@atep/core 0.1.0-alpha.3 → 0.1.0-alpha.5

package/README.md

@@ -4,7 +4,7 @@ ATEP is a quantum-safe trust layer for robots and AI agents. Every signature and
 
 > **Experimental alpha. Do not rely on this to protect anything of value.** There has been no independent security audit. The wire format may change between releases (the COSE labels are private-use values and the media types are unregistered), and the post-quantum crates underneath are young. "Quantum-safe" means finalized NIST algorithms (FIPS 203 and FIPS 204) in a hybrid construction; it does not mean audited or proven.
 
-`@atep/core` is the ATEP reference core (Draft 08, `ATEP-1` suite, including `retired`, `successor`, anchors and domain binding) for JavaScript: the Rust
+`@atep/core` is the ATEP reference core (Draft 09, `ATEP-1` suite, including `retired`, `successor`, anchors and domain binding) for JavaScript: the Rust
 `atep-core` crate compiled to WebAssembly, with a TypeScript API. One ESM
 package for Node, Bun, Deno and browsers, no framework and no runtime
 dependencies.
@@ -183,9 +183,23 @@ Types are in `dist/index.d.ts`.
 
 ### Runtimes
 
-* Node 18+: tested (Node 25). `init()` reads the wasm next to `index.js`.
-* Browsers: `init()` fetches `new URL("./wasm/atep_wasm_bg.wasm", import.meta.url)`; serve `.wasm` as `application/wasm`. Or pass your own source: `await init(fetch("/path/atep.wasm"))`, a `URL`, or bytes. Smoke page: `examples/smoke.html` (plain JS). Run `npm run smoke` and open http://127.0.0.1:8099/examples/smoke.html. The fetch + streaming instantiate path was exercised from Node against the local server; the page itself has not been opened in a real browser here.
-* Bun and Deno: the package uses only standard ESM, `WebAssembly`, `fetch`, `crypto.getRandomValues` (through wasm-bindgen) and `node:fs/promises` (supported by both); not tested here (neither runtime is installed).
+What was run against the built `dist/`, with the same vector checks and the roundtrip tests:
+
+| Runtime | How | Result |
+| --- | --- | --- |
+| Node 25 | `npm test` | 538 tests: 517 pass, 21 skipped by name (the 20 `log-admission` and 1 `monitor` vectors); in CI on every push |
+| Deno 2.9.7 | `deno test -A test/` | all 441 vector checks that apply pass, 5 skipped by name, and the roundtrip tests pass; in CI on every push (pinned release binary) |
+| Bun 1.4.2 | `bun test test/` | 451 tests: 446 pass, 5 skipped by name, 0 fail; in CI on every push (pinned release binary) |
+| Chromium 131 (headless shell, Playwright) | `node scripts/browser-vectors.mjs` (needs `playwright-core`, see the header of the script) | the vector checks ran in the page on 3 October 2026, when the suite had 437 vectors: 432 pass, 5 skipped by name, 0 fail; manual, not in CI and not re-run on the current suite |
+
+The Node, Deno and Bun results were first obtained on a Linux development machine (Ubuntu 20.04 under WSL) and are now also produced by the CI of the repository.
+
+Notes:
+
+* Node: 18 or later is the intended range, and only Node 25 was run here. `init()` reads the wasm next to `index.js`.
+* Browsers: `init()` fetches `new URL("./wasm/atep_wasm_bg.wasm", import.meta.url)`; serve `.wasm` as `application/wasm`. Or pass your own source: `await init(fetch("/path/atep.wasm"))`, a `URL`, or bytes. The fetch and streaming-instantiate path ran in the Chromium run above and in the hosted demo. Not run: Firefox, Safari, mobile browsers, or any other version of the runtimes above. The plain-JS page `examples/smoke.html` (`npm run smoke`) was not opened by hand; the Chromium run uses the same `init()` path.
+* Bun and Deno: the package uses only standard ESM, `WebAssembly`, `fetch`, `crypto.getRandomValues` (through wasm-bindgen) and `node:fs/promises`.
+* Not run anywhere: constrained devices, or any embedded or flight hardware.
 * Bundlers: the wasm is referenced via `new URL(..., import.meta.url)`; the export `@atep/core/atep_core_bg.wasm` points at the binary.
 
 ## Secrets and their limits
@@ -232,12 +246,12 @@ Node 25 on the development machine (WSL2), average over 50 to 100 calls after wa
 
 `npm test` (node:test) runs, under Node, through the built package:
 
-* `test/vectors.test.mjs`: every vector listed in `../vectors/manifest.json`: **432 passed + 5 skipped = 437**.
+* `test/vectors.test.mjs`: every vector listed in `../vectors/manifest.json`: **512 passed + 21 skipped = 533**.
   The first 200 (identity, signing, encryption, verify-positive/negative, attestation, chain-positive/negative,
   srl, log, atep-r-positive/negative, retired-positive/negative, successor-positive/negative, srl-context,
   log-admission, monitor) and the 236 of Draft 05: checkpoint-hash 9, anchor-record 36, chain-id 30,
   anchor-envelope 13, anchor-media-type 3, require-anchor 27, anchor-not-supported 9, registry-endpoint 26,
-  domain-binding 83. The 5 skipped are named and counted in the summary: `log-admission` (4) and `monitor` (1),
+  domain-binding 94. The 21 skipped are named and counted in the summary: `log-admission` (20) and `monitor` (1),
   because they need a stateful log or a monitor, which this package does not have. Each vector is checked for
   CBOR hash, JSON view equality with the vector's `.json` (a vector whose `.json` says `not_strict_cbor` has no
   view, and the runner only accepts a failing view for those), and by category: exact bytes for identity,
@@ -255,6 +269,7 @@ js/
   scripts/build.mjs      cargo -> wasm-bindgen -> tsc
   scripts/bench.mjs      timings
   scripts/serve.mjs      static server for the smoke page
+  scripts/browser-vectors.mjs  the vector checks in headless Chromium (needs playwright-core; not part of CI)
   examples/smoke.html    browser smoke page, plain JS
   test/                  node:test suites
 rust/atep-wasm/          the wasm-bindgen wrapper crate (workspace member)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atep/core",
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-alpha.5",
   "description": "ATEP (Autonomy Trust Envelope Protocol) core: the Rust atep-core compiled to WebAssembly, with a TypeScript API for Node, Bun, Deno and browsers.",
   "license": "Apache-2.0",
   "type": "module",