algosdk 3.6.0 → 3.7.0-beta.1

package/dist/cjs/ed25519-signer.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addressWithSignersFromRawEd25519Signer = void 0;
+const address_js_1 = require("./encoding/address.js");
+const encoding_js_1 = require("./encoding/encoding.js");
+const logicsig_js_1 = require("./logicsig.js");
+const multisig_js_1 = require("./multisig.js");
+const signedTransaction_js_1 = require("./signedTransaction.js");
+const signing_js_1 = require("./signing.js");
+const utils_js_1 = require("./utils/utils.js");
+function addressWithSignersFromRawEd25519Signer(ed25519SigningKey, sendingAddress = new address_js_1.Address(ed25519SigningKey.ed25519PublicKey)) {
+    const authAddress = new address_js_1.Address(ed25519SigningKey.ed25519PublicKey);
+    const { ed25519Signer: rawSigner } = ed25519SigningKey;
+    const txnSigner = async (txnGroup, indexesToSign) => {
+        const stxns = [];
+        for (const index of indexesToSign) {
+            const txn = txnGroup[index];
+            // eslint-disable-next-line no-await-in-loop
+            const sig = await rawSigner(txn.bytesToSign());
+            const stxn = new signedTransaction_js_1.SignedTransaction({
+                txn,
+                sig,
+                sgnr: txn.sender.equals(authAddress) ? undefined : authAddress,
+            });
+            stxns.push(stxn);
+        }
+        return stxns.map((stxn) => (0, encoding_js_1.encodeMsgpack)(stxn));
+    };
+    const delegatedLsigSigner = async (lsig, msig) => {
+        if (msig) {
+            const pks = (0, multisig_js_1.pksFromAddresses)(msig.addrs);
+            const multisigAddr = (0, multisig_js_1.addressFromMultisigPreImg)({
+                version: msig.version,
+                threshold: msig.threshold,
+                pks,
+            });
+            const toBeSigned = (0, utils_js_1.concatArrays)(logicsig_js_1.MSIG_PROGRAM_TAG, multisigAddr.publicKey, lsig.logic);
+            const subsigs = pks.map((pk) => ({ pk }));
+            const ourSubsig = subsigs.find((subsig) => (0, utils_js_1.arrayEqual)(subsig.pk, authAddress.publicKey));
+            if (ourSubsig === undefined) {
+                throw Error(`DelegatedLsigSigner could not find ${authAddress} as a signer in the multisig`);
+            }
+            const sig = await rawSigner(toBeSigned);
+            ourSubsig.s = sig;
+            return {
+                address: authAddress,
+                lmsig: {
+                    v: msig.version,
+                    thr: msig.threshold,
+                    subsig: subsigs,
+                },
+            };
+        }
+        const toBeSigned = (0, utils_js_1.concatArrays)(logicsig_js_1.PROGRAM_TAG, lsig.logic);
+        const sig = await rawSigner(toBeSigned);
+        return { address: authAddress, sig };
+    };
+    const mxBytesSigner = async (bytes) => {
+        const bytesToSign = (0, utils_js_1.concatArrays)(signing_js_1.SIGN_BYTES_PREFIX, bytes);
+        return rawSigner(bytesToSign);
+    };
+    const programDataSigner = async (data, lsig) => {
+        const parts = (0, utils_js_1.concatArrays)(lsig.address().publicKey, data);
+        const toBeSigned = (0, utils_js_1.concatArrays)(logicsig_js_1.SIGN_PROGRAM_DATA_PREFIX, parts);
+        return rawSigner(toBeSigned);
+    };
+    return {
+        address: sendingAddress,
+        programDataSigner,
+        txnSigner,
+        delegatedLsigSigner,
+        mxBytesSigner,
+    };
+}
+exports.addressWithSignersFromRawEd25519Signer = addressWithSignersFromRawEd25519Signer;
+//# sourceMappingURL=ed25519-signer.js.map

package/dist/cjs/ed25519-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-signer.js","sourceRoot":"","sources":["../../src/ed25519-signer.ts"],"names":[],"mappings":";;;AAAA,sDAAgD;AAChD,wDAAuD;AACvD,+CAIuB;AACvB,+CAA4E;AAC5E,iEAA2D;AAW3D,6CAAiD;AAMjD,+CAA4D;AAO5D,SAAgB,sCAAsC,CACpD,iBAAoC,EACpC,iBAA0B,IAAI,oBAAO,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;IAKzE,MAAM,WAAW,GAAG,IAAI,oBAAO,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACpE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC;IAEvD,MAAM,SAAS,GAAsB,KAAK,EACxC,QAAuB,EACvB,aAAuB,EACvB,EAAE;QACF,MAAM,KAAK,GAAwB,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5B,4CAA4C;YAC5C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,IAAI,wCAAiB,CAAC;gBACjC,GAAG;gBACH,GAAG;gBACH,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;aAC/D,CAAC,CAAC;YAEH,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,2BAAa,EAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAwB,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEzC,MAAM,YAAY,GAAG,IAAA,uCAAyB,EAAC;gBAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG;aACJ,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAA,uBAAY,EAC7B,8BAAgB,EAChB,YAAY,CAAC,SAAS,EACtB,IAAI,CAAC,KAAK,CACX,CAAC;YAEF,MAAM,OAAO,GAAoB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,IAAA,qBAAU,EAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,SAAS,CAAC,CAC7C,CAAC;YACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,CACT,sCAAsC,WAAW,8BAA8B,CAChF,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YACxC,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE;oBACL,CAAC,EAAE,IAAI,CAAC,OAAO;oBACf,GAAG,EAAE,IAAI,CAAC,SAAS;oBACnB,MAAM,EAAE,OAAO;iBACU;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,uBAAY,EAAC,yBAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,aAAa,GAAkB,KAAK,EAAE,KAAiB,EAAE,EAAE;QAC/D,MAAM,WAAW,GAAG,IAAA,uBAAY,EAAC,8BAAiB,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAsB,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,IAAA,uBAAY,EAAC,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAA,uBAAY,EAAC,sCAAwB,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,iBAAiB;QACjB,SAAS;QACT,mBAAmB;QACnB,aAAa;KACd,CAAC;AACJ,CAAC;AA5FD,wFA4FC"}

package/dist/cjs/encoding/address.js

@@ -26,18 +26,33 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getApplicationAddress = exports.encodeAddress = exports.isValidAddress = exports.decodeAddress = exports.Address = exports.CHECKSUM_ADDRESS_ERROR_MSG = exports.MALFORMED_ADDRESS_ERROR_MSG = exports.ALGORAND_ZERO_ADDRESS_STRING = exports.ALGORAND_ADDRESS_LENGTH = exports.ALGORAND_CHECKSUM_BYTE_LENGTH = exports.ALGORAND_ADDRESS_BYTE_LENGTH = void 0;
+exports.addressFromPQSig = exports.addressFromPQKey = exports.getApplicationAddress = exports.encodeAddress = exports.isValidAddress = exports.decodeAddress = exports.Address = exports.PQ_SALT_MAX = exports.PQ_SCHEME_SIZE = exports.CHECKSUM_ADDRESS_ERROR_MSG = exports.MALFORMED_ADDRESS_ERROR_MSG = exports.ALGORAND_ZERO_ADDRESS_STRING = exports.ALGORAND_ADDRESS_LENGTH = exports.ALGORAND_CHECKSUM_BYTE_LENGTH = exports.ALGORAND_ADDRESS_BYTE_LENGTH = void 0;
 const hi_base32_1 = __importDefault(require("hi-base32"));
 const nacl = __importStar(require("../nacl/naclWrappers.js"));
 const utils = __importStar(require("../utils/utils.js"));
 const uint64_js_1 = require("./uint64.js");
 const binarydata_js_1 = require("./binarydata.js");
+const ed25519_check_js_1 = require("../utils/ed25519-check.js");
 exports.ALGORAND_ADDRESS_BYTE_LENGTH = 36;
 exports.ALGORAND_CHECKSUM_BYTE_LENGTH = 4;
 exports.ALGORAND_ADDRESS_LENGTH = 58;
 exports.ALGORAND_ZERO_ADDRESS_STRING = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY5HFKQ';
 exports.MALFORMED_ADDRESS_ERROR_MSG = 'address seems to be malformed';
 exports.CHECKSUM_ADDRESS_ERROR_MSG = 'wrong checksum for address';
+/**
+ * The domain-separation prefix prepended to a post-quantum address preimage
+ * before hashing. Matches go-algorand's protocol.PostQuantumAddress HashID.
+ */
+const PQ_ADDRESS_PREFIX = new TextEncoder().encode('PQA');
+/**
+ * The required byte length of a post-quantum signature scheme identifier.
+ */
+exports.PQ_SCHEME_SIZE = 2;
+/**
+ * The largest value a post-quantum address salt may take. The salt occupies a
+ * single byte of the address preimage.
+ */
+exports.PQ_SALT_MAX = 0xff;
 function checksumFromPublicKey(pk) {
     return Uint8Array.from(nacl
         .genericHash(pk)
@@ -158,4 +173,49 @@ function getApplicationAddress(appID) {
     return new Address(Uint8Array.from(hash));
 }
 exports.getApplicationAddress = getApplicationAddress;
+/**
+ * Derive a post-quantum (PQ) account address together with the canonical salt
+ * used to derive it.
+ *
+ * @param schemeBytes - The 2-byte ASCII PQ scheme identifier (e.g. "f1" for Falcon-1024).
+ * @param key - The scheme's canonical public key.
+ * @returns The derived Address and the canonical 1-byte salt.
+ */
+function addressFromPQKey(schemeBytes, key) {
+    if (schemeBytes.length !== exports.PQ_SCHEME_SIZE)
+        throw new Error(`invalid PQ scheme length: expected ${exports.PQ_SCHEME_SIZE} bytes, got ${schemeBytes.length}`);
+    // Rejection-sample the lowest salt that yields a PQ-compliant (non-Ed25519)
+    // address. The probability of exhausting the range is ~2^-256.
+    for (let salt = 0; salt <= exports.PQ_SALT_MAX; salt++) {
+        const toBeHashed = utils.concatArrays(PQ_ADDRESS_PREFIX, schemeBytes, Uint8Array.of(salt), key);
+        const publicKey = Uint8Array.from(nacl.genericHash(toBeHashed));
+        if (!(0, ed25519_check_js_1.couldBeCurvePoint)(publicKey)) {
+            return { address: new Address(publicKey), salt };
+        }
+    }
+    throw new Error('no canonical salt exists for this PQ public key and scheme');
+}
+exports.addressFromPQKey = addressFromPQKey;
+/**
+ * Derive the account address that a post-quantum signature authorizes.
+ *
+ * Unlike an Ed25519 signature, a PQ signature carries the scheme, salt and
+ * public key of the signing account, so the address it authorizes is fully
+ * determined by the signature and does not have to be supplied out of band.
+ *
+ * This also validates the signature's self-consistency: the salt must be the
+ * canonical one for the given scheme and public key, which is what the network
+ * requires.
+ *
+ * @param pqsig - The post-quantum signature to derive the address from.
+ * @returns The address of the account the signature authorizes.
+ */
+function addressFromPQSig(pqsig) {
+    const { address, salt } = addressFromPQKey(pqsig.sch, pqsig.pk);
+    if (salt !== pqsig.slt) {
+        throw new Error(`invalid PQ signature salt: expected the canonical salt ${salt}, got ${pqsig.slt}`);
+    }
+    return address;
+}
+exports.addressFromPQSig = addressFromPQSig;
 //# sourceMappingURL=address.js.map

package/dist/cjs/encoding/address.js.map

@@ -1 +1 @@
-{"version":3,"file":"address.js","sourceRoot":"","sources":["../../../src/encoding/address.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0DAA+B;AAC/B,8DAAgD;AAChD,yDAA2C;AAC3C,2CAA2C;AAC3C,mDAA6C;AAEhC,QAAA,4BAA4B,GAAG,EAAE,CAAC;AAClC,QAAA,6BAA6B,GAAG,CAAC,CAAC;AAClC,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAC7B,QAAA,4BAA4B,GACvC,4DAA4D,CAAC;AAElD,QAAA,2BAA2B,GAAG,+BAA+B,CAAC;AAC9D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE,SAAS,qBAAqB,CAAC,EAAc;IAC3C,OAAO,UAAU,CAAC,IAAI,CACpB,IAAI;SACD,WAAW,CAAC,EAAE,CAAC;SACf,KAAK,CACJ,IAAI,CAAC,iBAAiB,GAAG,qCAA6B,EACtD,IAAI,CAAC,iBAAiB,CACvB,CACJ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAa,OAAO;IAMlB;;;OAGG;IACH,YAAY,SAAqB;QAC/B,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,KAAK,SAAS,4BAA4B,OAAO,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,IACE,SAAS,CAAC,MAAM;YAChB,oCAA4B,GAAG,qCAA6B;YAE5D,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,OAAO,IAAA,0BAAU,EAAC,SAAS,CAAC,YAAY,SAAS,CAAC,MAAM,EAAE,CACzF,CAAC;QACJ,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAc;QACnB,OAAO,CACL,KAAK,YAAY,OAAO;YACxB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAClD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,IAAI,GAAG,mBAAM,CAAC,MAAM,CACxB,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CACpD,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,CAAC,4BAA4B;IAC7E,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,OAAe;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;YAC7B,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,0BAA0B,OAAO,OAAO,KAAK,OAAO,EAAE,CACrF,CAAC;QACJ,IAAI,OAAO,CAAC,MAAM,KAAK,+BAAuB;YAC5C,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,qBAAqB,+BAAuB,SAAS,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAChH,CAAC;QAEJ,gBAAgB;QAChB,MAAM,OAAO,GAAG,mBAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,eAAe;QACf,IAAI,OAAO,CAAC,MAAM,KAAK,oCAA4B;YACjD,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,0BAA0B,oCAA4B,SAAS,OAAO,CAAC,MAAM,EAAE,CAC9G,CAAC;QAEJ,8BAA8B;QAC9B,MAAM,EAAE,GAAG,IAAI,UAAU,CACvB,OAAO,CAAC,KAAK,CACX,CAAC,EACD,oCAA4B,GAAG,qCAA6B,CAC7D,CACF,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,UAAU,CACvB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,oCAA4B,CAAC,CACpE,CAAC;QACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC3C,kDAAkD;QAClD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kCAA0B,CAAC,CAAC;QAE9C,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,OAAO,CAChB,IAAI,UAAU,CACZ,oCAA4B,GAAG,qCAA6B,CAC7D,CACF,CAAC;IACJ,CAAC;CACF;AAxGD,0BAwGC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAFD,sCAEC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,gBAAgB;IAChB,IAAI,CAAC;QACH,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AARD,wCAQC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAmB;IAC/C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACzC,CAAC;AAFD,sCAEC;AAED,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAExD;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,KAAsB;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,IAAA,wBAAY,EAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAJD,sDAIC"}
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../../../src/encoding/address.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0DAA+B;AAC/B,8DAAgD;AAChD,yDAA2C;AAC3C,2CAA2C;AAC3C,mDAA6C;AAC7C,gEAA8D;AAKjD,QAAA,4BAA4B,GAAG,EAAE,CAAC;AAClC,QAAA,6BAA6B,GAAG,CAAC,CAAC;AAClC,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAC7B,QAAA,4BAA4B,GACvC,4DAA4D,CAAC;AAElD,QAAA,2BAA2B,GAAG,+BAA+B,CAAC;AAC9D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE1D;;GAEG;AACU,QAAA,cAAc,GAAG,CAAC,CAAC;AAEhC;;;GAGG;AACU,QAAA,WAAW,GAAG,IAAI,CAAC;AAEhC,SAAS,qBAAqB,CAAC,EAAc;IAC3C,OAAO,UAAU,CAAC,IAAI,CACpB,IAAI;SACD,WAAW,CAAC,EAAE,CAAC;SACf,KAAK,CACJ,IAAI,CAAC,iBAAiB,GAAG,qCAA6B,EACtD,IAAI,CAAC,iBAAiB,CACvB,CACJ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAa,OAAO;IAMlB;;;OAGG;IACH,YAAY,SAAqB;QAC/B,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,KAAK,SAAS,4BAA4B,OAAO,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,IACE,SAAS,CAAC,MAAM;YAChB,oCAA4B,GAAG,qCAA6B;YAE5D,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,OAAO,IAAA,0BAAU,EAAC,SAAS,CAAC,YAAY,SAAS,CAAC,MAAM,EAAE,CACzF,CAAC;QACJ,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAc;QACnB,OAAO,CACL,KAAK,YAAY,OAAO;YACxB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAClD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,IAAI,GAAG,mBAAM,CAAC,MAAM,CACxB,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CACpD,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,CAAC,4BAA4B;IAC7E,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,OAAe;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;YAC7B,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,0BAA0B,OAAO,OAAO,KAAK,OAAO,EAAE,CACrF,CAAC;QACJ,IAAI,OAAO,CAAC,MAAM,KAAK,+BAAuB;YAC5C,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,qBAAqB,+BAAuB,SAAS,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAChH,CAAC;QAEJ,gBAAgB;QAChB,MAAM,OAAO,GAAG,mBAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,eAAe;QACf,IAAI,OAAO,CAAC,MAAM,KAAK,oCAA4B;YACjD,MAAM,IAAI,KAAK,CACb,GAAG,mCAA2B,0BAA0B,oCAA4B,SAAS,OAAO,CAAC,MAAM,EAAE,CAC9G,CAAC;QAEJ,8BAA8B;QAC9B,MAAM,EAAE,GAAG,IAAI,UAAU,CACvB,OAAO,CAAC,KAAK,CACX,CAAC,EACD,oCAA4B,GAAG,qCAA6B,CAC7D,CACF,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,UAAU,CACvB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,oCAA4B,CAAC,CACpE,CAAC;QACF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC3C,kDAAkD;QAClD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kCAA0B,CAAC,CAAC;QAE9C,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,OAAO,CAChB,IAAI,UAAU,CACZ,oCAA4B,GAAG,qCAA6B,CAC7D,CACF,CAAC;IACJ,CAAC;CACF;AAxGD,0BAwGC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAFD,sCAEC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,gBAAgB;IAChB,IAAI,CAAC;QACH,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AARD,wCAQC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAmB;IAC/C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACzC,CAAC;AAFD,sCAEC;AAED,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAExD;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,KAAsB;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,IAAA,wBAAY,EAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAJD,sDAIC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAC9B,WAAuB,EACvB,GAAe;IAEf,IAAI,WAAW,CAAC,MAAM,KAAK,sBAAc;QACvC,MAAM,IAAI,KAAK,CACb,sCAAsC,sBAAc,eAAe,WAAW,CAAC,MAAM,EAAE,CACxF,CAAC;IAEJ,4EAA4E;IAC5E,+DAA+D;IAC/D,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,mBAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CACnC,iBAAiB,EACjB,WAAW,EACX,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EACnB,GAAG,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,IAAA,oCAAiB,EAAC,SAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC;AAzBD,4CAyBC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB,CAAC,KAAmB;IAClD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0DAA0D,IAAI,SAAS,KAAK,CAAC,GAAG,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AARD,4CAQC"}

package/dist/cjs/falcon-signer.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addressWithSignersFromRawFalcon1024Signer = exports.FALCON_1024_SCHEME = void 0;
+const pq_signer_js_1 = require("./pq-signer.js");
+/**
+ * The 2-byte ASCII identifier of the Falcon-1024 post-quantum signature scheme.
+ */
+exports.FALCON_1024_SCHEME = new TextEncoder().encode('f1');
+function addressWithSignersFromRawFalcon1024Signer(falconSigningKey, sendingAddress) {
+    return (0, pq_signer_js_1.addressWithSignersFromRawPQSigner)({
+        pqScheme: exports.FALCON_1024_SCHEME,
+        pqPublicKey: falconSigningKey.falcon1024PublicKey,
+        pqSigner: falconSigningKey.falcon1024Signer,
+    }, sendingAddress);
+}
+exports.addressWithSignersFromRawFalcon1024Signer = addressWithSignersFromRawFalcon1024Signer;
+//# sourceMappingURL=falcon-signer.js.map

package/dist/cjs/falcon-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"falcon-signer.js","sourceRoot":"","sources":["../../src/falcon-signer.ts"],"names":[],"mappings":";;;AAKA,iDAAmE;AAEnE;;GAEG;AACU,QAAA,kBAAkB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAOjE,SAAgB,yCAAyC,CACvD,gBAAsC,EACtC,cAAwB;IAExB,OAAO,IAAA,gDAAiC,EACtC;QACE,QAAQ,EAAE,0BAAkB;QAC5B,WAAW,EAAE,gBAAgB,CAAC,mBAAmB;QACjD,QAAQ,EAAE,gBAAgB,CAAC,gBAAgB;KAC5C,EACD,cAAc,CACf,CAAC;AACJ,CAAC;AAZD,8FAYC"}

package/dist/cjs/logicsig.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.tealSignFromProgram = exports.verifyTealSign = exports.tealSign = exports.logicSigFromByte = exports.LogicSigAccount = exports.LogicSig = exports.sanityCheckProgram = void 0;
+exports.tealSignFromProgram = exports.verifyTealSign = exports.tealSign = exports.SIGN_PROGRAM_DATA_PREFIX = exports.logicSigFromByte = exports.LogicSigAccount = exports.LogicSig = exports.MSIG_PROGRAM_TAG = exports.PQ_PROGRAM_TAG = exports.PROGRAM_TAG = exports.sanityCheckProgram = void 0;
 const nacl = __importStar(require("./nacl/naclWrappers.js"));
 const address_js_1 = require("./encoding/address.js");
 const encoding = __importStar(require("./encoding/encoding.js"));
@@ -56,8 +56,9 @@ function sanityCheckProgram(program) {
     }
 }
 exports.sanityCheckProgram = sanityCheckProgram;
-const programTag = new TextEncoder().encode('Program');
-const multisigProgramTag = new TextEncoder().encode('MsigProgram');
+exports.PROGRAM_TAG = new TextEncoder().encode('Program');
+exports.PQ_PROGRAM_TAG = new TextEncoder().encode('PQProgram');
+exports.MSIG_PROGRAM_TAG = new TextEncoder().encode('MsigProgram');
 /**
  LogicSig implementation
 
@@ -79,6 +80,7 @@ class LogicSig {
         this.sig = undefined;
         this.msig = undefined;
         this.lmsig = undefined;
+        this.pqsig = undefined;
     }
     // eslint-disable-next-line class-methods-use-this
     getEncodingSchema() {
@@ -96,6 +98,9 @@ class LogicSig {
         if (this.lmsig) {
             data.set('lmsig', (0, encoded_js_1.encodedMultiSigToEncodingData)(this.lmsig));
         }
+        if (this.pqsig) {
+            data.set('pqsig', (0, encoded_js_1.encodedPQSigToEncodingData)(this.pqsig));
+        }
         return data;
     }
     static fromEncodingData(data) {
@@ -110,14 +115,20 @@ class LogicSig {
         if (data.get('lmsig')) {
             lsig.lmsig = (0, encoded_js_1.encodedMultiSigFromEncodingData)(data.get('lmsig'));
         }
+        if (data.get('pqsig')) {
+            lsig.pqsig = (0, encoded_js_1.encodedPQSigFromEncodingData)(data.get('pqsig'));
+        }
         return lsig;
     }
     /**
+     * @deprecated This function does not perform full verification and should not be fully trusted on its own.
+     * For example, it does not evaluate programs and does not have the ability to validate PQ signatures.
+     *
      * Performs signature verification
      * @param publicKey - Verification key (derived from sender address or escrow address)
      */
     verify(publicKey) {
-        const sigCount = [this.sig, this.msig, this.lmsig].filter(Boolean).length;
+        const sigCount = [this.sig, this.msig, this.lmsig, this.pqsig].filter(Boolean).length;
         if (sigCount > 1) {
             return false;
         }
@@ -127,11 +138,18 @@ class LogicSig {
         catch (e) {
             return false;
         }
-        const toBeSigned = utils.concatArrays(programTag, this.logic);
-        if (!this.sig && !this.msig && !this.lmsig) {
+        const toBeSigned = utils.concatArrays(exports.PROGRAM_TAG, this.logic);
+        if (!this.sig && !this.msig && !this.lmsig && !this.pqsig) {
             const hash = nacl.genericHash(toBeSigned);
             return utils.arrayEqual(hash, publicKey);
         }
+        if (this.pqsig) {
+            // This function has no way to validate a post-quantum signature, so it
+            // cannot report success here. Callers that need to sign a transaction
+            // with a PQ delegated LogicSig should go through
+            // signLogicSigTransactionObject, which skips this check.
+            return false;
+        }
         if (this.sig) {
             return nacl.verify(toBeSigned, this.sig, publicKey);
         }
@@ -141,7 +159,7 @@ class LogicSig {
                 threshold: this.lmsig.thr,
                 pks: this.lmsig.subsig.map((subsig) => subsig.pk),
             });
-            const lmsigProgram = utils.concatArrays(multisigProgramTag, multisigAddr.publicKey, this.logic);
+            const lmsigProgram = utils.concatArrays(exports.MSIG_PROGRAM_TAG, multisigAddr.publicKey, this.logic);
             return (0, multisig_js_1.verifyMultisig)(lmsigProgram, this.lmsig, publicKey);
         }
         if (this.msig) {
@@ -154,11 +172,13 @@ class LogicSig {
      * @returns String representation of the address
      */
     address() {
-        const toBeSigned = utils.concatArrays(programTag, this.logic);
+        const toBeSigned = utils.concatArrays(exports.PROGRAM_TAG, this.logic);
         const hash = nacl.genericHash(toBeSigned);
         return new address_js_1.Address(Uint8Array.from(hash));
     }
     /**
+     * @deprecated Use `signWithSigner` instead
+     *
      * Creates signature (if no msig provided) or multi signature otherwise
      * @param secretKey - Secret key to sign with
      * @param msig - Multisig account as \{version, threshold, addrs\}
@@ -179,6 +199,64 @@ class LogicSig {
         }
     }
     /**
+     * Signs this LogicSig for delegation using the given signer.
+     *
+     * @param signer - The signer to delegate to
+     * @param msig - Optional multisig account the signer is a subsigner of
+     * @returns The address the signer signed as. When `msig` is omitted this is
+     *   the delegating account. When `msig` is given it is the individual
+     *   subsigner, not the multisig, so the delegating account is
+     *   `multisigAddress(msig)`. Either way it is an authorizing address, which
+     *   is not necessarily the address a signer sends transactions from.
+     *
+     * Re-signing an already-signed LogicSig is allowed, and replaces the previous
+     * delegation signature. At most one of `sig`, `msig`, `lmsig` and `pqsig` may
+     * be set, so any signature left over from an earlier call is cleared.
+     */
+    async signWithSigner(signer, msig) {
+        const sigResult = await signer(this, msig);
+        if (msig == null) {
+            if ('pqsig' in sigResult && sigResult.pqsig) {
+                this.clearSignatures();
+                this.pqsig = sigResult.pqsig;
+                return sigResult.address;
+            }
+            if (!('sig' in sigResult) || !sigResult.sig) {
+                throw Error('Expected DelegatedLsigSigner to return sig or pqsig, but both are undefined. If signing for an msig, be sure to pass the msig argument');
+            }
+            this.clearSignatures();
+            this.sig = sigResult.sig;
+        }
+        else {
+            if (!('lmsig' in sigResult) || !sigResult.lmsig) {
+                throw Error('Expected DelegatedLsigSigner to return lmsig, but lmsig is undefined. If signing for a single account, do not pass msig argument');
+            }
+            const { lmsig } = sigResult;
+            const expectedPks = (0, multisig_js_1.pksFromAddresses)(msig.addrs);
+            if (lmsig.v !== msig.version ||
+                lmsig.thr !== msig.threshold ||
+                lmsig.subsig.length !== expectedPks.length ||
+                !lmsig.subsig.every((subsig, i) => utils.arrayEqual(subsig.pk, expectedPks[i]))) {
+                throw Error('DelegatedLsigSigner returned an lmsig whose version, threshold or public keys do not match the requested multisig');
+            }
+            this.clearSignatures();
+            this.lmsig = sigResult.lmsig;
+        }
+        return sigResult.address;
+    }
+    /**
+     * Removes every delegation signature from this LogicSig, so that exactly one
+     * of them can be set afterwards.
+     */
+    clearSignatures() {
+        this.sig = undefined;
+        this.msig = undefined;
+        this.lmsig = undefined;
+        this.pqsig = undefined;
+    }
+    /**
+     * @deprecated Use `appendToMultisigWithSigner` instead
+     *
      * Appends a signature to multi signature
      * @param secretKey - Secret key to sign with
      */
@@ -189,21 +267,66 @@ class LogicSig {
         const [sig, index] = this.singleSignMultisig(secretKey, this.lmsig);
         this.lmsig.subsig[index].s = sig;
     }
+    async appendToMultisigWithSigner(signer) {
+        if (this.lmsig === undefined) {
+            throw new Error('no multisig present');
+        }
+        const sigResult = await signer(this, {
+            version: this.lmsig.v,
+            threshold: this.lmsig.thr,
+            addrs: this.lmsig.subsig.map((s) => new address_js_1.Address(s.pk)),
+        });
+        if (!('lmsig' in sigResult) || !sigResult.lmsig) {
+            throw Error('Expected DelegatedLsigSigner to return lmsig, but lmsig is undefined');
+        }
+        if (sigResult.lmsig.v !== this.lmsig.v ||
+            sigResult.lmsig.thr !== this.lmsig.thr) {
+            throw Error('DelegatedLsigSigner returned an lmsig whose version or threshold does not match the current msig');
+        }
+        let signaturesReturned = false;
+        for (const subsig of sigResult.lmsig.subsig) {
+            if (subsig.s) {
+                signaturesReturned = true;
+                const thisSubsig = this.lmsig.subsig.find((s) => utils.arrayEqual(s.pk, subsig.pk));
+                if (thisSubsig === undefined) {
+                    throw Error(`DelegatedLsigSigner returned a signature for ${new address_js_1.Address(subsig.pk)} but this pk is not in the current msig`);
+                }
+                // Never let the signer silently replace a signature already collected
+                // from another member.
+                if (thisSubsig.s && !utils.arrayEqual(thisSubsig.s, subsig.s)) {
+                    throw Error(`DelegatedLsigSigner returned a signature for ${new address_js_1.Address(subsig.pk)} that conflicts with the signature already collected for it`);
+                }
+                thisSubsig.s = subsig.s;
+            }
+        }
+        if (!signaturesReturned) {
+            throw Error('DelegatedLsigSigner returned an lmsig with no signatures');
+        }
+    }
+    /**
+     * @deprecated Use `signWithSigner` followed by `.sig` instead
+     */
     signProgram(secretKey) {
-        const toBeSigned = utils.concatArrays(programTag, this.logic);
+        const toBeSigned = utils.concatArrays(exports.PROGRAM_TAG, this.logic);
         const sig = nacl.sign(toBeSigned, secretKey);
         return sig;
     }
+    /**
+     * @deprecated Use `signWithSigner` followed by `.sig` instead
+     */
     signProgramMultisig(secretKey, msig) {
         const multisigAddr = (0, multisig_js_1.addressFromMultisigPreImg)({
             version: msig.v,
             threshold: msig.thr,
             pks: msig.subsig.map((subsig) => subsig.pk),
         });
-        const toBeSigned = utils.concatArrays(multisigProgramTag, multisigAddr.publicKey, this.logic);
+        const toBeSigned = utils.concatArrays(exports.MSIG_PROGRAM_TAG, multisigAddr.publicKey, this.logic);
         const sig = nacl.sign(toBeSigned, secretKey);
         return sig;
     }
+    /**
+     * @deprecated Use `signWithSigner` followed by `.sig` instead
+     */
     singleSignMultisig(secretKey, msig) {
         let index = -1;
         const myPk = nacl.keyPairFromSecretKey(secretKey).publicKey;
@@ -226,6 +349,16 @@ class LogicSig {
     static fromByte(encoded) {
         return encoding.decodeMsgpack(encoded, LogicSig);
     }
+    /**
+     * Signs arbitrary data for use with the `ed25519verify` opcode from within
+     * this LogicSig's program.
+     *
+     * @param signer - The signer to sign the data with
+     * @param data - The data to sign
+     */
+    async signDataWithSigner(signer, data) {
+        return signer(data, this);
+    }
 }
 exports.LogicSig = LogicSig;
 LogicSig.encodingSchema = new index_js_1.NamedMapSchema((0, index_js_1.allOmitEmpty)([
@@ -249,6 +382,10 @@ LogicSig.encodingSchema = new index_js_1.NamedMapSchema((0, index_js_1.allOmitEm
         key: 'lmsig',
         valueSchema: new index_js_1.OptionalSchema(encoded_js_1.ENCODED_MULTISIG_SCHEMA),
     },
+    {
+        key: 'pqsig',
+        valueSchema: new index_js_1.OptionalSchema(encoded_js_1.ENCODED_PQSIG_SCHEMA),
+    },
 ]));
 /**
  * Represents an account that can sign with a LogicSig program.
@@ -309,9 +446,15 @@ class LogicSigAccount {
      * To verify the delegation signature, use `verify`.
      */
     isDelegated() {
-        return !!(this.lsig.sig || this.lsig.msig || this.lsig.lmsig);
+        return !!(this.lsig.sig ||
+            this.lsig.msig ||
+            this.lsig.lmsig ||
+            this.lsig.pqsig);
     }
     /**
+     * @deprecated This function does not perform full verification and should not be fully trusted on its own.
+     * For example, it does not evaluate programs and does not have the ability to validate PQ signatures.
+     *
      * Verifies this LogicSig's program and signatures.
      * @returns true if and only if the LogicSig program and signatures are valid.
      */
@@ -329,9 +472,24 @@ class LogicSigAccount {
      *  escrow address that is the hash of the LogicSig's program code.
      */
     address() {
-        const sigCount = [this.lsig.sig, this.lsig.msig, this.lsig.lmsig].filter(Boolean).length;
+        const sigCount = [
+            this.lsig.sig,
+            this.lsig.msig,
+            this.lsig.lmsig,
+            this.lsig.pqsig,
+        ].filter(Boolean).length;
         if (sigCount > 1) {
-            throw new Error('LogicSig has too many signatures. At most one of sig, msig, or lmsig may be present');
+            throw new Error('LogicSig has too many signatures. At most one of sig, msig, lmsig, or pqsig may be present');
+        }
+        if (this.lsig.pqsig) {
+            // A PQ signature carries the scheme, salt and public key of the
+            // delegating account, so derive the address rather than trusting
+            // `sigkey`. Also throws if the signature is not self-consistent.
+            const derived = (0, address_js_1.addressFromPQSig)(this.lsig.pqsig);
+            if (this.sigkey && !utils.arrayEqual(this.sigkey, derived.publicKey)) {
+                throw new Error(`Signing key for delegated account does not match the PQ signature. The signature authorizes ${derived}, but sigkey is ${new address_js_1.Address(this.sigkey)}`);
+            }
+            return derived;
         }
         if (this.lsig.sig) {
             if (!this.sigkey) {
@@ -351,6 +509,8 @@ class LogicSigAccount {
         return this.lsig.address();
     }
     /**
+     * @deprecated Use `signMultisigWithSigner` instead
+     *
      * Turns this LogicSigAccount into a delegated LogicSig. This type of LogicSig
      * has the authority to sign transactions on behalf of another account, called
      * the delegating account. Use this function if the delegating account is a
@@ -364,7 +524,12 @@ class LogicSigAccount {
     signMultisig(msig, secretKey) {
         this.lsig.sign(secretKey, msig);
     }
+    async signMultisigWithSigner(msig, signer) {
+        await this.lsig.signWithSigner(signer, msig);
+    }
     /**
+     * @deprecated Use appendToMultisigWithSigner
+     *
      * Adds an additional signature from a member of the delegating multisig
      * account.
      *
@@ -374,7 +539,12 @@ class LogicSigAccount {
     appendToMultisig(secretKey) {
         this.lsig.appendToMultisig(secretKey);
     }
+    async appendToMultisigWithSigner(signer) {
+        await this.lsig.appendToMultisigWithSigner(signer);
+    }
     /**
+     * @deprecated Use `signWithSigner` instead
+     *
      * Turns this LogicSigAccount into a delegated LogicSig. This type of LogicSig
      * has the authority to sign transactions on behalf of another account, called
      * the delegating account. If the delegating account is a multisig account,
@@ -386,6 +556,21 @@ class LogicSigAccount {
         this.lsig.sign(secretKey);
         this.sigkey = nacl.keyPairFromSecretKey(secretKey).publicKey;
     }
+    /**
+     * Turns this LogicSigAccount into a delegated LogicSig, signed by the given
+     * signer. If the delegating account is a multisig account, use
+     * `signMultisigWithSigner` instead.
+     *
+     * @param signer - The signer of the delegating account.
+     */
+    async signWithSigner(signer) {
+        // Record the address the signer reports rather than any sending address it
+        // may advertise: the latter is the address the signer sends transactions
+        // from, which for a rekeyed account is not the account that authorizes
+        // this delegation.
+        const delegatingAddress = await this.lsig.signWithSigner(signer);
+        this.sigkey = delegatingAddress.publicKey;
+    }
 }
 exports.LogicSigAccount = LogicSigAccount;
 LogicSigAccount.encodingSchema = new index_js_1.NamedMapSchema((0, index_js_1.allOmitEmpty)([
@@ -406,7 +591,7 @@ function logicSigFromByte(encoded) {
     return encoding.decodeMsgpack(encoded, LogicSig);
 }
 exports.logicSigFromByte = logicSigFromByte;
-const SIGN_PROGRAM_DATA_PREFIX = new TextEncoder().encode('ProgData');
+exports.SIGN_PROGRAM_DATA_PREFIX = new TextEncoder().encode('ProgData');
 /**
  * tealSign creates a signature compatible with ed25519verify opcode from program hash
  * @param sk - Uint8Array with secret key
@@ -418,7 +603,7 @@ function tealSign(sk, data, programHash) {
         ? address_js_1.Address.fromString(programHash)
         : programHash;
     const parts = utils.concatArrays(programAddr.publicKey, data);
-    const toBeSigned = utils.concatArrays(SIGN_PROGRAM_DATA_PREFIX, parts);
+    const toBeSigned = utils.concatArrays(exports.SIGN_PROGRAM_DATA_PREFIX, parts);
     return nacl.sign(toBeSigned, sk);
 }
 exports.tealSign = tealSign;
@@ -434,7 +619,7 @@ function verifyTealSign(data, programHash, sig, pk) {
         ? address_js_1.Address.fromString(programHash)
         : programHash;
     const parts = utils.concatArrays(programAddr.publicKey, data);
-    const toBeSigned = utils.concatArrays(SIGN_PROGRAM_DATA_PREFIX, parts);
+    const toBeSigned = utils.concatArrays(exports.SIGN_PROGRAM_DATA_PREFIX, parts);
     return nacl.verify(toBeSigned, sig, pk);
 }
 exports.verifyTealSign = verifyTealSign;