{"_id":"@aevesa/verify","_rev":"3-1a235f5b430b0d94213ef71dc3dcad6a","name":"@aevesa/verify","dist-tags":{"latest":"0.1.2"},"versions":{"0.1.0":{"name":"@aevesa/verify","version":"0.1.0","keywords":["aevesa","liability-receipt","agent-governance","offline-verification","cryptography","compliance"],"license":"SEE LICENSE IN LICENSE","_id":"@aevesa/verify@0.1.0","maintainers":[{"name":"abalous2894","email":"andrewbalous@gmail.com"}],"homepage":"https://verify.aevesa.com","bugs":{"url":"https://github.com/abalous2894/sentinul-backend/issues"},"bin":{"aevesa":"src/cli.js","aevesa-verify":"dist/aevesa-verify.js"},"dist":{"shasum":"df05e0f1383a37fa3b2c3a3ce9cab99c03ba055d","tarball":"https://registry.npmjs.org/@aevesa/verify/-/verify-0.1.0.tgz","fileCount":284,"integrity":"sha512-cbl9toAXqKtptIQnu35OnyzP8u2DO3jaUHmyDJJbprAqtRGHr4s/42LPTxYJBh3KhiQtyig1Mo4vhlN9lv9wrA==","signatures":[{"sig":"MEYCIQDM/WhmQBFDNNuhZtDupZRbD+1vj3GRkixzQk0k24VuqQIhAOacmONFoZWHOSCqhRzp+DhnadJ2B2VoM9VjtB/WoT8V","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":888378},"main":"dist/index.js","type":"module","types":"dist/index.d.ts","engines":{"node":">=20"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"},"./ledger":{"import":"./src/ledgerExports.js"},"./offline":{"import":"./src/offlinePromotionVerifier.js"},"./core/stableStringify":{"types":"./dist/core/stableStringify.d.ts","import":"./dist/core/stableStringify.js"}},"gitHead":"5edbc5cffdd28d9f2a047ee00238ec20cf20fbad","scripts":{"build":"tsc && node scripts/copy-core-js.mjs","test:kvr-301":"npm run build && node scripts/test-kvr-301-causal-lineage.mjs","build:browser":"npm run build && node scripts/build-browser-bundle.mjs","test:npm-pack":"npm run build && node scripts/test-npm-pack.mjs","prepublishOnly":"npm run build","test:verify-ci":"npm run build && npm run test:liability-receipt && npm run test:intent-alignment && npm run test:digest-binding && npm run test:kvr-301 && npm run test:jcs-receipt-leaf && npm run test:attest-mcp-manifest && npm run test:aevesa-verify-cli && npm run test:offline-promotion && npm run test:replay-bundle && npm run test:witness-inclusion && npm run test:conformance-lab-cli && npm run test:policy-proof && npm run test:unified-verify && npm run test:verify-action && npm run test:npm-pack && node scripts/test-stable-stringify-export.mjs && node scripts/test-isRecord-export.mjs && node scripts/verify-portal-intent-sample.mjs","test:policy-proof":"npm run build && node scripts/generate-policy-proof-fixture.mjs && node scripts/test-policy-proof-cli.mjs","test:replay-bundle":"node scripts/test-replay-bundle-cli.mjs","test:verify-action":"npm run build && node scripts/test-verify-action.mjs","test:digest-binding":"npm run build && node scripts/test-digest-binding.mjs","test:unified-verify":"npm run build && node scripts/test-unified-verify-cli.mjs","test:intent-alignment":"npm run build && node --input-type=module -e \"import { runSpecVectors } from './src/spec/runSpecVectors.js'; const r = runSpecVectors({ silent: true }); if (!r.ok) { console.error(r.results.filter(x=>!x.pass)); process.exit(1);} console.log('intent alignment vectors OK');\" && node scripts/intent-alignment-parity.mjs","test:jcs-receipt-leaf":"npm run build && node scripts/test-jcs-receipt-leaf.mjs","test:aevesa-verify-cli":"npm run build && node scripts/test-aevesa-verify-cli.mjs","test:intent-divergence":"npm run build && node scripts/intent-divergence-mock.mjs","test:liability-receipt":"npm run build && node scripts/smoke-liability-receipt.mjs","test:offline-promotion":"node scripts/test-offline-promotion-verifier.mjs","test:witness-inclusion":"node scripts/test-witness-inclusion-verify.mjs","test:attest-mcp-manifest":"npm run build && node scripts/test-attest-mcp-manifest.mjs","test:conformance-lab-cli":"npm run build && node scripts/test-conformance-lab-cli.mjs","check:browser-bundle-sync":"node scripts/check-browser-bundle-sync.mjs","test:policy-proof-template":"npm run build && node scripts/test-policy-proof-template.mjs","test:jcs-prototype-pollution":"npm run build && node scripts/test-jcs-prototype-pollution.mjs"},"_npmUser":{"name":"abalous2894","email":"andrewbalous@gmail.com"},"repository":{"url":"git+https://github.com/abalous2894/sentinul-backend.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.6.2","description":"Stateless cryptographic verification engine for Aevesa liability-receipt/v1 specifications","directories":{},"_nodeVersion":"24.12.0","dependencies":{"zod":"^3.0.0","jose":"^5.10.0","commander":"^12.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"buffer":"^6.0.3","esbuild":"^0.25.0","typescript":"^5.7.0","@types/node":"^22.10.0","@noble/hashes":"^1.8.0"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.0_1788221126805_0.11864246181141969","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@aevesa/verify","version":"0.1.1","keywords":["aevesa","liability-receipt","agent-governance","offline-verification","cryptography","compliance"],"license":"SEE LICENSE IN LICENSE","_id":"@aevesa/verify@0.1.1","maintainers":[{"name":"abalous2894","email":"andrewbalous@gmail.com"}],"homepage":"https://verify.aevesa.com","bugs":{"url":"https://github.com/abalous2894/sentinul-backend/issues"},"bin":{"aevesa":"src/cli.js","verify":"src/cli.js","aevesa-verify":"dist/aevesa-verify.js"},"dist":{"shasum":"0b888d48c581f3693a7dd882fbed03cfb03578a2","tarball":"https://registry.npmjs.org/@aevesa/verify/-/verify-0.1.1.tgz","fileCount":284,"integrity":"sha512-mIa18w1TDXR8GqtmaCpF/1sYauTwuJHWGh6B54ofKQoRByk/oPw17yQw0e/IzokTzj7PJJGmQ8JKUuYxbKTeNA==","signatures":[{"sig":"MEUCIFowmImpUbRwzU1OB3qtekxz4/4cZB7VVn1ftucuCE1HAiEAiL//UsueO82msa5cG135zuGi7bNBl7C5Q6iYrbHj05s=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIAtBiPTcSwW8N4k5WVfFEcL3WTDtH4HIbsaqEUdRPcflAiEA3V/0RbEja03WVxFYuAFXal00UN9YkifxPjHCzgU9+3c=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":888533},"main":"dist/index.js","type":"module","types":"dist/index.d.ts","engines":{"node":">=20"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"},"./ledger":{"import":"./src/ledgerExports.js"},"./offline":{"import":"./src/offlinePromotionVerifier.js"},"./core/stableStringify":{"types":"./dist/core/stableStringify.d.ts","import":"./dist/core/stableStringify.js"}},"gitHead":"5edbc5cffdd28d9f2a047ee00238ec20cf20fbad","scripts":{"build":"tsc && node scripts/copy-core-js.mjs","test:kvr-301":"npm run build && node scripts/test-kvr-301-causal-lineage.mjs","build:browser":"npm run build && node scripts/build-browser-bundle.mjs","test:npm-pack":"npm run build && node scripts/test-npm-pack.mjs","prepublishOnly":"npm run build","test:verify-ci":"npm run build && npm run test:liability-receipt && npm run test:intent-alignment && npm run test:digest-binding && npm run test:kvr-301 && npm run test:jcs-receipt-leaf && npm run test:attest-mcp-manifest && npm run test:aevesa-verify-cli && npm run test:offline-promotion && npm run test:replay-bundle && npm run test:witness-inclusion && npm run test:conformance-lab-cli && npm run test:policy-proof && npm run test:unified-verify && npm run test:verify-action && npm run test:npm-pack && node scripts/test-stable-stringify-export.mjs && node scripts/test-isRecord-export.mjs && node scripts/verify-portal-intent-sample.mjs","test:policy-proof":"npm run build && node scripts/generate-policy-proof-fixture.mjs && node scripts/test-policy-proof-cli.mjs","test:replay-bundle":"node scripts/test-replay-bundle-cli.mjs","test:verify-action":"npm run build && node scripts/test-verify-action.mjs","test:digest-binding":"npm run build && node scripts/test-digest-binding.mjs","test:unified-verify":"npm run build && node scripts/test-unified-verify-cli.mjs","test:intent-alignment":"npm run build && node --input-type=module -e \"import { runSpecVectors } from './src/spec/runSpecVectors.js'; const r = runSpecVectors({ silent: true }); if (!r.ok) { console.error(r.results.filter(x=>!x.pass)); process.exit(1);} console.log('intent alignment vectors OK');\" && node scripts/intent-alignment-parity.mjs","test:jcs-receipt-leaf":"npm run build && node scripts/test-jcs-receipt-leaf.mjs","test:aevesa-verify-cli":"npm run build && node scripts/test-aevesa-verify-cli.mjs","test:intent-divergence":"npm run build && node scripts/intent-divergence-mock.mjs","test:liability-receipt":"npm run build && node scripts/smoke-liability-receipt.mjs","test:offline-promotion":"node scripts/test-offline-promotion-verifier.mjs","test:witness-inclusion":"node scripts/test-witness-inclusion-verify.mjs","test:attest-mcp-manifest":"npm run build && node scripts/test-attest-mcp-manifest.mjs","test:conformance-lab-cli":"npm run build && node scripts/test-conformance-lab-cli.mjs","check:browser-bundle-sync":"node scripts/check-browser-bundle-sync.mjs","test:policy-proof-template":"npm run build && node scripts/test-policy-proof-template.mjs","test:jcs-prototype-pollution":"npm run build && node scripts/test-jcs-prototype-pollution.mjs"},"_npmUser":{"name":"abalous2894","email":"andrewbalous@gmail.com"},"repository":{"url":"git+https://github.com/abalous2894/sentinul-backend.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.6.2","description":"Stateless cryptographic verification engine for Aevesa liability-receipt/v1 specifications","directories":{},"_nodeVersion":"24.12.0","dependencies":{"zod":"^3.0.0","jose":"^5.10.0","commander":"^12.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"readmeFilename":"README.md","devDependencies":{"buffer":"^6.0.3","esbuild":"^0.25.0","typescript":"^5.7.0","@types/node":"^22.10.0","@noble/hashes":"^1.8.0"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.1.1_1788221992705_0.6679093153078071","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"_id":"@aevesa/verify@0.1.2","bin":{"aevesa":"src/cli.js","verify":"src/cli.js","aevesa-verify":"dist/aevesa-verify.js"},"bugs":{"url":"https://github.com/abalous2894/sentinul-backend/issues"},"dist":{"shasum":"bcd7abfd38854383b951199b0d715ff6c4f0976c","tarball":"https://registry.npmjs.org/@aevesa/verify/-/verify-0.1.2.tgz","fileCount":284,"integrity":"sha512-wBKD3cNCTGOxDn5HeDS+MST1Jw4QSAruOkD9yh09QP/Exc8ZVv2qAjhyheIg3zfQ79TIaEKxkZzMrs3Mb8rCQg==","signatures":[{"sig":"MEYCIQCT1Zydg+coL9DNRo2jYEXMYLfD5JM7U32V4UwuAl+XaAIhAMRQp/r2ZEXvpdepHYQ0w+NVovn2kRDl7c+W2mRLC7IK","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCYqOy4h1CX/o4lKIWcqf81bZeNH1gawPBF3MapDVihsgIhAPH9StAatOIleZDg9Gs7Ds15yBf6mx1IwILTm0DyCSTE"}],"unpackedSize":888146},"main":"dist/index.js","name":"@aevesa/verify","type":"module","types":"dist/index.d.ts","engines":{"node":">=20"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"},"./ledger":{"import":"./src/ledgerExports.js"},"./offline":{"import":"./src/offlinePromotionVerifier.js"},"./core/stableStringify":{"types":"./dist/core/stableStringify.d.ts","import":"./dist/core/stableStringify.js"}},"gitHead":"5edbc5cffdd28d9f2a047ee00238ec20cf20fbad","license":"SEE LICENSE IN LICENSE","scripts":{"build":"tsc && node scripts/copy-core-js.mjs","test:kvr-301":"npm run build && node scripts/test-kvr-301-causal-lineage.mjs","build:browser":"npm run build && node scripts/build-browser-bundle.mjs","test:npm-pack":"npm run build && node scripts/test-npm-pack.mjs","prepublishOnly":"npm run build && node scripts/normalize-publish-lf.mjs","test:verify-ci":"npm run build && npm run test:liability-receipt && npm run test:intent-alignment && npm run test:digest-binding && npm run test:kvr-301 && npm run test:jcs-receipt-leaf && npm run test:attest-mcp-manifest && npm run test:aevesa-verify-cli && npm run test:offline-promotion && npm run test:replay-bundle && npm run test:witness-inclusion && npm run test:conformance-lab-cli && npm run test:policy-proof && npm run test:unified-verify && npm run test:verify-action && npm run test:npm-pack && node scripts/test-stable-stringify-export.mjs && node scripts/test-isRecord-export.mjs && node scripts/verify-portal-intent-sample.mjs","test:policy-proof":"npm run build && node scripts/generate-policy-proof-fixture.mjs && node scripts/test-policy-proof-cli.mjs","test:replay-bundle":"node scripts/test-replay-bundle-cli.mjs","test:verify-action":"npm run build && node scripts/test-verify-action.mjs","test:digest-binding":"npm run build && node scripts/test-digest-binding.mjs","test:unified-verify":"npm run build && node scripts/test-unified-verify-cli.mjs","test:intent-alignment":"npm run build && node --input-type=module -e \"import { runSpecVectors } from './src/spec/runSpecVectors.js'; const r = runSpecVectors({ silent: true }); if (!r.ok) { console.error(r.results.filter(x=>!x.pass)); process.exit(1);} console.log('intent alignment vectors OK');\" && node scripts/intent-alignment-parity.mjs","test:jcs-receipt-leaf":"npm run build && node scripts/test-jcs-receipt-leaf.mjs","test:aevesa-verify-cli":"npm run build && node scripts/test-aevesa-verify-cli.mjs","test:intent-divergence":"npm run build && node scripts/intent-divergence-mock.mjs","test:liability-receipt":"npm run build && node scripts/smoke-liability-receipt.mjs","test:offline-promotion":"node scripts/test-offline-promotion-verifier.mjs","test:witness-inclusion":"node scripts/test-witness-inclusion-verify.mjs","test:attest-mcp-manifest":"npm run build && node scripts/test-attest-mcp-manifest.mjs","test:conformance-lab-cli":"npm run build && node scripts/test-conformance-lab-cli.mjs","check:browser-bundle-sync":"node scripts/check-browser-bundle-sync.mjs","test:policy-proof-template":"npm run build && node scripts/test-policy-proof-template.mjs","test:jcs-prototype-pollution":"npm run build && node scripts/test-jcs-prototype-pollution.mjs"},"version":"0.1.2","_npmUser":{"name":"abalous2894","email":"andrewbalous@gmail.com"},"homepage":"https://verify.aevesa.com","keywords":["aevesa","liability-receipt","agent-governance","offline-verification","cryptography","compliance"],"repository":{"url":"git+https://github.com/abalous2894/sentinul-backend.git","type":"git","directory":"packages/verify"},"_npmVersion":"11.6.2","description":"Stateless cryptographic verification engine for Aevesa liability-receipt/v1 specifications","directories":{},"maintainers":[{"name":"abalous2894","email":"andrewbalous@gmail.com"}],"_nodeVersion":"24.12.0","dependencies":{"zod":"^3.0.0","jose":"^5.10.0","commander":"^12.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"buffer":"^6.0.3","esbuild":"^0.25.0","typescript":"^5.7.0","@types/node":"^22.10.0","@noble/hashes":"^1.8.0"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/verify_0.1.2_1788222050336_0.44354028954624725"}}},"time":{"created":"2026-09-01T00:05:26.567Z","modified":"2026-09-01T00:20:50.640Z","0.1.0":"2026-09-01T00:05:27.028Z","0.1.1":"2026-09-01T00:19:52.839Z","0.1.2":"2026-09-01T00:20:50.435Z"},"bugs":{"url":"https://github.com/abalous2894/sentinul-backend/issues"},"license":"SEE LICENSE IN LICENSE","homepage":"https://verify.aevesa.com","keywords":["aevesa","liability-receipt","agent-governance","offline-verification","cryptography","compliance"],"repository":{"url":"git+https://github.com/abalous2894/sentinul-backend.git","type":"git","directory":"packages/verify"},"description":"Stateless cryptographic verification engine for Aevesa liability-receipt/v1 specifications","maintainers":[{"name":"abalous2894","email":"andrewbalous@gmail.com"}],"readme":"# @aevesa/verify\r\n\r\nStateless cryptographic verification for **Aevesa `liability-receipt/v1`** (Verified Autonomous Sessions).\r\n\r\n## Open-core boundary\r\n\r\n| Open (this package) | Commercial (Aevesa platform) |\r\n|---------------------|------------------------------|\r\n| Schema validation | Runtime intercept / gateway |\r\n| `receipt_digest` preimage | HITL signing service |\r\n| Anchor hash format & chain | Ledger write / tenant Aegis |\r\n| Optional Ed25519 / RS256 verify | Policy packs & enforcement |\r\n\r\n## Install (monorepo workspace)\r\n\r\n```bash\r\ncd packages/verify && npm install && npm run build\r\n```\r\n\r\n## Install (npm — evaluators & CI)\r\n\r\n```bash\r\nnpm install @aevesa/verify\r\n# or one-shot:\r\nnpx @aevesa/verify verify evidence.json --summary\r\n```\r\n\r\nRequires Node.js 20+. No Aevesa account or API key for offline verification.\r\n\r\n**Publish (maintainers):** from repo root after `npm login` with `@aevesa` scope access and **npm 2FA enabled** (or a granular publish token with bypass-2FA):\r\n\r\n```bash\r\nnpm run publish:verify\r\n```\r\n\r\nRuns tarball smoke test (`test:npm-pack`) then publishes `@aevesa/verify` only (not the monorepo root).\r\n\r\nIf first publish is private (scoped default), make it public:\r\n\r\n```bash\r\nnpm access set status=public @aevesa/verify\r\n```\r\n\r\n## API\r\n\r\n```typescript\r\nimport { verifyReceipt, computeReceiptDigest } from '@aevesa/verify';\r\n\r\nconst result = verifyReceipt(receiptJson);\r\n// { isValid: true, details: { chainLength: 2, pillarsValidated: [...] } }\r\n```\r\n\r\n### Verification steps (stateless)\r\n\r\n1. Structural validation (Zod / `liability-receipt/v1`)\r\n2. SHA-256 `receipt_digest` over canonical pillar JSON (integrity excluded)\r\n3. `aegis/1` anchor hash format, uniqueness, optional `chain_preimage` linkage\r\n4. `integrity.signature_alg` — `none` (default), or Ed25519 / RS256 with issuer public key\r\n5. Cross-pillar rules (HITL + `released_after_hitl`, financial void, diligence narrative)\r\n\r\nNo database, HTTP, or environment configuration is required.\r\n\r\n## Public protocol repository scope\r\n\r\nIn **[Kovera-Protocol-Of-Record](https://github.com/abalous2894/Kovera-Protocol-Of-Record)** (this package synced via `scripts/sync-public-protocol.sh`), the supported open-core path is:\r\n\r\n- **`verifyReceipt()` / `computeReceiptDigest()`** for `liability-receipt/v1`\r\n- **`npm run test:liability-receipt`** — offline smoke test\r\n\r\nThe **aegis/1** and **Art. 12** commands below require `kovera-sovereign-ledger-spec.md`, which is **not** shipped in the public protocol repo. Run them from the full Aevesa monorepo or pass `--spec` to a local copy of that document.\r\n\r\nSee **SECURITY.md** at the protocol repository root (`docs/standards/SECURITY.md` in the private monorepo) for test-fixture signing notes and `security@aevesa.com`.\r\n\r\n## Legacy ledger / Art. 12 CLI (full monorepo)\r\n\r\nThe **aegis/1** reference CLI and ledger exports remain under:\r\n\r\n```bash\r\nnode packages/verify/src/cli.js verify-spec-vectors --spec path/to/kovera-sovereign-ledger-spec.md\r\n# programmatic: import from '@aevesa/verify/ledger'\r\n```\r\n\r\n## Browser bundle (verify.aevesa.com Tier A)\r\n\r\nClient-side `liability-receipt/v1` verification for the static verify portal:\r\n\r\n```bash\r\nnpm run build:browser\r\n# → sentinul-app-site/src/js/aevesa-verify.bundle.js\r\n```\r\n\r\nFrom the monorepo root: `npm run test:verify` (builds the bundle and runs `test:verify-ci`).\r\n\r\n**Deploy policy (Strategy A):** The bundle is **committed** to `sentinul-app-site/src/js/aevesa-verify.bundle.js` (not gitignored). After changing verify code run `npm run build:browser --workspace=@aevesa/verify` and commit the regenerated bundle before deploy. CI enforces sync via `npm run check:browser-bundle-sync --workspace=@aevesa/verify`.\r\n\r\n## Unified verify (Phase A — one front door)\r\n\r\n```bash\r\n# Auto-detect evidence type; human summary\r\nnpx @aevesa/verify verify ./evidence.json --summary\r\n\r\n# Machine-readable aevesa.verification-report/v1\r\nnpx @aevesa/verify verify ./evidence.json --json\r\n\r\n# Entry hash only (fetches public receipt when online)\r\nnpx @aevesa/verify verify --entry-hash <64-hex> --summary\r\n```\r\n\r\nMonorepo dev (same commands via local CLI):\r\n\r\n```bash\r\nnode packages/verify/src/cli.js verify ./evidence.json --summary\r\n```\r\n\r\nEvaluators: see [EVALUATORS.md](../../EVALUATORS.md) at repo root.\r\n\r\n## Smoke test\r\n\r\n```bash\r\nnpm run test:liability-receipt\r\nnpm run test:verify-ci\r\n```\r\n","readmeFilename":"README.md"}