` (published
+ * over the trusted pairing, §8.3 step 2). If it is missing, verification cannot proceed —
+ * that is distinct from a bad signature and is reported as such.
+ */
+export function verifySignedMandate({ mandate, signature, encoding = 'der', signingPublicKey }) {
+  if (!signingPublicKey) return { verified: false, reason: 'no-published-signing-key' };
+  if (typeof signature !== 'string' || !signature) return { verified: false, reason: 'no-signature' };
+  let sigBytes, keyBytes;
+  try {
+    sigBytes = Buffer.from(signature, 'base64');
+    keyBytes = Buffer.from(signingPublicKey, 'base64');
+  } catch {
+    return { verified: false, reason: 'undecodable' };
+  }
+  try {
+    const verified = verifyEs256({
+      payload: mandate,
+      signature: sigBytes,
+      publicKey: keyBytes,
+      encoding,
+      field: AP2_SIGNATURE_FIELD,
+    });
+    return verified ? { verified: true } : { verified: false, reason: 'signature-mismatch' };
+  } catch (e) {
+    // A malformed KEY (not a bad signature) throws in the core; surface it as its own
+    // reason rather than reporting "not the subject's signature".
+    return { verified: false, reason: `key-error:${String(e && e.message || e)}` };
+  }
+}
+
+/** The exact bytes the phone is asked to sign — exported so a caller/test can assert the
+ *  server and phone agree on them. */
+export function mandateSigningInput(mandate) {
+  return signingInput(mandate, { field: AP2_SIGNATURE_FIELD });
+}
+
+/**
+ * Deposit a SIGN REQUEST and wake the device. Returns
+ * { deposited, request_id, window_ms, expires_at } or { deposited:false, reason }.
+ */
+export async function depositSignRequest(pairing, mandate, deps = {}) {
+  const fetchFn = deps.fetch || globalThis.fetch;
+  if (!pairing || !pairing.pair_key) return { deposited: false, reason: 'unpaired' };
+  if (!pairing.relay_device_id) return { deposited: false, reason: 'no-relay-device-id' };
+  if (!mandate || typeof mandate !== 'object') return { deposited: false, reason: 'no-mandate' };
+  // A mandate that already carries a signature must not be re-sent for signing.
+  if (mandate.signature != null) return { deposited: false, reason: 'already-signed' };
+
+  const windowMs = Math.max(1000, Number(deps.windowMs) || 5 * 60 * 1000);
+  const relayBase = deps.relayBase || relayBaseFromEnv();
+  const requestId = deps.requestId || genRequestId();
+  try {
+    const body = await buildSignRequestDeposit(pairing.pair_key, requestId, mandate, { windowMs });
+    const res = await fetchFn(`${relayBase}/escalation/${encodeURIComponent(pairing.relay_device_id)}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...relayAuthHeader(pairing) },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(deps.depositTimeoutMs || 8000),
+    });
+    if (!res || !res.ok) return { deposited: false, reason: `deposit-failed-${res && res.status}`, request_id: requestId };
+    let info = {};
+    try { info = await res.json(); } catch { /* body optional */ }
+    return { deposited: true, request_id: requestId, window_ms: windowMs, expires_at: info.expires_at, woke: info.woke };
+  } catch (e) {
+    return { deposited: false, reason: `deposit-error:${String(e && e.message || e)}`, request_id: requestId };
+  }
+}
+
+/**
+ * Poll ONCE for a signed mandate. Returns:
+ *   { resolved:true, signed:true, mandate }             — signature verified; mandate now carries it
+ *   { resolved:true, signed:false, reason:'refused' }   — the subject declined to sign
+ *   { resolved:true, signed:false, reason:'verify-failed', detail } — a response arrived but did not verify
+ *   { resolved:false, status:'pending' | 'expired' }
+ * Never throws. A verify failure is resolved-but-unsigned, never silently treated as signed.
+ */
+export async function pollSignOnce(pairing, requestId, mandate, deps = {}) {
+  const fetchFn = deps.fetch || globalThis.fetch;
+  if (!pairing || !pairing.pair_key || !requestId) return { resolved: false, status: 'expired', reason: 'bad-args' };
+  if (deps.expiresAt && (deps.now ? deps.now() : Date.now()) > deps.expiresAt) return { resolved: false, status: 'expired' };
+  const relayBase = deps.relayBase || relayBaseFromEnv();
+  let body = null;
+  try {
+    const res = await fetchFn(`${relayBase}/escalation/response/${encodeURIComponent(requestId)}`, {
+      headers: relayAuthHeader(pairing),
+      signal: AbortSignal.timeout(deps.pollTimeoutMs || 8000),
+    });
+    if (res && res.ok) body = await res.json();
+  } catch { /* transient */ }
+  if (!body) return { resolved: false, status: 'pending' };
+
+  const data = await unwrapSignResponse(pairing.pair_key, body);
+  if (!data) return { resolved: false, status: 'pending' };   // undecryptable → keep waiting, don't crash
+
+  if (data.refused === true) {
+    return { resolved: true, signed: false, reason: 'refused', request_id: requestId };
+  }
+
+  const check = verifySignedMandate({
+    mandate,
+    signature: data.signature,
+    encoding: data.encoding || 'der',
+    signingPublicKey: deps.signingPublicKey,
+  });
+  if (!check.verified) {
+    return { resolved: true, signed: false, reason: 'verify-failed', detail: check.reason, request_id: requestId };
+  }
+  return {
+    resolved: true,
+    signed: true,
+    request_id: requestId,
+    mandate: { ...mandate, signature: data.signature, signature_encoding: data.encoding || 'der',
+               signed_at: typeof data.signed_at === 'string' ? data.signed_at : undefined },
+  };
+}

package/signing.js

@@ -0,0 +1,176 @@
+// §8.3 asymmetric signing — the verification half, server-side.
+//
+// The MCP server CANNOT sign: the subject's signing key is non-extractable inside the
+// phone's Secure Enclave (spec §8.3, verified on hardware 2026-07-23). What the server
+// does is (a) compute the exact bytes a signature covers, so the phone can be asked to
+// sign them, and (b) VERIFY a signature once the phone returns one. Signing itself is a
+// ceremony that belongs to the device holding the key, and deliberately stays there.
+//
+// PURE: no I/O, no globals. Crypto is node:crypto only — no third-party dependency is
+// introduced into the verification path.
+
+import { createPublicKey, verify as nodeVerify } from 'node:crypto';
+
+const isObj = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+
+// ── RFC 8785 canonical JSON (spec §6) ────────────────────────────────────────
+//
+// ⚠️ A FAITHFUL PORT. This is the FOURTH copy in the repo — envelope.js (extension),
+// mobile/src/lib/envelope.ts, the mirror in scripts/test_cross_compat.mjs, and now this
+// one. It MUST stay byte-identical to those three: a signature is only verifiable if every
+// implementation agrees on the bytes, so a divergence here silently produces signatures
+// nobody else can check. Locked by the published TC-CANON vectors in
+// mcp/test-signing.mjs — if this drifts, that suite fails.
+//
+// JSON.stringify already emits RFC 8785-conformant scalars in ECMAScript (shortest
+// round-trip numbers, minimal string escaping). What it does NOT do is order keys
+// recursively, and it silently turns non-finite numbers into null. Full RFC 8785 here =
+// UTF-16 code-unit key sort + explicit REJECTION of values JSON cannot express.
+const notJson = (v) => v === undefined || typeof v === 'function' || typeof v === 'symbol';
+
+export function canonicalStringify(value) {
+  if (typeof value === 'number' && !Number.isFinite(value)) {
+    throw new Error('canonicalStringify: non-finite numbers are not expressible in RFC 8785 JSON');
+  }
+  if (value === null || typeof value !== 'object') {
+    const s = JSON.stringify(typeof value === 'string' ? value.normalize('NFC') : value);
+    if (s === undefined) throw new Error('canonicalStringify: a ' + typeof value + ' is not expressible in JSON');
+    return s;
+  }
+  if (Array.isArray(value)) {
+    return '[' + value.map(v => (notJson(v) ? 'null' : canonicalStringify(v))).join(',') + ']';
+  }
+  // §6.2 NFC — "Implementations MUST normalize text to NFC before canonicalization to avoid
+  // signature breakage from equivalent but byte different strings." It was implemented nowhere.
+  // This is the VERIFIER: if the phone ever normalizes and this does not, every signature it
+  // produces fails here, over text that looks identical in any log. KEYS too, and a post-NFC
+  // collision is REJECTED rather than silently dropping one. Byte-identical to envelope.js and
+  // mobile/src/lib/envelope.ts.
+  const seen = new Map();
+  for (const k of Object.keys(value)) {
+    if (notJson(value[k])) continue;
+    const nk = k.normalize('NFC');
+    if (seen.has(nk)) throw new Error('canonicalStringify: keys collide under NFC: ' + JSON.stringify(k));
+    seen.set(nk, value[k]);
+  }
+  const keys = [...seen.keys()].sort();   // UTF-16 code-unit order (RFC 8785 §3.2.3), post-NFC
+  const parts = [];
+  for (const k of keys) parts.push(JSON.stringify(k) + ':' + canonicalStringify(seen.get(k)));
+  return '{' + parts.join(',') + '}';
+}
+
+// ── What a signature covers ──────────────────────────────────────────────────
+
+/**
+ * The exact bytes a §8.3 signature is computed over: the §6 canonical serialization of
+ * the object with the signature field itself OMITTED. Omitting it is what makes the input
+ * well defined no matter how many signatures are later appended — the same construction
+ * §8.2 bootstrap mode uses for `digest`.
+ *
+ * @param {object} obj
+ * @param {{ field?: string }} [opts] field to omit (default 'signatures'; AP2 uses 'signature')
+ * @returns {Buffer} UTF-8 canonical bytes
+ */
+export function signingInput(obj, { field = 'signatures' } = {}) {
+  if (!isObj(obj)) throw new Error('signingInput: expected an object');
+  const rest = {};
+  for (const k of Object.keys(obj)) {
+    if (k !== field) rest[k] = obj[k];
+  }
+  return Buffer.from(canonicalStringify(rest), 'utf8');
+}
+
+// ── Key + signature encodings ────────────────────────────────────────────────
+
+/**
+ * Convert an X9.63 uncompressed EC point (0x04 || X || Y, 65 bytes) — what the Secure
+ * Enclave exports — into a node:crypto public key.
+ */
+export function publicKeyFromRawPoint(raw) {
+  const bytes = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+  if (bytes.length !== 65 || bytes[0] !== 0x04) {
+    throw new Error('publicKeyFromRawPoint: expected a 65-byte uncompressed P-256 point (0x04 || X || Y)');
+  }
+  return createPublicKey({
+    key: {
+      kty: 'EC',
+      crv: 'P-256',
+      x: bytes.subarray(1, 33).toString('base64url'),
+      y: bytes.subarray(33, 65).toString('base64url'),
+    },
+    format: 'jwk',
+  });
+}
+
+/**
+ * Convert a DER (X9.62) ECDSA signature — what SecKeyCreateSignature emits — into the raw
+ * r||s form (64 bytes) that JOSE ES256 and the W3C VC suites use.
+ *
+ * This conversion is the boundary the spec deferred: the enclave speaks DER, interoperable
+ * verifiers expect raw, and something has to translate. Doing it here means the wire form
+ * is the interoperable one while the device keeps using its native output.
+ */
+export function derToRawSignature(der) {
+  const b = Buffer.isBuffer(der) ? der : Buffer.from(der);
+  let i = 0;
+  if (b[i++] !== 0x30) throw new Error('derToRawSignature: not a DER SEQUENCE');
+  let seqLen = b[i++];
+  if (seqLen & 0x80) {                       // long form length
+    const n = seqLen & 0x7f;
+    if (n < 1 || n > 2) throw new Error('derToRawSignature: unsupported DER length');
+    seqLen = 0;
+    for (let k = 0; k < n; k++) seqLen = (seqLen << 8) | b[i++];
+  }
+  if (i + seqLen !== b.length) throw new Error('derToRawSignature: DER length mismatch');
+
+  const readInt = () => {
+    if (b[i++] !== 0x02) throw new Error('derToRawSignature: expected DER INTEGER');
+    const len = b[i++];
+    if (len & 0x80) throw new Error('derToRawSignature: unsupported INTEGER length');
+    let v = b.subarray(i, i + len);
+    i += len;
+    // DER integers are signed and minimally encoded: strip leading zero padding, then
+    // left-pad to the 32-byte field width the raw form requires.
+    while (v.length > 1 && v[0] === 0x00) v = v.subarray(1);
+    if (v.length > 32) throw new Error('derToRawSignature: integer wider than P-256 field');
+    return Buffer.concat([Buffer.alloc(32 - v.length), v]);
+  };
+
+  const r = readInt();
+  const s = readInt();
+  if (i !== b.length) throw new Error('derToRawSignature: trailing bytes after signature');
+  return Buffer.concat([r, s]);
+}
+
+// ── Verification ─────────────────────────────────────────────────────────────
+
+/**
+ * Verify a §8.3 ES256 signature over an object.
+ *
+ * Never throws on a bad signature — returns false. A malformed key or an unusable
+ * encoding still throws, because that is a caller bug rather than a failed verification,
+ * and the two must not be conflated (silently returning false for a broken key would
+ * report "not the subject's signature" when the truth is "we could not check").
+ *
+ * @param {object}  args.payload    the signed object (signature field may be present; it is omitted)
+ * @param {Buffer|Uint8Array} args.signature
+ * @param {Buffer|Uint8Array} args.publicKey  X9.63 uncompressed point (65 bytes)
+ * @param {'der'|'raw'} [args.encoding='raw']
+ * @param {string} [args.field='signatures']  which field to omit from the signing input
+ * @returns {boolean}
+ */
+export function verifyEs256({ payload, signature, publicKey, encoding = 'raw', field = 'signatures' }) {
+  if (encoding !== 'der' && encoding !== 'raw') {
+    throw new Error(`verifyEs256: unknown signature encoding '${encoding}'`);
+  }
+  const key = publicKeyFromRawPoint(publicKey);      // throws on a malformed key — deliberate
+  const data = signingInput(payload, { field });
+  const sig = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
+  try {
+    return nodeVerify('sha256', data, { key, dsaEncoding: encoding === 'der' ? 'der' : 'ieee-p1363' }, sig);
+  } catch {
+    // node throws on structurally invalid signature bytes; that is a failed verification,
+    // not a caller error.
+    return false;
+  }
+}