ncc-06-js 0.3.2 → 0.3.4

package/README.md

@@ -103,8 +103,11 @@ The package exposes modular helpers so you can keep using your own transport sta
 
 ## Trust model
 
-- `k` is the binding between NCC-02/NCC-05 records and the TLS key that serves `wss://` endpoints. Clients connect with `rejectUnauthorized=false` and enforce trust by comparing the published `k` value to the expected fingerprint before using the endpoint.
-- When migrating to real TLS/SPKI pins, update the sidecar to publish the real fingerprint via `ncc02ExpectedKey` and update the resolver’s `expectedK`. The shared helpers keep the rest of the resolution flow untouched.
+- `k` is the binding between NCC-02/NCC-05 records and the transport-level key (TLS/SPKI) that serves the endpoint.
+- This applies to **any secure protocol** (`wss://`, `https://`, `tls://`, `tcps://`).
+- **Trust Model:** This mimics DANE: the `k` tag pins the expected SPKI fingerprint of the endpoint's certificate.
+- **Self-Signed vs CA:** You can use **self-signed certificates** or CA-signed ones. The security comes from the NCC record's signature (the Identity) pinning the transport key, not from a centralized CA.
+- **Verification:** The shared helpers compare the endpoint's actual fingerprint against the published `k` value. This allows clients to securely connect to self-signed endpoints without security warnings, provided the NCC record is valid.
 
 ## Reference Docs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ncc-06-js",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Reusable NCC-06 discovery helpers extracted from the example relay, sidecar, and client.",
   "type": "module",
   "main": "src/index.js",