kxco-pq-attest 1.0.0

package/LICENSE

@@ -0,0 +1,34 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution.
+"Licensor" shall mean KXCO by Knightsbridge.
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity.
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+"Source" form shall mean the preferred form for making modifications.
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form.
+"Work" shall mean the work of authorship made available under the License.
+"Derivative Works" shall mean any work that is based on the Work.
+"Contribution" shall mean any work of authorship submitted to the Licensor for inclusion in the Work.
+"Contributor" shall mean Licensor and any Legal Entity on behalf of whom a Contribution has been received by the Licensor and incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work; and (d) If the Work includes a "NOTICE" text file, You must include a readable copy of the attribution notices contained within such NOTICE file.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor.
+
+7. Disclaimer of Warranty. THE WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.
+
+8. Limitation of Liability. IN NO EVENT SHALL ANY CONTRIBUTOR BE LIABLE FOR ANY DAMAGES ARISING FROM THIS LICENSE OR THE USE OF THE WORK.
+
+Copyright 2026 KXCO by Knightsbridge

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "kxco-pq-attest",
+  "version": "1.0.0",
+  "description": "Post-quantum attestations: sign arbitrary payloads with ML-DSA-65 (NIST FIPS 204). Produces a self-contained JSON envelope any counterparty can verify without trust delegation. Works in Node.js and Cloudflare Workers.",
+  "keywords": [
+    "post-quantum",
+    "pqc",
+    "ml-dsa",
+    "attestation",
+    "nist",
+    "fips-204",
+    "cloudflare-workers",
+    "kxco"
+  ],
+  "license": "Apache-2.0",
+  "author": "KXCO by Knightsbridge <hello@kxco.ai>",
+  "homepage": "https://kxco.ai",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/JackKXCO/kxco-pq-attest.git"
+  },
+  "bugs": {
+    "url": "https://github.com/JackKXCO/kxco-pq-attest/issues"
+  },
+  "type": "module",
+  "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "files": [
+    "src",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "dependencies": {
+    "kxco-post-quantum": "^1.1.6"
+  },
+  "scripts": {
+    "test": "node --test --test-timeout=30000 test/attest.test.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/attest.js

@@ -0,0 +1,79 @@
+import { mlDsa, fingerprint } from 'kxco-post-quantum'
+
+const VERSION = '1'
+
+function b64url(bytes) {
+  return Buffer.from(bytes).toString('base64url')
+}
+
+function fromB64url(str) {
+  return new Uint8Array(Buffer.from(str, 'base64url'))
+}
+
+function signingMsg(payloadB64, kid, issuedAt) {
+  const enc = new TextEncoder()
+  const parts = [
+    enc.encode('kxco-attest-v1\n'),
+    enc.encode(payloadB64),
+    enc.encode('\n'),
+    enc.encode(kid),
+    enc.encode('\n'),
+    enc.encode(issuedAt),
+  ]
+  const len = parts.reduce((n, a) => n + a.length, 0)
+  const msg = new Uint8Array(len)
+  let off = 0
+  for (const p of parts) { msg.set(p, off); off += p.length }
+  return msg
+}
+
+export function attest(payload, keypair) {
+  const payloadBytes = typeof payload === 'string'
+    ? new TextEncoder().encode(payload)
+    : new Uint8Array(payload)
+
+  const payloadB64 = b64url(payloadBytes)
+  const kid        = fingerprint(keypair.publicKey)
+  const issuedAt   = new Date().toISOString()
+  const msg        = signingMsg(payloadB64, kid, issuedAt)
+  const sig        = mlDsa.ml_dsa65.sign(new Uint8Array(keypair.secretKey), msg)
+
+  return {
+    'kxco-attest': VERSION,
+    payload:   payloadB64,
+    kid,
+    issuedAt,
+    signature: b64url(sig),
+  }
+}
+
+export function verify(envelope, publicKey) {
+  if (!envelope || typeof envelope !== 'object') {
+    return { valid: false, error: 'malformed envelope' }
+  }
+  if (envelope['kxco-attest'] !== VERSION) {
+    return { valid: false, error: 'unsupported version' }
+  }
+
+  const { payload: payloadB64, kid, issuedAt, signature } = envelope
+  if (!payloadB64 || !kid || !issuedAt || !signature) {
+    return { valid: false, error: 'malformed envelope' }
+  }
+
+  const msg = signingMsg(payloadB64, kid, issuedAt)
+  let ok
+  try {
+    ok = mlDsa.ml_dsa65.verify(new Uint8Array(publicKey), msg, fromB64url(signature))
+  } catch {
+    ok = false
+  }
+
+  if (!ok) return { valid: false, error: 'signature invalid' }
+
+  return {
+    valid:     true,
+    payload:   fromB64url(payloadB64),
+    signerKid: kid,
+    issuedAt,
+  }
+}

package/src/errors.js

@@ -0,0 +1,3 @@
+export class KxcoPqAttestError extends Error {
+  constructor(message) { super(message); this.name = 'KxcoPqAttestError' }
+}

package/src/index.js

@@ -0,0 +1,2 @@
+export { attest, verify } from './attest.js'
+export { KxcoPqAttestError } from './errors.js'