@typedstandards/verify-core 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -1,11 +1,101 @@
 # Changelog — @typedstandards/verify-core
 
-Factual record of what changed per published version. Check numbers (#1–#16)
+Factual record of what changed per published version. Check numbers (#1–#17)
 refer to the Typed Standards specification §9.2 verification sequence. Issue
 references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
 hardening arc; #116 is the standalone-verifier arc this package was extracted
 in).
 
+## 0.15.0 — 2026-10-30
+
+The R10 release (civic-ai-tools#289; hub ADR-0038 §3, §5 and §6, specification v0.1.13 §8.1.1,
+§8.6 and §9.2). **A minor bump**: new exports, a new `VerifyResult` field, and one combination
+check #16 newly reads `ok`.
+
+- **The subtype table (new exports `PRODUCER_PROFILE_SUBTYPES`, `isContentProfileConsistent`, and
+  the types `ProducerProfileSubtypeRow` and `ProducerProfileBundleRef`).** Beside the profile-type
+  table, one frozen row per built subtype of `ai-assisted-analysis`, keyed by the full
+  `producerProfile` value:
+  - `ai-assisted-analysis/datHere` admits `datHere`, with no bundle pinned;
+  - `ai-assisted-analysis/civicaitools-v1` admits `datHere` and `default`, with its guidance
+    bundle pinned by URL
+    (`https://raw.githubusercontent.com/npstorey/civic-ai-tools/v0.1.13-typed-standards-spec/docs/profiles/ai-assisted-analysis/civicaitools-v1/bundle.json`)
+    and SHA-256 (`724e399e02db8993041b64982eec731505084bec2ec5e6ca58fda2de8087a281`), revision 1.
+
+  `isContentProfileConsistent(producerProfile, contentProfile)` is the §8.1.1 invariant over the
+  table: the content profile is one the subtype's row admits; a subtype with no row admits
+  `"datHere"` exactly when it begins with `ai-assisted-analysis/datHere`, and `"default"` exactly
+  when it does not. Only the table's own keys are rows. The row does not change the capture
+  vocabulary: `PROFILE_CAPTURE_VOCAB`, `resolveProfileType` and `captureVocabForProfile` (check #15)
+  are unchanged.
+- **Check #16 reads the predicate.** `checkContentProfile` reports `contentProfile_inconsistent`
+  when `isContentProfileConsistent` is false, in place of the `startsWith` comparison. The no-row
+  clause is that comparison, so every status is unchanged except one: `datHere` under
+  `ai-assisted-analysis/civicaitools-v1` reads `ok` (it read `contentProfile_inconsistent`). No
+  published record carries that combination.
+- **Check #3's implicit rule reads the predicate.** For a package with no
+  `contentCanonicalization`, a `producerProfile` reads as datHere when its subtype admits
+  `"datHere"` and not `"default"`, which is the `startsWith` reading for the `datHere` row and every
+  subtype with no row; under `ai-assisted-analysis/civicaitools-v1` the choice is
+  `metadata.contentProfile`'s. Every result is unchanged.
+- **Check #17, the content-profile system prompt (new exports `checkSystemPrompt`,
+  `SYSTEM_PROMPT_STATUSES`, and the types `SystemPromptStatus` and `SystemPromptCheck`).** When
+  `metadata.contentProfile` is `"datHere"`, `skillMetadata.skillText` as a non-empty string reads
+  `ok` (`form: 'string'`) and as a BlobRef `ok` (`form: 'blobRef'`); absent, empty, or neither
+  reads `skillText_absent`. Any other content profile (absent, `"default"` or unknown) reads
+  `not_applicable`. `skillText_absent` is an attention status and never a failure. The check does
+  not resolve a BlobRef (check #9 does).
+- **`VerifyResult` gains `systemPrompt`** (`SystemPromptCheck | null`, null when the package is
+  absent), set by `verifyRecord` beside `contentProfile`. Every other field of the result is
+  unchanged. A consumer that builds a `VerifyResult` literal needs the new field.
+- **Every earlier fixture reads as before.** Over the signed bundles, signed documents and package
+  objects in this repository's fixtures and the hub harness's `reference-golden.json` and
+  `in-loop-golden.json`, `verifyRecord`, `checkContentProfile`, `resolveContentCanonicalization`
+  and `captureVocabForProfile` give byte-identical output to 0.14.0 once `systemPrompt` is removed.
+  Check #17 reads `skillText_absent` on the five fixture packages that declare `datHere` without
+  `skillText` (the hub reference golden's `v01-dathere-empty-notebook` and
+  `v01-dathere-executed-notebook`, their copies in produce-core's `reference-golden.json`, and the
+  hub's `in-loop-golden.json`), `ok` on the site's `q15-d67b8e` record, and `not_applicable` on
+  every other.
+- **Every lookup of a verify-core table by a value a record or bundle supplies reads only the
+  table's own entries;** a malformed value reads as an unknown one. Every well-formed value reads as
+  before.
+- **A local copy of the bundle**, `src/__fixtures__/civicaitools-v1-guidance-bundle.json` (not
+  published), byte-identical to the hub file at tree `7060f5e3`. A test asserts its SHA-256,
+  `subtype`, `url` and admitted set against the row, without the network. Its provenance is in
+  `src/__fixtures__/README.md`.
+
+## 0.14.0 — 2026-10-16
+
+The W5 release (civic-ai-tools#260, shipped in #146 and #147). **A minor bump**: new exports
+(`CONTENT_LAYOUT`; `parseStrictJson` and `RepeatedMemberNameError`), and a type URI check #12 newly
+reads `ok`.
+
+- **`content/layout/v1` is registered (hub ADR-0034; spec §8.14).** New export `CONTENT_LAYOUT`
+  (`'content/layout/v1'`). `KNOWN_TYPE_URIS` holds eighteen entries: `content/analysis/v1`, then
+  `content/layout/v1`, then the sixteen attestation sub-types in the §8.12.1 table order, unchanged.
+  Check #12 reads `ok` for a layout node, where it read `unknown_type`. No payload check is added: a
+  layout node's envelope verifies as any node's (§8.14.5).
+- **`parseStrictJson` and `RepeatedMemberNameError` (new exports; typedstandards#145,
+  specification §8.2 and §9.2 check #1).** `parseStrictJson(text: string | Uint8Array)`
+  refuses a JSON text that repeats a member name within an object, which is not I-JSON
+  (RFC 7493), the input RFC 8785 JCS requires. It throws `RepeatedMemberNameError`
+  (`name` `'RepeatedMemberNameError'`), carrying `memberName` (unescaped) and
+  `pointer`, the JSON Pointer (RFC 6901) of the object that holds it. Names compare
+  after unescaping; the same name in two different objects is not a repeat. A text with
+  no repeated name returns exactly what `JSON.parse` returns, and a text that is not
+  JSON throws what `JSON.parse` throws, unchanged. Bytes are decoded as UTF-8 with
+  `fatal`. The walk keeps its own stack, so nesting the platform parser accepts does
+  not overflow it. No dependency is added.
+- **`verifyRecord` is unchanged:** it takes a parsed package, so the refusal belongs to
+  whoever reads the text. `JSON.parse` keeps the last occurrence of a repeated name, and
+  the envelope hash is computed over the parsed object, so a caller that parses a
+  package with it accepts a text the specification refuses.
+- **A negative vector**, `src/__fixtures__/repeated-member-name.bundle.json` (not
+  published): the site's minted interop bundle with a second, earlier `summary` member in
+  its package, which under `JSON.parse` gives the signed package's envelope and content
+  hashes. Its provenance is in `src/__fixtures__/README.md`.
+
 ## 0.13.0 — 2026-09-27
 
 The core-minors release (typedstandards#113, shipped in #114, #115 and #118). **A minor bump** —

package/README.md

@@ -64,6 +64,14 @@ const result = await verifyRecord(input, {
 // contentHash, typeResolution, signerIdentity, lifecycle, ...
 ```
 
+> **Parse the package's text with `parseStrictJson`.** A record package's JSON text is
+> I-JSON (RFC 7493), so a verifier refuses a text that repeats a member name within an
+> object, before any hash is computed (spec §8.2, §9.2 check #1). `JSON.parse` keeps the
+> last occurrence and drops the others, and `verifyRecord` takes the parsed object, so it
+> cannot see a repeat. `parseStrictJson(text)` (a string, or bytes decoded as UTF-8)
+> throws `RepeatedMemberNameError`, with `memberName` and `pointer` (the JSON Pointer of
+> the object), on a repeated name, and otherwise returns what `JSON.parse` returns.
+
 > **`verifyEvidence` is the same function.** The 2026-08-19 vocabulary settlement
 > renamed the entry point to `verifyRecord` (spec Appendix J) — "evidence" is
 > retired from the artifact/infrastructure brand role and kept only for the

package/dist/checks.d.ts

@@ -22,7 +22,12 @@ export interface ContentCanonicalizationResolution {
  * `unknown_canonicalization_rule` (renders; check #4 then cannot recompute). An
  * absent field on a pre-v0.1 package → `implicit`, inferring the rule from
  * contentProfile / producerProfile (datHere → dathere-ag-jupyter/v1; otherwise
- * legacy-json/v1).
+ * legacy-json/v1). A `producerProfile` reads as datHere when the subtype admits
+ * `"datHere"` and not `"default"` under the §8.1.1 invariant
+ * (`isContentProfileConsistent`): with no row, exactly when it begins with
+ * `ai-assisted-analysis/datHere`, as before; a subtype whose row admits both, as
+ * `ai-assisted-analysis/civicaitools-v1` does, leaves the choice to
+ * `contentProfile`.
  */
 export declare function resolveContentCanonicalization(pkg: Record<string, unknown>): ContentCanonicalizationResolution;
 export declare const CONTENT_HASH_STATUSES: readonly ["ok", "content_hash_mismatch", "contentHash_no_supported_algorithm", "unresolved_rule", "legacy_relabeled", "content_bytes_unavailable"];
@@ -94,14 +99,39 @@ export interface ContentProfileCheck {
  *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
  *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
  *     (reported, not passed; consistency is not judged).
- *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
- *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *   - present, known, `producerProfile` present, and the §8.1.1 invariant fails
+ *     (ADR-0006 §2 as amended by hub ADR-0038 §3: the content profile is not one
+ *     the subtype's row admits, `isContentProfileConsistent`; a subtype with no
+ *     row admits `"datHere"` exactly when it begins with
  *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
  *   - otherwise → `ok`.
  * The invariant is compared only when both fields are present. No status is an
  * integrity failure: both labels are signature-covered.
  */
 export declare function checkContentProfile(pkg: Record<string, unknown>): ContentProfileCheck;
+export declare const SYSTEM_PROMPT_STATUSES: readonly ["ok", "skillText_absent", "not_applicable"];
+export type SystemPromptStatus = (typeof SYSTEM_PROMPT_STATUSES)[number];
+export interface SystemPromptCheck {
+    status: SystemPromptStatus;
+    /** On `ok`, how the text is carried: inline, or a BlobRef (which check #9 resolves). */
+    form?: 'string' | 'blobRef';
+}
+/**
+ * Check #17 — the system prompt §8.7.1 requirement 2 requires of a
+ * `datHere`-content-profile package (hub ADR-0038 §6).
+ *   - `metadata.contentProfile` not `"datHere"` (absent, `"default"` or unknown)
+ *     → `not_applicable`, and nothing else is read.
+ *   - `"datHere"` and `skillMetadata.skillText` a non-empty string → `ok`
+ *     (`form: 'string'`), or a BlobRef → `ok` (`form: 'blobRef'`).
+ *   - `"datHere"` and the key absent, empty, or neither a string nor a BlobRef
+ *     → `skillText_absent`.
+ * `skillText_absent` is an attention status, never a failure: it says nothing
+ * about the envelope, the signature or the notebook. The check does not resolve
+ * a BlobRef (check #9 does), and cannot check that the text is the prompt the
+ * model ran under.
+ */
+export declare function checkSystemPrompt(pkg: Record<string, unknown>): SystemPromptCheck;
+export declare const CONTENT_LAYOUT = "content/layout/v1";
 export declare const KNOWN_TYPE_URIS: readonly string[];
 export declare const TYPE_RESOLUTION_STATUSES: readonly ["ok", "implicit", "unknown_type"];
 export type TypeResolutionStatus = (typeof TYPE_RESOLUTION_STATUSES)[number];

package/dist/checks.js

@@ -1,5 +1,5 @@
 // Content-canonicalization, content-hash, and typed-standards envelope checks
-// (spec §9.2 checks #3, #4, #6, #12, #13, #14, #15, #16) + the package-level
+// (spec §9.2 checks #3, #4, #6, #12, #13, #14, #15, #16, #17) + the package-level
 // blob-ref walker (#9) — browser-safe.
 //
 // Factored verbatim from the server `verify.ts` (WS2); these functions were
@@ -8,7 +8,7 @@
 // for pre-v0.1 packages that omit the corresponding field.
 import { computeEnvelopeHash, computeContentHashSha256, isMultihashContentHash, KNOWN_CANONICALIZATION_RULES, LEGACY_JSON_CANONICALIZATION, DATHERE_AG_JUPYTER_CANONICALIZATION, RAW_BYTES_CANONICALIZATION, } from "./canonicalization.js";
 import { sha256Hex } from "./primitives.js";
-import { captureVocabForProfile, resolveProfileType } from "./profiles.js";
+import { captureVocabForProfile, isContentProfileConsistent, resolveProfileType } from "./profiles.js";
 import { isBlobRef, parseBlobRef, verifyBlobRef, } from "./blob-ref.js";
 import { isKeyDerivedIdentifier } from "./did-key.js";
 import { compareKeyDerivedIdentifier } from "./self-certifying.js";
@@ -34,7 +34,12 @@ export const CONTENT_CANONICALIZATION_STATUSES = [
  * `unknown_canonicalization_rule` (renders; check #4 then cannot recompute). An
  * absent field on a pre-v0.1 package → `implicit`, inferring the rule from
  * contentProfile / producerProfile (datHere → dathere-ag-jupyter/v1; otherwise
- * legacy-json/v1).
+ * legacy-json/v1). A `producerProfile` reads as datHere when the subtype admits
+ * `"datHere"` and not `"default"` under the §8.1.1 invariant
+ * (`isContentProfileConsistent`): with no row, exactly when it begins with
+ * `ai-assisted-analysis/datHere`, as before; a subtype whose row admits both, as
+ * `ai-assisted-analysis/civicaitools-v1` does, leaves the choice to
+ * `contentProfile`.
  */
 export function resolveContentCanonicalization(pkg) {
     const raw = pkg['contentCanonicalization'];
@@ -54,7 +59,9 @@ export function resolveContentCanonicalization(pkg) {
         ? pkg['producerProfile']
         : undefined;
     const isDatHere = contentProfile === 'datHere' ||
-        (producerProfile?.startsWith('ai-assisted-analysis/datHere') ?? false);
+        (producerProfile !== undefined &&
+            isContentProfileConsistent(producerProfile, 'datHere') &&
+            !isContentProfileConsistent(producerProfile, 'default'));
     return {
         status: 'implicit',
         rule: isDatHere
@@ -197,7 +204,7 @@ export async function verifyContentHashWithFetch(pkg, resolution, legacyExternal
         return first;
     return verifyContentHash(pkg, resolution, legacyExternalHash, bytes);
 }
-// --- Content-profile check (spec §9.2 check #16; hub ADR-0029 §5) ---
+// --- Content-profile check (spec §9.2 check #16; hub ADR-0029 §5, ADR-0038 §3) ---
 /** The known `metadata.contentProfile` values (spec §8.1.2). */
 export const KNOWN_CONTENT_PROFILES = ['default', 'datHere'];
 export const CONTENT_PROFILE_STATUSES = [
@@ -211,8 +218,10 @@ export const CONTENT_PROFILE_STATUSES = [
  *   - key absent → `contentProfile_absent` (read as `"default"`, spec §8.1.2).
  *   - present and neither `"default"` nor `"datHere"` → `contentProfile_unknown`
  *     (reported, not passed; consistency is not judged).
- *   - present, known, `producerProfile` present, and the ADR-0006 §2 invariant
- *     fails (`contentProfile === "datHere"` iff `producerProfile` starts with
+ *   - present, known, `producerProfile` present, and the §8.1.1 invariant fails
+ *     (ADR-0006 §2 as amended by hub ADR-0038 §3: the content profile is not one
+ *     the subtype's row admits, `isContentProfileConsistent`; a subtype with no
+ *     row admits `"datHere"` exactly when it begins with
  *     `ai-assisted-analysis/datHere`) → `contentProfile_inconsistent`.
  *   - otherwise → `ok`.
  * The invariant is compared only when both fields are present. No status is an
@@ -234,25 +243,61 @@ export function checkContentProfile(pkg) {
     if (typeof raw !== 'string' || !KNOWN_CONTENT_PROFILES.includes(raw)) {
         return { status: 'contentProfile_unknown', ...base };
     }
-    if (producerProfile !== undefined) {
-        const isDatHere = raw === 'datHere';
-        const profileIsDatHere = producerProfile.startsWith('ai-assisted-analysis/datHere');
-        if (isDatHere !== profileIsDatHere) {
-            return { status: 'contentProfile_inconsistent', ...base };
-        }
+    if (producerProfile !== undefined && !isContentProfileConsistent(producerProfile, raw)) {
+        return { status: 'contentProfile_inconsistent', ...base };
     }
     return { status: 'ok', ...base };
 }
+// --- Content-profile system prompt (spec §9.2 check #17; hub ADR-0038 §6) ---
+export const SYSTEM_PROMPT_STATUSES = ['ok', 'skillText_absent', 'not_applicable'];
+/**
+ * Check #17 — the system prompt §8.7.1 requirement 2 requires of a
+ * `datHere`-content-profile package (hub ADR-0038 §6).
+ *   - `metadata.contentProfile` not `"datHere"` (absent, `"default"` or unknown)
+ *     → `not_applicable`, and nothing else is read.
+ *   - `"datHere"` and `skillMetadata.skillText` a non-empty string → `ok`
+ *     (`form: 'string'`), or a BlobRef → `ok` (`form: 'blobRef'`).
+ *   - `"datHere"` and the key absent, empty, or neither a string nor a BlobRef
+ *     → `skillText_absent`.
+ * `skillText_absent` is an attention status, never a failure: it says nothing
+ * about the envelope, the signature or the notebook. The check does not resolve
+ * a BlobRef (check #9 does), and cannot check that the text is the prompt the
+ * model ran under.
+ */
+export function checkSystemPrompt(pkg) {
+    const metadata = pkg['metadata'];
+    const contentProfile = typeof metadata === 'object' && metadata !== null && !Array.isArray(metadata)
+        ? metadata['contentProfile']
+        : undefined;
+    if (contentProfile !== 'datHere')
+        return { status: 'not_applicable' };
+    const skillMetadata = pkg['skillMetadata'];
+    const skillText = typeof skillMetadata === 'object' && skillMetadata !== null && !Array.isArray(skillMetadata)
+        ? skillMetadata['skillText']
+        : undefined;
+    if (typeof skillText === 'string' && skillText.length > 0)
+        return { status: 'ok', form: 'string' };
+    if (isBlobRef(skillText))
+        return { status: 'ok', form: 'blobRef' };
+    return { status: 'skillText_absent' };
+}
 // --- Typed-standards envelope checks (spec §9.2 checks #12, #14, #15) ---
-// v0.1 ratified node type URIs (spec §8.12.1). Recognized so check #12 resolves
-// them; only `content/analysis/v1` (+ the lifecycle sub-types) are operationalized
-// today, but the full ratified set is registered so conformant packages don't
-// render as `unknown_type`. The sixteen attestation sub-types are in the order
-// of the §8.12.1 table; `type-resolution.test.ts` holds that table's copy.
-// Exported and frozen so a check outside this package can compare the registered
-// set with the specification's list without being able to change it.
+// The `content/layout/v1` sub-type (spec §8.14, hub ADR-0034): a standalone
+// assertion of how a host's page arranges a node's parts. Registered for check
+// #12; verify-core runs no payload check on it (§8.14.5).
+export const CONTENT_LAYOUT = 'content/layout/v1';
+// v0.1 ratified node type URIs. Recognized so check #12 resolves them; only
+// `content/analysis/v1` (+ the lifecycle sub-types) are operationalized today,
+// but the full ratified set is registered so conformant packages don't render
+// as `unknown_type`. The two `content/*` sub-types come first:
+// `content/analysis/v1`, then `content/layout/v1` (§8.14). The sixteen
+// attestation sub-types follow in the order of the §8.12.1 table;
+// `type-resolution.test.ts` holds that table's copy. Exported and frozen so a
+// check outside this package can compare the registered set with the
+// specification's list without being able to change it.
 export const KNOWN_TYPE_URIS = Object.freeze([
     'content/analysis/v1',
+    CONTENT_LAYOUT,
     'attestation/withdraws/v1',
     'attestation/reinstates/v1',
     'attestation/supersedes/v1',

package/dist/index.d.ts

@@ -15,3 +15,4 @@ export * from './asn1.ts';
 export * from './x509.ts';
 export * from './rfc3161.ts';
 export * from './verify.ts';
+export * from './strict-json.ts';

package/dist/index.js

@@ -29,3 +29,4 @@ export * from "./asn1.js";
 export * from "./x509.js";
 export * from "./rfc3161.js";
 export * from "./verify.js";
+export * from "./strict-json.js";

package/dist/lifecycle.js

@@ -319,7 +319,8 @@ function isAbsent(v) {
 }
 /** Each payload field §8.12.1 requires of `type` that `node` lacks, by name. */
 function missingRequiredFields(node, type) {
-    return (ATTESTATION_REQUIRED_FIELDS[type] ?? []).filter((f) => isAbsent(node[f]));
+    const required = Object.hasOwn(ATTESTATION_REQUIRED_FIELDS, type) ? ATTESTATION_REQUIRED_FIELDS[type] : [];
+    return required.filter((f) => isAbsent(node[f]));
 }
 /**
  * Check one `attestation/*` node on its own (spec §8.12.3), for `withdraws`,
@@ -343,7 +344,7 @@ function missingRequiredFields(node, type) {
 export function checkAttestationNode(carried, context = {}) {
     const node = carried.node;
     const type = pickString(node['type']) ?? '';
-    const rule = ATTESTATION_AUTHORIZATION_RULES[type] ?? null;
+    const rule = Object.hasOwn(ATTESTATION_AUTHORIZATION_RULES, type) ? ATTESTATION_AUTHORIZATION_RULES[type] : null;
     const verdict = verifyAttestationNode(node, carried.nodeId, carried.signature ?? null);
     const missingFields = missingRequiredFields(node, type);
     const publicKey = carried.signature?.publicKey ?? '';

package/dist/profiles.d.ts

@@ -18,3 +18,32 @@ export declare function resolveProfileType(producerProfile?: string | null, cont
  * `producerProfile_bundle_unresolved` degraded case).
  */
 export declare function captureVocabForProfile(producerProfile?: string | null, contentProfile?: string | null): readonly CaptureMethod[] | undefined;
+/** A guidance bundle pinned by its address and the SHA-256 of its bytes. */
+export interface ProducerProfileBundleRef {
+    readonly url: string;
+    /** Lowercase hex SHA-256 of the bundle file's bytes. */
+    readonly sha256: string;
+}
+/** One built subtype's row. */
+export interface ProducerProfileSubtypeRow {
+    /** The `metadata.contentProfile` values the subtype admits. */
+    readonly admits: readonly string[];
+    /** The subtype's guidance bundle, when one is pinned. */
+    readonly bundle?: ProducerProfileBundleRef;
+}
+/**
+ * The subtype table, keyed by the full `producerProfile` value. The
+ * `ai-assisted-analysis/civicaitools-v1` bundle is revision 1 (2026-10-30), as
+ * hub ADR-0038 §5 records its address and digest; a later revision moves the
+ * digest and this pin, and nothing else.
+ */
+export declare const PRODUCER_PROFILE_SUBTYPES: Readonly<Record<string, ProducerProfileSubtypeRow>>;
+/**
+ * The §8.1.1 consistency invariant, for a package that carries both
+ * `producerProfile` and `metadata.contentProfile`: whether the content profile is
+ * one the subtype's row admits. A subtype with no row admits `"datHere"` exactly
+ * when it begins with `ai-assisted-analysis/datHere`, and `"default"` exactly when
+ * it does not: the reading every earlier release applied, so a record whose
+ * subtype has no row reads as before. Check #16 reads it.
+ */
+export declare function isContentProfileConsistent(producerProfile: string, contentProfile: string): boolean;

package/dist/profiles.js

@@ -40,5 +40,38 @@ export function resolveProfileType(producerProfile, contentProfile) {
  * `producerProfile_bundle_unresolved` degraded case).
  */
 export function captureVocabForProfile(producerProfile, contentProfile) {
-    return PROFILE_CAPTURE_VOCAB[resolveProfileType(producerProfile, contentProfile)];
+    const profileType = resolveProfileType(producerProfile, contentProfile);
+    return Object.hasOwn(PROFILE_CAPTURE_VOCAB, profileType) ? PROFILE_CAPTURE_VOCAB[profileType] : undefined;
+}
+/**
+ * The subtype table, keyed by the full `producerProfile` value. The
+ * `ai-assisted-analysis/civicaitools-v1` bundle is revision 1 (2026-10-30), as
+ * hub ADR-0038 §5 records its address and digest; a later revision moves the
+ * digest and this pin, and nothing else.
+ */
+export const PRODUCER_PROFILE_SUBTYPES = Object.freeze({
+    // No bundle pinned: the integration partner's, not this table's to name.
+    'ai-assisted-analysis/datHere': Object.freeze({ admits: Object.freeze(['datHere']) }),
+    'ai-assisted-analysis/civicaitools-v1': Object.freeze({
+        admits: Object.freeze(['datHere', 'default']),
+        bundle: Object.freeze({
+            url: 'https://raw.githubusercontent.com/npstorey/civic-ai-tools/v0.1.13-typed-standards-spec/docs/profiles/ai-assisted-analysis/civicaitools-v1/bundle.json',
+            sha256: '724e399e02db8993041b64982eec731505084bec2ec5e6ca58fda2de8087a281',
+        }),
+    }),
+});
+const DATHERE_PREFIX = 'ai-assisted-analysis/datHere';
+/**
+ * The §8.1.1 consistency invariant, for a package that carries both
+ * `producerProfile` and `metadata.contentProfile`: whether the content profile is
+ * one the subtype's row admits. A subtype with no row admits `"datHere"` exactly
+ * when it begins with `ai-assisted-analysis/datHere`, and `"default"` exactly when
+ * it does not: the reading every earlier release applied, so a record whose
+ * subtype has no row reads as before. Check #16 reads it.
+ */
+export function isContentProfileConsistent(producerProfile, contentProfile) {
+    if (Object.hasOwn(PRODUCER_PROFILE_SUBTYPES, producerProfile)) {
+        return PRODUCER_PROFILE_SUBTYPES[producerProfile].admits.includes(contentProfile);
+    }
+    return producerProfile.startsWith(DATHERE_PREFIX) ? contentProfile === 'datHere' : contentProfile === 'default';
 }

package/dist/rekor.js

@@ -31,7 +31,7 @@ export async function verifyRekorEntry(entryId, packageHash, options = {}) {
             return { verified: false };
         }
         const result = (await response.json());
-        const entry = result[entryId] || Object.values(result)[0];
+        const entry = (Object.hasOwn(result, entryId) ? result[entryId] : undefined) || Object.values(result)[0];
         if (!entry)
             return { verified: false };
         // Decode the base64 body and cross-check both hash algorithm and value.

package/dist/strict-json.d.ts

@@ -0,0 +1,24 @@
+/** A JSON text repeats a member name within one object, so it is not I-JSON (RFC 7493). */
+export declare class RepeatedMemberNameError extends Error {
+    /** The repeated member name, unescaped. */
+    readonly memberName: string;
+    /** The JSON Pointer (RFC 6901) of the object that holds it: `""` for the top-level value. */
+    readonly pointer: string;
+    constructor(memberName: string, pointer: string);
+}
+/**
+ * Parse a record's JSON text strictly: refuse a text that repeats a member name
+ * within an object (I-JSON, RFC 7493; specification §8.2), before any hash is
+ * computed over what it holds.
+ *
+ * - Bytes are decoded as UTF-8 with `fatal`, so malformed UTF-8 throws the
+ *   decoder's `TypeError` rather than being replaced. A leading byte order mark is
+ *   removed, as the decoder does by default.
+ * - A text that is not JSON throws what `JSON.parse` throws, unchanged.
+ * - A text that repeats a member name within one object throws
+ *   `RepeatedMemberNameError`, naming the member and the JSON Pointer of the
+ *   object. Names compare after unescaping, so `"a"` repeats `"a"`; the same
+ *   name in two different objects is not a repeat.
+ * - Otherwise it returns `JSON.parse`'s value.
+ */
+export declare function parseStrictJson(text: string | Uint8Array): unknown;

package/dist/strict-json.js

@@ -0,0 +1,109 @@
+// The strict parse of a record's JSON text (typedstandards#145; specification §8.2,
+// §9.2 check #1; hub ADR-0035).
+//
+// A record package's JSON text is I-JSON (RFC 7493), the input RFC 8785 JCS
+// requires, and I-JSON allows no member name to repeat within an object. The
+// platform's `JSON.parse` keeps the last occurrence of a repeated name and drops
+// the earlier ones without a word, and the envelope hash is computed over the
+// parsed object, so a text with a repeated name hashes as the text without it while
+// a reader that keeps another occurrence sees other content. `parseStrictJson`
+// refuses such a text, and otherwise returns exactly what `JSON.parse` returns.
+//
+// Pure: no I/O, no dependency, browser-safe. The walk keeps its own stack, so any
+// nesting the platform parser accepts is walked without recursion.
+/** A JSON text repeats a member name within one object, so it is not I-JSON (RFC 7493). */
+export class RepeatedMemberNameError extends Error {
+    /** The repeated member name, unescaped. */
+    memberName;
+    /** The JSON Pointer (RFC 6901) of the object that holds it: `""` for the top-level value. */
+    pointer;
+    constructor(memberName, pointer) {
+        super(`JSON text is not I-JSON (RFC 7493): the member name ${JSON.stringify(memberName)} is repeated in the object at JSON Pointer ${JSON.stringify(pointer)}`);
+        this.name = 'RepeatedMemberNameError';
+        this.memberName = memberName;
+        this.pointer = pointer;
+    }
+}
+const QUOTE = 0x22;
+const BACKSLASH = 0x5c;
+const OPEN_OBJECT = 0x7b;
+const CLOSE_OBJECT = 0x7d;
+const OPEN_ARRAY = 0x5b;
+const CLOSE_ARRAY = 0x5d;
+const COMMA = 0x2c;
+const escapeSegment = (s) => s.replace(/~/g, '~0').replace(/\//g, '~1');
+/** The index of the quote that closes the string opening at `start`, in text known to be JSON. */
+function stringEnd(text, start) {
+    let i = start + 1;
+    for (;;) {
+        const c = text.charCodeAt(i);
+        if (c === BACKSLASH)
+            i += 2;
+        else if (c === QUOTE)
+            return i;
+        else
+            i += 1;
+    }
+}
+/** Throw `RepeatedMemberNameError` at the first repeated name, in text `JSON.parse` has accepted. */
+function refuseRepeatedNames(text) {
+    const stack = [];
+    const segments = [];
+    const n = text.length;
+    for (let i = 0; i < n; i++) {
+        const c = text.charCodeAt(i);
+        if (c === QUOTE) {
+            const end = stringEnd(text, i);
+            const top = stack[stack.length - 1];
+            if (top?.names && top.expectName) {
+                const raw = text.slice(i + 1, end);
+                const name = raw.includes('\\') ? JSON.parse(text.slice(i, end + 1)) : raw;
+                if (top.names.has(name))
+                    throw new RepeatedMemberNameError(name, segments.map((s) => `/${escapeSegment(s)}`).join(''));
+                top.names.add(name);
+                top.segment = name;
+                top.expectName = false;
+            }
+            i = end;
+        }
+        else if (c === OPEN_OBJECT || c === OPEN_ARRAY) {
+            const parent = stack[stack.length - 1];
+            if (parent)
+                segments.push(parent.names ? parent.segment : String(parent.index));
+            stack.push({ names: c === OPEN_OBJECT ? new Set() : null, expectName: c === OPEN_OBJECT, segment: '', index: 0 });
+        }
+        else if (c === CLOSE_OBJECT || c === CLOSE_ARRAY) {
+            stack.pop();
+            if (stack.length > 0)
+                segments.pop();
+        }
+        else if (c === COMMA) {
+            const top = stack[stack.length - 1];
+            if (top.names)
+                top.expectName = true;
+            else
+                top.index += 1;
+        }
+    }
+}
+/**
+ * Parse a record's JSON text strictly: refuse a text that repeats a member name
+ * within an object (I-JSON, RFC 7493; specification §8.2), before any hash is
+ * computed over what it holds.
+ *
+ * - Bytes are decoded as UTF-8 with `fatal`, so malformed UTF-8 throws the
+ *   decoder's `TypeError` rather than being replaced. A leading byte order mark is
+ *   removed, as the decoder does by default.
+ * - A text that is not JSON throws what `JSON.parse` throws, unchanged.
+ * - A text that repeats a member name within one object throws
+ *   `RepeatedMemberNameError`, naming the member and the JSON Pointer of the
+ *   object. Names compare after unescaping, so `"a"` repeats `"a"`; the same
+ *   name in two different objects is not a repeat.
+ * - Otherwise it returns `JSON.parse`'s value.
+ */
+export function parseStrictJson(text) {
+    const source = typeof text === 'string' ? text : new TextDecoder('utf-8', { fatal: true }).decode(text);
+    const value = JSON.parse(source);
+    refuseRepeatedNames(source);
+    return value;
+}

package/dist/verify.d.ts

@@ -1,7 +1,7 @@
 import { type RekorInclusionProof, type RekorInclusionResult } from './rekor-inclusion.ts';
 import { type Rfc3161VerifyResult } from './rfc3161.ts';
 import { type KeyTrustResult, type TrustRegistry, type TrustRegistryProvenance } from './trust-registry.ts';
-import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type SigningKeyIdConsistencyCheck, type CaptureMethodVocabCheck, type ContentProfileCheck, type BlobRefVerification } from './checks.ts';
+import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type SigningKeyIdConsistencyCheck, type CaptureMethodVocabCheck, type ContentProfileCheck, type SystemPromptCheck, type BlobRefVerification } from './checks.ts';
 import { type LifecycleResolution } from './lifecycle.ts';
 import type { FetchLike } from './types.ts';
 /** The parsed signature envelope (`buildCommitmentView`'s `signature`). */
@@ -163,6 +163,9 @@ export interface VerifyResult {
     captureMethodVocab: CaptureMethodVocabCheck | null;
     /** Check #16 — `metadata.contentProfile` (hub ADR-0029 §5). */
     contentProfile: ContentProfileCheck | null;
+    /** Check #17 — whether a `datHere`-content-profile package carries
+     *  `skillMetadata.skillText` (hub ADR-0038 §6). Null when the package is absent. */
+    systemPrompt: SystemPromptCheck | null;
     lifecycle: LifecycleResolution;
 }
 /**

package/dist/verify.js

@@ -35,7 +35,7 @@ import { verifyRekorInclusion, } from "./rekor-inclusion.js";
 import { verifyRfc3161Timestamp } from "./rfc3161.js";
 import { verifyKeyTrust, legacyEmbeddedKeyTrust, } from "./trust-registry.js";
 import { applyKeyDerivedRegistryRule, applySelfCertifiedKeyTrust, compareKeyDerivedIdentifier, } from "./self-certifying.js";
-import { resolveContentCanonicalization, verifyContentHashWithFetch, resolvePackageType, checkSignerIdentity, checkSigningKeyIdConsistency, checkCaptureMethodVocab, checkContentProfile, verifyPackageBlobRefs, } from "./checks.js";
+import { resolveContentCanonicalization, verifyContentHashWithFetch, resolvePackageType, checkSignerIdentity, checkSigningKeyIdConsistency, checkCaptureMethodVocab, checkContentProfile, checkSystemPrompt, verifyPackageBlobRefs, } from "./checks.js";
 import { resolveLifecycleFromLegacyColumns, } from "./lifecycle.js";
 /**
  * A fetcher that sends at most one request per URL and replays that request's
@@ -204,7 +204,7 @@ export async function verifyRecord(input, deps) {
             : applyKeyDerivedRegistryRule(keyTrust, deps.registryProvenance);
     }
     // Step 5 — canonicalization, content-hash, and envelope checks
-    // (#3/#4/#6/#12/#14/#15/#16). #4 fetches only for a raw-bytes/v1 BlobRef output.
+    // (#3/#4/#6/#12/#14/#15/#16/#17). #4 fetches only for a raw-bytes/v1 BlobRef output.
     let contentCanonicalization = null;
     let contentHashCheck = null;
     let typeResolution = null;
@@ -212,6 +212,7 @@ export async function verifyRecord(input, deps) {
     let signingKeyIdConsistency = null;
     let captureMethodVocab = null;
     let contentProfile = null;
+    let systemPrompt = null;
     if (pkg) {
         contentCanonicalization = resolveContentCanonicalization(pkg);
         contentHashCheck = await verifyContentHashWithFetch(pkg, contentCanonicalization, input.legacyExternalHash ?? packageHash, { fetch: blobFetch });
@@ -222,6 +223,7 @@ export async function verifyRecord(input, deps) {
         }
         captureMethodVocab = checkCaptureMethodVocab(pkg);
         contentProfile = checkContentProfile(pkg);
+        systemPrompt = checkSystemPrompt(pkg);
     }
     // Step 6 — lifecycle (check #10). Server-deeper resolution wins when supplied;
     // otherwise derive STATE from the sidecar's lifecycle (the portable depth).
@@ -257,6 +259,7 @@ export async function verifyRecord(input, deps) {
         signingKeyIdConsistency,
         captureMethodVocab,
         contentProfile,
+        systemPrompt,
         lifecycle,
     };
 }

package/dist/x509.js

@@ -162,7 +162,7 @@ function isImplementedCertSignatureAlgorithm(oid) {
  * apart before it calls this.
  */
 export async function verifyCertSignatureRsa(cert, issuerSpkiDer) {
-    const hash = RSA_SIG_HASH[cert.sigAlgOid];
+    const hash = isImplementedCertSignatureAlgorithm(cert.sigAlgOid) ? RSA_SIG_HASH[cert.sigAlgOid] : undefined;
     if (!hash)
         return false;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Portable, browser-safe verification core for Typed Standards record packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -31,12 +31,12 @@
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {
-    "@noble/curves": "^2.2.0",
+    "@noble/curves": "^2.4.0",
     "@noble/hashes": "^2.2.0",
-    "canonicalize": "^3.0.0"
+    "canonicalize": "^5.1.0"
   },
   "devDependencies": {
-    "@types/node": "^20",
+    "@types/node": "^22",
     "typescript": "^5.9.3"
   },
   "engines": {