@secoya/pq-sdk · 0.4.0-rc.5

One SDK for signed trust records and hybrid-protected evidence.

Secoya 0.4.0-rc.5 creates portable evidence records, binds record and signature metadata, verifies relying-party policy, and protects evidence for a designated recipient. It adds asynchronous signing and verification for future remote KMS, registry, trusted-time and replay adapters while preserving the synchronous API.

Developer preview · Node.js 24.7+ for the complete hybrid encryption path · tested on Node.js 24.7.0 and 24.18.0

Implemented capabilities

What the current build does.

  • trust recordsecoya-trust-record/2 creation, signing, verification and linked renewal.
  • classicalEd25519 classical signatures.
  • post-quantumML-DSA-65 post-quantum signatures.
  • hybrid policyHybrid-required verification requiring trusted classical and post-quantum signature classes.
  • digestSHA-384 payload digests.
  • canonicalsecoya-jcs/2 versioned canonicalisation.
  • key checksKey status, validity-window, revocation, authority and fingerprint checks.
  • envelopesecoya-evidence-envelope/1 encrypted evidence envelopes.
  • suitesecoya-hybrid-v1: X25519 plus ML-KEM-768 secrets, HKDF-SHA-384 derivation and AES-256-GCM authenticated encryption.
  • facadeHigh-level Secoya facade for encrypt, hybrid-sign, verify and decrypt workflows.
  • schemasStrict Draft 2020-12 JSON schemas and dependency-free runtime validators.
  • profilesSerializable verification profiles compiled into runtime policy objects.
  • resultVersioned secoya-verification-result/1 verification output.
  • adaptersVendor-neutral contracts for registry, KMS, trusted time and replay storage.
  • async integrationsignRecordAsync, verifyRecordAsync and provider-specific RAW-message limits for future remote KMS/HSM deployment.
Assurance evidence

What has been tested.

TypeScript SDK

The complete SDK and reference implementation: issuance, verification, renewal, asynchronous provider integration and protected evidence. From clean extracts, both the source ZIP and npm tarball pass 118 assertions with 0 failures on Node.js 24.18.0. On Node.js 22.23.1 the result is 102 passed, 0 failed, with 16 native-encryption cases explicitly skipped because they require Node.js 24.7+. Generated property and fuzz checks exercise 3,000 cases inside the suite.

Python verifier

An independent verifier with malformed-input, policy and trust coverage — 25 passed and 0 failed from a clean extract. It does not perform issuance or envelope encryption.

Rust harness

An independent Rust implementation verifies the committed hybrid record’s Ed25519 and ML-DSA-65 signatures through a separate cryptographic stack. Rust also participates in the shared /3 conformance suite. This is interoperability evidence, not an external security audit.

Vector manifest

A versioned vector manifest identifies stable acceptance, rejection, payload-tamper, signature-order and authenticated-context cases. The same committed record is now accepted by all three implementations across unrelated cryptographic stacks.

Assurance status

TypeScript and Python verification results have been reproduced from clean extracts. The Rust interoperability harness has been internally rerun successfully: 15 passed, 0 failed. These results demonstrate conformance and interoperability, not an independent cryptographic audit, FIPS validation or production deployment assurance.

Installation

From the supplied release archive.

Installation from the supplied release archive. The package is not yet published to a public npm registry.

# install from the supplied release archive (not a public registry) npm install ./secoya-pq-sdk-0.4.0-rc.5.tgz npm test
Downloads

Portable archives and checksums.

Distributed directly rather than through a public registry. Verify each archive against SHA256SUMS-portable.txt before use. The archives extract identically on Windows, Linux and macOS and carry no bundled dependencies or build output.

  • TypeScript sourcesecoya-pq-sdk-0.4.0-rc.5-source.zip
    61ED50379E285B4186E699E85CE61D4A4AD0A29318A8C18B41670383A924234B
  • TypeScript packagesecoya-pq-sdk-0.4.0-rc.5.tgz
    CB6B104951716DF61536E559F189318F59226DA43C83F58606E9208A659EB394
  • Python verifiersecoya-pq-python-0.1.0rc2-portable.zip
    53D6C543AD2FA10C20065665BFD3A80610388ACD5007007C6F535B9BDA570160
  • Rust harnesssecoya-verify-rs-0.1.0-portable.zip
    B04AE24C7060883D1EFD366E413736595292BD054A19AE7170519C413AB444E2
Requesting the archives

Email info@secoya.systems for the release set and its checksum manifest.