raz-encrypt 0.1.0

package/dist/crypto/hybrid.js

@@ -0,0 +1,180 @@
+import { gcm } from "@noble/ciphers/aes.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha384 } from "@noble/hashes/sha2.js";
+import { bytesToHex, concatBytes, hexToBytes, randomBytes, utf8ToBytes } from "@noble/hashes/utils.js";
+import { canonicalize, hashDocument } from "../canonicalJson.js";
+import { classicalSharedSecret, classicalSign, classicalVerify } from "./classical.js";
+import { pqcDecapsulate, pqcEncapsulate, pqcSign, pqcVerify } from "./pqc.js";
+// No import of ../store.js or ../trust.js here (only their LogEntry TYPE,
+// which is erased at compile time) — this file must stay resolvable by a
+// browser bundler on its own. The node:fs-backed default wiring for
+// sign/verify/encryptFor/decryptFrom lives in ./nodeHybrid.ts instead,
+// which is what "." (not "./core") re-exports.
+const HYBRID_INFO = utf8ToBytes("raz-encrypt-hybrid-v1");
+const ALGORITHMS = { classical: "ECDSA-P384", pqc: "ML-DSA-87" };
+export class UntrustedPartyError extends Error {
+    constructor(alias) {
+        super(`"${alias}" is not in the local trust list. Call trustParty() with their public card first.`);
+        this.name = "UntrustedPartyError";
+    }
+}
+/**
+ * The exact bytes both signatures are computed over. Binds `expiresAt` into
+ * the signed payload (not just `documentHash`) so a certificate's expiry
+ * can't be stripped or altered in transit without invalidating both
+ * signatures — an untrusted intermediary who only has the certificate
+ * (no secret key) must not be able to turn an expired certificate back into
+ * one that verify() accepts.
+ */
+function signedMessage(documentHash, expiresAt) {
+    return utf8ToBytes(canonicalize({ documentHash, expiresAt: expiresAt ?? null }));
+}
+async function requireTrusted(checkTrust, counterpart) {
+    const status = await checkTrust(counterpart);
+    if (status !== "trusted")
+        throw new UntrustedPartyError(counterpart.alias);
+}
+async function log(onLog, entry) {
+    if (onLog)
+        await onLog(entry);
+}
+/**
+ * Signs `document` with both the classical (ECDSA-P384) and post-quantum
+ * (ML-DSA-87) keys. Permanent by default; pass `options.expiresAt` to make
+ * verify() reject it once that time has passed. Takes no trust dependency —
+ * signing never checks anyone else's trust status, only your own keys.
+ */
+export async function signCore(identity, document, options = {}, deps = {}) {
+    const documentHash = hashDocument(document);
+    const message = signedMessage(documentHash, options.expiresAt);
+    const certificate = {
+        documentHash,
+        classicalSignature: bytesToHex(classicalSign(message, identity.classical.secretKey)),
+        pqcSignature: bytesToHex(pqcSign(message, identity.pqcSign.secretKey)),
+        algorithms: ALGORITHMS,
+        signer: {
+            alias: identity.alias,
+            classicalPublicKey: bytesToHex(identity.classical.publicKey),
+            pqcSignPublicKey: bytesToHex(identity.pqcSign.publicKey),
+        },
+        signedAt: new Date().toISOString(),
+        ...(options.expiresAt ? { expiresAt: options.expiresAt } : {}),
+    };
+    await log(deps.onLog, { action: "sign", documentHash });
+    return certificate;
+}
+/**
+ * Verifies `certificate` over `document` using an injected trust check
+ * (`deps.checkTrust`) instead of a hard-wired trust store. Requires BOTH the
+ * classical and post-quantum signatures to check out — either one failing
+ * fails the whole verification.
+ */
+export async function verifyCore(identity, document, certificate, deps) {
+    const record = (result) => {
+        void log(deps.onLog, {
+            action: "verify",
+            documentHash: certificate.documentHash,
+            counterpartAlias: certificate.signer.alias,
+            result: result.valid ? "valid" : result.reason,
+        });
+        return result;
+    };
+    const status = await deps.checkTrust(certificate.signer);
+    if (status === "untrusted") {
+        return record({ valid: false, reason: "untrusted-signer" });
+    }
+    if (status === "revoked") {
+        return record({ valid: false, reason: "revoked-signer" });
+    }
+    if (hashDocument(document) !== certificate.documentHash) {
+        return record({ valid: false, reason: "hash-mismatch" });
+    }
+    if (certificate.expiresAt && Date.now() >= Date.parse(certificate.expiresAt)) {
+        return record({ valid: false, reason: "expired" });
+    }
+    const message = signedMessage(certificate.documentHash, certificate.expiresAt);
+    const classicalOk = classicalVerify(hexToBytes(certificate.classicalSignature), message, hexToBytes(certificate.signer.classicalPublicKey));
+    if (!classicalOk)
+        return record({ valid: false, reason: "classical-signature-mismatch" });
+    const pqcOk = pqcVerify(hexToBytes(certificate.pqcSignature), message, hexToBytes(certificate.signer.pqcSignPublicKey));
+    if (!pqcOk)
+        return record({ valid: false, reason: "pqc-signature-mismatch" });
+    return record({ valid: true });
+}
+function deriveHybridKey(ecdhSecret, kemSecret) {
+    return hkdf(sha384, concatBytes(ecdhSecret, kemSecret), undefined, HYBRID_INFO, 32);
+}
+/**
+ * Encrypts `data` for `counterpart` using a symmetric key derived from BOTH
+ * an ECDH-P384 exchange and an ML-KEM-1024 encapsulation (HKDF-SHA384
+ * combines the two secrets), then AES-256-GCM. Throws UntrustedPartyError
+ * unless `deps.checkTrust(counterpart)` reports "trusted".
+ */
+export async function encryptForCore(identity, counterpart, data, deps) {
+    await requireTrusted(deps.checkTrust, counterpart);
+    const ecdhSecret = classicalSharedSecret(identity.classical.secretKey, hexToBytes(counterpart.classicalPublicKey));
+    const { cipherText: kemCipherText, sharedSecret: kemSecret } = pqcEncapsulate(hexToBytes(counterpart.pqcKemPublicKey));
+    const key = deriveHybridKey(ecdhSecret, kemSecret);
+    const nonce = randomBytes(12);
+    const ciphertext = gcm(key, nonce).encrypt(utf8ToBytes(canonicalize(data)));
+    await log(deps.onLog, { action: "encrypt", counterpartAlias: counterpart.alias });
+    return { kemCipherText: bytesToHex(kemCipherText), nonce: bytesToHex(nonce), ciphertext: bytesToHex(ciphertext) };
+}
+/**
+ * Decrypts a box produced by `encryptFor`. `counterpart` is the sender's
+ * public card. Throws UntrustedPartyError unless `deps.checkTrust(counterpart)`
+ * reports "trusted" — this stops a caller from accidentally decrypting "as
+ * if" a message came from someone they never actually trusted.
+ */
+export async function decryptFromCore(identity, counterpart, box, deps) {
+    await requireTrusted(deps.checkTrust, counterpart);
+    const ecdhSecret = classicalSharedSecret(identity.classical.secretKey, hexToBytes(counterpart.classicalPublicKey));
+    const kemSecret = pqcDecapsulate(hexToBytes(box.kemCipherText), identity.pqcKem.secretKey);
+    const key = deriveHybridKey(ecdhSecret, kemSecret);
+    const plaintext = gcm(key, hexToBytes(box.nonce)).decrypt(hexToBytes(box.ciphertext));
+    await log(deps.onLog, { action: "decrypt", counterpartAlias: counterpart.alias });
+    return JSON.parse(new TextDecoder().decode(plaintext));
+}
+// --- Session handshake ------------------------------------------------
+//
+// encryptForCore/decryptFromCore above do a full ECDH + ML-KEM encapsulation
+// PER CALL — fine for a one-off document, prohibitively expensive if called
+// once per 16 KiB chunk of a large file transfer. The functions below run
+// that hybrid exchange ONCE per connection and hand back a pair of
+// directional keys the caller reuses (via a separate per-frame cipher, not
+// implemented here) for as many messages as the connection carries.
+const SESSION_INFO_INITIATOR_TO_RESPONDER = utf8ToBytes("raz-encrypt-session-v1|initiator-to-responder");
+const SESSION_INFO_RESPONDER_TO_INITIATOR = utf8ToBytes("raz-encrypt-session-v1|responder-to-initiator");
+function deriveSessionKeys(ecdhSecret, kemSecret) {
+    const ikm = concatBytes(ecdhSecret, kemSecret);
+    return {
+        initiatorToResponder: hkdf(sha384, ikm, undefined, SESSION_INFO_INITIATOR_TO_RESPONDER, 32),
+        responderToInitiator: hkdf(sha384, ikm, undefined, SESSION_INFO_RESPONDER_TO_INITIATOR, 32),
+    };
+}
+/**
+ * Establishes a session as the connection's initiator (the side that
+ * created the WebRTC offer, in raz-encrypt-agnostic terms: whichever side
+ * owns the single ML-KEM encapsulation this handshake performs). Computes
+ * the ECDH-P384 secret with `counterpart` and one ML-KEM-1024 encapsulation
+ * toward their KEM public key, then HKDF-splits the combined secret into two
+ * directional AES-256-GCM keys. No trust dependency: establishing a session
+ * never checks anyone's trust status, same as signCore.
+ */
+export function establishSessionInitiatorCore(identity, counterpart) {
+    const ecdhSecret = classicalSharedSecret(identity.classical.secretKey, hexToBytes(counterpart.classicalPublicKey));
+    const { cipherText, sharedSecret: kemSecret } = pqcEncapsulate(hexToBytes(counterpart.pqcKemPublicKey));
+    return { kemCipherText: bytesToHex(cipherText), keys: deriveSessionKeys(ecdhSecret, kemSecret) };
+}
+/**
+ * Establishes a session as the connection's responder: computes the same
+ * ECDH-P384 secret, decapsulates the initiator's `kemCipherText` with our
+ * own KEM secret key, and derives the same two directional keys the
+ * initiator derived.
+ */
+export function establishSessionResponderCore(identity, counterpart, kemCipherText) {
+    const ecdhSecret = classicalSharedSecret(identity.classical.secretKey, hexToBytes(counterpart.classicalPublicKey));
+    const kemSecret = pqcDecapsulate(hexToBytes(kemCipherText), identity.pqcKem.secretKey);
+    return deriveSessionKeys(ecdhSecret, kemSecret);
+}
+//# sourceMappingURL=hybrid.js.map

package/dist/crypto/hybrid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybrid.js","sourceRoot":"","sources":["../../src/crypto/hybrid.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE9E,0EAA0E;AAC1E,yEAAyE;AACzE,oEAAoE;AACpE,uEAAuE;AACvE,+CAA+C;AAE/C,MAAM,WAAW,GAAG,WAAW,CAAC,uBAAuB,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAW,CAAC;AAE1E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,KAAa;QACvB,KAAK,CAAC,IAAI,KAAK,mFAAmF,CAAC,CAAC;QACpG,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAkBD;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,YAAoB,EAAE,SAA6B;IACxE,OAAO,WAAW,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAiCD,KAAK,UAAU,cAAc,CAAC,UAAmC,EAAE,WAAuB;IACxF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,KAAuB,EAAE,KAA2B;IACrE,IAAI,KAAK;QAAE,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,QAAiB,EAAE,UAAuB,EAAE,EAAE,OAAgB,EAAE;IACjH,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/D,MAAM,WAAW,GAAgB;QAC/B,YAAY;QACZ,kBAAkB,EAAE,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpF,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE;YACN,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;YAC5D,gBAAgB,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;SACzD;QACD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAiB,EAAE,WAAwB,EAAE,IAAgB;IAChH,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAgB,EAAE;QACpD,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;YACnB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK;YAC1C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;SAC/C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,WAAW,CAAC,YAAY,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IAE/E,MAAM,WAAW,GAAG,eAAe,CACjC,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAC1C,OAAO,EACP,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAClD,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACxH,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAE9E,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACjC,CAAC;AAQD,SAAS,eAAe,CAAC,UAAsB,EAAE,SAAqB;IACpE,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,WAAuB,EAAE,IAAa,EAAE,IAAe;IAC9G,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnH,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;IACvH,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5E,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAElF,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACpH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAc,QAAkB,EAAE,WAAuB,EAAE,GAAiB,EAAE,IAAe;IAChI,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnH,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAEtF,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAElF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;AAC9D,CAAC;AAED,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,oEAAoE;AAEpE,MAAM,mCAAmC,GAAG,WAAW,CAAC,+CAA+C,CAAC,CAAC;AACzG,MAAM,mCAAmC,GAAG,WAAW,CAAC,+CAA+C,CAAC,CAAC;AAezG,SAAS,iBAAiB,CAAC,UAAsB,EAAE,SAAqB;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,mCAAmC,EAAE,EAAE,CAAC;QAC3F,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,mCAAmC,EAAE,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAkB,EAAE,WAAuB;IACvF,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnH,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;IACxG,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAkB,EAAE,WAAuB,EAAE,aAAqB;IAC9G,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnH,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,OAAO,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC"}

package/dist/crypto/nodeHybrid.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Default (Node, fs-backed) wiring for the "." package export — the
+ * library's original public API. Behavior is unchanged from before the
+ * injectable-trust/log refactor: these still check identity's persisted
+ * trust store and append to its persisted audit log.
+ *
+ * This file is deliberately separate from ./hybrid.ts: it's the only place
+ * that imports ../trust.js and ../store.js (both node:fs-backed), so
+ * ./hybrid.ts — and therefore the "./core" export built from it — stays
+ * resolvable by a browser bundler with no node:fs in its module graph.
+ */
+import type { Identity, PublicCard } from "../identity.js";
+import { type Certificate, type EncryptedBox, type SignOptions, type VerifyResult } from "./hybrid.js";
+export { UntrustedPartyError } from "./hybrid.js";
+export type { Certificate, EncryptedBox, SignOptions, VerifyFailureReason, VerifyResult } from "./hybrid.js";
+/**
+ * Signs `document` with both the classical (ECDSA-P384) and post-quantum
+ * (ML-DSA-87) keys. Permanent by default; pass `options.expiresAt` to make
+ * verify() reject it once that time has passed.
+ */
+export declare function sign(identity: Identity, document: unknown, options?: SignOptions): Promise<Certificate>;
+/**
+ * Verifies `certificate` over `document`. Requires the signer to already be
+ * in `identity`'s local trust list (see trustParty), and requires BOTH the
+ * classical and post-quantum signatures to check out — either one failing
+ * fails the whole verification.
+ */
+export declare function verify(identity: Identity, document: unknown, certificate: Certificate): Promise<VerifyResult>;
+/**
+ * Encrypts `data` for `counterpart` using a symmetric key derived from BOTH
+ * an ECDH-P384 exchange and an ML-KEM-1024 encapsulation (HKDF-SHA384
+ * combines the two secrets), then AES-256-GCM. Throws UntrustedPartyError
+ * unless `counterpart` is already in `identity`'s local trust list.
+ */
+export declare function encryptFor(identity: Identity, counterpart: PublicCard, data: unknown): Promise<EncryptedBox>;
+/**
+ * Decrypts a box produced by `encryptFor`. `counterpart` is the sender's
+ * public card. Throws UntrustedPartyError unless `counterpart` is already
+ * in `identity`'s local trust list — this stops a caller from accidentally
+ * decrypting "as if" a message came from someone they never actually trusted.
+ */
+export declare function decryptFrom<T = unknown>(identity: Identity, counterpart: PublicCard, box: EncryptedBox): Promise<T>;

package/dist/crypto/nodeHybrid.js

@@ -0,0 +1,65 @@
+import { appendLogEntry } from "../store.js";
+import { getTrustRecordsByAlias, getTrustedPartiesByAlias } from "../trust.js";
+import { decryptFromCore, encryptForCore, signCore, verifyCore, } from "./hybrid.js";
+export { UntrustedPartyError } from "./hybrid.js";
+async function trustStatusForSigner(identity, signer) {
+    const allRecords = await getTrustRecordsByAlias(identity, signer.alias);
+    const matchingRecord = allRecords.find((r) => r.card.classicalPublicKey === signer.classicalPublicKey && r.card.pqcSignPublicKey === signer.pqcSignPublicKey);
+    if (!matchingRecord)
+        return "untrusted";
+    if (matchingRecord.revokedAt)
+        return "revoked";
+    return "trusted";
+}
+async function trustStatusForCard(identity, card) {
+    const candidates = await getTrustedPartiesByAlias(identity, card.alias);
+    const isTrusted = candidates.some((trusted) => trusted.classicalPublicKey === card.classicalPublicKey &&
+        trusted.pqcSignPublicKey === card.pqcSignPublicKey &&
+        trusted.pqcKemPublicKey === card.pqcKemPublicKey);
+    return isTrusted ? "trusted" : "untrusted";
+}
+/**
+ * Signs `document` with both the classical (ECDSA-P384) and post-quantum
+ * (ML-DSA-87) keys. Permanent by default; pass `options.expiresAt` to make
+ * verify() reject it once that time has passed.
+ */
+export async function sign(identity, document, options = {}) {
+    return signCore(identity, document, options, { onLog: (entry) => appendLogEntry(identity, entry) });
+}
+/**
+ * Verifies `certificate` over `document`. Requires the signer to already be
+ * in `identity`'s local trust list (see trustParty), and requires BOTH the
+ * classical and post-quantum signatures to check out — either one failing
+ * fails the whole verification.
+ */
+export async function verify(identity, document, certificate) {
+    return verifyCore(identity, document, certificate, {
+        checkTrust: (signer) => trustStatusForSigner(identity, signer),
+        onLog: (entry) => appendLogEntry(identity, entry),
+    });
+}
+/**
+ * Encrypts `data` for `counterpart` using a symmetric key derived from BOTH
+ * an ECDH-P384 exchange and an ML-KEM-1024 encapsulation (HKDF-SHA384
+ * combines the two secrets), then AES-256-GCM. Throws UntrustedPartyError
+ * unless `counterpart` is already in `identity`'s local trust list.
+ */
+export async function encryptFor(identity, counterpart, data) {
+    return encryptForCore(identity, counterpart, data, {
+        checkTrust: (card) => trustStatusForCard(identity, card),
+        onLog: (entry) => appendLogEntry(identity, entry),
+    });
+}
+/**
+ * Decrypts a box produced by `encryptFor`. `counterpart` is the sender's
+ * public card. Throws UntrustedPartyError unless `counterpart` is already
+ * in `identity`'s local trust list — this stops a caller from accidentally
+ * decrypting "as if" a message came from someone they never actually trusted.
+ */
+export async function decryptFrom(identity, counterpart, box) {
+    return decryptFromCore(identity, counterpart, box, {
+        checkTrust: (card) => trustStatusForCard(identity, card),
+        onLog: (entry) => appendLogEntry(identity, entry),
+    });
+}
+//# sourceMappingURL=nodeHybrid.js.map

package/dist/crypto/nodeHybrid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodeHybrid.js","sourceRoot":"","sources":["../../src/crypto/nodeHybrid.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,eAAe,EACf,cAAc,EACd,QAAQ,EAMR,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,KAAK,UAAU,oBAAoB,CACjC,QAAkB,EAClB,MAA+E;IAE/E,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CACtH,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,cAAc,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAkB,EAAE,IAAgB;IACpE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC,kBAAkB;QACtD,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;QAClD,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,CACnD,CAAC;IACF,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,QAAkB,EAAE,QAAiB,EAAE,UAAuB,EAAE;IACzF,OAAO,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAkB,EAAE,QAAiB,EAAE,WAAwB;IAC1F,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;QACjD,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC9D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,WAAuB,EAAE,IAAa;IACzF,OAAO,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;QACjD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC;QACxD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAc,QAAkB,EAAE,WAAuB,EAAE,GAAiB;IAC3G,OAAO,eAAe,CAAI,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;QACpD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC;QACxD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/crypto/pqc.d.ts

@@ -0,0 +1,19 @@
+export interface PqcSignKeypair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+export interface PqcKemKeypair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+/** ML-DSA-87 (FIPS 204, category-5 parameter set) — the post-quantum signing layer. */
+export declare function generatePqcSignKeypair(): PqcSignKeypair;
+export declare function pqcSign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function pqcVerify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
+/** ML-KEM-1024 (FIPS 203, category-5 parameter set) — the post-quantum key-exchange layer. */
+export declare function generatePqcKemKeypair(): PqcKemKeypair;
+export declare function pqcEncapsulate(theirPublicKey: Uint8Array): {
+    cipherText: Uint8Array;
+    sharedSecret: Uint8Array;
+};
+export declare function pqcDecapsulate(cipherText: Uint8Array, secretKey: Uint8Array): Uint8Array;

package/dist/crypto/pqc.js

@@ -0,0 +1,28 @@
+import { ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
+import { ml_kem1024 } from "@noble/post-quantum/ml-kem.js";
+/** ML-DSA-87 (FIPS 204, category-5 parameter set) — the post-quantum signing layer. */
+export function generatePqcSignKeypair() {
+    return ml_dsa87.keygen();
+}
+export function pqcSign(message, secretKey) {
+    return ml_dsa87.sign(message, secretKey);
+}
+export function pqcVerify(signature, message, publicKey) {
+    try {
+        return ml_dsa87.verify(signature, message, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+/** ML-KEM-1024 (FIPS 203, category-5 parameter set) — the post-quantum key-exchange layer. */
+export function generatePqcKemKeypair() {
+    return ml_kem1024.keygen();
+}
+export function pqcEncapsulate(theirPublicKey) {
+    return ml_kem1024.encapsulate(theirPublicKey);
+}
+export function pqcDecapsulate(cipherText, secretKey) {
+    return ml_kem1024.decapsulate(cipherText, secretKey);
+}
+//# sourceMappingURL=pqc.js.map

package/dist/crypto/pqc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pqc.js","sourceRoot":"","sources":["../../src/crypto/pqc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAY3D,uFAAuF;AACvF,MAAM,UAAU,sBAAsB;IACpC,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAmB,EAAE,SAAqB;IAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IACzF,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB;IACnC,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,cAA0B;IACvD,OAAO,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAsB,EAAE,SAAqB;IAC1E,OAAO,UAAU,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC"}

package/dist/fileCrypto.d.ts

@@ -0,0 +1,6 @@
+/** Encrypts `data` (any JSON-serializable value) at rest under a passphrase-derived AES-256-GCM key. */
+export declare function encryptToFile(filePath: string, passphrase: string, data: unknown): Promise<void>;
+export declare class DecryptionFailedError extends Error {
+    constructor();
+}
+export declare function decryptFromFile<T>(filePath: string, passphrase: string): Promise<T>;

package/dist/fileCrypto.js

@@ -0,0 +1,45 @@
+import { gcm } from "@noble/ciphers/aes.js";
+import { scrypt } from "@noble/hashes/scrypt.js";
+import { bytesToHex, hexToBytes, randomBytes, utf8ToBytes } from "@noble/hashes/utils.js";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+const SCRYPT_PARAMS = { N: 2 ** 17, r: 8, p: 1, dkLen: 32 };
+function deriveKey(passphrase, salt) {
+    return scrypt(utf8ToBytes(passphrase), salt, SCRYPT_PARAMS);
+}
+/** Encrypts `data` (any JSON-serializable value) at rest under a passphrase-derived AES-256-GCM key. */
+export async function encryptToFile(filePath, passphrase, data) {
+    const salt = randomBytes(16);
+    const nonce = randomBytes(12);
+    const key = deriveKey(passphrase, salt);
+    const plaintext = utf8ToBytes(JSON.stringify(data));
+    const ciphertext = gcm(key, nonce).encrypt(plaintext);
+    const payload = {
+        salt: bytesToHex(salt),
+        nonce: bytesToHex(nonce),
+        ciphertext: bytesToHex(ciphertext),
+    };
+    await mkdir(dirname(filePath), { recursive: true });
+    await writeFile(filePath, JSON.stringify(payload), { mode: 0o600 });
+}
+export class DecryptionFailedError extends Error {
+    constructor() {
+        super("Failed to decrypt local store: wrong passphrase or corrupted/tampered file.");
+        this.name = "DecryptionFailedError";
+    }
+}
+export async function decryptFromFile(filePath, passphrase) {
+    const raw = await readFile(filePath, "utf8");
+    const payload = JSON.parse(raw);
+    const salt = hexToBytes(payload.salt);
+    const nonce = hexToBytes(payload.nonce);
+    const key = deriveKey(passphrase, salt);
+    try {
+        const plaintext = gcm(key, nonce).decrypt(hexToBytes(payload.ciphertext));
+        return JSON.parse(new TextDecoder().decode(plaintext));
+    }
+    catch {
+        throw new DecryptionFailedError();
+    }
+}
+//# sourceMappingURL=fileCrypto.js.map

package/dist/fileCrypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileCrypto.js","sourceRoot":"","sources":["../src/fileCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAQ5D,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAgB;IACrD,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,UAAkB,EAAE,IAAa;IACrF,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAkB;QAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;QACtB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;QACxB,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;KACnC,CAAC;IAEF,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C;QACE,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,QAAgB,EAAE,UAAkB;IAC3E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,qBAAqB,EAAE,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/fingerprint.d.ts

@@ -0,0 +1,11 @@
+import type { PublicCard } from "./identity.js";
+/**
+ * A short, human-comparable fingerprint of a PublicCard (PGP/Signal
+ * "safety number" style: grouped hex). Two parties should read this aloud
+ * or compare it over a side channel (phone call, in person) BEFORE calling
+ * trustParty() with a card they received over an unauthenticated channel
+ * (email, chat) — this is what catches a spoofed or intercepted card.
+ *
+ * Does not change trustParty() itself; this is an additive, optional check.
+ */
+export declare function fingerprint(card: PublicCard): string;

package/dist/fingerprint.js

@@ -0,0 +1,18 @@
+import { sha384 } from "@noble/hashes/sha2.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
+import { canonicalize } from "./canonicalJson.js";
+/**
+ * A short, human-comparable fingerprint of a PublicCard (PGP/Signal
+ * "safety number" style: grouped hex). Two parties should read this aloud
+ * or compare it over a side channel (phone call, in person) BEFORE calling
+ * trustParty() with a card they received over an unauthenticated channel
+ * (email, chat) — this is what catches a spoofed or intercepted card.
+ *
+ * Does not change trustParty() itself; this is an additive, optional check.
+ */
+export function fingerprint(card) {
+    const hash = sha384(utf8ToBytes(canonicalize(card)));
+    const hex = bytesToHex(hash.slice(0, 20)).toUpperCase();
+    return hex.match(/.{1,4}/g).join(" ");
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,42 @@
+import { type ClassicalKeypair } from "./crypto/classical.js";
+import { type PqcKemKeypair, type PqcSignKeypair } from "./crypto/pqc.js";
+export interface Identity {
+    alias: string;
+    storageDir: string;
+    classical: ClassicalKeypair;
+    pqcSign: PqcSignKeypair;
+    pqcKem: PqcKemKeypair;
+}
+/** The public half of an Identity — safe to hand to the other party. */
+export interface PublicCard {
+    alias: string;
+    classicalPublicKey: string;
+    pqcSignPublicKey: string;
+    pqcKemPublicKey: string;
+}
+export declare const MIN_PASSPHRASE_LENGTH = 12;
+export interface CreateIdentityOptions {
+    storageDir: string;
+    passphrase: string;
+    alias: string;
+    /** Overwrite an existing identity at this storageDir. Defaults to false. */
+    overwrite?: boolean;
+}
+/**
+ * Generates a new hybrid classical+post-quantum identity (one ECDSA/ECDH-P384
+ * keypair, one ML-DSA-87 signing keypair, one ML-KEM-1024 key-exchange
+ * keypair) and persists it encrypted-at-rest under `storageDir`.
+ *
+ * Requires a passphrase of at least MIN_PASSPHRASE_LENGTH characters — this
+ * check only applies here, not to loadIdentity, so an identity created
+ * before this check existed can still be loaded with its original passphrase.
+ */
+export declare function createIdentity(options: CreateIdentityOptions): Promise<Identity>;
+export interface LoadIdentityOptions {
+    storageDir: string;
+    passphrase: string;
+}
+/** Loads a previously-created identity back from disk. */
+export declare function loadIdentity(options: LoadIdentityOptions): Promise<Identity>;
+/** The shareable public half of an identity — hand this to the other party out of band. */
+export declare function exportPublicIdentity(identity: Identity): PublicCard;

package/dist/identity.js

@@ -0,0 +1,87 @@
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { generateClassicalKeypair } from "./crypto/classical.js";
+import { decryptFromFile, encryptToFile } from "./fileCrypto.js";
+import { generatePqcKemKeypair, generatePqcSignKeypair } from "./crypto/pqc.js";
+function identityFilePath(storageDir) {
+    return join(storageDir, "identity.enc.json");
+}
+function serialize(identity) {
+    return {
+        alias: identity.alias,
+        classical: {
+            publicKey: bytesToHex(identity.classical.publicKey),
+            secretKey: bytesToHex(identity.classical.secretKey),
+        },
+        pqcSign: {
+            publicKey: bytesToHex(identity.pqcSign.publicKey),
+            secretKey: bytesToHex(identity.pqcSign.secretKey),
+        },
+        pqcKem: {
+            publicKey: bytesToHex(identity.pqcKem.publicKey),
+            secretKey: bytesToHex(identity.pqcKem.secretKey),
+        },
+    };
+}
+function deserialize(storageDir, data) {
+    return {
+        alias: data.alias,
+        storageDir,
+        classical: {
+            publicKey: hexToBytes(data.classical.publicKey),
+            secretKey: hexToBytes(data.classical.secretKey),
+        },
+        pqcSign: {
+            publicKey: hexToBytes(data.pqcSign.publicKey),
+            secretKey: hexToBytes(data.pqcSign.secretKey),
+        },
+        pqcKem: {
+            publicKey: hexToBytes(data.pqcKem.publicKey),
+            secretKey: hexToBytes(data.pqcKem.secretKey),
+        },
+    };
+}
+export const MIN_PASSPHRASE_LENGTH = 12;
+/**
+ * Generates a new hybrid classical+post-quantum identity (one ECDSA/ECDH-P384
+ * keypair, one ML-DSA-87 signing keypair, one ML-KEM-1024 key-exchange
+ * keypair) and persists it encrypted-at-rest under `storageDir`.
+ *
+ * Requires a passphrase of at least MIN_PASSPHRASE_LENGTH characters — this
+ * check only applies here, not to loadIdentity, so an identity created
+ * before this check existed can still be loaded with its original passphrase.
+ */
+export async function createIdentity(options) {
+    if (options.passphrase.length < MIN_PASSPHRASE_LENGTH) {
+        throw new Error(`Passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters long.`);
+    }
+    const filePath = identityFilePath(options.storageDir);
+    if (!options.overwrite && existsSync(filePath)) {
+        throw new Error(`An identity already exists at ${filePath}. Pass { overwrite: true } to replace it.`);
+    }
+    const identity = {
+        alias: options.alias,
+        storageDir: options.storageDir,
+        classical: generateClassicalKeypair(),
+        pqcSign: generatePqcSignKeypair(),
+        pqcKem: generatePqcKemKeypair(),
+    };
+    await encryptToFile(filePath, options.passphrase, serialize(identity));
+    return identity;
+}
+/** Loads a previously-created identity back from disk. */
+export async function loadIdentity(options) {
+    const data = await decryptFromFile(identityFilePath(options.storageDir), options.passphrase);
+    return deserialize(options.storageDir, data);
+}
+/** The shareable public half of an identity — hand this to the other party out of band. */
+export function exportPublicIdentity(identity) {
+    return {
+        alias: identity.alias,
+        classicalPublicKey: bytesToHex(identity.classical.publicKey),
+        pqcSignPublicKey: bytesToHex(identity.pqcSign.publicKey),
+        pqcKemPublicKey: bytesToHex(identity.pqcKem.publicKey),
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAA2C,MAAM,iBAAiB,CAAC;AAyBzH,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;SACpD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;SAClD;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAChD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAwB;IAC/D,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU;QACV,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAChD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SAC9C;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAUxC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+BAA+B,qBAAqB,mBAAmB,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,2CAA2C,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,QAAQ,GAAa;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,wBAAwB,EAAE;QACrC,OAAO,EAAE,sBAAsB,EAAE;QACjC,MAAM,EAAE,qBAAqB,EAAE;KAChC,CAAC;IAEF,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAqB,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACjH,OAAO,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5D,gBAAgB,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACxD,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { canonicalize, hashDocument } from "./canonicalJson.js";
+export { fingerprint } from "./fingerprint.js";
+export { decryptFrom, encryptFor, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
+export type { Certificate, EncryptedBox, VerifyFailureReason, VerifyResult } from "./crypto/nodeHybrid.js";
+export { createIdentity, exportPublicIdentity, loadIdentity, MIN_PASSPHRASE_LENGTH } from "./identity.js";
+export type { CreateIdentityOptions, Identity, LoadIdentityOptions, PublicCard } from "./identity.js";
+export { readLog, verifyLogIntegrity } from "./store.js";
+export type { LogEntry, LogIntegrityResult } from "./store.js";
+export { getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, trustParty, untrustParty, } from "./trust.js";
+export type { TrustRecord } from "./trust.js";

package/dist/index.js

@@ -0,0 +1,7 @@
+export { canonicalize, hashDocument } from "./canonicalJson.js";
+export { fingerprint } from "./fingerprint.js";
+export { decryptFrom, encryptFor, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
+export { createIdentity, exportPublicIdentity, loadIdentity, MIN_PASSPHRASE_LENGTH } from "./identity.js";
+export { readLog, verifyLogIntegrity } from "./store.js";
+export { getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, trustParty, untrustParty, } from "./trust.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1G,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC"}