pazair-verify 1.8.0 → 1.9.0

package/README.md

@@ -4,8 +4,9 @@ Trust between AI agents, checkable by anyone. Verify PazAIr receipts, Word Passe
 (the [PazAIr Trust Protocol](../SPEC.md)) in a few lines, without trusting PazAIr.
 
 Zero dependencies. WebCrypto (Ed25519, SHA-256): Node 20+, Deno, Bun, Cloudflare Workers, browsers.
-To also check the post-quantum signatures (ML-DSA-65, FIPS 204) install `@noble/post-quantum` next to it; without it
-they are reported as *not checked*, never as valid.
+To also check the post-quantum signatures (ML-DSA-65, FIPS 204, on Remember's links and on twice-signed passes,
+receipts and holder proofs) install `@noble/post-quantum` next to it; without it they are reported as *not checked*,
+never as valid.
 
 ```sh
 npm install pazair-verify
@@ -95,7 +96,8 @@ console.log(await verifyReceipt(receipt, { delivery }));
 | `checkHead("<day>:<head>", origin, { fetch? })` | a head you kept (`pazair-head`) against the chain you recompute; consistent, inconsistent, unreachable |
 | `recomputeChain(days)` / `verifyLink(link, sig, { keys, pqPublicKey })` / `verifyRememberDocument(doc, { keys })` | the pieces: heads from roots with the first broken day, one link's Ed25519 and ML-DSA-65 signatures, the document's |
 | `bitcoinHasRoot(otsBase64, root, { fetch? })` | the .ots proof is for this root and ends in the Merkle root of the block it names (public block explorers) |
-| `verifyReceipt(receipt, { keys?, delivery? })` | Ed25519 signature; optionally that `delivery` is the one signed |
+| `verifyReceipt(receipt, { keys?, pqKeys?, delivery? })` | Ed25519 signature, the second signature when present (section 16), optionally that `delivery` is the one signed |
+| `verifyPqSignature(obj, pqKeys?)` | Section 16: `pq_sig` (ML-DSA-65) with the issuer's `pq_keys`; `{ signed, valid }`, valid null when it cannot be checked here |
 | `verifyReceiptChain(top, { receipts, keys?, maxDepth? })` | Section 3.1: every receipt `top` was built on is present, signed, bought by its seller for that order; returns `{ valid, links, depth, total_minor, broken }` |
 | `verifyMandate(receipt, mandate, { keys?, end? })` | Section 3.2: the receipt was bought within the principal's mandate (agent, currency, cap per order, before its end); returns `{ valid, covers, reasons }` |
 | `verifyAward(receipt, tender, award, { keys?, qa? })` | Section 3.3: the receipt was paid under this award for this tender (buyer, awarded seller, budget, price or milestone, deadline, questions published before the award); returns `{ valid, covers, reasons }` |
@@ -103,7 +105,7 @@ console.log(await verifyReceipt(receipt, { delivery }));
 | `fingerprintOf({ origin, agent, first_leaf })` | Section 15: the seed and the 64-byte codeword of an agent's fingerprint; two agents differ in at least 55 symbols |
 | `fingerprintDistance(a, b)` | How many of the 64 symbols differ: 0 the same agent, below 55 not a fingerprint |
 | `fingerprintSvg(codeword, record?)` | The reference drawing, the same bytes for the same input; `recordOf(pass)` reads the record it grows with |
-| `verifyPass(anchored, { keys? })` | signature, Merkle proof into the day's root; returns the anchors to check on Bitcoin and Stellar |
+| `verifyPass(anchored, { keys?, pqKeys? })` | signature, the second signature when present, Merkle proof into the day's root; returns the anchors to check on Bitcoin and Stellar |
 | `verifyProof(leaf, proof, root)` | a Merkle path |
 | `leafOf(pass)`, `canonical(obj)`, `sha256hex(s)` | the building blocks of the spec |
 | `fetchKeys(origin?)` | the issuer's keys from `/.well-known/pazair-receipts.json` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pazair-verify",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Verify Word Passes, receipts, Merkle proofs and Remember (the chain of daily roots, Ed25519 + ML-DSA-65): checked by anyone, for any issuer, without trusting it. Zero dependencies.",
   "type": "module",
   "main": "./src/index.js",
@@ -30,7 +30,9 @@
     "@noble/post-quantum": ">=0.7.0"
   },
   "peerDependenciesMeta": {
-    "@noble/post-quantum": { "optional": true }
+    "@noble/post-quantum": {
+      "optional": true
+    }
   },
   "keywords": [
     "word-pass",

package/src/index.d.ts

@@ -1,12 +1,14 @@
 export type Jwk = { kid: string; kty?: string; crv?: string; x: string; revoked_at?: string };
+/** Section 16: an ML-DSA-65 public key as the keys document lists it under pq_keys. */
+export type PqKey = { pq_kid: string; alg?: 'ML-DSA-65'; public_key_b64url: string; revoked_at?: string };
 export type Step = { side: 'L' | 'R'; hash: string };
 export function canonical(v: unknown): string;
 export function sha256hex(s: string): Promise<string>;
 export function fetchKeys(origin?: string, f?: typeof fetch): Promise<Jwk[]>;
 export function verifySignature(obj: { sig?: string; kid?: string } & Record<string, unknown>, keys: Jwk[], opts?: { anchoredBefore?: string }): Promise<boolean>;
-export function fetchKeysDocument(origin?: string, f?: typeof fetch): Promise<{ keys: Jwk[]; anchors?: { stellar?: { account: string; network: string } } }>;
-export function verifyHolderProof(proof: unknown, opts: { keys?: Jwk[]; agent: string; nonce: string; aud?: string; now?: number }): Promise<{ ok: boolean; reason: string }>;
-export function verifyReceipt(receipt: Record<string, unknown>, opts?: { keys?: Jwk[]; delivery?: unknown }): Promise<{ valid: boolean; signature_valid: boolean; delivery_matches: boolean | null }>;
+export function fetchKeysDocument(origin?: string, f?: typeof fetch): Promise<{ keys: Jwk[]; pq_keys?: PqKey[]; anchors?: { stellar?: { account: string; network: string } } }>;
+export function verifyHolderProof(proof: unknown, opts: { keys?: Jwk[]; pqKeys?: PqKey[]; agent: string; nonce: string; aud?: string; now?: number }): Promise<{ ok: boolean; reason: string }>;
+export function verifyReceipt(receipt: Record<string, unknown>, opts?: { keys?: Jwk[]; pqKeys?: PqKey[]; delivery?: unknown }): Promise<{ valid: boolean; signature_valid: boolean; pq_signed: boolean; ml_dsa_65: boolean | null; delivery_matches: boolean | null }>;
 export function wordOf(pass: Record<string, unknown>): { kept_pct: number | null; badge: 'word_kept_99' | 'word_kept_95' | null };
 export function verifyMandate(receipt: Record<string, unknown>, mandate: Record<string, unknown>, opts?: { keys?: Jwk[]; end?: Record<string, unknown> }): Promise<{ valid: boolean; covers: string[]; reasons: string[] }>;
 export function verifyAward(receipt: Record<string, unknown>, tender: Record<string, unknown>, award: Record<string, unknown>, opts?: { keys?: Jwk[]; qa?: Record<string, unknown>[] }): Promise<{ valid: boolean; covers: string[]; reasons: string[] }>;
@@ -14,11 +16,11 @@ export function receiptHash(receipt: Record<string, unknown>): Promise<string>;
 export function verifyReceiptChain(top: Record<string, unknown>, opts?: { receipts?: Record<string, unknown>[]; keys?: Jwk[]; maxDepth?: number }): Promise<{ valid: boolean; links: number; depth: number; total_minor: Record<string, number>; broken: string | null }>;
 export function leafOf(pass: Record<string, unknown>): Promise<string>;
 export function verifyProof(leaf: string, proof: Step[], root: string): Promise<boolean>;
-export function verifyPass(anchored: Record<string, unknown>, opts?: { keys?: Jwk[]; anchoredBefore?: string }): Promise<{ valid: boolean; signature_valid: boolean; word_consistent: boolean; in_root: boolean | null; word: unknown; anchors: { root: string; day: string; bitcoin_ots: string | null; stellar_tx: string | null } | null }>;
+export function verifyPass(anchored: Record<string, unknown>, opts?: { keys?: Jwk[]; pqKeys?: PqKey[]; anchoredBefore?: string }): Promise<{ valid: boolean; signature_valid: boolean; pq_signed: boolean; ml_dsa_65: boolean | null; word_consistent: boolean; in_root: boolean | null; word: unknown; anchors: { root: string; day: string; bitcoin_ots: string | null; stellar_tx: string | null } | null }>;
 export type PassCheck = {
   trust: 'kept_its_word' | 'signed_unanchored' | 'no_badge_yet' | 'invalid' | 'unreachable';
   say: string; issuer: string | null;
-  checks: { signature: boolean; in_root: boolean | null; day: string | null; stellar: boolean | null; stellar_account_bound: boolean; bitcoin_ots: boolean; bitcoin: boolean | null; bitcoin_block?: BitcoinBlock; holder: boolean | null; word: boolean } | null;
+  checks: { signature: boolean; ml_dsa_65: boolean | null; in_root: boolean | null; day: string | null; stellar: boolean | null; stellar_account_bound: boolean; bitcoin_ots: boolean; bitcoin: boolean | null; bitcoin_block?: BitcoinBlock; holder: boolean | null; word: boolean } | null;
   pass: Record<string, unknown> | null;
 };
 export type BitcoinBlock = { height: number; hash: string; time: string };
@@ -56,3 +58,7 @@ export function recordOf(pass: Record<string, unknown>): FingerprintRecord;
 export function ridgesOf(delivered: number): number;
 /** The reference drawing, the same bytes for the same input. */
 export function fingerprintSvg(codeword: Fingerprint | string, record?: FingerprintRecord, opts?: { size?: number; ink?: string; gold?: string; background?: string }): string;
+
+// The second signature (SPEC section 16).
+/** { signed: false } without pq_sig; valid true / false, or null when it cannot be checked here (library missing, key not published). */
+export function verifyPqSignature(obj: Record<string, unknown>, pqKeys?: PqKey[], opts?: { anchoredBefore?: string }): Promise<{ signed: boolean; valid: boolean | null }>;

package/src/index.js

@@ -51,11 +51,12 @@ export async function verifySignature(obj, keys, { anchoredBefore } = {}) {
 }
 
 /** A delivery receipt: signed by the issuer; optionally, the delivery you hold is the one that was signed. */
-export async function verifyReceipt(receipt, { keys, delivery } = {}) {
+export async function verifyReceipt(receipt, { keys, pqKeys, delivery } = {}) {
   keys ??= await fetchKeys();
   const signature_valid = typeof receipt?.issuer === 'string' && (await verifySignature(receipt, keys));
+  const pq = await verifyPqSignature(receipt, pqKeys);
   const delivery_matches = delivery === undefined ? null : (await sha256hex(typeof delivery === 'string' ? delivery : JSON.stringify(delivery))) === receipt?.delivery_sha256;
-  return { valid: signature_valid && delivery_matches !== false, signature_valid, delivery_matches };
+  return { valid: signature_valid && pq.valid !== false && delivery_matches !== false, signature_valid, pq_signed: pq.signed, ml_dsa_65: pq.valid, delivery_matches };
 }
 
 /** SPEC section 4: kept_pct and badge as they follow from the pass's own counts. */
@@ -177,15 +178,18 @@ export async function verifyProof(leaf, proof, root) {
  * A revoked key counts only with { anchoredBefore }: a day you proved yourself (a Bitcoin block time), never the
  * root.day the document claims, which whoever holds the stolen key can write.
  */
-export async function verifyPass(anchored, { keys, anchoredBefore } = {}) {
+export async function verifyPass(anchored, { keys, pqKeys, anchoredBefore } = {}) {
   keys ??= await fetchKeys();
   const pass = anchored?.pass ?? anchored;
   const in_root = anchored?.proof && anchored?.root?.root ? await verifyProof(await leafOf(pass), anchored.proof, anchored.root.root) : null;
   const signature_valid = pass?.kind === 'word_pass' && (await verifySignature(pass, keys, { anchoredBefore: in_root ? anchoredBefore : undefined }));
+  const pq = await verifyPqSignature(pass, pqKeys, { anchoredBefore: in_root ? anchoredBefore : undefined });
   const w = wordOf(pass), word_consistent = pass?.word == null || ((pass.word.kept_pct ?? null) === w.kept_pct && (pass.word.badge ?? null) === w.badge); // no word, no claim
   return {
-    valid: signature_valid && in_root !== false && word_consistent,
+    valid: signature_valid && pq.valid !== false && in_root !== false && word_consistent,
     signature_valid,
+    pq_signed: pq.signed,
+    ml_dsa_65: pq.valid,
     word_consistent,
     in_root,
     word: pass?.word ?? null,
@@ -301,10 +305,11 @@ export async function bitcoinHasRoot(otsBase64, root, { fetch: f = fetch, explor
  * A holder proof (section 9): the issuer signed { agent, nonce } for the agent showing the pass. Proves the pass
  * is theirs and not a copied URL. Check it against the nonce you gave and the pass's agent.
  */
-export async function verifyHolderProof(proof, { keys, agent, nonce, aud, now = Date.now() } = {}) {
+export async function verifyHolderProof(proof, { keys, pqKeys, agent, nonce, aud, now = Date.now() } = {}) {
   keys ??= await fetchKeys();
   if (proof?.kind !== 'word_pass_proof') return { ok: false, reason: 'not a holder proof' };
   if (!(await verifySignature(proof, keys))) return { ok: false, reason: "signature does not match the issuer's key" };
+  if ((await verifyPqSignature(proof, pqKeys)).valid === false) return { ok: false, reason: "second signature (ML-DSA-65) does not match the issuer's key" };
   if (proof.agent !== agent) return { ok: false, reason: 'the proof is for another agent' };
   if (typeof nonce !== 'string' || nonce.length < 8 || proof.nonce !== nonce) return { ok: false, reason: 'the proof is not for the nonce you gave' };
   if (aud != null && proof.aud !== aud) return { ok: false, reason: 'the proof was made for another checker' };
@@ -329,16 +334,17 @@ export async function checkWordPass(url, { fetch: f = fetch, keys, proof, nonce,
   const pass = anchored?.pass ?? (doc?.current?.kind === 'word_pass' ? doc.current : doc?.kind === 'word_pass' ? doc : null);
   if (!pass) return none(`The document at ${u.href} is not a Word Pass.`);
   try { kd = keys ? { keys } : await fetchKeysDocument(u.origin, f); } catch { return none(`${u.host} publishes no keys at /.well-known/pazair-receipts.json.`); }
-  let v = await verifyPass(anchored ?? pass, { keys: kd.keys });
+  let v = await verifyPass(anchored ?? pass, { keys: kd.keys, pqKeys: kd.pq_keys });
   const a = kd.anchors?.stellar, account = a?.network === 'mainnet' && typeof a.account === 'string' ? a.account : undefined;
   const stellar = v.in_root && anchored.root.stellar_tx && account ? await stellarHasRoot(anchored.root.stellar_tx, anchored.root.root, { fetch: f, account }) : null;
   const btc = v.in_root && anchored.root.bitcoin_ots ? await bitcoinHasRoot(anchored.root.bitcoin_ots, anchored.root.root, { fetch: f }) : null;
   // Revoked key: only a Bitcoin block older than the revocation proves the pass was signed before the theft.
-  if (!v.signature_valid && btc?.ok && btc.block?.time) v = await verifyPass(anchored, { keys: kd.keys, anchoredBefore: btc.block.time.slice(0, 10) });
-  const held = proof != null ? await verifyHolderProof(proof, { keys: kd.keys, agent: pass.agent, nonce, aud }) : null;
-  const checks = { signature: v.signature_valid, in_root: v.in_root, day: v.anchors?.day ?? null, stellar, stellar_account_bound: !!(stellar && account), bitcoin_ots: !!(v.in_root && anchored.root.bitcoin_ots), bitcoin: btc ? btc.ok : null, ...(btc?.block ? { bitcoin_block: btc.block } : {}), holder: held ? held.ok : null, word: v.word_consistent };
+  if ((!v.signature_valid || v.ml_dsa_65 === false) && btc?.ok && btc.block?.time) v = await verifyPass(anchored, { keys: kd.keys, pqKeys: kd.pq_keys, anchoredBefore: btc.block.time.slice(0, 10) });
+  const held = proof != null ? await verifyHolderProof(proof, { keys: kd.keys, pqKeys: kd.pq_keys, agent: pass.agent, nonce, aud }) : null;
+  const checks = { signature: v.signature_valid, ml_dsa_65: v.pq_signed ? v.ml_dsa_65 : null, in_root: v.in_root, day: v.anchors?.day ?? null, stellar, stellar_account_bound: !!(stellar && account), bitcoin_ots: !!(v.in_root && anchored.root.bitcoin_ots), bitcoin: btc ? btc.ok : null, ...(btc?.block ? { bitcoin_block: btc.block } : {}), holder: held ? held.ok : null, word: v.word_consistent };
   const issuer = u.host;
   if (!checks.signature) return { trust: 'invalid', issuer, checks, pass, say: `Do not rely on this pass: its signature does not match ${issuer}'s published key.` };
+  if (checks.ml_dsa_65 === false) return { trust: 'invalid', issuer, checks, pass, say: `Do not rely on this pass: its second signature (ML-DSA-65) does not match ${issuer}'s published key.` };
   if (checks.in_root === false) return { trust: 'invalid', issuer, checks, pass, say: `Do not rely on this pass: its Merkle proof does not lead to the root of ${checks.day}.` };
   if (stellar === false) return { trust: 'invalid', issuer, checks, pass, say: `Do not rely on this pass: the Stellar transaction it names does not carry the root of ${checks.day} from ${issuer}'s anchor account.` };
   if (btc?.ok === false) return { trust: 'invalid', issuer, checks, pass, say: `Do not rely on this pass: the Bitcoin proof it names for the root of ${checks.day} is not for that root or not in the block it claims.` };
@@ -347,7 +353,7 @@ export async function checkWordPass(url, { fetch: f = fetch, keys, proof, nonce,
   const where = checks.in_root ? `in the Merkle root of ${checks.day}${stellar ? (account ? ", found on Stellar from the issuer's anchor account" : ', found on Stellar') : ''}${btc?.block ? `, confirmed in Bitcoin block ${btc.block.height} (${btc.block.time.slice(0, 10)})` : checks.bitcoin_ots ? ', stamped in Bitcoin (block confirmation pending)' : ''}` : 'not anchored yet';
   const whose = held?.ok ? ' The agent showing it proved it is this agent.' : ' To be sure it is theirs, give them a fresh nonce and ask for a holder proof (prove_word_pass).';
   const anchored_ok = stellar === true || btc?.ok === true;
-  return { trust: !pass.word?.badge ? 'no_badge_yet' : anchored_ok ? 'kept_its_word' : 'signed_unanchored', issuer, checks, pass, say: `${sayPass(pass, issuer)} Checked: signature of ${issuer} valid, ${where}.${whose}` };
+  return { trust: !pass.word?.badge ? 'no_badge_yet' : anchored_ok ? 'kept_its_word' : 'signed_unanchored', issuer, checks, pass, say: `${sayPass(pass, issuer)} Checked: signature of ${issuer} valid${checks.ml_dsa_65 ? ' (Ed25519 and ML-DSA-65)' : ''}, ${where}.${whose}` };
 }
 
 /** One plain sentence about a pass. */
@@ -359,7 +365,11 @@ export function sayPass(p, by = p.issuer) {
 }
 
 // Remember: the chain of daily roots, checked without the issuer (SPEC section 14).
-export { GENESIS, headOf, recomputeChain, verifyLink, verifyRememberDocument, checkRemember, checkHead, loadMlDsa, verifyMlDsa, pqKid } from './remember.js';
+export { GENESIS, headOf, recomputeChain, verifyLink, verifyRememberDocument, checkRemember, checkHead } from './remember.js';
+
+// The second signature (SPEC section 16): ML-DSA-65 on passes, receipts and holder proofs; checked when @noble/post-quantum is installed.
+export { loadMlDsa, verifyMlDsa, pqKid, verifyPqSignature } from './pq.js';
+import { verifyPqSignature } from './pq.js';
 
 // Fingerprint (SPEC section 15): a print no other agent can carry, provably; the reference drawing.
 export { FINGERPRINT, rsEncode, fingerprintOf, fingerprintDistance, fingerprintSvg, recordOf, ridgesOf } from './fingerprint.js';

package/src/pq.js

@@ -0,0 +1,42 @@
+// ML-DSA-65 (FIPS 204), the second signature. Checked when the optional package @noble/post-quantum is installed
+// next to pazair-verify; otherwise reported as not checked (null), never as valid. Used by Remember (section 14)
+// and by the second signature on passes, receipts and holder proofs (section 16).
+import { canonical, sha256hex } from './index.js';
+
+const enc = new TextEncoder();
+const unb64u = (s) => Uint8Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/') + '==='.slice((s.length + 3) % 4)), (c) => c.charCodeAt(0));
+const hex = (b) => [...b].map((x) => x.toString(16).padStart(2, '0')).join('');
+
+let mlDsa; // the optional ML-DSA-65 implementation, loaded once
+/** ML-DSA-65 when @noble/post-quantum is installed; null otherwise. */
+export async function loadMlDsa() {
+  if (mlDsa !== undefined) return mlDsa;
+  try { mlDsa = (await import('@noble/post-quantum/ml-dsa.js')).ml_dsa65 ?? null; } catch { mlDsa = null; }
+  return mlDsa;
+}
+
+/** true / false, or null when ML-DSA-65 cannot be checked here. */
+export async function verifyMlDsa(sigB64u, msgBytes, publicKeyB64u) {
+  const m = await loadMlDsa(); if (!m) return null;
+  try { return m.verify(unb64u(sigB64u), msgBytes, unb64u(publicKeyB64u)); } catch { return false; }
+}
+
+/** kid of an ML-DSA key: sha256hex(hex(public key))[0:16], like the Ed25519 kid is built from x. */
+export const pqKid = async (publicKeyB64u) => (await sha256hex(hex(unb64u(publicKeyB64u)))).slice(0, 16);
+
+/**
+ * Section 16: the second signature of an object. `pq_sig` is ML-DSA-65 over canonical(object without "sig" and
+ * "pq_sig") with the issuer's key named by `pq_kid` (`pq_keys` in the keys document). Returns
+ * { signed, valid }: signed false when the object carries no pq_sig; valid true / false, or null when it cannot be
+ * checked here (no library, or the key is not published). A revoked pq key signs nothing valid.
+ */
+export async function verifyPqSignature(obj, pqKeys = [], { anchoredBefore } = {}) {
+  if (!obj || typeof obj.pq_sig !== 'string') return { signed: false, valid: null };
+  if (typeof obj.pq_kid !== 'string') return { signed: true, valid: false };
+  const key = (pqKeys ?? []).find((k) => k?.pq_kid === obj.pq_kid);
+  if (!key || typeof key.public_key_b64url !== 'string') return { signed: true, valid: null };
+  if ((await pqKid(key.public_key_b64url)) !== key.pq_kid) return { signed: true, valid: false };
+  if (key.revoked_at && !(anchoredBefore && anchoredBefore < String(key.revoked_at).slice(0, 10))) return { signed: true, valid: false };
+  const { sig, pq_sig, ...body } = obj;
+  return { signed: true, valid: await verifyMlDsa(pq_sig, enc.encode(canonical(body)), key.public_key_b64url) };
+}

package/src/remember.js

@@ -8,7 +8,6 @@ import { canonical, fetchKeysDocument, sha256hex, verifySignature } from './inde
 export const GENESIS = '0'.repeat(64);
 const enc = new TextEncoder();
 const unb64u = (s) => Uint8Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/') + '==='.slice((s.length + 3) % 4)), (c) => c.charCodeAt(0));
-const hex = (b) => [...b].map((x) => x.toString(16).padStart(2, '0')).join('');
 
 /** One link of the chain. */
 export const headOf = (prev, root) => sha256hex(prev + root);
@@ -30,22 +29,8 @@ export async function recomputeChain(days) {
   return { head, days: sorted.length, last_day: sorted.length ? sorted[sorted.length - 1].day : null, broken_at, heads };
 }
 
-let mlDsa; // the optional ML-DSA-65 implementation, loaded once
-/** ML-DSA-65 when @noble/post-quantum is installed; null otherwise. */
-export async function loadMlDsa() {
-  if (mlDsa !== undefined) return mlDsa;
-  try { mlDsa = (await import('@noble/post-quantum/ml-dsa.js')).ml_dsa65 ?? null; } catch { mlDsa = null; }
-  return mlDsa;
-}
-
-/** true / false, or null when ML-DSA-65 cannot be checked here. */
-export async function verifyMlDsa(sigB64u, msgBytes, publicKeyB64u) {
-  const m = await loadMlDsa(); if (!m) return null;
-  try { return m.verify(unb64u(sigB64u), msgBytes, unb64u(publicKeyB64u)); } catch { return false; }
-}
-
-/** kid of an ML-DSA key: sha256hex(hex(public key))[0:16], like the Ed25519 kid is built from x. */
-export const pqKid = async (publicKeyB64u) => (await sha256hex(hex(unb64u(publicKeyB64u)))).slice(0, 16);
+export { loadMlDsa, verifyMlDsa, pqKid } from './pq.js';
+import { loadMlDsa, verifyMlDsa, pqKid } from './pq.js';
 
 async function ed25519(jwk, sigB64u, msgBytes) {
   if (!jwk || typeof jwk.x !== 'string') return false;