kxco-verify 1.4.1 → 1.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +13 -0
- package/README.md +3 -3
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,18 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.5.0 (2026-10-09)
|
|
4
|
+
|
|
5
|
+
Runtime support. No change to the API or its behaviour.
|
|
6
|
+
|
|
7
|
+
**Node.js 22.12 or later is required.** `engines.node` moves from `>=20.19`
|
|
8
|
+
to `>=22.12`. Node 20 reached end of life on 30 April 2026. 22.12 is the
|
|
9
|
+
first Node 22 release that loads ES modules through `require()` without a
|
|
10
|
+
flag, the same property the 20.19 floor provided.
|
|
11
|
+
|
|
12
|
+
**CI tests every change on Node 22, 24 and 26.** It tested Node 18, 20 and 22 before.
|
|
13
|
+
|
|
14
|
+
**Releases are built on Node 26**, where they were built on Node 24.
|
|
15
|
+
|
|
3
16
|
## 1.4.1
|
|
4
17
|
|
|
5
18
|
Documentation. No source change.
|
package/README.md
CHANGED
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
[](https://nodejs.org)
|
|
12
12
|
[](https://verify.kxco.ai)
|
|
13
13
|
|
|
14
|
-
Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-87 and ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js
|
|
14
|
+
Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-87 and ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 22.12 and later.
|
|
15
15
|
|
|
16
16
|
- **No KXCO server in the trust path.** `verifyManifest()` makes no network request at all, and `verifyUrl()` contacts only the attestation URL you pass and the key endpoint the manifest names.
|
|
17
17
|
- **Runs in the browser as shipped.** No `Buffer`, no `process` and SHA-256 from WebCrypto, which is how [verify.kxco.ai](https://verify.kxco.ai) checks a signature entirely in the tab.
|
|
@@ -49,7 +49,7 @@ To **sign** attestations, pick the signing package from [the KXCO post-quantum f
|
|
|
49
49
|
npm install kxco-verify
|
|
50
50
|
```
|
|
51
51
|
|
|
52
|
-
Node.js
|
|
52
|
+
Node.js 22.12 and later. ESM only. One dependency, and no KXCO server in the trust path.
|
|
53
53
|
|
|
54
54
|
## Command line
|
|
55
55
|
|
|
@@ -258,7 +258,7 @@ hexEquals(a: string, b: string): boolean
|
|
|
258
258
|
|
|
259
259
|
## Browser usage
|
|
260
260
|
|
|
261
|
-
The library is browser-safe by construction. It uses no `Buffer` and no `process`, and takes SHA-256 from `crypto.subtle`, which every modern browser and Node.js
|
|
261
|
+
The library is browser-safe by construction. It uses no `Buffer` and no `process`, and takes SHA-256 from `crypto.subtle`, which every modern browser and Node.js 22.12 and later provide.
|
|
262
262
|
|
|
263
263
|
Use a bundler (Vite, esbuild, Rollup, webpack), or load as ESM via an import map that points each package at its folder:
|
|
264
264
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-verify",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.5.0",
|
|
4
4
|
"description": "Free, browser-safe verifier for KXCO ML-DSA-87 and ML-DSA-65 signatures, with no KXCO server in the trust path. An auditor, regulator or counterparty confirms a signature from the artefact alone, years later, and can check the key is still live on chain.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|
|
@@ -78,7 +78,7 @@
|
|
|
78
78
|
"src"
|
|
79
79
|
],
|
|
80
80
|
"engines": {
|
|
81
|
-
"node": ">=
|
|
81
|
+
"node": ">=22.12"
|
|
82
82
|
},
|
|
83
83
|
"dependencies": {
|
|
84
84
|
"@noble/post-quantum": "0.7.0"
|