@e-sig/core 0.5.0 → 0.6.0

package/dist/pq-embed.js

@@ -0,0 +1,119 @@
+// pq-embed.ts
+//
+// Embed a post-quantum seal (see pq-seal.ts) into a rendered PDF as an
+// append-only incremental update, and extract it back out.
+//
+// WHY append-only: the seal signs SHA-256 of the document bytes it covers
+// (`coveredBytes` = length of the pre-seal PDF, P0). An incremental update never
+// rewrites prior bytes, so in the final signed file P2, the prefix P2[0:coveredBytes]
+// is byte-identical to P0 — the verifier recovers exactly what the seal signed.
+// This ordering (embed seal → THEN apply the RSA PAdES signature) also lets the
+// classical /ByteRange signature cryptographically cover the seal.
+//
+// The incremental update we append is deliberately minimal and mirrors the exact
+// xref/trailer byte layout @signpdf/placeholder-plain expects (it later parses
+// this file to add its own signature layer): one new indirect object holding the
+// base64 seal, one single-subsection classic xref, a trailer that copies the
+// document's /Root (+ /Info) and points /Prev at the previous xref, and a clean
+// `startxref … %%EOF` tail.
+//
+// Retrieval scans for the object's `/Seal(<base64>)` literal. Base64's alphabet
+// (A–Z a–z 0–9 + / =) contains no PDF-string metacharacters, so no escaping is
+// needed and a simple regex is unambiguous. @signpdf never rewrites these bytes,
+// so the seal survives the subsequent signing pass verbatim.
+/** Marker object type; also the retrieval anchor. */
+const SEAL_OBJ_TYPE = "ESigPQSeal";
+const SEAL_EXTRACT_RE = new RegExp(`/Type\\s*/${SEAL_OBJ_TYPE}/V\\s+1/Seal\\(([A-Za-z0-9+/=]+)\\)`, "g");
+/**
+ * Parse the most recent classic trailer to recover the fields our incremental
+ * update must carry forward: /Root, optional /Info, /Size (→ next free object
+ * number), and the last xref offset (→ our /Prev). Throws with a clear message
+ * on xref-stream PDFs, which the whole signing pipeline (@signpdf included)
+ * doesn't support anyway.
+ */
+function readLastTrailer(pdf) {
+    const text = pdf.toString("latin1"); // 1 byte ↔ 1 char, so string index === byte offset
+    const sxIdx = text.lastIndexOf("startxref");
+    if (sxIdx < 0)
+        throw new Error("pq-embed: no startxref found (not a classic PDF)");
+    const prevMatch = text.slice(sxIdx + "startxref".length).match(/\d+/);
+    if (!prevMatch)
+        throw new Error("pq-embed: could not read previous startxref offset");
+    const prevStartxref = parseInt(prevMatch[0], 10);
+    const trIdx = text.lastIndexOf("trailer");
+    if (trIdx < 0 || trIdx > sxIdx) {
+        throw new Error("pq-embed: classic trailer not found (xref-stream PDFs are unsupported)");
+    }
+    const dict = text.slice(trIdx, sxIdx);
+    const root = dict.match(/\/Root\s+(\d+\s+\d+\s+R)/);
+    const info = dict.match(/\/Info\s+(\d+\s+\d+\s+R)/);
+    const size = dict.match(/\/Size\s+(\d+)/);
+    if (!root)
+        throw new Error("pq-embed: trailer has no /Root");
+    if (!size)
+        throw new Error("pq-embed: trailer has no /Size");
+    return {
+        rootRef: root[1].replace(/\s+/g, " "),
+        infoRef: info?.[1].replace(/\s+/g, " "),
+        size: parseInt(size[1], 10),
+        prevStartxref,
+    };
+}
+/**
+ * Append `seal` to `pdf` as an incremental update. Returns the new PDF; the first
+ * `pdf.length` bytes are preserved verbatim, so `seal.coveredBytes` (set by the
+ * caller to `pdf.length`) still points at the original document in the final file.
+ */
+export function embedPqSeal(pdf, seal) {
+    const trailer = readLastTrailer(pdf);
+    const sealB64 = Buffer.from(JSON.stringify(seal), "utf8").toString("base64");
+    const objNum = trailer.size; // next free object number
+    // Separate our update from the prior %%EOF with a newline (harmless if the
+    // file already ended in one).
+    const head = Buffer.concat([pdf, Buffer.from("\n", "latin1")]);
+    const objOffset = head.length;
+    const objBuf = Buffer.from(`${objNum} 0 obj\n<</Type/${SEAL_OBJ_TYPE}/V 1/Seal(${sealB64})>>\nendobj\n`, "latin1");
+    const withObj = Buffer.concat([head, objBuf]);
+    const xrefOffset = withObj.length;
+    const paddedOffset = String(objOffset).padStart(10, "0");
+    const xref = Buffer.from("xref\n" +
+        `${objNum} 1\n` +
+        `${paddedOffset} 00000 n \n` + // 20-byte entry: 10 offset + gen 00000 + 'n' + trailing space + LF
+        "trailer\n<<\n" +
+        `/Size ${objNum + 1}\n` +
+        `/Root ${trailer.rootRef}\n` +
+        (trailer.infoRef ? `/Info ${trailer.infoRef}\n` : "") +
+        `/Prev ${trailer.prevStartxref}\n` +
+        ">>\nstartxref\n" +
+        `${xrefOffset}\n%%EOF\n`, "latin1");
+    return Buffer.concat([withObj, xref]);
+}
+/**
+ * Extract the embedded seal from a (possibly later-signed) PDF, or null if none
+ * is present / it is not valid JSON. Returns the FIRST seal if several exist.
+ *
+ * FIRST, deliberately: the genuine seal is embedded BEFORE the RSA PAdES
+ * signature, so it sits at the lowest file offset and is covered by the classical
+ * /ByteRange. A seal an attacker appends AFTER signing lands at a higher offset
+ * and is NOT RSA-covered — taking the first match ignores it, so even a standalone
+ * `verifyPqSeal` reports the authentic signer rather than the appended identity.
+ * Never throws — a malformed seal is treated as absent (fail-closed at verify).
+ */
+export function extractPqSeal(pdf) {
+    SEAL_EXTRACT_RE.lastIndex = 0;
+    const match = SEAL_EXTRACT_RE.exec(pdf.toString("latin1"));
+    if (!match)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(match[1], "base64").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** True if the PDF carries an embedded post-quantum seal. */
+export function hasPqSeal(pdf) {
+    SEAL_EXTRACT_RE.lastIndex = 0;
+    return SEAL_EXTRACT_RE.test(pdf.toString("latin1"));
+}
+//# sourceMappingURL=pq-embed.js.map

package/dist/pq-embed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-embed.js","sourceRoot":"","sources":["../src/pq-embed.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,uEAAuE;AACvE,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,sFAAsF;AACtF,gFAAgF;AAChF,gFAAgF;AAChF,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,4BAA4B;AAC5B,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,6DAA6D;AAI7D,qDAAqD;AACrD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,aAAa,aAAa,qCAAqC,EAAE,GAAG,CAAC,CAAC;AASzG;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,mDAAmD;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAE7D,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACvC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3B,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,0BAA0B;IAEvD,2EAA2E;IAC3E,8BAA8B;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,GAAG,MAAM,mBAAmB,aAAa,aAAa,OAAO,eAAe,EAC5E,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAElC,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CACtB,QAAQ;QACN,GAAG,MAAM,MAAM;QACf,GAAG,YAAY,aAAa,GAAG,mEAAmE;QAClG,eAAe;QACf,SAAS,MAAM,GAAG,CAAC,IAAI;QACvB,SAAS,OAAO,CAAC,OAAO,IAAI;QAC5B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,SAAS,OAAO,CAAC,aAAa,IAAI;QAClC,iBAAiB;QACjB,GAAG,UAAU,WAAW,EAC1B,QAAQ,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAW,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/pq-lifecycle.d.ts

@@ -0,0 +1,59 @@
+import { type PqSigningKeys, type PqPublicMaterial } from "./pq-seal.js";
+/** A persisted, wrapped post-quantum key bundle + its public identity material. */
+export interface StoredPqKeys {
+    id: string;
+    tenantId: string;
+    /** `wrapPqKeyBundle` output (AES-256-GCM). Never store the unwrapped bundle. */
+    keyBundleEncrypted: Uint8Array;
+    /** base64 raw Ed25519 public key. */
+    ed25519Public: string;
+    /** base64 raw ML-DSA-65 public key. */
+    mldsa65Public: string;
+    /** SHA-256 hex of the ML-DSA-65 public key — the identity to publish/pin. */
+    mldsa65Fpr: string;
+    /** 128-bit hex id over both public keys. */
+    keyId: string;
+    active: boolean;
+    rotatedFromId?: string | null;
+    createdAt: Date;
+}
+/** Bring-your-own persistence for post-quantum key bundles (mirrors CertStore). */
+export interface PqKeyStore {
+    /** The active bundle for a tenant, or null if none exists yet. */
+    findActive(tenantId: string): Promise<StoredPqKeys | null>;
+    /** Persist a new bundle. Ensure at most one `active=true` per tenant. */
+    insert(input: {
+        tenantId: string;
+        keyBundleEncrypted: Uint8Array;
+        public: PqPublicMaterial;
+        rotatedFromId?: string | null;
+    }): Promise<StoredPqKeys>;
+    /** Mark a bundle inactive (used during rotation). */
+    deactivate(id: string): Promise<void>;
+}
+export interface EnsurePqKeysResult {
+    record: StoredPqKeys;
+    /** In-memory signing keys ready for `signPdf({ pqSeal: { keys } })`. */
+    keys: PqSigningKeys;
+    public: PqPublicMaterial;
+}
+/**
+ * Ensure an active post-quantum key bundle for the tenant, generating + wrapping
+ * one on first use. `passphrase` (≥24 chars) wraps the bundle at rest.
+ */
+export declare function ensureActivePqKeys(opts: {
+    store: PqKeyStore;
+    tenantId: string;
+    passphrase: string;
+}): Promise<EnsurePqKeysResult>;
+/**
+ * Force a rotation: deactivate the current bundle (if any) and mint a fresh one
+ * with `rotatedFromId` set. Documents already sealed with the old key keep
+ * verifying — verification uses the public key embedded in each seal.
+ */
+export declare function rotatePqKeys(opts: {
+    store: PqKeyStore;
+    tenantId: string;
+    passphrase: string;
+}): Promise<EnsurePqKeysResult>;
+//# sourceMappingURL=pq-lifecycle.d.ts.map

package/dist/pq-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-lifecycle.d.ts","sourceRoot":"","sources":["../src/pq-lifecycle.ts"],"names":[],"mappings":"AAeA,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,kBAAkB,EAAE,UAAU,CAAC;IAC/B,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3D,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,kBAAkB,EAAE,UAAU,CAAC;QAC/B,MAAM,EAAE,gBAAgB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1B,qDAAqD;IACrD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiB9B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAI9B"}

package/dist/pq-lifecycle.js

@@ -0,0 +1,55 @@
+// pq-lifecycle.ts
+//
+// Stack-agnostic "ensure an active post-quantum key bundle for this tenant"
+// helper — the ML-DSA-65 / Ed25519 analogue of ensureActiveCert. Depends only on
+// the bring-your-own `PqKeyStore` interface plus the crypto in pq-seal; no DB, no
+// stack assumptions.
+//
+// Unlike signing certificates, hybrid key bundles do not expire on a clock —
+// rotation is an explicit, deployment-driven decision (e.g. suspected key
+// compromise, or a policy roll). `ensureActivePqKeys` therefore generates on
+// first use and reuses thereafter; `rotatePqKeys` mints a fresh bundle and links
+// the predecessor. Consumers that don't want a managed store can skip this module
+// entirely and use generatePqKeyBundle / wrapPqKeyBundle / loadPqSigningKeys
+// directly, persisting the wrapped blob wherever they like.
+import { generatePqKeyBundle, loadPqSigningKeys, wrapPqKeyBundle, unwrapPqKeyBundle, } from "./pq-seal.js";
+/**
+ * Ensure an active post-quantum key bundle for the tenant, generating + wrapping
+ * one on first use. `passphrase` (≥24 chars) wraps the bundle at rest.
+ */
+export async function ensureActivePqKeys(opts) {
+    const existing = await opts.store.findActive(opts.tenantId);
+    if (existing) {
+        const bundle = unwrapPqKeyBundle(existing.keyBundleEncrypted, opts.passphrase);
+        const keys = loadPqSigningKeys(bundle);
+        return {
+            record: existing,
+            keys,
+            public: {
+                ed25519: existing.ed25519Public,
+                mldsa65: existing.mldsa65Public,
+                mldsa65Fpr: existing.mldsa65Fpr,
+                keyId: existing.keyId,
+            },
+        };
+    }
+    return mint(opts.store, opts.tenantId, opts.passphrase, null);
+}
+/**
+ * Force a rotation: deactivate the current bundle (if any) and mint a fresh one
+ * with `rotatedFromId` set. Documents already sealed with the old key keep
+ * verifying — verification uses the public key embedded in each seal.
+ */
+export async function rotatePqKeys(opts) {
+    const existing = await opts.store.findActive(opts.tenantId);
+    if (existing)
+        await opts.store.deactivate(existing.id);
+    return mint(opts.store, opts.tenantId, opts.passphrase, existing?.id ?? null);
+}
+async function mint(store, tenantId, passphrase, rotatedFromId) {
+    const { bundle, public: pub } = generatePqKeyBundle();
+    const keyBundleEncrypted = wrapPqKeyBundle(bundle, passphrase);
+    const record = await store.insert({ tenantId, keyBundleEncrypted, public: pub, rotatedFromId });
+    return { record, keys: loadPqSigningKeys(bundle), public: pub };
+}
+//# sourceMappingURL=pq-lifecycle.js.map

package/dist/pq-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-lifecycle.js","sourceRoot":"","sources":["../src/pq-lifecycle.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,iFAAiF;AACjF,kFAAkF;AAClF,6EAA6E;AAC7E,4DAA4D;AAE5D,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AA2CtB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,MAAM,EAAE;gBACN,OAAO,EAAE,QAAQ,CAAC,aAAa;gBAC/B,OAAO,EAAE,QAAQ,CAAC,aAAa;gBAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAIlC;IACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ;QAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,KAAiB,EACjB,QAAgB,EAChB,UAAkB,EAClB,aAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACtD,MAAM,kBAAkB,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAClE,CAAC"}

package/dist/pq-seal.d.ts

@@ -0,0 +1,133 @@
+import crypto from "node:crypto";
+/** Seal schema version. Bump on any breaking change to the signed payload shape. */
+export declare const PQ_SEAL_VERSION: 1;
+/** Hybrid algorithm identifier embedded in (and bound by) every seal. */
+export declare const PQ_SEAL_ALG: "hybrid-ed25519-ml-dsa-65";
+/** Bundle schema version for the wrapped at-rest key material. */
+declare const PQ_BUNDLE_VERSION: 1;
+/**
+ * The wrappable at-rest key bundle. Persist `wrapPqKeyBundle(bundle, passphrase)`;
+ * never store the raw bundle. Compact by design: an Ed25519 PKCS#8 key plus a
+ * 32-byte ML-DSA seed (the full 4032-byte ML-DSA secret key is re-derived
+ * deterministically via `ml_dsa65.keygen(seed)`).
+ */
+export interface PqKeyBundle {
+    v: typeof PQ_BUNDLE_VERSION;
+    /** base64 PKCS#8 DER of the Ed25519 private key. */
+    ed25519Pkcs8: string;
+    /** base64 32-byte ML-DSA-65 seed. */
+    mldsa65Seed: string;
+}
+/** Public key material derived from a bundle — safe to publish/pin as the signer identity. */
+export interface PqPublicMaterial {
+    /** base64 raw 32-byte Ed25519 public key. */
+    ed25519: string;
+    /** base64 raw 1952-byte ML-DSA-65 public key. */
+    mldsa65: string;
+    /** SHA-256 hex of the raw ML-DSA-65 public key — the post-quantum identity fingerprint. */
+    mldsa65Fpr: string;
+    /** Stable 128-bit hex id over both public keys (bound into every seal). */
+    keyId: string;
+}
+/** In-memory signing keys, ready to produce seals. Never persisted directly. */
+export interface PqSigningKeys {
+    ed25519PrivateKey: crypto.KeyObject;
+    ed25519PublicRaw: Uint8Array;
+    mldsa65SecretKey: Uint8Array;
+    mldsa65PublicKey: Uint8Array;
+}
+/**
+ * A hybrid post-quantum seal. The signed payload is every field EXCEPT `sig`,
+ * serialized canonically (see `canonicalJson`). `digest` is the SHA-256 (hex) of
+ * the first `coveredBytes` bytes of the final document — the PDF-verify layer
+ * checks that binding; `verifyPqSealSignatures` only checks the two signatures.
+ */
+export interface PqSeal {
+    v: typeof PQ_SEAL_VERSION;
+    alg: typeof PQ_SEAL_ALG;
+    /** Digest algorithm over the covered document bytes. */
+    over: "sha256";
+    /** SHA-256 hex of the covered document bytes (the first `coveredBytes` bytes). */
+    digest: string;
+    /** Byte length of the document prefix the digest covers (P0 = rendered PDF pre-seal). */
+    coveredBytes: number;
+    /** ISO 8601 seal creation time. */
+    signedAt: string;
+    /** 128-bit hex id over both public keys. */
+    keyId: string;
+    keys: {
+        ed25519: string;
+        mldsa65: string;
+        mldsa65Fpr: string;
+    };
+    sig: {
+        /** base64 Ed25519 signature over canonicalJson(payload). */
+        ed25519: string;
+        /** base64 ML-DSA-65 signature over canonicalJson(payload). */
+        mldsa65: string;
+    };
+}
+/** Result of verifying a seal's two signatures (does NOT check document binding). */
+export interface PqSealVerification {
+    /** Classical Ed25519 signature valid. */
+    ed25519: boolean;
+    /** Post-quantum ML-DSA-65 signature valid. */
+    mldsa65: boolean;
+    /** The embedded `mldsa65Fpr` matches SHA-256(mldsa65 public key). */
+    fingerprintOk: boolean;
+    /** The embedded `keyId` matches the digest of the two public keys it claims. */
+    keyIdOk: boolean;
+    /** Hybrid verdict: every check passed (both signatures + fingerprint + keyId). */
+    ok: boolean;
+}
+/**
+ * Generate a fresh hybrid key bundle plus its derived public material. The bundle
+ * is what you wrap + persist; the public material is what you publish/pin as the
+ * signer's post-quantum identity.
+ */
+export declare function generatePqKeyBundle(): {
+    bundle: PqKeyBundle;
+    public: PqPublicMaterial;
+};
+/** Rehydrate in-memory signing keys from a bundle (deterministically re-derives the ML-DSA keypair). */
+export declare function loadPqSigningKeys(bundle: PqKeyBundle): PqSigningKeys;
+/** Derive the publishable public material for a set of signing keys. */
+export declare function publicMaterialForKeys(keys: PqSigningKeys): PqPublicMaterial;
+/** AES-256-GCM-wrap a key bundle for persistence. `passphrase` ≥ 24 chars. */
+export declare function wrapPqKeyBundle(bundle: PqKeyBundle, passphrase: string): Uint8Array;
+/** Inverse of `wrapPqKeyBundle`. Throws on wrong passphrase / tampering (auth-tag mismatch). */
+export declare function unwrapPqKeyBundle(blob: Uint8Array, passphrase: string): PqKeyBundle;
+export interface BuildPqSealInput {
+    /** SHA-256 hex of the covered document bytes. */
+    digestHex: string;
+    /** Byte length the digest covers (the document prefix protected by the seal). */
+    coveredBytes: number;
+    keys: PqSigningKeys;
+    /** Seal timestamp. Defaults to now. */
+    signedAt?: Date;
+}
+/**
+ * Produce a hybrid seal over `digestHex`. Both signatures are computed over the
+ * exact same canonical bytes (the seal minus `sig`), binding digest, covered
+ * length, public keys, timestamp and keyId under BOTH schemes.
+ */
+export declare function buildPqSeal(input: BuildPqSealInput): PqSeal;
+/**
+ * Verify a seal's two signatures over its own payload (does NOT bind the seal to a
+ * document — the PDF-verify layer checks `digest` against the covered bytes).
+ *
+ * Fails CLOSED: any malformed field, wrong-length key/signature, or thrown error
+ * yields `ok:false` rather than propagating. The hybrid verdict requires BOTH
+ * signatures valid AND the ML-DSA fingerprint self-consistent.
+ */
+export declare function verifyPqSealSignatures(seal: PqSeal): PqSealVerification;
+/**
+ * Deterministic JSON serialization (recursively key-sorted, no insignificant
+ * whitespace) used as the signing input. The seal payload contains only strings
+ * and safe integers, so this is unambiguous without full RFC 8785 number
+ * canonicalization. Both signing and verification serialize the identical field
+ * set (payload = seal minus `sig`), so the two sides always agree.
+ */
+export declare function canonicalJson(value: unknown): string;
+export {};
+//# sourceMappingURL=pq-seal.d.ts.map

package/dist/pq-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-seal.d.ts","sourceRoot":"","sources":["../src/pq-seal.ts"],"names":[],"mappings":"AA0BA,OAAO,MAAM,MAAM,aAAa,CAAC;AAOjC,oFAAoF;AACpF,eAAO,MAAM,eAAe,EAAG,CAAU,CAAC;AAC1C,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAG,0BAAmC,CAAC;AAC/D,kEAAkE;AAClE,QAAA,MAAM,iBAAiB,EAAG,CAAU,CAAC;AAkBrC;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC;IACpC,gBAAgB,EAAE,UAAU,CAAC;IAC7B,gBAAgB,EAAE,UAAU,CAAC;IAC7B,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,OAAO,eAAe,CAAC;IAC1B,GAAG,EAAE,OAAO,WAAW,CAAC;IACxB,wDAAwD;IACxD,IAAI,EAAE,QAAQ,CAAC;IACf,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE;QACH,4DAA4D;QAC5D,OAAO,EAAE,MAAM,CAAC;QAChB,8DAA8D;QAC9D,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,aAAa,EAAE,OAAO,CAAC;IACvB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,EAAE,EAAE,OAAO,CAAC;CACb;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAcvF;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAsBpE;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,gBAAgB,CAE3E;AAID,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAEnF;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAMnF;AAID,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CA8DvE;AA2CD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD"}

package/dist/pq-seal.js

@@ -0,0 +1,261 @@
+// pq-seal.ts
+//
+// Hybrid post-quantum document seal — Ed25519 (classical) + ML-DSA-65 (FIPS 204,
+// module-lattice, quantum-resistant). This is the cryptographic core of e-sig's
+// post-quantum wedge: every sealed document carries TWO independent signatures
+// over the same payload, and a verifier requires BOTH to pass. If either scheme
+// is ever broken (a CRQC breaks Ed25519, or an unforeseen lattice attack dents
+// ML-DSA), the seal still stands on the other — the belt-and-suspenders
+// migration path NIST/CNSA 2.0 recommends over a hard cutover.
+//
+// The seal is a small canonical-JSON object signed over a SHA-256 digest of the
+// document bytes it covers. It does NOT replace the PDF's PKCS#7/PAdES RSA
+// signature (which stays valid in every PDF reader, including Adobe Acrobat —
+// no mainstream reader validates ML-DSA in PAdES yet, 2026). Instead the seal is
+// embedded in the PDF and the RSA /ByteRange signature is applied on top, so the
+// classical signature cryptographically covers the seal (see sign-pdf.ts).
+//
+// Identity model (v1): raw ML-DSA-65 public key + its SHA-256 fingerprint carried
+// in the seal (the `keyId` / `mldsa65Fpr`), verified TOFU / against-published-key.
+// A self-signed ML-DSA-65 X.509 certificate (RFC 9881 OID 2.16.840.1.101.3.4.3.18)
+// is a deliberate fast-follow, not required to ship the seal.
+//
+// Algorithm binding: both signatures are computed over the SAME canonical bytes —
+// the seal object minus its `sig` field — so digest, covered length, public keys,
+// timestamp and keyId are all bound together and cannot be swapped independently.
+import crypto from "node:crypto";
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+import { encryptKeyPem, decryptKeyPem } from "./cert-issuer.js";
+// ---------- Constants ----------
+/** Seal schema version. Bump on any breaking change to the signed payload shape. */
+export const PQ_SEAL_VERSION = 1;
+/** Hybrid algorithm identifier embedded in (and bound by) every seal. */
+export const PQ_SEAL_ALG = "hybrid-ed25519-ml-dsa-65";
+/** Bundle schema version for the wrapped at-rest key material. */
+const PQ_BUNDLE_VERSION = 1;
+/**
+ * DER SubjectPublicKeyInfo prefix for an Ed25519 key (RFC 8410 §4). A raw 32-byte
+ * Ed25519 public key is exactly this 12-byte prefix followed by the key, so we
+ * can round-trip raw keys ↔ node KeyObjects without a heavier ASN.1 dependency.
+ */
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+// FIPS 204 ML-DSA-65 sizes (raw, unencoded) — asserted defensively at load time.
+const MLDSA65_PUBLIC_LEN = 1952;
+const MLDSA65_SIGNATURE_LEN = 3309;
+const MLDSA65_SEED_LEN = 32;
+const ED25519_RAW_PUBLIC_LEN = 32;
+const ED25519_SIGNATURE_LEN = 64;
+// ---------- Key generation / loading ----------
+/**
+ * Generate a fresh hybrid key bundle plus its derived public material. The bundle
+ * is what you wrap + persist; the public material is what you publish/pin as the
+ * signer's post-quantum identity.
+ */
+export function generatePqKeyBundle() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+    const ed25519Pkcs8 = privateKey.export({ type: "pkcs8", format: "der" });
+    const ed25519PublicRaw = rawEd25519FromKeyObject(publicKey);
+    const seed = crypto.randomBytes(MLDSA65_SEED_LEN);
+    const { publicKey: mldsa65PublicKey } = ml_dsa65.keygen(seed);
+    const bundle = {
+        v: PQ_BUNDLE_VERSION,
+        ed25519Pkcs8: b64(ed25519Pkcs8),
+        mldsa65Seed: b64(seed),
+    };
+    return { bundle, public: publicMaterial(ed25519PublicRaw, mldsa65PublicKey) };
+}
+/** Rehydrate in-memory signing keys from a bundle (deterministically re-derives the ML-DSA keypair). */
+export function loadPqSigningKeys(bundle) {
+    if (bundle.v !== PQ_BUNDLE_VERSION) {
+        throw new Error(`loadPqSigningKeys: unknown bundle version ${bundle.v}`);
+    }
+    const ed25519PrivateKey = crypto.createPrivateKey({
+        key: Buffer.from(bundle.ed25519Pkcs8, "base64"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const ed25519PublicRaw = rawEd25519FromKeyObject(crypto.createPublicKey(ed25519PrivateKey));
+    const seed = Buffer.from(bundle.mldsa65Seed, "base64");
+    if (seed.length !== MLDSA65_SEED_LEN) {
+        throw new Error(`loadPqSigningKeys: ML-DSA seed must be ${MLDSA65_SEED_LEN} bytes, got ${seed.length}`);
+    }
+    const { publicKey, secretKey } = ml_dsa65.keygen(seed);
+    return {
+        ed25519PrivateKey,
+        ed25519PublicRaw,
+        mldsa65SecretKey: secretKey,
+        mldsa65PublicKey: publicKey,
+    };
+}
+/** Derive the publishable public material for a set of signing keys. */
+export function publicMaterialForKeys(keys) {
+    return publicMaterial(keys.ed25519PublicRaw, keys.mldsa65PublicKey);
+}
+// ---------- At-rest wrapping (reuses cert-issuer AES-256-GCM) ----------
+/** AES-256-GCM-wrap a key bundle for persistence. `passphrase` ≥ 24 chars. */
+export function wrapPqKeyBundle(bundle, passphrase) {
+    return encryptKeyPem(JSON.stringify(bundle), passphrase);
+}
+/** Inverse of `wrapPqKeyBundle`. Throws on wrong passphrase / tampering (auth-tag mismatch). */
+export function unwrapPqKeyBundle(blob, passphrase) {
+    const bundle = JSON.parse(decryptKeyPem(blob, passphrase));
+    if (bundle.v !== PQ_BUNDLE_VERSION) {
+        throw new Error(`unwrapPqKeyBundle: unknown bundle version ${bundle.v}`);
+    }
+    return bundle;
+}
+/**
+ * Produce a hybrid seal over `digestHex`. Both signatures are computed over the
+ * exact same canonical bytes (the seal minus `sig`), binding digest, covered
+ * length, public keys, timestamp and keyId under BOTH schemes.
+ */
+export function buildPqSeal(input) {
+    if (!/^[0-9a-f]{64}$/.test(input.digestHex)) {
+        throw new Error("buildPqSeal: digestHex must be 64 lowercase hex chars (SHA-256)");
+    }
+    if (!Number.isInteger(input.coveredBytes) || input.coveredBytes <= 0) {
+        throw new Error("buildPqSeal: coveredBytes must be a positive integer");
+    }
+    const pub = publicMaterialForKeys(input.keys);
+    const payload = {
+        v: PQ_SEAL_VERSION,
+        alg: PQ_SEAL_ALG,
+        over: "sha256",
+        digest: input.digestHex,
+        coveredBytes: input.coveredBytes,
+        signedAt: (input.signedAt ?? new Date()).toISOString(),
+        keyId: pub.keyId,
+        keys: { ed25519: pub.ed25519, mldsa65: pub.mldsa65, mldsa65Fpr: pub.mldsa65Fpr },
+    };
+    const signingInput = Buffer.from(canonicalJson(payload), "utf8");
+    const ed25519Sig = crypto.sign(null, signingInput, input.keys.ed25519PrivateKey);
+    const mldsa65Sig = ml_dsa65.sign(signingInput, input.keys.mldsa65SecretKey);
+    return { ...payload, sig: { ed25519: b64(ed25519Sig), mldsa65: b64(mldsa65Sig) } };
+}
+/**
+ * Verify a seal's two signatures over its own payload (does NOT bind the seal to a
+ * document — the PDF-verify layer checks `digest` against the covered bytes).
+ *
+ * Fails CLOSED: any malformed field, wrong-length key/signature, or thrown error
+ * yields `ok:false` rather than propagating. The hybrid verdict requires BOTH
+ * signatures valid AND the ML-DSA fingerprint self-consistent.
+ */
+export function verifyPqSealSignatures(seal) {
+    const fail = {
+        ed25519: false,
+        mldsa65: false,
+        fingerprintOk: false,
+        keyIdOk: false,
+        ok: false,
+    };
+    try {
+        if (seal.v !== PQ_SEAL_VERSION || seal.alg !== PQ_SEAL_ALG || seal.over !== "sha256")
+            return fail;
+        const ed25519Pub = Buffer.from(seal.keys.ed25519, "base64");
+        const mldsa65Pub = Buffer.from(seal.keys.mldsa65, "base64");
+        const ed25519Sig = Buffer.from(seal.sig.ed25519, "base64");
+        const mldsa65Sig = Buffer.from(seal.sig.mldsa65, "base64");
+        if (ed25519Pub.length !== ED25519_RAW_PUBLIC_LEN)
+            return fail;
+        if (mldsa65Pub.length !== MLDSA65_PUBLIC_LEN)
+            return fail;
+        if (ed25519Sig.length !== ED25519_SIGNATURE_LEN)
+            return fail;
+        if (mldsa65Sig.length !== MLDSA65_SIGNATURE_LEN)
+            return fail;
+        // Reconstruct the exact signed payload: the seal minus `sig`.
+        const { sig: _sig, ...payload } = seal;
+        void _sig;
+        const signingInput = Buffer.from(canonicalJson(payload), "utf8");
+        // Self-consistency of the identity fields carried in the (signed) payload:
+        // fingerprint over the ML-DSA key, and keyId over BOTH public keys. These
+        // don't add trust (the keys are the seal's own), but they make the identity
+        // fields the signature commits to actually correspond to the keys present.
+        const fingerprintOk = sha256Hex(mldsa65Pub) === seal.keys.mldsa65Fpr;
+        const expectedKeyId = crypto
+            .createHash("sha256")
+            .update(ed25519Pub)
+            .update(mldsa65Pub)
+            .digest("hex")
+            .slice(0, 32);
+        const keyIdOk = seal.keyId === expectedKeyId;
+        let ed25519 = false;
+        try {
+            ed25519 = crypto.verify(null, signingInput, ed25519RawToPublicKey(ed25519Pub), ed25519Sig);
+        }
+        catch {
+            ed25519 = false;
+        }
+        let mldsa65 = false;
+        try {
+            mldsa65 = ml_dsa65.verify(mldsa65Sig, signingInput, mldsa65Pub);
+        }
+        catch {
+            mldsa65 = false;
+        }
+        return {
+            ed25519,
+            mldsa65,
+            fingerprintOk,
+            keyIdOk,
+            ok: ed25519 && mldsa65 && fingerprintOk && keyIdOk,
+        };
+    }
+    catch {
+        return fail;
+    }
+}
+// ---------- Internals ----------
+function publicMaterial(ed25519PublicRaw, mldsa65PublicKey) {
+    const ed25519 = b64(ed25519PublicRaw);
+    const mldsa65 = b64(mldsa65PublicKey);
+    const mldsa65Fpr = sha256Hex(mldsa65PublicKey);
+    const keyId = crypto
+        .createHash("sha256")
+        .update(ed25519PublicRaw)
+        .update(mldsa65PublicKey)
+        .digest("hex")
+        .slice(0, 32);
+    return { ed25519, mldsa65, mldsa65Fpr, keyId };
+}
+/** Extract the raw 32-byte Ed25519 public key from a node KeyObject (SPKI tail). */
+function rawEd25519FromKeyObject(pub) {
+    const spki = pub.export({ type: "spki", format: "der" });
+    return Uint8Array.prototype.slice.call(spki, spki.length - ED25519_RAW_PUBLIC_LEN);
+}
+/** Rebuild a node public KeyObject from a raw 32-byte Ed25519 key. */
+function ed25519RawToPublicKey(raw) {
+    if (raw.length !== ED25519_RAW_PUBLIC_LEN) {
+        throw new Error(`ed25519 raw public key must be ${ED25519_RAW_PUBLIC_LEN} bytes`);
+    }
+    return crypto.createPublicKey({
+        key: Buffer.concat([ED25519_SPKI_PREFIX, Buffer.from(raw)]),
+        format: "der",
+        type: "spki",
+    });
+}
+function sha256Hex(bytes) {
+    return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+function b64(bytes) {
+    return Buffer.from(bytes).toString("base64");
+}
+/**
+ * Deterministic JSON serialization (recursively key-sorted, no insignificant
+ * whitespace) used as the signing input. The seal payload contains only strings
+ * and safe integers, so this is unambiguous without full RFC 8785 number
+ * canonicalization. Both signing and verification serialize the identical field
+ * set (payload = seal minus `sig`), so the two sides always agree.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((v) => canonicalJson(v)).join(",")}]`;
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+}
+//# sourceMappingURL=pq-seal.js.map