@typedstandards/civic-typed-harness 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +29 -0
  2. package/README.md +1 -1
  3. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -3,6 +3,35 @@
3
3
  Factual record of what changed per published version. Section references are
4
4
  to the Typed Standards specification unless noted otherwise.
5
5
 
6
+ ## 0.6.0 — 2026-09-26
7
+
8
+ The list is derived from
9
+ `git log 65e8a1d..<this release> -- packages/civic-typed-harness/` — `65e8a1d`
10
+ is the 0.5.0 release's last commit, its dating fix. No harness source changes
11
+ in that range.
12
+
13
+ - **Dependency floor raised:** `@typedstandards/produce-core` `^0.3.0 ||
14
+ ^0.4.0` → `^0.7.0`, and the `@typedstandards/verify-core` devDependency
15
+ `^0.9.0` → `^0.12.0`, the version produce-core 0.7.0 resolves. The two move
16
+ together so the install holds one copy of verify-core: with only the
17
+ devDependency moved, produce-core 0.3.0 kept verify-core 0.9.0 and the
18
+ harness tests imported a second copy. The raise went to `^0.6.0` /
19
+ `^0.11.0` first ([civic-ai-tools#232](https://github.com/npstorey/civic-ai-tools/issues/232))
20
+ and was not published at that range.
21
+ - **What the two releases bring.** verify-core 0.11.0 is the first release
22
+ that exports `KNOWN_TYPE_URIS`, which the hub's `check:verifier-subtype-set`
23
+ compares with the specification's §8.12.1 table. verify-core 0.12.0 (the
24
+ certificate-chain split, typedstandards#100) adds a member to
25
+ `ChainFailReason` and to `Rfc3161FailReason`; the harness reads neither.
26
+ produce-core 0.7.0 changes none of its own source.
27
+ - The lockfile resolves produce-core 0.7.0 and verify-core 0.12.0, one copy
28
+ each, and no other entry moves. The golden byte-compat suite passes
29
+ unchanged.
30
+ - A consumer that pins produce-core 0.3.x through 0.6.x no longer shares its
31
+ copy with this package: under 0.x semver `^0.7.0` excludes them.
32
+ - **README:** the runtime-dependency line named produce-core `^0.2.0`, a range
33
+ this package has not declared since 0.3.0. It names `^0.7.0`.
34
+
6
35
  ## 0.5.0 — 2026-09-18
7
36
 
8
37
  The list is derived from
package/README.md CHANGED
@@ -49,7 +49,7 @@ Likewise: `buildDatHereEnvironment` / `deriveDatHereEnvelopeFields` take `CIVICA
49
49
 
50
50
  No I/O, no network, no environment reads, no Node built-ins, browser-safe — anywhere in the package. Clock and RNG are permitted **in capture modules only** (span timestamps and ids are what capture *is*) and are injectable for deterministic tests. Enforced mechanically twice: `eslint.config.mjs` (`no-restricted-imports` / `-globals` / `-properties` / `-syntax`) and `src/purity.test.ts` (browser-safety + determinism + module-boundary checks under `node --test`).
51
51
 
52
- Runtime dependency: **`@typedstandards/produce-core` (`^0.2.0`) only.** The verify-core primitives the harness consumes (`sha256Hex`, `isBlobRef`, the canonicalization-rule URIs, the Q32 vocabulary table, the `CaptureMethod` type) are reached through produce-core's 0.2.0 re-exports rather than imported from `@typedstandards/verify-core` directly — one declared dependency, no phantom, and still one hashing implementation across producer, harness, and verifier by construction (produce-core re-exports the same bindings verify-core defines, verified by reference identity).
52
+ Runtime dependency: **`@typedstandards/produce-core` (`^0.7.0`) only.** The verify-core primitives the harness consumes (`sha256Hex`, `isBlobRef`, the canonicalization-rule URIs, the Q32 vocabulary table, the `CaptureMethod` type) are reached through produce-core's 0.2.0 re-exports rather than imported from `@typedstandards/verify-core` directly — one declared dependency, no phantom, and still one hashing implementation across producer, harness, and verifier by construction (produce-core re-exports the same bindings verify-core defines, verified by reference identity).
53
53
 
54
54
  > **Q32 adjacency** (open-questions registry): the captureMethod vocabulary re-exported from `src/format/profiles.ts` is verify-core's hardcoded fallback table, pending versioned, content-addressed guidance bundles. Flagged, not solved, here.
55
55
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@typedstandards/civic-typed-harness",
3
- "version": "0.5.0",
3
+ "version": "0.6.0",
4
4
  "description": "Civic-domain harness for Typed Standards evidence packages — the DOMAIN layer of the ADR-0021 format/domain line: civic PROV-O vocabulary and provenance builder, datHere envelope-policy derivations, and the capture machinery (trace builder, skill-metadata extraction, data-source population, adversarial rubric core). Derives; @typedstandards/produce-core assembles.",
5
5
  "license": "MIT",
6
6
  "author": "Nathan Storey",
@@ -33,10 +33,10 @@
33
33
  "prepublishOnly": "npm run clean && npm run build"
34
34
  },
35
35
  "dependencies": {
36
- "@typedstandards/produce-core": "^0.3.0 || ^0.4.0"
36
+ "@typedstandards/produce-core": "^0.7.0"
37
37
  },
38
38
  "devDependencies": {
39
- "@typedstandards/verify-core": "^0.9.0",
39
+ "@typedstandards/verify-core": "^0.12.0",
40
40
  "@types/node": "^22.20.2",
41
41
  "@typescript-eslint/parser": "^8",
42
42
  "eslint": "^9",