@typedstandards/verify-core 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -6,6 +6,32 @@ references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
 hardening arc; #116 is the standalone-verifier arc this package was extracted
 in).
 
+## 0.9.0 — 2026-08-19
+
+Vocabulary settlement (spec v0.1.5 Appendix J; registry Q50/Q66, ADR-0025,
+anchored at `civic-ai-tools#160`). "Evidence" is retired from the artifact and
+infrastructure brand role and retained only for the epistemic
+Question/Evidence/Claim role. **A minor bump** — a new export, no removals, no
+behavior change.
+
+- **`verifyRecord` is the canonical §9.2 entry point.** `verifyEvidence` remains
+  exported as a **deprecated alias**, and it is the same function object
+  (`verifyEvidence === verifyRecord`), not a wrapper — every existing caller
+  keeps working unchanged and gets byte-identical results. The alias is removed
+  no earlier than the next MAJOR version. Migration class `alias-and-deprecate`
+  (Appendix J).
+- Package `description` and one `keywords` entry now say "record packages"
+  rather than "evidence packages"; the README's usage example imports
+  `verifyRecord` and states the alias explicitly. Present-tense references to
+  the entry point in published JSDoc (`VerifyInput`, `lifecycle.ts`) name
+  `verifyRecord`; past-tense historical narration of what the function did at
+  earlier versions is left as written, since it remains accurate.
+- New regression guard in `package-exports.test.ts`: both names must resolve
+  and must be the same function object, so the alias cannot silently become a
+  second implementation or disappear.
+- No wire, algorithm, check-depth, or result-shape change. Already-signed
+  packages are byte-identical and verify exactly as before.
+
 ## 0.8.1 — 2026-08-17
 
 - Removed the `prepare` (install-time build) script (typedstandards#39).

package/README.md

@@ -1,6 +1,6 @@
 # @typedstandards/verify-core
 
-The portable, **browser-safe** verification core for [Typed Standards][ts] evidence
+The portable, **browser-safe** verification core for [Typed Standards][ts] record
 packages — the spec §9.2 check suite, factored so it runs **identically** on a
 server (e.g. civicaitools.org's verify route) and in the browser (the
 typedstandards.org client-side verifier). One implementation, so a tampered
@@ -45,7 +45,7 @@ edge, and in Node.
 ## Usage
 
 ```ts
-import { verifyEvidence, type VerifyInput, type TrustRegistry } from '@typedstandards/verify-core';
+import { verifyRecord, type VerifyInput, type TrustRegistry } from '@typedstandards/verify-core';
 
 const input: VerifyInput = {
   package: pkg,            // the parsed package JSON
@@ -56,7 +56,7 @@ const input: VerifyInput = {
   lifecycle,              // optional sidecar lifecycle state
 };
 
-const result = await verifyEvidence(input, {
+const result = await verifyRecord(input, {
   registry,               // a TrustRegistry (fetched from the package's trustRegistryUrl)
   fetch: globalThis.fetch,
 });
@@ -64,6 +64,14 @@ const result = await verifyEvidence(input, {
 // contentHash, typeResolution, signerIdentity, lifecycle, ...
 ```
 
+> **`verifyEvidence` is the same function.** The 2026-08-19 vocabulary settlement
+> renamed the entry point to `verifyRecord` (spec Appendix J) — "evidence" is
+> retired from the artifact/infrastructure brand role and kept only for the
+> epistemic Question/Evidence/Claim role. `verifyEvidence` is still exported as a
+> **deprecated alias of this exact function object**, so existing code keeps
+> working unchanged and returns identical results. The alias is removed no
+> earlier than the next MAJOR version; new code should use `verifyRecord`.
+
 The barrel (`.`) also exports the individual check functions
 (`recomputePackageHash`, `verifySignature`, `verifyKeyTrust`, `verifyContentHash`,
 …), the canonicalization primitives (`computeEnvelopeHash`,

package/dist/blob-ref.js

@@ -1,4 +1,4 @@
-// Content-addressable blob references for evidence package fields (spec §9.2
+// Content-addressable blob references for record package fields (spec §9.2
 // check #9) — browser-safe.
 //
 // Large fields (full output text, trace JSON, composed skill guidance) can be

package/dist/index.js

@@ -1,4 +1,4 @@
-// @typedstandards/verify-core (in-repo) — the portable, browser-safe evidence
+// @typedstandards/verify-core (in-repo) — the portable, browser-safe record
 // verification core (civic-ai-tools-website#116 WS2).
 //
 // Pure functions over provided data: no `node:crypto` / `fs` / `path` / `process`

package/dist/lifecycle.js

@@ -11,7 +11,7 @@
 // verification logic (factored from the server `verify.ts`). The DB + blob fetch
 // orchestration that assembles the chain stays in the server `lifecycle.ts`,
 // which imports these. WS2's portable orchestrator (`verify.ts` →
-// `verifyEvidence`) consumes lifecycle at STATE depth (the sidecar's
+// `verifyRecord`) consumes lifecycle at STATE depth (the sidecar's
 // status/withdrawnAt/reason) rather than re-running the chain — verifying the
 // signed attestation chain independently in the browser is civic-ai-tools-website#119.
 import { computeEnvelopeHash } from "./canonicalization.js";

package/dist/verify.d.ts

@@ -48,7 +48,7 @@ export interface CommitmentLifecycleState {
     reinstatedReason?: string;
 }
 /**
- * Everything `verifyEvidence` needs, aligned to the WS1 commitment sidecar +
+ * Everything `verifyRecord` needs, aligned to the WS1 commitment sidecar +
  * the package JSON the sidecar's `packageUrl` resolves to.
  */
 export interface VerifyInput {
@@ -150,5 +150,20 @@ export interface VerifyResult {
  * Run the §9.2 check suite. The step order mirrors the server route exactly
  * (notably: Rekor before key-trust, because a deprecated-key trust decision is
  * time-bounded by the Rekor `integratedTime`).
+ *
+ * Named `verifyEvidence` before the 2026-08-19 vocabulary settlement; that
+ * name remains exported as a deprecated alias of this exact function.
  */
-export declare function verifyEvidence(input: VerifyInput, deps: VerifyDeps): Promise<VerifyResult>;
+export declare function verifyRecord(input: VerifyInput, deps: VerifyDeps): Promise<VerifyResult>;
+/**
+ * @deprecated Renamed to {@link verifyRecord} in the 2026-08-19 vocabulary
+ * settlement — "evidence" is retired from the artifact/infrastructure brand
+ * role and retained only for the epistemic Question/Evidence/Claim role (spec
+ * §6.3, Appendix J; migration class `alias-and-deprecate`).
+ *
+ * This is the SAME function object, not a wrapper: `verifyEvidence ===
+ * verifyRecord`. Existing callers keep working unchanged and get identical
+ * results; the alias is removed no earlier than this package's next MAJOR
+ * version. New code should import `verifyRecord`.
+ */
+export declare const verifyEvidence: typeof verifyRecord;

package/dist/verify.js

@@ -1,6 +1,6 @@
 // Portable verification orchestrator (spec §9.2) — browser-safe.
 //
-// `verifyEvidence` runs the §9.2 check suite over an already-resolved package +
+// `verifyRecord` runs the §9.2 check suite over an already-resolved package +
 // its proofs, returning one structured verdict. It is the SINGLE orchestration
 // both consumers run: the civicaitools.org server route (which injects its
 // `fetch`, its loaded trust registry, and — to preserve its current output — its
@@ -11,9 +11,14 @@
 // test pins this.
 //
 // `VerifyInput` is shaped to align field-for-field with the WS1 commitment
-// sidecar (`buildCommitmentView`) so WS3 can wire sidecar → verifyEvidence with
+// sidecar (`buildCommitmentView`) so WS3 can wire sidecar → verifyRecord with
 // no glue. The server route adapts its DB row to the same shape.
 //
+// The entry point was named `verifyEvidence` before the 2026-08-19 vocabulary
+// settlement (spec Appendix J, migration class `alias-and-deprecate`). That
+// name is still exported, still the same function object, and still works;
+// see the deprecated alias at the bottom of this file.
+//
 // Check depth: fully client-side for #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; #7 (RFC
 // 3161) is PRESENCE (`hasTimestamp`) AND, when a token is present, cryptographic TSA
 // verification against the pinned FreeTSA anchor (civic-ai-tools-website#119 P2a —
@@ -35,8 +40,11 @@ import { resolveLifecycleFromLegacyColumns, } from "./lifecycle.js";
  * Run the §9.2 check suite. The step order mirrors the server route exactly
  * (notably: Rekor before key-trust, because a deprecated-key trust decision is
  * time-bounded by the Rekor `integratedTime`).
+ *
+ * Named `verifyEvidence` before the 2026-08-19 vocabulary settlement; that
+ * name remains exported as a deprecated alias of this exact function.
  */
-export async function verifyEvidence(input, deps) {
+export async function verifyRecord(input, deps) {
     const { package: pkg, packageHash } = input;
     // Step 1 — recompute the envelope hash (checks #1 + #13). Tri-state: a present
     // package recomputes to `verified` / `altered`; a null package is `unavailable`
@@ -180,3 +188,15 @@ export async function verifyEvidence(input, deps) {
         lifecycle,
     };
 }
+/**
+ * @deprecated Renamed to {@link verifyRecord} in the 2026-08-19 vocabulary
+ * settlement — "evidence" is retired from the artifact/infrastructure brand
+ * role and retained only for the epistemic Question/Evidence/Claim role (spec
+ * §6.3, Appendix J; migration class `alias-and-deprecate`).
+ *
+ * This is the SAME function object, not a wrapper: `verifyEvidence ===
+ * verifyRecord`. Existing callers keep working unchanged and get identical
+ * results; the alias is removed no earlier than this package's next MAJOR
+ * version. New code should import `verifyRecord`.
+ */
+export const verifyEvidence = verifyRecord;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.8.1",
-  "description": "Portable, browser-safe verification core for Typed Standards evidence packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
+  "version": "0.9.0",
+  "description": "Portable, browser-safe verification core for Typed Standards record packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
   "type": "module",
@@ -55,7 +55,7 @@
   },
   "keywords": [
     "typed-standards",
-    "evidence",
+    "record-package",
     "verification",
     "provenance",
     "ed25519",