{"_id":"@axiorank/audit-verify","_rev":"8-9deacafd90262ee54fb616151fe30480","name":"@axiorank/audit-verify","dist-tags":{"latest":"0.6.0"},"versions":{"0.1.0":{"name":"@axiorank/audit-verify","version":"0.1.0","keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance"],"author":{"name":"AxioRank"},"license":"MIT","_id":"@axiorank/audit-verify@0.1.0","maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"homepage":"https://axiorank.com","bugs":{"url":"https://github.com/frostyhand/AxioRank/issues"},"bin":{"audit-verify":"dist/cli.js"},"dist":{"shasum":"63fd0b8b1390e83fbc64c6d84cff154508934231","tarball":"https://registry.npmjs.org/@axiorank/audit-verify/-/audit-verify-0.1.0.tgz","fileCount":18,"integrity":"sha512-rMgj9wMOzGMg7qFMte9IguJfqo8WMcJzAVI+WEkeFr7AMEu2VVaAYQU9zdSjzM8GWX5aSA9aLYO0vUrGEpkR4g==","signatures":[{"sig":"MEQCIG3XMRVK731vZwOGLyshZ2X4+mReM4fJ1Zisffl/ZnGrAiBjRTlIKdjXTHh3Jfc9qrJgDGHUuDL0+JU+6RT5AiH8ew==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":76598},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./package.json":"./package.json"},"gitHead":"73efdaec70e828e71cdacc6e1a9d113c069be89f","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit","gen-vectors":"node scripts/gen-vectors.mjs"},"_npmUser":{"name":"tejaswi.s","email":"tejaswi33@gmail.com"},"repository":{"url":"git+https://github.com/frostyhand/AxioRank.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.8","description":"Independently verify AxioRank audit receipts offline. Merkle inclusion proofs, Ed25519 signed tree heads, and delegation provenance. Zero dependencies.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.3","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.5","vitest":"^4.1.8","typescript":"^6.0.3","@types/node":"^22.10.2"},"_npmOperationalInternal":{"tmp":"tmp/audit-verify_0.1.0_1781023296773_0.8839699152186271","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@axiorank/audit-verify","version":"0.2.0","keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance"],"author":{"name":"AxioRank"},"license":"MIT","_id":"@axiorank/audit-verify@0.2.0","maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"homepage":"https://axiorank.com","bugs":{"url":"https://github.com/frostyhand/AxioRank/issues"},"bin":{"audit-verify":"dist/cli.js"},"dist":{"shasum":"99c840775ae1956c4b541b8ad77eb6698f01dc3a","tarball":"https://registry.npmjs.org/@axiorank/audit-verify/-/audit-verify-0.2.0.tgz","fileCount":18,"integrity":"sha512-B/d9n8WNeVufALvXPiMuhhRyvGjkOiYe2yOyKG1NLjMTpEVh+tBA4gvZ6yJazAPirzm8q2LmVsRpsyvRzhNrTw==","signatures":[{"sig":"MEQCIFzacl2Gy59aBuX9Em+VuvY0nF7xIaMA2HPfF8zTVTSsAiB3XLdUlfbhqvGA9CZBNyKvUy5jvdnstKvq6+Y2zWuoHg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":153881},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./package.json":"./package.json"},"gitHead":"d153e3056c9469ce8e1111e0079af0144c32406b","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit","gen-vectors":"node scripts/gen-vectors.mjs"},"_npmUser":{"name":"tejaswi.s","email":"tejaswi33@gmail.com"},"repository":{"url":"git+https://github.com/frostyhand/AxioRank.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.8","description":"Independently verify AxioRank audit receipts offline. Merkle inclusion proofs, Ed25519 signed tree heads, delegation provenance, and human-approval signatures. Zero dependencies.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.3","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.5","vitest":"^4.1.8","typescript":"^6.0.3","@types/node":"^22.10.2"},"_npmOperationalInternal":{"tmp":"tmp/audit-verify_0.2.0_1781165672152_0.6611029666325587","host":"s3://npm-registry-packages-npm-production"}},"0.2.1":{"name":"@axiorank/audit-verify","version":"0.2.1","keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance"],"author":{"name":"AxioRank"},"license":"MIT","_id":"@axiorank/audit-verify@0.2.1","maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"homepage":"https://axiorank.com","bugs":{"url":"https://github.com/frostyhand/AxioRank/issues"},"bin":{"audit-verify":"dist/cli.js"},"dist":{"shasum":"3d27429807ac15223681484de125313e41113ca3","tarball":"https://registry.npmjs.org/@axiorank/audit-verify/-/audit-verify-0.2.1.tgz","fileCount":18,"integrity":"sha512-Avcj5ZTxEDk185LYhcpsuQ9zU1p4TXprLARg9rflKEwlZuLJC6ieaoQ2L04DwwTO+rcUYjoRiByfUkYCXS0zxQ==","signatures":[{"sig":"MEUCIQCDc3vcINMBSkXawzy3mVzAUPupSylc7FGS4hSC2f27ggIgYM/on5w6BVFwe+rz5iw0i3DVsRZBsqvfSdSqu2iBNKQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":155847},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./package.json":"./package.json"},"gitHead":"bdc97bd408c92dcb91950eaa2e5d997ae94f6fc3","scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit","gen-vectors":"node scripts/gen-vectors.mjs"},"_npmUser":{"name":"tejaswi.s","email":"tejaswi33@gmail.com"},"repository":{"url":"git+https://github.com/frostyhand/AxioRank.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.8","description":"Independently verify AxioRank audit receipts offline. Merkle inclusion proofs, Ed25519 signed tree heads, delegation provenance, human-approval signatures, and Sigstore Rekor witness co-signatures. Zero dependencies.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.3","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.5","vitest":"^4.1.8","typescript":"^6.0.3","@types/node":"^22.10.2"},"_npmOperationalInternal":{"tmp":"tmp/audit-verify_0.2.1_1781166471483_0.25480538487316107","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@axiorank/audit-verify","version":"0.3.0","keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance","bitcoin","opentimestamps","blockchain-anchor"],"author":{"name":"AxioRank"},"license":"MIT","_id":"@axiorank/audit-verify@0.3.0","maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"homepage":"https://axiorank.com","bugs":{"url":"https://github.com/frostyhand/AxioRank/issues"},"bin":{"audit-verify":"dist/cli.js"},"dist":{"shasum":"5895e33a32ea30805fb14376d08ae7b49da0fe03","tarball":"https://registry.npmjs.org/@axiorank/audit-verify/-/audit-verify-0.3.0.tgz","fileCount":18,"integrity":"sha512-5JRMIwqGMNnkFLQTe+t3Rpy7/tHnbEDUlI7gXv5MjpYuhrYmshgkBrs3/m/rpZ4nQzU8MOCFl30gOMyjEzo0Dg==","signatures":[{"sig":"MEYCIQDtoB+F78c1Ci0sFNrzrxu4mczvWwU9PsxeMZZmP2HjjgIhALNComA3DVD3x8jH4GSVTVV5RLD7wbV111Kna4DYv9Xl","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":274643},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./package.json":"./package.json"},"scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit","gen-vectors":"node scripts/gen-vectors.mjs"},"_npmUser":{"name":"tejaswi.s","email":"tejaswi33@gmail.com"},"deprecated":"Bitcoin anchoring removed; upgrade to 0.3.1 (verifyOtsWitness/checkOts/parseOts no longer exist).","repository":{"url":"git+https://github.com/frostyhand/AxioRank.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.8","description":"Independently verify AxioRank audit receipts offline. Merkle inclusion proofs, Ed25519 signed tree heads, delegation provenance, human-approval signatures, Sigstore Rekor witness co-signatures, and Bitcoin anchors via OpenTimestamps. Zero dependencies.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.3","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.5","vitest":"^4.1.8","typescript":"^6.0.3","@types/node":"^22.10.2"},"_npmOperationalInternal":{"tmp":"tmp/audit-verify_0.3.0_1782324767501_0.34546827188057505","host":"s3://npm-registry-packages-npm-production"}},"0.3.1":{"name":"@axiorank/audit-verify","version":"0.3.1","keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance"],"author":{"name":"AxioRank"},"license":"MIT","_id":"@axiorank/audit-verify@0.3.1","maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"homepage":"https://axiorank.com","bugs":{"url":"https://github.com/frostyhand/AxioRank/issues"},"bin":{"audit-verify":"dist/cli.js"},"dist":{"shasum":"962893c41a9073a369bf7dc4cb889ba417387057","tarball":"https://registry.npmjs.org/@axiorank/audit-verify/-/audit-verify-0.3.1.tgz","fileCount":18,"integrity":"sha512-OG5RYE9kwCGE5Ksy6BKwLBJMcvOHRjX+WtS7PMieFNWeetuOSC4XQgHoCZJGr+z58kZz1u5oUQrOb0VZupkCyw==","signatures":[{"sig":"MEUCIQCwHxKPS10NDSGe/H7O3rIf5jkGZGS8MRUTiZKAOJqZ5wIgSfZo7L+2Hk6iOT/8Vz/Q67SeaoCQyv4H8Fvvv3FKCJc=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":204499},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./package.json":"./package.json"},"scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit","gen-vectors":"node scripts/gen-vectors.mjs"},"_npmUser":{"name":"tejaswi.s","email":"tejaswi33@gmail.com"},"repository":{"url":"git+https://github.com/frostyhand/AxioRank.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.8","description":"Independently verify AxioRank audit receipts offline. Merkle inclusion proofs, Ed25519 signed tree heads, delegation provenance, human-approval signatures, and Sigstore Rekor witness co-signatures. Zero dependencies.","directories":{},"sideEffects":false,"_nodeVersion":"22.22.3","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.5","vitest":"^4.1.8","typescript":"^6.0.3","@types/node":"^22.10.2"},"_npmOperationalInternal":{"tmp":"tmp/audit-verify_0.3.1_1782366028182_0.3475725420909499","host":"s3://npm-registry-packages-npm-production"}},"0.5.0":{"name":"@axiorank/audit-verify","version":"0.5.0","keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance","agentic-commerce","agent-payments","mandate","conformance"],"author":{"name":"AxioRank"},"license":"MIT","_id":"@axiorank/audit-verify@0.5.0","maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"homepage":"https://axiorank.com","bugs":{"url":"https://github.com/frostyhand/AxioRank/issues"},"bin":{"audit-verify":"dist/cli.js"},"dist":{"shasum":"306637916ed542e71d535a1728813c671525c26c","tarball":"https://registry.npmjs.org/@axiorank/audit-verify/-/audit-verify-0.5.0.tgz","fileCount":18,"integrity":"sha512-xCVyA15x9S1YfluWYSZeNtBT0lktVl25oCy83P64FWmGMAwEOJsFgjmEJ/A+0QpZNmTr9gRbY4mXvVsT6X9aIA==","signatures":[{"sig":"MEUCIQC4wTi6Cr1tnQV//kZbhPoDr18yaPyLs0394Z5HGPOMfgIgQ43KfPWEyPerPrDkIh0IWDxywHJrweliw+BTdi31nAk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":276507},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./package.json":"./package.json"},"scripts":{"dev":"tsup --watch","test":"vitest run","build":"tsup","typecheck":"tsc --noEmit","gen-vectors":"node scripts/gen-vectors.mjs"},"_npmUser":{"name":"tejaswi.s","email":"tejaswi33@gmail.com"},"repository":{"url":"git+https://github.com/frostyhand/AxioRank.git","type":"git","directory":"packages/verify"},"_npmVersion":"10.9.8","description":"Independently verify AxioRank audit receipts, agent-commerce conformance seals, and agent reputation credentials offline. Merkle inclusion proofs, Ed25519 signed tree heads, delegation provenance, human-approval signatures, witness co-signatures, agent-pu","directories":{},"sideEffects":false,"_nodeVersion":"22.22.3","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.3.5","vitest":"^4.1.8","typescript":"^6.0.3","@types/node":"^22.10.2"},"_npmOperationalInternal":{"tmp":"tmp/audit-verify_0.5.0_1782373981121_0.31513371437316473","host":"s3://npm-registry-packages-npm-production"}},"0.6.0":{"name":"@axiorank/audit-verify","version":"0.6.0","description":"Independently verify AxioRank audit receipts, agent-commerce conformance seals, agent reputation credentials, and coding-session seals offline. Merkle inclusion proofs, Ed25519 signed tree heads, delegation provenance, human-approval signatures, witness c","license":"MIT","homepage":"https://github.com/AxioRank/agent-commerce-conformance","repository":{"type":"git","url":"git+https://github.com/AxioRank/agent-commerce-conformance.git"},"bugs":{"url":"https://github.com/AxioRank/agent-commerce-conformance/issues"},"author":{"name":"AxioRank"},"type":"module","main":"./dist/index.cjs","module":"./dist/index.js","types":"./dist/index.d.ts","bin":{"audit-verify":"dist/cli.js"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"},"./package.json":"./package.json"},"sideEffects":false,"engines":{"node":">=18"},"keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance","agentic-commerce","agent-payments","mandate","conformance"],"publishConfig":{"access":"public"},"devDependencies":{"@types/node":"^22.10.2","tsup":"^8.3.5","typescript":"^6.0.3","vitest":"^4.1.8"},"scripts":{"build":"tsup","dev":"tsup --watch","typecheck":"tsc --noEmit","test":"vitest run","gen-vectors":"node scripts/gen-vectors.mjs"},"_id":"@axiorank/audit-verify@0.6.0","_integrity":"sha512-Ac262Datboj4jBl/55uwebVhkoIliY7y4AZ4MfNduJI5vgZSBxt0rRGiFghKvKhzvuhWpc0JW7JKNZbp+5TO2A==","_resolved":"/private/var/folders/tj/sd2_mky164g410jm_lcgy8wh0000gn/T/2c08c228de9c934ec0fd8edda6f3ed50/axiorank-audit-verify-0.6.0.tgz","_from":"file:axiorank-audit-verify-0.6.0.tgz","_nodeVersion":"22.22.3","_npmVersion":"10.9.8","dist":{"integrity":"sha512-Ac262Datboj4jBl/55uwebVhkoIliY7y4AZ4MfNduJI5vgZSBxt0rRGiFghKvKhzvuhWpc0JW7JKNZbp+5TO2A==","shasum":"52afde1d1d2be659ce739bc81745cd84ec8df53f","tarball":"https://registry.npmjs.org/@axiorank/audit-verify/-/audit-verify-0.6.0.tgz","fileCount":18,"unpackedSize":306848,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIDuVLcRXPX/bCrISskVzs1YkO4I/5rkvfkqmJi/l8fYTAiBfB2eBZ7lKkdOVGU6dE3Op4rNlS7q3nvP+OnQI5Fej4Q=="}]},"_npmUser":{"name":"tejaswi.s","email":"tejaswi33@gmail.com"},"directories":{},"maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/audit-verify_0.6.0_1782407065392_0.5473322876917874"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-09T16:41:36.539Z","modified":"2026-06-25T17:04:25.682Z","0.1.0":"2026-06-09T16:41:36.924Z","0.2.0":"2026-06-11T08:14:32.275Z","0.2.1":"2026-06-11T08:27:51.623Z","0.3.0":"2026-06-24T18:12:47.651Z","0.3.1":"2026-06-25T05:40:28.345Z","0.5.0":"2026-06-25T07:53:01.260Z","0.6.0":"2026-06-25T17:04:25.566Z"},"bugs":{"url":"https://github.com/AxioRank/agent-commerce-conformance/issues"},"author":{"name":"AxioRank"},"license":"MIT","homepage":"https://github.com/AxioRank/agent-commerce-conformance","keywords":["axiorank","audit","transparency-log","merkle","rfc6962","certificate-transparency","ed25519","receipt","verify","tamper-evident","provenance","compliance","agentic-commerce","agent-payments","mandate","conformance"],"repository":{"type":"git","url":"git+https://github.com/AxioRank/agent-commerce-conformance.git"},"description":"Independently verify AxioRank audit receipts, agent-commerce conformance seals, agent reputation credentials, and coding-session seals offline. Merkle inclusion proofs, Ed25519 signed tree heads, delegation provenance, human-approval signatures, witness c","maintainers":[{"name":"tejaswi.s","email":"tejaswi33@gmail.com"}],"readme":"# @axiorank/audit-verify\n\nIndependently verify [AxioRank](https://axiorank.com) audit receipts **offline**, with nothing but a public key. No AxioRank account, no API call, no trust in AxioRank.\n\nA receipt proves three things about a single governed action:\n\n1. **Membership.** The audit row is in the sealed RFC 6962 Merkle tree (an inclusion proof).\n2. **Integrity.** That tree's root was signed by the log (an Ed25519 signed tree head).\n3. **Provenance.** Who or what authorized the action, as a signed delegation chain (operator who approved, the agent key, the upstream trace step).\n\nThis package re-implements the verification primitives (JCS canonicalization, RFC 6962 Merkle, Ed25519) in about 200 lines with **zero dependencies**, so you can read all of it in a few minutes and trust nothing else.\n\n## Install\n\n```bash\nnpm install @axiorank/audit-verify\n```\n\nRequires Node 18 or newer.\n\n## Verify in code\n\n```ts\nimport { verifyReceipt } from \"@axiorank/audit-verify\";\n\n// `jwks` is a key you pinned out of band (see \"Trust model\" below).\nconst result = verifyReceipt(receipt, jwks);\n\nif (result.ok) {\n  console.log(\"verified\");\n} else {\n  console.error(`failed: ${result.reason}`, result.checks);\n}\n```\n\n## Verify on the command line\n\n```bash\n# Verify against a key you pinned and stored alongside your records.\nnpx @axiorank/audit-verify receipt.json --jwks key.json\n\n#  ✓ leaf hash\n#  ✓ inclusion proof\n#  ✓ signed tree head\n#  ✓ delegation provenance\n#\n#  VERIFIED\n```\n\nExit code is 0 when verified, 1 when verification fails, 2 on a usage error.\n\n## Verify an Agent Action Seal\n\nAn Agent Action Seal is a portable, signed proof-of-governance an agent carries and\npresents at the moment it acts, before the audit window seals. Verify one the same way:\n\n```bash\nnpx @axiorank/audit-verify seal ./seal.json --jwks key.json\n\n#  ✓ seal format\n#  ✓ seal signature\n#  ✓ embedded provenance\n#  ✓ provenance binds to action\n#  ✓ human approver signature\n#  ✓ freshness (within window)\n#\n#  VERIFIED\n```\n\nIn code, use `verifyPassport(seal, jwks)` (the function name is the stable protocol API).\nThe full format is documented in [SEAL.md](./SEAL.md). Once the audit window seals, upgrade\nthe Seal to a full Merkle inclusion receipt with `verifyReceipt`.\n\n## Verify an agent-commerce conformance seal\n\nWhen an AI agent makes a purchase on a person's behalf, a Commerce Conformance Seal proves\nthe purchase stayed within the user or issuer's signed mandate (a spend cap, an allowed set\nof merchants and categories, a currency, a time window). It is an Action Seal carrying a\nsigned `commerce` block, so a merchant, an issuer, or the buyer can all check it offline,\nwithout trusting any network:\n\n```ts\nimport { verifyCommerceSeal } from \"@axiorank/audit-verify\";\n\n// Without the mandate: confirms the seal is genuine and reports its signed verdict.\nconst r = verifyCommerceSeal(seal, jwks);\n//  r.checks.commerce === true, seal.commerce.inScope === true | false\n\n// With the mandate (pinned out of band): also confirms the seal references that exact\n// mandate and that the in-scope verdict is not a lie.\nconst r2 = verifyCommerceSeal(seal, jwks, { mandate });\n//  r2.checks.mandateBinding  -> the seal is bound to THIS mandate\n//  r2.checks.inScopeHonest   -> the signed verdict is not refuted by re-running the mandate\n```\n\n`evaluateMandate(purchase, mandate)` and `mandateHash(mandate)` are exported so you can\nre-run the conformance check yourself. AxioRank consumes the mandate (for example an AP2\nIntent Mandate); it does not issue it.\n\n## Trust model\n\nA receipt is only as trustworthy as the key you check it against. For genuine independence, **pin the public key out of band**: fetch it once from `https://app.axiorank.com/api/v1/audit/public-key`, confirm the `kid`, and store that key with your records. Then verify every receipt against the pinned key.\n\nThe package ships a `fetchJwks()` convenience that pulls the live JWKS, but fetching the key from the same party that issued the receipt is not independent verification. Use it for tooling, never as your trust anchor.\n\n## What a verified receipt does and does not prove\n\nA verified receipt proves the action is in a signed, append-only log and was authorized as the provenance chain states, and that the record was not altered after sealing. It does not, on its own, protect against a split-view attack (a malicious operator showing different signed histories to different parties); that requires gossiping signed tree heads to an external witness. Pin tree heads over time (`GET /api/v1/audit/checkpoints/{seq}`) to detect a retroactive edit yourself.\n\n## License\n\nMIT\n","readmeFilename":"README.md"}