@e-sig/core 0.5.1 → 0.7.0

package/dist/pq-cert.js

@@ -0,0 +1,295 @@
+// src/pq-cert.ts
+//
+// Self-signed ML-DSA-65 X.509 certificate (RFC 9881).
+//
+// The raw-key TOFU identity (pq-seal) is enough to pin a signer, but enterprise
+// relying parties expect an X.509 container: a human-readable subject bound to a
+// public key by a signature. This issues a self-signed certificate whose
+// SubjectPublicKeyInfo AND signatureAlgorithm are id-ml-dsa-65
+// (2.16.840.1.101.3.4.3.18), per RFC 9881 — parseable by OpenSSL 3.5+ and
+// self-verifying with the same ML-DSA-65 primitive the seal uses.
+//
+// The cert does NOT add a root of trust (it is self-signed — still TOFU on the
+// key), but it upgrades the identity from an opaque fingerprint to a portable,
+// standards-shaped assertion "CN=<subject> controls this ML-DSA-65 key", which
+// `certMatchesPqSeal` ties back to a seal by public-key fingerprint.
+import forge from "node-forge";
+import crypto from "node:crypto";
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+/** RFC 9881 / NIST: id-ml-dsa-65. Used for BOTH the SPKI alg and the cert signature alg. */
+export const ID_ML_DSA_65 = "2.16.840.1.101.3.4.3.18";
+const MLDSA65_PUBLIC_LEN = 1952;
+const MLDSA65_SIGNATURE_LEN = 3309;
+const OID_COMMON_NAME = "2.5.4.3";
+const OID_ORG_NAME = "2.5.4.10";
+const OID_BASIC_CONSTRAINTS = "2.5.29.19";
+const OID_KEY_USAGE = "2.5.29.15";
+const DEFAULT_VALIDITY_DAYS = 365;
+const asn1 = forge.asn1;
+const { Class, Type } = asn1;
+// ---------- binary <-> Uint8Array (node-forge speaks binary strings) ----------
+function u8ToBin(u8) {
+    let s = "";
+    for (let i = 0; i < u8.length; i++)
+        s += String.fromCharCode(u8[i]);
+    return s;
+}
+function binToU8(bin) {
+    const u8 = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        u8[i] = bin.charCodeAt(i) & 0xff;
+    return u8;
+}
+function sha256Hex(bytes) {
+    return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+// ---------- ASN.1 builders ----------
+function oidNode(oid) {
+    return asn1.create(Class.UNIVERSAL, Type.OID, false, asn1.oidToDer(oid).getBytes());
+}
+/** AlgorithmIdentifier for ML-DSA: SEQUENCE { OID } — parameters field ABSENT (RFC 9881 §4). */
+function mlDsaAlgId() {
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [oidNode(ID_ML_DSA_65)]);
+}
+/** DER BIT STRING with 0 unused bits wrapping raw bytes (keys, signatures). */
+function bitStringNode(bytes) {
+    return asn1.create(Class.UNIVERSAL, Type.BITSTRING, false, String.fromCharCode(0x00) + u8ToBin(bytes));
+}
+function utf8Node(value) {
+    return asn1.create(Class.UNIVERSAL, Type.UTF8, false, forge.util.encodeUtf8(value));
+}
+/** RDNSequence for a CN + O subject. */
+function nameNode(commonName, org) {
+    const rdn = (oid, value) => asn1.create(Class.UNIVERSAL, Type.SET, true, [
+        asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [oidNode(oid), utf8Node(value)]),
+    ]);
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [
+        rdn(OID_COMMON_NAME, commonName),
+        rdn(OID_ORG_NAME, org),
+    ]);
+}
+/** SubjectPublicKeyInfo: SEQUENCE { AlgorithmIdentifier, BIT STRING(raw pubkey) } (RFC 9881). */
+function spkiNode(pub) {
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [mlDsaAlgId(), bitStringNode(pub)]);
+}
+function timeNode(d) {
+    // UTCTime for years < 2050 (RFC 5280 §4.1.2.5), GeneralizedTime beyond.
+    if (d.getUTCFullYear() < 2050) {
+        return asn1.create(Class.UNIVERSAL, Type.UTCTIME, false, asn1.dateToUtcTime(d));
+    }
+    return asn1.create(Class.UNIVERSAL, Type.GENERALIZEDTIME, false, asn1.dateToGeneralizedTime(d));
+}
+/** Extension: SEQUENCE { OID, [critical BOOLEAN], OCTET STRING(DER of value) }. */
+function extensionNode(oid, critical, value) {
+    const children = [oidNode(oid)];
+    if (critical)
+        children.push(asn1.create(Class.UNIVERSAL, Type.BOOLEAN, false, String.fromCharCode(0xff)));
+    children.push(asn1.create(Class.UNIVERSAL, Type.OCTETSTRING, false, asn1.toDer(value).getBytes()));
+    return asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, children);
+}
+/**
+ * Issue a self-signed ML-DSA-65 X.509 certificate for the given signing keys.
+ * The certificate's public key is the raw 1952-byte ML-DSA-65 key, and its own
+ * signature is ML-DSA-65 over the TBSCertificate.
+ */
+export function issueMlDsaCertificate(opts) {
+    const { keys, subjectName, validityDays = DEFAULT_VALIDITY_DAYS } = opts;
+    if (!/^[\x20-\x7e]+$/.test(subjectName)) {
+        throw new Error(`subjectName "${subjectName}" contains non-ASCII characters`);
+    }
+    const pub = keys.mldsa65PublicKey;
+    if (pub.length !== MLDSA65_PUBLIC_LEN) {
+        throw new Error(`ML-DSA-65 public key must be ${MLDSA65_PUBLIC_LEN} bytes, got ${pub.length}`);
+    }
+    // Serial: 128 bits CSPRNG, top bit cleared (positive DER INTEGER), nonzero lead.
+    let serial;
+    if (opts.serial) {
+        serial = opts.serial;
+    }
+    else {
+        const s = crypto.randomBytes(16);
+        s[0] = (s[0] & 0x7f) | 0x40;
+        serial = s;
+    }
+    const notBefore = opts.notBefore ?? new Date();
+    const notAfter = new Date(notBefore.getTime() + validityDays * 86_400_000);
+    const cn = `E-sig PQ (${subjectName})`;
+    const name = () => nameNode(cn, subjectName);
+    const version = asn1.create(Class.CONTEXT_SPECIFIC, 0, true, [
+        asn1.create(Class.UNIVERSAL, Type.INTEGER, false, String.fromCharCode(0x02)), // v3
+    ]);
+    const serialNode = asn1.create(Class.UNIVERSAL, Type.INTEGER, false, u8ToBin(serial));
+    const validity = asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [timeNode(notBefore), timeNode(notAfter)]);
+    // basicConstraints (CA:FALSE = empty SEQUENCE) + keyUsage (digitalSignature + nonRepudiation).
+    const basicConstraints = extensionNode(OID_BASIC_CONSTRAINTS, true, asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, []));
+    const keyUsage = extensionNode(OID_KEY_USAGE, true, 
+    // bits 0 (digitalSignature) + 1 (nonRepudiation) set → 0xC0, 6 unused bits.
+    asn1.create(Class.UNIVERSAL, Type.BITSTRING, false, String.fromCharCode(0x06) + String.fromCharCode(0xc0)));
+    const extensions = asn1.create(Class.CONTEXT_SPECIFIC, 3, true, [
+        asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [basicConstraints, keyUsage]),
+    ]);
+    const tbs = asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [
+        version,
+        serialNode,
+        mlDsaAlgId(), // signature algorithm
+        name(), // issuer
+        validity,
+        name(), // subject (self-signed → issuer == subject)
+        spkiNode(pub),
+        extensions,
+    ]);
+    const tbsDer = binToU8(asn1.toDer(tbs).getBytes());
+    const signature = ml_dsa65.sign(tbsDer, keys.mldsa65SecretKey);
+    const certAsn1 = asn1.create(Class.UNIVERSAL, Type.SEQUENCE, true, [
+        tbs,
+        mlDsaAlgId(),
+        bitStringNode(signature),
+    ]);
+    const certDer = binToU8(asn1.toDer(certAsn1).getBytes());
+    const certPem = derToPem(certDer);
+    return {
+        certPem,
+        certDer,
+        fingerprint: sha256Hex(certDer),
+        publicKeyFingerprint: sha256Hex(pub),
+        notBefore,
+        notAfter,
+    };
+}
+function derToPem(der) {
+    const b64 = Buffer.from(der).toString("base64");
+    const lines = b64.match(/.{1,64}/g) ?? [];
+    return `-----BEGIN CERTIFICATE-----\n${lines.join("\n")}\n-----END CERTIFICATE-----\n`;
+}
+function pemToDer(pem) {
+    const b64 = pem.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, "");
+    return new Uint8Array(Buffer.from(b64, "base64"));
+}
+/** Read one definite-length DER TLV starting at `offset`. */
+function readTlv(der, offset) {
+    if (offset + 1 >= der.length)
+        throw new Error("DER: truncated TLV");
+    const tag = der[offset];
+    let i = offset + 1;
+    let len = der[i++];
+    if (len & 0x80) {
+        const n = len & 0x7f;
+        if (n === 0 || n > 4)
+            throw new Error("DER: unsupported length encoding");
+        len = 0;
+        for (let k = 0; k < n; k++)
+            len = (len << 8) | der[i++];
+    }
+    const contentStart = i;
+    const end = contentStart + len;
+    if (end > der.length)
+        throw new Error("DER: length exceeds buffer");
+    return { tag, start: offset, contentStart, end };
+}
+/**
+ * Parse a self-signed ML-DSA-65 certificate. The TBS bytes are recovered by a
+ * raw TLV slice of the original DER (never re-encoded), so signature
+ * verification is over the exact signed bytes.
+ */
+export function parseMlDsaCertificate(cert) {
+    const der = typeof cert === "string" ? pemToDer(cert) : cert;
+    // Certificate ::= SEQUENCE { tbsCertificate, signatureAlgorithm, signatureValue }
+    const outer = readTlv(der, 0);
+    const tbs = readTlv(der, outer.contentStart);
+    const sigAlg = readTlv(der, tbs.end);
+    const sigVal = readTlv(der, sigAlg.end);
+    const tbsDer = der.slice(tbs.start, tbs.end);
+    // signatureValue is a BIT STRING: first content byte = unused-bits count (0).
+    const signature = der.slice(sigVal.contentStart + 1, sigVal.end);
+    // Human-readable + key fields via node-forge (structure is standard X.509).
+    const parsed = asn1.fromDer(forge.util.createBuffer(u8ToBin(der)));
+    const tbsNode = parsed.value[0];
+    const kids = tbsNode.value;
+    // With explicit version [0], fields are: [0]=version [1]=serial [2]=sigAlg
+    // [3]=issuer [4]=validity [5]=subject [6]=spki [7]=extensions.
+    const validityNode = kids[4];
+    const subjectNode = kids[5];
+    const spkiNode = kids[6];
+    const notBefore = asn1.utcTimeToDate(validityNode.value[0].value);
+    const notAfter = asn1.utcTimeToDate(validityNode.value[1].value);
+    const subjectCommonName = extractCommonName(subjectNode);
+    const spkiKids = spkiNode.value;
+    const algOid = asn1.derToOid(spkiKids[0].value[0].value);
+    const bitStr = spkiKids[1].value; // leading unused-bits byte
+    const publicKey = binToU8(bitStr.slice(1));
+    return {
+        subjectCommonName,
+        notBefore,
+        notAfter,
+        publicKey,
+        publicKeyFingerprint: sha256Hex(publicKey),
+        signatureAlgOid: algOid,
+        tbsDer,
+        signature,
+    };
+}
+function extractCommonName(nameNode) {
+    for (const rdn of nameNode.value) {
+        for (const atv of rdn.value) {
+            const [oidNode, valNode] = atv.value;
+            if (asn1.derToOid(oidNode.value) === OID_COMMON_NAME) {
+                return forge.util.decodeUtf8(valNode.value);
+            }
+        }
+    }
+    return "";
+}
+/**
+ * Verify a self-signed ML-DSA-65 certificate: correct algorithm, the self
+ * signature validates against the embedded public key, and it is within its
+ * validity window. Never throws.
+ */
+export function verifyMlDsaCertificate(cert, now = new Date()) {
+    const failures = [];
+    try {
+        const p = parseMlDsaCertificate(cert);
+        const algOk = p.signatureAlgOid === ID_ML_DSA_65;
+        if (!algOk)
+            failures.push(`unexpected signature algorithm ${p.signatureAlgOid}`);
+        let selfSignatureOk = false;
+        if (p.publicKey.length === MLDSA65_PUBLIC_LEN &&
+            p.signature.length === MLDSA65_SIGNATURE_LEN) {
+            try {
+                selfSignatureOk = ml_dsa65.verify(p.signature, p.tbsDer, p.publicKey);
+            }
+            catch {
+                selfSignatureOk = false;
+            }
+        }
+        if (!selfSignatureOk)
+            failures.push("ML-DSA-65 self-signature invalid");
+        const t = now.getTime();
+        const timeValid = t >= p.notBefore.getTime() && t <= p.notAfter.getTime();
+        if (!timeValid)
+            failures.push("certificate is outside its validity window");
+        return { ok: algOk && selfSignatureOk && timeValid, algOk, selfSignatureOk, timeValid, failures };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            algOk: false,
+            selfSignatureOk: false,
+            timeValid: false,
+            failures: [`certificate parse error: ${e.message}`],
+        };
+    }
+}
+/**
+ * Bind a certificate to a post-quantum seal: the cert must be valid AND its
+ * public key must be the one that produced the seal (fingerprint match). This
+ * is how a relying party upgrades from raw-fingerprint pinning to an X.509
+ * identity without changing the seal format.
+ */
+export function certMatchesPqSeal(cert, seal, now = new Date()) {
+    const verdict = verifyMlDsaCertificate(cert, now);
+    if (!verdict.ok)
+        return false;
+    const p = parseMlDsaCertificate(cert);
+    return p.publicKeyFingerprint === seal.keys.mldsa65Fpr;
+}
+//# sourceMappingURL=pq-cert.js.map

package/dist/pq-cert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-cert.js","sourceRoot":"","sources":["../src/pq-cert.ts"],"names":[],"mappings":"AAAA,iBAAiB;AACjB,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,+DAA+D;AAC/D,0EAA0E;AAC1E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,qEAAqE;AAErE,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAIzD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAkC,CAAC;AAE/D,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAC1C,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;AAE7B,iFAAiF;AAEjF,SAAS,OAAO,CAAC,EAAc;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,OAAO,EAAE,CAAC;AACZ,CAAC;AACD,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,uCAAuC;AAEvC,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,wCAAwC;AACxC,SAAS,QAAQ,CAAC,UAAkB,EAAE,GAAW;IAC/C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE,CACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;KACnF,CAAC,CAAC;IACL,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACvD,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC;QAChC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC;KACvB,CAAC,CAAC;AACL,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAe;IAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,QAAQ,CAAC,CAAO;IACvB,wEAAwE;IACxE,IAAI,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,GAAW,EAAE,QAAiB,EAAE,KAAsB;IAC3E,MAAM,QAAQ,GAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1G,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,GAAG,qBAAqB,EAAE,GAAG,IAAI,CAAC;IACzE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,iCAAiC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,kBAAkB,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,iFAAiF;IACjF,IAAI,MAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QAC5B,MAAM,GAAG,CAAC,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;IAE3E,MAAM,EAAE,GAAG,aAAa,WAAW,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE;QAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK;KACpF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE9G,+FAA+F;IAC/F,MAAM,gBAAgB,GAAG,aAAa,CACpC,qBAAqB,EACrB,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CACtD,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAC5B,aAAa,EACb,IAAI;IACJ,4EAA4E;IAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAC3G,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;KAChF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5D,OAAO;QACP,UAAU;QACV,UAAU,EAAE,EAAE,sBAAsB;QACpC,IAAI,EAAE,EAAE,SAAS;QACjB,QAAQ;QACR,IAAI,EAAE,EAAE,4CAA4C;QACpD,QAAQ,CAAC,GAAG,CAAC;QACb,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjE,GAAG;QACH,UAAU,EAAE;QACZ,aAAa,CAAC,SAAS,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO;QACL,OAAO;QACP,OAAO;QACP,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,SAAS,CAAC,GAAG,CAAC;QACpC,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAWD,6DAA6D;AAC7D,SAAS,OAAO,CAAC,GAAe,EAAE,MAAc;IAC9C,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACnB,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACnB,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC1E,GAAG,GAAG,CAAC,CAAC;QACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,YAAY,GAAG,GAAG,CAAC;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7D,kFAAkF;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,KAA0B,CAAC;IAChD,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAE,YAAY,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAE,YAAY,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IAElG,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAA0B,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC,2BAA2B;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,iBAAiB;QACjB,SAAS;QACT,QAAQ;QACR,SAAS;QACT,oBAAoB,EAAE,SAAS,CAAC,SAAS,CAAC;QAC1C,eAAe,EAAE,MAAM;QACvB,MAAM;QACN,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAyB;IAClD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAA0B,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAA0B,EAAE,CAAC;YACjD,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAA0B,CAAC;YAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAe,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyB,EAAE,MAAY,IAAI,IAAI,EAAE;IACtF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,KAAK,GAAG,CAAC,CAAC,eAAe,KAAK,YAAY,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAEjF,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IACE,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB;YACzC,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,qBAAqB,EAC5C,CAAC;YACD,IAAI,CAAC;gBACH,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAExE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1E,IAAI,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAE5E,OAAO,EAAE,EAAE,EAAE,KAAK,IAAI,eAAe,IAAI,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACpG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC,4BAA6B,CAAW,CAAC,OAAO,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAyB,EAAE,IAAY,EAAE,MAAY,IAAI,IAAI,EAAE;IAC/F,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,oBAAoB,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;AACzD,CAAC"}

package/dist/pq-embed.d.ts

@@ -0,0 +1,22 @@
+import type { PqSeal } from "./pq-seal.js";
+/**
+ * Append `seal` to `pdf` as an incremental update. Returns the new PDF; the first
+ * `pdf.length` bytes are preserved verbatim, so `seal.coveredBytes` (set by the
+ * caller to `pdf.length`) still points at the original document in the final file.
+ */
+export declare function embedPqSeal(pdf: Buffer, seal: PqSeal): Buffer;
+/**
+ * Extract the embedded seal from a (possibly later-signed) PDF, or null if none
+ * is present / it is not valid JSON. Returns the FIRST seal if several exist.
+ *
+ * FIRST, deliberately: the genuine seal is embedded BEFORE the RSA PAdES
+ * signature, so it sits at the lowest file offset and is covered by the classical
+ * /ByteRange. A seal an attacker appends AFTER signing lands at a higher offset
+ * and is NOT RSA-covered — taking the first match ignores it, so even a standalone
+ * `verifyPqSeal` reports the authentic signer rather than the appended identity.
+ * Never throws — a malformed seal is treated as absent (fail-closed at verify).
+ */
+export declare function extractPqSeal(pdf: Buffer): PqSeal | null;
+/** True if the PDF carries an embedded post-quantum seal. */
+export declare function hasPqSeal(pdf: Buffer): boolean;
+//# sourceMappingURL=pq-embed.d.ts.map

package/dist/pq-embed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-embed.d.ts","sourceRoot":"","sources":["../src/pq-embed.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA+C3C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAiC7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASxD;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG9C"}

package/dist/pq-embed.js

@@ -0,0 +1,119 @@
+// pq-embed.ts
+//
+// Embed a post-quantum seal (see pq-seal.ts) into a rendered PDF as an
+// append-only incremental update, and extract it back out.
+//
+// WHY append-only: the seal signs SHA-256 of the document bytes it covers
+// (`coveredBytes` = length of the pre-seal PDF, P0). An incremental update never
+// rewrites prior bytes, so in the final signed file P2, the prefix P2[0:coveredBytes]
+// is byte-identical to P0 — the verifier recovers exactly what the seal signed.
+// This ordering (embed seal → THEN apply the RSA PAdES signature) also lets the
+// classical /ByteRange signature cryptographically cover the seal.
+//
+// The incremental update we append is deliberately minimal and mirrors the exact
+// xref/trailer byte layout @signpdf/placeholder-plain expects (it later parses
+// this file to add its own signature layer): one new indirect object holding the
+// base64 seal, one single-subsection classic xref, a trailer that copies the
+// document's /Root (+ /Info) and points /Prev at the previous xref, and a clean
+// `startxref … %%EOF` tail.
+//
+// Retrieval scans for the object's `/Seal(<base64>)` literal. Base64's alphabet
+// (A–Z a–z 0–9 + / =) contains no PDF-string metacharacters, so no escaping is
+// needed and a simple regex is unambiguous. @signpdf never rewrites these bytes,
+// so the seal survives the subsequent signing pass verbatim.
+/** Marker object type; also the retrieval anchor. */
+const SEAL_OBJ_TYPE = "ESigPQSeal";
+const SEAL_EXTRACT_RE = new RegExp(`/Type\\s*/${SEAL_OBJ_TYPE}/V\\s+1/Seal\\(([A-Za-z0-9+/=]+)\\)`, "g");
+/**
+ * Parse the most recent classic trailer to recover the fields our incremental
+ * update must carry forward: /Root, optional /Info, /Size (→ next free object
+ * number), and the last xref offset (→ our /Prev). Throws with a clear message
+ * on xref-stream PDFs, which the whole signing pipeline (@signpdf included)
+ * doesn't support anyway.
+ */
+function readLastTrailer(pdf) {
+    const text = pdf.toString("latin1"); // 1 byte ↔ 1 char, so string index === byte offset
+    const sxIdx = text.lastIndexOf("startxref");
+    if (sxIdx < 0)
+        throw new Error("pq-embed: no startxref found (not a classic PDF)");
+    const prevMatch = text.slice(sxIdx + "startxref".length).match(/\d+/);
+    if (!prevMatch)
+        throw new Error("pq-embed: could not read previous startxref offset");
+    const prevStartxref = parseInt(prevMatch[0], 10);
+    const trIdx = text.lastIndexOf("trailer");
+    if (trIdx < 0 || trIdx > sxIdx) {
+        throw new Error("pq-embed: classic trailer not found (xref-stream PDFs are unsupported)");
+    }
+    const dict = text.slice(trIdx, sxIdx);
+    const root = dict.match(/\/Root\s+(\d+\s+\d+\s+R)/);
+    const info = dict.match(/\/Info\s+(\d+\s+\d+\s+R)/);
+    const size = dict.match(/\/Size\s+(\d+)/);
+    if (!root)
+        throw new Error("pq-embed: trailer has no /Root");
+    if (!size)
+        throw new Error("pq-embed: trailer has no /Size");
+    return {
+        rootRef: root[1].replace(/\s+/g, " "),
+        infoRef: info?.[1].replace(/\s+/g, " "),
+        size: parseInt(size[1], 10),
+        prevStartxref,
+    };
+}
+/**
+ * Append `seal` to `pdf` as an incremental update. Returns the new PDF; the first
+ * `pdf.length` bytes are preserved verbatim, so `seal.coveredBytes` (set by the
+ * caller to `pdf.length`) still points at the original document in the final file.
+ */
+export function embedPqSeal(pdf, seal) {
+    const trailer = readLastTrailer(pdf);
+    const sealB64 = Buffer.from(JSON.stringify(seal), "utf8").toString("base64");
+    const objNum = trailer.size; // next free object number
+    // Separate our update from the prior %%EOF with a newline (harmless if the
+    // file already ended in one).
+    const head = Buffer.concat([pdf, Buffer.from("\n", "latin1")]);
+    const objOffset = head.length;
+    const objBuf = Buffer.from(`${objNum} 0 obj\n<</Type/${SEAL_OBJ_TYPE}/V 1/Seal(${sealB64})>>\nendobj\n`, "latin1");
+    const withObj = Buffer.concat([head, objBuf]);
+    const xrefOffset = withObj.length;
+    const paddedOffset = String(objOffset).padStart(10, "0");
+    const xref = Buffer.from("xref\n" +
+        `${objNum} 1\n` +
+        `${paddedOffset} 00000 n \n` + // 20-byte entry: 10 offset + gen 00000 + 'n' + trailing space + LF
+        "trailer\n<<\n" +
+        `/Size ${objNum + 1}\n` +
+        `/Root ${trailer.rootRef}\n` +
+        (trailer.infoRef ? `/Info ${trailer.infoRef}\n` : "") +
+        `/Prev ${trailer.prevStartxref}\n` +
+        ">>\nstartxref\n" +
+        `${xrefOffset}\n%%EOF\n`, "latin1");
+    return Buffer.concat([withObj, xref]);
+}
+/**
+ * Extract the embedded seal from a (possibly later-signed) PDF, or null if none
+ * is present / it is not valid JSON. Returns the FIRST seal if several exist.
+ *
+ * FIRST, deliberately: the genuine seal is embedded BEFORE the RSA PAdES
+ * signature, so it sits at the lowest file offset and is covered by the classical
+ * /ByteRange. A seal an attacker appends AFTER signing lands at a higher offset
+ * and is NOT RSA-covered — taking the first match ignores it, so even a standalone
+ * `verifyPqSeal` reports the authentic signer rather than the appended identity.
+ * Never throws — a malformed seal is treated as absent (fail-closed at verify).
+ */
+export function extractPqSeal(pdf) {
+    SEAL_EXTRACT_RE.lastIndex = 0;
+    const match = SEAL_EXTRACT_RE.exec(pdf.toString("latin1"));
+    if (!match)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(match[1], "base64").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** True if the PDF carries an embedded post-quantum seal. */
+export function hasPqSeal(pdf) {
+    SEAL_EXTRACT_RE.lastIndex = 0;
+    return SEAL_EXTRACT_RE.test(pdf.toString("latin1"));
+}
+//# sourceMappingURL=pq-embed.js.map

package/dist/pq-embed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-embed.js","sourceRoot":"","sources":["../src/pq-embed.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,uEAAuE;AACvE,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,sFAAsF;AACtF,gFAAgF;AAChF,gFAAgF;AAChF,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,4BAA4B;AAC5B,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,6DAA6D;AAI7D,qDAAqD;AACrD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,aAAa,aAAa,qCAAqC,EAAE,GAAG,CAAC,CAAC;AASzG;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,mDAAmD;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAE7D,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACvC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3B,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,0BAA0B;IAEvD,2EAA2E;IAC3E,8BAA8B;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,GAAG,MAAM,mBAAmB,aAAa,aAAa,OAAO,eAAe,EAC5E,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAElC,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CACtB,QAAQ;QACN,GAAG,MAAM,MAAM;QACf,GAAG,YAAY,aAAa,GAAG,mEAAmE;QAClG,eAAe;QACf,SAAS,MAAM,GAAG,CAAC,IAAI;QACvB,SAAS,OAAO,CAAC,OAAO,IAAI;QAC5B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,SAAS,OAAO,CAAC,aAAa,IAAI;QAClC,iBAAiB;QACjB,GAAG,UAAU,WAAW,EAC1B,QAAQ,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAW,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/pq-lifecycle.d.ts

@@ -0,0 +1,59 @@
+import { type PqSigningKeys, type PqPublicMaterial } from "./pq-seal.js";
+/** A persisted, wrapped post-quantum key bundle + its public identity material. */
+export interface StoredPqKeys {
+    id: string;
+    tenantId: string;
+    /** `wrapPqKeyBundle` output (AES-256-GCM). Never store the unwrapped bundle. */
+    keyBundleEncrypted: Uint8Array;
+    /** base64 raw Ed25519 public key. */
+    ed25519Public: string;
+    /** base64 raw ML-DSA-65 public key. */
+    mldsa65Public: string;
+    /** SHA-256 hex of the ML-DSA-65 public key — the identity to publish/pin. */
+    mldsa65Fpr: string;
+    /** 128-bit hex id over both public keys. */
+    keyId: string;
+    active: boolean;
+    rotatedFromId?: string | null;
+    createdAt: Date;
+}
+/** Bring-your-own persistence for post-quantum key bundles (mirrors CertStore). */
+export interface PqKeyStore {
+    /** The active bundle for a tenant, or null if none exists yet. */
+    findActive(tenantId: string): Promise<StoredPqKeys | null>;
+    /** Persist a new bundle. Ensure at most one `active=true` per tenant. */
+    insert(input: {
+        tenantId: string;
+        keyBundleEncrypted: Uint8Array;
+        public: PqPublicMaterial;
+        rotatedFromId?: string | null;
+    }): Promise<StoredPqKeys>;
+    /** Mark a bundle inactive (used during rotation). */
+    deactivate(id: string): Promise<void>;
+}
+export interface EnsurePqKeysResult {
+    record: StoredPqKeys;
+    /** In-memory signing keys ready for `signPdf({ pqSeal: { keys } })`. */
+    keys: PqSigningKeys;
+    public: PqPublicMaterial;
+}
+/**
+ * Ensure an active post-quantum key bundle for the tenant, generating + wrapping
+ * one on first use. `passphrase` (≥24 chars) wraps the bundle at rest.
+ */
+export declare function ensureActivePqKeys(opts: {
+    store: PqKeyStore;
+    tenantId: string;
+    passphrase: string;
+}): Promise<EnsurePqKeysResult>;
+/**
+ * Force a rotation: deactivate the current bundle (if any) and mint a fresh one
+ * with `rotatedFromId` set. Documents already sealed with the old key keep
+ * verifying — verification uses the public key embedded in each seal.
+ */
+export declare function rotatePqKeys(opts: {
+    store: PqKeyStore;
+    tenantId: string;
+    passphrase: string;
+}): Promise<EnsurePqKeysResult>;
+//# sourceMappingURL=pq-lifecycle.d.ts.map

package/dist/pq-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-lifecycle.d.ts","sourceRoot":"","sources":["../src/pq-lifecycle.ts"],"names":[],"mappings":"AAeA,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,kBAAkB,EAAE,UAAU,CAAC;IAC/B,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3D,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,kBAAkB,EAAE,UAAU,CAAC;QAC/B,MAAM,EAAE,gBAAgB,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1B,qDAAqD;IACrD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiB9B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAI9B"}

package/dist/pq-lifecycle.js

@@ -0,0 +1,55 @@
+// pq-lifecycle.ts
+//
+// Stack-agnostic "ensure an active post-quantum key bundle for this tenant"
+// helper — the ML-DSA-65 / Ed25519 analogue of ensureActiveCert. Depends only on
+// the bring-your-own `PqKeyStore` interface plus the crypto in pq-seal; no DB, no
+// stack assumptions.
+//
+// Unlike signing certificates, hybrid key bundles do not expire on a clock —
+// rotation is an explicit, deployment-driven decision (e.g. suspected key
+// compromise, or a policy roll). `ensureActivePqKeys` therefore generates on
+// first use and reuses thereafter; `rotatePqKeys` mints a fresh bundle and links
+// the predecessor. Consumers that don't want a managed store can skip this module
+// entirely and use generatePqKeyBundle / wrapPqKeyBundle / loadPqSigningKeys
+// directly, persisting the wrapped blob wherever they like.
+import { generatePqKeyBundle, loadPqSigningKeys, wrapPqKeyBundle, unwrapPqKeyBundle, } from "./pq-seal.js";
+/**
+ * Ensure an active post-quantum key bundle for the tenant, generating + wrapping
+ * one on first use. `passphrase` (≥24 chars) wraps the bundle at rest.
+ */
+export async function ensureActivePqKeys(opts) {
+    const existing = await opts.store.findActive(opts.tenantId);
+    if (existing) {
+        const bundle = unwrapPqKeyBundle(existing.keyBundleEncrypted, opts.passphrase);
+        const keys = loadPqSigningKeys(bundle);
+        return {
+            record: existing,
+            keys,
+            public: {
+                ed25519: existing.ed25519Public,
+                mldsa65: existing.mldsa65Public,
+                mldsa65Fpr: existing.mldsa65Fpr,
+                keyId: existing.keyId,
+            },
+        };
+    }
+    return mint(opts.store, opts.tenantId, opts.passphrase, null);
+}
+/**
+ * Force a rotation: deactivate the current bundle (if any) and mint a fresh one
+ * with `rotatedFromId` set. Documents already sealed with the old key keep
+ * verifying — verification uses the public key embedded in each seal.
+ */
+export async function rotatePqKeys(opts) {
+    const existing = await opts.store.findActive(opts.tenantId);
+    if (existing)
+        await opts.store.deactivate(existing.id);
+    return mint(opts.store, opts.tenantId, opts.passphrase, existing?.id ?? null);
+}
+async function mint(store, tenantId, passphrase, rotatedFromId) {
+    const { bundle, public: pub } = generatePqKeyBundle();
+    const keyBundleEncrypted = wrapPqKeyBundle(bundle, passphrase);
+    const record = await store.insert({ tenantId, keyBundleEncrypted, public: pub, rotatedFromId });
+    return { record, keys: loadPqSigningKeys(bundle), public: pub };
+}
+//# sourceMappingURL=pq-lifecycle.js.map

package/dist/pq-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pq-lifecycle.js","sourceRoot":"","sources":["../src/pq-lifecycle.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,iFAAiF;AACjF,kFAAkF;AAClF,6EAA6E;AAC7E,4DAA4D;AAE5D,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AA2CtB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,MAAM,EAAE;gBACN,OAAO,EAAE,QAAQ,CAAC,aAAa;gBAC/B,OAAO,EAAE,QAAQ,CAAC,aAAa;gBAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAIlC;IACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ;QAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,KAAiB,EACjB,QAAgB,EAChB,UAAkB,EAClB,aAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACtD,MAAM,kBAAkB,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAClE,CAAC"}