Bug Fixes

• add publishConfig.provenance for OIDC publishing (release)

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file: signet-protocol-1.8.1.tgz
size: 222491 bytes
sha256: e75997afa3e7874e6b12c898ff51da573c9c81f66a1fe0d73654a47815763c68
sha512-hwB33GqINVqnKZ1muzMSExHWShBlUwj5BH5xKit/tQj/LW8DtcdY0F1DhTn6FYgUk1SZP+H2r+C0veY77xJTIw==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/signet-protocol/-/signet-protocol-1.8.1.tgz
shasum -a 256 signet-protocol-1.8.1.tgz

Features

• cross-device Sign-in-with-Signet via relay delivery

Bug Fixes

• validate sessionPubkey and enforce pairing with relay (qr-router)

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file: signet-protocol-1.6.0.tgz
size: 221835 bytes
sha256: 88a562ab8c13d01aaaac318f9d773802399819deb230f8723054f22a39521fcf
sha512-PsheTmJOo6/1MCj1P2yoCKX5lApix83kay4qAj2tW9SUFa33iQJGXzqyZrl3umFmxgu/Z5JRlZZbaxHOc4rJBw==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/signet-protocol/-/signet-protocol-1.6.0.tgz
shasum -a 256 signet-protocol-1.6.0.tgz

Bug Fixes

• deterministic tamper in ring-signature test to eliminate 1/256 flake

Reproducible build: byte-identical output verified across two independent CI runners.

Artefact integrity

file: signet-protocol-1.2.3.tgz
size: 220562 bytes
sha256: f4e1b804040c77962a040ac994c20a78e1e24ba2e7ac29f2172c5deb2dcb042c
sha512-0lmC2P/NroFPw5X4roDMeEQ+CkO/956hCz75a0c7NH2zJtbVipyx0NwC2GF04tAOg+FJFH8w9/plxOvYXFcDYg==

Verify against the registry tarball:

curl -sLO https://registry.npmjs.org/signet-protocol/-/signet-protocol-1.2.3.tgz
shasum -a 256 signet-protocol-1.2.3.tgz

1.2.1 (2026年04月12日)

Bug Fixes

• deps: bump vite, picomatch, and esbuild across manifests (security) (0d3db23)

1.2.0 (2026年04月10日)

Features

• spec: lock attestation kind 31000 as canonical (fd34c8d)

1.1.0 (2026年04月10日)

Bug Fixes

• add per-signal-type caps to IQ score computation (2bc22bb), closes hi#score forgesworn/signet-app-internal#80

Features

• accept .well-known/signet.json version 2 (fbe7a07), closes signet-app-internal#79
• export presentation, QR router, URL auth, relay events, and computeAge (5a02514), closes signet-app-internal#70 signet-app-internal#71 signet-app-internal#73 signet-app-internal#58
• export SigningBackend interface and SigningMode type (19229bd), closes signet-app-internal#74
• extract presentation, QR router, URL auth, and relay event builders (620fdb0), closes signet-app-internal#70 signet-app-internal#71 signet-app-internal#73
• extract signet-me directional words and venue entry builder (cb8f601), closes signet-app-internal#72 signet-app-internal#76
• include entityType in computeBadge return value (5b572fc), closes signet-app-internal#75
• migration event type for cross-keypair identity continuity (43882b6), closes signet-app-internal#83
• wire ZK age range proofs into all credential builders (2e9420f), closes signet-app-internal#58

1.0.0 (2026年03月31日)

Bug Fixes

• add algorithm field to voting parsed interfaces (227c5a5)
• add ArrayBuffer cast for crypto.subtle.importKey type compat (e9408e4)
• add ECDH identity-point check to computeSharedSecret for consistency (9842bfc)
• add length bounds to callbackUrl and relayUrl in VerifyRequest validation (7b1234e)
• add prepare script for git URL installs (c0d55a6)
• add prepare script for git URL installs (ce306e8)
• add signet-lsag-v1 domain separator to LSAG signatures (ea68b6b)
• address re-review findings — bounds checks, constant-time comparisons, type guards (e0a4621)
• allow ws:// on local network IPs (10.x, 192.168.x, 172.16-31.x) (a66efcf)
• app build — bump spoken-token to v2, shim node:crypto for browser (e0066cf)
• app security — remove console.log, raise PBKDF2, clipboard expiry, QR validation (d5d71b3)
• bind signet age proof verification to credential policy (f1c51e9)
• bump @forgesworn/ring-sig to ^3.0.0 and @forgesworn/range-proof to ^2.0.0 (042af30)
• bump canary-kit to ^0.10.0 (spoken-token extraction) (5ae99df)
• compact QR format for auth + combined flow warning (d6702b3)
• compliance off-by-one in consent age check, merkle key colon guard (a732133)
• comprehensive security and production readiness hardening (8e6ccbc), closes Hi#severity
• correct copyright holder in licence (6416431)
• correct nsec-tree file: path for main repo root (1918279)
• correct repository URL and remove NPM_TOKEN from CI (e5c6f22)
• enforce wss:// for non-localhost relays, cap fetch events, complete SignetError migration (85dfcd1)
• fifth security pass — auth, SDK, and presentation hardening (445d1cb)
• fourth security pass — undici fix, nsec single-keypair safety, encryption prep (2bce01a)
• low-severity security hardening (9315c1f)
• modulo bias, pubkey validation, trim API surface, add engines (af7689b)
• NaN guard in compliance age-range, tag validation in store import, zero-scalar check in ECDH (177795e)
• NaN guards on parseInt for untrusted tag values (2c365fc)
• nullifier separator ambiguity and relay event verification (4590b0d)
• pass 7 belt-and-braces — 24 findings, all fixed (330fb61)
• pass 8 — onboarding encryption window + double-encryption bug (36a231a)
• pin GitHub Actions to SHA, add workflow permissions, pin ubuntu (cc9d2f4)
• QR scanner — remove all sizing overrides, let html5-qrcode manage layout (95a210f)
• QR scanner — remove forced aspect ratio causing duplicate view (37d4128)
• QR scanner — split image, jerkiness, and auto-stop on scan (ab828e2)
• remaining security and production readiness issues (e1dd8f8)
• remove manual L/l tags from builders (nip-va auto-generates) (a056287)
• remove unused deriveNostrKeyPair import (re-review finding) (b04306a)
• rename expires → expiration (NIP-40 standard) across all files (277f586)
• replace html5-qrcode camera with native getUserMedia + jsQR (edeee32)
• resolve all LOW-severity security findings from audit passes 1-3 (8368196)
• resolve app build issues and install dependencies (e72f32c)
• resolve final two CRITICALs — real Schnorr in SDK, PRF biometric key (64908c0)
• resolve remaining tracked security findings (MED-3, MED-6, LOW-2, LOW-3) (120d9ec)
• resolve Uint8Array type compatibility with crypto.subtle (d8cb466)
• restore correct repository URL to signet-protocol (5f629fd)
• restore HTTPS certs for app after dev-app retirement (b38b5dd)
• second-pass security hardening (2274db2)
• second-pass security review — tag bounds, relay guards, range-proof hardening (a3b88cf)
• security and production readiness hardening (iteration 1) (d8963cb)
• security audit — HIGH and MEDIUM severity fixes (512a978)
• security hardening — expiry checks, type guards, fetch timeout, key cleanup (b516b21)
• security hardening — input validation, type guards, error classes (7085af8)
• security hardening — NaN guards, assertValidity, input bounds (073d394)
• security hardening pass 2 — ring encoding, key image validation, store/relay guards (0ba8268)
• security hardening, credential chain fix, kind number reservation (96e0974)
• security review findings - binding, validation, replay resistance (67e0202)
• simplify HTTPS setup, remove redirect ports (d6acaa1)
• switch canary-kit dependency from file: to npm ^0.9.0 (24f02cc)
• tests: add algorithm field to voting and policy test objects (d6955cb)
• update app domain to forgesworn.dev, replace local path aliases with npm deps (232339d)
• update kind 30999 references in comments to 31000 (ac21899)
• update repository URL to forgesworn/signet ([8c01baf](https://github.com/forgesworn/signet...