@e-sig/core 0.5.1 → 0.6.0

package/dist/pq-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-seal.js","sourceRoot":"","sources":["../src/pq-seal.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,wEAAwE;AACxE,+DAA+D;AAC/D,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAC3E,EAAE;AACF,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,8DAA8D;AAC9D,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAElF,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhE,kCAAkC;AAElC,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAU,CAAC;AAC1C,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAAG,0BAAmC,CAAC;AAC/D,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,CAAU,CAAC;AAErC;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAoFjC,iDAAiD;AAEjD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACnF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAgB;QAC1B,CAAC,EAAE,iBAAiB;QACpB,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC;QAC/B,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC;KACvB,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,IAAI,MAAM,CAAC,CAAC,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAChD,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC/C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,MAAM,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0CAA0C,gBAAgB,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO;QACL,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB,EAAE,SAAS;QAC3B,gBAAgB,EAAE,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACtE,CAAC;AAED,0EAA0E;AAE1E,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,UAAkB;IACrE,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,UAAkB;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAgB,CAAC;IAC1E,IAAI,MAAM,CAAC,CAAC,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG;QACd,CAAC,EAAE,eAAe;QAClB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,QAAiB;QACvB,MAAM,EAAE,KAAK,CAAC,SAAS;QACvB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACtD,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE;KACjF,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE5E,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,IAAI,GAAuB;QAC/B,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,KAAK;KACV,CAAC;IACF,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,CAAC,KAAK,eAAe,IAAI,IAAI,CAAC,GAAG,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAElG,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAE7D,8DAA8D;QAC9D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;QACvC,KAAK,IAAI,CAAC;QACV,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAEjE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACrE,MAAM,aAAa,GAAG,MAAM;aACzB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,aAAa,CAAC;QAE7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO;YACP,aAAa;YACb,OAAO;YACP,EAAE,EAAE,OAAO,IAAI,OAAO,IAAI,aAAa,IAAI,OAAO;SACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kCAAkC;AAElC,SAAS,cAAc,CAAC,gBAA4B,EAAE,gBAA4B;IAChF,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM;SACjB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,oFAAoF;AACpF,SAAS,uBAAuB,CAAC,GAAqB;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACnE,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;AACrF,CAAC;AAED,sEAAsE;AACtE,SAAS,qBAAqB,CAAC,GAAe;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kCAAkC,sBAAsB,QAAQ,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC3F,CAAC"}

package/dist/pq-verify.d.ts

@@ -0,0 +1,77 @@
+import { type VerifyResult } from "./verify-pdf.js";
+export interface PqSealVerdict {
+    /** A seal was found and parsed. */
+    present: boolean;
+    /** Hybrid verdict: digest binds to the document AND both signatures + fingerprint valid. */
+    ok: boolean;
+    /** SHA-256 over the covered document prefix equals the seal's `digest`. */
+    digestBinds?: boolean;
+    /** Classical Ed25519 signature valid. */
+    ed25519?: boolean;
+    /** Post-quantum ML-DSA-65 signature valid. */
+    mldsa65?: boolean;
+    /** Embedded ML-DSA fingerprint matches its public key. */
+    fingerprintOk?: boolean;
+    /** A `signerCert` was supplied AND it is a valid ML-DSA-65 cert for this seal's key. */
+    certIdentityOk?: boolean;
+    alg?: string;
+    keyId?: string;
+    /** ML-DSA-65 public-key fingerprint — the post-quantum signer identity to pin. */
+    mldsa65Fpr?: string;
+    signedAt?: string;
+    coveredBytes?: number;
+    failures: string[];
+}
+export interface VerifyPqSealOptions {
+    /**
+     * Pin the expected post-quantum signer. When set, the seal's ML-DSA-65
+     * fingerprint MUST equal this value (case-insensitive hex) or verification
+     * fails — this is how a relying party asserts "signed by THIS party" in-band
+     * (the raw-key TOFU trust model). Compare against a fingerprint you published
+     * or received out-of-band.
+     */
+    expectedMldsa65Fpr?: string;
+    /**
+     * A self-signed ML-DSA-65 X.509 certificate (PEM or DER) asserting the signer
+     * identity. When set, the cert must be valid AND its public key must be the one
+     * that produced the seal — the X.509 upgrade of `expectedMldsa65Fpr`.
+     */
+    signerCert?: string | Uint8Array;
+}
+/**
+ * Verify the embedded post-quantum seal against the document bytes. Never throws;
+ * a missing or malformed seal returns `{ present:false, ok:false }`. Pass
+ * `expectedMldsa65Fpr` to also pin the signer identity.
+ */
+export declare function verifyPqSeal(pdf: Buffer, opts?: VerifyPqSealOptions): PqSealVerdict;
+export interface DocumentVerification {
+    /**
+     * Overall: the classical signature is valid AND, if a post-quantum seal is
+     * present, it too is valid and lies within the classically-signed region. A
+     * document with no seal is judged on the classical signature alone (backward
+     * compatible); callers that REQUIRE post-quantum protection should also assert
+     * `postQuantum.present`.
+     */
+    ok: boolean;
+    /** Classical PAdES / PKCS#7 (RSA) verification. */
+    classical: VerifyResult;
+    /** Post-quantum hybrid seal verification. */
+    postQuantum: PqSealVerdict;
+}
+export interface VerifyDocumentOptions extends VerifyPqSealOptions {
+    /**
+     * Require a valid post-quantum seal. When true, a document without a seal (or
+     * with an invalid one) fails overall — use this where post-quantum protection
+     * is mandatory, to prevent a silent downgrade to classical-only.
+     */
+    requirePq?: boolean;
+}
+/**
+ * Full document verification: classical PAdES signature + post-quantum hybrid
+ * seal. Also asserts that the seal-covered region falls within the RSA-signed
+ * prefix, so the classical signature genuinely protects the seal. Pass
+ * `requirePq` to reject unsealed documents and `expectedMldsa65Fpr` to pin the
+ * post-quantum signer.
+ */
+export declare function verifyDocument(pdf: Buffer, opts?: VerifyDocumentOptions): DocumentVerification;
+//# sourceMappingURL=pq-verify.d.ts.map

package/dist/pq-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-verify.d.ts","sourceRoot":"","sources":["../src/pq-verify.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAKxE,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,aAAa,CA+DvF;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ,mDAAmD;IACnD,SAAS,EAAE,YAAY,CAAC;IACxB,6CAA6C;IAC7C,WAAW,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,qBAA0B,GAAG,oBAAoB,CA8BlG"}

package/dist/pq-verify.js

@@ -0,0 +1,119 @@
+// pq-verify.ts
+//
+// Verify the post-quantum hybrid seal embedded in a signed PDF, and the combined
+// classical + post-quantum trust result — the "two-line" answer the product
+// pitch leans on:
+//
+//   classical (PAdES / PKCS#7 RSA): VALID  — every PDF reader, incl. Acrobat
+//   post-quantum (ML-DSA-65, FIPS 204):   VALID  — quantum-resistant
+//
+// The seal binds to the document by covering SHA-256 of the first `coveredBytes`
+// bytes (P0, the pre-seal PDF). Because the seal is embedded append-only and the
+// RSA /ByteRange signature is applied on top, tampering with the document breaks
+// BOTH the classical signature AND the post-quantum digest.
+import crypto from "node:crypto";
+import { verifyPdfSignature } from "./verify-pdf.js";
+import { verifyPqSealSignatures } from "./pq-seal.js";
+import { extractPqSeal } from "./pq-embed.js";
+import { certMatchesPqSeal } from "./pq-cert.js";
+/**
+ * Verify the embedded post-quantum seal against the document bytes. Never throws;
+ * a missing or malformed seal returns `{ present:false, ok:false }`. Pass
+ * `expectedMldsa65Fpr` to also pin the signer identity.
+ */
+export function verifyPqSeal(pdf, opts = {}) {
+    const failures = [];
+    const seal = extractPqSeal(pdf);
+    if (!seal) {
+        return { present: false, ok: false, failures: ["no post-quantum seal found"] };
+    }
+    const verdict = {
+        present: true,
+        ok: false,
+        alg: seal.alg,
+        keyId: seal.keyId,
+        mldsa65Fpr: seal.keys?.mldsa65Fpr,
+        signedAt: seal.signedAt,
+        coveredBytes: seal.coveredBytes,
+        failures,
+    };
+    // (1) Document binding: the seal must cover a real, in-bounds prefix.
+    const covered = seal.coveredBytes;
+    let digestBinds = false;
+    if (!Number.isInteger(covered) || covered <= 0 || covered > pdf.length) {
+        failures.push(`seal coveredBytes (${covered}) is out of range for a ${pdf.length}-byte file`);
+    }
+    else {
+        const recomputed = crypto.createHash("sha256").update(pdf.subarray(0, covered)).digest("hex");
+        digestBinds = recomputed === seal.digest;
+        if (!digestBinds) {
+            failures.push("post-quantum digest does not match the document — content altered");
+        }
+    }
+    verdict.digestBinds = digestBinds;
+    // (2) Signatures: both classical Ed25519 and post-quantum ML-DSA-65 must verify.
+    const sigs = verifyPqSealSignatures(seal);
+    verdict.ed25519 = sigs.ed25519;
+    verdict.mldsa65 = sigs.mldsa65;
+    verdict.fingerprintOk = sigs.fingerprintOk;
+    if (!sigs.ed25519)
+        failures.push("Ed25519 seal signature invalid");
+    if (!sigs.mldsa65)
+        failures.push("ML-DSA-65 seal signature invalid");
+    if (!sigs.fingerprintOk)
+        failures.push("ML-DSA-65 fingerprint inconsistent with its public key");
+    if (!sigs.keyIdOk)
+        failures.push("seal keyId inconsistent with its public keys");
+    // (3) Optional identity pinning (in-band TOFU assertion).
+    let identityOk = true;
+    if (opts.expectedMldsa65Fpr) {
+        identityOk = (verdict.mldsa65Fpr ?? "").toLowerCase() === opts.expectedMldsa65Fpr.toLowerCase();
+        if (!identityOk) {
+            failures.push("post-quantum signer fingerprint does not match the expected (pinned) identity");
+        }
+    }
+    // (4) Optional X.509 identity: a self-signed ML-DSA-65 cert bound to this key.
+    if (opts.signerCert) {
+        const certOk = certMatchesPqSeal(opts.signerCert, seal);
+        verdict.certIdentityOk = certOk;
+        if (!certOk) {
+            identityOk = false;
+            failures.push("signer certificate is invalid or does not match the seal's post-quantum key");
+        }
+    }
+    verdict.ok = digestBinds && sigs.ok && identityOk;
+    return verdict;
+}
+/**
+ * Full document verification: classical PAdES signature + post-quantum hybrid
+ * seal. Also asserts that the seal-covered region falls within the RSA-signed
+ * prefix, so the classical signature genuinely protects the seal. Pass
+ * `requirePq` to reject unsealed documents and `expectedMldsa65Fpr` to pin the
+ * post-quantum signer.
+ */
+export function verifyDocument(pdf, opts = {}) {
+    const classical = verifyPdfSignature(pdf);
+    const postQuantum = verifyPqSeal(pdf, {
+        expectedMldsa65Fpr: opts.expectedMldsa65Fpr,
+        signerCert: opts.signerCert,
+    });
+    let sealWithinSignedRegion = true;
+    if (postQuantum.present && classical.byteRange && postQuantum.coveredBytes != null) {
+        const [a, b] = classical.byteRange;
+        const contentsStart = a + b; // end of the first signed chunk = start of /Contents
+        if (postQuantum.coveredBytes > contentsStart) {
+            sealWithinSignedRegion = false;
+            postQuantum.failures.push("seal covers bytes beyond the classically-signed region (not RSA-protected)");
+            postQuantum.ok = false;
+        }
+    }
+    if (opts.requirePq && !postQuantum.present) {
+        postQuantum.failures.push("post-quantum seal required but none present");
+    }
+    const pqSatisfied = postQuantum.present
+        ? postQuantum.ok && sealWithinSignedRegion
+        : !opts.requirePq;
+    const ok = classical.ok && pqSatisfied;
+    return { ok, classical, postQuantum };
+}
+//# sourceMappingURL=pq-verify.js.map

package/dist/pq-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-verify.js","sourceRoot":"","sources":["../src/pq-verify.ts"],"names":[],"mappings":"AAAA,eAAe;AACf,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,kBAAkB;AAClB,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,4DAA4D;AAE5D,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AA2CjD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAA4B,EAAE;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAkB;QAC7B,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,KAAK;QACT,GAAG,EAAG,IAAe,CAAC,GAAG;QACzB,KAAK,EAAG,IAAe,CAAC,KAAK;QAC7B,UAAU,EAAG,IAAe,CAAC,IAAI,EAAE,UAAU;QAC7C,QAAQ,EAAG,IAAe,CAAC,QAAQ;QACnC,YAAY,EAAG,IAAe,CAAC,YAAY;QAC3C,QAAQ;KACT,CAAC;IAEF,sEAAsE;IACtE,MAAM,OAAO,GAAI,IAAe,CAAC,YAAY,CAAC;IAC9C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,OAAO,2BAA2B,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9F,WAAW,GAAG,UAAU,KAAM,IAAe,CAAC,MAAM,CAAC;QACrD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IAElC,iFAAiF;IACjF,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAc,CAAC,CAAC;IACpD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACjG,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAEjF,0DAA0D;IAC1D,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,CAAC;QAChG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAc,CAAC,CAAC;QAClE,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,UAAU,GAAG,KAAK,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,OAAO,CAAC,EAAE,GAAG,WAAW,IAAI,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC;AA0BD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,OAA8B,EAAE;IAC1E,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,EAAE;QACpC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IAEH,IAAI,sBAAsB,GAAG,IAAI,CAAC;IAClC,IAAI,WAAW,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QACnF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC;QACnC,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,qDAAqD;QAClF,IAAI,WAAW,CAAC,YAAY,GAAG,aAAa,EAAE,CAAC;YAC7C,sBAAsB,GAAG,KAAK,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,IAAI,CACvB,4EAA4E,CAC7E,CAAC;YACF,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO;QACrC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,sBAAsB;QAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IAEpB,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,WAAW,CAAC;IACvC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC"}

package/dist/sign-document.d.ts

@@ -1,5 +1,6 @@
 import type { CertStore, AuditLogStore, PdfStorageStore, EsigAuditAction } from "./adapters.js";
 import type { TsaTransport } from "./types.js";
+import type { PqSigningKeys } from "./pq-seal.js";
 export interface SignDocumentInput {
     /** Fully-rendered, signature-embedded HTML (the consumer composes this). */
     html: string;
@@ -30,6 +31,15 @@ export interface SignDocumentInput {
     signingTime?: Date;
     /** Optional RFC-3161 timestamp transport. Provide one to upgrade to CAdES-T. */
     tsa?: TsaTransport;
+    /**
+     * Optional post-quantum hybrid seal (Ed25519 + ML-DSA-65). Provide signing
+     * keys (e.g. from `ensureActivePqKeys` or `loadPqSigningKeys`) to embed a
+     * quantum-resistant seal covered by the classical PAdES signature.
+     */
+    pq?: {
+        keys: PqSigningKeys;
+        signedAt?: Date;
+    };
     /** Audit row fields. */
     action?: EsigAuditAction | string;
     targetTable?: string;
@@ -49,6 +59,12 @@ export interface SignDocumentResult {
     /** True when an RFC-3161 token was embedded (CAdES-T); false = CAdES-B. */
     timestamped: boolean;
     tsaError?: string;
+    /** True when a post-quantum hybrid seal (ML-DSA-65) was embedded. */
+    pqSealed: boolean;
+    /** Seal keyId, when post-quantum sealed. */
+    pqKeyId?: string;
+    /** ML-DSA-65 public-key fingerprint, when post-quantum sealed. */
+    pqMldsa65Fpr?: string;
 }
 export declare function signDocument(input: SignDocumentInput): Promise<SignDocumentResult>;
 //# sourceMappingURL=sign-document.d.ts.map

package/dist/sign-document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign-document.d.ts","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,eAAe,EACf,eAAe,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5D,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,aAAa,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IAEzB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IAEnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,gFAAgF;IAChF,GAAG,CAAC,EAAE,YAAY,CAAC;IAEnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAmF7B"}
+{"version":3,"file":"sign-document.d.ts","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,eAAe,EACf,eAAe,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5D,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,aAAa,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IAEzB,iGAAiG;IACjG,UAAU,EAAE,MAAM,CAAC;IAEnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,gFAAgF;IAChF,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;OAIG;IACH,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IAE9C,wBAAwB;IACxB,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CA6F7B"}

package/dist/sign-document.js

@@ -35,6 +35,7 @@ export async function signDocument(input) {
         name: input.signer.name,
         signingTime: signedAt,
         tsa: input.tsa,
+        pqSeal: input.pq ? { keys: input.pq.keys, signedAt: input.pq.signedAt ?? signedAt } : undefined,
     });
     // 4. Persist the signed PDF (+ optional signature image).
     const tsKey = signedAt.toISOString().replace(/[:.]/g, "-");
@@ -78,6 +79,12 @@ export async function signDocument(input) {
                 degraded: !!input.tsa && !r.timestamped,
                 error: r.tsaError ?? null,
             },
+            post_quantum: {
+                sealed: r.pqSealed,
+                ...(r.pqSealed
+                    ? { alg: "hybrid-ed25519-ml-dsa-65", key_id: r.pqKeyId, mldsa65_fpr: r.pqMldsa65Fpr }
+                    : {}),
+            },
         },
     });
     return {
@@ -88,6 +95,9 @@ export async function signDocument(input) {
         certFingerprint: cert.cert.certFingerprint,
         timestamped: r.timestamped,
         tsaError: r.tsaError,
+        pqSealed: r.pqSealed,
+        pqKeyId: r.pqKeyId,
+        pqMldsa65Fpr: r.pqMldsa65Fpr,
     };
 }
 //# sourceMappingURL=sign-document.js.map

package/dist/sign-document.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-document.js","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAAA,mBAAmB;AACnB,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6DvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IAEjD,0BAA0B;IAC1B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;QACtB,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qBAAqB;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,QAAQ;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,CAAC,SAAS;QAClB,WAAW,EAAE,iBAAiB;KAC/B,CAAC,CAAC;IAEH,IAAI,iBAAqC,CAAC;IAC1C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,gBAAgB,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACvC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;YACjC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;SAC9C,CAAC,CAAC;QACH,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,QAAQ,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,SAAS,EAAE;gBACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG;gBACtB,OAAO,EAAE,CAAC,CAAC,WAAW;gBACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW;gBACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;aAC1B;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,iBAAiB;QACjB,UAAU,EAAE,KAAK,CAAC,EAAE;QACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-document.js","sourceRoot":"","sources":["../src/sign-document.ts"],"names":[],"mappings":"AAAA,mBAAmB;AACnB,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA0EvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;IAEjD,0BAA0B;IAC1B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;QACtB,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qBAAqB;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,QAAQ;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;KAChG,CAAC,CAAC;IAEH,0DAA0D;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,CAAC,SAAS;QAClB,WAAW,EAAE,iBAAiB;KAC/B,CAAC,CAAC;IAEH,IAAI,iBAAqC,CAAC;IAC1C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,gBAAgB,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACvC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;YACjC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;SAC9C,CAAC,CAAC;QACH,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,QAAQ,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,SAAS,EAAE;gBACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG;gBACtB,OAAO,EAAE,CAAC,CAAC,WAAW;gBACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW;gBACvC,KAAK,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;aAC1B;YACD,YAAY,EAAE;gBACZ,MAAM,EAAE,CAAC,CAAC,QAAQ;gBAClB,GAAG,CAAC,CAAC,CAAC,QAAQ;oBACZ,CAAC,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE;oBACrF,CAAC,CAAC,EAAE,CAAC;aACR;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,GAAG;QACvB,iBAAiB;QACjB,UAAU,EAAE,KAAK,CAAC,EAAE;QACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;QAC1C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC;AACJ,CAAC"}

package/dist/sign-pdf.d.ts

@@ -1,4 +1,5 @@
 import type { TsaTransport } from "./types.js";
+import { type PqSigningKeys } from "./pq-seal.js";
 export interface SignPdfInput {
     pdf: Buffer;
     keyPem: string;
@@ -33,6 +34,20 @@ export interface SignPdfInput {
      * (keeps `signing-time` for backward compatibility).
      */
     padesStrict?: boolean;
+    /**
+     * Optional post-quantum hybrid seal (Ed25519 + ML-DSA-65, FIPS 204). When
+     * provided, a seal over SHA-256 of the pre-signature PDF is embedded FIRST (an
+     * append-only incremental update), so the classical RSA /ByteRange signature
+     * applied on top cryptographically covers it. The classical signature remains
+     * valid in every PDF reader; the seal is the quantum-resistant layer, verified
+     * by `verifyPqSeal` / `verifyDocument`.
+     */
+    pqSeal?: {
+        /** Hybrid signing keys (see generatePqKeyBundle / loadPqSigningKeys). */
+        keys: PqSigningKeys;
+        /** Seal timestamp. Defaults to `signingTime` or now. */
+        signedAt?: Date;
+    };
 }
 export interface SignPdfResult {
     signedPdf: Buffer;
@@ -41,6 +56,12 @@ export interface SignPdfResult {
     timestamped: boolean;
     /** Present when a non-required TSA request failed (signature is CAdES-B). */
     tsaError?: string;
+    /** True when a post-quantum hybrid seal was embedded (and is RSA-covered). */
+    pqSealed: boolean;
+    /** Seal keyId (128-bit hex over both public keys), when sealed. */
+    pqKeyId?: string;
+    /** ML-DSA-65 public-key fingerprint (SHA-256 hex), when sealed. */
+    pqMldsa65Fpr?: string;
 }
 export declare function signPdf(input: SignPdfInput): Promise<SignPdfResult>;
 //# sourceMappingURL=sign-pdf.d.ts.map

package/dist/sign-pdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign-pdf.d.ts","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAW/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAyCzE"}
+{"version":3,"file":"sign-pdf.d.ts","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAsC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAYtF,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACP,yEAAyE;QACzE,IAAI,EAAE,aAAa,CAAC;QACpB,wDAAwD;QACxD,QAAQ,CAAC,EAAE,IAAI,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAkEzE"}

package/dist/sign-pdf.js

@@ -7,10 +7,13 @@
 // TSA is supplied the default /Contents budget is raised to fit the TST + TSA
 // cert chain, and an overflow guard rejects a result whose PKCS#7 exceeded the
 // placeholder (which @signpdf would otherwise silently truncate).
+import crypto from "node:crypto";
 import { SignPdf } from "@signpdf/signpdf";
 import { plainAddPlaceholder } from "@signpdf/placeholder-plain";
 import { PemSigner } from "./pem-signer.js";
 import { verifyPdfStructure } from "./verify-pdf.js";
+import { buildPqSeal, publicMaterialForKeys } from "./pq-seal.js";
+import { embedPqSeal } from "./pq-embed.js";
 /** Default /Contents budget (bytes) when no timestamp is embedded. */
 const DEFAULT_SIGNATURE_LENGTH = 8192;
 /**
@@ -23,8 +26,28 @@ const signpdfInstance = new SignPdf();
 export async function signPdf(input) {
     const budget = input.signatureLength ??
         (input.tsa ? TIMESTAMPED_SIGNATURE_LENGTH : DEFAULT_SIGNATURE_LENGTH);
+    // Post-quantum seal FIRST (append-only), so the classical /ByteRange signature
+    // applied below cryptographically covers it. The seal signs SHA-256 of the
+    // pre-seal PDF (P0); coveredBytes = P0.length locates that region in the final
+    // file (incremental updates never rewrite prior bytes).
+    let basePdf = input.pdf;
+    let pqKeyId;
+    let pqMldsa65Fpr;
+    if (input.pqSeal) {
+        const digestHex = crypto.createHash("sha256").update(input.pdf).digest("hex");
+        const seal = buildPqSeal({
+            digestHex,
+            coveredBytes: input.pdf.length,
+            keys: input.pqSeal.keys,
+            signedAt: input.pqSeal.signedAt ?? input.signingTime,
+        });
+        basePdf = embedPqSeal(input.pdf, seal);
+        const pub = publicMaterialForKeys(input.pqSeal.keys);
+        pqKeyId = pub.keyId;
+        pqMldsa65Fpr = pub.mldsa65Fpr;
+    }
     const withPlaceholder = plainAddPlaceholder({
-        pdfBuffer: input.pdf,
+        pdfBuffer: basePdf,
         reason: input.reason,
         contactInfo: input.contactInfo,
         name: input.name,
@@ -55,6 +78,9 @@ export async function signPdf(input) {
         placeholderBudget: budget,
         timestamped: signer.lastTimestamped,
         tsaError: signer.lastTsaError,
+        pqSealed: !!input.pqSeal,
+        pqKeyId,
+        pqMldsa65Fpr,
     };
 }
 //# sourceMappingURL=sign-pdf.js.map

package/dist/sign-pdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-pdf.js","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAElE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,sEAAsE;AACtE,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,CAAC;AA+C3C,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,MAAM,GACV,KAAK,CAAC,eAAe;QACrB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,MAAM;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAEtF,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,SAAS,CAAC,eAAe,IAAI,MAAM,CAAC;IAC3D,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,wCAAwC,cAAc,8BAA8B,CACtG,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,MAAM,CAAC,eAAe;QACnC,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-pdf.js","sourceRoot":"","sources":["../src/sign-pdf.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAElE,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,sEAAsE;AACtE,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAmE3C,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAC/C,MAAM,MAAM,GACV,KAAK,CAAC,eAAe;QACrB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAExE,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,wDAAwD;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;IACxB,IAAI,OAA2B,CAAC;IAChC,IAAI,YAAgC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,SAAS;YACT,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;YAC9B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW;SACrD,CAAC,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,YAAY,GAAG,GAAG,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CAAC;QAC1C,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,MAAM;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAEtF,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,IAAI,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,SAAS,CAAC,eAAe,IAAI,MAAM,CAAC;IAC3D,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,wCAAwC,cAAc,8BAA8B,CACtG,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,MAAM,CAAC,eAAe;QACnC,QAAQ,EAAE,MAAM,CAAC,YAAY;QAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;QACxB,OAAO;QACP,YAAY;KACb,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@e-sig/core",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Self-contained PKCS#7 PDF signing — no SaaS, no metering, no per-doc fees. Render→sign→verify engine + pluggable persistence interfaces + end-to-end signDocument() orchestrator.",
   "license": "MIT",
   "type": "module",
@@ -27,6 +27,11 @@
       "types": "./dist/fs-adapters.d.ts",
       "import": "./dist/fs-adapters.js",
       "default": "./dist/fs-adapters.js"
+    },
+    "./pq-seal": {
+      "types": "./dist/pq-seal.d.ts",
+      "import": "./dist/pq-seal.js",
+      "default": "./dist/pq-seal.js"
     }
   },
   "files": [
@@ -69,6 +74,7 @@
   },
   "homepage": "https://github.com/vmvtech/esig-suite/tree/main/packages/esig-core#readme",
   "dependencies": {
+    "@noble/post-quantum": "^0.6.1",
     "@signpdf/placeholder-plain": "^3.3.0",
     "@signpdf/signpdf": "^3.3.0",
     "@signpdf/utils": "^3.3.0",
@@ -93,8 +99,5 @@
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
-  },
-  "overrides": {
-    "crypto-js": "^4.2.0"
   }
 }