@forgezero/runtime 0.1.18 → 0.1.19

package/dist/vault-runtime.d.ts

@@ -6,9 +6,9 @@
  * for one operation. Keeping the algorithms here makes their byte formats
  * independently testable without making `@forgezero/vault.get()` a signer.
  */
-export declare const VAULT_RUNTIME_KINDS: readonly ["random-password", "data-encryption-key", "key-encryption-key", "hmac-key", "jwt-hmac-key", "ed25519-key", "secp256k1-key", "ssh-ca-key", "chain-key"];
+export declare const VAULT_RUNTIME_KINDS: readonly ["random-password", "data-encryption-key", "key-encryption-key", "hmac-key", "jwt-hmac-key", "ed25519-key", "ml-dsa-65-key", "secp256k1-key", "ssh-ca-key", "chain-key"];
 export type VaultRuntimeKind = typeof VAULT_RUNTIME_KINDS[number];
-export declare const VAULT_RUNTIME_ALGORITHM_IDS: readonly ["password-v1", "aes-256-gcm", "aes-256-kw", "hmac-sha256", "hmac-sha512", "jws-hs256", "ed25519", "secp256k1", "ssh-ed25519-ca", "ethereum-secp256k1", "solana-ed25519"];
+export declare const VAULT_RUNTIME_ALGORITHM_IDS: readonly ["password-v1", "aes-256-gcm", "aes-256-kw", "hmac-sha256", "hmac-sha512", "jws-hs256", "ed25519", "ml-dsa-65", "secp256k1", "ssh-ed25519-ca", "ethereum-secp256k1", "solana-ed25519"];
 export type VaultRuntimeAlgorithm = typeof VAULT_RUNTIME_ALGORITHM_IDS[number];
 export type VaultRuntimeOperation = 'generate-password' | 'encrypt' | 'decrypt' | 'wrap' | 'unwrap' | 'sign' | 'verify' | 'sign-jwt' | 'verify-jwt' | 'issue-ssh-certificate' | 'derive-public-key' | 'derive-address';
 export interface VaultRuntimeAlgorithmDefinition {
@@ -66,6 +66,12 @@ export declare const VAULT_RUNTIME_ALGORITHMS: readonly [{
     readonly operations: readonly ["derive-public-key", "sign", "verify"];
     readonly exports: "public-only";
     readonly standard: "RFC 8032";
+}, {
+    readonly kind: "ml-dsa-65-key";
+    readonly algorithm: "ml-dsa-65";
+    readonly operations: readonly ["derive-public-key", "sign", "verify"];
+    readonly exports: "public-only";
+    readonly standard: "FIPS 204 ML-DSA-65";
 }, {
     readonly kind: "secp256k1-key";
     readonly algorithm: "secp256k1";
@@ -182,6 +188,9 @@ export declare function verifyCompactJws(key: Uint8Array, token: string, options
 export declare const ed25519PublicKey: (secret: Uint8Array) => Uint8Array;
 export declare const ed25519Sign: (secret: Uint8Array, message: Uint8Array) => Uint8Array;
 export declare const ed25519Verify: (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => boolean;
+export declare const mlDsa65PublicKey: (seed: Uint8Array) => Uint8Array;
+export declare const mlDsa65Sign: (seed: Uint8Array, message: Uint8Array) => Uint8Array;
+export declare const mlDsa65Verify: (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => boolean;
 export declare const secp256k1PublicKey: (secret: Uint8Array, compressed?: boolean) => Uint8Array;
 export declare const secp256k1SignDigest: (secret: Uint8Array, digest: Uint8Array) => Uint8Array;
 export declare const secp256k1VerifyDigest: (publicKey: Uint8Array, digest: Uint8Array, signature: Uint8Array) => boolean;

package/dist/vault-runtime.js

@@ -13,6 +13,7 @@ import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { hmac } from "@noble/hashes/hmac.js";
 import { keccak_256 } from "@noble/hashes/sha3.js";
 import { sha256, sha512 } from "@noble/hashes/sha2.js";
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
 import { base58 } from "@scure/base";
 var VAULT_RUNTIME_KINDS = [
   "random-password",
@@ -21,6 +22,7 @@ var VAULT_RUNTIME_KINDS = [
   "hmac-key",
   "jwt-hmac-key",
   "ed25519-key",
+  "ml-dsa-65-key",
   "secp256k1-key",
   "ssh-ca-key",
   "chain-key"
@@ -33,6 +35,7 @@ var VAULT_RUNTIME_ALGORITHM_IDS = [
   "hmac-sha512",
   "jws-hs256",
   "ed25519",
+  "ml-dsa-65",
   "secp256k1",
   "ssh-ed25519-ca",
   "ethereum-secp256k1",
@@ -46,6 +49,7 @@ var VAULT_RUNTIME_ALGORITHMS = [
   { kind: "hmac-key", algorithm: "hmac-sha512", operations: ["sign", "verify"], exports: "none", standard: "RFC 2104 / SHA-512" },
   { kind: "jwt-hmac-key", algorithm: "jws-hs256", operations: ["sign-jwt", "verify-jwt"], exports: "none", standard: "RFC 7515 / RFC 7518" },
   { kind: "ed25519-key", algorithm: "ed25519", operations: ["derive-public-key", "sign", "verify"], exports: "public-only", standard: "RFC 8032" },
+  { kind: "ml-dsa-65-key", algorithm: "ml-dsa-65", operations: ["derive-public-key", "sign", "verify"], exports: "public-only", standard: "FIPS 204 ML-DSA-65" },
   { kind: "secp256k1-key", algorithm: "secp256k1", operations: ["derive-public-key", "sign", "verify"], exports: "public-only", standard: "SEC 2 secp256k1" },
   { kind: "ssh-ca-key", algorithm: "ssh-ed25519-ca", operations: ["derive-public-key", "issue-ssh-certificate"], exports: "public-only", standard: "OpenSSH PROTOCOL.certkeys" },
   { kind: "chain-key", algorithm: "ethereum-secp256k1", operations: ["derive-public-key", "derive-address", "sign", "verify"], exports: "public-only", standard: "BIP-32/BIP-44/SLIP-44/EIP-55" },
@@ -208,6 +212,9 @@ function verifyCompactJws(key, token, options = {}) {
 var ed25519PublicKey = (secret) => ed25519.getPublicKey(secret);
 var ed25519Sign = (secret, message) => ed25519.sign(message, secret);
 var ed25519Verify = (publicKey, message, signature) => ed25519.verify(signature, message, publicKey);
+var mlDsa65PublicKey = (seed) => ml_dsa65.keygen(seed).publicKey;
+var mlDsa65Sign = (seed, message) => ml_dsa65.sign(message, ml_dsa65.keygen(seed).secretKey);
+var mlDsa65Verify = (publicKey, message, signature) => ml_dsa65.verify(signature, message, publicKey);
 var secp256k1PublicKey = (secret, compressed = true) => secp256k1.getPublicKey(secret, compressed);
 var secp256k1SignDigest = (secret, digest) => {
   if (digest.length !== 32)
@@ -254,6 +261,9 @@ export {
   secp256k1SignDigest,
   secp256k1PublicKey,
   passwordFromBytes,
+  mlDsa65Verify,
+  mlDsa65Sign,
+  mlDsa65PublicKey,
   hmacVerify,
   hmacSign,
   fromBase64Url,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/runtime",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "type": "module",
   "publishConfig": {
     "access": "public",