Separate signer policy and expose BLS signing fixtures

[HDauven]

Summary

Implement ichbindas's package-surface cleanup in #2 before the first registry publication.

• Expose the existing checkPolicyLimits through @dusk/typed-data/policy on npm and JSR, removing it from the root hashing export.
• Expose BLS fixtures through the npm @dusk/typed-data/vectors/bls-signing/* path, so consumers need not traverse the package's internal directories.
• Rename the corpus directory to vectors/bls-signing/ and update its generator/test/native-check paths. All five BLS files are 100% identical renames; all 41 fixture files retain their original bytes.
• Document the intentional API change and migration path. No new policy implementation, cryptographic dependency or workflow.

Hasher, BLS verifier and normative specification are unchanged. In particular, §11 still requires verifiers to support otherwise-valid inputs within the resource floor and permits refusal above it. Moving the helper clarifies its intended use; the 70,000-byte example is not itself a demonstrated verifier violation. The BLS scheme remains V2 and the typed-data protocol remains draft, not frozen.

Validation

• Library CI: 146 tests / 5 files, build/coverage, both generators and npm pack.
• Five frozen native BLS fixtures match the locked Rust emitter.
• New package-contract checks fail on the old export surface and pass here.
• Actual installed npm tarballs: public fixture resolution, /policy, absence from both hashing entrypoints, TypeScript declarations/negative controls, and resource-check behavior pass.
• Fresh Deno workspace: /policy, BLS exports and consumer policy/result types pass.
• Updated consumers: 161 Connect tests, 655 Wallet tests, four rendered-preview tests and Chrome/Firefox/Tauri frontend builds pass.
• Fresh production Chrome flow with those consumers: 25/25, seven actual signatures, zero uncaught page errors. All seven signatures verify through npm, JSR and native Rust, with rejecting controls.

Production E2E is Chrome-only and uses a fresh unfunded wallet with real provider/approval/engine/signing. This is not independent encoding/security certification or a full cross-platform Wallet audit. Local tarballs/workspaces do not prove registry availability.

Coordination

Connect #41 and Wallet #112 are updated together for this surface. Wallet's Noble pinning and checked little-endian golden-test serialization are kept in a separate Wallet hardening commit; no runtime dependency version was upgraded.

The package remains unpublished at 0.1.0-next.0 (fresh npm/JSR probes return 404). Review/merge this library change, coordinate the actual registry version, then regenerate consumer lockfiles and repeat clean-install/normal CI checks. No registry publication, merge, release or protocol freeze is performed by this PR. Prior contributor history is preserved unchanged.

Refs #2.

[Copilot]

🟢 Approval recommended

No unresolved issues were identified.

Pull request overview

This PR separates signer policy checks into a public /policy entrypoint and exposes renamed BLS signing fixtures through the package surface.

Changes:

• Adds npm and JSR policy exports while removing the root policy export.
• Publishes BLS fixtures under vectors/bls-signing/.
• Updates generators, tests, package metadata, documentation, and changelog.

File summaries

File	Reviewed change
vectors/bls-signing/zero_seed_index_255.json	Renamed BLS signing fixture.
vectors/bls-signing/zero_seed_index_0.json	Renamed BLS signing fixture.
vectors/bls-signing/typed_data_digest_nested_struct.json	Renamed BLS signing fixture.
vectors/bls-signing/patterned_seed_index_1.json	Renamed BLS signing fixture.
vectors/bls-signing/anchor_zero_seed_index_42.json	Renamed BLS signing fixture.
tsconfig.json	Includes the policy entrypoint.
tools/rust-vector-emitter/check.mjs	Checks the renamed corpus.
src/typed-data/index.ts	Removes the root policy export.
src/policy/index.ts	Exposes signer policy checks.
src/package.test.ts	Validates package-surface contracts.
src/bls/vectors.generated.test.ts	Tests fixtures from the renamed directory.
scripts/generate-bls-vectors.ts	Updates fixture generation paths.
README.md	Documents the migration and fixture paths.
package.json	Adds npm policy and fixture exports.
jsr.json	Adds the JSR policy export.
CHANGELOG.md	Documents the API and corpus changes.

Review details

• Files reviewed: 10/16 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.