sovereignbase · jortsupetterson · Mar 26, 2026 · Mar 26, 2026
diff --git a/.github/workflows/ci.inactive → .github/workflows/ci.yaml b/.github/workflows/ci.inactive → .github/workflows/ci.yaml
diff --git a/src/.errors/class.ts b/src/.errors/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/.helpers/getBufferSourceLength.ts b/src/.helpers/getBufferSourceLength.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/.core/CipherKeyHarness/class.ts b/src/CipherMessage/.core/CipherKeyHarness/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/.core/helpers/createParamsByAlgCode/index.ts b/src/CipherMessage/.core/helpers/createParamsByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/.core/helpers/getImportKeyAlgorithmByAlgCode/index.ts b/src/CipherMessage/.core/helpers/getImportKeyAlgorithmByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/.core/helpers/getParamsByAlgCode/index.ts b/src/CipherMessage/.core/helpers/getParamsByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/.core/helpers/validateKeyByAlgCode/index.ts b/src/CipherMessage/.core/helpers/validateKeyByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/.core/types/index.ts b/src/CipherMessage/.core/types/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -37,16 +37,30 @@ type A256CTRKey = JsonWebKey &
     key_ops: readonly ('encrypt' | 'decrypt')[]
   }
 
+/**
+ * Algorithm parameters serialized alongside an AES-CTR cipher message.
+ */
 export type A256CTRParams = {
+  /** The 96-bit initialization vector used for encryption. */
   iv: Uint8Array
 }
 
 type A256CTRMessage = {
+  /** The encrypted payload bytes. */
   ciphertext: ArrayBuffer
 } & A256CTRParams
 
+/**
+ * Symmetric AES-CTR-256 JWK used for cipher messaging operations.
+ */
 export type CipherKey = A256CTRKey
 
+/**
+ * Serialized parameters required to decrypt a cipher message.
+ */
 export type CipherParams = A256CTRParams
 
+/**
+ * Cipher message artifact returned by cipher encryption operations.
+ */
 export type CipherMessage = A256CTRMessage
diff --git a/src/CipherMessage/CipherCluster/class.ts b/src/CipherMessage/CipherCluster/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/deriveCipherKey/index.ts b/src/CipherMessage/deriveCipherKey/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/generateCipherKey/index.ts b/src/CipherMessage/generateCipherKey/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/CipherMessage/index.ts b/src/CipherMessage/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/.core/SignKeyHarness/class.ts b/src/DigitalSignature/.core/SignKeyHarness/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/.core/VerifyKeyHarness/class.ts b/src/DigitalSignature/.core/VerifyKeyHarness/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/.core/helpers/createImportKeyAlgorithmByAlgCode/index.ts b/src/DigitalSignature/.core/helpers/createImportKeyAlgorithmByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/.core/helpers/createParamsByAlgCode/index.ts b/src/DigitalSignature/.core/helpers/createParamsByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/.core/helpers/getParamsByAlgCode/index.ts b/src/DigitalSignature/.core/helpers/getParamsByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/.core/helpers/validateKeyByAlgCode/index.ts b/src/DigitalSignature/.core/helpers/validateKeyByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/.core/types/index.ts b/src/DigitalSignature/.core/types/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -50,15 +50,26 @@ type MLDSA87SignKey = JsonWebKey &
   }
 
 type MLDSA87VerifyParams = {
+  /** The raw ML-DSA-87 public key bytes. */
   publicKey: Uint8Array
 }
 
 type MLDSA87SignParams = {
+  /** The raw ML-DSA-87 secret key bytes. */
   secretKey: Uint8Array
 }
 
+/**
+ * Public ML-DSA-87 JWK used to verify signatures.
+ */
 export type VerifyKey = MLDSA87VerifyKey
 
+/**
+ * Private ML-DSA-87 JWK used to produce signatures.
+ */
 export type SignKey = MLDSA87SignKey
 
+/**
+ * Runtime ML-DSA-87 key material used internally by signing and verification harnesses.
+ */
 export type DigitalSignatureParams = MLDSA87VerifyParams | MLDSA87SignParams
diff --git a/src/DigitalSignature/DigitalSignatureCluster/class.ts b/src/DigitalSignature/DigitalSignatureCluster/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/DigitalSignature/deriveDigitalSignatureKeypair/index.ts b/src/DigitalSignature/deriveDigitalSignatureKeypair/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -60,22 +60,6 @@ export async function deriveDigitalSignatureKeypair(
     key_ops: ['verify'],
   })
 
-  /* c8 ignore next 6 */
-  if (!('d' in signKey)) {
-    throw new CryptosuiteError(
-      'SIGN_JWK_INVALID',
-      'deriveDigitalSignatureKeypair: internal sign key invariant failed.'
-    )
-  }
-
-  /* c8 ignore next 6 */
-  if (!('x' in verifyKey)) {
-    throw new CryptosuiteError(
-      'VERIFY_JWK_INVALID',
-      'deriveDigitalSignatureKeypair: internal verify key invariant failed.'
-    )
-  }
-
   return {
     signKey: signKey as SignKey,
     verifyKey: verifyKey as VerifyKey,

diff --git a/src/DigitalSignature/generateDigitalSignatureKeypair/index.ts b/src/DigitalSignature/generateDigitalSignatureKeypair/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -15,7 +15,6 @@ limitations under the License.
 */
 import { toBase64UrlString } from '@sovereignbase/bytecodec'
 import { ml_dsa87 } from '@noble/post-quantum/ml-dsa.js'
-import { CryptosuiteError } from '../../.errors/class.js'
 import { validateKeyByAlgCode } from '../.core/helpers/validateKeyByAlgCode/index.js'
 import type { SignKey, VerifyKey } from '../.core/types/index.js'
 
@@ -44,22 +43,6 @@ export async function generateDigitalSignatureKeypair(): Promise<{
     key_ops: ['verify'],
   })
 
-  /* c8 ignore next 6 */
-  if (!('d' in signKey)) {
-    throw new CryptosuiteError(
-      'SIGN_JWK_INVALID',
-      'generateDigitalSignatureKeypair: internal sign key invariant failed.'
-    )
-  }
-
-  /* c8 ignore next 6 */
-  if (!('x' in verifyKey)) {
-    throw new CryptosuiteError(
-      'VERIFY_JWK_INVALID',
-      'generateDigitalSignatureKeypair: internal verify key invariant failed.'
-    )
-  }
-
   return {
     signKey: signKey as SignKey,
     verifyKey: verifyKey as VerifyKey,

diff --git a/src/DigitalSignature/index.ts b/src/DigitalSignature/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/Identifier/index.ts b/src/Identifier/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/KeyAgreement/.core/DecapsulateKeyHarness/class.ts b/src/KeyAgreement/.core/DecapsulateKeyHarness/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/KeyAgreement/.core/EncapsulateKeyHarness/class.ts b/src/KeyAgreement/.core/EncapsulateKeyHarness/class.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/KeyAgreement/.core/helpers/createImportKeyAlgorithmByAlgCode/index.ts b/src/KeyAgreement/.core/helpers/createImportKeyAlgorithmByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/KeyAgreement/.core/helpers/createParamsByAlgCode/index.ts b/src/KeyAgreement/.core/helpers/createParamsByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/KeyAgreement/.core/helpers/getParamsByAlgCode/index.ts b/src/KeyAgreement/.core/helpers/getParamsByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/KeyAgreement/.core/helpers/validateKeyByAlgCode/index.ts b/src/KeyAgreement/.core/helpers/validateKeyByAlgCode/index.ts
@@ -1,5 +1,5 @@
 /*
-Copyright 2026 z-base
+Copyright 2026 Sovereignbase
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

diff --git a/src/KeyAgreement/.core/types/index.ts b/src/KeyAgreement/.core/types/index.ts
@@ -47,23 +47,38 @@ type MLKEM1024DecapsulateKey = JsonWebKey &
   }
 
 type MLKEM1024KeyOffer = {
+  /** The encapsulated shared-secret artifact emitted by ML-KEM-1024. */
   ciphertext: ArrayBuffer
 }
 
 type MLKEM1024EncapsulateParams = {
+  /** The raw ML-KEM-1024 public key bytes. */
   publicKey: Uint8Array
 }
 
 type MLKEM1024DecapsulateParams = {
+  /** The raw ML-KEM-1024 secret key bytes. */
   secretKey: Uint8Array
 }
 
+/**
+ * Public ML-KEM-1024 JWK used to encapsulate a shared cipher key.
+ */
 export type EncapsulateKey = MLKEM1024EncapsulateKey
 
+/**
+ * Private ML-KEM-1024 JWK used to decapsulate a shared cipher key.
+ */
 export type DecapsulateKey = MLKEM1024DecapsulateKey
 
+/**
+ * Encapsulated key agreement artifact exchanged with the counterparty.
+ */
 export type KeyOffer = MLKEM1024KeyOffer
 
+/**
+ * Runtime ML-KEM-1024 parameters used internally by key agreement harnesses.
+ */
 export type KeyAgreementParams =
   | MLKEM1024EncapsulateParams
   | MLKEM1024DecapsulateParams
diff --git a/src/KeyAgreement/deriveKeyAgreementKeypair/index.ts b/src/KeyAgreement/deriveKeyAgreementKeypair/index.ts
@@ -59,27 +59,8 @@ export async function deriveKeyAgreementKeypair(
     key_ops: ['deriveKey', 'deriveBits'],
   })
 
-  /* c8 ignore next 6 */
-  if (!('x' in encapsulateKey)) {
-    throw new CryptosuiteError(
-      'KEY_AGREEMENT_KEY_INVALID',
-      'deriveKeyAgreementKeypair: internal key validation invariant failed.'
-    )
-  }
-
-  /* c8 ignore next 6 */
-  if (!('d' in decapsulateKey)) {
-    throw new CryptosuiteError(
-      'KEY_AGREEMENT_KEY_INVALID',
-      'deriveKeyAgreementKeypair: internal key validation invariant failed.'
-    )
-  }
-
-  const normalizedEncapsulateKey = encapsulateKey as EncapsulateKey
-  const normalizedDecapsulateKey = decapsulateKey as DecapsulateKey
-
   return {
-    encapsulateKey: normalizedEncapsulateKey,
-    decapsulateKey: normalizedDecapsulateKey,
+    encapsulateKey: encapsulateKey as EncapsulateKey,
+    decapsulateKey: decapsulateKey as DecapsulateKey,
   }
 }