@ariestools/aries-datalake-core is the Node entry point. It includes the browser-safe contracts plus HS256 challenge, session, and datalake token signing and verification.
@ariestools/aries-datalake-core/browser is the browser entry point. It contains wire types, route builders, error types, and the canonical control/data audience and scope constants. It does not import Node cryptography, filesystem APIs, environment variables, or credential storage.
Use the /browser entry point in browser applications. JWT verification belongs on the Aries control and data planes; importing the wire contracts does not make browser code an authorization boundary.
Browser wallet JWTs are short-lived, audience-bound bearer credentials. The server additionally enforces the exact HTTP Origin, signed origin, canonical scope vocabulary, signer identity, and current datalake ACL. A signed statement does not by itself establish truth, consent, privacy, or permanence.