Verifiable Tier Credential

A signed, privacy-preserving portable credential a contributor can present anywhere, asserting a tier without exposing the underlying score or history.

Signature verification is the easy half. The parts usually got wrong are revocation, expiry and replay: a credential that cannot be revoked is a permanent grant, and one without a nonce can be presented twice.

Fails closed on an unknown issuer, an expired credential and a malformed claim set, rather than degrading to a partial trust decision.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function canonicalStringify(v: unknown): string;
  export function canonicalDigest(body: unknown): string;
  export function tierForScore(score: number | null): CredentialTier;
  export function verifyCredential(cred: TieredCredential, publicKeyPem?: string):;

  export type CredentialTier = "Gold" | "Silver" | "Bronze" | "Provisional" | "Unrated";