Offline credential verifiers
Language-specific verification helpers and their trust boundaries.
Attestix uses a published canonical-JSON and Ed25519 credential profile. Shared fixtures test interoperability; they do not prove identical validation or trust policy across every API in every language. The profile differs from strict RFC 8785.
| Source repository | Scope |
|---|---|
| Python | Identity and credential issuance, verification, documentation and provenance workflows. |
| JavaScript / TypeScript | Offline verifier and delegation helpers; read parsing and chain-validation boundaries. |
| Go | Credential verification and basic/full delegation helpers with different checks. |
| Java | Caller-pinned trust inputs and supported signature/profile checks. |
| R | Credential verification and delegation pair helpers. |
| Rust | Credential/delegation verification and checked canonicalization. |
The current npm package is attestix: install attestix@0.4.2. The legacy @vibetensor/attestix package remains at 0.2.0. Read each repository's installation and release notes; registry publication is separate from a GitHub release. JavaScript, Go and Java 0.4.2 are published; R and Rust have GitHub 0.4.2 releases, while CRAN and crates.io remain at 0.4.1 at this cutoff. The non-Python repositories are verifier libraries, not credential issuers.
Verification responsibilities
Establish which issuer/key is trusted, what claims authorize, whether time/status checks are appropriate, and how replay is prevented. An embedded DID or caller-supplied key proves key control, not identity or permission. Offline verification cannot establish live revocation unless you provide a trusted status source and freshness policy.
The browser verifier uses npm attestix 0.4.2 with its documented local boundary checks and signature verification. It is not a legal conformity decision or a substitute for a trusted resolver.
See the public conformance fixtures and each SDK README for exact APIs and limitations.