@forgezero/runtime 0.1.5 → 0.1.7

package/dist/custody-crypto.d.ts

@@ -28,13 +28,15 @@ export declare function openWithKey(key: Uint8Array, box: CipherBox, aad: string
  * plaintext — so a captured response is ciphertext, and opening it requires the
  * factor itself.
  *
- * X25519 + HKDF-SHA256 + AES-256-GCM, with the ephemeral public key carried in
- * the box. Nothing bespoke: the ephemeral-static shape is what every sealed-box
- * construction uses, and doing it by hand is how people lose the AAD.
+ * ML-KEM-768 + X25519 + HKDF-SHA256 + AES-256-GCM. Both KEM halves are
+ * mandatory: a captured custody envelope remains confidential after a future
+ * break of X25519, while the classical half hedges a failure in the newer KEM.
+ * The version is explicit and the opener accepts no legacy X25519-only shape.
  */
 export interface SealedToKey extends CipherBox {
-    /** base64 — the ephemeral public key this box was sealed with. */
-    ephemeral: string;
+    version: 2;
+    /** base64 — the mandatory hybrid ML-KEM-768 + X25519 ciphertext. */
+    kemCiphertext: string;
 }
 /** Seal to a recipient's public key. */
 export declare function sealToKey(recipientPublicKey: Uint8Array, plaintext: Uint8Array, aad: string): SealedToKey;

package/dist/custody-crypto.js

@@ -8,9 +8,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 
 // src/custody-crypto.ts
 import { gcm } from "@noble/ciphers/aes.js";
-import { x25519 } from "@noble/curves/ed25519.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
+import { ml_kem768_x25519 } from "@noble/post-quantum/hybrid.js";
 var KEY_BYTES = 32;
 var NONCE_BYTES = 12;
 var toBase64 = (bytes) => {
@@ -44,40 +44,62 @@ function openWithKey(key, box, aad) {
     throw new Error(`custody: unknown algorithm ${box.alg}`);
   return gcm(key, fromBase64(box.nonce), utf8(aad)).decrypt(fromBase64(box.ciphertext));
 }
-var WRAP_INFO = "forgezero:custody:wrap:v1";
-var wrapKey = (shared, ephemeral, recipient) => hkdf(sha256, shared, concatBytes(ephemeral, recipient), utf8(WRAP_INFO), 32);
-function concatBytes(left, right) {
-  const out = new Uint8Array(left.length + right.length);
-  out.set(left, 0);
-  out.set(right, left.length);
-  return out;
-}
+var WRAP_INFO = "forgezero:custody:wrap:ml-kem-768+x25519:v2";
+var WRAP_SEED_SALT = utf8("forgezero:custody:wrapkey:ml-kem-768+x25519:v2");
+var wrapKey = (shared) => hkdf(sha256, shared, undefined, utf8(WRAP_INFO), 32);
 function sealToKey(recipientPublicKey, plaintext, aad) {
-  const ephemeralSecret = x25519.utils.randomSecretKey();
-  const ephemeralPublic = x25519.getPublicKey(ephemeralSecret);
-  const shared = x25519.getSharedSecret(ephemeralSecret, recipientPublicKey);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublicKey);
+  if (recipientPublicKey.length !== ml_kem768_x25519.lengths.publicKey) {
+    throw new Error("custody: invalid hybrid recipient public key");
+  }
+  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(recipientPublicKey);
+  const shared = Uint8Array.from(sharedSecret);
+  const ciphertext = Uint8Array.from(cipherText);
+  const key = wrapKey(shared);
   try {
-    return { ...sealWithKey(key, plaintext, aad), ephemeral: toBase64(ephemeralPublic) };
+    return {
+      version: 2,
+      ...sealWithKey(key, plaintext, aad),
+      kemCiphertext: toBase64(ciphertext)
+    };
   } finally {
     key.fill(0);
-    ephemeralSecret.fill(0);
+    shared.fill(0);
   }
 }
 function openFromKey(recipientSecretKey, box, aad) {
-  const ephemeralPublic = fromBase64(box.ephemeral);
-  const recipientPublic = x25519.getPublicKey(recipientSecretKey);
-  const shared = x25519.getSharedSecret(recipientSecretKey, ephemeralPublic);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublic);
+  if (box?.version !== 2 || typeof box.kemCiphertext !== "string") {
+    throw new Error("custody: unsupported sealed-to-key envelope");
+  }
+  if (recipientSecretKey.length !== ml_kem768_x25519.lengths.secretKey) {
+    throw new Error("custody: invalid hybrid recipient secret key");
+  }
+  const ciphertext = fromBase64(box.kemCiphertext);
+  if (ciphertext.length !== ml_kem768_x25519.lengths.cipherText) {
+    throw new Error("custody: invalid hybrid KEM ciphertext");
+  }
+  const shared = Uint8Array.from(ml_kem768_x25519.decapsulate(ciphertext, recipientSecretKey));
+  const key = wrapKey(shared);
   try {
     return openWithKey(key, box, aad);
   } finally {
     key.fill(0);
+    shared.fill(0);
   }
 }
 function wrappingKeyPair(factorMaterial, info) {
-  const secretKey = hkdf(sha256, factorMaterial, utf8("forgezero:custody:wrapkey:v1"), utf8(info), 32);
-  return { secretKey, publicKey: x25519.getPublicKey(secretKey) };
+  if (factorMaterial.length < 32) {
+    throw new Error("custody: wrapping factor material must be at least 32 bytes");
+  }
+  const seed = hkdf(sha256, factorMaterial, WRAP_SEED_SALT, utf8(info), 32);
+  try {
+    const pair = ml_kem768_x25519.keygen(seed);
+    return {
+      secretKey: Uint8Array.from(pair.secretKey),
+      publicKey: Uint8Array.from(pair.publicKey)
+    };
+  } finally {
+    seed.fill(0);
+  }
 }
 export {
   wrappingKeyPair,

package/dist/custody-share.d.ts

@@ -1,6 +1,8 @@
 import { type CipherBox, type SealedToKey } from './custody-crypto';
 export interface SealedShare {
     shareIndex: number;
+    /** Account credential whose PRF deterministically derives this passkey key. */
+    passkeyCredentialId?: string;
     passkeyEnvelope: CipherBox;
     phraseEnvelope: CipherBox;
     /** base64 — the HKDF salt for the phrase key and the verifier. */
@@ -42,6 +44,8 @@ export declare function openShareWithPhrase(sealed: SealedShare, custodianKey: s
  * ever sent.
  */
 export interface WrappingKeys {
+    /** The verified, PRF-capable account credential selected by the browser. */
+    passkeyCredentialId: string;
     passkeyPublicKey: string;
     phrasePublicKey: string;
     phraseSalt: string;
@@ -60,6 +64,7 @@ export declare function phraseWrappingKey(custodianKey: string, phraseWords: str
 /** Everything the server needs, and nothing it must not have. */
 export declare function wrappingKeysFor(args: {
     custodianKey: string;
+    passkeyCredentialId: string;
     passkeyPrfOutput: Uint8Array;
     phraseWords: string[];
 }): WrappingKeys;

package/dist/custody-share.js

@@ -8,9 +8,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 
 // src/custody-crypto.ts
 import { gcm } from "@noble/ciphers/aes.js";
-import { x25519 } from "@noble/curves/ed25519.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
+import { ml_kem768_x25519 } from "@noble/post-quantum/hybrid.js";
 var KEY_BYTES = 32;
 var NONCE_BYTES = 12;
 var toBase64 = (bytes) => {
@@ -44,40 +44,62 @@ function openWithKey(key, box, aad) {
     throw new Error(`custody: unknown algorithm ${box.alg}`);
   return gcm(key, fromBase64(box.nonce), utf8(aad)).decrypt(fromBase64(box.ciphertext));
 }
-var WRAP_INFO = "forgezero:custody:wrap:v1";
-var wrapKey = (shared, ephemeral, recipient) => hkdf(sha256, shared, concatBytes(ephemeral, recipient), utf8(WRAP_INFO), 32);
-function concatBytes(left, right) {
-  const out = new Uint8Array(left.length + right.length);
-  out.set(left, 0);
-  out.set(right, left.length);
-  return out;
-}
+var WRAP_INFO = "forgezero:custody:wrap:ml-kem-768+x25519:v2";
+var WRAP_SEED_SALT = utf8("forgezero:custody:wrapkey:ml-kem-768+x25519:v2");
+var wrapKey = (shared) => hkdf(sha256, shared, undefined, utf8(WRAP_INFO), 32);
 function sealToKey(recipientPublicKey, plaintext, aad) {
-  const ephemeralSecret = x25519.utils.randomSecretKey();
-  const ephemeralPublic = x25519.getPublicKey(ephemeralSecret);
-  const shared = x25519.getSharedSecret(ephemeralSecret, recipientPublicKey);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublicKey);
+  if (recipientPublicKey.length !== ml_kem768_x25519.lengths.publicKey) {
+    throw new Error("custody: invalid hybrid recipient public key");
+  }
+  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(recipientPublicKey);
+  const shared = Uint8Array.from(sharedSecret);
+  const ciphertext = Uint8Array.from(cipherText);
+  const key = wrapKey(shared);
   try {
-    return { ...sealWithKey(key, plaintext, aad), ephemeral: toBase64(ephemeralPublic) };
+    return {
+      version: 2,
+      ...sealWithKey(key, plaintext, aad),
+      kemCiphertext: toBase64(ciphertext)
+    };
   } finally {
     key.fill(0);
-    ephemeralSecret.fill(0);
+    shared.fill(0);
   }
 }
 function openFromKey(recipientSecretKey, box, aad) {
-  const ephemeralPublic = fromBase64(box.ephemeral);
-  const recipientPublic = x25519.getPublicKey(recipientSecretKey);
-  const shared = x25519.getSharedSecret(recipientSecretKey, ephemeralPublic);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublic);
+  if (box?.version !== 2 || typeof box.kemCiphertext !== "string") {
+    throw new Error("custody: unsupported sealed-to-key envelope");
+  }
+  if (recipientSecretKey.length !== ml_kem768_x25519.lengths.secretKey) {
+    throw new Error("custody: invalid hybrid recipient secret key");
+  }
+  const ciphertext = fromBase64(box.kemCiphertext);
+  if (ciphertext.length !== ml_kem768_x25519.lengths.cipherText) {
+    throw new Error("custody: invalid hybrid KEM ciphertext");
+  }
+  const shared = Uint8Array.from(ml_kem768_x25519.decapsulate(ciphertext, recipientSecretKey));
+  const key = wrapKey(shared);
   try {
     return openWithKey(key, box, aad);
   } finally {
     key.fill(0);
+    shared.fill(0);
   }
 }
 function wrappingKeyPair(factorMaterial, info) {
-  const secretKey = hkdf(sha256, factorMaterial, utf8("forgezero:custody:wrapkey:v1"), utf8(info), 32);
-  return { secretKey, publicKey: x25519.getPublicKey(secretKey) };
+  if (factorMaterial.length < 32) {
+    throw new Error("custody: wrapping factor material must be at least 32 bytes");
+  }
+  const seed = hkdf(sha256, factorMaterial, WRAP_SEED_SALT, utf8(info), 32);
+  try {
+    const pair = ml_kem768_x25519.keygen(seed);
+    return {
+      secretKey: Uint8Array.from(pair.secretKey),
+      publicKey: Uint8Array.from(pair.publicKey)
+    };
+  } finally {
+    seed.fill(0);
+  }
 }
 
 // src/phrase.ts
@@ -247,11 +269,14 @@ function phraseWrappingKey(custodianKey, phraseWords, salt) {
   return wrappingKeyPair(phraseToKey(phraseWords, salt), wrapInfo(custodianKey, "phrase"));
 }
 function wrappingKeysFor(args) {
+  if (!args.passkeyCredentialId)
+    throw new Error("custody-share: passkey credential id is required");
   const salt = newSalt();
   const passkey = passkeyWrappingKey(args.custodianKey, args.passkeyPrfOutput);
   const phrase = phraseWrappingKey(args.custodianKey, args.phraseWords, salt);
   try {
     return {
+      passkeyCredentialId: args.passkeyCredentialId,
       passkeyPublicKey: toBase642(passkey.publicKey),
       phrasePublicKey: toBase642(phrase.publicKey),
       phraseSalt: toBase642(salt),

package/dist/identity.d.ts

@@ -9,9 +9,9 @@
  * are young; Ed25519 is not. Requiring both means a break in either one leaves
  * the other standing, and the cost is a few hundred bytes per request.
  *
- * This is the one place ForgeZero uses asymmetric post-quantum crypto. Custody
- * needs none — it is symmetric and Shamir throughout — but a node signature is
- * genuinely a signature, so there is a Shor target here and nowhere else.
+ * This is the machine-identity use of asymmetric post-quantum crypto. Browser
+ * passkeys have a separate PRF-derived ML-DSA companion in passkey-hybrid.ts,
+ * while persisted custody remains symmetric and Shamir-based.
  *
  * ## Where the primitives come from
  *
@@ -55,9 +55,13 @@ export interface NodePublicKeys {
  * break in one leaves the other genuinely independent.
  */
 export declare function deriveKeysFromSeed(seed: Uint8Array): NodeKeyPair;
+/** Derive only public halves for server-side credential issuance, then erase every private byte. */
+export declare function derivePublicKeysFromSeed(seed: Uint8Array): NodePublicKeys;
 /** Generate a node key pair. The secret halves never leave the caller. */
 export declare function generateNodeKeys(): NodeKeyPair;
 export interface SignedEnvelope {
+    version: 1;
+    suite: typeof REQUEST_SIGNATURE_SUITE;
     nodeKey: string;
     timestamp: number;
     nonce: string;
@@ -70,11 +74,14 @@ export interface ResponseRecipient {
 }
 export interface SealedResponse {
     version: 1;
+    suite: typeof RESPONSE_SEALING_SUITE;
     kemCiphertext: string;
     nonce: string;
     ciphertext: string;
 }
 export declare const RESPONSE_KEY_HEADER = "x-fz-response-key";
+export declare const REQUEST_SIGNATURE_SUITE: "ed25519+ml-dsa-65";
+export declare const RESPONSE_SEALING_SUITE: "ml-kem-768+x25519/aes-256-gcm";
 export declare function validResponsePublicKey(value: string): boolean;
 /** One ephemeral hybrid ML-KEM-768 + X25519 recipient per request. */
 export declare function generateResponseRecipient(): ResponseRecipient;
@@ -95,6 +102,7 @@ export declare function decodeSignatureHeader(raw: string, nodeKey: string): Sig
  * large upload does not have to be buffered twice.
  */
 export declare function canonicalString(args: {
+    identity: string;
     method: string;
     path: string;
     query: string;

package/dist/identity.js

@@ -26,10 +26,26 @@ function deriveKeysFromSeed(seed) {
   const edPublic = ed25519.getPublicKey(edSecret);
   const mlKeys = ml_dsa65.keygen(mlSeed);
   mlSeed.fill(0);
-  return {
+  const result = {
     ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
     mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
   };
+  edSecret.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
+}
+function derivePublicKeysFromSeed(seed) {
+  if (seed.length < 32)
+    throw new Error("identity: seed must be at least 32 bytes");
+  const edSecret = hkdf(sha256, seed, undefined, ENCODER.encode("forgezero/identity/ed25519/v1"), 32);
+  const mlSeed = hkdf(sha256, seed, undefined, ENCODER.encode("forgezero/identity/ml-dsa-65/v1"), 32);
+  const edPublic = ed25519.getPublicKey(edSecret);
+  const mlKeys = ml_dsa65.keygen(mlSeed);
+  const result = { ed25519: b64(edPublic), mlDsa: b64(mlKeys.publicKey) };
+  edSecret.fill(0);
+  mlSeed.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
 }
 function generateNodeKeys() {
   const edSecret = ed25519.utils.randomSecretKey();
@@ -37,26 +53,60 @@ function generateNodeKeys() {
   const seed = randomBytes(32);
   const mlKeys = ml_dsa65.keygen(seed);
   seed.fill(0);
-  return {
+  const result = {
     ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
     mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
   };
+  edSecret.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
 }
 var RESPONSE_KEY_HEADER = "x-fz-response-key";
-function validResponsePublicKey(value) {
+var REQUEST_SIGNATURE_SUITE = "ed25519+ml-dsa-65";
+var RESPONSE_SEALING_SUITE = "ml-kem-768+x25519/aes-256-gcm";
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var encodedLength = (bytes) => Math.ceil(bytes * 4 / 3);
+var length = (value, name) => {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new Error(`identity: ${name} length unavailable`);
+  return value;
+};
+var ED_PUBLIC_BYTES = length(ed25519.lengths.publicKey, "Ed25519 public key");
+var ED_SIGNATURE_BYTES = length(ed25519.lengths.signature, "Ed25519 signature");
+var ML_PUBLIC_BYTES = length(ml_dsa65.lengths.publicKey, "ML-DSA-65 public key");
+var ML_SIGNATURE_BYTES = length(ml_dsa65.lengths.signature, "ML-DSA-65 signature");
+var RESPONSE_PUBLIC_BYTES = length(ml_kem768_x25519.lengths.publicKey, "hybrid response public key");
+var RESPONSE_SECRET_BYTES = length(ml_kem768_x25519.lengths.secretKey, "hybrid response secret key");
+var RESPONSE_CIPHERTEXT_BYTES = length(ml_kem768_x25519.lengths.cipherText, "hybrid response ciphertext");
+function exactBytes(value, bytes) {
+  if (typeof value !== "string" || value.length !== encodedLength(bytes) || !BASE64URL.test(value))
+    return null;
   try {
-    return un64(value).length === ml_kem768_x25519.lengths.publicKey;
+    const decoded = un64(value);
+    return decoded.length === bytes && b64(decoded) === value ? decoded : null;
   } catch {
-    return false;
+    return null;
   }
 }
+function validIdentity(value) {
+  return typeof value === "string" && value.length >= 1 && value.length <= 128 && !/[^A-Za-z0-9_.:@/-]/.test(value) && !/[\0\r\n]/.test(value);
+}
+function validResponsePublicKey(value) {
+  return exactBytes(value, RESPONSE_PUBLIC_BYTES) !== null;
+}
 function generateResponseRecipient() {
   const pair = ml_kem768_x25519.keygen();
   return { publicKey: b64(pair.publicKey), secretKey: b64(pair.secretKey) };
 }
 var responseKey = (sharedSecret) => hkdf(sha256, sharedSecret, undefined, ENCODER.encode("forgezero/response/ml-kem-768+x25519/v1"), 32);
 async function sealResponse(recipientPublicKey, requestBinding, payload) {
-  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(un64(recipientPublicKey));
+  const recipient = exactBytes(recipientPublicKey, RESPONSE_PUBLIC_BYTES);
+  if (!recipient)
+    throw new Error("response: malformed recipient public key");
+  if (!requestBinding || requestBinding.length > 16384 || /[\0\r\n]/.test(requestBinding)) {
+    throw new Error("response: malformed request binding");
+  }
+  const { cipherText, sharedSecret } = ml_kem768_x25519.encapsulate(recipient);
   const rawKey = responseKey(sharedSecret);
   sharedSecret.fill(0);
   const key = await crypto.subtle.importKey("raw", new Uint8Array(rawKey), "AES-GCM", false, ["encrypt"]);
@@ -66,6 +116,10 @@ async function sealResponse(recipientPublicKey, requestBinding, payload) {
   if (serialized === undefined)
     throw new Error("response: payload is not JSON serializable");
   const plaintext = ENCODER.encode(serialized);
+  if (plaintext.length > 16 * 1024 * 1024 - 16) {
+    plaintext.fill(0);
+    throw new Error("response: payload exceeds sealed response limit");
+  }
   const ciphertext = await crypto.subtle.encrypt({
     name: "AES-GCM",
     iv: new Uint8Array(nonce),
@@ -75,25 +129,46 @@ async function sealResponse(recipientPublicKey, requestBinding, payload) {
   plaintext.fill(0);
   return {
     version: 1,
+    suite: RESPONSE_SEALING_SUITE,
     kemCiphertext: b64(cipherText),
     nonce: b64(nonce),
     ciphertext: b64(new Uint8Array(ciphertext))
   };
 }
 async function openResponse(recipientSecretKey, requestBinding, envelope) {
-  if (envelope?.version !== 1)
+  if (!requestBinding || requestBinding.length > 16384 || /[\0\r\n]/.test(requestBinding)) {
+    throw new Error("response: malformed request binding");
+  }
+  if (envelope?.version !== 1 || envelope.suite !== RESPONSE_SEALING_SUITE) {
     throw new Error("response: unsupported sealed response");
-  const sharedSecret = ml_kem768_x25519.decapsulate(un64(envelope.kemCiphertext), un64(recipientSecretKey));
+  }
+  const kemCiphertext = exactBytes(envelope.kemCiphertext, RESPONSE_CIPHERTEXT_BYTES);
+  const nonce = exactBytes(envelope.nonce, 12);
+  if (!kemCiphertext || !nonce || typeof envelope.ciphertext !== "string" || envelope.ciphertext.length < encodedLength(16) || envelope.ciphertext.length > encodedLength(16 * 1024 * 1024) || !BASE64URL.test(envelope.ciphertext)) {
+    throw new Error("response: malformed sealed response");
+  }
+  let encodedCiphertext;
+  try {
+    encodedCiphertext = un64(envelope.ciphertext);
+  } catch {
+    throw new Error("response: malformed sealed response");
+  }
+  if (encodedCiphertext.length < 16 || encodedCiphertext.length > 16 * 1024 * 1024 || b64(encodedCiphertext) !== envelope.ciphertext) {
+    throw new Error("response: malformed sealed response");
+  }
+  const sharedSecret = ml_kem768_x25519.decapsulate(kemCiphertext, exactBytes(recipientSecretKey, RESPONSE_SECRET_BYTES) ?? (() => {
+    throw new Error("response: malformed recipient secret key");
+  })());
   const rawKey = responseKey(sharedSecret);
   sharedSecret.fill(0);
   const key = await crypto.subtle.importKey("raw", new Uint8Array(rawKey), "AES-GCM", false, ["decrypt"]);
   rawKey.fill(0);
   const decrypted = new Uint8Array(await crypto.subtle.decrypt({
     name: "AES-GCM",
-    iv: new Uint8Array(un64(envelope.nonce)),
+    iv: new Uint8Array(nonce),
     additionalData: new Uint8Array(ENCODER.encode(requestBinding)),
     tagLength: 128
-  }, key, new Uint8Array(un64(envelope.ciphertext))));
+  }, key, new Uint8Array(encodedCiphertext)));
   try {
     return JSON.parse(new TextDecoder().decode(decrypted));
   } finally {
@@ -101,6 +176,8 @@ async function openResponse(recipientSecretKey, requestBinding, envelope) {
   }
 }
 var SIGNATURE_FIELDS = (envelope) => ({
+  version: envelope.version,
+  suite: envelope.suite,
   timestamp: envelope.timestamp,
   nonce: envelope.nonce,
   edSignature: envelope.edSignature,
@@ -110,15 +187,19 @@ function encodeSignatureHeader(envelope) {
   return b64(ENCODER.encode(JSON.stringify(SIGNATURE_FIELDS(envelope))));
 }
 function decodeSignatureHeader(raw, nodeKey) {
+  if (typeof raw !== "string" || raw.length < 64 || raw.length > 8192 || !BASE64URL.test(raw))
+    return null;
   let parsed;
   try {
     parsed = JSON.parse(new TextDecoder().decode(un64(raw)));
   } catch {
     return null;
   }
-  if (typeof parsed.timestamp !== "number" || !Number.isSafeInteger(parsed.timestamp) || typeof parsed.nonce !== "string" || typeof parsed.edSignature !== "string" || typeof parsed.mlDsaSignature !== "string")
+  if (Object.keys(parsed).length !== 6 || parsed.version !== 1 || parsed.suite !== REQUEST_SIGNATURE_SUITE || typeof parsed.timestamp !== "number" || !Number.isSafeInteger(parsed.timestamp) || !exactBytes(parsed.nonce ?? "", 16) || !exactBytes(parsed.edSignature ?? "", ED_SIGNATURE_BYTES) || !exactBytes(parsed.mlDsaSignature ?? "", ML_SIGNATURE_BYTES) || !validIdentity(nodeKey))
     return null;
   return {
+    version: 1,
+    suite: REQUEST_SIGNATURE_SUITE,
     nodeKey,
     timestamp: parsed.timestamp,
     nonce: parsed.nonce,
@@ -127,9 +208,15 @@ function decodeSignatureHeader(raw, nodeKey) {
   };
 }
 function canonicalString(args) {
+  if (!validIdentity(args.identity) || !/^[A-Za-z][A-Za-z0-9-]{0,31}$/.test(args.method) || /[\0\r\n]/.test(args.path) || /[\0\r\n]/.test(args.query) || !exactBytes(args.nonce, 16) || args.responseKey !== undefined && !validResponsePublicKey(args.responseKey)) {
+    throw new Error("identity: malformed canonical request");
+  }
   const body = typeof args.body === "string" ? ENCODER.encode(args.body) : args.body;
   const digest = Array.from(sha256(body), (byte) => byte.toString(16).padStart(2, "0")).join("");
   const fields = [
+    "forgezero/request-signature/v1",
+    REQUEST_SIGNATURE_SUITE,
+    args.identity,
     args.method.toUpperCase(),
     args.path,
     args.query ?? "",
@@ -137,16 +224,17 @@ function canonicalString(args) {
     args.nonce,
     digest
   ];
-  if (args.responseKey)
-    fields.push(args.responseKey);
+  fields.push(args.responseKey ?? "-");
   return fields.join(`
 `);
 }
 function signRequest(keys, nodeKey, args) {
   const timestamp = Math.floor(Date.now() / 1000);
   const nonce = b64(randomBytes(16));
-  const message = ENCODER.encode(canonicalString({ ...args, query: args.query ?? "", timestamp, nonce }));
+  const message = ENCODER.encode(canonicalString({ ...args, identity: nodeKey, query: args.query ?? "", timestamp, nonce }));
   return {
+    version: 1,
+    suite: REQUEST_SIGNATURE_SUITE,
     nodeKey,
     timestamp,
     nonce,
@@ -157,12 +245,16 @@ function signRequest(keys, nodeKey, args) {
 var CLOCK_SKEW_SECONDS = 300;
 function verifyRequest(args) {
   const now = args.nowSeconds ?? Math.floor(Date.now() / 1000);
+  if (args.envelope.version !== 1 || args.envelope.suite !== REQUEST_SIGNATURE_SUITE || !validIdentity(args.envelope.nodeKey) || !exactBytes(args.envelope.nonce, 16) || !exactBytes(args.envelope.edSignature, ED_SIGNATURE_BYTES) || !exactBytes(args.envelope.mlDsaSignature, ML_SIGNATURE_BYTES) || !exactBytes(args.publicKeys.ed25519, ED_PUBLIC_BYTES) || !exactBytes(args.publicKeys.mlDsa, ML_PUBLIC_BYTES) || args.responseKey !== undefined && !validResponsePublicKey(args.responseKey)) {
+    return { verified: false, reason: "malformed" };
+  }
   if (Math.abs(now - args.envelope.timestamp) > CLOCK_SKEW_SECONDS) {
     return { verified: false, reason: "timestamp_out_of_window" };
   }
   let message;
   try {
     message = ENCODER.encode(canonicalString({
+      identity: args.envelope.nodeKey,
       method: args.method,
       path: args.path,
       query: args.query ?? "",
@@ -199,9 +291,12 @@ export {
   generateResponseRecipient,
   generateNodeKeys,
   encodeSignatureHeader,
+  derivePublicKeysFromSeed,
   deriveKeysFromSeed,
   decodeSignatureHeader,
   canonicalString,
+  RESPONSE_SEALING_SUITE,
   RESPONSE_KEY_HEADER,
+  REQUEST_SIGNATURE_SUITE,
   CLOCK_SKEW_SECONDS
 };

package/dist/passkey-hybrid.d.ts

@@ -0,0 +1,37 @@
+export declare const PASSKEY_HYBRID_VERSION: 1;
+export declare const PASSKEY_HYBRID_SUITE: "webauthn+prf-ml-dsa-65";
+export declare const PASSKEY_PRF_SALT: Uint8Array<ArrayBuffer>;
+export type PasskeyHybridPurpose = 'register' | 'signin' | 'session' | 'action';
+export interface PasskeyHybridBinding {
+    version: typeof PASSKEY_HYBRID_VERSION;
+    suite: typeof PASSKEY_HYBRID_SUITE;
+    purpose: PasskeyHybridPurpose;
+    rpId: string;
+    origin: string;
+    challenge: string;
+    userKey: string;
+    sessionKey: string;
+    actionRequestKey: string;
+}
+export interface PasskeyHybridProof {
+    version: typeof PASSKEY_HYBRID_VERSION;
+    suite: typeof PASSKEY_HYBRID_SUITE;
+    credentialId: string;
+    signature: string;
+}
+export interface PasskeyHybridRegistrationProof extends PasskeyHybridProof {
+    publicKey: string;
+    /** A verified WebAuthn assertion which performed the PRF evaluation. */
+    assertion: unknown;
+}
+export declare function passkeyHybridMessage(binding: PasskeyHybridBinding, credentialId: string): Uint8Array;
+export declare function createPasskeyHybridProof(prfOutput: Uint8Array, binding: PasskeyHybridBinding, credentialId: string): PasskeyHybridProof & {
+    publicKey: string;
+};
+export declare function verifyPasskeyHybridProof(args: {
+    proof: PasskeyHybridProof;
+    publicKey: string;
+    binding: PasskeyHybridBinding;
+}): boolean;
+export declare const PASSKEY_ML_DSA_PUBLIC_KEY_BYTES: number;
+export declare const PASSKEY_ML_DSA_SIGNATURE_BYTES: number;