@atlasauth/pca-fndsa 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,221 @@
+/**
+ * @atlasauth/pca-fndsa — FN-DSA / Falcon (FIPS 206 draft) for PCA's crypto-agility seam.
+ *
+ * FN-DSA (standardization name for Falcon) is a LATTICE signature over NTRU whose selling point is
+ * COMPACTNESS: its public keys and signatures are far smaller than ML-DSA's at the same security
+ * category (Falcon-512 ≈ Category 1, Falcon-1024 ≈ Category 5). That makes it the suite to reach for
+ * on bandwidth-bound or storage-bound surfaces — exactly the places ML-DSA-65's 1952 B key / 3309 B
+ * signature hurt.
+ *
+ * WHY A PLUGGABLE BACKEND (the honest part):
+ *   Falcon signing needs discrete-Gaussian sampling over a lattice and an FFT/NTT in a regime that the
+ *   reference implementation runs in floating point. A CONSTANT-TIME, correct, interoperable Falcon
+ *   CANNOT be safely hand-rolled in TypeScript: a float-based sampler leaks the secret via timing, and a
+ *   naive integer reimplementation is a research project, not a package. Shipping a "pure-TS Falcon"
+ *   here would be worse than shipping nothing — it would look done while being unsafe. So this package
+ *   does the one honest thing: it REGISTERS the FN-DSA suites in PCA's wire + agility framing and routes
+ *   the heavy math to a PLUGGABLE, VETTED backend (a wasm build of the FIPS-206 reference, or a vetted
+ *   native lib). The wire format, the suite ids, the byte-length enforcement, the PCA leaf framing and
+ *   the hybrid composition are all REAL and fully tested here (against a deterministic KAT mock); only
+ *   the Gaussian-sampling arithmetic is delegated. Drop in a real backend via {@link setFalconBackend}
+ *   and nothing else in PCA changes.
+ *
+ * This mirrors the conventions of `@atlasauth/pca`'s `pq.ts` suite registry (SigAlg / SIG_SUITES /
+ * signWithSuite / verifyWithSuite) so FN-DSA slots in as a PEER suite family: same `sig` / `alg` /
+ * `pq_pk` / `pq_sig` wire fields, same fail-closed hybrid rule, same per-suite exact-length enforcement.
+ * It lives in its own package (not in `pq.ts`) precisely because its primitive is pluggable, not bundled.
+ */
+import { type PCActn, type PCActnBody } from '@atlasauth/pca';
+/** FN-DSA-512 (Falcon-512, ~Category 1) public-key size, in bytes. */
+export declare const FN_DSA_512_PUBLIC_KEY_BYTES = 897;
+/** FN-DSA-512 padded (FIPS-206 fixed-length) signature size, in bytes. The compressed form averages smaller. */
+export declare const FN_DSA_512_SIGNATURE_BYTES = 666;
+/** FN-DSA-1024 (Falcon-1024, ~Category 5) public-key size, in bytes. */
+export declare const FN_DSA_1024_PUBLIC_KEY_BYTES = 1793;
+/** FN-DSA-1024 padded (FIPS-206 fixed-length) signature size, in bytes. The compressed form averages smaller. */
+export declare const FN_DSA_1024_SIGNATURE_BYTES = 1280;
+/** The two pure FN-DSA parameter sets (the backend's "variant"). */
+export type FnDsaVariant = 'fn-dsa-512' | 'fn-dsa-1024';
+/**
+ * The FN-DSA suite ids registered in PCA's agility seam. The pure suites carry the FN-DSA signature in
+ * the primary `sig` field; the `hybrid-ed25519-fn-dsa-*` suites carry an Ed25519 signature in `sig` and
+ * the FN-DSA signature in `pq_sig` — classical + lattice defense-in-depth, requiring BOTH to verify.
+ */
+export type FnDsaSigAlg = 'fn-dsa-512' | 'fn-dsa-1024' | 'hybrid-ed25519-fn-dsa-512' | 'hybrid-ed25519-fn-dsa-1024';
+/** A single FN-DSA suite's wire contract — the FN-DSA parallel of pq.ts's {@link SigSuite}. */
+export interface FnDsaSuite {
+    alg: FnDsaSigAlg;
+    /** The pure FN-DSA parameter set the suite uses (which `pq_pk` / FN-DSA `sig` lengths apply). */
+    variant: FnDsaVariant;
+    /** Suite carries an Ed25519 component (in `sig`, under the leaf holder key). */
+    hasEd25519: boolean;
+    /** Decoded byte length REQUIRED in the primary `sig` field (Ed25519 64 for hybrid; the FN-DSA sig for pure). */
+    sigBytes: number;
+    /** A `pq_pk` (FN-DSA public key) field is REQUIRED (always true for FN-DSA suites). */
+    needsPqPk: boolean;
+    /** Decoded byte length REQUIRED in `pq_pk`. */
+    pqPkBytes: number;
+    /** A `pq_sig` field is REQUIRED — i.e. the FN-DSA sig is separate from `sig` (hybrid only). */
+    needsPqSig: boolean;
+    /** Decoded byte length REQUIRED in `pq_sig` when `needsPqSig`; `0` when unused. */
+    pqSigBytes: number;
+    /** The FN-DSA signature length for this suite's variant (== sigBytes for pure, == pqSigBytes for hybrid). */
+    fnSigBytes: number;
+}
+/** The closed FN-DSA suite registry (the FN-DSA parallel of pq.ts's SIG_SUITES). */
+export declare const FN_DSA_SUITES: Readonly<Record<FnDsaSigAlg, Readonly<FnDsaSuite>>>;
+export declare function isKnownFnDsaAlg(x: unknown): x is FnDsaSigAlg;
+/** Resolve an FN-DSA suite by id; `null` (FAIL-CLOSED) for an unknown name or non-string. */
+export declare function resolveFnDsaAlg(alg: unknown): Readonly<FnDsaSuite> | null;
+/** Is `v` one of the two pure FN-DSA parameter sets? */
+export declare function isFnDsaVariant(v: unknown): v is FnDsaVariant;
+/** An FN-DSA key pair as raw bytes (the wire/PKI boundary). */
+export interface FalconKeyPair {
+    /** FN-DSA public key (897 B for 512, 1793 B for 1024). */
+    pk: Uint8Array;
+    /** FN-DSA secret key (backend-defined encoding). */
+    sk: Uint8Array;
+}
+/**
+ * The vetted FN-DSA primitive, supplied by a real backend (wasm build of the FIPS-206 reference, or a
+ * vetted native lib). `verify` is mandatory (verification is the hot path and is safe to run anywhere);
+ * `sign` and `keygen` are OPTIONAL because many deployments only ever VERIFY FN-DSA signatures (signing,
+ * with its constant-time Gaussian sampler, lives next to the secret key and may be absent client-side).
+ *
+ * All byte arguments are the padded FIPS-206 encodings; a backend that works in the compressed form MUST
+ * pad to the fixed sizes before returning from `sign` and accept the padded form in `verify`.
+ */
+export interface FalconBackend {
+    /** Verify `signature` over `message` under `pubkey`. MUST NOT throw on a bad signature — return false. */
+    verify(pubkey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
+    /** Sign `message` under `secretkey`, returning the padded FIPS-206 signature. Optional. */
+    sign?(secretkey: Uint8Array, message: Uint8Array): Uint8Array;
+    /** Generate a fresh FN-DSA key pair. Optional. */
+    keygen?(): FalconKeyPair;
+}
+/** The clear error the default (unregistered) backend raises so misuse FAILS LOUD, not silently. */
+export declare const NO_FN_DSA_BACKEND_MESSAGE = "no FN-DSA backend registered \u2014 install @atlasauth/pca-fndsa-node or supply a wasm backend via setFalconBackend()";
+/** Install the FN-DSA backend that performs the actual Falcon math. */
+export declare function setFalconBackend(backend: FalconBackend): void;
+/** The currently installed FN-DSA backend (the default throws {@link NO_FN_DSA_BACKEND_MESSAGE}). */
+export declare function getFalconBackend(): FalconBackend;
+/** Restore the default (throwing) backend — mainly for tests and teardown. */
+export declare function resetFalconBackend(): void;
+/**
+ * FN-DSA sign over raw bytes, delegating to the registered backend AFTER enforcing the suite's key/sig
+ * framing. THROWS (fail-loud) when no backend is registered, when the backend is verify-only (no `sign`),
+ * or when the backend returns a signature of the wrong padded length. `sk` must be a non-empty Uint8Array
+ * (its exact encoding is backend-defined, so its length is not pinned here).
+ */
+export declare function fndsaSign(variant: FnDsaVariant, sk: Uint8Array, msg: Uint8Array): Uint8Array;
+/**
+ * FN-DSA verify over raw bytes. The suite's key + signature LENGTHS are enforced HERE, BEFORE the backend
+ * is ever called, so a wrong-length public key or signature is rejected (false) without reaching the
+ * primitive. A registered backend that itself throws is NOT swallowed (fail-loud) — but a wrong-length
+ * input, and the clear "no backend" error, surface as described: length guard returns false; the default
+ * backend throws {@link NO_FN_DSA_BACKEND_MESSAGE} once the length guard has passed.
+ */
+export declare function fndsaVerify(variant: FnDsaVariant, pk: Uint8Array, msg: Uint8Array, sig: Uint8Array): boolean;
+/**
+ * The wire fields an FN-DSA-signed PCA surface carries — structurally the SAME shape pq.ts emits from
+ * {@link signSuiteArtifact} (`sig` always; `alg` + `pq_pk` for every FN-DSA suite; `pq_sig` for hybrid).
+ * The caller spreads these onto the artifact it transports alongside the PCActn, exactly as the core
+ * suite fields ride on a PCActn. (FN-DSA is not yet a member of pq.ts's `SigAlg` union — admitting it
+ * there is the mechanical follow pq.ts describes for SLH-DSA — so these fields travel as a parallel,
+ * byte-compatible frame rather than being typed onto the PCActn object.)
+ */
+export interface FnDsaArtifactFields {
+    /** b64u — the FN-DSA signature for a pure suite; the Ed25519 signature for a hybrid suite. */
+    sig: string;
+    /** The FN-DSA suite id (SIGNED into the leaf message, so a downgrade/key-swap invalidates the signature). */
+    alg: FnDsaSigAlg;
+    /** b64u FN-DSA public key (SIGNED into the leaf message). */
+    pq_pk: string;
+    /** b64u FN-DSA signature — hybrid suites only. */
+    pq_sig?: string;
+}
+/** The domain separator for the FN-DSA leaf/hop binding suffix. */
+export declare const FN_DSA_LEAF_DOMAIN = "atlas-pca/fn-dsa/leaf/v1\0";
+/**
+ * The exact bytes an FN-DSA leaf/hop signature covers:
+ *
+ *   thresholdMessage(leaf)  ‖  FN_DSA_LEAF_DOMAIN  ‖  utf8(alg)  ‖  0x00  ‖  utf8(pq_pk b64u)
+ *
+ * The leading `thresholdMessage(leaf)` is the IDENTICAL canonical message pq.ts's core leaf signs, so an
+ * FN-DSA signature commits to the whole action. The domain-separated suffix additively BINDS `alg` and
+ * `pq_pk` into the signed bytes — the same downgrade/key-swap protection pq.ts gets by folding `alg` /
+ * `pq_pk` into the canonical body via `bindSuiteFields`, achieved here without mutating the PCActn's typed
+ * shape (FN-DSA is not yet in the `SigAlg` union). In a hybrid both the Ed25519 and FN-DSA halves sign
+ * these same bytes, so each commits to the suite + PQ key.
+ */
+export declare function fndsaLeafMessage(leaf: PCActn | PCActnBody, alg: FnDsaSigAlg, pqPkB64u: string): Uint8Array;
+/** Inputs to {@link signPcaWithFndsa}. */
+export interface SignPcaWithFndsaInput {
+    /** The FN-DSA suite id. */
+    alg: FnDsaSigAlg;
+    /** The PCActn (or its body) whose leaf is being signed — its {@link thresholdMessage} is the base. */
+    leaf: PCActn | PCActnBody;
+    /** The FN-DSA key pair (its `pk` becomes `pq_pk`; its `sk` signs). */
+    fnDsa: FalconKeyPair;
+    /** Ed25519 leaf-holder secret key — REQUIRED for a `hybrid-*` suite, ignored for a pure suite. */
+    edSecret?: Uint8Array;
+}
+/**
+ * Produce an FN-DSA leaf (or capability-hop) signature for a PCActn, returning the wire fields the
+ * surface carries. Pure FN-DSA: `sig` = FN-DSA signature, `pq_pk` = FN-DSA key. Hybrid: `sig` = Ed25519
+ * signature, `pq_sig` = FN-DSA signature, `pq_pk` = FN-DSA key — both over the SAME leaf message, for
+ * classical + lattice DEFENSE-IN-DEPTH (a forger must break Ed25519 AND Falcon). THROWS fail-closed on an
+ * unknown suite, a wrong-length FN-DSA key, a hybrid suite with no `edSecret`, or a missing/limited backend.
+ */
+export declare function signPcaWithFndsa(input: SignPcaWithFndsaInput): FnDsaArtifactFields;
+/** Inputs to {@link verifyPcaFndsa}. The signature fields are UNTRUSTED (every one optional/`unknown`). */
+export interface VerifyPcaFndsaInput {
+    /** The FN-DSA suite id from the wire (validated; an unknown value fails closed). */
+    alg: unknown;
+    /** The PCActn (or body) whose leaf is being verified — its {@link thresholdMessage} is recomputed. */
+    leaf: PCActn | PCActnBody;
+    /** The Ed25519 leaf-holder public key (b64u) — REQUIRED for a hybrid suite. */
+    holder?: unknown;
+    /** The FN-DSA public key (b64u) as carried in the surface's `pq_pk`. */
+    pq_pk?: unknown;
+    /** The primary signature (b64u): FN-DSA sig for a pure suite, Ed25519 sig for a hybrid suite. */
+    sig?: unknown;
+    /** The FN-DSA signature (b64u) — hybrid suites only. */
+    pq_sig?: unknown;
+}
+/**
+ * Verify an FN-DSA leaf/hop signature over a PCActn. FAIL-CLOSED and never throws for ordinary wire
+ * faults: an unknown `alg`, a wrong-length/absent key or signature, a tampered action (its
+ * {@link thresholdMessage} changes), or a suite/key downgrade (the binding suffix changes) all return
+ * false. Hybrid requires BOTH the Ed25519 half AND the FN-DSA half. (A registered backend that itself
+ * throws is not caught — that is a backend bug, which should be loud.)
+ */
+export declare function verifyPcaFndsa(input: VerifyPcaFndsaInput): boolean;
+/** A known-answer vector: the backend must map `(pk, msg)` to `sig`. */
+export interface FalconKat {
+    pk: Uint8Array;
+    msg: Uint8Array;
+    sig: Uint8Array;
+}
+/**
+ * Deterministic SHA-256 counter-mode stretch of `seed` to exactly `outLen` bytes. This is the mock/KAT
+ * key-derivation and signature-derivation function — NOT Falcon. It exists only so the wire framing and
+ * length enforcement are testable with reproducible, fixed-length byte strings.
+ */
+export declare function hashKat(seed: Uint8Array, outLen: number): Uint8Array;
+/**
+ * Deterministically mint a MOCK FN-DSA key pair for a variant (NOT real Falcon keys). The secret key is
+ * `MOCK_SK_TAG ‖ pk` so the mock backend's `sign` can recover the public key from it; the public key is a
+ * reproducible stretch of `seed` to the variant's exact length, so a given `seed` always yields the same
+ * pair (handy for stable KAT fixtures).
+ */
+export declare function mockKeypair(variant: FnDsaVariant, seed?: Uint8Array | string): FalconKeyPair;
+/**
+ * Install a DETERMINISTIC mock FN-DSA backend (and return it) so the wire format, PCA integration and
+ * length enforcement can be tested WITHOUT the real Falcon math. The backend is keyed by `(pk, msg) -> sig`:
+ *   - any explicit `vectors` take precedence (drop in real FIPS-206 known-answer vectors here);
+ *   - otherwise `(pk, msg)` maps to a reproducible {@link deriveMockSig}, so sign/verify round-trip.
+ * `keygen()` returns an `fn-dsa-512` {@link mockKeypair} by default; use {@link mockKeypair} directly for a
+ * specific variant. This is a TEST double — never register it in production (register a vetted backend).
+ */
+export declare function registerTestBackend(vectors?: readonly FalconKat[]): FalconBackend;

package/dist/index.js

@@ -0,0 +1,411 @@
+"use strict";
+/**
+ * @atlasauth/pca-fndsa — FN-DSA / Falcon (FIPS 206 draft) for PCA's crypto-agility seam.
+ *
+ * FN-DSA (standardization name for Falcon) is a LATTICE signature over NTRU whose selling point is
+ * COMPACTNESS: its public keys and signatures are far smaller than ML-DSA's at the same security
+ * category (Falcon-512 ≈ Category 1, Falcon-1024 ≈ Category 5). That makes it the suite to reach for
+ * on bandwidth-bound or storage-bound surfaces — exactly the places ML-DSA-65's 1952 B key / 3309 B
+ * signature hurt.
+ *
+ * WHY A PLUGGABLE BACKEND (the honest part):
+ *   Falcon signing needs discrete-Gaussian sampling over a lattice and an FFT/NTT in a regime that the
+ *   reference implementation runs in floating point. A CONSTANT-TIME, correct, interoperable Falcon
+ *   CANNOT be safely hand-rolled in TypeScript: a float-based sampler leaks the secret via timing, and a
+ *   naive integer reimplementation is a research project, not a package. Shipping a "pure-TS Falcon"
+ *   here would be worse than shipping nothing — it would look done while being unsafe. So this package
+ *   does the one honest thing: it REGISTERS the FN-DSA suites in PCA's wire + agility framing and routes
+ *   the heavy math to a PLUGGABLE, VETTED backend (a wasm build of the FIPS-206 reference, or a vetted
+ *   native lib). The wire format, the suite ids, the byte-length enforcement, the PCA leaf framing and
+ *   the hybrid composition are all REAL and fully tested here (against a deterministic KAT mock); only
+ *   the Gaussian-sampling arithmetic is delegated. Drop in a real backend via {@link setFalconBackend}
+ *   and nothing else in PCA changes.
+ *
+ * This mirrors the conventions of `@atlasauth/pca`'s `pq.ts` suite registry (SigAlg / SIG_SUITES /
+ * signWithSuite / verifyWithSuite) so FN-DSA slots in as a PEER suite family: same `sig` / `alg` /
+ * `pq_pk` / `pq_sig` wire fields, same fail-closed hybrid rule, same per-suite exact-length enforcement.
+ * It lives in its own package (not in `pq.ts`) precisely because its primitive is pluggable, not bundled.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FN_DSA_LEAF_DOMAIN = exports.NO_FN_DSA_BACKEND_MESSAGE = exports.FN_DSA_SUITES = exports.FN_DSA_1024_SIGNATURE_BYTES = exports.FN_DSA_1024_PUBLIC_KEY_BYTES = exports.FN_DSA_512_SIGNATURE_BYTES = exports.FN_DSA_512_PUBLIC_KEY_BYTES = void 0;
+exports.isKnownFnDsaAlg = isKnownFnDsaAlg;
+exports.resolveFnDsaAlg = resolveFnDsaAlg;
+exports.isFnDsaVariant = isFnDsaVariant;
+exports.setFalconBackend = setFalconBackend;
+exports.getFalconBackend = getFalconBackend;
+exports.resetFalconBackend = resetFalconBackend;
+exports.fndsaSign = fndsaSign;
+exports.fndsaVerify = fndsaVerify;
+exports.fndsaLeafMessage = fndsaLeafMessage;
+exports.signPcaWithFndsa = signPcaWithFndsa;
+exports.verifyPcaFndsa = verifyPcaFndsa;
+exports.hashKat = hashKat;
+exports.mockKeypair = mockKeypair;
+exports.registerTestBackend = registerTestBackend;
+const pca_1 = require("@atlasauth/pca");
+// ---------------------------------------------------------------------------------------------------
+// FIPS-206 (FN-DSA / Falcon) encoded sizes
+// ---------------------------------------------------------------------------------------------------
+//
+// FN-DSA public keys are a fixed size. Falcon SIGNATURES are natively VARIABLE-LENGTH (the signature's
+// short vector is range/Huffman-"compressed", so the exact byte count depends on the sampled vector).
+// FIPS 206 pins a FIXED "padded" signature encoding per parameter set — the sizes below — so a signature
+// always occupies a constant number of bytes on the wire. PCA uses the PADDED encoding exclusively: it
+// gives deterministic framing and a single exact length to enforce, matching how pq.ts enforces ML-DSA /
+// SLH-DSA lengths. (A backend that produces the compressed variable-length form MUST pad it to these
+// sizes before returning — the standard "sig" vs "sig (padded)" distinction in the reference code.)
+/** FN-DSA-512 (Falcon-512, ~Category 1) public-key size, in bytes. */
+exports.FN_DSA_512_PUBLIC_KEY_BYTES = 897;
+/** FN-DSA-512 padded (FIPS-206 fixed-length) signature size, in bytes. The compressed form averages smaller. */
+exports.FN_DSA_512_SIGNATURE_BYTES = 666;
+/** FN-DSA-1024 (Falcon-1024, ~Category 5) public-key size, in bytes. */
+exports.FN_DSA_1024_PUBLIC_KEY_BYTES = 1793;
+/** FN-DSA-1024 padded (FIPS-206 fixed-length) signature size, in bytes. The compressed form averages smaller. */
+exports.FN_DSA_1024_SIGNATURE_BYTES = 1280;
+const VARIANT_PK_BYTES = Object.freeze({
+    'fn-dsa-512': exports.FN_DSA_512_PUBLIC_KEY_BYTES,
+    'fn-dsa-1024': exports.FN_DSA_1024_PUBLIC_KEY_BYTES,
+});
+const VARIANT_SIG_BYTES = Object.freeze({
+    'fn-dsa-512': exports.FN_DSA_512_SIGNATURE_BYTES,
+    'fn-dsa-1024': exports.FN_DSA_1024_SIGNATURE_BYTES,
+});
+/** The closed FN-DSA suite registry (the FN-DSA parallel of pq.ts's SIG_SUITES). */
+exports.FN_DSA_SUITES = Object.freeze({
+    'fn-dsa-512': {
+        alg: 'fn-dsa-512', variant: 'fn-dsa-512', hasEd25519: false,
+        sigBytes: exports.FN_DSA_512_SIGNATURE_BYTES, needsPqPk: true, pqPkBytes: exports.FN_DSA_512_PUBLIC_KEY_BYTES,
+        needsPqSig: false, pqSigBytes: 0, fnSigBytes: exports.FN_DSA_512_SIGNATURE_BYTES,
+    },
+    'fn-dsa-1024': {
+        alg: 'fn-dsa-1024', variant: 'fn-dsa-1024', hasEd25519: false,
+        sigBytes: exports.FN_DSA_1024_SIGNATURE_BYTES, needsPqPk: true, pqPkBytes: exports.FN_DSA_1024_PUBLIC_KEY_BYTES,
+        needsPqSig: false, pqSigBytes: 0, fnSigBytes: exports.FN_DSA_1024_SIGNATURE_BYTES,
+    },
+    'hybrid-ed25519-fn-dsa-512': {
+        alg: 'hybrid-ed25519-fn-dsa-512', variant: 'fn-dsa-512', hasEd25519: true,
+        sigBytes: pca_1.ED25519_SIGNATURE_BYTES, needsPqPk: true, pqPkBytes: exports.FN_DSA_512_PUBLIC_KEY_BYTES,
+        needsPqSig: true, pqSigBytes: exports.FN_DSA_512_SIGNATURE_BYTES, fnSigBytes: exports.FN_DSA_512_SIGNATURE_BYTES,
+    },
+    'hybrid-ed25519-fn-dsa-1024': {
+        alg: 'hybrid-ed25519-fn-dsa-1024', variant: 'fn-dsa-1024', hasEd25519: true,
+        sigBytes: pca_1.ED25519_SIGNATURE_BYTES, needsPqPk: true, pqPkBytes: exports.FN_DSA_1024_PUBLIC_KEY_BYTES,
+        needsPqSig: true, pqSigBytes: exports.FN_DSA_1024_SIGNATURE_BYTES, fnSigBytes: exports.FN_DSA_1024_SIGNATURE_BYTES,
+    },
+});
+function isKnownFnDsaAlg(x) {
+    return typeof x === 'string' && Object.prototype.hasOwnProperty.call(exports.FN_DSA_SUITES, x);
+}
+/** Resolve an FN-DSA suite by id; `null` (FAIL-CLOSED) for an unknown name or non-string. */
+function resolveFnDsaAlg(alg) {
+    if (isKnownFnDsaAlg(alg))
+        return exports.FN_DSA_SUITES[alg];
+    return null;
+}
+/** Is `v` one of the two pure FN-DSA parameter sets? */
+function isFnDsaVariant(v) {
+    return v === 'fn-dsa-512' || v === 'fn-dsa-1024';
+}
+/** The clear error the default (unregistered) backend raises so misuse FAILS LOUD, not silently. */
+exports.NO_FN_DSA_BACKEND_MESSAGE = 'no FN-DSA backend registered — install @atlasauth/pca-fndsa-node or supply a wasm backend via setFalconBackend()';
+const DEFAULT_BACKEND = Object.freeze({
+    verify() {
+        throw new Error(exports.NO_FN_DSA_BACKEND_MESSAGE);
+    },
+    sign() {
+        throw new Error(exports.NO_FN_DSA_BACKEND_MESSAGE);
+    },
+    keygen() {
+        throw new Error(exports.NO_FN_DSA_BACKEND_MESSAGE);
+    },
+});
+let currentBackend = DEFAULT_BACKEND;
+/** Install the FN-DSA backend that performs the actual Falcon math. */
+function setFalconBackend(backend) {
+    currentBackend = backend;
+}
+/** The currently installed FN-DSA backend (the default throws {@link NO_FN_DSA_BACKEND_MESSAGE}). */
+function getFalconBackend() {
+    return currentBackend;
+}
+/** Restore the default (throwing) backend — mainly for tests and teardown. */
+function resetFalconBackend() {
+    currentBackend = DEFAULT_BACKEND;
+}
+// ---------------------------------------------------------------------------------------------------
+// Primitive-level wrappers (raw bytes) — mirror pq.ts's mlDsa65Sign / mlDsa65Verify
+// ---------------------------------------------------------------------------------------------------
+/**
+ * FN-DSA sign over raw bytes, delegating to the registered backend AFTER enforcing the suite's key/sig
+ * framing. THROWS (fail-loud) when no backend is registered, when the backend is verify-only (no `sign`),
+ * or when the backend returns a signature of the wrong padded length. `sk` must be a non-empty Uint8Array
+ * (its exact encoding is backend-defined, so its length is not pinned here).
+ */
+function fndsaSign(variant, sk, msg) {
+    if (!isFnDsaVariant(variant))
+        throw new RangeError(`fndsaSign: unknown FN-DSA variant '${String(variant)}'`);
+    if (!(sk instanceof Uint8Array) || sk.length === 0)
+        throw new TypeError('fndsaSign: secret key must be a non-empty Uint8Array');
+    if (!(msg instanceof Uint8Array))
+        throw new TypeError('fndsaSign: message must be a Uint8Array');
+    const backend = currentBackend;
+    if (typeof backend.sign !== 'function')
+        throw new Error('fndsaSign: FN-DSA backend is verify-only (no sign())');
+    const sig = backend.sign(sk, msg);
+    const expected = VARIANT_SIG_BYTES[variant];
+    if (!(sig instanceof Uint8Array) || sig.length !== expected) {
+        throw new Error(`fndsaSign: FN-DSA backend returned a ${sig instanceof Uint8Array ? String(sig.length) : 'non-byte'} signature; expected padded ${expected} bytes for '${variant}'`);
+    }
+    return sig;
+}
+/**
+ * FN-DSA verify over raw bytes. The suite's key + signature LENGTHS are enforced HERE, BEFORE the backend
+ * is ever called, so a wrong-length public key or signature is rejected (false) without reaching the
+ * primitive. A registered backend that itself throws is NOT swallowed (fail-loud) — but a wrong-length
+ * input, and the clear "no backend" error, surface as described: length guard returns false; the default
+ * backend throws {@link NO_FN_DSA_BACKEND_MESSAGE} once the length guard has passed.
+ */
+function fndsaVerify(variant, pk, msg, sig) {
+    if (!isFnDsaVariant(variant))
+        return false;
+    if (!(pk instanceof Uint8Array) || pk.length !== VARIANT_PK_BYTES[variant])
+        return false;
+    if (!(sig instanceof Uint8Array) || sig.length !== VARIANT_SIG_BYTES[variant])
+        return false;
+    if (!(msg instanceof Uint8Array))
+        return false;
+    return currentBackend.verify(pk, msg, sig);
+}
+/** The domain separator for the FN-DSA leaf/hop binding suffix. */
+exports.FN_DSA_LEAF_DOMAIN = 'atlas-pca/fn-dsa/leaf/v1\0';
+/**
+ * The exact bytes an FN-DSA leaf/hop signature covers:
+ *
+ *   thresholdMessage(leaf)  ‖  FN_DSA_LEAF_DOMAIN  ‖  utf8(alg)  ‖  0x00  ‖  utf8(pq_pk b64u)
+ *
+ * The leading `thresholdMessage(leaf)` is the IDENTICAL canonical message pq.ts's core leaf signs, so an
+ * FN-DSA signature commits to the whole action. The domain-separated suffix additively BINDS `alg` and
+ * `pq_pk` into the signed bytes — the same downgrade/key-swap protection pq.ts gets by folding `alg` /
+ * `pq_pk` into the canonical body via `bindSuiteFields`, achieved here without mutating the PCActn's typed
+ * shape (FN-DSA is not yet in the `SigAlg` union). In a hybrid both the Ed25519 and FN-DSA halves sign
+ * these same bytes, so each commits to the suite + PQ key.
+ */
+function fndsaLeafMessage(leaf, alg, pqPkB64u) {
+    const base = (0, pca_1.thresholdMessage)(leaf);
+    const suffix = (0, pca_1.utf8)(exports.FN_DSA_LEAF_DOMAIN);
+    const algBytes = (0, pca_1.utf8)(alg);
+    const pkBytes = (0, pca_1.utf8)(pqPkB64u);
+    const out = new Uint8Array(base.length + suffix.length + algBytes.length + 1 + pkBytes.length);
+    let off = 0;
+    out.set(base, off);
+    off += base.length;
+    out.set(suffix, off);
+    off += suffix.length;
+    out.set(algBytes, off);
+    off += algBytes.length;
+    out[off] = 0;
+    off += 1;
+    out.set(pkBytes, off);
+    return out;
+}
+/**
+ * Produce an FN-DSA leaf (or capability-hop) signature for a PCActn, returning the wire fields the
+ * surface carries. Pure FN-DSA: `sig` = FN-DSA signature, `pq_pk` = FN-DSA key. Hybrid: `sig` = Ed25519
+ * signature, `pq_sig` = FN-DSA signature, `pq_pk` = FN-DSA key — both over the SAME leaf message, for
+ * classical + lattice DEFENSE-IN-DEPTH (a forger must break Ed25519 AND Falcon). THROWS fail-closed on an
+ * unknown suite, a wrong-length FN-DSA key, a hybrid suite with no `edSecret`, or a missing/limited backend.
+ */
+function signPcaWithFndsa(input) {
+    const suite = resolveFnDsaAlg(input.alg);
+    if (suite === null)
+        throw new RangeError(`signPcaWithFndsa: unknown FN-DSA alg '${String(input.alg)}'`);
+    if (!(input.fnDsa?.pk instanceof Uint8Array) || input.fnDsa.pk.length !== suite.pqPkBytes) {
+        throw new TypeError(`signPcaWithFndsa: '${suite.alg}' requires a ${suite.pqPkBytes}-byte FN-DSA public key`);
+    }
+    if (!(input.fnDsa.sk instanceof Uint8Array) || input.fnDsa.sk.length === 0) {
+        throw new TypeError(`signPcaWithFndsa: '${suite.alg}' requires FN-DSA secret-key material`);
+    }
+    const pqPkB64u = (0, pca_1.b64u)(input.fnDsa.pk);
+    const msg = fndsaLeafMessage(input.leaf, suite.alg, pqPkB64u);
+    const fnSig = fndsaSign(suite.variant, input.fnDsa.sk, msg);
+    if (!suite.hasEd25519) {
+        // Pure FN-DSA: the FN-DSA signature IS the primary `sig`.
+        return { sig: (0, pca_1.b64u)(fnSig), alg: suite.alg, pq_pk: pqPkB64u };
+    }
+    // Hybrid ed25519 + fn-dsa: `sig` = Ed25519 over `msg`, `pq_sig` = FN-DSA over `msg`.
+    if (!(input.edSecret instanceof Uint8Array)) {
+        throw new TypeError(`signPcaWithFndsa: '${suite.alg}' requires edSecret (Ed25519 leaf-holder secret key)`);
+    }
+    return { sig: (0, pca_1.b64u)((0, pca_1.sign)(input.edSecret, msg)), alg: suite.alg, pq_pk: pqPkB64u, pq_sig: (0, pca_1.b64u)(fnSig) };
+}
+/**
+ * Verify an FN-DSA leaf/hop signature over a PCActn. FAIL-CLOSED and never throws for ordinary wire
+ * faults: an unknown `alg`, a wrong-length/absent key or signature, a tampered action (its
+ * {@link thresholdMessage} changes), or a suite/key downgrade (the binding suffix changes) all return
+ * false. Hybrid requires BOTH the Ed25519 half AND the FN-DSA half. (A registered backend that itself
+ * throws is not caught — that is a backend bug, which should be loud.)
+ */
+function verifyPcaFndsa(input) {
+    const suite = resolveFnDsaAlg(input.alg);
+    if (suite === null)
+        return false; // unknown alg => fail-closed
+    if (typeof input.pq_pk !== 'string')
+        return false;
+    const pk = (0, pca_1.decodeB64uStrict)(input.pq_pk, suite.pqPkBytes);
+    if (pk === null)
+        return false; // wrong-length / non-canonical FN-DSA key — rejected before the backend
+    const msg = fndsaLeafMessage(input.leaf, suite.alg, input.pq_pk);
+    if (!suite.hasEd25519) {
+        // Pure FN-DSA: `sig` holds the FN-DSA signature.
+        if (typeof input.sig !== 'string')
+            return false;
+        const fnSig = (0, pca_1.decodeB64uStrict)(input.sig, suite.sigBytes);
+        if (fnSig === null)
+            return false; // wrong-length FN-DSA sig — rejected before the backend
+        return fndsaVerify(suite.variant, pk, msg, fnSig);
+    }
+    // Hybrid: Ed25519 `sig` under `holder` AND FN-DSA `pq_sig` under `pq_pk`, both over `msg`.
+    if (typeof input.holder !== 'string' || typeof input.sig !== 'string')
+        return false;
+    const edSig = (0, pca_1.decodeB64uStrict)(input.sig, suite.sigBytes); // enforce 64-byte Ed25519 sig
+    if (edSig === null)
+        return false;
+    const edOk = (0, pca_1.verifyB64u)(input.holder, msg, input.sig);
+    if (typeof input.pq_sig !== 'string')
+        return false;
+    const fnSig = (0, pca_1.decodeB64uStrict)(input.pq_sig, suite.pqSigBytes);
+    if (fnSig === null)
+        return false;
+    const pqOk = fndsaVerify(suite.variant, pk, msg, fnSig);
+    return edOk && pqOk; // fail-closed: BOTH required
+}
+/** Tag prefixed to a MOCK secret key so the mock can recover the public key from it (mock-only encoding). */
+const MOCK_SK_TAG = (0, pca_1.utf8)('atlas-pca/fn-dsa/mock-sk/v1\0');
+function concatBytes(...parts) {
+    let total = 0;
+    for (const p of parts)
+        total += p.length;
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.length;
+    }
+    return out;
+}
+function u32be(n) {
+    const b = new Uint8Array(4);
+    b[0] = (n >>> 24) & 0xff;
+    b[1] = (n >>> 16) & 0xff;
+    b[2] = (n >>> 8) & 0xff;
+    b[3] = n & 0xff;
+    return b;
+}
+/**
+ * Deterministic SHA-256 counter-mode stretch of `seed` to exactly `outLen` bytes. This is the mock/KAT
+ * key-derivation and signature-derivation function — NOT Falcon. It exists only so the wire framing and
+ * length enforcement are testable with reproducible, fixed-length byte strings.
+ */
+function hashKat(seed, outLen) {
+    const out = new Uint8Array(outLen);
+    let off = 0;
+    let counter = 0;
+    while (off < outLen) {
+        const block = (0, pca_1.sha256)(concatBytes(seed, u32be(counter)));
+        const take = Math.min(block.length, outLen - off);
+        out.set(block.subarray(0, take), off);
+        off += take;
+        counter += 1;
+    }
+    return out;
+}
+function sigLenForPk(pkLen) {
+    if (pkLen === exports.FN_DSA_512_PUBLIC_KEY_BYTES)
+        return exports.FN_DSA_512_SIGNATURE_BYTES;
+    if (pkLen === exports.FN_DSA_1024_PUBLIC_KEY_BYTES)
+        return exports.FN_DSA_1024_SIGNATURE_BYTES;
+    return null;
+}
+/** The mock's deterministic `(pk, msg) -> sig` derivation, padded to the variant's fixed length. */
+function deriveMockSig(pk, msg) {
+    const sigLen = sigLenForPk(pk.length);
+    if (sigLen === null)
+        return null;
+    return hashKat(concatBytes((0, pca_1.utf8)('fn-dsa/mock-sig/v1\0'), pk, msg), sigLen);
+}
+function katKey(pk, msg) {
+    return `${(0, pca_1.b64u)(pk)}|${(0, pca_1.b64u)(msg)}`;
+}
+/** Constant-time byte-equality (no early return on the first differing byte). */
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    }
+    return diff === 0;
+}
+/**
+ * Deterministically mint a MOCK FN-DSA key pair for a variant (NOT real Falcon keys). The secret key is
+ * `MOCK_SK_TAG ‖ pk` so the mock backend's `sign` can recover the public key from it; the public key is a
+ * reproducible stretch of `seed` to the variant's exact length, so a given `seed` always yields the same
+ * pair (handy for stable KAT fixtures).
+ */
+function mockKeypair(variant, seed = 'default') {
+    if (!isFnDsaVariant(variant))
+        throw new RangeError(`mockKeypair: unknown FN-DSA variant '${String(variant)}'`);
+    const seedBytes = typeof seed === 'string' ? (0, pca_1.utf8)(`${variant}/${seed}`) : concatBytes((0, pca_1.utf8)(`${variant}/`), seed);
+    const pk = hashKat(seedBytes, VARIANT_PK_BYTES[variant]);
+    const sk = concatBytes(MOCK_SK_TAG, pk);
+    return { pk, sk };
+}
+function pkFromMockSk(sk) {
+    if (sk.length <= MOCK_SK_TAG.length)
+        return null;
+    if (!timingSafeEqual(sk.subarray(0, MOCK_SK_TAG.length), MOCK_SK_TAG))
+        return null;
+    return sk.subarray(MOCK_SK_TAG.length);
+}
+/**
+ * Install a DETERMINISTIC mock FN-DSA backend (and return it) so the wire format, PCA integration and
+ * length enforcement can be tested WITHOUT the real Falcon math. The backend is keyed by `(pk, msg) -> sig`:
+ *   - any explicit `vectors` take precedence (drop in real FIPS-206 known-answer vectors here);
+ *   - otherwise `(pk, msg)` maps to a reproducible {@link deriveMockSig}, so sign/verify round-trip.
+ * `keygen()` returns an `fn-dsa-512` {@link mockKeypair} by default; use {@link mockKeypair} directly for a
+ * specific variant. This is a TEST double — never register it in production (register a vetted backend).
+ */
+function registerTestBackend(vectors) {
+    const table = new Map();
+    if (vectors) {
+        for (const v of vectors)
+            table.set(katKey(v.pk, v.msg), v.sig);
+    }
+    const backend = {
+        verify(pk, msg, sig) {
+            const fromTable = table.get(katKey(pk, msg));
+            const expected = fromTable ?? deriveMockSig(pk, msg);
+            if (expected === null)
+                return false;
+            return timingSafeEqual(sig, expected);
+        },
+        sign(sk, msg) {
+            const pk = pkFromMockSk(sk);
+            if (pk === null)
+                throw new Error('mock FN-DSA backend: secret key was not minted by mockKeypair()');
+            const fromTable = table.get(katKey(pk, msg));
+            if (fromTable)
+                return fromTable;
+            const derived = deriveMockSig(pk, msg);
+            if (derived === null)
+                throw new Error('mock FN-DSA backend: public key length matches no FN-DSA variant');
+            return derived;
+        },
+        keygen() {
+            return mockKeypair('fn-dsa-512');
+        },
+    };
+    setFalconBackend(backend);
+    return backend;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AA4GH,0CAEC;AAGD,0CAGC;AAGD,wCAEC;AAmDD,4CAEC;AAGD,4CAEC;AAGD,gDAEC;AAYD,8BAYC;AASD,kCAMC;AAwCD,4CAaC;AAqBD,4CAsBC;AAyBD,wCAyBC;AA2CD,0BAYC;AAmCD,kCAMC;AAgBD,kDA2BC;AA1fD,wCAWwB;AAExB,sGAAsG;AACtG,2CAA2C;AAC3C,sGAAsG;AACtG,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,yGAAyG;AACzG,uGAAuG;AACvG,yGAAyG;AACzG,qGAAqG;AACrG,oGAAoG;AAEpG,sEAAsE;AACzD,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAC/C,gHAAgH;AACnG,QAAA,0BAA0B,GAAG,GAAG,CAAC;AAC9C,wEAAwE;AAC3D,QAAA,4BAA4B,GAAG,IAAI,CAAC;AACjD,iHAAiH;AACpG,QAAA,2BAA2B,GAAG,IAAI,CAAC;AAyChD,MAAM,gBAAgB,GAA2C,MAAM,CAAC,MAAM,CAAC;IAC7E,YAAY,EAAE,mCAA2B;IACzC,aAAa,EAAE,oCAA4B;CAC5C,CAAC,CAAC;AACH,MAAM,iBAAiB,GAA2C,MAAM,CAAC,MAAM,CAAC;IAC9E,YAAY,EAAE,kCAA0B;IACxC,aAAa,EAAE,mCAA2B;CAC3C,CAAC,CAAC;AAEH,oFAAoF;AACvE,QAAA,aAAa,GAAwD,MAAM,CAAC,MAAM,CAAC;IAC9F,YAAY,EAAE;QACZ,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK;QAC3D,QAAQ,EAAE,kCAA0B,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,mCAA2B;QAC7F,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,kCAA0B;KACzE;IACD,aAAa,EAAE;QACb,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK;QAC7D,QAAQ,EAAE,mCAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,oCAA4B;QAC/F,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,mCAA2B;KAC1E;IACD,2BAA2B,EAAE;QAC3B,GAAG,EAAE,2BAA2B,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI;QACzE,QAAQ,EAAE,6BAAuB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,mCAA2B;QAC1F,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,kCAA0B,EAAE,UAAU,EAAE,kCAA0B;KACjG;IACD,4BAA4B,EAAE;QAC5B,GAAG,EAAE,4BAA4B,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI;QAC3E,QAAQ,EAAE,6BAAuB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,oCAA4B;QAC3F,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,mCAA2B,EAAE,UAAU,EAAE,mCAA2B;KACnG;CACF,CAAC,CAAC;AAEH,SAAgB,eAAe,CAAC,CAAU;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,qBAAa,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,6FAA6F;AAC7F,SAAgB,eAAe,CAAC,GAAY;IAC1C,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,qBAAa,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,SAAgB,cAAc,CAAC,CAAU;IACvC,OAAO,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,aAAa,CAAC;AACnD,CAAC;AAgCD,oGAAoG;AACvF,QAAA,yBAAyB,GACpC,kHAAkH,CAAC;AAErH,MAAM,eAAe,GAAkB,MAAM,CAAC,MAAM,CAAC;IACnD,MAAM;QACJ,MAAM,IAAI,KAAK,CAAC,iCAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI;QACF,MAAM,IAAI,KAAK,CAAC,iCAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM;QACJ,MAAM,IAAI,KAAK,CAAC,iCAAyB,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC,CAAC;AAEH,IAAI,cAAc,GAAkB,eAAe,CAAC;AAEpD,uEAAuE;AACvE,SAAgB,gBAAgB,CAAC,OAAsB;IACrD,cAAc,GAAG,OAAO,CAAC;AAC3B,CAAC;AAED,qGAAqG;AACrG,SAAgB,gBAAgB;IAC9B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,SAAgB,kBAAkB;IAChC,cAAc,GAAG,eAAe,CAAC;AACnC,CAAC;AAED,sGAAsG;AACtG,oFAAoF;AACpF,sGAAsG;AAEtG;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,OAAqB,EAAE,EAAc,EAAE,GAAe;IAC9E,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,sCAAsC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7G,IAAI,CAAC,CAAC,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAChI,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,cAAc,CAAC;IAC/B,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAChH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,+BAA+B,QAAQ,eAAe,OAAO,GAAG,CAAC,CAAC;IACvL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,OAAqB,EAAE,EAAc,EAAE,GAAe,EAAE,GAAe;IACjG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC,CAAC,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAyBD,mEAAmE;AACtD,QAAA,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,IAAyB,EAAE,GAAgB,EAAE,QAAgB;IAC5F,MAAM,IAAI,GAAG,IAAA,sBAAgB,EAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAA,UAAI,EAAC,0BAAkB,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAA,UAAI,EAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAA,UAAI,EAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/F,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;IACvC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC;IAC/C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,GAAG,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAcD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxG,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1F,MAAM,IAAI,SAAS,CAAC,sBAAsB,KAAK,CAAC,GAAG,gBAAgB,KAAK,CAAC,SAAS,yBAAyB,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,SAAS,CAAC,sBAAsB,KAAK,CAAC,GAAG,uCAAuC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,UAAI,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAE5D,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,0DAA0D;QAC1D,OAAO,EAAE,GAAG,EAAE,IAAA,UAAI,EAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC/D,CAAC;IACD,qFAAqF;IACrF,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,YAAY,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,sBAAsB,KAAK,CAAC,GAAG,sDAAsD,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAA,UAAI,EAAC,IAAA,UAAI,EAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,UAAI,EAAC,KAAK,CAAC,EAAE,CAAC;AACxG,CAAC;AAkBD;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,6BAA6B;IAC/D,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,EAAE,GAAG,IAAA,sBAAgB,EAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,wEAAwE;IACvG,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,iDAAiD;QACjD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,KAAK,GAAG,IAAA,sBAAgB,EAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,wDAAwD;QAC1F,OAAO,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,2FAA2F;IAC3F,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpF,MAAM,KAAK,GAAG,IAAA,sBAAgB,EAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,8BAA8B;IACzF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,gBAAU,EAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,sBAAgB,EAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,6BAA6B;AACpD,CAAC;AAcD,6GAA6G;AAC7G,MAAM,WAAW,GAAG,IAAA,UAAI,EAAC,+BAA+B,CAAC,CAAC;AAE1D,SAAS,WAAW,CAAC,GAAG,KAAmB;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,OAAO,CAAC,IAAgB,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,GAAG,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,YAAM,EAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,IAAI,IAAI,CAAC;QACZ,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,KAAK,mCAA2B;QAAE,OAAO,kCAA0B,CAAC;IAC7E,IAAI,KAAK,KAAK,oCAA4B;QAAE,OAAO,mCAA2B,CAAC;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CAAC,EAAc,EAAE,GAAe;IACpD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,OAAO,CAAC,WAAW,CAAC,IAAA,UAAI,EAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,MAAM,CAAC,EAAc,EAAE,GAAe;IAC7C,OAAO,GAAG,IAAA,UAAI,EAAC,EAAE,CAAC,IAAI,IAAA,UAAI,EAAC,GAAG,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,OAAqB,EAAE,OAA4B,SAAS;IACtF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,wCAAwC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/G,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,UAAI,EAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAA,UAAI,EAAC,GAAG,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACjH,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,EAAc;IAClC,IAAI,EAAE,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,OAAO,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,OAA8B;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAkB;QAC7B,MAAM,CAAC,EAAc,EAAE,GAAe,EAAE,GAAe;YACrD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,SAAS,IAAI,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,EAAc,EAAE,GAAe;YAClC,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACpG,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YAC1G,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM;YACJ,OAAO,WAAW,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,33 @@
 {
   "name": "@atlasauth/pca-fndsa",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "FN-DSA / Falcon (FIPS 206 draft) suite for PCA: register the compact PQ signature suite in the crypto-agility seam with a pluggable, vetted verify backend (a constant-time Falcon is not safely hand-rolled in TS) — wire format, suite ids, and KAT-driven integration tests.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@atlasauth/pca": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.