@forgezero/runtime 0.1.5 → 0.1.6

package/dist/custody-crypto.d.ts

@@ -28,13 +28,15 @@ export declare function openWithKey(key: Uint8Array, box: CipherBox, aad: string
  * plaintext — so a captured response is ciphertext, and opening it requires the
  * factor itself.
  *
- * X25519 + HKDF-SHA256 + AES-256-GCM, with the ephemeral public key carried in
- * the box. Nothing bespoke: the ephemeral-static shape is what every sealed-box
- * construction uses, and doing it by hand is how people lose the AAD.
+ * ML-KEM-768 + X25519 + HKDF-SHA256 + AES-256-GCM. Both KEM halves are
+ * mandatory: a captured custody envelope remains confidential after a future
+ * break of X25519, while the classical half hedges a failure in the newer KEM.
+ * The version is explicit and the opener accepts no legacy X25519-only shape.
  */
 export interface SealedToKey extends CipherBox {
-    /** base64 — the ephemeral public key this box was sealed with. */
-    ephemeral: string;
+    version: 2;
+    /** base64 — the mandatory hybrid ML-KEM-768 + X25519 ciphertext. */
+    kemCiphertext: string;
 }
 /** Seal to a recipient's public key. */
 export declare function sealToKey(recipientPublicKey: Uint8Array, plaintext: Uint8Array, aad: string): SealedToKey;

package/dist/custody-crypto.js

@@ -8,9 +8,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 
 // src/custody-crypto.ts
 import { gcm } from "@noble/ciphers/aes.js";
-import { x25519 } from "@noble/curves/ed25519.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
+import { ml_kem768_x25519 } from "@noble/post-quantum/hybrid.js";
 var KEY_BYTES = 32;
 var NONCE_BYTES = 12;
 var toBase64 = (bytes) => {
@@ -44,40 +44,62 @@ function openWithKey(key, box, aad) {
     throw new Error(`custody: unknown algorithm ${box.alg}`);
   return gcm(key, fromBase64(box.nonce), utf8(aad)).decrypt(fromBase64(box.ciphertext));
 }
-var WRAP_INFO = "forgezero:custody:wrap:v1";
-var wrapKey = (shared, ephemeral, recipient) => hkdf(sha256, shared, concatBytes(ephemeral, recipient), utf8(WRAP_INFO), 32);
-function concatBytes(left, right) {
-  const out = new Uint8Array(left.length + right.length);
-  out.set(left, 0);
-  out.set(right, left.length);
-  return out;
-}
+var WRAP_INFO = "forgezero:custody:wrap:ml-kem-768+x25519:v2";
+var WRAP_SEED_SALT = utf8("forgezero:custody:wrapkey:ml-kem-768+x25519:v2");
+var wrapKey = (shared) => hkdf(sha256, shared, undefined, utf8(WRAP_INFO), 32);
 function sealToKey(recipientPublicKey, plaintext, aad) {
-  const ephemeralSecret = x25519.utils.randomSecretKey();
-  const ephemeralPublic = x25519.getPublicKey(ephemeralSecret);
-  const shared = x25519.getSharedSecret(ephemeralSecret, recipientPublicKey);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublicKey);
+  if (recipientPublicKey.length !== ml_kem768_x25519.lengths.publicKey) {
+    throw new Error("custody: invalid hybrid recipient public key");
+  }
+  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(recipientPublicKey);
+  const shared = Uint8Array.from(sharedSecret);
+  const ciphertext = Uint8Array.from(cipherText);
+  const key = wrapKey(shared);
   try {
-    return { ...sealWithKey(key, plaintext, aad), ephemeral: toBase64(ephemeralPublic) };
+    return {
+      version: 2,
+      ...sealWithKey(key, plaintext, aad),
+      kemCiphertext: toBase64(ciphertext)
+    };
   } finally {
     key.fill(0);
-    ephemeralSecret.fill(0);
+    shared.fill(0);
   }
 }
 function openFromKey(recipientSecretKey, box, aad) {
-  const ephemeralPublic = fromBase64(box.ephemeral);
-  const recipientPublic = x25519.getPublicKey(recipientSecretKey);
-  const shared = x25519.getSharedSecret(recipientSecretKey, ephemeralPublic);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublic);
+  if (box?.version !== 2 || typeof box.kemCiphertext !== "string") {
+    throw new Error("custody: unsupported sealed-to-key envelope");
+  }
+  if (recipientSecretKey.length !== ml_kem768_x25519.lengths.secretKey) {
+    throw new Error("custody: invalid hybrid recipient secret key");
+  }
+  const ciphertext = fromBase64(box.kemCiphertext);
+  if (ciphertext.length !== ml_kem768_x25519.lengths.cipherText) {
+    throw new Error("custody: invalid hybrid KEM ciphertext");
+  }
+  const shared = Uint8Array.from(ml_kem768_x25519.decapsulate(ciphertext, recipientSecretKey));
+  const key = wrapKey(shared);
   try {
     return openWithKey(key, box, aad);
   } finally {
     key.fill(0);
+    shared.fill(0);
   }
 }
 function wrappingKeyPair(factorMaterial, info) {
-  const secretKey = hkdf(sha256, factorMaterial, utf8("forgezero:custody:wrapkey:v1"), utf8(info), 32);
-  return { secretKey, publicKey: x25519.getPublicKey(secretKey) };
+  if (factorMaterial.length < 32) {
+    throw new Error("custody: wrapping factor material must be at least 32 bytes");
+  }
+  const seed = hkdf(sha256, factorMaterial, WRAP_SEED_SALT, utf8(info), 32);
+  try {
+    const pair = ml_kem768_x25519.keygen(seed);
+    return {
+      secretKey: Uint8Array.from(pair.secretKey),
+      publicKey: Uint8Array.from(pair.publicKey)
+    };
+  } finally {
+    seed.fill(0);
+  }
 }
 export {
   wrappingKeyPair,

package/dist/custody-share.d.ts

@@ -1,6 +1,8 @@
 import { type CipherBox, type SealedToKey } from './custody-crypto';
 export interface SealedShare {
     shareIndex: number;
+    /** Account credential whose PRF deterministically derives this passkey key. */
+    passkeyCredentialId?: string;
     passkeyEnvelope: CipherBox;
     phraseEnvelope: CipherBox;
     /** base64 — the HKDF salt for the phrase key and the verifier. */
@@ -42,6 +44,8 @@ export declare function openShareWithPhrase(sealed: SealedShare, custodianKey: s
  * ever sent.
  */
 export interface WrappingKeys {
+    /** The verified, PRF-capable account credential selected by the browser. */
+    passkeyCredentialId: string;
     passkeyPublicKey: string;
     phrasePublicKey: string;
     phraseSalt: string;
@@ -60,6 +64,7 @@ export declare function phraseWrappingKey(custodianKey: string, phraseWords: str
 /** Everything the server needs, and nothing it must not have. */
 export declare function wrappingKeysFor(args: {
     custodianKey: string;
+    passkeyCredentialId: string;
     passkeyPrfOutput: Uint8Array;
     phraseWords: string[];
 }): WrappingKeys;

package/dist/custody-share.js

@@ -8,9 +8,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 
 // src/custody-crypto.ts
 import { gcm } from "@noble/ciphers/aes.js";
-import { x25519 } from "@noble/curves/ed25519.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
+import { ml_kem768_x25519 } from "@noble/post-quantum/hybrid.js";
 var KEY_BYTES = 32;
 var NONCE_BYTES = 12;
 var toBase64 = (bytes) => {
@@ -44,40 +44,62 @@ function openWithKey(key, box, aad) {
     throw new Error(`custody: unknown algorithm ${box.alg}`);
   return gcm(key, fromBase64(box.nonce), utf8(aad)).decrypt(fromBase64(box.ciphertext));
 }
-var WRAP_INFO = "forgezero:custody:wrap:v1";
-var wrapKey = (shared, ephemeral, recipient) => hkdf(sha256, shared, concatBytes(ephemeral, recipient), utf8(WRAP_INFO), 32);
-function concatBytes(left, right) {
-  const out = new Uint8Array(left.length + right.length);
-  out.set(left, 0);
-  out.set(right, left.length);
-  return out;
-}
+var WRAP_INFO = "forgezero:custody:wrap:ml-kem-768+x25519:v2";
+var WRAP_SEED_SALT = utf8("forgezero:custody:wrapkey:ml-kem-768+x25519:v2");
+var wrapKey = (shared) => hkdf(sha256, shared, undefined, utf8(WRAP_INFO), 32);
 function sealToKey(recipientPublicKey, plaintext, aad) {
-  const ephemeralSecret = x25519.utils.randomSecretKey();
-  const ephemeralPublic = x25519.getPublicKey(ephemeralSecret);
-  const shared = x25519.getSharedSecret(ephemeralSecret, recipientPublicKey);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublicKey);
+  if (recipientPublicKey.length !== ml_kem768_x25519.lengths.publicKey) {
+    throw new Error("custody: invalid hybrid recipient public key");
+  }
+  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(recipientPublicKey);
+  const shared = Uint8Array.from(sharedSecret);
+  const ciphertext = Uint8Array.from(cipherText);
+  const key = wrapKey(shared);
   try {
-    return { ...sealWithKey(key, plaintext, aad), ephemeral: toBase64(ephemeralPublic) };
+    return {
+      version: 2,
+      ...sealWithKey(key, plaintext, aad),
+      kemCiphertext: toBase64(ciphertext)
+    };
   } finally {
     key.fill(0);
-    ephemeralSecret.fill(0);
+    shared.fill(0);
   }
 }
 function openFromKey(recipientSecretKey, box, aad) {
-  const ephemeralPublic = fromBase64(box.ephemeral);
-  const recipientPublic = x25519.getPublicKey(recipientSecretKey);
-  const shared = x25519.getSharedSecret(recipientSecretKey, ephemeralPublic);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublic);
+  if (box?.version !== 2 || typeof box.kemCiphertext !== "string") {
+    throw new Error("custody: unsupported sealed-to-key envelope");
+  }
+  if (recipientSecretKey.length !== ml_kem768_x25519.lengths.secretKey) {
+    throw new Error("custody: invalid hybrid recipient secret key");
+  }
+  const ciphertext = fromBase64(box.kemCiphertext);
+  if (ciphertext.length !== ml_kem768_x25519.lengths.cipherText) {
+    throw new Error("custody: invalid hybrid KEM ciphertext");
+  }
+  const shared = Uint8Array.from(ml_kem768_x25519.decapsulate(ciphertext, recipientSecretKey));
+  const key = wrapKey(shared);
   try {
     return openWithKey(key, box, aad);
   } finally {
     key.fill(0);
+    shared.fill(0);
   }
 }
 function wrappingKeyPair(factorMaterial, info) {
-  const secretKey = hkdf(sha256, factorMaterial, utf8("forgezero:custody:wrapkey:v1"), utf8(info), 32);
-  return { secretKey, publicKey: x25519.getPublicKey(secretKey) };
+  if (factorMaterial.length < 32) {
+    throw new Error("custody: wrapping factor material must be at least 32 bytes");
+  }
+  const seed = hkdf(sha256, factorMaterial, WRAP_SEED_SALT, utf8(info), 32);
+  try {
+    const pair = ml_kem768_x25519.keygen(seed);
+    return {
+      secretKey: Uint8Array.from(pair.secretKey),
+      publicKey: Uint8Array.from(pair.publicKey)
+    };
+  } finally {
+    seed.fill(0);
+  }
 }
 
 // src/phrase.ts
@@ -247,11 +269,14 @@ function phraseWrappingKey(custodianKey, phraseWords, salt) {
   return wrappingKeyPair(phraseToKey(phraseWords, salt), wrapInfo(custodianKey, "phrase"));
 }
 function wrappingKeysFor(args) {
+  if (!args.passkeyCredentialId)
+    throw new Error("custody-share: passkey credential id is required");
   const salt = newSalt();
   const passkey = passkeyWrappingKey(args.custodianKey, args.passkeyPrfOutput);
   const phrase = phraseWrappingKey(args.custodianKey, args.phraseWords, salt);
   try {
     return {
+      passkeyCredentialId: args.passkeyCredentialId,
       passkeyPublicKey: toBase642(passkey.publicKey),
       phrasePublicKey: toBase642(phrase.publicKey),
       phraseSalt: toBase642(salt),

package/dist/identity.d.ts

@@ -9,9 +9,9 @@
  * are young; Ed25519 is not. Requiring both means a break in either one leaves
  * the other standing, and the cost is a few hundred bytes per request.
  *
- * This is the one place ForgeZero uses asymmetric post-quantum crypto. Custody
- * needs none — it is symmetric and Shamir throughout — but a node signature is
- * genuinely a signature, so there is a Shor target here and nowhere else.
+ * This is the machine-identity use of asymmetric post-quantum crypto. Browser
+ * passkeys have a separate PRF-derived ML-DSA companion in passkey-hybrid.ts,
+ * while persisted custody remains symmetric and Shamir-based.
  *
  * ## Where the primitives come from
  *
@@ -55,9 +55,13 @@ export interface NodePublicKeys {
  * break in one leaves the other genuinely independent.
  */
 export declare function deriveKeysFromSeed(seed: Uint8Array): NodeKeyPair;
+/** Derive only public halves for server-side credential issuance, then erase every private byte. */
+export declare function derivePublicKeysFromSeed(seed: Uint8Array): NodePublicKeys;
 /** Generate a node key pair. The secret halves never leave the caller. */
 export declare function generateNodeKeys(): NodeKeyPair;
 export interface SignedEnvelope {
+    version: 1;
+    suite: typeof REQUEST_SIGNATURE_SUITE;
     nodeKey: string;
     timestamp: number;
     nonce: string;
@@ -70,11 +74,14 @@ export interface ResponseRecipient {
 }
 export interface SealedResponse {
     version: 1;
+    suite: typeof RESPONSE_SEALING_SUITE;
     kemCiphertext: string;
     nonce: string;
     ciphertext: string;
 }
 export declare const RESPONSE_KEY_HEADER = "x-fz-response-key";
+export declare const REQUEST_SIGNATURE_SUITE: "ed25519+ml-dsa-65";
+export declare const RESPONSE_SEALING_SUITE: "ml-kem-768+x25519/aes-256-gcm";
 export declare function validResponsePublicKey(value: string): boolean;
 /** One ephemeral hybrid ML-KEM-768 + X25519 recipient per request. */
 export declare function generateResponseRecipient(): ResponseRecipient;
@@ -95,6 +102,7 @@ export declare function decodeSignatureHeader(raw: string, nodeKey: string): Sig
  * large upload does not have to be buffered twice.
  */
 export declare function canonicalString(args: {
+    identity: string;
     method: string;
     path: string;
     query: string;

package/dist/identity.js

@@ -26,10 +26,26 @@ function deriveKeysFromSeed(seed) {
   const edPublic = ed25519.getPublicKey(edSecret);
   const mlKeys = ml_dsa65.keygen(mlSeed);
   mlSeed.fill(0);
-  return {
+  const result = {
     ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
     mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
   };
+  edSecret.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
+}
+function derivePublicKeysFromSeed(seed) {
+  if (seed.length < 32)
+    throw new Error("identity: seed must be at least 32 bytes");
+  const edSecret = hkdf(sha256, seed, undefined, ENCODER.encode("forgezero/identity/ed25519/v1"), 32);
+  const mlSeed = hkdf(sha256, seed, undefined, ENCODER.encode("forgezero/identity/ml-dsa-65/v1"), 32);
+  const edPublic = ed25519.getPublicKey(edSecret);
+  const mlKeys = ml_dsa65.keygen(mlSeed);
+  const result = { ed25519: b64(edPublic), mlDsa: b64(mlKeys.publicKey) };
+  edSecret.fill(0);
+  mlSeed.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
 }
 function generateNodeKeys() {
   const edSecret = ed25519.utils.randomSecretKey();
@@ -37,26 +53,60 @@ function generateNodeKeys() {
   const seed = randomBytes(32);
   const mlKeys = ml_dsa65.keygen(seed);
   seed.fill(0);
-  return {
+  const result = {
     ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
     mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
   };
+  edSecret.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
 }
 var RESPONSE_KEY_HEADER = "x-fz-response-key";
-function validResponsePublicKey(value) {
+var REQUEST_SIGNATURE_SUITE = "ed25519+ml-dsa-65";
+var RESPONSE_SEALING_SUITE = "ml-kem-768+x25519/aes-256-gcm";
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var encodedLength = (bytes) => Math.ceil(bytes * 4 / 3);
+var length = (value, name) => {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new Error(`identity: ${name} length unavailable`);
+  return value;
+};
+var ED_PUBLIC_BYTES = length(ed25519.lengths.publicKey, "Ed25519 public key");
+var ED_SIGNATURE_BYTES = length(ed25519.lengths.signature, "Ed25519 signature");
+var ML_PUBLIC_BYTES = length(ml_dsa65.lengths.publicKey, "ML-DSA-65 public key");
+var ML_SIGNATURE_BYTES = length(ml_dsa65.lengths.signature, "ML-DSA-65 signature");
+var RESPONSE_PUBLIC_BYTES = length(ml_kem768_x25519.lengths.publicKey, "hybrid response public key");
+var RESPONSE_SECRET_BYTES = length(ml_kem768_x25519.lengths.secretKey, "hybrid response secret key");
+var RESPONSE_CIPHERTEXT_BYTES = length(ml_kem768_x25519.lengths.cipherText, "hybrid response ciphertext");
+function exactBytes(value, bytes) {
+  if (typeof value !== "string" || value.length !== encodedLength(bytes) || !BASE64URL.test(value))
+    return null;
   try {
-    return un64(value).length === ml_kem768_x25519.lengths.publicKey;
+    const decoded = un64(value);
+    return decoded.length === bytes && b64(decoded) === value ? decoded : null;
   } catch {
-    return false;
+    return null;
   }
 }
+function validIdentity(value) {
+  return typeof value === "string" && value.length >= 1 && value.length <= 128 && !/[^A-Za-z0-9_.:@/-]/.test(value) && !/[\0\r\n]/.test(value);
+}
+function validResponsePublicKey(value) {
+  return exactBytes(value, RESPONSE_PUBLIC_BYTES) !== null;
+}
 function generateResponseRecipient() {
   const pair = ml_kem768_x25519.keygen();
   return { publicKey: b64(pair.publicKey), secretKey: b64(pair.secretKey) };
 }
 var responseKey = (sharedSecret) => hkdf(sha256, sharedSecret, undefined, ENCODER.encode("forgezero/response/ml-kem-768+x25519/v1"), 32);
 async function sealResponse(recipientPublicKey, requestBinding, payload) {
-  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(un64(recipientPublicKey));
+  const recipient = exactBytes(recipientPublicKey, RESPONSE_PUBLIC_BYTES);
+  if (!recipient)
+    throw new Error("response: malformed recipient public key");
+  if (!requestBinding || requestBinding.length > 16384 || /[\0\r\n]/.test(requestBinding)) {
+    throw new Error("response: malformed request binding");
+  }
+  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(recipient);
   const rawKey = responseKey(sharedSecret);
   sharedSecret.fill(0);
   const key = await crypto.subtle.importKey("raw", new Uint8Array(rawKey), "AES-GCM", false, ["encrypt"]);
@@ -66,6 +116,10 @@ async function sealResponse(recipientPublicKey, requestBinding, payload) {
   if (serialized === undefined)
     throw new Error("response: payload is not JSON serializable");
   const plaintext = ENCODER.encode(serialized);
+  if (plaintext.length > 16 * 1024 * 1024 - 16) {
+    plaintext.fill(0);
+    throw new Error("response: payload exceeds sealed response limit");
+  }
   const ciphertext = await crypto.subtle.encrypt({
     name: "AES-GCM",
     iv: new Uint8Array(nonce),
@@ -75,25 +129,46 @@ async function sealResponse(recipientPublicKey, requestBinding, payload) {
   plaintext.fill(0);
   return {
     version: 1,
+    suite: RESPONSE_SEALING_SUITE,
     kemCiphertext: b64(cipherText),
     nonce: b64(nonce),
     ciphertext: b64(new Uint8Array(ciphertext))
   };
 }
 async function openResponse(recipientSecretKey, requestBinding, envelope) {
-  if (envelope?.version !== 1)
+  if (!requestBinding || requestBinding.length > 16384 || /[\0\r\n]/.test(requestBinding)) {
+    throw new Error("response: malformed request binding");
+  }
+  if (envelope?.version !== 1 || envelope.suite !== RESPONSE_SEALING_SUITE) {
     throw new Error("response: unsupported sealed response");
-  const sharedSecret = ml_kem768_x25519.decapsulate(un64(envelope.kemCiphertext), un64(recipientSecretKey));
+  }
+  const kemCiphertext = exactBytes(envelope.kemCiphertext, RESPONSE_CIPHERTEXT_BYTES);
+  const nonce = exactBytes(envelope.nonce, 12);
+  if (!kemCiphertext || !nonce || typeof envelope.ciphertext !== "string" || envelope.ciphertext.length < encodedLength(16) || envelope.ciphertext.length > encodedLength(16 * 1024 * 1024) || !BASE64URL.test(envelope.ciphertext)) {
+    throw new Error("response: malformed sealed response");
+  }
+  let encodedCiphertext;
+  try {
+    encodedCiphertext = un64(envelope.ciphertext);
+  } catch {
+    throw new Error("response: malformed sealed response");
+  }
+  if (encodedCiphertext.length < 16 || encodedCiphertext.length > 16 * 1024 * 1024 || b64(encodedCiphertext) !== envelope.ciphertext) {
+    throw new Error("response: malformed sealed response");
+  }
+  const sharedSecret = ml_kem768_x25519.decapsulate(kemCiphertext, exactBytes(recipientSecretKey, RESPONSE_SECRET_BYTES) ?? (() => {
+    throw new Error("response: malformed recipient secret key");
+  })());
   const rawKey = responseKey(sharedSecret);
   sharedSecret.fill(0);
   const key = await crypto.subtle.importKey("raw", new Uint8Array(rawKey), "AES-GCM", false, ["decrypt"]);
   rawKey.fill(0);
   const decrypted = new Uint8Array(await crypto.subtle.decrypt({
     name: "AES-GCM",
-    iv: new Uint8Array(un64(envelope.nonce)),
+    iv: new Uint8Array(nonce),
     additionalData: new Uint8Array(ENCODER.encode(requestBinding)),
     tagLength: 128
-  }, key, new Uint8Array(un64(envelope.ciphertext))));
+  }, key, new Uint8Array(encodedCiphertext)));
   try {
     return JSON.parse(new TextDecoder().decode(decrypted));
   } finally {
@@ -101,6 +176,8 @@ async function openResponse(recipientSecretKey, requestBinding, envelope) {
   }
 }
 var SIGNATURE_FIELDS = (envelope) => ({
+  version: envelope.version,
+  suite: envelope.suite,
   timestamp: envelope.timestamp,
   nonce: envelope.nonce,
   edSignature: envelope.edSignature,
@@ -110,15 +187,19 @@ function encodeSignatureHeader(envelope) {
   return b64(ENCODER.encode(JSON.stringify(SIGNATURE_FIELDS(envelope))));
 }
 function decodeSignatureHeader(raw, nodeKey) {
+  if (typeof raw !== "string" || raw.length < 64 || raw.length > 8192 || !BASE64URL.test(raw))
+    return null;
   let parsed;
   try {
     parsed = JSON.parse(new TextDecoder().decode(un64(raw)));
   } catch {
     return null;
   }
-  if (typeof parsed.timestamp !== "number" || !Number.isSafeInteger(parsed.timestamp) || typeof parsed.nonce !== "string" || typeof parsed.edSignature !== "string" || typeof parsed.mlDsaSignature !== "string")
+  if (Object.keys(parsed).length !== 6 || parsed.version !== 1 || parsed.suite !== REQUEST_SIGNATURE_SUITE || typeof parsed.timestamp !== "number" || !Number.isSafeInteger(parsed.timestamp) || !exactBytes(parsed.nonce ?? "", 16) || !exactBytes(parsed.edSignature ?? "", ED_SIGNATURE_BYTES) || !exactBytes(parsed.mlDsaSignature ?? "", ML_SIGNATURE_BYTES) || !validIdentity(nodeKey))
     return null;
   return {
+    version: 1,
+    suite: REQUEST_SIGNATURE_SUITE,
     nodeKey,
     timestamp: parsed.timestamp,
     nonce: parsed.nonce,
@@ -127,9 +208,15 @@ function decodeSignatureHeader(raw, nodeKey) {
   };
 }
 function canonicalString(args) {
+  if (!validIdentity(args.identity) || !/^[A-Za-z][A-Za-z0-9-]{0,31}$/.test(args.method) || /[\0\r\n]/.test(args.path) || /[\0\r\n]/.test(args.query) || !exactBytes(args.nonce, 16) || args.responseKey !== undefined && !validResponsePublicKey(args.responseKey)) {
+    throw new Error("identity: malformed canonical request");
+  }
   const body = typeof args.body === "string" ? ENCODER.encode(args.body) : args.body;
   const digest = Array.from(sha256(body), (byte) => byte.toString(16).padStart(2, "0")).join("");
   const fields = [
+    "forgezero/request-signature/v1",
+    REQUEST_SIGNATURE_SUITE,
+    args.identity,
     args.method.toUpperCase(),
     args.path,
     args.query ?? "",
@@ -137,16 +224,17 @@ function canonicalString(args) {
     args.nonce,
     digest
   ];
-  if (args.responseKey)
-    fields.push(args.responseKey);
+  fields.push(args.responseKey ?? "-");
   return fields.join(`
 `);
 }
 function signRequest(keys, nodeKey, args) {
   const timestamp = Math.floor(Date.now() / 1000);
   const nonce = b64(randomBytes(16));
-  const message = ENCODER.encode(canonicalString({ ...args, query: args.query ?? "", timestamp, nonce }));
+  const message = ENCODER.encode(canonicalString({ ...args, identity: nodeKey, query: args.query ?? "", timestamp, nonce }));
   return {
+    version: 1,
+    suite: REQUEST_SIGNATURE_SUITE,
     nodeKey,
     timestamp,
     nonce,
@@ -157,12 +245,16 @@ function signRequest(keys, nodeKey, args) {
 var CLOCK_SKEW_SECONDS = 300;
 function verifyRequest(args) {
   const now = args.nowSeconds ?? Math.floor(Date.now() / 1000);
+  if (args.envelope.version !== 1 || args.envelope.suite !== REQUEST_SIGNATURE_SUITE || !validIdentity(args.envelope.nodeKey) || !exactBytes(args.envelope.nonce, 16) || !exactBytes(args.envelope.edSignature, ED_SIGNATURE_BYTES) || !exactBytes(args.envelope.mlDsaSignature, ML_SIGNATURE_BYTES) || !exactBytes(args.publicKeys.ed25519, ED_PUBLIC_BYTES) || !exactBytes(args.publicKeys.mlDsa, ML_PUBLIC_BYTES) || args.responseKey !== undefined && !validResponsePublicKey(args.responseKey)) {
+    return { verified: false, reason: "malformed" };
+  }
   if (Math.abs(now - args.envelope.timestamp) > CLOCK_SKEW_SECONDS) {
     return { verified: false, reason: "timestamp_out_of_window" };
   }
   let message;
   try {
     message = ENCODER.encode(canonicalString({
+      identity: args.envelope.nodeKey,
       method: args.method,
       path: args.path,
       query: args.query ?? "",
@@ -199,9 +291,12 @@ export {
   generateResponseRecipient,
   generateNodeKeys,
   encodeSignatureHeader,
+  derivePublicKeysFromSeed,
   deriveKeysFromSeed,
   decodeSignatureHeader,
   canonicalString,
+  RESPONSE_SEALING_SUITE,
   RESPONSE_KEY_HEADER,
+  REQUEST_SIGNATURE_SUITE,
   CLOCK_SKEW_SECONDS
 };

package/dist/passkey-hybrid.d.ts

@@ -0,0 +1,37 @@
+export declare const PASSKEY_HYBRID_VERSION: 1;
+export declare const PASSKEY_HYBRID_SUITE: "webauthn+prf-ml-dsa-65";
+export declare const PASSKEY_PRF_SALT: Uint8Array<ArrayBuffer>;
+export type PasskeyHybridPurpose = 'register' | 'signin' | 'session' | 'action';
+export interface PasskeyHybridBinding {
+    version: typeof PASSKEY_HYBRID_VERSION;
+    suite: typeof PASSKEY_HYBRID_SUITE;
+    purpose: PasskeyHybridPurpose;
+    rpId: string;
+    origin: string;
+    challenge: string;
+    userKey: string;
+    sessionKey: string;
+    actionRequestKey: string;
+}
+export interface PasskeyHybridProof {
+    version: typeof PASSKEY_HYBRID_VERSION;
+    suite: typeof PASSKEY_HYBRID_SUITE;
+    credentialId: string;
+    signature: string;
+}
+export interface PasskeyHybridRegistrationProof extends PasskeyHybridProof {
+    publicKey: string;
+    /** A verified WebAuthn assertion which performed the PRF evaluation. */
+    assertion: unknown;
+}
+export declare function passkeyHybridMessage(binding: PasskeyHybridBinding, credentialId: string): Uint8Array;
+export declare function createPasskeyHybridProof(prfOutput: Uint8Array, binding: PasskeyHybridBinding, credentialId: string): PasskeyHybridProof & {
+    publicKey: string;
+};
+export declare function verifyPasskeyHybridProof(args: {
+    proof: PasskeyHybridProof;
+    publicKey: string;
+    binding: PasskeyHybridBinding;
+}): boolean;
+export declare const PASSKEY_ML_DSA_PUBLIC_KEY_BYTES: number;
+export declare const PASSKEY_ML_DSA_SIGNATURE_BYTES: number;

package/dist/passkey-hybrid.js

@@ -0,0 +1,111 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/passkey-hybrid.ts
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+var PASSKEY_HYBRID_VERSION = 1;
+var PASSKEY_HYBRID_SUITE = "webauthn+prf-ml-dsa-65";
+var PASSKEY_PRF_SALT = new TextEncoder().encode("forgezero:passkey:hybrid-auth:prf:v1");
+var utf8 = (value) => new TextEncoder().encode(value);
+var b64 = (bytes) => {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var un64 = (value) => {
+  if (!/^[A-Za-z0-9_-]+$/.test(value))
+    throw new Error("passkey-hybrid: non-canonical base64url");
+  const normal = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(normal.padEnd(Math.ceil(normal.length / 4) * 4, "="));
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+};
+function field(value) {
+  if (value.length > 2048 || /[\0\r\n]/.test(value)) {
+    throw new Error("passkey-hybrid: invalid binding field");
+  }
+  return `${utf8(value).length}:${value}`;
+}
+function passkeyHybridMessage(binding, credentialId) {
+  if (binding.version !== PASSKEY_HYBRID_VERSION || binding.suite !== PASSKEY_HYBRID_SUITE) {
+    throw new Error("passkey-hybrid: unsupported protocol");
+  }
+  if (!/^[A-Za-z0-9_-]{16,1024}$/.test(credentialId)) {
+    throw new Error("passkey-hybrid: invalid credential id");
+  }
+  return utf8([
+    "forgezero-passkey-hybrid-v1",
+    binding.suite,
+    binding.purpose,
+    binding.rpId,
+    binding.origin,
+    binding.challenge,
+    credentialId,
+    binding.userKey,
+    binding.sessionKey,
+    binding.actionRequestKey
+  ].map(field).join(`
+`));
+}
+function keys(prfOutput, credentialId) {
+  if (prfOutput.length !== 32)
+    throw new Error("passkey-hybrid: PRF output must be exactly 32 bytes");
+  const seed = hkdf(sha256, prfOutput, utf8("forgezero:passkey:hybrid-auth:ml-dsa-65:v1"), utf8(`credential:${credentialId.length}:${credentialId}`), 32);
+  try {
+    const pair = ml_dsa65.keygen(seed);
+    return {
+      publicKey: Uint8Array.from(pair.publicKey),
+      secretKey: Uint8Array.from(pair.secretKey)
+    };
+  } finally {
+    seed.fill(0);
+  }
+}
+function createPasskeyHybridProof(prfOutput, binding, credentialId) {
+  const pair = keys(prfOutput, credentialId);
+  try {
+    return {
+      version: PASSKEY_HYBRID_VERSION,
+      suite: PASSKEY_HYBRID_SUITE,
+      credentialId,
+      publicKey: b64(pair.publicKey),
+      signature: b64(ml_dsa65.sign(passkeyHybridMessage(binding, credentialId), pair.secretKey))
+    };
+  } finally {
+    pair.secretKey.fill(0);
+  }
+}
+function verifyPasskeyHybridProof(args) {
+  try {
+    if (args.proof.version !== PASSKEY_HYBRID_VERSION || args.proof.suite !== PASSKEY_HYBRID_SUITE || !Object.keys(args.proof).every((key) => ["version", "suite", "credentialId", "signature"].includes(key)))
+      return false;
+    const publicKey = un64(args.publicKey);
+    const signature = un64(args.proof.signature);
+    if (publicKey.length !== ml_dsa65.lengths.publicKey || signature.length !== ml_dsa65.lengths.signature)
+      return false;
+    if (b64(publicKey) !== args.publicKey || b64(signature) !== args.proof.signature)
+      return false;
+    return ml_dsa65.verify(signature, passkeyHybridMessage(args.binding, args.proof.credentialId), publicKey);
+  } catch {
+    return false;
+  }
+}
+var PASSKEY_ML_DSA_PUBLIC_KEY_BYTES = ml_dsa65.lengths.publicKey;
+var PASSKEY_ML_DSA_SIGNATURE_BYTES = ml_dsa65.lengths.signature;
+export {
+  verifyPasskeyHybridProof,
+  passkeyHybridMessage,
+  createPasskeyHybridProof,
+  PASSKEY_PRF_SALT,
+  PASSKEY_ML_DSA_SIGNATURE_BYTES,
+  PASSKEY_ML_DSA_PUBLIC_KEY_BYTES,
+  PASSKEY_HYBRID_VERSION,
+  PASSKEY_HYBRID_SUITE
+};

package/dist/realtime.d.ts

@@ -0,0 +1,68 @@
+export declare const REALTIME_MAX_EVENTS = 100;
+export declare const REALTIME_MAX_EVENT_BYTES: number;
+export declare const REALTIME_MAX_BATCH_BYTES: number;
+export declare const REALTIME_MAX_SOCKETS_PER_SHARD = 1000;
+export declare const REALTIME_MAX_SHARDS_PER_TOPIC = 1024;
+export interface RealtimeEvent {
+    id: string;
+    type: string;
+    payload: unknown;
+}
+export type RealtimePrincipalKind = 'user' | 'node' | 'api-key' | 'service' | 'header';
+export type RealtimeAudience = Readonly<{
+    kind: 'public';
+}> | Readonly<{
+    kind: 'principal';
+    realmId: string;
+    principalKind: RealtimePrincipalKind;
+    principalKey: string;
+    capability: string;
+}> | Readonly<{
+    kind: 'project';
+    realmId: string;
+    projectKey: string;
+    capability: string;
+}> | Readonly<{
+    kind: 'group';
+    realmId: string;
+    group: string;
+    capability: string;
+}>;
+export interface RealtimeBatch {
+    version: 2;
+    batchId: string;
+    topic: string;
+    audience: RealtimeAudience;
+    publishedAtMs: number;
+    events: RealtimeEvent[];
+}
+export declare function validateRealtimeAudience(input: unknown): RealtimeAudience;
+export declare function validateRealtimeBatch(input: unknown): RealtimeBatch;
+export declare const realtimeBatchBytes: (input: unknown) => string;
+export interface RealtimeSubscriptionTicket {
+    version: 2;
+    topic: string;
+    principal: Readonly<{
+        kind: RealtimePrincipalKind;
+        key: string;
+    }>;
+    realmId: string;
+    projectKeys: readonly string[];
+    groups: readonly string[];
+    capabilities: readonly string[];
+    expiresAtSec: number;
+    nonce: string;
+}
+export declare function validateRealtimeSubscriptionTicket(input: unknown, nowSec?: number): RealtimeSubscriptionTicket;
+/**
+ * The edge has no database authority. It may deliver only when the short-lived,
+ * API-issued connection capability contains every coordinate named by the
+ * event audience. Topic equality is handled by the shard; it is not an access
+ * decision.
+ */
+export declare function canReceiveRealtimeAudience(ticket: RealtimeSubscriptionTicket, audience: RealtimeAudience): boolean;
+export declare const realtimeShardKey: (topic: string, shard: number) => string;
+export declare function realtimeHmac(secret: string, message: string): Promise<string>;
+export declare function verifyRealtimeHmac(secret: string, message: string, signature: string): Promise<boolean>;
+export declare function issueRealtimeSubscriptionTicket(secret: string, ticket: RealtimeSubscriptionTicket, nowSec?: number): Promise<string>;
+export declare function verifyRealtimeSubscriptionToken(secret: string, token: string, nowSec?: number): Promise<RealtimeSubscriptionTicket | null>;

package/dist/realtime.js

@@ -0,0 +1,184 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/realtime.ts
+var REALTIME_MAX_EVENTS = 100;
+var REALTIME_MAX_EVENT_BYTES = 64 * 1024;
+var REALTIME_MAX_BATCH_BYTES = 512 * 1024;
+var REALTIME_MAX_SOCKETS_PER_SHARD = 1000;
+var REALTIME_MAX_SHARDS_PER_TOPIC = 1024;
+var ATOM = /^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/;
+var PRINCIPAL_KINDS = new Set(["user", "node", "api-key", "service", "header"]);
+var atom = (value) => typeof value === "string" && ATOM.test(value);
+function validateRealtimeAudience(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Realtime audience must be an object.");
+  const row = input;
+  if (row.kind === "public") {
+    if (Object.keys(row).length !== 1)
+      throw new Error("Public realtime audience has no additional coordinates.");
+    return { kind: "public" };
+  }
+  if (!atom(row.realmId) || !atom(row.capability))
+    throw new Error("Realtime audience scope is invalid.");
+  if (row.kind === "principal" && PRINCIPAL_KINDS.has(row.principalKind) && atom(row.principalKey)) {
+    return {
+      kind: "principal",
+      realmId: row.realmId,
+      principalKind: row.principalKind,
+      principalKey: row.principalKey,
+      capability: row.capability
+    };
+  }
+  if (row.kind === "project" && atom(row.projectKey)) {
+    return { kind: "project", realmId: row.realmId, projectKey: row.projectKey, capability: row.capability };
+  }
+  if (row.kind === "group" && atom(row.group)) {
+    return { kind: "group", realmId: row.realmId, group: row.group, capability: row.capability };
+  }
+  throw new Error("Realtime audience coordinates are invalid.");
+}
+function validateRealtimeBatch(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Realtime batch must be an object.");
+  const row = input;
+  if (row.version !== 2 || !ATOM.test(row.batchId ?? "") || !ATOM.test(row.topic ?? "") || !Number.isSafeInteger(row.publishedAtMs) || row.publishedAtMs < 0 || !Array.isArray(row.events) || row.events.length < 1 || row.events.length > REALTIME_MAX_EVENTS)
+    throw new Error("Realtime batch coordinates are invalid.");
+  const audience = validateRealtimeAudience(row.audience);
+  const events = row.events.map((event) => {
+    if (!event || typeof event !== "object" || Array.isArray(event))
+      throw new Error("Realtime event must be an object.");
+    const value = event;
+    if (!ATOM.test(value.id ?? "") || !ATOM.test(value.type ?? ""))
+      throw new Error("Realtime event id/type is invalid.");
+    const encoded = JSON.stringify(value.payload);
+    if (encoded === undefined || new TextEncoder().encode(encoded).byteLength > REALTIME_MAX_EVENT_BYTES) {
+      throw new Error("Realtime event payload is too large or not JSON serializable.");
+    }
+    return { id: value.id, type: value.type, payload: value.payload };
+  });
+  if (new Set(events.map(({ id }) => id)).size !== events.length)
+    throw new Error("Realtime event ids must be unique in a batch.");
+  const batch = {
+    version: 2,
+    batchId: row.batchId,
+    topic: row.topic,
+    audience,
+    publishedAtMs: row.publishedAtMs,
+    events
+  };
+  if (new TextEncoder().encode(JSON.stringify(batch)).byteLength > REALTIME_MAX_BATCH_BYTES) {
+    throw new Error("Realtime batch is too large.");
+  }
+  return batch;
+}
+var realtimeBatchBytes = (input) => JSON.stringify(validateRealtimeBatch(input));
+function boundedUniqueAtoms(value, maximum, label) {
+  if (!Array.isArray(value) || value.length > maximum || value.some((item) => !atom(item)) || new Set(value).size !== value.length)
+    throw new Error(`Realtime ticket ${label} are invalid.`);
+  return [...value];
+}
+function validateRealtimeSubscriptionTicket(input, nowSec = Math.floor(Date.now() / 1000)) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Realtime ticket must be an object.");
+  const row = input;
+  if (row.version !== 2 || !atom(row.topic) || !atom(row.realmId) || !atom(row.nonce) || !row.principal || !PRINCIPAL_KINDS.has(row.principal.kind) || !atom(row.principal.key) || !Number.isSafeInteger(row.expiresAtSec) || row.expiresAtSec <= nowSec || row.expiresAtSec > nowSec + 300)
+    throw new Error("Realtime ticket is invalid or expired.");
+  return {
+    version: 2,
+    topic: row.topic,
+    principal: { kind: row.principal.kind, key: row.principal.key },
+    realmId: row.realmId,
+    projectKeys: boundedUniqueAtoms(row.projectKeys, 32, "project keys"),
+    groups: boundedUniqueAtoms(row.groups, 16, "groups"),
+    capabilities: boundedUniqueAtoms(row.capabilities, 64, "capabilities"),
+    expiresAtSec: row.expiresAtSec,
+    nonce: row.nonce
+  };
+}
+function canReceiveRealtimeAudience(ticket, audience) {
+  if (audience.kind === "public")
+    return true;
+  if (ticket.realmId !== audience.realmId || !ticket.capabilities.includes(audience.capability))
+    return false;
+  if (audience.kind === "principal") {
+    return ticket.principal.kind === audience.principalKind && ticket.principal.key === audience.principalKey;
+  }
+  if (audience.kind === "project")
+    return ticket.projectKeys.includes(audience.projectKey);
+  return ticket.groups.includes(audience.group);
+}
+var realtimeShardKey = (topic, shard) => {
+  if (!ATOM.test(topic) || !Number.isSafeInteger(shard) || shard < 0 || shard >= REALTIME_MAX_SHARDS_PER_TOPIC) {
+    throw new Error("Realtime shard coordinates are invalid.");
+  }
+  return `rt:${topic}:${shard.toString().padStart(4, "0")}`;
+};
+var bytesToHex = (bytes) => [...bytes].map((value) => value.toString(16).padStart(2, "0")).join("");
+var timingEqual = (left, right) => {
+  if (left.length !== right.length)
+    return false;
+  let difference = 0;
+  for (let index = 0;index < left.length; index += 1)
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  return difference === 0;
+};
+async function realtimeHmac(secret, message) {
+  if (new TextEncoder().encode(secret).byteLength < 32)
+    throw new Error("Realtime secret must contain at least 32 bytes.");
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message))));
+}
+async function verifyRealtimeHmac(secret, message, signature) {
+  return /^[a-f0-9]{64}$/.test(signature) && timingEqual(await realtimeHmac(secret, message), signature);
+}
+var base64url = (value) => {
+  const bytes = new TextEncoder().encode(value);
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var fromBase64url = (value) => {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(normalized + "=".repeat((4 - normalized.length % 4) % 4));
+  return new TextDecoder().decode(Uint8Array.from(binary, (char) => char.charCodeAt(0)));
+};
+async function issueRealtimeSubscriptionTicket(secret, ticket, nowSec = Math.floor(Date.now() / 1000)) {
+  const body = base64url(JSON.stringify(validateRealtimeSubscriptionTicket(ticket, nowSec)));
+  return `${body}.${await realtimeHmac(secret, `ticket
+${body}`)}`;
+}
+async function verifyRealtimeSubscriptionToken(secret, token, nowSec = Math.floor(Date.now() / 1000)) {
+  const [body, signature, ...extra] = token.split(".");
+  if (!body || !signature || extra.length || !await verifyRealtimeHmac(secret, `ticket
+${body}`, signature))
+    return null;
+  try {
+    return validateRealtimeSubscriptionTicket(JSON.parse(fromBase64url(body)), nowSec);
+  } catch {
+    return null;
+  }
+}
+export {
+  verifyRealtimeSubscriptionToken,
+  verifyRealtimeHmac,
+  validateRealtimeSubscriptionTicket,
+  validateRealtimeBatch,
+  validateRealtimeAudience,
+  realtimeShardKey,
+  realtimeHmac,
+  realtimeBatchBytes,
+  issueRealtimeSubscriptionTicket,
+  canReceiveRealtimeAudience,
+  REALTIME_MAX_SOCKETS_PER_SHARD,
+  REALTIME_MAX_SHARDS_PER_TOPIC,
+  REALTIME_MAX_EVENT_BYTES,
+  REALTIME_MAX_EVENTS,
+  REALTIME_MAX_BATCH_BYTES
+};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@forgezero/runtime",
-	"version": "0.1.5",
+  "version": "0.1.6",
 	"type": "module",
   "publishConfig": {
     "access": "public",
@@ -47,6 +47,10 @@
 			"types": "./dist/query.d.ts",
 			"default": "./dist/query.js"
 		},
+		"./realtime": {
+			"types": "./dist/realtime.d.ts",
+			"default": "./dist/realtime.js"
+		},
 		"./calendar": {
 			"types": "./dist/calendar.d.ts",
 			"default": "./dist/calendar.js"
@@ -55,6 +59,10 @@
 			"types": "./dist/identity.d.ts",
 			"default": "./dist/identity.js"
 		},
+		"./passkey-hybrid": {
+			"types": "./dist/passkey-hybrid.d.ts",
+			"default": "./dist/passkey-hybrid.js"
+		},
 		"./totp": {
 			"types": "./dist/totp.d.ts",
 			"default": "./dist/totp.js"
@@ -155,10 +163,6 @@
 			"types": "./dist/phrase.d.ts",
 			"default": "./dist/phrase.js"
 		},
-		"./ssh-agent": {
-			"types": "./dist/ssh-agent.d.ts",
-			"default": "./dist/ssh-agent.js"
-		},
 		"./slip10": {
 			"types": "./dist/slip10.d.ts",
 			"default": "./dist/slip10.js"
@@ -183,7 +187,7 @@
 	"scripts": {
 		"check": "tsc --noEmit",
 		"prebuild": "rm -rf dist",
-		"build": "bun build src/query.ts src/jobs.ts src/queue.ts src/outbox.ts src/audit.ts src/backup.ts src/notify.ts src/notify-templates.ts src/calendar.ts src/compliance.ts src/pipeline.ts src/totp.ts src/otpauth.ts src/identity.ts src/slip10.ts src/openssh.ts src/ssh-cert.ts src/importers.ts src/snp.ts src/passkey.ts src/custody-crypto.ts src/custody-share.ts src/phrase.ts src/ssh-agent.ts src/schema.ts src/schema-typebox.ts src/finance/discounts.ts src/finance/money.ts src/finance/storage.ts src/finance/custody.ts src/finance/tax.ts src/finance/derive.ts src/finance/venues.ts src/finance/ledger.ts src/finance/rates.ts src/finance/transfers.ts src/finance/chain.ts src/finance/chain-addresses.ts src/finance/chain-deposits.ts src/finance/chain-withdrawals.ts src/finance/chain-reconcile.ts src/finance/market.ts src/finance/commission.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
+		"build": "bun build src/query.ts src/realtime.ts src/jobs.ts src/queue.ts src/outbox.ts src/audit.ts src/backup.ts src/notify.ts src/notify-templates.ts src/calendar.ts src/compliance.ts src/pipeline.ts src/totp.ts src/otpauth.ts src/identity.ts src/slip10.ts src/openssh.ts src/ssh-cert.ts src/importers.ts src/snp.ts src/passkey.ts src/passkey-hybrid.ts src/custody-crypto.ts src/custody-share.ts src/phrase.ts src/schema.ts src/schema-typebox.ts src/finance/discounts.ts src/finance/money.ts src/finance/storage.ts src/finance/custody.ts src/finance/tax.ts src/finance/derive.ts src/finance/venues.ts src/finance/ledger.ts src/finance/rates.ts src/finance/transfers.ts src/finance/chain.ts src/finance/chain-addresses.ts src/finance/chain-deposits.ts src/finance/chain-withdrawals.ts src/finance/chain-reconcile.ts src/finance/market.ts src/finance/commission.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
 		"prepublishOnly": "bun run check && bun run build"
 	},
 	"dependencies": {

package/dist/ssh-agent.d.ts

@@ -1,83 +0,0 @@
-/**
- * SSH agent as a custody factor.
- *
- * The ceremony seals every custodian share twice — once under a key derived from
- * a WebAuthn PRF output, once under a key derived from a BIP-39 phrase — and
- * either alone opens it. That works in a browser and not at all over SSH, which
- * is where the platform is first brought up: there is no passkey before there is
- * a platform to register one against.
- *
- * An SSH agent fills the same slot. Both are an agent-held key that produces a
- * stable secret without ever exposing the key itself, so the SSH signature over
- * a fixed challenge substitutes for the PRF output with no change to the sealing
- * code. The custodian later registers a passkey through the UI and the same
- * share gains a browser route.
- *
- * **Ed25519 only, and that is a correctness requirement rather than a
- * preference.** The derived key must be identical on every enrolment and every
- * unlock, so the signature has to be deterministic. Ed25519 is (RFC 8032). RSA
- * with PKCS#1 v1.5 happens to be, but agents are free to offer RSA-PSS for the
- * same key, and PSS is randomised — a share sealed under one PSS signature could
- * never be opened again. Refusing everything except Ed25519 makes that
- * impossible rather than rare.
- */
-export declare class SshAgentError extends Error {
-}
-export interface AgentIdentity {
-    /** Raw SSH public key blob, as the agent returns it. */
-    blob: Buffer;
-    comment: string;
-    /** `ssh-ed25519`, etc. Anything else is refused — see the module note. */
-    type: string;
-    /** `SHA256:…`, matching `ssh-add -l`, so a human can confirm which key. */
-    fingerprint: string;
-}
-/**
- * How long to wait on the agent before giving up.
- *
- * An agent holding a forwarded key whose upstream is gone, or a confirm-on-use
- * key with nobody at the terminal, does not refuse — it simply never answers.
- * Without a socket-level deadline those connections are never closed, and a
- * caller that races them against its own timer leaks one socket per attempt
- * until the agent stops accepting connections entirely.
- */
-export declare const AGENT_TIMEOUT_MS = 3000;
-/** The keys the agent is holding. Matches `ssh-add -l`. */
-export declare function listIdentities(socketPath?: string): Promise<AgentIdentity[]>;
-/** Ed25519 only. See the module note — determinism is the whole mechanism. */
-export declare function listCustodyIdentities(socketPath?: string): Promise<AgentIdentity[]>;
-/**
- * Sign arbitrary bytes with an identity the agent holds.
- *
- * Exported because a fresh proof from a terminal needs it: the server issues a
- * nonce and this is what turns it into something the server can verify against
- * a registered public key. `deriveCustodyKey` signs a FIXED challenge and hashes
- * the result — that is a key-derivation, not a proof, and using it as one would
- * replay.
- *
- * Returns the raw ed25519 signature, unwrapped from the agent's blob, because
- * that is what a verifier takes.
- */
-export declare function signWithIdentity(identity: AgentIdentity, data: Uint8Array, socketPath?: string): Promise<Uint8Array>;
-/**
- * Derive the 32-byte custody key for an identity.
- *
- * Stable across processes and machines for the same key, which is what lets a
- * custodian enrol today and unlock next month from a different laptop with the
- * same key in their agent.
- *
- * HKDF over the signature rather than the signature itself: the signature is a
- * value the agent will hand to anything that asks, so using it directly as a
- * key would mean any process that can reach the socket holds the custody key.
- * The salt and info bind it to this purpose.
- */
-export declare function deriveCustodyKey(identity: AgentIdentity, socketPath?: string): Promise<Uint8Array>;
-/**
- * Prove the derivation reproduces before it is trusted with a share.
- *
- * Signs twice and compares. A non-deterministic agent — a smartcard doing PSS, a
- * forwarded agent that swapped keys mid-ceremony — would otherwise seal a share
- * under a key that can never be reproduced, and the failure would surface only
- * at the worst possible moment: recovery.
- */
-export declare function assertDeterministic(identity: AgentIdentity, socketPath?: string): Promise<Uint8Array>;

package/dist/ssh-agent.js

@@ -1,147 +0,0 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined")
-    return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
-// src/ssh-agent.ts
-import { Socket } from "node:net";
-import { createHash, hkdfSync } from "node:crypto";
-
-class SshAgentError extends Error {
-}
-var SSH_AGENTC_REQUEST_IDENTITIES = 11;
-var SSH_AGENT_IDENTITIES_ANSWER = 12;
-var SSH_AGENTC_SIGN_REQUEST = 13;
-var SSH_AGENT_SIGN_RESPONSE = 14;
-var CUSTODY_CHALLENGE = Buffer.from("forgezero/custody/ssh-agent/v1", "utf8");
-function readString(buffer, offset) {
-  const length = buffer.readUInt32BE(offset);
-  const start = offset + 4;
-  return [buffer.subarray(start, start + length), start + length];
-}
-function writeString(value) {
-  const length = Buffer.alloc(4);
-  length.writeUInt32BE(value.length);
-  return Buffer.concat([length, value]);
-}
-function frame(payload) {
-  const length = Buffer.alloc(4);
-  length.writeUInt32BE(payload.length);
-  return Buffer.concat([length, payload]);
-}
-var AGENT_TIMEOUT_MS = 3000;
-async function request(socketPath, payload) {
-  return new Promise((resolve, reject) => {
-    const socket = new Socket;
-    const chunks = [];
-    let expected = null;
-    let settled = false;
-    const fail = (message) => {
-      if (settled)
-        return;
-      settled = true;
-      socket.destroy();
-      reject(new SshAgentError(message));
-    };
-    socket.setTimeout(AGENT_TIMEOUT_MS, () => fail("SSH_AGENT_TIMEOUT"));
-    socket.on("error", () => fail("SSH_AGENT_UNREACHABLE"));
-    socket.on("connect", () => socket.write(frame(payload)));
-    socket.on("data", (chunk) => {
-      chunks.push(chunk);
-      const all = Buffer.concat(chunks);
-      if (expected === null && all.length >= 4)
-        expected = all.readUInt32BE(0);
-      if (expected !== null && all.length >= expected + 4) {
-        if (settled)
-          return;
-        settled = true;
-        socket.end();
-        resolve(all.subarray(4, expected + 4));
-      }
-    });
-    socket.on("close", () => {
-      if (expected === null)
-        fail("SSH_AGENT_CLOSED_EARLY");
-    });
-    socket.connect(socketPath);
-  });
-}
-function agentSocket(explicit) {
-  const path = explicit ?? process.env.SSH_AUTH_SOCK;
-  if (!path)
-    throw new SshAgentError("SSH_AUTH_SOCK_NOT_SET");
-  return path;
-}
-async function listIdentities(socketPath) {
-  const response = await request(agentSocket(socketPath), Buffer.from([SSH_AGENTC_REQUEST_IDENTITIES]));
-  if (response[0] !== SSH_AGENT_IDENTITIES_ANSWER) {
-    throw new SshAgentError("SSH_AGENT_BAD_RESPONSE");
-  }
-  const count = response.readUInt32BE(1);
-  const identities = [];
-  let offset = 5;
-  for (let index = 0;index < count; index += 1) {
-    const [blob, afterBlob] = readString(response, offset);
-    const [comment, afterComment] = readString(response, afterBlob);
-    offset = afterComment;
-    const [type] = readString(blob, 0);
-    identities.push({
-      blob,
-      comment: comment.toString("utf8"),
-      type: type.toString("utf8"),
-      fingerprint: `SHA256:${createHash("sha256").update(blob).digest("base64").replace(/=+$/, "")}`
-    });
-  }
-  return identities;
-}
-async function listCustodyIdentities(socketPath) {
-  return (await listIdentities(socketPath)).filter((id) => id.type === "ssh-ed25519");
-}
-async function signWithIdentity(identity, data, socketPath) {
-  const wrapped = await sign(identity.blob, Buffer.from(data), socketPath);
-  const [raw] = readString(wrapped, readString(wrapped, 0)[1]);
-  return new Uint8Array(raw);
-}
-async function sign(blob, data, socketPath) {
-  const payload = Buffer.concat([
-    Buffer.from([SSH_AGENTC_SIGN_REQUEST]),
-    writeString(blob),
-    writeString(data),
-    Buffer.alloc(4)
-  ]);
-  const response = await request(agentSocket(socketPath), payload);
-  if (response[0] !== SSH_AGENT_SIGN_RESPONSE) {
-    throw new SshAgentError("SSH_AGENT_SIGN_REFUSED");
-  }
-  const [signature] = readString(response, 1);
-  return signature;
-}
-async function deriveCustodyKey(identity, socketPath) {
-  if (identity.type !== "ssh-ed25519") {
-    throw new SshAgentError("SSH_KEY_TYPE_UNSUPPORTED");
-  }
-  const signature = await sign(identity.blob, CUSTODY_CHALLENGE, socketPath);
-  if (signature.length < 32)
-    throw new SshAgentError("SSH_AGENT_SIGNATURE_TOO_SHORT");
-  return new Uint8Array(hkdfSync("sha256", signature, identity.blob, Buffer.from("forgezero/custody/ssh-key/v1", "utf8"), 32));
-}
-async function assertDeterministic(identity, socketPath) {
-  const first = await deriveCustodyKey(identity, socketPath);
-  const second = await deriveCustodyKey(identity, socketPath);
-  if (Buffer.compare(Buffer.from(first), Buffer.from(second)) !== 0) {
-    throw new SshAgentError("SSH_AGENT_NOT_DETERMINISTIC");
-  }
-  return first;
-}
-export {
-  signWithIdentity,
-  listIdentities,
-  listCustodyIdentities,
-  deriveCustodyKey,
-  assertDeterministic,
-  SshAgentError,
-  AGENT_TIMEOUT_MS
-};