kxco-verify 1.2.0 → 1.2.2

package/package.json

@@ -1,87 +1,87 @@
-{
-  "name": "kxco-verify",
-  "version": "1.2.0",
-  "description": "Standalone, browser-safe verifier for KXCO ML-DSA-65 post-quantum signed attestations and credentials, for auditors, regulators, counterparties, and anyone who needs to confirm a signature without running the full KXCO SDK.",
-  "keywords": [
-    "post-quantum",
-    "pqc",
-    "ml-dsa",
-    "dilithium",
-    "nist",
-    "fips-204",
-    "verification",
-    "attestation",
-    "verify",
-    "kxco-post-quantum",
-    "browser",
-    "browser-safe",
-    "zero-dependencies",
-    "supply-chain",
-    "deploy-attestation",
-    "provenance",
-    "manifest-verification"
-  ],
-  "license": "Apache-2.0",
-  "author": "Shayne Heffernan and John Heffernan",
-  "contributors": [
-    {
-      "name": "Shayne Heffernan"
-    },
-    {
-      "name": "John Heffernan"
-    }
-  ],
-  "homepage": "https://verify.kxco.ai",
-  "funding": "https://kxco.ai",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/KnightsbridgeAIQ/kxco-verify.git"
-  },
-  "bugs": {
-    "url": "https://github.com/KnightsbridgeAIQ/kxco-verify/issues"
-  },
-  "type": "module",
-  "sideEffects": false,
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.d.ts",
-      "import": "./src/index.js"
-    },
-    "./parse": {
-      "types": "./src/parse.d.ts",
-      "import": "./src/parse.js"
-    },
-    "./verify": {
-      "types": "./src/verify.d.ts",
-      "import": "./src/verify.js"
-    },
-    "./fetch": {
-      "types": "./src/fetch.d.ts",
-      "import": "./src/fetch.js"
-    }
-  },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md"
-  ],
-  "engines": {
-    "node": ">=20.19"
-  },
-  "dependencies": {
-    "@noble/post-quantum": "0.7.0"
-  },
-  "scripts": {
-    "test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
-    "test:cov": "node --test --experimental-test-coverage test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
-    "smoke": "node scripts/smoke.js",
-    "lint": "node -c src/index.js && node -c src/parse.js && node -c src/verify.js && node -c src/fetch.js"
-  },
-  "publishConfig": {
-    "provenance": true,
-    "access": "public"
-  }
-}
+{
+  "name": "kxco-verify",
+  "version": "1.2.2",
+  "description": "Standalone, browser-safe verifier for KXCO ML-DSA-65 post-quantum signed attestations and credentials, for auditors, regulators, counterparties, and anyone who needs to confirm a signature without running the full KXCO SDK.",
+  "keywords": [
+    "post-quantum",
+    "pqc",
+    "ml-dsa",
+    "dilithium",
+    "nist",
+    "fips-204",
+    "verification",
+    "attestation",
+    "verify",
+    "kxco-post-quantum",
+    "browser",
+    "browser-safe",
+    "zero-dependencies",
+    "supply-chain",
+    "deploy-attestation",
+    "provenance",
+    "manifest-verification"
+  ],
+  "license": "Apache-2.0",
+  "author": "Shayne Heffernan and John Heffernan",
+  "contributors": [
+    {
+      "name": "Shayne Heffernan"
+    },
+    {
+      "name": "John Heffernan"
+    }
+  ],
+  "homepage": "https://verify.kxco.ai",
+  "funding": "https://kxco.ai",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/KnightsbridgeAIQ/kxco-verify.git"
+  },
+  "bugs": {
+    "url": "https://github.com/KnightsbridgeAIQ/kxco-verify/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "import": "./src/index.js"
+    },
+    "./parse": {
+      "types": "./src/parse.d.ts",
+      "import": "./src/parse.js"
+    },
+    "./verify": {
+      "types": "./src/verify.d.ts",
+      "import": "./src/verify.js"
+    },
+    "./fetch": {
+      "types": "./src/fetch.d.ts",
+      "import": "./src/fetch.js"
+    }
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "dependencies": {
+    "@noble/post-quantum": "0.7.0"
+  },
+  "scripts": {
+    "test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
+    "test:cov": "node --test --experimental-test-coverage test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
+    "smoke": "node scripts/smoke.js",
+    "lint": "node -c src/index.js && node -c src/parse.js && node -c src/verify.js && node -c src/fetch.js"
+  },
+  "publishConfig": {
+    "provenance": true,
+    "access": "public"
+  }
+}

package/src/fetch.d.ts

@@ -1,28 +1,28 @@
-export interface FetchOk {
-  ok: true
-  url: string
-  status: number
-  body: string
-}
-
-export interface FetchErr {
-  ok: false
-  error: {
-    kind: 'fetch'
-    code: 'no_fetch' | 'invalid_url' | 'timeout' | 'network' | 'http_status' | 'too_large' | 'read'
-    message: string
-    url?: string
-    status?: number
-  }
-}
-
-export interface GetJsonBodyOpts {
-  timeoutMs?: number
-  maxBytes?: number
-  fetchImpl?: typeof fetch
-}
-
-export function getJsonBody(
-  url: string,
-  opts?: GetJsonBodyOpts,
-): Promise<FetchOk | FetchErr>
+export interface FetchOk {
+  ok: true
+  url: string
+  status: number
+  body: string
+}
+
+export interface FetchErr {
+  ok: false
+  error: {
+    kind: 'fetch'
+    code: 'no_fetch' | 'invalid_url' | 'timeout' | 'network' | 'http_status' | 'too_large' | 'read'
+    message: string
+    url?: string
+    status?: number
+  }
+}
+
+export interface GetJsonBodyOpts {
+  timeoutMs?: number
+  maxBytes?: number
+  fetchImpl?: typeof fetch
+}
+
+export function getJsonBody(
+  url: string,
+  opts?: GetJsonBodyOpts,
+): Promise<FetchOk | FetchErr>

package/src/fetch.js

@@ -1,100 +1,100 @@
-// Network fetching. Browser-safe (uses global `fetch`), with a hard timeout
-// per request via AbortController so a slow target site cannot hang the
-// verifier. Returns either { ok: true, body, url, status } or
-// { ok: false, error: { kind: 'fetch', code, message } }.
-
-const DEFAULT_TIMEOUT_MS = 3000
-const DEFAULT_MAX_BYTES  = 200_000   // attestation manifests are ~11KB; cap at 200KB
-
-/**
- * @typedef {Object} FetchOk
- * @property {true}    ok
- * @property {string}  url
- * @property {number}  status
- * @property {string}  body
- *
- * @typedef {Object} FetchErr
- * @property {false}  ok
- * @property {{ kind: 'fetch', code: string, message: string, url?: string, status?: number }} error
- */
-
-/**
- * GET a URL with a timeout, returning the body as a UTF-8 string. Caps the
- * response at maxBytes to defend against memory blow-ups from a hostile
- * target. Does NOT throw — always returns a tagged result.
- *
- * @param {string} url
- * @param {{ timeoutMs?: number, maxBytes?: number, fetchImpl?: typeof fetch }} [opts]
- * @returns {Promise<FetchOk | FetchErr>}
- */
-export async function getJsonBody(url, opts = {}) {
-  const timeoutMs = typeof opts.timeoutMs === 'number' ? opts.timeoutMs : DEFAULT_TIMEOUT_MS
-  const maxBytes  = typeof opts.maxBytes  === 'number' ? opts.maxBytes  : DEFAULT_MAX_BYTES
-  const f         = opts.fetchImpl || globalThis.fetch
-
-  if (typeof f !== 'function') {
-    return errFetch_('no_fetch', 'global fetch() not available; pass opts.fetchImpl', { url })
-  }
-  if (typeof url !== 'string' || (!url.startsWith('http://') && !url.startsWith('https://'))) {
-    return errFetch_('invalid_url', 'url must be an absolute http(s) URL', { url })
-  }
-
-  const ctrl = new AbortController()
-  const timer = setTimeout(() => ctrl.abort(), timeoutMs)
-  let res
-  try {
-    res = await f(url, { signal: ctrl.signal, redirect: 'follow', headers: { 'Accept': 'application/json' } })
-  } catch (err) {
-    clearTimeout(timer)
-    const code = err && err.name === 'AbortError' ? 'timeout' : 'network'
-    return errFetch_(code, code === 'timeout' ? `fetch timed out after ${timeoutMs}ms` : `network error: ${err.message}`, { url })
-  }
-  clearTimeout(timer)
-
-  if (!res.ok) {
-    return errFetch_('http_status', `HTTP ${res.status}`, { url, status: res.status })
-  }
-
-  // Read with a byte cap to prevent OOM on hostile responses.
-  let body
-  try {
-    body = await readWithCap_(res, maxBytes)
-  } catch (err) {
-    if (err && err.code === 'too_large') {
-      return errFetch_('too_large', `response exceeded ${maxBytes} bytes`, { url, status: res.status })
-    }
-    return errFetch_('read', `failed to read response body: ${err.message}`, { url, status: res.status })
-  }
-
-  return { ok: true, url, status: res.status, body }
-}
-
-async function readWithCap_(res, maxBytes) {
-  if (!res.body || typeof res.body.getReader !== 'function') {
-    // Fallback for environments without streams: read the whole text, check size.
-    const text = await res.text()
-    if (text.length > maxBytes * 4) { const e = new Error('too large'); e.code = 'too_large'; throw e }
-    return text
-  }
-  const reader = res.body.getReader()
-  const chunks = []
-  let total = 0
-  while (true) {
-    const { done, value } = await reader.read()
-    if (done) break
-    total += value.length
-    if (total > maxBytes) {
-      try { await reader.cancel() } catch {}
-      const e = new Error('too large'); e.code = 'too_large'; throw e
-    }
-    chunks.push(value)
-  }
-  const merged = new Uint8Array(total)
-  let off = 0
-  for (const c of chunks) { merged.set(c, off); off += c.length }
-  return new TextDecoder('utf-8').decode(merged)
-}
-
-function errFetch_(code, message, extra = {}) {
-  return { ok: false, error: { kind: 'fetch', code, message, ...extra } }
-}
+// Network fetching. Browser-safe (uses global `fetch`), with a hard timeout
+// per request via AbortController so a slow target site cannot hang the
+// verifier. Returns either { ok: true, body, url, status } or
+// { ok: false, error: { kind: 'fetch', code, message } }.
+
+const DEFAULT_TIMEOUT_MS = 3000
+const DEFAULT_MAX_BYTES  = 200_000   // attestation manifests are ~11KB; cap at 200KB
+
+/**
+ * @typedef {Object} FetchOk
+ * @property {true}    ok
+ * @property {string}  url
+ * @property {number}  status
+ * @property {string}  body
+ *
+ * @typedef {Object} FetchErr
+ * @property {false}  ok
+ * @property {{ kind: 'fetch', code: string, message: string, url?: string, status?: number }} error
+ */
+
+/**
+ * GET a URL with a timeout, returning the body as a UTF-8 string. Caps the
+ * response at maxBytes to defend against memory blow-ups from a hostile
+ * target. Does NOT throw — always returns a tagged result.
+ *
+ * @param {string} url
+ * @param {{ timeoutMs?: number, maxBytes?: number, fetchImpl?: typeof fetch }} [opts]
+ * @returns {Promise<FetchOk | FetchErr>}
+ */
+export async function getJsonBody(url, opts = {}) {
+  const timeoutMs = typeof opts.timeoutMs === 'number' ? opts.timeoutMs : DEFAULT_TIMEOUT_MS
+  const maxBytes  = typeof opts.maxBytes  === 'number' ? opts.maxBytes  : DEFAULT_MAX_BYTES
+  const f         = opts.fetchImpl || globalThis.fetch
+
+  if (typeof f !== 'function') {
+    return errFetch_('no_fetch', 'global fetch() not available; pass opts.fetchImpl', { url })
+  }
+  if (typeof url !== 'string' || (!url.startsWith('http://') && !url.startsWith('https://'))) {
+    return errFetch_('invalid_url', 'url must be an absolute http(s) URL', { url })
+  }
+
+  const ctrl = new AbortController()
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs)
+  let res
+  try {
+    res = await f(url, { signal: ctrl.signal, redirect: 'follow', headers: { 'Accept': 'application/json' } })
+  } catch (err) {
+    clearTimeout(timer)
+    const code = err && err.name === 'AbortError' ? 'timeout' : 'network'
+    return errFetch_(code, code === 'timeout' ? `fetch timed out after ${timeoutMs}ms` : `network error: ${err.message}`, { url })
+  }
+  clearTimeout(timer)
+
+  if (!res.ok) {
+    return errFetch_('http_status', `HTTP ${res.status}`, { url, status: res.status })
+  }
+
+  // Read with a byte cap to prevent OOM on hostile responses.
+  let body
+  try {
+    body = await readWithCap_(res, maxBytes)
+  } catch (err) {
+    if (err && err.code === 'too_large') {
+      return errFetch_('too_large', `response exceeded ${maxBytes} bytes`, { url, status: res.status })
+    }
+    return errFetch_('read', `failed to read response body: ${err.message}`, { url, status: res.status })
+  }
+
+  return { ok: true, url, status: res.status, body }
+}
+
+async function readWithCap_(res, maxBytes) {
+  if (!res.body || typeof res.body.getReader !== 'function') {
+    // Fallback for environments without streams: read the whole text, check size.
+    const text = await res.text()
+    if (text.length > maxBytes * 4) { const e = new Error('too large'); e.code = 'too_large'; throw e }
+    return text
+  }
+  const reader = res.body.getReader()
+  const chunks = []
+  let total = 0
+  while (true) {
+    const { done, value } = await reader.read()
+    if (done) break
+    total += value.length
+    if (total > maxBytes) {
+      try { await reader.cancel() } catch {}
+      const e = new Error('too large'); e.code = 'too_large'; throw e
+    }
+    chunks.push(value)
+  }
+  const merged = new Uint8Array(total)
+  let off = 0
+  for (const c of chunks) { merged.set(c, off); off += c.length }
+  return new TextDecoder('utf-8').decode(merged)
+}
+
+function errFetch_(code, message, extra = {}) {
+  return { ok: false, error: { kind: 'fetch', code, message, ...extra } }
+}

package/src/index.d.ts

@@ -1,57 +1,57 @@
-export type VerifyState = 'valid' | 'rotated' | 'invalid' | 'error'
-
-export interface VerifyResultError {
-  kind: 'parse' | 'fetch' | 'signature' | 'consistency' | 'rotation'
-  code: string
-  message: string
-  /** true when the error is non-fatal (math succeeded but a soft check failed). */
-  soft?: boolean
-  [k: string]: unknown
-}
-
-export interface VerifyResult {
-  state: VerifyState
-  algorithm?: 'ML-DSA-65'
-  /** kid as declared inside the manifest itself */
-  manifestKid?: string
-  /** kid currently served at the live well-known pubkey endpoint (when fetched) */
-  livePubkeyKid?: string
-  /** site identifier as declared by the manifest */
-  site?: string
-  /** opaque deployment metadata from the manifest */
-  deployment?: Record<string, unknown>
-  /** full parsed manifest JSON, for UI display */
-  manifestRaw?: Record<string, unknown>
-  /** present when state is "error", "invalid", or "rotated" */
-  error?: VerifyResultError
-  attestationUrl?: string
-  /** URL of the live well-known pubkey endpoint (only present when fetched) */
-  pubkeyUrl?: string
-  /** Date.now() at the moment verification finished */
-  verifiedAtMs?: number
-}
-
-export interface VerifyUrlOpts {
-  timeoutMs?: number
-  maxBytes?: number
-  fetchImpl?: typeof fetch
-  /** When true, skip fetching the live well-known pubkey (no rotation detection). */
-  skipLivePubkey?: boolean
-}
-
-/**
- * Verify an attestation manifest you already have in hand.
- * Result is "valid" / "invalid" / "error" — never "rotated" (no live fetch).
- */
-export function verifyManifest(manifestBody: string | object): Promise<VerifyResult>
-
-/**
- * Verify an attestation by URL. May return "rotated" if the live well-known
- * pubkey endpoint serves a different kid than the manifest declared.
- */
-export function verifyUrl(attestationUrl: string, opts?: VerifyUrlOpts): Promise<VerifyResult>
-
-// Re-exports.
-export { parseManifest, ParseResult, ParsedManifest, ParseError } from './parse.js'
-export { verifySignature, computeKid, hexToBytes, bytesToHex, hexEquals } from './verify.js'
-export { getJsonBody, FetchOk, FetchErr, GetJsonBodyOpts }            from './fetch.js'
+export type VerifyState = 'valid' | 'rotated' | 'invalid' | 'error'
+
+export interface VerifyResultError {
+  kind: 'parse' | 'fetch' | 'signature' | 'consistency' | 'rotation'
+  code: string
+  message: string
+  /** true when the error is non-fatal (math succeeded but a soft check failed). */
+  soft?: boolean
+  [k: string]: unknown
+}
+
+export interface VerifyResult {
+  state: VerifyState
+  algorithm?: 'ML-DSA-65'
+  /** kid as declared inside the manifest itself */
+  manifestKid?: string
+  /** kid currently served at the live well-known pubkey endpoint (when fetched) */
+  livePubkeyKid?: string
+  /** site identifier as declared by the manifest */
+  site?: string
+  /** opaque deployment metadata from the manifest */
+  deployment?: Record<string, unknown>
+  /** full parsed manifest JSON, for UI display */
+  manifestRaw?: Record<string, unknown>
+  /** present when state is "error", "invalid", or "rotated" */
+  error?: VerifyResultError
+  attestationUrl?: string
+  /** URL of the live well-known pubkey endpoint (only present when fetched) */
+  pubkeyUrl?: string
+  /** Date.now() at the moment verification finished */
+  verifiedAtMs?: number
+}
+
+export interface VerifyUrlOpts {
+  timeoutMs?: number
+  maxBytes?: number
+  fetchImpl?: typeof fetch
+  /** When true, skip fetching the live well-known pubkey (no rotation detection). */
+  skipLivePubkey?: boolean
+}
+
+/**
+ * Verify an attestation manifest you already have in hand.
+ * Result is "valid" / "invalid" / "error" — never "rotated" (no live fetch).
+ */
+export function verifyManifest(manifestBody: string | object): Promise<VerifyResult>
+
+/**
+ * Verify an attestation by URL. May return "rotated" if the live well-known
+ * pubkey endpoint serves a different kid than the manifest declared.
+ */
+export function verifyUrl(attestationUrl: string, opts?: VerifyUrlOpts): Promise<VerifyResult>
+
+// Re-exports.
+export { parseManifest, ParseResult, ParsedManifest, ParseError } from './parse.js'
+export { verifySignature, computeKid, hexToBytes, bytesToHex, hexEquals } from './verify.js'
+export { getJsonBody, FetchOk, FetchErr, GetJsonBodyOpts }            from './fetch.js'