GOVP Verifier 0.1.10

Static publication interoperability release. Adds the byte-exact 256-shard RFC 6962 publication builder and O(log N) proof verifier, with complete TypeScript declarations and shared Python vectors for 7 and 10,000 events. Published to npm through GitHub OIDC; the attached tarball is the exact npm registry artifact.

GOVP Verifier 0.1.8

Security and interoperability release. Fixes alternate-casing GOVP-STATUS-1 revocation bypass, enforces bounded status freshness, rejects normalized JSON key collisions, and uses strict deterministic Ed25519 verification. Published to npm through GitHub OIDC; the attached tarball is the exact npm registry artifact.

GOVP Verifier 0.1.7 (superseded)

Security notice

This version is superseded by 0.1.8. Upgrade to @govp/verifier@0.1.8: version 0.1.7 can miss a GOVP-STATUS-1 revocation when the record uses alternate field-name casing. Version 0.1.8 also adds bounded status freshness, normalized JSON collision rejection and strict deterministic Ed25519 verification.

Original release

Signed release of the independent JavaScript implementation of GOVP-1 and GOVP-STATUS-1. This patch hardened the npm Trusted Publishing workflow with tag-push OIDC, GitHub-verified annotated-tag enforcement and a pinned OIDC-capable npm CLI. The attached tarball is retained for reproducibility; verify it with SHA256SUMS.

GOVP JavaScript verifier 0.1.3

Trusted-publishing release of the independent GOVP verifier.

• Published to npm exclusively through GitHub Actions OIDC
• npm provenance requested and no publication token used
• Node.js 20, 22 and 24 conformance suites pass
• npm audit reports zero known vulnerabilities
• Verifier API and protocol behavior are unchanged

Verify the attached tarball with SHA256SUMS.

GOVP JavaScript verifier 0.1.2

Public npm release of the independent GOVP verifier.

• Install: npm install @govp/verifier
• Runtime: Node.js 20+ and modern browsers
• Conformance: GOVP-1 and GOVP-STATUS-1 suites pass
• Audit: 0 known npm vulnerabilities
• Integrity: verify the attached tarball with SHA256SUMS

The verifier API and protocol behavior are unchanged from 0.1.1.

GOVP JavaScript verifier 0.1.1

Conformance-equivalent JavaScript verifier with a working signed-release installation path. Runtime code, dependencies, vectors and public API are unchanged from 0.1.0. The attached tarball passes every GOVP-1 and GOVP-STATUS-1 vector on Node.js 20, 22 and 24.

GOVP JavaScript verifier 0.1.0

First independent JavaScript implementation of GOVP-1 and GOVP-STATUS-1. Passes every published byte-exact conformance vector. Supports Node.js 20+ and modern browsers. The attached npm tarball is the exact package prepared for registry publication.