{"_id":"@atlasent/verify","name":"@atlasent/verify","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@atlasent/verify","version":"0.1.0","description":"Offline verifier for AtlaSent Proof bundles. Recomputes the audit chain, re-checks Ed25519 signatures, and re-hashes payloads against bound proofs — without touching the API.","type":"module","main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"import":"./dist/index.js","types":"./dist/index.d.ts"}},"bin":{"atlasent-verify":"dist/cli.js"},"dependencies":{"zod":"3.25.30"},"devDependencies":{"@types/node":"20.14.10","tsx":"4.17.0","typescript":"5.5.4","vitest":"2.0.5"},"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/AtlaSent-Systems-Inc/atlasent-api.git","directory":"packages/verify"},"keywords":["atlasent","verify","proof","audit","compliance","ed25519"],"license":"Apache-2.0","scripts":{"build":"tsc -p tsconfig.json","lint":"node -e \"console.log('lint handled at root for now')\"","typecheck":"tsc -p tsconfig.json --noEmit","test":"vitest run","verify":"tsx src/cli.ts"},"_id":"@atlasent/verify@0.1.0","bugs":{"url":"https://github.com/AtlaSent-Systems-Inc/atlasent-api/issues"},"homepage":"https://github.com/AtlaSent-Systems-Inc/atlasent-api#readme","_integrity":"sha512-lV0u/Fw3iGf4XNZswpBT/Qdc+cNsfB9YI9hbBTD0IsEy6lewwRXqC0503tN3tg467WY7siTkAAnnDtV52TOKOA==","_resolved":"/tmp/c871ae4f62d02e5572e3177ff3f319bc/atlasent-verify-0.1.0.tgz","_from":"file:atlasent-verify-0.1.0.tgz","_nodeVersion":"20.20.2","_npmVersion":"10.8.2","dist":{"integrity":"sha512-lV0u/Fw3iGf4XNZswpBT/Qdc+cNsfB9YI9hbBTD0IsEy6lewwRXqC0503tN3tg467WY7siTkAAnnDtV52TOKOA==","shasum":"5dba7f64330594ebeef18be1c93abaca465d0868","tarball":"https://registry.npmjs.org/@atlasent/verify/-/verify-0.1.0.tgz","fileCount":20,"unpackedSize":65177,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDcjbeFa4sx/eV91KvcU4FUK2W/qV8Z/WoILnhsk6sMcQIhAMa8dFaq9SIS3r6EGxA/Y5W6yolK7xOgZqvkYN7G9i/b"}]},"_npmUser":{"name":"bettyc","email":"betty@atlasent.io"},"directories":{},"maintainers":[{"name":"bettyc","email":"betty@atlasent.io"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/verify_0.1.0_1780992756549_0.8476732507499443"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-09T08:12:36.360Z","0.1.0":"2026-06-09T08:12:36.698Z","modified":"2026-06-09T08:12:36.950Z"},"maintainers":[{"name":"bettyc","email":"betty@atlasent.io"}],"description":"Offline verifier for AtlaSent Proof bundles. Recomputes the audit chain, re-checks Ed25519 signatures, and re-hashes payloads against bound proofs — without touching the API.","homepage":"https://github.com/AtlaSent-Systems-Inc/atlasent-api#readme","keywords":["atlasent","verify","proof","audit","compliance","ed25519"],"repository":{"type":"git","url":"git+https://github.com/AtlaSent-Systems-Inc/atlasent-api.git","directory":"packages/verify"},"bugs":{"url":"https://github.com/AtlaSent-Systems-Inc/atlasent-api/issues"},"license":"Apache-2.0","readme":"# @atlasent/verify\n\nOffline verifier for AtlaSent Proof bundles. It recomputes every audit\nhash, re-walks the hash-linked chain, and re-checks every Ed25519\nsignature — with **zero network calls and zero database access**. A\npassing verification here is identical to the check the API runs, so it's\nsuitable as a third-party / auditor-side integrity gate.\n\n## Install\n\n```bash\nnpm i -g @atlasent/verify   # or: npx @atlasent/verify ...\n```\n\n## CLI\n\n```bash\n# Verify a bundle exported from GET /v1/proofs/export.\n# Signatures are checked against the bundle's embedded key registry.\natlasent-verify bundle.json\n\n# Pin trust to a key you obtained out-of-band (e.g. the AtlaSent trust\n# center). The bundle's own key claim is then ignored — this is the\n# assurance that matters for an audit.\natlasent-verify bundle.json --pubkey @atlasent-audit-key.pem\n```\n\nExit code is `0` when every proof verifies, `1` otherwise — and `2` for\nusage/IO errors. The summary line reports the key source\n(`out-of-band pinned key` vs `bundle-embedded registry`).\n\n### `--pubkey` formats\n\nThe flag (or the `ATLASENT_PUBLIC_KEY_PEM` / `ATLASENT_AUDIT_PUBLIC_KEY`\nenv var) accepts the key as:\n\n- PEM (`-----BEGIN PUBLIC KEY-----`, SPKI),\n- base64 / base64url of the SPKI DER, or\n- base64 / base64url of the raw 32-byte Ed25519 key.\n\nPrefix the value with `@` to read it from a file. Passing `--pubkey`\nwithout a value is an error — the verifier fails closed rather than\nsilently falling back to the bundle's key.\n\n## Library\n\n```ts\nimport { verifyBundle, importPublicKey } from \"@atlasent/verify\";\n\nconst pinnedKey = await importPublicKey(pem); // or raw/SPKI base64\nconst result = await verifyBundle(bundle, { pinnedKey });\n\nresult.status;      // \"valid\" | \"invalid\"\nresult.key_source;  // \"pinned\" | \"bundle\"\nresult.results;     // per-proof checks + failure_reasons\n```\n\n## License\n\nApache-2.0\n","readmeFilename":"README.md","_rev":"1-f1dbcb68cc38d87c6b03d8e4b438fa34"}