@e-sig/core 0.5.0 → 0.6.0

package/README.md

@@ -15,6 +15,7 @@ Given an HTML document and a person who wants to sign it, this library:
 2. Generates or reuses a self-signed RSA-2048 X.509 cert for the signing tenant.
 3. Embeds a PKCS#7 detached signature under the **ETSI.CAdES.detached** subfilter, with the ESS **signing-certificate-v2** attribute binding the signer cert into the signed data. Pass `padesStrict: true` for strict **PAdES B-B** (also drops the PAdES-forbidden `signing-time` attribute).
 4. Produces a PDF that opens cleanly in Preview / Adobe Reader with a valid signature panel — any post-signing edit invalidates the signature. `verifyPdfSignature()` checks this cryptographically (recomputes the digest over the signed ByteRange and RSA-verifies the signature).
+5. *(Optional)* Adds a **post-quantum hybrid seal** — **Ed25519 + ML-DSA-65 (FIPS 204)** — embedded under the classical signature so the PDF stays Acrobat-valid while gaining quantum resistance. See [Post-quantum seal](#post-quantum-seal--ml-dsa-65-fips-204).
 
 > **Trust vs. validity.** The signature is cryptographically *valid*, but the cert is *self-issued* — stock Adobe Reader shows "validity unknown" until the cert is trusted (org trust-store import, or plug in an AATL/CA signer). This verifies the signature math and integrity, not third-party trust. See the compliance notes below.
 
@@ -45,6 +46,10 @@ The library gives you **crypto + rendering**. You bring **persistence + UI + aut
 | `render-pdf.ts` | HTML → PDF via puppeteer-core; auto-detects Lambda vs local Chrome | ✅ |
 | `sign-pdf.ts` | Combine placeholder injection + PKCS#7 sign (ETSI.CAdES) | ✅ |
 | `verify-pdf.ts` | Structural verifier (parses /ByteRange + PKCS#7 blob, returns diagnostics) | ✅ |
+| `pq-seal.ts` | Hybrid **Ed25519 + ML-DSA-65 (FIPS 204)** post-quantum seal — keygen, sign, verify | ✅ |
+| `pq-embed.ts` | Embed/extract the seal in a PDF as an append-only incremental update | ✅ |
+| `pq-verify.ts` | `verifyPqSeal` + `verifyDocument` (classical **and** post-quantum verdict) | ✅ |
+| `pq-lifecycle.ts` | `ensureActivePqKeys` / `rotatePqKeys` over a bring-your-own `PqKeyStore` | ✅ |
 | `signature-block.ts` | HTML helper to render N signature blocks for multi-party flows | ✅ |
 | `types.ts` | Shared TS types (`Signer`, `SigningCertPem`, …) | ✅ |
 | `index.ts` | Public re-export barrel | ✅ |
@@ -187,6 +192,93 @@ See `CONSUMING.md` for the full consumer guide.
 
 ---
 
+## Post-quantum seal — ML-DSA-65 (FIPS 204)
+
+Harvest-now-decrypt-later is a real threat to long-lived signed documents: a
+signature that is only RSA/ECDSA today is forgeable the day a cryptographically
+relevant quantum computer exists. `@e-sig/core` can add a **hybrid post-quantum
+seal** — **Ed25519 + ML-DSA-65** (the FIPS 204 module-lattice signature, née
+Dilithium) — to any signed PDF, without giving up compatibility.
+
+**How it stays compatible:** the seal does **not** replace the PKCS#7/PAdES RSA
+signature (no mainstream PDF reader validates ML-DSA in PAdES yet). The seal is
+embedded *first*, as an append-only incremental update, and the classical RSA
+signature is applied on top — so it **cryptographically covers the seal**. Adobe
+Acrobat still shows a valid signature; your verifier additionally confirms the
+quantum-resistant layer. This is the hybrid migration path NIST/CNSA 2.0 
+recommend over a hard cutover.
+
+```ts
+import {
+  generateSelfSignedCert,
+  generatePqKeyBundle,
+  loadPqSigningKeys,
+  signPdf,
+  verifyDocument,
+} from "@e-sig/core";
+
+const cert = generateSelfSignedCert({ subjectName: "Acme Corp" });
+
+// One hybrid key bundle per signer/tenant (persist wrapPqKeyBundle(...) at rest;
+// or use ensureActivePqKeys with a PqKeyStore — see below).
+const pqKeys = loadPqSigningKeys(generatePqKeyBundle().bundle);
+
+const { signedPdf } = await signPdf({
+  pdf: unsigned,
+  keyPem: cert.keyPem,
+  certPem: cert.certPem,
+  reason: "Service Agreement acceptance",
+  location: "",
+  contactInfo: "jane@example.com",
+  name: "Jane Doe",
+  pqSeal: { keys: pqKeys },   // ← adds the post-quantum seal
+});
+
+// One call, two verdicts:
+const v = verifyDocument(signedPdf);
+console.log("classical (PAdES/RSA):", v.classical.ok);          // → true (Acrobat-grade)
+console.log("post-quantum (ML-DSA-65):", v.postQuantum.ok);     // → true
+console.log("PQ signer fingerprint:", v.postQuantum.mldsa65Fpr);
+// v.ok === true only when BOTH layers verify AND the seal lies inside the
+// RSA-signed region. Tampering with one byte of the document fails BOTH.
+```
+
+**Managed keys.** `ensureActivePqKeys({ store, tenantId, passphrase })` mints +
+wraps a bundle on first use and reuses it thereafter (implement the small
+`PqKeyStore` interface against your DB, same pattern as `CertStore`);
+`rotatePqKeys(...)` rolls to a fresh key while old documents keep verifying
+against the public key embedded in each seal. `signDocument({ pq: { keys } })`
+threads it through the end-to-end orchestrator and records the PQ key id +
+ML-DSA fingerprint in the audit row.
+
+**Trust model (v1).** The seal carries the raw ML-DSA-65 public key + its
+SHA-256 fingerprint; a relying party pins/publishes the expected fingerprint
+(TOFU). Assert it in-band:
+
+```ts
+verifyDocument(signedPdf, {
+  expectedMldsa65Fpr: "<the signer's published fingerprint>", // fails if it differs
+  requirePq: true,                                            // fails if no seal present (no silent downgrade)
+});
+```
+
+**X.509 identity (RFC 9881).** For an enterprise-shaped identity, issue a
+self-signed **ML-DSA-65 X.509 certificate** (OID `2.16.840.1.101.3.4.3.18`) —
+its SubjectPublicKeyInfo *and* signature are ML-DSA-65, so it parses and verifies
+in OpenSSL 3.5+ (validated against 3.6). Bind it to a seal at verify time:
+
+```ts
+const cert = issueMlDsaCertificate({ keys, subjectName: "Acme Inc" }); // publish cert.certPem
+verifyDocument(signedPdf, { signerCert: cert.certPem }); // fails unless the cert is valid AND owns the seal's key
+```
+
+`verifyMlDsaCertificate()` checks the self-signature, algorithm, and validity
+window; `certMatchesPqSeal()` ties it to a seal by public-key fingerprint. Both
+seal signatures are required — if either Ed25519 **or** ML-DSA-65 fails (or the
+seal's `fingerprint`/`keyId` don't match its keys), the seal fails.
+
+---
+
 ## Persisting certs + audit logs across requests
 
 For real usage you need to:

package/dist/index.d.ts

@@ -9,4 +9,9 @@ export type { StoredCert, CertStore, AuditLogEntry, AuditLogRow, AuditLogStore,
 export { ensureActiveCert, type EnsureCertResult } from "./cert-lifecycle.js";
 export { createEnvelope, resolveSigningToken, recordSignature, declineEnvelope, voidEnvelope, composeEnvelopeHtml, EnvelopeError, type Envelope, type EnvelopeSigner, type EnvelopeStatus, type EnvelopeSignerStatus, type EnvelopeStore, type CreateEnvelopeInput, type CreateEnvelopeResult, type TokenResolution, } from "./envelope.js";
 export { signDocument, type SignDocumentInput, type SignDocumentResult, } from "./sign-document.js";
+export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, type PqKeyBundle, type PqPublicMaterial, type PqSigningKeys, type PqSeal, type PqSealVerification, type BuildPqSealInput, } from "./pq-seal.js";
+export { embedPqSeal, extractPqSeal, hasPqSeal } from "./pq-embed.js";
+export { verifyPqSeal, verifyDocument, type PqSealVerdict, type DocumentVerification, type VerifyPqSealOptions, type VerifyDocumentOptions, } from "./pq-verify.js";
+export { ensureActivePqKeys, rotatePqKeys, type PqKeyStore, type StoredPqKeys, type EnsurePqKeysResult, } from "./pq-lifecycle.js";
+export { issueMlDsaCertificate, parseMlDsaCertificate, verifyMlDsaCertificate, certMatchesPqSeal, ID_ML_DSA_65, type IssueMlDsaCertOptions, type MlDsaCertificate, type ParsedMlDsaCertificate, type MlDsaCertVerdict, } from "./pq-cert.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -20,4 +20,10 @@ export { ensureActiveCert } from "./cert-lifecycle.js";
 export { createEnvelope, resolveSigningToken, recordSignature, declineEnvelope, voidEnvelope, composeEnvelopeHtml, EnvelopeError, } from "./envelope.js";
 // ---- End-to-end orchestrator ----
 export { signDocument, } from "./sign-document.js";
+// ---- Post-quantum hybrid seal (Ed25519 + ML-DSA-65, FIPS 204) ----
+export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, } from "./pq-seal.js";
+export { embedPqSeal, extractPqSeal, hasPqSeal } from "./pq-embed.js";
+export { verifyPqSeal, verifyDocument, } from "./pq-verify.js";
+export { ensureActivePqKeys, rotatePqKeys, } from "./pq-lifecycle.js";
+export { issueMlDsaCertificate, parseMlDsaCertificate, verifyMlDsaCertificate, certMatchesPqSeal, ID_ML_DSA_65, } from "./pq-cert.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAEhF,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAyC,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAmBxB,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,GASd,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAEhF,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAyC,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAmBxB,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,GASd,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,WAAW,GAOZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,GAKf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,GAKb,MAAM,cAAc,CAAC"}

package/dist/pq-cert.d.ts

@@ -0,0 +1,76 @@
+import type { PqSigningKeys, PqSeal } from "./pq-seal.js";
+/** RFC 9881 / NIST: id-ml-dsa-65. Used for BOTH the SPKI alg and the cert signature alg. */
+export declare const ID_ML_DSA_65: "2.16.840.1.101.3.4.3.18";
+export interface IssueMlDsaCertOptions {
+    /** The signing keys — the ML-DSA-65 keypair is both subject and issuer (self-signed). */
+    keys: PqSigningKeys;
+    /** Subject CN / O seed. ASCII-only (matches cert-issuer's node-forge round-trip guard). */
+    subjectName: string;
+    /** Validity window in days. Default 365. */
+    validityDays?: number;
+    /** Optional 16-byte serial; a CSPRNG positive serial is generated otherwise. */
+    serial?: Uint8Array;
+    /** Backdate notBefore by this many seconds to tolerate clock skew. Default 0. */
+    notBefore?: Date;
+}
+export interface MlDsaCertificate {
+    certPem: string;
+    certDer: Uint8Array;
+    /** SHA-256 hex of the DER-encoded certificate. */
+    fingerprint: string;
+    /** SHA-256 hex of the raw ML-DSA-65 public key — equals a seal's `keys.mldsa65Fpr`. */
+    publicKeyFingerprint: string;
+    notBefore: Date;
+    notAfter: Date;
+}
+/**
+ * Issue a self-signed ML-DSA-65 X.509 certificate for the given signing keys.
+ * The certificate's public key is the raw 1952-byte ML-DSA-65 key, and its own
+ * signature is ML-DSA-65 over the TBSCertificate.
+ */
+export declare function issueMlDsaCertificate(opts: IssueMlDsaCertOptions): MlDsaCertificate;
+export interface ParsedMlDsaCertificate {
+    subjectCommonName: string;
+    notBefore: Date;
+    notAfter: Date;
+    /** Raw ML-DSA-65 public key (1952 bytes). */
+    publicKey: Uint8Array;
+    /** SHA-256 hex of `publicKey` — compare to a seal's `keys.mldsa65Fpr`. */
+    publicKeyFingerprint: string;
+    /** signatureAlgorithm OID (must be ID_ML_DSA_65). */
+    signatureAlgOid: string;
+    /** Exact DER of the TBSCertificate (byte-sliced, not re-encoded) — what the signature covers. */
+    tbsDer: Uint8Array;
+    /** Raw ML-DSA-65 signature (3309 bytes). */
+    signature: Uint8Array;
+}
+/**
+ * Parse a self-signed ML-DSA-65 certificate. The TBS bytes are recovered by a
+ * raw TLV slice of the original DER (never re-encoded), so signature
+ * verification is over the exact signed bytes.
+ */
+export declare function parseMlDsaCertificate(cert: string | Uint8Array): ParsedMlDsaCertificate;
+export interface MlDsaCertVerdict {
+    ok: boolean;
+    /** signatureAlgorithm is id-ml-dsa-65. */
+    algOk: boolean;
+    /** The ML-DSA-65 self-signature over the TBS verifies against the cert's own public key. */
+    selfSignatureOk: boolean;
+    /** `now` is within [notBefore, notAfter]. */
+    timeValid: boolean;
+    failures: string[];
+}
+/**
+ * Verify a self-signed ML-DSA-65 certificate: correct algorithm, the self
+ * signature validates against the embedded public key, and it is within its
+ * validity window. Never throws.
+ */
+export declare function verifyMlDsaCertificate(cert: string | Uint8Array, now?: Date): MlDsaCertVerdict;
+/**
+ * Bind a certificate to a post-quantum seal: the cert must be valid AND its
+ * public key must be the one that produced the seal (fingerprint match). This
+ * is how a relying party upgrades from raw-fingerprint pinning to an X.509
+ * identity without changing the seal format.
+ */
+export declare function certMatchesPqSeal(cert: string | Uint8Array, seal: PqSeal, now?: Date): boolean;
+//# sourceMappingURL=pq-cert.d.ts.map

package/dist/pq-cert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-cert.d.ts","sourceRoot":"","sources":["../src/pq-cert.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE1D,4FAA4F;AAC5F,eAAO,MAAM,YAAY,EAAG,yBAAkC,CAAC;AAoF/D,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,IAAI,EAAE,aAAa,CAAC;IACpB,2FAA2F;IAC3F,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,iFAAiF;IACjF,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,CA8EnF;AAwCD,MAAM,WAAW,sBAAsB;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC;IACf,6CAA6C;IAC7C,SAAS,EAAE,UAAU,CAAC;IACtB,0EAA0E;IAC1E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,MAAM,EAAE,UAAU,CAAC;IACnB,4CAA4C;IAC5C,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,sBAAsB,CA2CvF;AAcD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,0CAA0C;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,4FAA4F;IAC5F,eAAe,EAAE,OAAO,CAAC;IACzB,6CAA6C;IAC7C,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,GAAE,IAAiB,GAAG,gBAAgB,CAmC1G;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAK1G"}

package/dist/pq-cert.js

@@ -0,0 +1,295 @@
+// src/pq-cert.ts
+//
+// Self-signed ML-DSA-65 X.509 certificate (RFC 9881).
+//
+// The raw-key TOFU identity (pq-seal) is enough to pin a signer, but enterprise
+// relying parties expect an X.509 container: a human-readable subject bound to a
+// public key by a signature. This issues a self-signed certificate whose
+// SubjectPublicKeyInfo AND signatureAlgorithm are id-ml-dsa-65
+// (2.16.840.1.101.3.4.3.18), per RFC 9881 — parseable by OpenSSL 3.5+ and
+// self-verifying with the same ML-DSA-65 primitive the seal uses.
+//
+// The cert does NOT add a root of trust (it is self-signed — still TOFU on the
+// key), but it upgrades the identity from an opaque fingerprint to a portable,
+// standards-shaped assertion "CN=<subject> controls this ML-DSA-65 key", which
+// `certMatchesPqSeal` ties back to a seal by public-key fingerprint.
+import forge from "node-forge";
+import crypto from "node:crypto";
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+/** RFC 9881 / NIST: id-ml-dsa-65. Used for BOTH the SPKI alg and the cert signature alg. */
+export const ID_ML_DSA_65 = "2.16.840.1.101.3.4.3.18";
+const MLDSA65_PUBLIC_LEN = 1952;
+const MLDSA65_SIGNATURE_LEN = 3309;
+const OID_COMMON_NAME = "2.5.4.3";
+const OID_ORG_NAME = "2.5.4.10";
+const OID_BASIC_CONSTRAINTS = "2.5.29.19";
+const OID_KEY_USAGE = "2.5.29.15";
+const DEFAULT_VALIDITY_DAYS = 365;
+const asn1 = forge.asn1;
+const { Class, Type } = asn1;
+// ---------- binary <-> Uint8Array (node-forge speaks binary strings) ----------
+function u8ToBin(u8) {
+    let s = "";
+    for (let i = 0; i < u8.length; i++)
+        s += String.fromCharCode(u8[i]);
+    return s;
+}
+function binToU8(bin) {
+    const u8 = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        u8[i] = bin.charCodeAt(i) & 0xff;
+    return u8;
+}
+function sha256Hex(bytes) {
+    return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+// ---------- ASN.1 builders ----------
+function oidNode(oid) {
+    return asn1.create(Class.UNIVERSAL, Type.OID, false, asn1.oidToDer(oid).getBytes());
+}
+/** AlgorithmIdentifier for ML-DSA: SEQUENCE { OID } — parameters field ABSENT (RFC 9881 §4). */
+function mlDsaAlgId() {
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [oidNode(ID_ML_DSA_65)]);
+}
+/** DER BIT STRING with 0 unused bits wrapping raw bytes (keys, signatures). */
+function bitStringNode(bytes) {
+    return asn1.create(Class.UNIVERSAL, Type.BITSTRING, false, String.fromCharCode(0x00) + u8ToBin(bytes));
+}
+function utf8Node(value) {
+    return asn1.create(Class.UNIVERSAL, Type.UTF8, false, forge.util.encodeUtf8(value));
+}
+/** RDNSequence for a CN + O subject. */
+function nameNode(commonName, org) {
+    const rdn = (oid, value) => asn1.create(Class.UNIVERSAL, Type.SET, true, [
+        asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [oidNode(oid), utf8Node(value)]),
+    ]);
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [
+        rdn(OID_COMMON_NAME, commonName),
+        rdn(OID_ORG_NAME, org),
+    ]);
+}
+/** SubjectPublicKeyInfo: SEQUENCE { AlgorithmIdentifier, BIT STRING(raw pubkey) } (RFC 9881). */
+function spkiNode(pub) {
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [mlDsaAlgId(), bitStringNode(pub)]);
+}
+function timeNode(d) {
+    // UTCTime for years < 2050 (RFC 5280 §4.1.2.5), GeneralizedTime beyond.
+    if (d.getUTCFullYear() < 2050) {
+        return asn1.create(Class.UNIVERSAL, Type.UTCTIME, false, asn1.dateToUtcTime(d));
+    }
+    return asn1.create(Class.UNIVERSAL, Type.GENERALIZEDTIME, false, asn1.dateToGeneralizedTime(d));
+}
+/** Extension: SEQUENCE { OID, [critical BOOLEAN], OCTET STRING(DER of value) }. */
+function extensionNode(oid, critical, value) {
+    const children = [oidNode(oid)];
+    if (critical)
+        children.push(asn1.create(Class.UNIVERSAL, Type.BOOLEAN, false, String.fromCharCode(0xff)));
+    children.push(asn1.create(Class.UNIVERSAL, Type.OCTETSTRING, false, asn1.toDer(value).getBytes()));
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, children);
+}
+/**
+ * Issue a self-signed ML-DSA-65 X.509 certificate for the given signing keys.
+ * The certificate's public key is the raw 1952-byte ML-DSA-65 key, and its own
+ * signature is ML-DSA-65 over the TBSCertificate.
+ */
+export function issueMlDsaCertificate(opts) {
+    const { keys, subjectName, validityDays = DEFAULT_VALIDITY_DAYS } = opts;
+    if (!/^[\x20-\x7e]+$/.test(subjectName)) {
+        throw new Error(`subjectName "${subjectName}" contains non-ASCII characters`);
+    }
+    const pub = keys.mldsa65PublicKey;
+    if (pub.length !== MLDSA65_PUBLIC_LEN) {
+        throw new Error(`ML-DSA-65 public key must be ${MLDSA65_PUBLIC_LEN} bytes, got ${pub.length}`);
+    }
+    // Serial: 128 bits CSPRNG, top bit cleared (positive DER INTEGER), nonzero lead.
+    let serial;
+    if (opts.serial) {
+        serial = opts.serial;
+    }
+    else {
+        const s = crypto.randomBytes(16);
+        s[0] = (s[0] & 0x7f) | 0x40;
+        serial = s;
+    }
+    const notBefore = opts.notBefore ?? new Date();
+    const notAfter = new Date(notBefore.getTime() + validityDays * 86_400_000);
+    const cn = `E-sig PQ (${subjectName})`;
+    const name = () => nameNode(cn, subjectName);
+    const version = asn1.create(Class.CONTEXT_SPECIFIC, 0, true, [
+        asn1.create(Class.UNIVERSAL, Type.INTEGER, false, String.fromCharCode(0x02)), // v3
+    ]);
+    const serialNode = asn1.create(Class.UNIVERSAL, Type.INTEGER, false, u8ToBin(serial));
+    const validity = asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [timeNode(notBefore), timeNode(notAfter)]);
+    // basicConstraints (CA:FALSE = empty SEQUENCE) + keyUsage (digitalSignature + nonRepudiation).
+    const basicConstraints = extensionNode(OID_BASIC_CONSTRAINTS, true, asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, []));
+    const keyUsage = extensionNode(OID_KEY_USAGE, true, 
+    // bits 0 (digitalSignature) + 1 (nonRepudiation) set → 0xC0, 6 unused bits.
+    asn1.create(Class.UNIVERSAL, Type.BITSTRING, false, String.fromCharCode(0x06) + String.fromCharCode(0xc0)));
+    const extensions = asn1.create(Class.CONTEXT_SPECIFIC, 3, true, [
+        asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [basicConstraints, keyUsage]),
+    ]);
+    const tbs = asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [
+        version,
+        serialNode,
+        mlDsaAlgId(), // signature algorithm
+        name(), // issuer
+        validity,
+        name(), // subject (self-signed → issuer == subject)
+        spkiNode(pub),
+        extensions,
+    ]);
+    const tbsDer = binToU8(asn1.toDer(tbs).getBytes());
+    const signature = ml_dsa65.sign(tbsDer, keys.mldsa65SecretKey);
+    const certAsn1 = asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [
+        tbs,
+        mlDsaAlgId(),
+        bitStringNode(signature),
+    ]);
+    const certDer = binToU8(asn1.toDer(certAsn1).getBytes());
+    const certPem = derToPem(certDer);
+    return {
+        certPem,
+        certDer,
+        fingerprint: sha256Hex(certDer),
+        publicKeyFingerprint: sha256Hex(pub),
+        notBefore,
+        notAfter,
+    };
+}
+function derToPem(der) {
+    const b64 = Buffer.from(der).toString("base64");
+    const lines = b64.match(/.{1,64}/g) ?? [];
+    return `-----BEGIN CERTIFICATE-----\n${lines.join("\n")}\n-----END CERTIFICATE-----\n`;
+}
+function pemToDer(pem) {
+    const b64 = pem.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, "");
+    return new Uint8Array(Buffer.from(b64, "base64"));
+}
+/** Read one definite-length DER TLV starting at `offset`. */
+function readTlv(der, offset) {
+    if (offset + 1 >= der.length)
+        throw new Error("DER: truncated TLV");
+    const tag = der[offset];
+    let i = offset + 1;
+    let len = der[i++];
+    if (len & 0x80) {
+        const n = len & 0x7f;
+        if (n === 0 || n > 4)
+            throw new Error("DER: unsupported length encoding");
+        len = 0;
+        for (let k = 0; k < n; k++)
+            len = (len << 8) | der[i++];
+    }
+    const contentStart = i;
+    const end = contentStart + len;
+    if (end > der.length)
+        throw new Error("DER: length exceeds buffer");
+    return { tag, start: offset, contentStart, end };
+}
+/**
+ * Parse a self-signed ML-DSA-65 certificate. The TBS bytes are recovered by a
+ * raw TLV slice of the original DER (never re-encoded), so signature
+ * verification is over the exact signed bytes.
+ */
+export function parseMlDsaCertificate(cert) {
+    const der = typeof cert === "string" ? pemToDer(cert) : cert;
+    // Certificate ::= SEQUENCE { tbsCertificate, signatureAlgorithm, signatureValue }
+    const outer = readTlv(der, 0);
+    const tbs = readTlv(der, outer.contentStart);
+    const sigAlg = readTlv(der, tbs.end);
+    const sigVal = readTlv(der, sigAlg.end);
+    const tbsDer = der.slice(tbs.start, tbs.end);
+    // signatureValue is a BIT STRING: first content byte = unused-bits count (0).
+    const signature = der.slice(sigVal.contentStart + 1, sigVal.end);
+    // Human-readable + key fields via node-forge (structure is standard X.509).
+    const parsed = asn1.fromDer(forge.util.createBuffer(u8ToBin(der)));
+    const tbsNode = parsed.value[0];
+    const kids = tbsNode.value;
+    // With explicit version [0], fields are: [0]=version [1]=serial [2]=sigAlg
+    // [3]=issuer [4]=validity [5]=subject [6]=spki [7]=extensions.
+    const validityNode = kids[4];
+    const subjectNode = kids[5];
+    const spkiNode = kids[6];
+    const notBefore = asn1.utcTimeToDate(validityNode.value[0].value);
+    const notAfter = asn1.utcTimeToDate(validityNode.value[1].value);
+    const subjectCommonName = extractCommonName(subjectNode);
+    const spkiKids = spkiNode.value;
+    const algOid = asn1.derToOid(spkiKids[0].value[0].value);
+    const bitStr = spkiKids[1].value; // leading unused-bits byte
+    const publicKey = binToU8(bitStr.slice(1));
+    return {
+        subjectCommonName,
+        notBefore,
+        notAfter,
+        publicKey,
+        publicKeyFingerprint: sha256Hex(publicKey),
+        signatureAlgOid: algOid,
+        tbsDer,
+        signature,
+    };
+}
+function extractCommonName(nameNode) {
+    for (const rdn of nameNode.value) {
+        for (const atv of rdn.value) {
+            const [oidNode, valNode] = atv.value;
+            if (asn1.derToOid(oidNode.value) === OID_COMMON_NAME) {
+                return forge.util.decodeUtf8(valNode.value);
+            }
+        }
+    }
+    return "";
+}
+/**
+ * Verify a self-signed ML-DSA-65 certificate: correct algorithm, the self
+ * signature validates against the embedded public key, and it is within its
+ * validity window. Never throws.
+ */
+export function verifyMlDsaCertificate(cert, now = new Date()) {
+    const failures = [];
+    try {
+        const p = parseMlDsaCertificate(cert);
+        const algOk = p.signatureAlgOid === ID_ML_DSA_65;
+        if (!algOk)
+            failures.push(`unexpected signature algorithm ${p.signatureAlgOid}`);
+        let selfSignatureOk = false;
+        if (p.publicKey.length === MLDSA65_PUBLIC_LEN &&
+            p.signature.length === MLDSA65_SIGNATURE_LEN) {
+            try {
+                selfSignatureOk = ml_dsa65.verify(p.signature, p.tbsDer, p.publicKey);
+            }
+            catch {
+                selfSignatureOk = false;
+            }
+        }
+        if (!selfSignatureOk)
+            failures.push("ML-DSA-65 self-signature invalid");
+        const t = now.getTime();
+        const timeValid = t >= p.notBefore.getTime() && t <= p.notAfter.getTime();
+        if (!timeValid)
+            failures.push("certificate is outside its validity window");
+        return { ok: algOk && selfSignatureOk && timeValid, algOk, selfSignatureOk, timeValid, failures };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            algOk: false,
+            selfSignatureOk: false,
+            timeValid: false,
+            failures: [`certificate parse error: ${e.message}`],
+        };
+    }
+}
+/**
+ * Bind a certificate to a post-quantum seal: the cert must be valid AND its
+ * public key must be the one that produced the seal (fingerprint match). This
+ * is how a relying party upgrades from raw-fingerprint pinning to an X.509
+ * identity without changing the seal format.
+ */
+export function certMatchesPqSeal(cert, seal, now = new Date()) {
+    const verdict = verifyMlDsaCertificate(cert, now);
+    if (!verdict.ok)
+        return false;
+    const p = parseMlDsaCertificate(cert);
+    return p.publicKeyFingerprint === seal.keys.mldsa65Fpr;
+}
+//# sourceMappingURL=pq-cert.js.map

package/dist/pq-cert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-cert.js","sourceRoot":"","sources":["../src/pq-cert.ts"],"names":[],"mappings":"AAAA,iBAAiB;AACjB,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,+DAA+D;AAC/D,0EAA0E;AAC1E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,qEAAqE;AAErE,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAIzD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAkC,CAAC;AAE/D,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAC1C,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;AAE7B,iFAAiF;AAEjF,SAAS,OAAO,CAAC,EAAc;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,OAAO,EAAE,CAAC;AACZ,CAAC;AACD,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,uCAAuC;AAEvC,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,wCAAwC;AACxC,SAAS,QAAQ,CAAC,UAAkB,EAAE,GAAW;IAC/C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE,CACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;KACnF,CAAC,CAAC;IACL,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACvD,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC;QAChC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC;KACvB,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAe;IAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAO;IACvB,wEAAwE;IACxE,IAAI,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,GAAW,EAAE,QAAiB,EAAE,KAAsB;IAC3E,MAAM,QAAQ,GAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1G,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,GAAG,qBAAqB,EAAE,GAAG,IAAI,CAAC;IACzE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,iCAAiC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,kBAAkB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,iFAAiF;IACjF,IAAI,MAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QAC5B,MAAM,GAAG,CAAC,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;IAE3E,MAAM,EAAE,GAAG,aAAa,WAAW,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE;QAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK;KACpF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE9G,+FAA+F;IAC/F,MAAM,gBAAgB,GAAG,aAAa,CACpC,qBAAqB,EACrB,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CACtD,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC5B,aAAa,EACb,IAAI;IACJ,4EAA4E;IAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAC3G,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;KAChF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5D,OAAO;QACP,UAAU;QACV,UAAU,EAAE,EAAE,sBAAsB;QACpC,IAAI,EAAE,EAAE,SAAS;QACjB,QAAQ;QACR,IAAI,EAAE,EAAE,4CAA4C;QACpD,QAAQ,CAAC,GAAG,CAAC;QACb,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjE,GAAG;QACH,UAAU,EAAE;QACZ,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO;QACL,OAAO;QACP,OAAO;QACP,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,SAAS,CAAC,GAAG,CAAC;QACpC,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAWD,6DAA6D;AAC7D,SAAS,OAAO,CAAC,GAAe,EAAE,MAAc;IAC9C,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACnB,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACnB,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1E,GAAG,GAAG,CAAC,CAAC;QACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,YAAY,GAAG,GAAG,CAAC;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7D,kFAAkF;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,KAA0B,CAAC;IAChD,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAE,YAAY,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAE,YAAY,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IAElG,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAA0B,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC,2BAA2B;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,iBAAiB;QACjB,SAAS;QACT,QAAQ;QACR,SAAS;QACT,oBAAoB,EAAE,SAAS,CAAC,SAAS,CAAC;QAC1C,eAAe,EAAE,MAAM;QACvB,MAAM;QACN,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAyB;IAClD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAA0B,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAA0B,EAAE,CAAC;YACjD,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAA0B,CAAC;YAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAe,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyB,EAAE,MAAY,IAAI,IAAI,EAAE;IACtF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,KAAK,GAAG,CAAC,CAAC,eAAe,KAAK,YAAY,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAEjF,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IACE,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB;YACzC,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,qBAAqB,EAC5C,CAAC;YACD,IAAI,CAAC;gBACH,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAExE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1E,IAAI,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAE5E,OAAO,EAAE,EAAE,EAAE,KAAK,IAAI,eAAe,IAAI,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACpG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC,4BAA6B,CAAW,CAAC,OAAO,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAyB,EAAE,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC/F,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,oBAAoB,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;AACzD,CAAC"}

package/dist/pq-embed.d.ts

@@ -0,0 +1,22 @@
+import type { PqSeal } from "./pq-seal.js";
+/**
+ * Append `seal` to `pdf` as an incremental update. Returns the new PDF; the first
+ * `pdf.length` bytes are preserved verbatim, so `seal.coveredBytes` (set by the
+ * caller to `pdf.length`) still points at the original document in the final file.
+ */
+export declare function embedPqSeal(pdf: Buffer, seal: PqSeal): Buffer;
+/**
+ * Extract the embedded seal from a (possibly later-signed) PDF, or null if none
+ * is present / it is not valid JSON. Returns the FIRST seal if several exist.
+ *
+ * FIRST, deliberately: the genuine seal is embedded BEFORE the RSA PAdES
+ * signature, so it sits at the lowest file offset and is covered by the classical
+ * /ByteRange. A seal an attacker appends AFTER signing lands at a higher offset
+ * and is NOT RSA-covered — taking the first match ignores it, so even a standalone
+ * `verifyPqSeal` reports the authentic signer rather than the appended identity.
+ * Never throws — a malformed seal is treated as absent (fail-closed at verify).
+ */
+export declare function extractPqSeal(pdf: Buffer): PqSeal | null;
+/** True if the PDF carries an embedded post-quantum seal. */
+export declare function hasPqSeal(pdf: Buffer): boolean;
+//# sourceMappingURL=pq-embed.d.ts.map

package/dist/pq-embed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-embed.d.ts","sourceRoot":"","sources":["../src/pq-embed.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA+C3C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAiC7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASxD;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG9C"}