xoonya 3.2.0 → 3.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/RELEASE_NOTES.md +1 -7
  2. package/package.json +1 -1
package/RELEASE_NOTES.md CHANGED
@@ -1,7 +1 @@
1
- `xoonya` 3.2.0 turns the npm package into a thin verifier. The published tarball now carries only what a third party needs to verify xoonya proofs and naxytra delivery evidence: the standalone native verifier (`lib/native_verify.js`), the detached-signature verifier (`lib/external_proof_verify.js`, Ed25519 / ECDSA / RSA / ML-DSA-44/65/87), the `xoonya` CLI (`start-here`, `first-run --verify-native`, `conformance --json`, `verify <bundle.json>`), the conformance and adversarial vectors, and the release-candidate gate.
2
-
3
- The proof engine, server, review, governance, bridge packs, reference implementations and operator tooling are no longer distributed. They run as the hosted xoonya service (https://xoonya.onrender.com) behind the naxytra runtime; `xoonya release` and `xoonya review` now explain this and exit with code 2.
4
-
5
- Verification semantics are unchanged. The standalone verifier reproduces the engine's canonicalization, hashing, key-fingerprint and signature-suite rules exactly; the in-repo gate verifies every vector, option variant, freshly emitted bundle and mutation with both the engine and the standalone verifier and requires identical results. All eleven verification methods still pass, including `xoonya-native-hybrid-v1` (Ed25519 + ML-DSA-65).
6
-
7
- Package entry is now `verify.js` (`verifyNativeBundle`, `verifyNativeProof`, `verifyDetachedSignature`, `verifyJws`, `verifyExternalProofSignature`, `verifyxoonyaNativeAtom`, `verifyVectors`, `version`, `endpoints`). The verifier SDK stays Apache-2.0; the hosted service is proprietary.
1
+ `xoonya` 3.2.2 is a synchronized-line release with no change to the verifier package contents, vectors or verification behavior. It is published through npm trusted publishing (GitHub OIDC), with no npm token involved.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "xoonya",
3
- "version": "3.2.0",
3
+ "version": "3.2.2",
4
4
  "description": "Verifier for xoonya proofs and naxytra delivery evidence: deterministic verification of xoonya native proof bundles (replayable digest, Ed25519/secp256k1/P-256 signed, Ed25519 + ML-DSA-65 post-quantum hybrid, anchored), XNYA machine-evidence atoms, and detached signatures (Ed25519, ECDSA, RSA, ML-DSA). The proof engine and server are a hosted service and are not distributed.",
5
5
  "main": "verify.js",
6
6
  "bin": {