@typedstandards/verify-core 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -6,6 +6,14 @@ references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
 hardening arc; #116 is the standalone-verifier arc this package was extracted
 in).
 
+## 0.8.0 — 2026-08-01
+
+- New export: `ED25519_SPKI_PREFIX` (`signature.ts`) — the fixed 12-byte
+  Ed25519 SPKI DER prefix this module asserts in `extractRawPublicKey`.
+  Previously duplicated locally by `@typedstandards/produce-core`'s
+  `derivePublicKeySpki`, which now imports it (typedstandards#36). No behavior
+  change; the bytes are identical.
+
 ## 0.7.0 — 2026-06-16
 
 - #1 envelope integrity is now TRI-STATE. `VerifyResult` gains an

package/dist/signature.d.ts

@@ -1,3 +1,14 @@
+/**
+ * The fixed 12-byte prefix of an Ed25519 public key in SPKI DER (SEQUENCE →
+ * AlgorithmIdentifier{ OID 1.3.101.112 } → BIT STRING, 0 unused bits); the
+ * full 44-byte structure is this prefix followed by the 32-byte raw key.
+ * Asserting the prefix + length before slicing the tail makes a malformed key
+ * throw rather than yield 32 arbitrary bytes — matching the old JWK path,
+ * which threw on a bad key. Exported (typedstandards#36) so producers
+ * assembling SPKI DER — `@typedstandards/produce-core`'s
+ * `derivePublicKeySpki` — build from the same bytes this module asserts.
+ */
+export declare const ED25519_SPKI_PREFIX: Uint8Array<ArrayBuffer>;
 /**
  * Extract the raw 32-byte Ed25519 public key from a base64 SPKI DER encoding.
  * Browser-safe replacement for Node's `crypto.createPublicKey(...).export({jwk})`:

package/dist/signature.js

@@ -8,12 +8,17 @@
 // reused as-is, INCLUDING the #111 algorithm dispatch.
 import { ed25519, ed25519ph } from '@noble/curves/ed25519.js';
 import { base64ToBytes, sha512Hex, utf8ToBytes } from "./primitives.js";
-// An Ed25519 public key in SPKI DER is a fixed 44-byte structure: a 12-byte
-// prefix (SEQUENCE → AlgorithmIdentifier{ OID 1.3.101.112 } → BIT STRING, 0
-// unused bits) followed by the 32-byte raw key. Asserting the prefix + length
-// before slicing the tail makes a malformed key throw rather than yield 32
-// arbitrary bytes — matching the old JWK path, which threw on a bad key.
-const ED25519_SPKI_PREFIX = Uint8Array.from([
+/**
+ * The fixed 12-byte prefix of an Ed25519 public key in SPKI DER (SEQUENCE →
+ * AlgorithmIdentifier{ OID 1.3.101.112 } → BIT STRING, 0 unused bits); the
+ * full 44-byte structure is this prefix followed by the 32-byte raw key.
+ * Asserting the prefix + length before slicing the tail makes a malformed key
+ * throw rather than yield 32 arbitrary bytes — matching the old JWK path,
+ * which threw on a bad key. Exported (typedstandards#36) so producers
+ * assembling SPKI DER — `@typedstandards/produce-core`'s
+ * `derivePublicKeySpki` — build from the same bytes this module asserts.
+ */
+export const ED25519_SPKI_PREFIX = Uint8Array.from([
     0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
 ]);
 const ED25519_SPKI_LENGTH = 44;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Portable, browser-safe verification core for Typed Standards evidence packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",