kxco-verify 1.0.5 → 1.2.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.1.0 — 2026-07-22
+
+Engine modernization. Public API unchanged; all 50 tests pass, including live
+verification of the pinned attestation fixtures.
+
+### Changed
+- **`@noble/post-quantum` bumped `^0.2.1` → `^0.6.1`** (FIPS 203/204/205 final
+  reference implementation). Absorbs the upstream breaking change: `ml_dsa65.verify`
+  argument order is now `(signature, message, publicKey)`, and the subpath import
+  requires the `.js` extension. Both are handled internally — `verifySignature()`
+  behaves identically.
+- `engines.node` raised to `>=20.19` to match the `@noble/post-quantum@0.6`
+  requirement.
+- `author` set to Shayne Heffernan and John Heffernan.
+
 ## 1.0.0 — 2026-05-24
 
 Stable release.

package/README.md

@@ -231,9 +231,11 @@ The verifier is architecturally independent of the signer — the two share no c
 
 ## Security
 
-Signature verification uses [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) ML-DSA-65, independently audited by Cure53 (2024) with no transitive dependencies. The library makes no outbound requests beyond the attestation URL you supply and the `pinAt` endpoint declared in the manifest. No data is sent to KXCO.
+Signature verification uses [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) ML-DSA-65, with no transitive dependencies. That package has **not** been independently audited by a third party; it has been self-audited by its maintainer. Cure53's 2023 NDS-01 audit of the `@noble` ecosystem covered `ciphers`, `curves` and `hashes`, and did not cover `@noble/post-quantum`. We state this plainly because you should not adopt a verification library on the strength of an audit that does not exist.
 
-To report a vulnerability, open a [private security advisory](https://github.com/JackKXCO/kxco-verify/security/advisories/new) or email **security@kxco.ai**.
+The library makes no outbound requests beyond the attestation URL you supply and the `pinAt` endpoint declared in the manifest. No data is sent to KXCO.
+
+To report a vulnerability, open a [private security advisory](https://github.com/KnightsbridgeAIQ/kxco-verify/security/advisories/new) or email **john@knightsbridgelaw.com**. Acknowledgement within 2 business days, triage decision within 5. Full policy, including safe harbour for good-faith research: <https://kxco.ai/security>.
 
 ---
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kxco-verify",
-  "version": "1.0.5",
-  "description": "Standalone, browser-safe verifier for KXCO ML-DSA-65 post-quantum signed attestations and credentials \u2014 for auditors, regulators, counterparties, and anyone who needs to confirm a signature without running the full KXCO SDK.",
+  "version": "1.2.0",
+  "description": "Standalone, browser-safe verifier for KXCO ML-DSA-65 post-quantum signed attestations and credentials, for auditors, regulators, counterparties, and anyone who needs to confirm a signature without running the full KXCO SDK.",
   "keywords": [
     "post-quantum",
     "pqc",
@@ -22,19 +22,23 @@
     "manifest-verification"
   ],
   "license": "Apache-2.0",
-  "author": "KXCO by Knightsbridge <hello@kxco.ai>",
+  "author": "Shayne Heffernan and John Heffernan",
   "contributors": [
-    { "name": "Shayne Heffernan" },
-    { "name": "John Heffernan" }
+    {
+      "name": "Shayne Heffernan"
+    },
+    {
+      "name": "John Heffernan"
+    }
   ],
   "homepage": "https://verify.kxco.ai",
   "funding": "https://kxco.ai",
   "repository": {
     "type": "git",
-    "url": "https://github.com/JackKXCO/kxco-verify.git"
+    "url": "https://github.com/KnightsbridgeAIQ/kxco-verify.git"
   },
   "bugs": {
-    "url": "https://github.com/JackKXCO/kxco-verify/issues"
+    "url": "https://github.com/KnightsbridgeAIQ/kxco-verify/issues"
   },
   "type": "module",
   "sideEffects": false,
@@ -65,10 +69,10 @@
     "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20.19"
   },
   "dependencies": {
-    "@noble/post-quantum": "^0.2.1"
+    "@noble/post-quantum": "0.7.0"
   },
   "scripts": {
     "test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
@@ -80,4 +84,4 @@
     "provenance": true,
     "access": "public"
   }
-}
+}

package/src/verify.js

@@ -5,7 +5,7 @@
 // from the Web Crypto API where available (browser, Node 20+), fallback to
 // node:crypto's createHash where SubtleCrypto.digest is not present.
 
-import { ml_dsa65 } from '@noble/post-quantum/ml-dsa'
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js'
 
 /**
  * Hex string → Uint8Array. Throws on malformed input.
@@ -79,10 +79,10 @@ export function verifySignature(publicKey, message, signature) {
   const pk  = typeof publicKey === 'string' ? hexToBytes(publicKey) : publicKey
   const sig = typeof signature === 'string' ? hexToBytes(signature) : signature
   const msg = typeof message   === 'string' ? utf8(message)         : message
-  // @noble/post-quantum signature: (publicKey, message, signature). Matches
-  // the canonical wrapper in kxco-post-quantum/src/ml-dsa.js.
+  // @noble/post-quantum ≥0.6 signature order: (signature, message, publicKey).
+  // Matches the canonical wrapper in kxco-post-quantum/src/ml-dsa.js.
   try {
-    return ml_dsa65.verify(pk, msg, sig)
+    return ml_dsa65.verify(sig, msg, pk)
   } catch {
     return false
   }