kxco-verify 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,28 +1,34 @@
 # Changelog
 
+## 0.1.1 — 2026-05-24
+
+Maintenance release. No breaking changes.
+
+
+
 All notable changes to this project will be documented in this file. The
 format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this project follows [Semantic Versioning](https://semver.org/).
 
-## [0.1.0] — 2026-05-22
+## [0.1.0] — 2026-05-22
 
 Initial release. Phase 1 of the [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum) evolution brief.
 
 ### Added
-- `verifyManifest(input)` — verify an attestation manifest object or JSON string. Returns the 3-state result envelope (`valid` / `invalid` / `error`).
-- `verifyUrl(url, opts?)` — fetch and verify an attestation by URL. May additionally return `rotated` when the live well-known endpoint serves a different kid than the manifest declared.
-- `parseManifest(input)` — typed-ish parser with byte-count sanity for ML-DSA-65 publicKey (1952 bytes) and signature (3309 bytes).
-- `verifySignature(publicKey, message, signature)` — ML-DSA-65 (NIST FIPS 204) verification via `@noble/post-quantum`.
-- `computeKid(publicKey)` — first 16 hex chars of SHA-256(rawPubkeyBytes). Matches the algorithm used by `kxco-post-quantum`'s `fingerprint()`.
-- `getJsonBody(url, opts?)` — fetch helper with timeout (default 3000ms), max-byte cap (default 200KB), and SSRF-aware URL validation.
-- Browser-safe implementation throughout — no `Buffer`, no `node:crypto`, no `process`. Uses `crypto.subtle` where available, falls back to `node:crypto` on Node 18.
+- `verifyManifest(input)` — verify an attestation manifest object or JSON string. Returns the 3-state result envelope (`valid` / `invalid` / `error`).
+- `verifyUrl(url, opts—)` — fetch and verify an attestation by URL. May additionally return `rotated` when the live well-known endpoint serves a different kid than the manifest declared.
+- `parseManifest(input)` — typed-ish parser with byte-count sanity for ML-DSA-65 publicKey (1952 bytes) and signature (3309 bytes).
+- `verifySignature(publicKey, message, signature)` — ML-DSA-65 (NIST FIPS 204) verification via `@noble/post-quantum`.
+- `computeKid(publicKey)` — first 16 hex chars of SHA-256(rawPubkeyBytes). Matches the algorithm used by `kxco-post-quantum`'s `fingerprint()`.
+- `getJsonBody(url, opts—)` — fetch helper with timeout (default 3000ms), max-byte cap (default 200KB), and SSRF-aware URL validation.
+- Browser-safe implementation throughout — no `Buffer`, no `node:crypto`, no `process`. Uses `crypto.subtle` where available, falls back to `node:crypto` on Node 18.
 - Live production fixtures captured in `fixtures/` for `chain.kxco.ai/wallet` and `www.target150.com`.
 - Test suite: 50 tests, 97.5%+ line coverage, includes adversarial cases (signature tampering, kid mismatch, malformed JSON, byte-length attacks).
 - Smoke script (`npm run smoke`) that exercises both production endpoints end-to-end.
 
 ### Known limitations (deliberately deferred to later phases)
 - No KXCO-controlled key registry. Verification is a math claim only.
-- No SLH-DSA-128s or hybrid envelopes — ML-DSA-65 only.
+- No SLH-DSA-128s or hybrid envelopes — ML-DSA-65 only.
 - No transparency log.
 - The browser app at `verify.kxco.ai` is gated by CORS on the target site. Sites that don't serve `Access-Control-Allow-Origin: *` on their attestation endpoint require the "paste the JSON" fallback path.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kxco-verify",
-  "version": "0.1.0",
-  "description": "Independent, browser-safe verifier for KXCO post-quantum signed deploy attestations. Verifies ML-DSA-65 (NIST FIPS 204) signatures emitted by sites that use kxco-post-quantum. No trust delegation: this library tells you whether the signature math checks out and whether the manifest-declared key matches the live well-known endpoint — it does NOT vouch for any site.",
+  "version": "0.1.1",
+  "description": "Independent, browser-safe verifier for KXCO post-quantum signed deploy attestations. Verifies ML-DSA-65 (NIST FIPS 204) signatures emitted by sites that use kxco-post-quantum. No trust delegation: this library tells you whether the signature math checks out and whether the manifest-declared key matches the live well-known endpoint \u00e2\u20ac\u201d it does NOT vouch for any site.",
   "keywords": [
     "post-quantum",
     "pqc",
@@ -31,19 +31,19 @@
   "types": "./src/index.d.ts",
   "exports": {
     ".": {
-      "types":  "./src/index.d.ts",
+      "types": "./src/index.d.ts",
       "import": "./src/index.js"
     },
     "./parse": {
-      "types":  "./src/parse.d.ts",
+      "types": "./src/parse.d.ts",
       "import": "./src/parse.js"
     },
     "./verify": {
-      "types":  "./src/verify.d.ts",
+      "types": "./src/verify.d.ts",
       "import": "./src/verify.js"
     },
     "./fetch": {
-      "types":  "./src/fetch.d.ts",
+      "types": "./src/fetch.d.ts",
       "import": "./src/fetch.js"
     }
   },
@@ -60,13 +60,13 @@
     "@noble/post-quantum": "^0.2.1"
   },
   "scripts": {
-    "test":       "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
-    "test:cov":   "node --test --experimental-test-coverage test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
-    "smoke":      "node scripts/smoke.js",
-    "lint":       "node -c src/index.js && node -c src/parse.js && node -c src/verify.js && node -c src/fetch.js"
+    "test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
+    "test:cov": "node --test --experimental-test-coverage test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
+    "smoke": "node scripts/smoke.js",
+    "lint": "node -c src/index.js && node -c src/parse.js && node -c src/verify.js && node -c src/fetch.js"
   },
   "publishConfig": {
     "provenance": true,
     "access": "public"
   }
-}
+}