{"_id":"@concordia-dao/verify","_rev":"9-a227a259f2937b9c90cfee17f4ff834f","name":"@concordia-dao/verify","dist-tags":{"latest":"0.1.4"},"versions":{"0.1.0":{"name":"@concordia-dao/verify","version":"0.1.0","keywords":["casper","proof","governance","verification","x402"],"author":{"name":"Concordia DAO"},"license":"MIT","_id":"@concordia-dao/verify@0.1.0","maintainers":[{"name":"syed3000","email":"saaz1@live.com"}],"homepage":"https://github.com/asadvendor-boop/concordia-dao-council#readme","bugs":{"url":"https://github.com/asadvendor-boop/concordia-dao-council/issues"},"bin":{"concordia-verify":"dist/cli.js"},"dist":{"shasum":"cc0545dcecc4d7fb62c02b113a688a36fc363e34","tarball":"https://registry.npmjs.org/@concordia-dao/verify/-/verify-0.1.0.tgz","fileCount":136,"integrity":"sha512-u3Jk9aWs0DDXt6oHEoxuQKejHtURfc2qhgsfiA7FmzkeQtXKUWXq2b4NuTMWesGRW68+iGLteJ5c7I0eBUZhhg==","signatures":[{"sig":"MEUCIQCN5zTxanqhz3ngRL3XCQk1uUmGHX8XDt1iNGEf+Fz4igIgI0SpnrVe4raWZh26UwXOmysal/KGiNBxnR8nrldNXkY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1555923},"main":"./dist/index.js","type":"module","_from":"file:/tmp/concordia-npm-pack.esWqHr/concordia-dao-verify-0.1.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=20.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"private":false,"scripts":{"lint":"tsc -p tsconfig.json --noEmit","test":"npm run clean && npm run build && node --test test/*.test.mjs","build":"tsc -p tsconfig.json && node scripts/copy-vectors.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","prepack":"npm run clean && npm run build","test:unit":"node --test test/*.test.mjs"},"_npmUser":{"name":"syed3000","email":"saaz1@live.com"},"_resolved":"/tmp/concordia-npm-pack.esWqHr/concordia-dao-verify-0.1.0.tgz","_integrity":"sha512-u3Jk9aWs0DDXt6oHEoxuQKejHtURfc2qhgsfiA7FmzkeQtXKUWXq2b4NuTMWesGRW68+iGLteJ5c7I0eBUZhhg==","deprecated":"Superseded by 0.1.1, which carries npm provenance (SLSA v1) binding the GitHub-hosted publish workflow and exact source commit. Same verifier code; 0.1.0 was operator-published without an attestation.","repository":{"url":"git+https://github.com/asadvendor-boop/concordia-dao-council.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.6.2","description":"Read-only, fail-closed verifier for Concordia proof registries and typed v3 envelopes.","directories":{},"sideEffects":false,"_nodeVersion":"22.12.0","dependencies":{"@noble/hashes":"1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"5.9.3","@types/node":"22.19.19"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.0_1784950463729_0.06736965870955691","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@concordia-dao/verify","version":"0.1.1","keywords":["casper","proof","governance","verification","x402"],"author":{"name":"Concordia DAO"},"license":"MIT","_id":"@concordia-dao/verify@0.1.1","maintainers":[{"name":"syed3000","email":"saaz1@live.com"}],"homepage":"https://github.com/asadvendor-boop/concordia-dao-council#readme","bugs":{"url":"https://github.com/asadvendor-boop/concordia-dao-council/issues"},"bin":{"concordia-verify":"dist/cli.js"},"dist":{"shasum":"d8f09d6730ab5ce5bb3a533d0be60d010cf36755","tarball":"https://registry.npmjs.org/@concordia-dao/verify/-/verify-0.1.1.tgz","fileCount":136,"integrity":"sha512-omsNIINM33l0v8IzPr6RuxsSxdM31Cyw35LCA04s1oLsk2MEsDcu1gzVG5J135Q6TwRx9hOf5m5HIv6Z5yRSRA==","signatures":[{"sig":"MEUCIEHmY1xOczovWDlcRXtYL84RZUAY1Wk2/if3v3C3l2fHAiEAya1u4D2GtpljSHCpRyBr8fwtKm6yqzdVuGzmdf80WGU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@concordia-dao%2fverify@0.1.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1556049},"main":"./dist/index.js","type":"module","_from":"file:concordia-dao-verify-0.1.1.tgz","types":"./dist/index.d.ts","engines":{"node":">=20.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"private":false,"scripts":{"lint":"tsc -p tsconfig.json --noEmit","test":"npm run clean && npm run build && node --test test/*.test.mjs","build":"tsc -p tsconfig.json && node scripts/copy-vectors.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","prepack":"npm run clean && npm run build","test:unit":"node --test test/*.test.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:23cf73cd-548a-4ff8-9199-9f56c0a380cf"}},"_resolved":"/home/runner/work/concordia-dao-council/concordia-dao-council/packages/verify/concordia-dao-verify-0.1.1.tgz","_integrity":"sha512-omsNIINM33l0v8IzPr6RuxsSxdM31Cyw35LCA04s1oLsk2MEsDcu1gzVG5J135Q6TwRx9hOf5m5HIv6Z5yRSRA==","deprecated":"Superseded by 0.1.2; use the V1.5-compatible provenance release.","repository":{"url":"git+https://github.com/asadvendor-boop/concordia-dao-council.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.18.0","description":"Read-only, fail-closed verifier for Concordia proof registries and typed v3 envelopes.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.0","dependencies":{"@noble/hashes":"1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"5.9.3","@types/node":"22.19.19"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.1_1784972191169_0.10249981614467796","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"@concordia-dao/verify","version":"0.1.2","keywords":["casper","proof","governance","verification","receipt","testnet"],"author":{"name":"Concordia DAO"},"license":"MIT","_id":"@concordia-dao/verify@0.1.2","maintainers":[{"name":"syed3000","email":"saaz1@live.com"}],"homepage":"https://github.com/asadvendor-boop/concordia-dao-council#readme","bugs":{"url":"https://github.com/asadvendor-boop/concordia-dao-council/issues"},"bin":{"concordia-verify":"dist/cli.js"},"dist":{"shasum":"5f4ed98d052baf62a5de84ecb6aa11a22bfca81d","tarball":"https://registry.npmjs.org/@concordia-dao/verify/-/verify-0.1.2.tgz","fileCount":136,"integrity":"sha512-Gy15bzVVk0ynDNzdXp31e1hVwHfN/Eq0QeyypZUKu/TR89HtOx2coHymTijLb0gCGKiNWPFIYLdVoxNDKXbIAg==","signatures":[{"sig":"MEYCIQD2Oau8RBte90hVFdkQRFUiwJ/MoD12/uEQZj9wYdCYqAIhAOQhHX0VZvvbo6TMVNPQFr+uAvezNypd7fbV2LUn9X8g","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@concordia-dao%2fverify@0.1.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1551638},"main":"./dist/index.js","type":"module","_from":"file:concordia-dao-verify-0.1.2.tgz","types":"./dist/index.d.ts","engines":{"node":">=20.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"private":false,"scripts":{"lint":"tsc -p tsconfig.json --noEmit","test":"npm run clean && npm run build && node --test test/*.test.mjs","build":"tsc -p tsconfig.json && node scripts/copy-vectors.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","prepack":"npm run clean && npm run build","test:unit":"node --test test/*.test.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:23cf73cd-548a-4ff8-9199-9f56c0a380cf"}},"_resolved":"/home/runner/work/concordia-dao-council/concordia-dao-council/packages/verify/concordia-dao-verify-0.1.2.tgz","_integrity":"sha512-Gy15bzVVk0ynDNzdXp31e1hVwHfN/Eq0QeyypZUKu/TR89HtOx2coHymTijLb0gCGKiNWPFIYLdVoxNDKXbIAg==","deprecated":"Superseded by provenance-verified 0.1.4.","repository":{"url":"git+https://github.com/asadvendor-boop/concordia-dao-council.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.18.0","description":"Read-only, fail-closed verifier for Concordia V1 receipts and proof registries, with historical compatibility.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.0","dependencies":{"@noble/hashes":"1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"5.9.3","@types/node":"22.19.19"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.2_1785038693353_0.523457610384362","host":"s3://npm-registry-packages-npm-production"}},"0.1.3":{"name":"@concordia-dao/verify","version":"0.1.3","keywords":["casper","proof","governance","verification","receipt","testnet"],"author":{"name":"Concordia DAO"},"license":"MIT","_id":"@concordia-dao/verify@0.1.3","maintainers":[{"name":"syed3000","email":"saaz1@live.com"}],"homepage":"https://github.com/asadvendor-boop/concordia-dao-council#readme","bugs":{"url":"https://github.com/asadvendor-boop/concordia-dao-council/issues"},"bin":{"concordia-verify":"dist/cli.js"},"dist":{"shasum":"6f4d76c1962221481ebe5b7072926b6d5ce1e179","tarball":"https://registry.npmjs.org/@concordia-dao/verify/-/verify-0.1.3.tgz","fileCount":136,"integrity":"sha512-2GNl6qZE45IrmtNN9NoMxPWCSayL7vBldW40iBdFHTJCgYfaZtnyAP5psGei/rk5/GY/26Q2toee+Y/rsyP/EA==","signatures":[{"sig":"MEYCIQDmjWc15/JMGJ1wWoigFjdM4Lvv3sNeQErO4/ahV87YygIhAKiUWTKshETKlrRra5NtYtsyXAhfcT0Wa8Vfh59IFMZy","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@concordia-dao%2fverify@0.1.3","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1551856},"main":"./dist/index.js","type":"module","_from":"file:concordia-dao-verify-0.1.3.tgz","types":"./dist/index.d.ts","engines":{"node":">=20.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"d5ee34d11fd08d75ad85eecbe56ed71c65cab85b","private":false,"scripts":{"lint":"tsc -p tsconfig.json --noEmit","test":"npm run clean && npm run build && node --test test/*.test.mjs","build":"tsc -p tsconfig.json && node scripts/copy-vectors.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","prepack":"npm run clean && npm run build","test:unit":"node --test test/*.test.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:23cf73cd-548a-4ff8-9199-9f56c0a380cf"}},"_resolved":"/home/runner/work/concordia-dao-council/concordia-dao-council/packages/verify/concordia-dao-verify-0.1.3.tgz","_integrity":"sha512-2GNl6qZE45IrmtNN9NoMxPWCSayL7vBldW40iBdFHTJCgYfaZtnyAP5psGei/rk5/GY/26Q2toee+Y/rsyP/EA==","repository":{"url":"git+https://github.com/asadvendor-boop/concordia-dao-council.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.18.0","description":"Read-only, fail-closed verifier for Concordia V1 receipts and proof registries, with historical compatibility.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.0","dependencies":{"@noble/hashes":"1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"5.9.3","@types/node":"22.19.19"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.3_1785089548990_0.621173001791004","host":"s3://npm-registry-packages-npm-production"},"deprecated":"Superseded by provenance-verified 0.1.4."},"0.1.4":{"name":"@concordia-dao/verify","version":"0.1.4","keywords":["casper","proof","governance","verification","receipt","testnet"],"author":{"name":"Concordia DAO"},"license":"MIT","_id":"@concordia-dao/verify@0.1.4","maintainers":[{"name":"syed3000","email":"saaz1@live.com"}],"homepage":"https://github.com/asadvendor-boop/concordia-dao-council#readme","bugs":{"url":"https://github.com/asadvendor-boop/concordia-dao-council/issues"},"bin":{"concordia-verify":"dist/cli.js"},"dist":{"shasum":"40f67923d3426b6f4cc3479038a61a53f06030d7","tarball":"https://registry.npmjs.org/@concordia-dao/verify/-/verify-0.1.4.tgz","fileCount":136,"integrity":"sha512-kf2pBnVuml8VO4lJ5fOWy6FOWKLGNBVnrcLVVAHQKv9uurZV36HMX6+WY3xENUIrScrYYoVUwJxK/sX9ZHQrOg==","signatures":[{"sig":"MEUCIQDjUlP8ZqtyqCY2fOP1Krm2eSpvAYXuVOGMu0vz6A+ThAIgVc0qsrwLgFSAfmOlQ7AXM8R2qsEfi87uBJpshLlpShk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@concordia-dao%2fverify@0.1.4","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1551866},"main":"./dist/index.js","type":"module","_from":"file:concordia-dao-verify-0.1.4.tgz","types":"./dist/index.d.ts","engines":{"node":">=20.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"7b76e1f7cb1e4da95801d4bfb9172b14b9724ad7","private":false,"scripts":{"lint":"tsc -p tsconfig.json --noEmit","test":"npm run clean && npm run build && node --test test/*.test.mjs","build":"tsc -p tsconfig.json && node scripts/copy-vectors.mjs","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","prepack":"npm run clean && npm run build","test:unit":"node --test test/*.test.mjs"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:23cf73cd-548a-4ff8-9199-9f56c0a380cf"}},"_resolved":"/home/runner/work/concordia-dao-council/concordia-dao-council/packages/verify/concordia-dao-verify-0.1.4.tgz","_integrity":"sha512-kf2pBnVuml8VO4lJ5fOWy6FOWKLGNBVnrcLVVAHQKv9uurZV36HMX6+WY3xENUIrScrYYoVUwJxK/sX9ZHQrOg==","repository":{"url":"git+https://github.com/asadvendor-boop/concordia-dao-council.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.18.0","description":"Read-only, fail-closed verifier for Concordia V1 receipts and proof registries, with historical compatibility.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.0","dependencies":{"@noble/hashes":"1.8.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"5.9.3","@types/node":"22.19.19"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.4_1785090655556_0.4663593557952508","host":"s3://npm-registry-packages-npm-production"}}},"time":{"created":"2026-07-25T03:34:23.611Z","modified":"2026-07-26T18:51:02.287Z","0.1.0":"2026-07-25T03:34:23.896Z","0.1.1":"2026-07-25T09:36:31.392Z","0.1.2":"2026-07-26T04:04:53.509Z","0.1.3":"2026-07-26T18:12:29.176Z","0.1.4":"2026-07-26T18:30:55.701Z"},"bugs":{"url":"https://github.com/asadvendor-boop/concordia-dao-council/issues"},"author":{"name":"Concordia DAO"},"license":"MIT","homepage":"https://github.com/asadvendor-boop/concordia-dao-council#readme","keywords":["casper","proof","governance","verification","receipt","testnet"],"repository":{"url":"git+https://github.com/asadvendor-boop/concordia-dao-council.git","type":"git","directory":"packages/verify"},"description":"Read-only, fail-closed verifier for Concordia V1 receipts and proof registries, with historical compatibility.","maintainers":[{"name":"syed3000","email":"saaz1@live.com"}],"readme":"# `@concordia-dao/verify`\n\nRead-only, fail-closed verification for Concordia V1 receipts, proof registries,\nand historical compatibility artifacts.\n\nVersion 0.1.4 is V1-first and remains an API/parser/refusal superset of 0.1.3.\nIt does not sign, broadcast, settle, or mutate.\n\n## V1.5 truth boundary\n\nThe default documentation uses canonical V1 proposal `DAO-PROP-6CB25C`,\nreceipt\n`e926582f3dacd05d9bd59a4fe0ae3c3c884ad57f23ab7318925cef34c286d852`,\nand the recorded quorum sequence.\n\n- Casper-native x402 v2 exposes a live HTTP 402 challenge; the package does not\n  claim or verify an external facilitator service.\n- Mainnet has not been executed.\n- Governance v3 is excluded from V1.5.\n- SafePay Lite is recorded native-CSPR settlement evidence, not an external\n  facilitator claim.\n\nHistorical V2/V3 names below are compatibility schema identifiers. Retaining\nthem prevents consumer regression; it does not make them V1.5 product claims.\n\n## Outcomes\n\n| Status | Exit code | Meaning |\n| --- | ---: | --- |\n| `verified` | `0` | Every required supported check passed |\n| `invalid` | `2` | Evidence was malformed, contradictory, tampered, or failed a required check |\n| `unavailable` | `3` | Required evidence or a read-only observation could not be obtained |\n| `unknown` | `4` | No supported terminal observation establishes the claim |\n| usage error | `64` | CLI arguments were invalid |\n\nOnly `verified` is success. Summary booleans never override recomputed facts.\n\n## Install\n\n```bash\nnpm install @concordia-dao/verify@0.1.4\n```\n\nNode.js 20 or newer is required.\n\n## V1-first CLI example\n\nExport a V1 proof-registry document and all relative artifacts into one\ndirectory:\n\n```bash\nconcordia-verify local ./v1-proof-registry.json\n```\n\nThe canonical V1 proposal ID is `DAO-PROP-6CB25C`.\n\nThe `proposal` mode remains available for 0.1.1 API compatibility, but it\nrequires a deployment that actually serves the proof-registry contract. The\nConcordia V1 apex does not advertise `/proof-registry/v1/`, so this README does\nnot send users to that broken outbound route.\n\n```bash\nconcordia-verify proposal DAO-PROP-6CB25C \\\n  --base-url https://your-proof-registry.example\n```\n\nURL and proposal registry/artifact modes use bounded `GET` requests. Live mode sends `POST` requests only for an explicit allowlist of read-only Casper JSON-RPC methods. Redirects are disabled and embedded credentials are rejected.\n\n## Library\n\n```js\nimport {\n  verifyLocal,\n  verifyProofRegistry,\n} from \"@concordia-dao/verify\";\n\nconst local = await verifyLocal(\"./v1-proof-registry.json\");\nif (local.status !== \"verified\") {\n  process.exitCode = local.exitCode;\n}\n\nconst result = verifyProofRegistry(registry, {\n  artifacts: {\n    \"artifacts/proof.json\": artifactBytes,\n  },\n});\n```\n\n## Compatibility retained from 0.1.1\n\nEvery 0.1.1 public export remains. Strict registry support and refusal behavior\nremain for:\n\n- `historical_odra_receipt_v2`\n- `exact_envelope_v3`\n- `native_treasury_execution_v1`\n- `safepay_v2`\n- `official_x402_settlement_v1`\n- `approval_boundary_v1`\n- `demo_capability_v1`\n- `room_identity_v1`\n- `snapshot`\n\nThe package continues to expose canonical encoders, golden-vector verification,\nsigned-deploy and finality adapters, state and transfer adapters, registry\nverification, local/URL/proposal/live modes, and the same distinct exit codes.\n\n### Historical receipt behavior\n\nThe historical receipt adapter preserves generation-specific call target,\nNamedArg order, card-chain binding, deploy/signature checks, execution/block\ntranscripts, and preserved lineage inventory. Historical fixture bytes remain\ntest-only and off public product promotion.\n\n### Exact-envelope and native treasury behavior\n\nThe exact-envelope and native-treasury adapters remain available for consumers\nof 0.1.1 evidence. They recompute typed identities and fail closed on missing or\ncontradictory transcript material. Their presence is compatibility, not a\nclaim that governance v3 shipped in V1.5.\n\n### SafePay and official-x402 refusals\n\nThe payment envelope adapters can bind strict artifact identity fields. They do\nnot claim to verify provider persistence, quote/fulfillment/replay semantics,\nEIP-712 authorization, official-facilitator behavior, WCSPR execution,\nsettlement finality, or protected-resource release. Unsupported semantics are\nlisted in `unsupportedCapabilities` and cannot produce `green: true`.\n\n## Live corroboration\n\nOffline artifacts can establish byte identity, signature validity, and internal\ntranscript consistency. They do not alone prove canonical-chain membership.\n\n`verifyLive` can upgrade supported observations only after replaying embedded\nread-only Casper requests against two to four explicitly trusted public RPC\nendpoints. Endpoint disagreement, incomplete observations, artifact mismatch,\nor timeout fails closed. Distinct hostnames and addresses are transport\nseparation, not proof of independent administration.\n\nThe package ships no default RPC endpoints and accepts no RPC credentials.\n\n## Release authentication\n\n`0.1.0` was operator-published without an npm provenance attestation and is\ndeprecated. `0.1.1`, `0.1.2`, and `0.1.3` remain supported historical releases.\n\n`0.1.4` is the provenance-strengthened V1.5 package version. Source metadata\nalone does not prove it is published. The pinned\n`.github/workflows/publish-verifier.yml` workflow must:\n\n1. be dispatched manually with an exact commit and version;\n2. require that commit to equal the current public `main` tip;\n3. run clean build, tests, lint, audit, pack, and consumer checks;\n4. embed the authorized public `main` SHA as `gitHead`, then use\n   `npm publish --provenance --access public` through the\n   OIDC trusted publisher and `npm-production` environment; and\n5. run the shared `scripts/verify_published_release.mjs` provenance verifier.\n\nNo long-lived npm publish token is stored in GitHub. Package metadata has no\n`publish` script, and no checkout, push, pull request, or release event can\npublish by itself.\n\n## Security\n\n- Strict JSON parsing rejects duplicate keys.\n- Registry and artifact sizes, counts, paths, redirects, destinations, and\n  deadlines are bounded.\n- Local artifact reads stay inside the registry directory and verify opened\n  file identity.\n- Live mode permits only read-only Casper RPC methods.\n- The package has no wallet, signer, secret loader, settlement, or mutation\n  capability.\n- Dependencies are exactly pinned in `package-lock.json`.\n\nReport security issues through the repository's private vulnerability-reporting\nchannel.\n","readmeFilename":"README.md"}