npm - kxco-post-quantum - Versions diffs - 1.1.11 → 1.2.0 - Mend

kxco-post-quantum 1.1.11 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/README.md CHANGED Viewed

@@ -1,289 +1,135 @@
 # kxco-post-quantum
-**Production-tested post-quantum cryptography patterns.** Deterministic key derivation, hybrid webhook signing, and kid fingerprinting — the integration patterns KXCO uses in production across KnightsVault, KXCO Bank, KnightsBot, The Exchequer, and Armature L1.
+Post-quantum cryptography primitives for the KXCO stack.
+[![npm](https://img.shields.io/npm/v/kxco-post-quantum)](https://www.npmjs.com/package/kxco-post-quantum)
 [![CI](https://github.com/JackKXCO/kxco-post-quantum/actions/workflows/ci.yml/badge.svg)](https://github.com/JackKXCO/kxco-post-quantum/actions/workflows/ci.yml)
-[![Socket](https://socket.dev/api/badge/npm/package/kxco-post-quantum)](https://socket.dev/npm/package/kxco-post-quantum)
-[![npm provenance](https://img.shields.io/npm/v/kxco-post-quantum?label=npm%20%E2%9C%93%20provenance)](https://www.npmjs.com/package/kxco-post-quantum)
 [![license](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
-[![node](https://img.shields.io/node/v/kxco-post-quantum.svg)](https://nodejs.org)
-[![live verifier](https://img.shields.io/website?url=https%3A%2F%2Fchain.kxco.ai%2Fwallet%2Fverify&up_message=live&up_color=brightgreen&down_message=down&down_color=red&label=production)](https://chain.kxco.ai/wallet/verify)
----
+ML-DSA-65 (FIPS 204) and SLH-DSA-SHA2-192s (FIPS 205) signatures, ML-KEM-768 (FIPS 203) key encapsulation, and key fingerprinting utilities. Wraps [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) — the NIST reference implementation. All other `kxco-pq-*` packages depend on this one.
-## 60-second quickstart
+---
-Install the package, fetch a freshly signed test vector from the live KXCO platform, post it back to verify — **200 OK**. The same code path every production webhook runs.
+## Install
 ```bash
-# 1. Install
 npm install kxco-post-quantum
-# 2. Fetch a freshly signed test vector from the live KXCO platform
-curl -s https://chain.kxco.ai/wallet/api/verify-demo > vector.json
-# 3. Post it back — the server verifies HMAC + ML-DSA-65 against the live key
-node --input-type=module -e '
-  import fs from "node:fs"
-  const v = JSON.parse(fs.readFileSync("vector.json", "utf8"))
-  const h = v.headers
-  const res = await fetch("https://chain.kxco.ai/wallet/api/verify-demo", {
-    method:  "POST",
-    headers: { "Content-Type": "application/json" },
-    body:    JSON.stringify({
-      timestamp:  h["X-KXCO-Timestamp"],
-      body:       v.body,
-      hmacSecret: v.hmacSecret,
-      hmacSig:    h["X-KXCO-Signature"],
-      pqSig:      h["X-KXCO-PQ-Signature"].replace(/^ml-dsa-65=/, ""),
-      pqKid:      h["X-KXCO-PQ-Kid"],
-    }),
-  })
-  console.log(res.status, await res.json())
-'
-# → 200 { kidMatch: true, hmac: { ok: true }, pq: { ok: true }, ... }
-```
-The platform signs every fetch fresh — no cached fixtures, no replay. `verify-demo` exposes the HMAC secret for the demo only; in production the HMAC secret never leaves the receiving server.
-## Used in production at
-This is not a sample library. It runs in production at KXCO across multiple products. You can verify this yourself without any cooperation from us:
-```bash
-# Fetch the live platform PQ identity key from production
-curl https://chain.kxco.ai/wallet/api/.well-known/kxco-pq-pubkey
-# Returns a JSON document with alg=ML-DSA-65, the public key (3904 hex chars),
-# and a kid fingerprint. The kid is fingerprint(publicKey) using this library.
 ```
-The wallet at `chain.kxco.ai` imports `kxco-post-quantum` directly from npm. The platform identity signing module ([src/lib/pqSigner.js in kxco-bank](https://chain.kxco.ai/wallet/dev-docs)) delegates to `mlDsa.keypairFromMaster`, `mlDsa.sign`, and `fingerprint` from this package. Every outbound webhook from the KXCO platform is signed using `webhook.signDelivery`. You can pin the kid returned above, install this library, and verify any webhook from the production fleet offline.
-Other KXCO products on the same package: KnightsVault (institutional custody), KnightsBot (universal trading — every order signed), The Exchequer (compliance intelligence), Armature L1 (the permissioned chain underneath everything).
-## What this is
-A higher-level package that wraps [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) — the audited, dependency-free TypeScript reference implementation of NIST's August 2024 post-quantum standards — with the integration patterns we run in production:
-- **Deterministic key derivation** from a master secret via HKDF-SHA-512 with domain separation
-- **Hybrid HMAC + ML-DSA-65 webhook signing** with non-repudiation
-- **Kid fingerprints** for fast key identification in delivery headers
-- **Replay protection** through enforced timestamp windows
-- **Constant-time comparisons** where it matters
-This package does NOT reimplement the NIST primitives. Cryptographic operations defer to `@noble/post-quantum`.
+Requires Node.js 20.19+. ESM-only.
-## What it isn't
-- Not a TLS library — use OpenSSL 3.5+ or BoringSSL for `X25519MLKEM768` at the edge
-- Not a key management service — use AWS KMS, HashiCorp Vault, or an HSM for production secret storage
-- Not FIPS 140-3 certified — the underlying algorithms are FIPS-standardised; the *module* is not validated
-## Install
-```bash
-npm install @kxco/post-quantum
-```
-Requires Node.js 18+. ESM-only.
+---
 ## Quick start
-### Sign a webhook
 ```js
-import { webhook, mlDsa, fingerprint, deriveSeed } from '@kxco/post-quantum'
-// Derive a stable platform identity from your master secret
-const KXCO_KEY_MASTER = Buffer.from(process.env.KXCO_KEY_MASTER, 'hex')
-const { publicKey, secretKey } = mlDsa.keypairFromMaster(KXCO_KEY_MASTER, 'platform-v1')
-const pqKid = fingerprint(publicKey)
-// On every outbound webhook
-const rawBody = JSON.stringify(payload)
-const headers = webhook.signDelivery({
-  rawBody,
-  hmacSecret:  endpointSecret,
-  pqSecretKey: secretKey,
-  pqKid,
-  event:       'payment.settled',
-  deliveryId:  jobId,
-})
-await fetch(url, { method: 'POST', headers, body: rawBody })
+import { mlDsa, mlKem, slhDsa, fingerprint, kidEquals } from 'kxco-post-quantum'
+// ML-DSA-65 — sign and verify
+const { publicKey, secretKey } = mlDsa.keypairFromMaster(masterSecret, 'signing-v1')
+const sig = mlDsa.sign(secretKey, 'hello')
+const ok  = mlDsa.verify(publicKey, 'hello', sig)  // true
+// SLH-DSA-SHA2-192s — hash-based signatures (same API shape as mlDsa)
+const slh = slhDsa.keypairFromMaster(masterSecret, 'signing-v1')
+const slhSig = slhDsa.sign(slh.secretKey, 'hello')
+const slhOk  = slhDsa.verify(slh.publicKey, 'hello', slhSig)  // true
+// Key fingerprint
+const kid = fingerprint(publicKey)  // e.g. '4a7c9e2f1b3d5680'
+kidEquals(kid, kid)                 // true (constant-time)
+// ML-KEM-768 — key encapsulation
+const kemKeys = mlKem.keypairFromMaster(masterSecret, 'encryption-v1')
+const { ciphertext, sharedSecret } = mlKem.encapsulate(kemKeys.publicKey)
+const recovered = mlKem.decapsulate(ciphertext, kemKeys.secretKey)
+// sharedSecret and recovered are the same 32 bytes
 ```
-### Verify a webhook (receiver side)
-```js
-import { webhook } from '@kxco/post-quantum'
-// Pin these from /.well-known/kxco-pq-pubkey on first integration
-const PINNED_KID    = '4a7c9e2f1b3d5680'
-const PINNED_PUBKEY = Buffer.from('...3904 hex chars...', 'hex')
-const HMAC_SECRET   = process.env.KXCO_WEBHOOK_SECRET
-const result = webhook.verifyDelivery({
-  headers:      req.headers,
-  rawBody:      req.rawBody,      // the body bytes EXACTLY as received
-  hmacSecret:   HMAC_SECRET,
-  pqPublicKey:  PINNED_PUBKEY,
-  pinnedKid:    PINNED_KID,
-})
-if (!result.hmacOk && !result.pqOk) {
-  return res.status(401).end()
-}
-```
-### Encapsulate to a recipient
-```js
-import { mlKem } from '@kxco/post-quantum'
-// Sender side — encapsulate to the recipient's public key
-const { ciphertext, sharedSecret } = mlKem.encapsulate(recipientPubKey)
-// Use sharedSecret as an AES-256-GCM key; transmit ciphertext to the recipient
-// Recipient side — recover the same shared secret
-const recovered = mlKem.decapsulate(ciphertext, mySecretKey)
-```
+`masterSecret` is a `Buffer` or `Uint8Array` with at least 16 bytes of entropy (typically 32–64 bytes from an env var or KMS).
-### Deterministic keypair from a master secret
+---
-```js
-import { mlDsa, mlKem, deriveSeed } from '@kxco/post-quantum'
+## API
-const master = Buffer.from(process.env.KXCO_KEY_MASTER, 'hex')
+### `mlDsa` — ML-DSA-65 (NIST FIPS 204)
-// Two domain-separated keypairs from the same master
-const signing    = mlDsa.keypairFromMaster(master, 'platform-signing-v1')
-const encryption = mlKem.keypairFromMaster(master, 'platform-encryption-v1')
+| Export | Signature | Description |
+|---|---|---|
+| `keypairFromMaster` | `(master, info?) → { publicKey, secretKey }` | Deterministic keypair via HKDF-SHA-512. `info` defaults to `'ml-dsa-65-v1'`. |
+| `sign` | `(secretKey, message) → string` | Signs a message. Returns a hex-encoded signature (6618 chars). |
+| `verify` | `(publicKey, message, sigHex) → boolean` | Verifies a hex-encoded signature. Returns `false` on any failure. |
+| `ml_dsa65` | raw primitive | The underlying `@noble/post-quantum` primitive, re-exported. |
-// You can also derive raw seeds for other purposes
-const customSeed = deriveSeed(master, 'audit-trail-anchor-v1', 32)
-```
+`publicKey` is 1952 bytes. `secretKey` is 4032 bytes. `message` accepts `Buffer`, `Uint8Array`, or `string`.
-## The signed envelope
+### `slhDsa` — SLH-DSA-SHA2-192s (NIST FIPS 205)
-Both signatures cover **the exact same envelope**: `timestamp + "." + raw_body`.
+Hash-based, stateless signatures. Security Category 3 (matching ML-DSA-65), but security rests only on the SHA-2 hash function — no lattice or number-theoretic assumptions. Use this as a conservative hedge alongside `mlDsa`. Tradeoff: signatures are ~5× larger (16224 vs 3309 bytes) and signing is slower.
-```
-4a7c9e2f1b3d5680.{"event":"payment.settled","amount":1000}
-^^^ Unix seconds  ^^^ raw body, byte-for-byte
-```
+| Export | Signature | Description |
+|---|---|---|
+| `keypairFromMaster` | `(master, info?) → { publicKey, secretKey }` | Deterministic keypair via HKDF-SHA-512. `info` defaults to `'slh-dsa-sha2-192s-v1'`. |
+| `sign` | `(secretKey, message) → string` | Signs a message. Returns a hex-encoded signature (32448 chars). |
+| `verify` | `(publicKey, message, sigHex) → boolean` | Verifies a hex-encoded signature. Returns `false` on any failure. |
+| `slh_dsa_sha2_192s` | raw primitive | The underlying `@noble/post-quantum` primitive, re-exported. |
-This means receivers can verify either signature independently. Verifying both is defence-in-depth: HMAC blocks tampering by anyone without the shared secret, while ML-DSA-65 binds the message to the platform identity even if the HMAC secret leaks.
+`publicKey` is 48 bytes. `secretKey` is 96 bytes. `message` accepts `Buffer`, `Uint8Array`, or `string`.
-## Why hybrid (HMAC + PQ) instead of PQ-only?
+### `mlKem` — ML-KEM-768 (NIST FIPS 203)
-| Concern | HMAC-SHA-256 | ML-DSA-65 |
+| Export | Signature | Description |
 |---|---|---|
-| Symmetric / asymmetric | Symmetric | Asymmetric |
-| Post-quantum secure | ✓ | ✓ |
-| Verify offline with shared secret | ✓ | — |
-| Non-repudiation | ✗ — anyone with the secret can forge | ✓ — only the holder of the private key can sign |
-| Library required to verify | none | a FIPS-204 library |
-| Signature size | 32 bytes | 3309 bytes |
-You get the cheap-and-easy verification path AND cryptographic identity binding. Receivers can adopt one signature first and the other later, or both from day one.
+| `keypairFromMaster` | `(master, info?) → { publicKey, secretKey }` | Deterministic keypair via HKDF-SHA-512. `info` defaults to `'ml-kem-768-v1'`. |
+| `encapsulate` | `(publicKey) → { ciphertext, sharedSecret }` | Generates a shared secret and ciphertext to send to the key holder. |
+| `decapsulate` | `(ciphertext, secretKey) → Buffer` | Recovers the shared secret from a ciphertext. Returns 32 bytes. |
+| `ml_kem768` | raw primitive | The underlying `@noble/post-quantum` primitive, re-exported. |
-## API
+`publicKey` is 1184 bytes. `ciphertext` is 1088 bytes. `sharedSecret` is 32 bytes.
-### `mlDsa` — ML-DSA-65 (NIST FIPS 204, Dilithium3)
+### `fingerprint(publicKey)` → `string`
-- `keypairFromMaster(master, info?)` → `{ publicKey, secretKey }`
-- `sign(secretKey, message)` → hex string
-- `verify(publicKey, message, sigHex)` → boolean
-- `ml_dsa65` — the raw `@noble/post-quantum` primitive, re-exported
+First 16 hex characters of SHA-256 of the public key. Stable for the lifetime of the key. Accepts raw bytes or a hex string.
-### `mlKem` — ML-KEM-768 (NIST FIPS 203, Kyber768)
+### `kidEquals(a, b)` → `boolean`
-- `keypairFromMaster(master, info?)` → `{ publicKey, secretKey }`
-- `encapsulate(publicKey)` → `{ ciphertext, sharedSecret }`
-- `decapsulate(ciphertext, secretKey)` → `Buffer`
-- `ml_kem768` — the raw `@noble/post-quantum` primitive, re-exported
+Constant-time comparison of two kid strings. Use this when comparing user-supplied input — not `===`.
 ### `deriveSeed(master, info, length)` → `Buffer`
-HKDF-SHA-512 derivation. Empty salt is fine when `master` has high entropy. Domain-separate via `info`.
-### `fingerprint(publicKey)` → 16-hex `kid`
-First 16 hex characters of SHA-256 of the public key. Stable for the lifetime of the key.
-### `kidEquals(a, b)` → boolean
+HKDF-SHA-512 derivation. `master` must be at least 16 bytes. `info` is a required domain-separation string. Returns `length` bytes.
-Constant-time string compare. Use this when comparing user-supplied kids.
+### `webhook` — hybrid HMAC + ML-DSA-65 delivery signing
-### `webhook` — hybrid signing utilities
+Low-level helpers for the KXCO hybrid webhook pattern: `envelope`, `hmacHex`, `verifyHmac`, `pqSign`, `verifyPq`, `signDelivery`, `verifyDelivery`. HMAC-SHA-256 gives symmetric verification with no library dependency; ML-DSA-65 adds non-repudiation over the same `${timestamp}.${body}` envelope. The full identity/credential surface lives in `kxco-pq-sdk`.
-- `envelope(timestamp, rawBody)` → `Buffer`
-- `hmacHex(secret, timestamp, rawBody)` → hex string
-- `verifyHmac(secret, timestamp, rawBody, sigHeader)` → boolean
-- `pqSign(secretKey, timestamp, rawBody)` → `ml-dsa-65=<hex>` header value
-- `verifyPq(publicKey, timestamp, rawBody, sigHeader)` → boolean
-- `signDelivery({ rawBody, hmacSecret, pqSecretKey, pqKid, ... })` → header map
-- `verifyDelivery({ headers, rawBody, hmacSecret?, pqPublicKey?, pinnedKid?, windowSeconds? })` → `{ hmacOk, pqOk, timestampOk, kidOk }`
-## Security notes
-- **Keep your master secret in environment variables or a KMS / HSM.** Never commit it.
-- **Use domain separation.** Two purposes = two distinct `info` strings.
-- **Pin the kid.** Don't trust the public key on every request — fetch and pin it once.
-- **Receive raw bodies byte-for-byte.** Re-stringifying JSON before verifying changes the signature input.
-- **Enforce timestamp windows.** Defaults to 5 minutes. Set lower for higher-security paths.
-- **Constant-time compare strings.** Use `kidEquals` and `verifyHmac`, not `===`.
-## Reproducibility
-Every public output is pinned in `test/vectors.json`. Run them:
+---
-```bash
-git clone https://github.com/JackKXCO/kxco-post-quantum
-cd kxco-post-quantum
-npm install
-npm test          # 9 functional tests + 29 vector checks
-npm run test:vectors   # vectors only
-```
+## What this does NOT do
-Expected output: `✓ All 29 checks pass — library output matches pinned vectors bit-for-bit.`
+- No identity credentials or verifiable claims (those are in `kxco-pq-sdk`)
+- No relay, transport, or network layer
+- No key storage or KMS integration
+- No FIPS 140-3 module validation (the algorithms are FIPS-standardised; the module is not validated)
-If any check fails on a release version, file an issue. The vectors are the tripwire for cryptographic regressions.
+---
-## Audit posture
+## Part of the KXCO stack
-See [AUDIT.md](./AUDIT.md) for the full statement. Short version:
+`kxco-post-quantum` is the primitive layer. Everything else builds on it:
-- **Underlying primitives** (`@noble/post-quantum@0.2.1`) — audited by Cure53, 2024
-- **This wrapper** — no third-party audit yet. Roadmap: external audit Q3 2026, public bug bounty Q4 2026, FIPS 140-3 CMVP application 2027
-- **Internal review** — KXCO Engineering + Cybersecurity (lead: Sean O'Coiligh, ex-DTCC Offensive Cyber)
-- **Production deployment** — live at chain.kxco.ai since 2025-11
+- **`kxco-pq-sdk`** — identity credentials, webhook signing, verifiable claims
+- Other `kxco-pq-*` packages — domain-specific integrations
-## References
+Install this package directly when you need ML-DSA or ML-KEM without the rest of the identity stack.
-- [NIST FIPS 204 — Module-Lattice-Based Digital Signature Standard](https://csrc.nist.gov/pubs/fips/204/final)
-- [NIST FIPS 203 — Module-Lattice-Based Key-Encapsulation Mechanism Standard](https://csrc.nist.gov/pubs/fips/203/final)
-- [NSA CNSA 2.0](https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF)
-- [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) — the underlying audited implementation
-- [RFC 9106 — Argon2](https://datatracker.ietf.org/doc/html/rfc9106)
+---
 ## Security
-Cryptographic primitives are provided by [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) and [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) — independently audited by Cure53 (2024). This package does not reimplement any NIST primitive; all ML-DSA-65 and ML-KEM-768 operations delegate entirely to the audited upstream.
-To report a vulnerability, open a [private security advisory](https://github.com/JackKXCO/kxco-post-quantum/security/advisories/new) or email **security@kxco.ai**.
-## Funding
-Maintained by **Shayne Heffernan** and **John Heffernan** at [KXCO by Knightsbridge](https://kxco.ai).
+Cryptographic operations delegate entirely to [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) and [`@noble/hashes`](https://github.com/paulmillr/noble-hashes), audited by Cure53 (2024). This package does not reimplement any NIST primitive.
-[Knightsbridge Law](https://knightsbridge.law) · [target150.com](https://target150.com) · [livetradingnews.com](https://livetradingnews.com)
-## About KXCO
-KXCO by Knightsbridge is the unification layer for global trade — settlement, issuance, compliance, custody, trading. Quantum-resistant by design. Visit [kxco.ai](https://kxco.ai).
+To report a vulnerability: [open a private security advisory](https://github.com/JackKXCO/kxco-post-quantum/security/advisories/new) or email **security@kxco.ai**.
 ## License
@@ -291,6 +137,4 @@ MIT. See [LICENSE](./LICENSE).
 ## Maintainers
-Shayne Heffernan · John Heffernan — [KXCO by Knightsbridge](https://kxco.ai)
-Deployed in production at [target150.com](https://target150.com), [knightsbridgelaw.com](https://knightsbridgelaw.com), [livetradingnews.com](https://livetradingnews.com).
+Shayne Heffernan and John Heffernan — [KXCO by Knightsbridge](https://kxco.ai)

package/SECURITY.md CHANGED Viewed

@@ -1,27 +1,28 @@
-# Security Policy
-## Reporting a vulnerability
-Email **security@kxco.ai**. Do not open public issues for security reports.
-PGP key available on request. We respond within 48 hours and credit reporters
-in `CHANGELOG.md` unless they request otherwise.
-## Scope
-In scope:
-- Cryptographic correctness of the wrappers in this package
-- Constant-time guarantees on signature/HMAC comparison
-- Replay-window enforcement in `webhook.verify`
-- HKDF domain separation in `derive`
-- Kid fingerprint collision behaviour
-Out of scope (report upstream to https://github.com/paulmillr/noble-post-quantum):
-- Bugs in the underlying ML-DSA-65, ML-KEM-768, or HKDF primitives
-## Algorithms used
-- ML-DSA-65 — NIST FIPS 204 (lattice signatures)
-- ML-KEM-768 — NIST FIPS 203 (key encapsulation)
-- HMAC-SHA-256
-- HKDF-SHA-512 (RFC 5869)
-## Disclosure
-We follow coordinated disclosure with a 90-day default window.
-For actively-exploited issues we ship a patch release within 48 hours.
+# Security Policy
+## Reporting a vulnerability
+Email **security@kxco.ai**. Do not open public issues for security reports.
+PGP key available on request. We respond within 48 hours and credit reporters
+in `CHANGELOG.md` unless they request otherwise.
+## Scope
+In scope:
+- Cryptographic correctness of the wrappers in this package
+- Constant-time guarantees on signature/HMAC comparison
+- Replay-window enforcement in `webhook.verify`
+- HKDF domain separation in `derive`
+- Kid fingerprint collision behaviour
+Out of scope (report upstream to https://github.com/paulmillr/noble-post-quantum):
+- Bugs in the underlying ML-DSA-65, ML-KEM-768, SLH-DSA-SHA2-192s, or HKDF primitives
+## Algorithms used
+- ML-DSA-65 — NIST FIPS 204 (lattice signatures)
+- ML-KEM-768 — NIST FIPS 203 (key encapsulation)
+- SLH-DSA-SHA2-192s — NIST FIPS 205 (hash-based signatures)
+- HMAC-SHA-256
+- HKDF-SHA-512 (RFC 5869)
+## Disclosure
+We follow coordinated disclosure with a 90-day default window.
+For actively-exploited issues we ship a patch release within 48 hours.

package/package.json CHANGED Viewed

@@ -1,100 +1,107 @@
-{
-  "name": "kxco-post-quantum",
-  "version": "1.1.11",
-  "description": "Production-tested post-quantum cryptography patterns: deterministic key derivation, hybrid webhook signing, and kid fingerprinting. Built on @noble/post-quantum. Used in production at KXCO.",
-  "keywords": [
-    "post-quantum",
-    "pqc",
-    "ml-dsa",
-    "ml-kem",
-    "dilithium",
-    "kyber",
-    "nist",
-    "fips-203",
-    "fips-204",
-    "webhook-signing",
-    "quantum-resistant",
-    "armature",
-    "key-derivation",
-    "hkdf",
-    "deterministic-keys",
-    "fingerprint",
-    "replay-protection",
-    "constant-time",
-    "hybrid-signing",
-    "non-repudiation"
-  ],
-  "license": "MIT",
-  "author": "KXCO by Knightsbridge <hello@kxco.ai>",
-  "contributors": [
-    {
-      "name": "Shayne Heffernan"
-    },
-    {
-      "name": "John Heffernan"
-    }
-  ],
-  "homepage": "https://kxco.ai",
-  "funding": "https://kxco.ai",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/JackKXCO/kxco-post-quantum.git"
-  },
-  "bugs": {
-    "url": "https://github.com/JackKXCO/kxco-post-quantum/issues"
-  },
-  "type": "module",
-  "sideEffects": false,
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.d.ts",
-      "import": "./src/index.js"
-    },
-    "./ml-dsa": {
-      "types": "./src/ml-dsa.d.ts",
-      "import": "./src/ml-dsa.js"
-    },
-    "./ml-kem": {
-      "types": "./src/ml-kem.d.ts",
-      "import": "./src/ml-kem.js"
-    },
-    "./derive": {
-      "types": "./src/derive.d.ts",
-      "import": "./src/derive.js"
-    },
-    "./webhook": {
-      "types": "./src/webhook.d.ts",
-      "import": "./src/webhook.js"
-    },
-    "./kid": {
-      "types": "./src/kid.d.ts",
-      "import": "./src/kid.js"
-    }
-  },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "SECURITY.md",
-    "CHANGELOG.md"
-  ],
-  "engines": {
-    "node": ">=20.19"
-  },
-  "dependencies": {
-    "@noble/hashes": "^2.2.0",
-    "@noble/post-quantum": "^0.2.1"
-  },
-  "scripts": {
-    "test": "node --test test/basic.test.js && node --test test/browser-smoke.test.js && node test/run-vectors.js",
-    "test:vectors": "node test/run-vectors.js",
-    "generate:vectors": "node test/generate-vectors.js > test/vectors.json",
-    "bench": "node bench/bench.js"
-  },
-  "publishConfig": {
-    "provenance": true,
-    "access": "public"
-  }
-}
+{
+  "name": "kxco-post-quantum",
+  "version": "1.2.0",
+  "description": "ML-DSA-65, ML-KEM-768 and SLH-DSA-SHA2-192s primitives with key fingerprinting. The base layer for all kxco-pq-* packages.",
+  "keywords": [
+    "post-quantum",
+    "pqc",
+    "ml-dsa",
+    "ml-kem",
+    "slh-dsa",
+    "sphincs",
+    "dilithium",
+    "kyber",
+    "nist",
+    "fips-203",
+    "fips-204",
+    "fips-205",
+    "webhook-signing",
+    "quantum-resistant",
+    "armature",
+    "key-derivation",
+    "hkdf",
+    "deterministic-keys",
+    "fingerprint",
+    "replay-protection",
+    "constant-time",
+    "hybrid-signing",
+    "non-repudiation"
+  ],
+  "license": "MIT",
+  "author": "KXCO by Knightsbridge <hello@kxco.ai>",
+  "contributors": [
+    {
+      "name": "Shayne Heffernan"
+    },
+    {
+      "name": "John Heffernan"
+    }
+  ],
+  "homepage": "https://kxco.ai",
+  "funding": "https://kxco.ai",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/JackKXCO/kxco-post-quantum.git"
+  },
+  "bugs": {
+    "url": "https://github.com/JackKXCO/kxco-post-quantum/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "import": "./src/index.js"
+    },
+    "./ml-dsa": {
+      "types": "./src/ml-dsa.d.ts",
+      "import": "./src/ml-dsa.js"
+    },
+    "./ml-kem": {
+      "types": "./src/ml-kem.d.ts",
+      "import": "./src/ml-kem.js"
+    },
+    "./slh-dsa": {
+      "types": "./src/slh-dsa.d.ts",
+      "import": "./src/slh-dsa.js"
+    },
+    "./derive": {
+      "types": "./src/derive.d.ts",
+      "import": "./src/derive.js"
+    },
+    "./webhook": {
+      "types": "./src/webhook.d.ts",
+      "import": "./src/webhook.js"
+    },
+    "./kid": {
+      "types": "./src/kid.d.ts",
+      "import": "./src/kid.js"
+    }
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "SECURITY.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "dependencies": {
+    "@noble/hashes": "^2.2.0",
+    "@noble/post-quantum": "^0.6.1"
+  },
+  "scripts": {
+    "test": "node --test test/basic.test.js && node --test test/browser-smoke.test.js && node test/run-vectors.js",
+    "test:vectors": "node test/run-vectors.js",
+    "generate:vectors": "node test/generate-vectors.js > test/vectors.json",
+    "bench": "node bench/bench.js"
+  },
+  "publishConfig": {
+    "provenance": true,
+    "access": "public"
+  }
+}