add real ES256 signature verification

- verifyServiceJwt() decompresses P-256 public key and verifies via WebCrypto
- PDS.evaluate() now cryptographically verifies JWT against sender's public key
- UI shows verification status (✓/✗) in event log

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

README.md

···
 
 interactive browser demo of PDS-to-PDS message passing.
 
-demonstrates jacob.gold's proposal: PDSes have incoming message queues for DMs, like email servers.
+demonstrates [jacob.gold's proposal](https://bsky.app/profile/jacob.gold/post/3mbsbqsc3vc24): PDSes have incoming message queues for DMs, like email servers.
 
 ## run
 
···
 
 - **P-256 key pairs** - each simulated PDS generates real keys on startup
 - **ES256 JWT signatures** - service auth tokens are cryptographically signed
+- **signature verification** - recipient verifies JWT against sender's public key via WebCrypto
 - **proper JWT structure** - iss, aud, lxm, exp, iat, jti fields
 
 ## what's mocked
 
 | component | current | path to real |
 |-----------|---------|--------------|
+| DID resolution | public key passed directly | resolve sender DID doc to get public key |
 | DIDs | fake strings | [PLC resolution](https://github.com/did-method-plc/did-method-plc) |
-| signature verification | decoded but not verified | resolve sender DID doc, verify against public key |
 | labeler | in-memory map | [ozone](https://github.com/bluesky-social/atproto/tree/main/packages/ozone) |
 | network | in-memory objects | actual HTTP between PDSes |
 
 ## prior art
 
-- [private data: developing a rubric for success](https://pfrazee.leaflet.pub/3lzhmtognls2q) - pfrazee on requirements for private/shared data
 - [AT Protocol and SMTP](https://ngerakines.leaflet.pub/3lxxk3oahzc2f) - ngerakines on PDS as crypto service, SMTP as transport
-- [the community manager pattern](https://ngerakines.leaflet.pub/3majmrpjrd22b) - service auth for inter-service communication
 - [bourbon protocol](https://blog.boscolo.co/3lzj5po423s2g) - invitation-based messaging, combating spam
-- [why inter-service auth needs client identity](https://ngerakines.leaflet.pub/3m6xaxk64tk2h) - `client_id` in JWTs for blocking bad actors
-- [priv (private follows)](https://github.com/TechnoJo4/priv) - using labeler reports as private signaling channel
 
 ## references
 

src/lib/crypto.js

···
 	base64UrlEncode,
 	base64UrlDecode
 } from '../../vendor/pds.js/src/pds.js';
+
+import { base64UrlDecode } from '../../vendor/pds.js/src/pds.js';
+
+/**
+ * decompress P-256 public key (33 bytes → 65 bytes)
+ * @param {Uint8Array} compressed - 33-byte compressed key
+ * @returns {Uint8Array} 65-byte uncompressed key
+ */
+function decompressPublicKey(compressed) {
+	const p = 2n ** 256n - 2n ** 224n + 2n ** 192n + 2n ** 96n - 1n;
+	const b = 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604bn;
+
+	const prefix = compressed[0];
+	const xBytes = compressed.slice(1, 33);
+	let x = 0n;
+	for (const byte of xBytes) x = (x << 8n) | BigInt(byte);
+
+	// y² = x³ - 3x + b (mod p)
+	const rhs = (x ** 3n - 3n * x + b) % p;
+	let y = modPow(rhs, (p + 1n) / 4n, p);
+
+	const yIsEven = (y & 1n) === 0n;
+	const wantEven = prefix === 0x02;
+	if (yIsEven !== wantEven) y = p - y;
+
+	const uncompressed = new Uint8Array(65);
+	uncompressed[0] = 0x04;
+	for (let i = 31; i >= 0; i--) { uncompressed[1 + i] = Number(x & 0xffn); x >>= 8n; }
+	for (let i = 31; i >= 0; i--) { uncompressed[33 + i] = Number(y & 0xffn); y >>= 8n; }
+	return uncompressed;
+}
+
+function modPow(base, exp, mod) {
+	let result = 1n;
+	base = base % mod;
+	while (exp > 0n) {
+		if (exp & 1n) result = (result * base) % mod;
+		exp >>= 1n;
+		base = (base * base) % mod;
+	}
+	return result;
+}
+
+/**
+ * verify ES256 service JWT against sender's public key
+ * @param {string} jwt - the JWT to verify
+ * @param {Uint8Array} publicKey - sender's compressed P-256 public key
+ * @returns {Promise<{valid: boolean, payload: object|null, error: string|null}>}
+ */
+export async function verifyServiceJwt(jwt, publicKey) {
+	try {
+		const [headerB64, payloadB64, sigB64] = jwt.split('.');
+		if (!headerB64 || !payloadB64 || !sigB64) {
+			return { valid: false, payload: null, error: 'malformed JWT' };
+		}
+
+		// decode payload
+		const payload = JSON.parse(
+			new TextDecoder().decode(base64UrlDecode(payloadB64))
+		);
+
+		// check expiration
+		const now = Math.floor(Date.now() / 1000);
+		if (payload.exp && payload.exp < now) {
+			return { valid: false, payload, error: 'expired' };
+		}
+
+		// import public key
+		const uncompressed = decompressPublicKey(publicKey);
+		const cryptoKey = await crypto.subtle.importKey(
+			'raw',
+			uncompressed,
+			{ name: 'ECDSA', namedCurve: 'P-256' },
+			false,
+			['verify']
+		);
+
+		// verify signature
+		const sigBytes = base64UrlDecode(sigB64);
+		const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+		const valid = await crypto.subtle.verify(
+			{ name: 'ECDSA', hash: 'SHA-256' },
+			cryptoKey,
+			sigBytes,
+			data
+		);
+
+		return { valid, payload, error: valid ? null : 'bad signature' };
+	} catch (e) {
+		return { valid: false, payload: null, error: e.message };
+	}
+}

src/lib/models.js

···
 	generateKeyPair,
 	importPrivateKey,
 	createServiceJwt,
-	base64UrlDecode
+	verifyServiceJwt
 } from './crypto.js';
-
-/**
- * decode JWT payload (no verification - just for display)
- * @param {string} jwt
- */
-export function decodeJwtPayload(jwt) {
-	const [, payloadB64] = jwt.split('.');
-	const json = new TextDecoder().decode(base64UrlDecode(payloadB64));
-	return JSON.parse(json);
-}
 
 /**
  * labeler - simulates com.atproto.label
···
 	 * @param {string} text
 	 * @param {string} jwt - the service auth JWT
 	 * @param {Labeler} labeler
-	 * @returns {[boolean, string]}
+	 * @param {Uint8Array} senderPublicKey - sender's public key for verification
+	 * @returns {Promise<[boolean, string, object|null]>}
 	 */
-	evaluate(senderDid, text, jwt, labeler) {
-		// decode token (real impl would verify signature against sender's DID doc)
-		const token = decodeJwtPayload(jwt);
+	async evaluate(senderDid, text, jwt, labeler, senderPublicKey) {
+		// verify JWT signature against sender's public key
+		const { valid, payload, error } = await verifyServiceJwt(jwt, senderPublicKey);
 
-		// token checks
-		const now = Math.floor(Date.now() / 1000);
-		if (now > token.exp) return [false, 'token-expired'];
-		if (token.aud !== this.did) return [false, 'wrong-audience'];
-		if (token.iss !== senderDid) return [false, 'issuer-mismatch'];
+		if (!valid) return [false, `sig-invalid: ${error}`, null];
+		if (payload.aud !== this.did) return [false, 'wrong-audience', payload];
+		if (payload.iss !== senderDid) return [false, 'issuer-mismatch', payload];
 
 		// policy checks
-		if (labeler.hasLabel(senderDid, 'spam')) return [false, 'labeled-spam'];
-		if (this.blocked.has(senderDid)) return [false, 'blocked'];
+		if (labeler.hasLabel(senderDid, 'spam')) return [false, 'labeled-spam', payload];
+		if (this.blocked.has(senderDid)) return [false, 'blocked', payload];
 
 		// invitation flow
 		if (!this.accepted.has(senderDid)) {
-			if (this.pending.has(senderDid)) return [false, 'pending-acceptance'];
+			if (this.pending.has(senderDid)) return [false, 'pending-acceptance', payload];
 			this.pending.set(senderDid, { text, time: new Date() });
-			return [false, 'request-created'];
+			return [false, 'request-created', payload];
 		}
 
 		// rate limiting
···
 		const cutoff = nowMs - 60000;
 		let counts = this.rateCounts.get(senderDid) || [];
 		counts = counts.filter((t) => t > cutoff);
-		if (counts.length >= this.rateLimit) return [false, 'rate-limited'];
+		if (counts.length >= this.rateLimit) return [false, 'rate-limited', payload];
 
 		counts.push(nowMs);
 		this.rateCounts.set(senderDid, counts);
 		this.inbox.push({ from: senderDid, text, time: new Date() });
-		return [true, 'delivered'];
+		return [true, 'delivered', payload];
 	}
 
 	/**

src/routes/+page.svelte

···
 		initNetwork,
 		ready
 	} from '$lib/stores.js';
-	import { decodeJwtPayload } from '$lib/models.js';
 
 	let senderHandle = $state('bob');
 	let recipientHandle = $state('alice');
 	let messageText = $state('');
 	let sending = $state(false);
+	let logEl = $state(null);
 
 	let sender = $derived(getPds(senderHandle));
 	let recipient = $derived(getPds(recipientHandle));
 	let isSelf = $derived(senderHandle === recipientHandle);
 
+	$effect(() => {
+		$logs;
+		if (logEl) logEl.scrollTop = logEl.scrollHeight;
+	});
+
 	onMount(async () => {
 		await initNetwork();
 		log('keys generated (P-256/ES256)', 'green');
···
 
 		try {
 			const jwt = await sender.createServiceToken(recipient.did);
-			const payload = decodeJwtPayload(jwt);
 			const preview = messageText.slice(0, 30);
 
 			log(`>>> ${senderHandle} -> ${recipientHandle}: ${preview}...`, 'cyan');
-			log(`    JWT: iss=${payload.iss} aud=${payload.aud} lxm=${payload.lxm}`, 'dim');
-			log(`    sig: ${jwt.split('.')[2].slice(0, 16)}...`, 'dim');
 
-			const [ok, reason] = recipient.evaluate(
+			// recipient verifies JWT against sender's public key
+			const [ok, reason, payload] = await recipient.evaluate(
 				sender.did,
 				messageText,
 				jwt,
-				labeler
+				labeler,
+				sender.publicKey
 			);
+
+			const sigValid = !reason.startsWith('sig-invalid');
+			if (payload) {
+				log(`    JWT: iss=${payload.iss} aud=${payload.aud}`, 'dim');
+			}
+			log(`    sig: ${jwt.split('.')[2].slice(0, 12)}... ${sigValid ? '✓' : '✗'}`, sigValid ? 'green' : 'red');
 
 			if (ok) {
 				log(`delivered`, 'green');
···
 			</Tooltip>
 		</div>
 
-		<div class="log">
+		<div class="log" bind:this={logEl}>
 			<h3>event log</h3>
 			{#each $logs as entry}
 				<div class={entry.cls}>{entry.msg}</div>