@typedstandards/verify-core 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog — @typedstandards/verify-core
+
+Factual record of what changed per published version. Check numbers (#1–#15)
+refer to the Typed Standards specification §9.2 verification sequence. Issue
+references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
+hardening arc; #116 is the standalone-verifier arc this package was extracted
+in).
+
+## 0.6.1 — 2026-06-10
+
+- Documentation only; no code changes. Corrects the README's stale "Check
+  depth (v1)" section — checks #7/#8/#10 have run at full cryptographic depth
+  since 0.2.0–0.6.0, not presence/hash-parity/state depth as previously
+  described. Adds this changelog.
+
+## 0.6.0 — 2026-06-07
+
+- #7 hardening: strict RFC 5280 certificate-chain validation (#119 P4).
+- Shared `parseInclusionProof` guard for #8 consumers (#119 P4).
+
+## 0.5.0 — 2026-06-07
+
+- #10 at full depth: independent verification of the signed lifecycle
+  attestation chain, including reachability from the package node, replacing
+  host-reported state (#119 P3).
+
+## 0.4.0 — 2026-06-07
+
+- #7 deepened: TSA certificate-chain verification to a pinned FreeTSA root;
+  token `genTime` surfaced to check #5 (#119 P2b).
+
+## 0.3.1 — 2026-06-07
+
+- Fix: accept high-S ECDSA signatures (`lowS: false`) from third-party
+  signers.
+
+## 0.3.0 — 2026-06-07
+
+- #7 at cryptographic depth: RFC 3161 token parsing, message-imprint match,
+  and TSA signature verification, FreeTSA profile (#119 P2a).
+
+## 0.2.0 — 2026-06-06
+
+- #8 at cryptographic depth: Rekor Merkle inclusion-proof verification from
+  the carried proof, against Rekor's pinned public key; carried-offline
+  integration test (#119 P1).
+
+## 0.1.0 — 2026-06-05
+
+- Initial release (#116 WS2/WS3): the spec §9.2 check suite, browser-safe (no
+  Node built-ins). #7 at presence depth, #8 at hash-parity depth, #10 at state
+  depth; all other checks fully client-side.

package/README.md

@@ -66,17 +66,28 @@ The barrel (`.`) also exports the individual check functions
 `computeContentHashSha256`), and every status vocabulary type — so a consumer can
 drive the checks one-at-a-time and render the math as it resolves.
 
-## Check depth (v1)
-
-Fully client-side: #1 envelope hash, #2 signature, #3 canonicalization, #4 content
-hash, #5 key trust, #6 kid consistency, #9 blob refs, #12 type, #13 nodeId, #14
-signer identity, #15 captureMethod vocab. **Presence** only for #7 (RFC 3161).
-**Hash-parity** only for #8 (Rekor). **State** depth for #10 (lifecycle).
-
-The deeper offline crypto — TSA-chain verification, Rekor Merkle-inclusion,
-independent lifecycle-chain verification, and the authoritative bundle-mode test —
-is a fast-follow (#119), not in this release. The UI built on this should be
-honest about what is presence vs. full-crypto.
+## Check depth (v0.6.x)
+
+Every check in the spec §9.2 sequence runs fully client-side, including the three
+that shipped at reduced depth in v0.1:
+
+- **#7 RFC 3161 timestamp** — full cryptographic verification: token parsing,
+  message-imprint match, TSA signature, and certificate-chain validation with
+  strict RFC 5280 checks to a pinned root (FreeTSA EC-P384 leaf → RSA-4096
+  root).
+- **#8 Rekor transparency log** — cryptographic Merkle inclusion-proof
+  verification from the proof carried with the package, against Rekor's pinned
+  public key; no live call to Rekor required.
+- **#10 lifecycle** — independent verification of the signed lifecycle
+  attestation chain, including reachability from the package node, instead of
+  trusting a host-reported state.
+
+Verification is offline-first: from a self-contained commitment bundle the full
+sequence runs with zero network access (demonstrated by a hermetic,
+network-blocked test in this monorepo). Trust anchors (the TSA certificate
+chain and the Rekor log public key) ship pinned in the source with capture
+dates and rotation notes. See `CHANGELOG.md` for how each check reached full
+depth across 0.2.0–0.6.0.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Portable, browser-safe verification core for Typed Standards evidence packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -20,6 +20,7 @@
   "files": [
     "dist",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {