Skip to content

@opena2a/atx-verify 0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 17:25
atx-verify-v0.4.0
3fd2dc5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Diagnostics, packaging, and type-precision release for the shared offline ATX verifier. No verdict-path changes: the 20-fixture conformance replay pins the accept/reject set unchanged from 0.3.0.

Changed

  • Staged anchor-fault diagnostics — an empty eligible-key set previously rejected with the generic Ed25519 signature ... did not verify, which reads as bad signature bytes when the fault is verifier configuration. Three staged reasons now distinguish: no Ed25519 anchors configured / all configured keys excluded by key-to-issuer binding (the cross-issuer case) / configured key hex failed to parse. Same rejectCategory (SIGNATURE_INVALID) everywhere — reason refinement only. A missing atcVersion now rejects with atcVersion is missing (supported: "1.0", "1.1") instead of interpolating undefined.
  • exports map — the package now exposes only the root entry and ./package.json; deep dist/* imports (never documented) fail with ERR_PACKAGE_PATH_NOT_EXPORTED. README states the ESM-only consumption patterns (native require() on Node >= 22, await import() on 18/20) and the @types/node requirement for skipLibCheck: false consumers.
  • Atx.atcVersion is now required (type-level change) — absence always rejected UNSUPPORTED_VERSION at runtime, so the optional marker only misled object-literal constructors. Flag for consumers: a TS consumer constructing Atx literals without atcVersion will now get a compile error; set it to "1.0" or "1.1". Both known in-org consumers already set it.
  • New exports — topLevelMemberSpan / ValueSpan, the tokenizer-offset raw-member extractor, for consumers that need credential-only strict-parse scoping of a larger envelope.
  • README — new Building a test credential walkthrough (verified verbatim against the published artifact) and an Additional exports reference.

Provenance

Published via npm Trusted Publishing (GitHub Actions OIDC, no long-lived tokens) with SLSA v1 provenance. Verify:

npm view @opena2a/atx-verify dist.attestations --json
npm audit signatures   # in a project that installs it

Full Changelog: atx-verify-v0.3.0...atx-verify-v0.4.0

Assets 2
Loading