@hesohq/verify-wasm 0.5.1-dev.131 → 0.5.1-dev.136

package/heso_wasm.d.ts

@@ -579,9 +579,12 @@ export function validateNoFloorBypass(rules_json: string): void;
  * `verdict = "Malformed:…"`. This is the browser replacement for the
  * `verifyReceipt` function in `crypto.ts`, backed by the SAME Rust JCS +
  * BLAKE3 + Ed25519 core as Node for canonicalization, hashing, and signature
- * verification. NOTE: this is NOT byte-identical to Node for EVERY receipt —
- * the `tsa` feature is OFF here, so a TIME-ANCHORED receipt that Node verifies
- * against its TSA stack is handled differently on the browser surface.
+ * verification. The `tsa` feature is ON here, so a TIME-ANCHORED receipt is
+ * verified against the SAME RFC-3161 trusted-time stack Node uses — the proof
+ * page can now actually verify an anchor (rather than blanket reporting
+ * TimeAnchorUnverifiable). Verification stays fail-closed: an anchor is
+ * accepted only if its token chains to a pinned TSA root; any anchor that does
+ * not still resolves to TimeAnchorUnverifiable.
  */
 export function verifyActionReceipt(receipt_bytes: Uint8Array): ActionVerdict;
 

package/heso_wasm.js

@@ -1862,9 +1862,12 @@ export function validateNoFloorBypass(rules_json) {
  * `verdict = "Malformed:…"`. This is the browser replacement for the
  * `verifyReceipt` function in `crypto.ts`, backed by the SAME Rust JCS +
  * BLAKE3 + Ed25519 core as Node for canonicalization, hashing, and signature
- * verification. NOTE: this is NOT byte-identical to Node for EVERY receipt —
- * the `tsa` feature is OFF here, so a TIME-ANCHORED receipt that Node verifies
- * against its TSA stack is handled differently on the browser surface.
+ * verification. The `tsa` feature is ON here, so a TIME-ANCHORED receipt is
+ * verified against the SAME RFC-3161 trusted-time stack Node uses — the proof
+ * page can now actually verify an anchor (rather than blanket reporting
+ * TimeAnchorUnverifiable). Verification stays fail-closed: an anchor is
+ * accepted only if its token chains to a pinned TSA root; any anchor that does
+ * not still resolves to TimeAnchorUnverifiable.
  * @param {Uint8Array} receipt_bytes
  * @returns {ActionVerdict}
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hesohq/verify-wasm",
-  "version": "0.5.1-dev.131",
+  "version": "0.5.1-dev.136",
   "description": "HESO Enterprise trust layer — browser WASM verify-only surface (ESM)",
   "type": "module",
   "scripts": {