@e-sig/core 0.6.0 → 0.7.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Opendelphi contributors
+Copyright (c) 2026 VMVTech, Ltd.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/index.d.ts

@@ -1,15 +1,15 @@
 export { PemSigner, type PemSignerInput } from "./pem-signer.js";
 export { generateSelfSignedCert, encryptKeyPem, decryptKeyPem, type GenerateCertOptions, type GeneratedCert, } from "./cert-issuer.js";
 export { renderHtmlToPdf, type RenderHtmlToPdfOptions } from "./render-pdf.js";
-export { signPdf, type SignPdfInput, type SignPdfResult } from "./sign-pdf.js";
+export { signPdf, SUPPORTED_SUBFILTERS, type SubFilter, type SignPdfInput, type SignPdfResult, } from "./sign-pdf.js";
 export { verifyPdfStructure, verifyPdfSignature, type VerifyResult } from "./verify-pdf.js";
 export { buildTimeStampReq, parseTimeStampResp, parseTstInfo, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
-export type { Signer, SigningCertPem, SignedPdfMetadata, TsaTransport, } from "./types.js";
+export type { Signer, SigningCertPem, SignedPdfMetadata, TsaTransport, ExternalSigner, ExternalSignerKeyType, } from "./types.js";
 export type { StoredCert, CertStore, AuditLogEntry, AuditLogRow, AuditLogStore, EsigAuditAction, PdfStorageStore, } from "./adapters.js";
 export { ensureActiveCert, type EnsureCertResult } from "./cert-lifecycle.js";
 export { createEnvelope, resolveSigningToken, recordSignature, declineEnvelope, voidEnvelope, composeEnvelopeHtml, EnvelopeError, type Envelope, type EnvelopeSigner, type EnvelopeStatus, type EnvelopeSignerStatus, type EnvelopeStore, type CreateEnvelopeInput, type CreateEnvelopeResult, type TokenResolution, } from "./envelope.js";
 export { signDocument, type SignDocumentInput, type SignDocumentResult, } from "./sign-document.js";
-export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, type PqKeyBundle, type PqPublicMaterial, type PqSigningKeys, type PqSeal, type PqSealVerification, type BuildPqSealInput, } from "./pq-seal.js";
+export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, isWellFormedUuaidAssertion, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, type GeneratePqKeyBundleOptions, type PqKeyBundle, type PqPublicMaterial, type PqSigningKeys, type PqSeal, type PqSealVerification, type BuildPqSealInput, } from "./pq-seal.js";
 export { embedPqSeal, extractPqSeal, hasPqSeal } from "./pq-embed.js";
 export { verifyPqSeal, verifyDocument, type PqSealVerdict, type DocumentVerification, type VerifyPqSealOptions, type VerifyDocumentOptions, } from "./pq-verify.js";
 export { ensureActivePqKeys, rotatePqKeys, type PqKeyStore, type StoredPqKeys, type EnsurePqKeysResult, } from "./pq-lifecycle.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,OAAO,EACP,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -11,7 +11,7 @@
 export { PemSigner } from "./pem-signer.js";
 export { generateSelfSignedCert, encryptKeyPem, decryptKeyPem, } from "./cert-issuer.js";
 export { renderHtmlToPdf } from "./render-pdf.js";
-export { signPdf } from "./sign-pdf.js";
+export { signPdf, SUPPORTED_SUBFILTERS, } from "./sign-pdf.js";
 export { verifyPdfStructure, verifyPdfSignature } from "./verify-pdf.js";
 export { buildTimeStampReq, parseTimeStampResp, parseTstInfo, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
 // ---- Cert lifecycle (stack-agnostic; interface-only) ----
@@ -21,7 +21,7 @@ export { createEnvelope, resolveSigningToken, recordSignature, declineEnvelope,
 // ---- End-to-end orchestrator ----
 export { signDocument, } from "./sign-document.js";
 // ---- Post-quantum hybrid seal (Ed25519 + ML-DSA-65, FIPS 204) ----
-export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, } from "./pq-seal.js";
+export { generatePqKeyBundle, loadPqSigningKeys, publicMaterialForKeys, wrapPqKeyBundle, unwrapPqKeyBundle, buildPqSeal, verifyPqSealSignatures, isWellFormedUuaidAssertion, canonicalJson, PQ_SEAL_VERSION, PQ_SEAL_ALG, } from "./pq-seal.js";
 export { embedPqSeal, extractPqSeal, hasPqSeal } from "./pq-embed.js";
 export { verifyPqSeal, verifyDocument, } from "./pq-verify.js";
 export { ensureActivePqKeys, rotatePqKeys, } from "./pq-lifecycle.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAEhF,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAyC,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAmBxB,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,GASd,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,WAAW,GAOZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,GAKf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,GAKb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,gFAAgF;AAEhF,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,OAAO,EACP,oBAAoB,GAIrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAqBxB,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,GASd,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,aAAa,EACb,eAAe,EACf,WAAW,GAQZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,cAAc,GAKf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,GAKb,MAAM,cAAc,CAAC"}

package/dist/pem-signer.d.ts

@@ -1,8 +1,20 @@
 import { Signer } from "@signpdf/utils";
-import type { TsaTransport } from "./types.js";
+import type { ExternalSigner, TsaTransport } from "./types.js";
 export interface PemSignerInput {
-    keyPem: string;
-    certPem: string;
+    /** PEM-encoded RSA private key. Required unless `externalSigner` is provided. */
+    keyPem?: string;
+    /**
+     * PEM-encoded X.509 certificate. Required on the `keyPem` path; on the
+     * `externalSigner` path it defaults to `externalSigner.certificatePem`.
+     */
+    certPem?: string;
+    /**
+     * External signing seam (HSM / KMS — see `ExternalSigner` in types.ts).
+     * Mutually exclusive with `keyPem`. The private key never enters this
+     * process; the PKCS#7 signature is produced by `signRsaSha256` (sync or
+     * async) over the final signed-attributes SET.
+     */
+    externalSigner?: ExternalSigner;
     /**
      * Optional RFC 3161 timestamp transport. When provided, each produced
      * signature is upgraded from CAdES-B to CAdES-T by embedding a
@@ -20,7 +32,9 @@ export interface PemSignerInput {
     padesStrict?: boolean;
 }
 export declare class PemSigner extends Signer {
-    private privateKey;
+    /** Present on the in-memory path; absent when an ExternalSigner is used. */
+    private privateKey?;
+    private externalSigner?;
     private certificate;
     private tsa?;
     private padesStrict;
@@ -28,7 +42,9 @@ export declare class PemSigner extends Signer {
     lastTimestamped: boolean;
     /** Set when a non-required TSA call failed (signature falls back to CAdES-B). */
     lastTsaError?: string;
-    constructor({ keyPem, certPem, tsa, padesStrict }: PemSignerInput);
+    constructor({ keyPem, certPem, tsa, padesStrict, externalSigner }: PemSignerInput);
+    /** RSA modulus size in bytes (a PKCS1-v1_5 signature is exactly this long). */
+    private modulusBytes;
     sign(pdfBuffer: Buffer, signingTime?: Date): Promise<Buffer>;
     /**
      * Insert the ESS signing-certificate-v2 signed attribute into the first
@@ -36,6 +52,11 @@ export declare class PemSigner extends Signer {
      * modified set. In `padesStrict` mode the PAdES-forbidden signing-time
      * attribute is also removed. Returns the new signatureValue (forge binary
      * string) so the caller can timestamp the FINAL signature.
+     *
+     * This is the single point where the real signature is produced (the value
+     * forge computed during p7.sign() is overwritten unconditionally) — so it is
+     * also the ExternalSigner seam: on that path the raw DER of the SET is handed
+     * to `signRsaSha256` (awaited; sync or async), instead of the in-memory key.
      */
     private addSigningCertV2AndResign;
 }

package/dist/pem-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem-signer.d.ts","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAStD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAS/C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,SAAU,SAAQ,MAAM;IACnC,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAe;IAC3B,OAAO,CAAC,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,UAAS;IAC/B,iFAAiF;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEjB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,cAAc;IAc3D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IA2ElE;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;CAwClC"}
+{"version":3,"file":"pem-signer.d.ts","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAStD,OAAO,KAAK,EAAE,cAAc,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AAgBtF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,qBAAa,SAAU,SAAQ,MAAM;IACnC,4EAA4E;IAC5E,OAAO,CAAC,UAAU,CAAC,CAA2B;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAe;IAC3B,OAAO,CAAC,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,UAAS;IAC/B,iFAAiF;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEjB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,cAAc;IAuCjF,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAMd,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAsFlE;;;;;;;;;;;OAWG;YACW,yBAAyB;CAuDxC"}

package/dist/pem-signer.js

@@ -21,12 +21,20 @@ import forge from "node-forge";
 import { Signer, SignPdfError } from "@signpdf/utils";
 import { buildTimeStampReq, parseTimeStampResp, derStringToUint8, uint8ToDerString, OID_TIMESTAMP_TOKEN, } from "./timestamp.js";
 const asn1 = forge.asn1;
+/** Expected RSA modulus bit length per ExternalSigner keyType. */
+const EXTERNAL_KEY_BITS = {
+    "rsa-2048": 2048,
+    "rsa-3072": 3072,
+    "rsa-4096": 4096,
+};
 /** id-aa-signingCertificateV2 (ESS, RFC 5035) — binds the signer cert into the signed data. */
 const OID_SIGNING_CERT_V2 = "1.2.840.113549.1.9.16.2.47";
 /** id-signingTime (PKCS#9) — PAdES forbids this signed attribute (time belongs in /M). */
 const OID_SIGNING_TIME = "1.2.840.113549.1.9.5";
 export class PemSigner extends Signer {
+    /** Present on the in-memory path; absent when an ExternalSigner is used. */
     privateKey;
+    externalSigner;
     certificate;
     tsa;
     padesStrict;
@@ -34,19 +42,45 @@ export class PemSigner extends Signer {
     lastTimestamped = false;
     /** Set when a non-required TSA call failed (signature falls back to CAdES-B). */
     lastTsaError;
-    constructor({ keyPem, certPem, tsa, padesStrict }) {
+    constructor({ keyPem, certPem, tsa, padesStrict, externalSigner }) {
         super();
-        if (!keyPem.includes("-----BEGIN")) {
-            throw new Error("PemSigner: keyPem must be PEM-encoded");
+        if (externalSigner) {
+            if (keyPem) {
+                throw new Error("PemSigner: pass either keyPem or externalSigner, not both");
+            }
+            const pem = certPem ?? externalSigner.certificatePem;
+            if (!pem || !pem.includes("-----BEGIN CERTIFICATE-----")) {
+                throw new Error("PemSigner: certPem must be a PEM-encoded X.509 certificate");
+            }
+            this.certificate = forge.pki.certificateFromPem(pem);
+            const expectedBits = EXTERNAL_KEY_BITS[externalSigner.keyType];
+            if (!expectedBits) {
+                throw new Error(`PemSigner: unsupported externalSigner.keyType "${String(externalSigner.keyType)}"`);
+            }
+            const actualBits = this.certificate.publicKey.n.bitLength();
+            if (actualBits !== expectedBits) {
+                throw new Error(`PemSigner: externalSigner.keyType ${externalSigner.keyType} does not match the ` +
+                    `certificate's RSA modulus (${actualBits} bits)`);
+            }
+            this.externalSigner = externalSigner;
         }
-        if (!certPem.includes("-----BEGIN CERTIFICATE-----")) {
-            throw new Error("PemSigner: certPem must be a PEM-encoded X.509 certificate");
+        else {
+            if (!keyPem || !keyPem.includes("-----BEGIN")) {
+                throw new Error("PemSigner: keyPem must be PEM-encoded");
+            }
+            if (!certPem || !certPem.includes("-----BEGIN CERTIFICATE-----")) {
+                throw new Error("PemSigner: certPem must be a PEM-encoded X.509 certificate");
+            }
+            this.privateKey = forge.pki.privateKeyFromPem(keyPem);
+            this.certificate = forge.pki.certificateFromPem(certPem);
         }
-        this.privateKey = forge.pki.privateKeyFromPem(keyPem);
-        this.certificate = forge.pki.certificateFromPem(certPem);
         this.tsa = tsa;
         this.padesStrict = padesStrict ?? false;
     }
+    /** RSA modulus size in bytes (a PKCS1-v1_5 signature is exactly this long). */
+    modulusBytes() {
+        return Math.ceil(this.certificate.publicKey.n.bitLength() / 8);
+    }
     async sign(pdfBuffer, signingTime) {
         if (!Buffer.isBuffer(pdfBuffer)) {
             throw new SignPdfError("PDF expected as Buffer.", SignPdfError.TYPE_INPUT);
@@ -54,11 +88,20 @@ export class PemSigner extends Signer {
         // Reset per-call timestamp state (signpdf calls sign() once per signature).
         this.lastTimestamped = false;
         this.lastTsaError = undefined;
+        // Key handed to forge's synchronous p7.sign() pass. On the externalSigner
+        // path this is a placeholder shim: forge only needs an object with a
+        // sign(md) method, and the signature it produces here is ALWAYS discarded —
+        // addSigningCertV2AndResign() below recomputes the signature over the final
+        // (spliced) signed-attributes SET on BOTH paths. Doing the real external
+        // call there (in our own async code, with the raw to-be-signed bytes in
+        // hand) is what makes async HSM signers possible without a two-pass sign.
+        const forgeSigningKey = this.privateKey ??
+            placeholderForgeKey(this.modulusBytes());
         const p7 = forge.pkcs7.createSignedData();
         p7.content = forge.util.createBuffer(pdfBuffer.toString("binary"));
         p7.addCertificate(this.certificate);
         p7.addSigner({
-            key: this.privateKey,
+            key: forgeSigningKey,
             certificate: this.certificate,
             digestAlgorithm: forge.pki.oids.sha256,
             authenticatedAttributes: [
@@ -76,7 +119,7 @@ export class PemSigner extends Signer {
         // authenticatedAttributes list, so we splice it in and recompute the RSA
         // signature over the exact bytes. Returns the NEW signatureValue.
         const p7Asn1 = p7.toAsn1();
-        const sigValue = this.addSigningCertV2AndResign(p7Asn1);
+        const sigValue = await this.addSigningCertV2AndResign(p7Asn1);
         // No timestamp requested → CAdES-B (now cert-bound).
         if (!this.tsa) {
             return Buffer.from(forge.asn1.toDer(p7Asn1).getBytes(), "binary");
@@ -114,8 +157,13 @@ export class PemSigner extends Signer {
      * modified set. In `padesStrict` mode the PAdES-forbidden signing-time
      * attribute is also removed. Returns the new signatureValue (forge binary
      * string) so the caller can timestamp the FINAL signature.
+     *
+     * This is the single point where the real signature is produced (the value
+     * forge computed during p7.sign() is overwritten unconditionally) — so it is
+     * also the ExternalSigner seam: on that path the raw DER of the SET is handed
+     * to `signRsaSha256` (awaited; sync or async), instead of the in-memory key.
      */
-    addSigningCertV2AndResign(p7Asn1) {
+    async addSigningCertV2AndResign(p7Asn1) {
         const signerInfo = firstSignerInfoSeq(p7Asn1);
         const siChildren = signerInfo.value;
         // signedAttrs = the [0] IMPLICIT context node; encryptedDigest = the
@@ -144,13 +192,36 @@ export class PemSigner extends Signer {
         signedAttrs.value = attrs;
         // Re-sign: RSA over DER(signedAttrs re-tagged as SET OF), SHA-256.
         const setDer = asn1.toDer(asn1.create(asn1.Class.UNIVERSAL, asn1.Type.SET, true, attrs)).getBytes();
-        const md = forge.md.sha256.create();
-        md.update(setDer);
-        const newSig = this.privateKey.sign(md); // RSASSA-PKCS1-V1_5 (forge default)
+        let newSig;
+        if (this.externalSigner) {
+            // External seam: RSASSA-PKCS1-v1_5/SHA-256 over the same raw bytes —
+            // byte-identical to forge's key.sign(md) for the same key.
+            const sig = await this.externalSigner.signRsaSha256(derStringToUint8(setDer));
+            const expected = this.modulusBytes();
+            if (!(sig instanceof Uint8Array) || sig.length !== expected) {
+                throw new Error(`PemSigner: externalSigner.signRsaSha256 returned ${sig instanceof Uint8Array ? sig.length : typeof sig} bytes; expected exactly ${expected} (RSASSA-PKCS1-v1_5 signatures are modulus-sized)`);
+            }
+            newSig = uint8ToDerString(sig);
+        }
+        else {
+            const md = forge.md.sha256.create();
+            md.update(setDer);
+            newSig = this.privateKey.sign(md); // RSASSA-PKCS1-V1_5 (forge default)
+        }
         sigOctet.value = newSig;
         return newSig;
     }
 }
+/**
+ * Stand-in key for forge's internal (always-discarded) signing pass on the
+ * ExternalSigner path. node-forge accepts any object with a `sign(md)` method
+ * as a SignerInfo key; this one emits modulus-sized zero bytes so the ASN.1
+ * tree has a correctly-shaped signature OCTET STRING until
+ * addSigningCertV2AndResign() overwrites it with the real external signature.
+ */
+function placeholderForgeKey(modulusBytes) {
+    return { sign: () => "\x00".repeat(modulusBytes) };
+}
 /**
  * Build the ESS signing-certificate-v2 signed attribute (RFC 5035) binding the
  * signer certificate into the signed data:

package/dist/pem-signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"pem-signer.js","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAExB,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AACzD,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAsBhD,MAAM,OAAO,SAAU,SAAQ,MAAM;IAC3B,UAAU,CAA2B;IACrC,WAAW,CAAwB;IACnC,GAAG,CAAgB;IACnB,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,GAAG,KAAK,CAAC;IAC/B,iFAAiF;IAC1E,YAAY,CAAU;IAE7B,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAkB;QAC/D,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAA6B,CAAC;QAClF,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,WAAkB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAE9B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1C,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC;YACX,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM;YACtC,uBAAuB,EAAE;gBACvB,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;gBAChE,qEAAqE;gBACrE,8DAA8D;gBAC9D,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAsB,EAAE;gBAC7F,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;aACvC;SACF,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5B,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAExD,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YAElE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC1E,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAC9C;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC;YAEH,kDAAkD;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,qEAAqE;YACrE,0EAA0E;YAC1E,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAE3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC;YACV,CAAC;YACD,+CAA+C;YAC/C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAAC,MAAuB;QACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,KAA0B,CAAC;QAEzD,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,WAAwC,CAAC;QAC7C,IAAI,QAAqC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpF,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,KAAK,GAAG,WAAW,CAAC,KAA0B,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,gBAAgB,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;QAE1B,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC;QAC7E,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;IAExC,0EAA0E;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB;IACzG,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAChG,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC,4BAA4B;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzE,YAAY;KACb,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9F,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,WAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1G,WAAW,GAAG,KAAK,CAAC,CAAC,mCAAmC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,mBAAmB,CAC1B,WAA4B,EAC5B,aAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,CAAC,gCAAgC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAEA,UAAU,CAAC,KAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"pem-signer.js","sourceRoot":"","sources":["../src/pem-signer.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gBAAgB;AAEhB,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAExB,kEAAkE;AAClE,MAAM,iBAAiB,GAA0C;IAC/D,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AACzD,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAkChD,MAAM,OAAO,SAAU,SAAQ,MAAM;IACnC,4EAA4E;IACpE,UAAU,CAA4B;IACtC,cAAc,CAAkB;IAChC,WAAW,CAAwB;IACnC,GAAG,CAAgB;IACnB,WAAW,CAAU;IAE7B,6EAA6E;IACtE,eAAe,GAAG,KAAK,CAAC;IAC/B,iFAAiF;IAC1E,YAAY,CAAU;IAE7B,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAkB;QAC/E,KAAK,EAAE,CAAC;QACR,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,IAAI,cAAc,CAAC,cAAc,CAAC;YACrD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,kDAAkD,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CACpF,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAI,IAAI,CAAC,WAAW,CAAC,SAAqC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACzF,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,qCAAqC,cAAc,CAAC,OAAO,sBAAsB;oBAC/E,8BAA8B,UAAU,QAAQ,CACnD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAA6B,CAAC;YAClF,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,+EAA+E;IACvE,YAAY;QAClB,OAAO,IAAI,CAAC,IAAI,CACb,IAAI,CAAC,WAAW,CAAC,SAAqC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,WAAkB;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAE9B,0EAA0E;QAC1E,qEAAqE;QACrE,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,eAAe,GACnB,IAAI,CAAC,UAAU;YACd,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAyC,CAAC;QAEpF,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1C,EAAE,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC;YACX,GAAG,EAAE,eAAe;YACpB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM;YACtC,uBAAuB,EAAE;gBACvB,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;gBAChE,qEAAqE;gBACrE,8DAA8D;gBAC9D,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAsB,EAAE;gBAC7F,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;aACvC;SACF,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5B,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAE9D,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YAElE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC1E,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,KAAK,CAAC,SAAS,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,KAAK,EACL,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAC9C;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC;YAEH,kDAAkD;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,qEAAqE;YACrE,0EAA0E;YAC1E,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAE3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC;YACV,CAAC;YACD,+CAA+C;YAC/C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,yBAAyB,CAAC,MAAuB;QAC7D,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,KAA0B,CAAC;QAEzD,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,WAAwC,CAAC;QAC7C,IAAI,QAAqC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACvE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpF,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,KAAK,GAAG,WAAW,CAAC,KAA0B,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAe,CAAC,KAAK,gBAAgB,CAAC,CAAC;YAC/G,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;QAE1B,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAC9D,CAAC,QAAQ,EAAE,CAAC;QACb,IAAI,MAAc,CAAC;QACnB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GACpG,4BAA4B,QAAQ,mDAAmD,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClB,MAAM,GAAG,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC;QAC1E,CAAC;QACD,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,YAAoB;IAG/C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;IAExC,0EAA0E;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB;IACzG,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAChG,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC,4BAA4B;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAEzG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzE,YAAY;KACb,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9F,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,WAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1G,WAAW,GAAG,KAAK,CAAC,CAAC,mCAAmC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,mBAAmB,CAC1B,WAA4B,EAC5B,aAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAuC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAA0B,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjF,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,IAAI,WAAwC,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAA0B,EAAE,CAAC;QAC1D,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YACvC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,WAAW,GAAG,KAAK,CAAC,CAAC,gCAAgC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAEA,UAAU,CAAC,KAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC"}

package/dist/pq-seal.d.ts

@@ -5,6 +5,18 @@ export declare const PQ_SEAL_VERSION: 1;
 export declare const PQ_SEAL_ALG: "hybrid-ed25519-ml-dsa-65";
 /** Bundle schema version for the wrapped at-rest key material. */
 declare const PQ_BUNDLE_VERSION: 1;
+/**
+ * True if `value` is a structurally well-formed UUAID assertion — the exact rule
+ * `buildPqSeal` enforces on input and `verifyPqSealSignatures` enforces on a
+ * seal that carries one. This is an envelope check, NOT proof that the
+ * identifier resolves, exists, or belongs to the signer.
+ *
+ * Accepted here does NOT imply accepted by the UUAID registry: the registry
+ * additionally enforces semantics this package deliberately does not know
+ * (registered subject classes and object types, canonical UUID form). Expect a
+ * band of identifiers this will sign and a resolver will still reject.
+ */
+export declare function isWellFormedUuaidAssertion(value: unknown): value is string;
 /**
  * The wrappable at-rest key bundle. Persist `wrapPqKeyBundle(bundle, passphrase)`;
  * never store the raw bundle. Compact by design: an Ed25519 PKCS#8 key plus a
@@ -55,6 +67,14 @@ export interface PqSeal {
     signedAt: string;
     /** 128-bit hex id over both public keys. */
     keyId: string;
+    /**
+     * OPTIONAL signer-asserted UUAID (IAASO-0004 attribution). Omitted entirely
+     * unless the signer supplies one. Signed like every other payload field, so it
+     * is immutable once sealed — but it is a CLAIM by the seal key, not proof of
+     * identity: it binds key -> uuaid only. See the identity note at the top of
+     * this file before relying on it for attribution.
+     */
+    uuaid?: string;
     keys: {
         ed25519: string;
         mldsa65: string;
@@ -77,15 +97,36 @@ export interface PqSealVerification {
     fingerprintOk: boolean;
     /** The embedded `keyId` matches the digest of the two public keys it claims. */
     keyIdOk: boolean;
-    /** Hybrid verdict: every check passed (both signatures + fingerprint + keyId). */
+    /**
+     * The seal either asserts no UUAID, or asserts a structurally well-formed one.
+     * A seal carrying a malformed `uuaid` is rejected (fail-closed) even though its
+     * signatures are intact — a hand-crafted identity field is not something to
+     * pass downstream. True does NOT mean the assertion was verified.
+     */
+    uuaidOk: boolean;
+    /** Hybrid verdict: every check passed (both signatures + fingerprint + keyId + uuaid shape). */
     ok: boolean;
 }
+export interface GeneratePqKeyBundleOptions {
+    /**
+     * 32-byte ML-DSA-65 keygen seed. The same seed always derives the same
+     * keypair — supply one for deterministic key provisioning (e.g. from a KMS
+     * or sealed secret). Omit for a fresh random seed.
+     */
+    mldsa65Seed?: Uint8Array;
+    /**
+     * PKCS#8 DER Ed25519 private key to use instead of generating a fresh one.
+     * Together with `mldsa65Seed` this makes the whole bundle deterministic.
+     */
+    ed25519Pkcs8?: Uint8Array;
+}
 /**
  * Generate a fresh hybrid key bundle plus its derived public material. The bundle
  * is what you wrap + persist; the public material is what you publish/pin as the
- * signer's post-quantum identity.
+ * signer's post-quantum identity. Pass `opts` to provision deterministically
+ * from existing key material instead of random generation.
  */
-export declare function generatePqKeyBundle(): {
+export declare function generatePqKeyBundle(opts?: GeneratePqKeyBundleOptions): {
     bundle: PqKeyBundle;
     public: PqPublicMaterial;
 };
@@ -105,6 +146,15 @@ export interface BuildPqSealInput {
     keys: PqSigningKeys;
     /** Seal timestamp. Defaults to now. */
     signedAt?: Date;
+    /**
+     * OPTIONAL UUAID to assert as the signer identity (IAASO-0004 attribution).
+     * Omit — the default — to produce a seal byte-identical to pre-`uuaid` output.
+     * Rejected at build time unless structurally well-formed, so a malformed
+     * identifier can never be signed into a document. That check is structural
+     * only: passing it does not mean the UUAID registry will resolve or accept the
+     * identifier (see `isWellFormedUuaidAssertion`).
+     */
+    uuaid?: string;
 }
 /**
  * Produce a hybrid seal over `digestHex`. Both signatures are computed over the

package/dist/pq-seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pq-seal.d.ts","sourceRoot":"","sources":["../src/pq-seal.ts"],"names":[],"mappings":"AA0BA,OAAO,MAAM,MAAM,aAAa,CAAC;AAOjC,oFAAoF;AACpF,eAAO,MAAM,eAAe,EAAG,CAAU,CAAC;AAC1C,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAG,0BAAmC,CAAC;AAC/D,kEAAkE;AAClE,QAAA,MAAM,iBAAiB,EAAG,CAAU,CAAC;AAkBrC;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC;IACpC,gBAAgB,EAAE,UAAU,CAAC;IAC7B,gBAAgB,EAAE,UAAU,CAAC;IAC7B,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,OAAO,eAAe,CAAC;IAC1B,GAAG,EAAE,OAAO,WAAW,CAAC;IACxB,wDAAwD;IACxD,IAAI,EAAE,QAAQ,CAAC;IACf,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE;QACH,4DAA4D;QAC5D,OAAO,EAAE,MAAM,CAAC;QAChB,8DAA8D;QAC9D,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,aAAa,EAAE,OAAO,CAAC;IACvB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,EAAE,EAAE,OAAO,CAAC;CACb;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAcvF;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAsBpE;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,gBAAgB,CAE3E;AAID,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAEnF;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAMnF;AAID,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CA8DvE;AA2CD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD"}
+{"version":3,"file":"pq-seal.d.ts","sourceRoot":"","sources":["../src/pq-seal.ts"],"names":[],"mappings":"AAiDA,OAAO,MAAM,MAAM,aAAa,CAAC;AAOjC,oFAAoF;AACpF,eAAO,MAAM,eAAe,EAAG,CAAU,CAAC;AAC1C,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAG,0BAAmC,CAAC;AAC/D,kEAAkE;AAClE,QAAA,MAAM,iBAAiB,EAAG,CAAU,CAAC;AAkCrC;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE1E;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC;IACpC,gBAAgB,EAAE,UAAU,CAAC;IAC7B,gBAAgB,EAAE,UAAU,CAAC;IAC7B,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,OAAO,eAAe,CAAC;IAC1B,GAAG,EAAE,OAAO,WAAW,CAAC;IACxB,wDAAwD;IACxD,IAAI,EAAE,QAAQ,CAAC;IACf,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE;QACH,4DAA4D;QAC5D,OAAO,EAAE,MAAM,CAAC;QAChB,8DAA8D;QAC9D,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,aAAa,EAAE,OAAO,CAAC;IACvB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,EAAE,EAAE,OAAO,CAAC;CACb;AAID,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,0BAA+B,GACpC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAoCnD;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAsBpE;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,gBAAgB,CAE3E;AAID,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAEnF;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAMnF;AAID,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAiC3D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAqEvE;AA2CD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD"}

package/dist/pq-seal.js

@@ -20,6 +20,29 @@
 // A self-signed ML-DSA-65 X.509 certificate (RFC 9881 OID 2.16.840.1.101.3.4.3.18)
 // is a deliberate fast-follow, not required to ship the seal.
 //
+// Optional signer-asserted UUAID (`uuaid`): a signer MAY additionally assert the
+// UUAID identity it signs as, for IAASO-0004 (Media Provenance & Attribution)
+// attribution. The field is part of the signed payload, so it is bound under BOTH
+// schemes and cannot be added, removed or swapped on an existing seal.
+//
+//   What it proves:     the holder of THIS seal key claims to be THAT UUAID.
+//   What it does NOT:   that the UUAID's owner authorised this document.
+//
+// It is one half of a mutual binding (key -> uuaid). The other half (uuaid -> key,
+// i.e. the UUAID owner authenticating this seal key as theirs) lives in the UUAID
+// registry and is NOT established here. A relying party MUST NOT treat a bare
+// `uuaid` assertion as attribution: unmatched, it is worth exactly the TOFU
+// fingerprint next to it. Absent the second direction, an attacker who can mint
+// any seal can assert any UUAID.
+//
+// Backward compatibility: the field is omitted entirely when not supplied, so
+// seals from callers that never set it are byte-identical to pre-`uuaid` output,
+// and verifiers that predate the field still verify uuaid-bearing seals (the
+// signed payload is reconstructed generically as "the seal minus `sig`"). This is
+// why the field is additive at v1 rather than a version bump: bumping
+// PQ_SEAL_VERSION would break every already-deployed verifier, the added field
+// does not.
+//
 // Algorithm binding: both signatures are computed over the SAME canonical bytes —
 // the seal object minus its `sig` field — so digest, covered length, public keys,
 // timestamp and keyId are all bound together and cannot be swapped independently.
@@ -45,17 +68,65 @@ const MLDSA65_SIGNATURE_LEN = 3309;
 const MLDSA65_SEED_LEN = 32;
 const ED25519_RAW_PUBLIC_LEN = 32;
 const ED25519_SIGNATURE_LEN = 64;
-// ---------- Key generation / loading ----------
+/** Upper bound on an asserted UUAID string — bounds the seal, not the namespace. */
+const UUAID_MAX_LEN = 255;
+/**
+ * Structural shape of a UUAID: `uuaid:` followed by three or four
+ * `[A-Za-z0-9_-]` segments — covering both the compact profile
+ * (`uuaid:foundation:<objectType>:<uuid>`) and the federated profile
+ * (`uuaid:<subjectClass>:<jurisdiction>:<authority>:<localId>`).
+ *
+ * Deliberately structural only. Which subject classes and object types exist is
+ * a registry that evolves in the UUAID lane; hard-coding that enum here would
+ * make this package reject newly-registered-but-valid identifiers until it is
+ * republished, and it would bake another system's policy into a signed wire
+ * format. Semantic validation and resolution belong to the UUAID verifier.
+ */
+const UUAID_ASSERTION_RE = /^uuaid:[A-Za-z0-9_-]+:[A-Za-z0-9_-]+:[A-Za-z0-9_-]+(?::[A-Za-z0-9_-]+)?$/;
+/**
+ * True if `value` is a structurally well-formed UUAID assertion — the exact rule
+ * `buildPqSeal` enforces on input and `verifyPqSealSignatures` enforces on a
+ * seal that carries one. This is an envelope check, NOT proof that the
+ * identifier resolves, exists, or belongs to the signer.
+ *
+ * Accepted here does NOT imply accepted by the UUAID registry: the registry
+ * additionally enforces semantics this package deliberately does not know
+ * (registered subject classes and object types, canonical UUID form). Expect a
+ * band of identifiers this will sign and a resolver will still reject.
+ */
+export function isWellFormedUuaidAssertion(value) {
+    return typeof value === "string" && value.length <= UUAID_MAX_LEN && UUAID_ASSERTION_RE.test(value);
+}
 /**
  * Generate a fresh hybrid key bundle plus its derived public material. The bundle
  * is what you wrap + persist; the public material is what you publish/pin as the
- * signer's post-quantum identity.
+ * signer's post-quantum identity. Pass `opts` to provision deterministically
+ * from existing key material instead of random generation.
  */
-export function generatePqKeyBundle() {
-    const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
-    const ed25519Pkcs8 = privateKey.export({ type: "pkcs8", format: "der" });
-    const ed25519PublicRaw = rawEd25519FromKeyObject(publicKey);
-    const seed = crypto.randomBytes(MLDSA65_SEED_LEN);
+export function generatePqKeyBundle(opts = {}) {
+    let ed25519Pkcs8;
+    let ed25519PublicRaw;
+    if (opts.ed25519Pkcs8) {
+        const privateKey = crypto.createPrivateKey({
+            key: Buffer.from(opts.ed25519Pkcs8),
+            format: "der",
+            type: "pkcs8",
+        });
+        if (privateKey.asymmetricKeyType !== "ed25519") {
+            throw new Error(`generatePqKeyBundle: ed25519Pkcs8 must be an Ed25519 key, got ${privateKey.asymmetricKeyType}`);
+        }
+        ed25519Pkcs8 = Buffer.from(opts.ed25519Pkcs8);
+        ed25519PublicRaw = rawEd25519FromKeyObject(crypto.createPublicKey(privateKey));
+    }
+    else {
+        const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+        ed25519Pkcs8 = privateKey.export({ type: "pkcs8", format: "der" });
+        ed25519PublicRaw = rawEd25519FromKeyObject(publicKey);
+    }
+    if (opts.mldsa65Seed && opts.mldsa65Seed.length !== MLDSA65_SEED_LEN) {
+        throw new Error(`generatePqKeyBundle: mldsa65Seed must be ${MLDSA65_SEED_LEN} bytes, got ${opts.mldsa65Seed.length}`);
+    }
+    const seed = opts.mldsa65Seed ? Buffer.from(opts.mldsa65Seed) : crypto.randomBytes(MLDSA65_SEED_LEN);
     const { publicKey: mldsa65PublicKey } = ml_dsa65.keygen(seed);
     const bundle = {
         v: PQ_BUNDLE_VERSION,
@@ -116,6 +187,9 @@ export function buildPqSeal(input) {
     if (!Number.isInteger(input.coveredBytes) || input.coveredBytes <= 0) {
         throw new Error("buildPqSeal: coveredBytes must be a positive integer");
     }
+    if (input.uuaid !== undefined && !isWellFormedUuaidAssertion(input.uuaid)) {
+        throw new Error("buildPqSeal: uuaid must be a well-formed UUAID (uuaid:<3-or-4 segments>) — refusing to sign a malformed identity claim");
+    }
     const pub = publicMaterialForKeys(input.keys);
     const payload = {
         v: PQ_SEAL_VERSION,
@@ -125,6 +199,10 @@ export function buildPqSeal(input) {
         coveredBytes: input.coveredBytes,
         signedAt: (input.signedAt ?? new Date()).toISOString(),
         keyId: pub.keyId,
+        // Spread-in rather than `uuaid: input.uuaid` so the key is ABSENT (not
+        // `undefined`) when unused — canonicalJson would otherwise serialize it and
+        // change the signed bytes of every seal that never asked for attribution.
+        ...(input.uuaid !== undefined ? { uuaid: input.uuaid } : {}),
         keys: { ed25519: pub.ed25519, mldsa65: pub.mldsa65, mldsa65Fpr: pub.mldsa65Fpr },
     };
     const signingInput = Buffer.from(canonicalJson(payload), "utf8");
@@ -146,6 +224,7 @@ export function verifyPqSealSignatures(seal) {
         mldsa65: false,
         fingerprintOk: false,
         keyIdOk: false,
+        uuaidOk: false,
         ok: false,
     };
     try {
@@ -179,6 +258,10 @@ export function verifyPqSealSignatures(seal) {
             .digest("hex")
             .slice(0, 32);
         const keyIdOk = seal.keyId === expectedKeyId;
+        // An absent `uuaid` asserts nothing and is fine; a present one must be
+        // structurally sound. Both cases are already covered by the signatures —
+        // this only rejects identity fields no honest signer could have produced.
+        const uuaidOk = seal.uuaid === undefined || isWellFormedUuaidAssertion(seal.uuaid);
         let ed25519 = false;
         try {
             ed25519 = crypto.verify(null, signingInput, ed25519RawToPublicKey(ed25519Pub), ed25519Sig);
@@ -198,7 +281,8 @@ export function verifyPqSealSignatures(seal) {
             mldsa65,
             fingerprintOk,
             keyIdOk,
-            ok: ed25519 && mldsa65 && fingerprintOk && keyIdOk,
+            uuaidOk,
+            ok: ed25519 && mldsa65 && fingerprintOk && keyIdOk && uuaidOk,
         };
     }
     catch {