Add ML-DSA-65 cold signing support and NEAR integration

Cargo.toml

@@ -82,6 +82,14 @@ nam-tiny-hderive = { version = "=0.3.1-nam.1", default-features = false }
 blake3 = "1.8"
 reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
 
+# NEAR integration: borsh transaction encoding, base58 key text forms,
+# SHA3-256 access-key handles, ed25519 parent-account signing, base64 tx submit.
+base64 = "0.22"
+borsh = { version = "1.5", features = ["derive"] }
+bs58 = "0.5"
+ed25519-dalek = "2"
+sha3 = "0.10"
+
 # Self-update: download and replace the running binary from GitHub releases.
 # 1.0.0-rc.x is required for quick-xml >= 0.41 (RUSTSEC-2026-0194 / 0195); stable
 # 0.44 still pins quick-xml ^0.38. Pulls reqwest 0.13 alongside our 0.12.

src/chain/signing.rs

@@ -57,21 +57,27 @@ context_sign!(
 	ml_dsa_65
 );
 
-/// Whether `sig_with_public` signs `message` under `context`. Cold wallets sign ML-DSA-87 only,
-/// so that is the only response the CLI checks.
-pub fn verify_ml_dsa_87(
-	sig_with_public: &Dilithium87SignatureWithPublic,
-	message: &[u8],
-	context: Option<&[u8]>,
-) -> bool {
-	let Ok(public) = qp_rusty_crystals_dilithium::ml_dsa_87::PublicKey::from_bytes(
-		sig_with_public.public().as_slice(),
-	) else {
-		return false;
+macro_rules! context_verify {
+	($verify:ident, $sig_with_public:ty, $module:ident) => {
+		/// Whether `sig_with_public` signs `message` under `context`.
+		pub fn $verify(
+			sig_with_public: &$sig_with_public,
+			message: &[u8],
+			context: Option<&[u8]>,
+		) -> bool {
+			let Ok(public) = qp_rusty_crystals_dilithium::$module::PublicKey::from_bytes(
+				sig_with_public.public().as_slice(),
+			) else {
+				return false;
+			};
+			public.verify(message, sig_with_public.signature().as_slice(), context)
+		}
 	};
-	public.verify(message, sig_with_public.signature().as_slice(), context)
 }
 
+context_verify!(verify_ml_dsa_87, Dilithium87SignatureWithPublic, ml_dsa_87);
+context_verify!(verify_ml_dsa_65, Dilithium65SignatureWithPublic, ml_dsa_65);
+
 #[cfg(test)]
 mod tests {
 	use super::*;
@@ -90,13 +96,9 @@ mod tests {
 	fn ml_dsa_65_signature_verifies_under_the_context_it_was_made_with() {
 		let pair = Dilithium65Pair::from_seed(&[7u8; 32]).expect("seed is well-formed");
 		let signature = sign_ml_dsa_65(&pair, b"payload", CTX);
-		let public = qp_rusty_crystals_dilithium::ml_dsa_65::PublicKey::from_bytes(
-			signature.public().as_slice(),
-		)
-		.expect("public key must parse");
-		let sig = signature.signature();
-		assert!(public.verify(b"payload", sig.as_slice(), CTX));
-		assert!(!public.verify(b"payload", sig.as_slice(), None));
+		assert!(verify_ml_dsa_65(&signature, b"payload", CTX));
+		assert!(!verify_ml_dsa_65(&signature, b"payload", None));
+		assert!(!verify_ml_dsa_65(&signature, b"a different payload", CTX));
 	}
 
 	/// FIPS 204 contexts are domain separated, so this cuts both ways: a spec-148 node rejects a