@smartledger/keys 1.5.0 → 1.5.2

package/README.md

@@ -2,10 +2,12 @@
 
 **Single source of truth for cryptographic key operations.**
 
-Version: 1.4.0  
+Version: 1.5.1  
 Status: ✅ Production Ready  
 Tests: 52/52 passing
 
+**New in 1.5.1:** All three ML-DSA security levels now available (44/65/87)
+
 ---
 
 ## Why This SDK?
@@ -48,6 +50,16 @@ And **don't care** how keys are stored, rotated, or implemented.
 npm install @smartledger/keys
 ```
 
+### Supported ML-DSA Variants
+
+Choose the right security level for your use case:
+
+| Variant | NIST Level | Equivalent | Use Case |
+|---------|------------|------------|----------|
+| **ml-dsa-44** | Level 2 | AES-128 | IoT devices, high-throughput systems |
+| **ml-dsa-65** | Level 3 | AES-192 | **General purpose (recommended)** |
+| **ml-dsa-87** | Level 5 | AES-256 | High-security, long-term confidential data |
+
 ---
 
 ## Quick Start
@@ -59,10 +71,11 @@ import { createKeySDK } from '@smartledger/keys';
 const sdk = createKeySDK();
 
 // Create both PQ + ECDSA keys for an agent
+// Using ml-dsa-65 (Level 3) - recommended for most use cases
 const { primaryKey, secondaryKey } = await sdk.createDualSignatureKeys(
   'agent-resonance',
   {
-    primarySignatureSuite: 'ml-dsa-87',
+    primarySignatureSuite: 'ml-dsa-65',  // or 'ml-dsa-44', 'ml-dsa-87'
     secondarySignatureSuite: 'bsv-ecdsa-secp256k1',
   }
 );
@@ -101,7 +114,7 @@ Create a new key for an agent/module.
 ```typescript
 const key = await sdk.createKey(
   'agent-schema',
-  { primarySignatureSuite: 'ml-dsa-87' },
+  { primarySignatureSuite: 'ml-dsa-65' },  // Recommended: Level 3
   {
     expiresAt: new Date(Date.now() + 365 * 86400000).toISOString(), // 1 year
     usage: ['signing'],
@@ -124,7 +137,7 @@ Get an existing key by ID.
 ```typescript
 const key = await sdk.getKey('agent-resonance:pk-ml-1');
 if (key) {
-  console.log(key.meta.suiteId); // 'ml-dsa-87'
+  console.log(key.meta.suiteId); // 'ml-dsa-65' or 'ml-dsa-44', 'ml-dsa-87'
   console.log(key.publicKey); // Uint8Array
 }
 ```
@@ -207,7 +220,7 @@ Looks up the most recent active keys and infers the profile.
 **Example:**
 ```typescript
 const profile = await sdk.getActiveCryptoProfile('agent-schema');
-console.log(profile.primarySignatureSuite); // 'ml-dsa-87'
+console.log(profile.primarySignatureSuite); // 'ml-dsa-65'
 console.log(profile.secondarySignatureSuite); // 'bsv-ecdsa-secp256k1'
 ```
 
@@ -252,11 +265,11 @@ Create key if it doesn't exist, otherwise return existing.
 ```typescript
 // Safe to call multiple times
 const key1 = await sdk.getOrCreateKey('agent-validator', {
-  primarySignatureSuite: 'ml-dsa-87',
+  primarySignatureSuite: 'ml-dsa-65',
 });
 
 const key2 = await sdk.getOrCreateKey('agent-validator', {
-  primarySignatureSuite: 'ml-dsa-87',
+  primarySignatureSuite: 'ml-dsa-65',
 });
 
 console.log(key1.meta.keyId === key2.meta.keyId); // true
@@ -275,7 +288,7 @@ Create both primary and secondary keys in one call. Requires `profile.secondaryS
 const { primaryKey, secondaryKey } = await sdk.createDualSignatureKeys(
   'agent-bridge',
   {
-    primarySignatureSuite: 'ml-dsa-87',
+    primarySignatureSuite: 'ml-dsa-65',  // Recommended
     secondarySignatureSuite: 'bsv-ecdsa-secp256k1',
   }
 );
@@ -351,7 +364,7 @@ Per-agent/module crypto configuration.
 
 ```typescript
 interface CryptoProfile {
-  primarySignatureSuite: string;     // e.g. 'ml-dsa-87'
+  primarySignatureSuite: string;     // e.g. 'ml-dsa-65' (recommended), 'ml-dsa-44', 'ml-dsa-87'
   secondarySignatureSuite?: string;  // e.g. 'bsv-ecdsa-secp256k1' (hybrid)
   keyEncapsulationSuite?: string;    // e.g. 'ml-kem-768' (future)
 }
@@ -364,9 +377,9 @@ interface CryptoProfile {
 ### Single Signature (PQ-only)
 
 ```typescript
-// Agent uses only ML-DSA
+// Agent uses only ML-DSA (recommended: ml-dsa-65)
 const key = await sdk.createKey('agent-research', {
-  primarySignatureSuite: 'ml-dsa-87',
+  primarySignatureSuite: 'ml-dsa-65',  // or 'ml-dsa-44' for IoT, 'ml-dsa-87' for max security
 });
 
 const message = new TextEncoder().encode('research results');
@@ -378,7 +391,7 @@ const signature = await sdk.signWithKey(key.meta.keyId, message);
 ```typescript
 // One call to create both keys
 await sdk.getOrCreateDualSignatureKeys('agent-bridge', {
-  primarySignatureSuite: 'ml-dsa-87',
+  primarySignatureSuite: 'ml-dsa-65',  // Balanced security (recommended)
   secondarySignatureSuite: 'bsv-ecdsa-secp256k1',
 });
 
@@ -397,7 +410,7 @@ console.log(verified.allValid); // true
 // Safe to call on every startup
 async function setupAgent(agentId: string) {
   const key = await sdk.getOrCreateKey(agentId, {
-    primarySignatureSuite: 'ml-dsa-87',
+    primarySignatureSuite: 'ml-dsa-65',  // Recommended default
   }, {
     expiresAt: new Date(Date.now() + 365 * 86400000).toISOString(),
   });
@@ -491,7 +504,7 @@ const sig = await suite.sign(key.keypair.privateKey, message);
 ```typescript
 // Clean, centralized
 const key = await sdk.createKey('agent-1', {
-  primarySignatureSuite: 'ml-dsa-87',
+  primarySignatureSuite: 'ml-dsa-65',  // Choose: 'ml-dsa-44', '65', or '87'
 });
 
 const sig = await sdk.signWithKey(key.meta.keyId, message);

package/dist/cjs/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBpD;AAED;;GAEG;;;;AACH,wBAEE"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAoBpD;AAED;;GAEG;;;;AACH,wBAEE"}

package/dist/cjs/browser.js

@@ -37,9 +37,8 @@ async function createKeySDK() {
     const suiteRegistry = new crypto_1.SignatureSuiteRegistry();
     suiteRegistry.register(new crypto_1.BsvEcdsaSuite());
     suiteRegistry.register(new crypto_1.MlDsa44Suite()); // Level 2 (AES-128 equivalent)
-    suiteRegistry.register(new crypto_1.MlDsa65Suite()); // Level 3 (AES-192 equivalent)
+    suiteRegistry.register(new crypto_1.MlDsa65Suite()); // Level 3 (AES-192 equivalent) - also 'ml-dsa-65' default
     suiteRegistry.register(new crypto_1.MlDsa87Suite()); // Level 5 (AES-256 equivalent)
-    suiteRegistry.register(new crypto_1.MlDsaSuite()); // Alias for MlDsa65Suite
     const sdk = new sdk_js_1.DefaultKeySDK({
         keyRegistry,
         suiteRegistry,

package/dist/cjs/browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;AAuBH,oCAqBC;AA1CD,qCAAyC;AACzC,gDAS6B;AAG7B,wCAAwC;AACxC,6CAA2B;AAC3B,8CAAyD;AAAhD,4GAAA,kBAAkB,OAAA;AAE3B;;;GAGG;AACI,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,2BAAkB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,oBAAW,CAAC,OAAO,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,MAAM,aAAa,GAAG,IAAI,+BAAsB,EAAE,CAAC;IACnD,aAAa,CAAC,QAAQ,CAAC,IAAI,sBAAa,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,QAAQ,CAAC,IAAI,qBAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,qBAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,qBAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,mBAAU,EAAE,CAAC,CAAC,CAAG,yBAAyB;IAErE,MAAM,GAAG,GAAG,IAAI,sBAAa,CAAC;QAC5B,WAAW;QACX,aAAa;KACd,CAAC,CAAC;IAEH,2CAA2C;IAC3C,kEAAkE;IAElE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,kBAAe;IACb,YAAY;CACb,CAAC;AAEF,8BAA8B;AAC9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;IACjC,MAAc,CAAC,SAAS,GAAG;QAC1B,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;AAsBH,oCAoBC;AAxCD,qCAAyC;AACzC,gDAQ6B;AAG7B,wCAAwC;AACxC,6CAA2B;AAC3B,8CAAyD;AAAhD,4GAAA,kBAAkB,OAAA;AAE3B;;;GAGG;AACI,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,2BAAkB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,oBAAW,CAAC,OAAO,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,MAAM,aAAa,GAAG,IAAI,+BAAsB,EAAE,CAAC;IACnD,aAAa,CAAC,QAAQ,CAAC,IAAI,sBAAa,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,QAAQ,CAAC,IAAI,qBAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,qBAAY,EAAE,CAAC,CAAC,CAAC,0DAA0D;IACtG,aAAa,CAAC,QAAQ,CAAC,IAAI,qBAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAE3E,MAAM,GAAG,GAAG,IAAI,sBAAa,CAAC;QAC5B,WAAW;QACX,aAAa;KACd,CAAC,CAAC;IAEH,2CAA2C;IAC3C,kEAAkE;IAElE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,kBAAe;IACb,YAAY;CACb,CAAC;AAEF,8BAA8B;AAC9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;IACjC,MAAc,CAAC,SAAS,GAAG;QAC1B,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/esm/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBpD;AAED;;GAEG;;;;AACH,wBAEE"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAoBpD;AAED;;GAEG;;;;AACH,wBAEE"}

package/dist/esm/browser.js

@@ -3,7 +3,7 @@
  * Includes WASM initialization and browser-compatible exports
  */
 import { DefaultKeySDK } from './sdk.js';
-import { InMemoryKeyStorage, KeyRegistry, SignatureSuiteRegistry, BsvEcdsaSuite, MlDsa44Suite, MlDsa65Suite, MlDsa87Suite, MlDsaSuite, } from '@smartledger/crypto';
+import { InMemoryKeyStorage, KeyRegistry, SignatureSuiteRegistry, BsvEcdsaSuite, MlDsa44Suite, MlDsa65Suite, MlDsa87Suite, } from '@smartledger/crypto';
 // Re-export all types for browser usage
 export * from './types.js';
 export { InMemoryKeyStorage } from '@smartledger/crypto';
@@ -18,9 +18,8 @@ export async function createKeySDK() {
     const suiteRegistry = new SignatureSuiteRegistry();
     suiteRegistry.register(new BsvEcdsaSuite());
     suiteRegistry.register(new MlDsa44Suite()); // Level 2 (AES-128 equivalent)
-    suiteRegistry.register(new MlDsa65Suite()); // Level 3 (AES-192 equivalent)
+    suiteRegistry.register(new MlDsa65Suite()); // Level 3 (AES-192 equivalent) - also 'ml-dsa-65' default
     suiteRegistry.register(new MlDsa87Suite()); // Level 5 (AES-256 equivalent)
-    suiteRegistry.register(new MlDsaSuite()); // Alias for MlDsa65Suite
     const sdk = new DefaultKeySDK({
         keyRegistry,
         suiteRegistry,

package/dist/esm/browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,UAAU,GACX,MAAM,qBAAqB,CAAC;AAG7B,wCAAwC;AACxC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,MAAM,aAAa,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACnD,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAG,yBAAyB;IAErE,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;QAC5B,WAAW;QACX,aAAa;KACd,CAAC,CAAC;IAEH,2CAA2C;IAC3C,kEAAkE;IAElE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,eAAe;IACb,YAAY;CACb,CAAC;AAEF,8BAA8B;AAC9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;IACjC,MAAc,CAAC,SAAS,GAAG;QAC1B,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,wCAAwC;AACxC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,MAAM,aAAa,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACnD,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAC3E,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,0DAA0D;IACtG,aAAa,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,+BAA+B;IAE3E,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;QAC5B,WAAW;QACX,aAAa;KACd,CAAC,CAAC;IAEH,2CAA2C;IAC3C,kEAAkE;IAElE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,eAAe;IACb,YAAY;CACb,CAAC;AAEF,8BAA8B;AAC9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;IACjC,MAAc,CAAC,SAAS,GAAG;QAC1B,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/lumen-keys.js

@@ -10400,8 +10400,6 @@ zoo`.split("\n");
       return ML_DSA_SIZES["ml-dsa-87"];
     }
   };
-  var MlDsaSuite = class extends MlDsa65Suite {
-  };
 
   // src/sdk.ts
   var DefaultKeySDK = class {
@@ -10794,7 +10792,6 @@ Consider using one of these suites or remove the derivationContext option.` : `N
     suiteRegistry.register(new MlDsa44Suite());
     suiteRegistry.register(new MlDsa65Suite());
     suiteRegistry.register(new MlDsa87Suite());
-    suiteRegistry.register(new MlDsaSuite());
     const sdk = new DefaultKeySDK({
       keyRegistry,
       suiteRegistry