@ziffer-io/verify 0.1.0

package/dist/ed25519.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Strict Ed25519 -- the small-order rule WRITTEN OUT (ACP-106), the third
+ * spelling of the one rule the engine keeps in two places: Rust calls
+ * `ed25519-dalek`'s `verify_strict`; the Python reference writes the guard out
+ * in `acp_crypto.verify_prim` because `cryptography` has no strict mode. The
+ * three MUST stay one rule -- a guard on one side only converts a closed
+ * defect into a divergence -- and `fixtures/refused_ed25519.json` (mirrored
+ * byte-identically from the engine) is the executable statement of it: every
+ * vector there is accepted by RFC 8032 as OpenSSL implements it and must be
+ * refused here.
+ *
+ * WHY. Under a small-order public key A the verification equation
+ * `[s]B == R + [k]A` loses its A term -- for the identity point `[k]A` is the
+ * identity whatever k is -- so what remains, `[s]B == R`, does not mention the
+ * message at all, and ONE signature verifies for EVERY message under that key.
+ * A small-order R is the same fail-open reached from the signature side: an
+ * honest signer can emit r=0 and a non-strict verifier accepts it over a
+ * message it never committed to. Both halves are refused, as in `verify_prim`.
+ *
+ * @noble/curves' `verify` with `{ zip215: false }` gives RFC 8032 cofactored
+ * verification with canonical encodings enforced, but -- like OpenSSL -- it
+ * does NOT refuse small-order points: those are perfectly canonical. So the
+ * guard is written out here, before the equation, exactly as in Python.
+ */
+/** RFC 8032 raw public key length. */
+export declare const ED25519_PK_LEN = 32;
+/** RFC 8032 signature length. */
+export declare const ED25519_SIG_LEN = 64;
+/**
+ * Whether an encoded point has order dividing 8 -- dalek's `is_weak`, the
+ * predicate `verify_strict` applies before it checks the equation. Computed on
+ * the curve (`[8]P == identity` via the library's own point arithmetic), never
+ * from a table of the eight encodings: a hardcoded blacklist is a second
+ * definition of "small order" that nothing can check against the curve.
+ *
+ * Bytes that do not decode as a point are `false`, not `true`: "not a key" is
+ * refused by the verifier itself a line later, and a guard that answered
+ * "weak" about bytes that are not a point would make its own failure mode
+ * unreadable (the engine states this rule on both sides).
+ */
+export declare function ed25519IsSmallOrder(encoded: Uint8Array): boolean;
+/**
+ * Verify one Ed25519 signature under the strict rule.
+ *
+ * Never throws: a malformed signature is a verification FAILURE, not an
+ * exception for a caller further up to catch -- a throw would travel a
+ * different path from a `false`, and the two must be indistinguishable to the
+ * fail-closed contract (`verify_prim`'s own words).
+ */
+export declare function verifyEd25519Strict(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
+//# sourceMappingURL=ed25519.d.ts.map

package/dist/ed25519.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,sCAAsC;AACtC,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,iCAAiC;AACjC,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAOhE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,GACpB,OAAO,CAmBT"}

package/dist/ed25519.js

@@ -0,0 +1,81 @@
+/**
+ * Strict Ed25519 -- the small-order rule WRITTEN OUT (ACP-106), the third
+ * spelling of the one rule the engine keeps in two places: Rust calls
+ * `ed25519-dalek`'s `verify_strict`; the Python reference writes the guard out
+ * in `acp_crypto.verify_prim` because `cryptography` has no strict mode. The
+ * three MUST stay one rule -- a guard on one side only converts a closed
+ * defect into a divergence -- and `fixtures/refused_ed25519.json` (mirrored
+ * byte-identically from the engine) is the executable statement of it: every
+ * vector there is accepted by RFC 8032 as OpenSSL implements it and must be
+ * refused here.
+ *
+ * WHY. Under a small-order public key A the verification equation
+ * `[s]B == R + [k]A` loses its A term -- for the identity point `[k]A` is the
+ * identity whatever k is -- so what remains, `[s]B == R`, does not mention the
+ * message at all, and ONE signature verifies for EVERY message under that key.
+ * A small-order R is the same fail-open reached from the signature side: an
+ * honest signer can emit r=0 and a non-strict verifier accepts it over a
+ * message it never committed to. Both halves are refused, as in `verify_prim`.
+ *
+ * @noble/curves' `verify` with `{ zip215: false }` gives RFC 8032 cofactored
+ * verification with canonical encodings enforced, but -- like OpenSSL -- it
+ * does NOT refuse small-order points: those are perfectly canonical. So the
+ * guard is written out here, before the equation, exactly as in Python.
+ */
+import { ed25519 } from '@noble/curves/ed25519.js';
+/** RFC 8032 raw public key length. */
+export const ED25519_PK_LEN = 32;
+/** RFC 8032 signature length. */
+export const ED25519_SIG_LEN = 64;
+/**
+ * Whether an encoded point has order dividing 8 -- dalek's `is_weak`, the
+ * predicate `verify_strict` applies before it checks the equation. Computed on
+ * the curve (`[8]P == identity` via the library's own point arithmetic), never
+ * from a table of the eight encodings: a hardcoded blacklist is a second
+ * definition of "small order" that nothing can check against the curve.
+ *
+ * Bytes that do not decode as a point are `false`, not `true`: "not a key" is
+ * refused by the verifier itself a line later, and a guard that answered
+ * "weak" about bytes that are not a point would make its own failure mode
+ * unreadable (the engine states this rule on both sides).
+ */
+export function ed25519IsSmallOrder(encoded) {
+    if (encoded.length !== ED25519_PK_LEN)
+        return false;
+    try {
+        return ed25519.Point.fromBytes(encoded).isSmallOrder();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify one Ed25519 signature under the strict rule.
+ *
+ * Never throws: a malformed signature is a verification FAILURE, not an
+ * exception for a caller further up to catch -- a throw would travel a
+ * different path from a `false`, and the two must be indistinguishable to the
+ * fail-closed contract (`verify_prim`'s own words).
+ */
+export function verifyEd25519Strict(publicKey, message, signature) {
+    if (publicKey.length !== ED25519_PK_LEN || signature.length !== ED25519_SIG_LEN) {
+        return false;
+    }
+    // ACP-106, both halves, BEFORE the equation: a small-order A makes one
+    // signature verify for every message; a small-order R (the first 32 bytes
+    // of the signature) lets an r=0 signature verify over a message the signer
+    // never committed to.
+    if (ed25519IsSmallOrder(publicKey) || ed25519IsSmallOrder(signature.subarray(0, 32))) {
+        return false;
+    }
+    try {
+        // zip215: false -- canonical point and scalar encodings enforced, matching
+        // dalek's strict decoding; the small-order refusals above are the part no
+        // library default provides.
+        return ed25519.verify(signature, message, publicKey, { zip215: false });
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ed25519.js.map

package/dist/ed25519.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD,sCAAsC;AACtC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,iCAAiC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmB;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,sBAAsB;IACtB,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,2EAA2E;QAC3E,0EAA0E;QAC1E,4BAA4B;QAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @ziffer-io/verify -- the third receipt-verifier implementation (ACP-197 §5).
+ *
+ * `verifyReceipt` is the API; everything else is exported so the pieces are
+ * individually testable and so `@ziffer-io/client` can re-export ONE verify (the
+ * client adds no verification logic of its own -- one home per rule).
+ */
+export { canon, compareCodePoints, type Json } from './canon.js';
+export { CLAUSE_BODY_SIZE, CLAUSE_CANONICAL, CLAUSE_DECISION, CLAUSE_PROPOSAL_BINDING, CLAUSE_RECEIPT_NONCE_SIZE, CLAUSE_SIGNATURE, CLAUSE_SUITE_FLOOR, CLAUSE_TEMPORAL, CLAUSE_UNKNOWN_SUITE, CLAUSE_VALIDITY_WINDOW, CLAUSE_VERSION, CLAUSE_WIRE_TYPE, } from './clauses.js';
+export { ED25519_PK_LEN, ED25519_SIG_LEN, ed25519IsSmallOrder, verifyEd25519Strict, } from './ed25519.js';
+export { parseInstant } from './instant.js';
+export { Refusal } from './refusal.js';
+export { parseSuite, satisfiesFloor, suitePrimitives, verifyHybrid, type HybridError, type Primitive, type PrimitiveVerdict, type Suite, } from './suite.js';
+export { CLOCK_SKEW_SECS, MAX_VALIDITY_WINDOW_SECS, MLDSA65_PK_LEN, MLDSA65_SIG_LEN, NONCE128_BYTES, NONCE128_LEN, RECEIPT_MAX_SIGNED_BYTES, RECEIPT_VERSION, SIGNED_EXCLUDE, isWe4B64, verifyReceipt, type TrustAnchor, type Verified, type VerifyOptions, } from './verify.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,KAAK,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+/**
+ * @ziffer-io/verify -- the third receipt-verifier implementation (ACP-197 §5).
+ *
+ * `verifyReceipt` is the API; everything else is exported so the pieces are
+ * individually testable and so `@ziffer-io/client` can re-export ONE verify (the
+ * client adds no verification logic of its own -- one home per rule).
+ */
+export { canon, compareCodePoints } from './canon.js';
+export { CLAUSE_BODY_SIZE, CLAUSE_CANONICAL, CLAUSE_DECISION, CLAUSE_PROPOSAL_BINDING, CLAUSE_RECEIPT_NONCE_SIZE, CLAUSE_SIGNATURE, CLAUSE_SUITE_FLOOR, CLAUSE_TEMPORAL, CLAUSE_UNKNOWN_SUITE, CLAUSE_VALIDITY_WINDOW, CLAUSE_VERSION, CLAUSE_WIRE_TYPE, } from './clauses.js';
+export { ED25519_PK_LEN, ED25519_SIG_LEN, ed25519IsSmallOrder, verifyEd25519Strict, } from './ed25519.js';
+export { parseInstant } from './instant.js';
+export { Refusal } from './refusal.js';
+export { parseSuite, satisfiesFloor, suitePrimitives, verifyHybrid, } from './suite.js';
+export { CLOCK_SKEW_SECS, MAX_VALIDITY_WINDOW_SECS, MLDSA65_PK_LEN, MLDSA65_SIG_LEN, NONCE128_BYTES, NONCE128_LEN, RECEIPT_MAX_SIGNED_BYTES, RECEIPT_VERSION, SIGNED_EXCLUDE, isWe4B64, verifyReceipt, } from './verify.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAa,MAAM,YAAY,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,GAKb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,aAAa,GAId,MAAM,aAAa,CAAC"}

package/dist/instant.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The RFC 3339 UTC instant, ported from the engine's ONE parser
+ * (`crates/acp-core/src/instant.rs::Timestamp`, WE-5's grammar).
+ *
+ * Strict, not permissive: exactly `YYYY-MM-DDTHH:MM:SSZ` and nothing else.
+ * Offsets, fractional seconds and lowercase `z` are refused rather than
+ * normalised -- a permissive decoder silently folding two spellings into one
+ * value is the encoding-split defect, and here it would decide when a receipt
+ * stops being valid. The day is checked against the ACTUAL month length
+ * (2026-02-31 used to parse in the engine and rolled forward to 2026-03-03:
+ * two spellings of one instant) and leap seconds are refused because the
+ * reference `datetime` refuses them.
+ *
+ * `fixtures/instant-type-vectors.json` is the engine's shared corpus for this
+ * grammar -- the file instant.rs, the Python reference and the schema pattern
+ * all answer -- mirrored byte-identically; the test here makes this file its
+ * FOURTH consumer, so a spelling that tells any two implementations apart
+ * turns something red.
+ *
+ * This module is a parser only. The engine also renders; a verifier writes no
+ * instants, and an unused renderer would be untested surface.
+ */
+/** Seconds since the Unix epoch for a WE-5 instant, or null when refused. */
+export declare function parseInstant(s: string): number | null;
+//# sourceMappingURL=instant.d.ts.map

package/dist/instant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instant.d.ts","sourceRoot":"","sources":["../src/instant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmCrD"}

package/dist/instant.js

@@ -0,0 +1,104 @@
+/**
+ * The RFC 3339 UTC instant, ported from the engine's ONE parser
+ * (`crates/acp-core/src/instant.rs::Timestamp`, WE-5's grammar).
+ *
+ * Strict, not permissive: exactly `YYYY-MM-DDTHH:MM:SSZ` and nothing else.
+ * Offsets, fractional seconds and lowercase `z` are refused rather than
+ * normalised -- a permissive decoder silently folding two spellings into one
+ * value is the encoding-split defect, and here it would decide when a receipt
+ * stops being valid. The day is checked against the ACTUAL month length
+ * (2026-02-31 used to parse in the engine and rolled forward to 2026-03-03:
+ * two spellings of one instant) and leap seconds are refused because the
+ * reference `datetime` refuses them.
+ *
+ * `fixtures/instant-type-vectors.json` is the engine's shared corpus for this
+ * grammar -- the file instant.rs, the Python reference and the schema pattern
+ * all answer -- mirrored byte-identically; the test here makes this file its
+ * FOURTH consumer, so a spelling that tells any two implementations apart
+ * turns something red.
+ *
+ * This module is a parser only. The engine also renders; a verifier writes no
+ * instants, and an unused renderer would be untested surface.
+ */
+/** Seconds since the Unix epoch for a WE-5 instant, or null when refused. */
+export function parseInstant(s) {
+    if (s.length !== 20)
+        return null;
+    if (s.charCodeAt(4) !== 0x2d || // -
+        s.charCodeAt(7) !== 0x2d || // -
+        s.charCodeAt(10) !== 0x54 || // T
+        s.charCodeAt(13) !== 0x3a || // :
+        s.charCodeAt(16) !== 0x3a || // :
+        s.charCodeAt(19) !== 0x5a // Z
+    ) {
+        return null;
+    }
+    const n = (from, to) => {
+        let v = 0;
+        for (let i = from; i < to; i += 1) {
+            const c = s.charCodeAt(i);
+            if (c < 0x30 || c > 0x39)
+                return null;
+            v = v * 10 + (c - 0x30);
+        }
+        return v;
+    };
+    const y = n(0, 4);
+    const mo = n(5, 7);
+    const d = n(8, 10);
+    const h = n(11, 13);
+    const mi = n(14, 16);
+    const sec = n(17, 19);
+    if (y === null || mo === null || d === null || h === null || mi === null || sec === null) {
+        return null;
+    }
+    // sec stops at 59: no leap second, matching the reference's datetime.
+    if (mo < 1 || mo > 12 || d < 1 || d > daysInMonth(y, mo) || h > 23 || mi > 59 || sec > 59) {
+        return null;
+    }
+    return daysFromCivil(y, mo, d) * 86_400 + h * 3600 + mi * 60 + sec;
+}
+/**
+ * How many days a month actually has. The century rule is the part that gets
+ * written wrong: 2000 IS a leap year (divisible by 400), 2100 is not
+ * (divisible by 100 but not 400). Both are in the mirrored corpus.
+ */
+function daysInMonth(y, m) {
+    switch (m) {
+        case 1:
+        case 3:
+        case 5:
+        case 7:
+        case 8:
+        case 10:
+        case 12:
+            return 31;
+        case 4:
+        case 6:
+        case 9:
+        case 11:
+            return 30;
+        case 2:
+            return (y % 4 === 0 && y % 100 !== 0) || y % 400 === 0 ? 29 : 28;
+        default:
+            return 0;
+    }
+}
+/**
+ * Days since 1970-01-01 for a proleptic Gregorian date -- Howard Hinnant's
+ * `days_from_civil`, the same algorithm instant.rs uses, so the two cannot
+ * disagree on exactly the dates the /100 and /400 rules cover.
+ *
+ * `Math.trunc` where Rust integer division truncates: `/` alone would carry
+ * fractions into every later term.
+ */
+function daysFromCivil(yIn, m, d) {
+    const y = m <= 2 ? yIn - 1 : yIn;
+    const era = Math.trunc((y >= 0 ? y : y - 399) / 400);
+    const yoe = y - era * 400;
+    const mp = (m + 9) % 12;
+    const doy = Math.trunc((153 * mp + 2) / 5) + d - 1;
+    const doe = yoe * 365 + Math.trunc(yoe / 4) - Math.trunc(yoe / 100) + doy;
+    return era * 146_097 + doe - 719_468;
+}
+//# sourceMappingURL=instant.js.map

package/dist/instant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instant.js","sourceRoot":"","sources":["../src/instant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,IACE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI;QAChC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI;QAChC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI;QACjC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI;QACjC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI;QACjC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI;MAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAU,EAAiB,EAAE;QACpD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI;gBAAE,OAAO,IAAI,CAAC;YACtC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrB,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,CAAC;QACP,KAAK,EAAE,CAAC;QACR,KAAK,EAAE;YACL,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,CAAC;QACP,KAAK,EAAE;YACL,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC;YACJ,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,CAAS,EAAE,CAAS;IACtD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;IAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1E,OAAO,GAAG,GAAG,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;AACvC,CAAC"}

package/dist/refusal.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A named refusal, mirroring the engine's `acp_decision::Refusal` and the
+ * reference's `FailClosed(clause, msg)`.
+ *
+ * Thrown, not returned: the Python SDK's `verify()` raises `RefusedError(name)`
+ * and this package's `verifyReceipt` is its TS sibling -- a caller that wants a
+ * verdict catches and reads `clause`. The CLAUSE is the machine-readable half
+ * (the value the cross-implementation comparison is on); `message` is for the
+ * operator and is never part of the contract.
+ */
+export declare class Refusal extends Error {
+    /** The clause id, spelled exactly as the engine's Rust constants spell it. */
+    readonly clause: string;
+    constructor(clause: string, message: string);
+}
+//# sourceMappingURL=refusal.d.ts.map

package/dist/refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,OAAQ,SAAQ,KAAK;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK5C"}

package/dist/refusal.js

@@ -0,0 +1,20 @@
+/**
+ * A named refusal, mirroring the engine's `acp_decision::Refusal` and the
+ * reference's `FailClosed(clause, msg)`.
+ *
+ * Thrown, not returned: the Python SDK's `verify()` raises `RefusedError(name)`
+ * and this package's `verifyReceipt` is its TS sibling -- a caller that wants a
+ * verdict catches and reads `clause`. The CLAUSE is the machine-readable half
+ * (the value the cross-implementation comparison is on); `message` is for the
+ * operator and is never part of the contract.
+ */
+export class Refusal extends Error {
+    /** The clause id, spelled exactly as the engine's Rust constants spell it. */
+    clause;
+    constructor(clause, message) {
+        super(`${clause}: ${message}`);
+        this.name = 'Refusal';
+        this.clause = clause;
+    }
+}
+//# sourceMappingURL=refusal.js.map

package/dist/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,OAAQ,SAAQ,KAAK;IAChC,8EAA8E;IACrE,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/suite.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The signature suite table (CR-1, CR-4) and the conjunctive combiner (CR-3),
+ * mirroring `crates/acp-crypto/src/suite.rs` and `lib.rs::verify_hybrid` at
+ * the pin. Third writing of one table; the mirrored vectors and the shared
+ * clause names are what keep the three honest.
+ *
+ * `pq-slh` (SLH-DSA, FIPS 205) is DECLARED AND NOT IMPLEMENTED, with its own
+ * primitive name. Aliasing it to `pq` would mean a receipt claiming suite
+ * `slhdsa128s` was verified against an ML-DSA key -- the label naming one
+ * algorithm and the bytes another. It fails closed as `unsupported`.
+ */
+/** One cryptographic primitive within a suite, by its wire name (CR-2 keys). */
+export type Primitive = 'classical' | 'pq' | 'pq-slh';
+/** A named signature suite, by its wire name. */
+export type Suite = 'ed25519' | 'hybrid-ed25519-mldsa65' | 'slhdsa128s';
+/**
+ * Parse a wire suite name. Unknown names are null and MUST be refused by the
+ * caller, never defaulted to a known suite (CR-1).
+ */
+export declare function parseSuite(name: string): Suite | null;
+/** The primitives a parsed suite requires, in the table's order. */
+export declare function suitePrimitives(suite: Suite): readonly Primitive[];
+/**
+ * CR-4: whether `suite` satisfies a signed floor.
+ *
+ * CONTAINMENT, NOT RANK -- the engine's published correction. Under a rank
+ * table `hybrid-ed25519-mldsa65` outranked `slhdsa128s` while containing none
+ * of its primitives: a deployment whose floor said "hash-based post-quantum,
+ * no lattice assumption" was served a lattice signature and told its floor was
+ * met. The floor is satisfied iff every primitive it names is present.
+ */
+export declare function satisfiesFloor(suite: Suite, floor: Suite): boolean;
+/** Outcome of verifying one primitive within a declared suite. */
+export type PrimitiveVerdict = 'valid' | 'invalid' | 'unsupported';
+/** Why the conjunctive combiner refused; the Rust `HybridError` variants. */
+export type HybridError = 'PrimitiveInvalid' | 'PrimitiveUnsupported' | 'SuiteMismatch';
+/**
+ * CR-3 -- verification is conjunctive over the DECLARED suite: the primitives
+ * presented must be exactly those the suite requires, and every one must
+ * verify. An `any`-shaped check lets an attacker strip the post-quantum leg,
+ * present a genuine classical one, and be accepted -- the downgrade the hybrid
+ * suite exists to prevent.
+ *
+ * The suite is a PARAMETER, exactly as in Rust: a caller that decides how many
+ * primitives a hybrid signature needs can be persuaded to decide "one".
+ * Completeness compares as multisets, so a primitive presented twice cannot
+ * stand in for one not presented at all. `unsupported` is reported before
+ * `invalid` -- the first is a statement about this BUILD, the second about the
+ * signature, and reporting one as the other sends the investigation to the
+ * wrong place.
+ *
+ * Returns null on success, the error name on refusal (the caller wraps it in
+ * a 9.3-1 Refusal; this layer is protocol logic, not the checklist).
+ */
+export declare function verifyHybrid(suite: Suite, verdicts: readonly (readonly [Primitive, PrimitiveVerdict])[]): HybridError | null;
+//# sourceMappingURL=suite.d.ts.map

package/dist/suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suite.d.ts","sourceRoot":"","sources":["../src/suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,IAAI,GAAG,QAAQ,CAAC;AAEtD,iDAAiD;AACjD,MAAM,MAAM,KAAK,GAAG,SAAS,GAAG,wBAAwB,GAAG,YAAY,CAAC;AAaxE;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAWrD;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAElE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAElE;AAED,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;AAEnE,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,eAAe,CAAC;AAExF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAC5D,WAAW,GAAG,IAAI,CAYpB"}

package/dist/suite.js

@@ -0,0 +1,85 @@
+/**
+ * The signature suite table (CR-1, CR-4) and the conjunctive combiner (CR-3),
+ * mirroring `crates/acp-crypto/src/suite.rs` and `lib.rs::verify_hybrid` at
+ * the pin. Third writing of one table; the mirrored vectors and the shared
+ * clause names are what keep the three honest.
+ *
+ * `pq-slh` (SLH-DSA, FIPS 205) is DECLARED AND NOT IMPLEMENTED, with its own
+ * primitive name. Aliasing it to `pq` would mean a receipt claiming suite
+ * `slhdsa128s` was verified against an ML-DSA key -- the label naming one
+ * algorithm and the bytes another. It fails closed as `unsupported`.
+ */
+/**
+ * Every primitive a suite requires. Verification is conjunctive over ALL of
+ * them (CR-3). Mirrors the Rust `Suite::primitives` and the reference's
+ * `SUITES` table.
+ */
+const SUITES = {
+    ed25519: ['classical'],
+    'hybrid-ed25519-mldsa65': ['classical', 'pq'],
+    slhdsa128s: ['pq-slh'],
+};
+/**
+ * Parse a wire suite name. Unknown names are null and MUST be refused by the
+ * caller, never defaulted to a known suite (CR-1).
+ */
+export function parseSuite(name) {
+    // A switch, so the narrowing is the compiler's and not a cast's (the
+    // project rules forbid `as`, and here the cast would be load-bearing).
+    switch (name) {
+        case 'ed25519':
+        case 'hybrid-ed25519-mldsa65':
+        case 'slhdsa128s':
+            return name;
+        default:
+            return null;
+    }
+}
+/** The primitives a parsed suite requires, in the table's order. */
+export function suitePrimitives(suite) {
+    return SUITES[suite];
+}
+/**
+ * CR-4: whether `suite` satisfies a signed floor.
+ *
+ * CONTAINMENT, NOT RANK -- the engine's published correction. Under a rank
+ * table `hybrid-ed25519-mldsa65` outranked `slhdsa128s` while containing none
+ * of its primitives: a deployment whose floor said "hash-based post-quantum,
+ * no lattice assumption" was served a lattice signature and told its floor was
+ * met. The floor is satisfied iff every primitive it names is present.
+ */
+export function satisfiesFloor(suite, floor) {
+    return SUITES[floor].every((needed) => SUITES[suite].includes(needed));
+}
+/**
+ * CR-3 -- verification is conjunctive over the DECLARED suite: the primitives
+ * presented must be exactly those the suite requires, and every one must
+ * verify. An `any`-shaped check lets an attacker strip the post-quantum leg,
+ * present a genuine classical one, and be accepted -- the downgrade the hybrid
+ * suite exists to prevent.
+ *
+ * The suite is a PARAMETER, exactly as in Rust: a caller that decides how many
+ * primitives a hybrid signature needs can be persuaded to decide "one".
+ * Completeness compares as multisets, so a primitive presented twice cannot
+ * stand in for one not presented at all. `unsupported` is reported before
+ * `invalid` -- the first is a statement about this BUILD, the second about the
+ * signature, and reporting one as the other sends the investigation to the
+ * wrong place.
+ *
+ * Returns null on success, the error name on refusal (the caller wraps it in
+ * a 9.3-1 Refusal; this layer is protocol logic, not the checklist).
+ */
+export function verifyHybrid(suite, verdicts) {
+    const presented = verdicts.map(([p]) => p).sort();
+    const required = [...SUITES[suite]].sort();
+    if (presented.length !== required.length ||
+        !presented.every((p, i) => p === required[i])) {
+        return 'SuiteMismatch';
+    }
+    if (verdicts.some(([, v]) => v === 'unsupported'))
+        return 'PrimitiveUnsupported';
+    if (verdicts.some(([, v]) => v === 'invalid'))
+        return 'PrimitiveInvalid';
+    return null;
+}
+//# sourceMappingURL=suite.js.map

package/dist/suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suite.js","sourceRoot":"","sources":["../src/suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;;;GAIG;AACH,MAAM,MAAM,GAAkD;IAC5D,OAAO,EAAE,CAAC,WAAW,CAAC;IACtB,wBAAwB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;IAC7C,UAAU,EAAE,CAAC,QAAQ,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,qEAAqE;IACrE,uEAAuE;IACvE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,wBAAwB,CAAC;QAC9B,KAAK,YAAY;YACf,OAAO,IAAI,CAAC;QACd;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY,EAAE,KAAY;IACvD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC;AAQD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAY,EACZ,QAA6D;IAE7D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IACE,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACpC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC7C,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACjF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/testkeys.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TEST KEY MATERIAL ONLY -- the reference's `HybridKey` seed derivation
+ * (`acp_crypto.py`), mirrored so fixtures signed here are signed under
+ * identities the ENGINE derives from the same seeds: ed secret =
+ * sha256(seed || "ed"), ML-DSA seed = sha256(seed || "mldsa"), both legs from
+ * one seed (an unseeded ML-DSA keygen gave each process a different key for
+ * one identity once -- the engine's own recorded defect).
+ *
+ * A seed derived from a string anyone can read is a key anyone can hold. This
+ * module is imported by tests only and is deliberately NOT exported from
+ * index.ts; a deployment loads keys from a KMS, never from here.
+ */
+export interface TestHybridKey {
+    readonly edSecret: Uint8Array;
+    readonly classical: Uint8Array;
+    readonly pq: Uint8Array;
+    readonly pqSecret: Uint8Array;
+}
+export declare function hybridKeyFromSeed(seedText: string): TestHybridKey;
+//# sourceMappingURL=testkeys.d.ts.map

package/dist/testkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testkeys.d.ts","sourceRoot":"","sources":["../src/testkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAejE"}

package/dist/testkeys.js

@@ -0,0 +1,28 @@
+/**
+ * TEST KEY MATERIAL ONLY -- the reference's `HybridKey` seed derivation
+ * (`acp_crypto.py`), mirrored so fixtures signed here are signed under
+ * identities the ENGINE derives from the same seeds: ed secret =
+ * sha256(seed || "ed"), ML-DSA seed = sha256(seed || "mldsa"), both legs from
+ * one seed (an unseeded ML-DSA keygen gave each process a different key for
+ * one identity once -- the engine's own recorded defect).
+ *
+ * A seed derived from a string anyone can read is a key anyone can hold. This
+ * module is imported by tests only and is deliberately NOT exported from
+ * index.ts; a deployment loads keys from a KMS, never from here.
+ */
+import { createHash } from 'node:crypto';
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+export function hybridKeyFromSeed(seedText) {
+    const seed = new TextEncoder().encode(seedText);
+    const edSecret = new Uint8Array(createHash('sha256').update(seed).update(new TextEncoder().encode('ed')).digest());
+    const mlSeed = new Uint8Array(createHash('sha256').update(seed).update(new TextEncoder().encode('mldsa')).digest());
+    const kp = ml_dsa65.keygen(mlSeed);
+    return {
+        edSecret,
+        classical: Uint8Array.from(ed25519.getPublicKey(edSecret)),
+        pq: Uint8Array.from(kp.publicKey),
+        pqSecret: Uint8Array.from(kp.secretKey),
+    };
+}
+//# sourceMappingURL=testkeys.js.map

package/dist/testkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testkeys.js","sourceRoot":"","sources":["../src/testkeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AASzD,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAClF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CACrF,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1D,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC;QACjC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC;KACxC,CAAC;AACJ,CAAC"}