chit402-verify 0.1.1 → 0.3.0

package/README.md

@@ -33,6 +33,10 @@ console.log(fullResult.overall); // 'verified' | 'partial' | 'failed'
 # Local binding verification (no network required)
 npx chit402-verify receipt.json
 
+# Hash the canonical object (must match signed payload_hash) and read not_after
+# from a pinned issuer-history snapshot. Both flags are offline.
+npx chit402-verify receipt.json --canonical-preimage preimage.json --issuer-history-file issuer-history.json
+
 # With on-chain nullifier check (requires network)
 npx chit402-verify receipt.json --check-nullifier
 
@@ -48,10 +52,12 @@ curl -s https://api.chit402.com/receipt/task-123?format=json | npx chit402-verif
 | Check | Requires Network? | Description |
 |-------|-------------------|-------------|
 | Payment binding | No | Recompute commitment from receipt fields |
-| Issuer signature | No | ES256 — pinned `issuer_jwk` on receipt, or JWKS file |
+| Issuer signature | No, unless `--fetch-jwks` | ES256. Trusted via JWKS (by kid) or the pinned production kid. Embedded `issuer_jwk` alone is not enough. |
 | Output hash | No | Hash is on the receipt |
 | On-chain settlement | Yes | Query Base RPC for tx |
 | Nullifier anchor | Yes | Query ZKVerifierSP1 contract |
+| Canonical preimage | No | `--canonical-preimage` is SHA-256'd and matched to signed `payload_hash` |
+| Issuer history | No, with `--issuer-history-file` | `iat` is inside the kid's `not_before` / `not_after`. A payload v10 pin must match |
 
 ## Exit Codes (CLI)
 

package/cli.js

@@ -8,6 +8,8 @@ import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
 
 const require = createRequire(import.meta.url);
+// Resolve via the package exports map. Deep imports of dist/cli.js throw
+// ERR_PACKAGE_PATH_NOT_EXPORTED unless @xfuel/verify lists that subpath.
 const verifyCliPath = require.resolve('@xfuel/verify/dist/cli.js');
 
 const child = spawn(process.execPath, [verifyCliPath, ...process.argv.slice(2)], {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chit402-verify",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Chit402 receipt verification — verify payment binding and output commitment offline.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -54,6 +54,6 @@
     "directory": "packages/aliases/chit402-verify"
   },
   "dependencies": {
-    "@xfuel/verify": "^0.1.1"
+    "@xfuel/verify": "^0.3.0"
   }
 }