Freeze profile 0.2-V1, Ed25519, RFC 8785 JCS, and the non-recursive signature scope.
Fourteen checks.
One local call.
Download one zero-dependency ESM module to verify the complete WANTED audit trust chain. It canonicalizes strict I-JSON, verifies both Ed25519 signatures, pins registry roots, and never uploads the manifest.
0RUNTIME DEPENDENCIES
14HARD CHECKS
2ED25519 SIGNATURES
0NETWORK REQUESTS
01 / VERIFICATION SURFACEBytes, signer,
Bytes, signer,
authority, lifecycle.
A pass means every seal and credential check succeeded. Individual check IDs and errors remain available for audit logs and developer tooling.
Reproduce the unsigned-manifest digest and verify the declared auditor key and signature.
Pin the registry root, minimum version, and issuer signature over credential 0.2-V2.
Bind signer identity and key, authorized target, validity, revocation, freshness, and mode.
02 / COPY, LOAD, VERIFYProduction trust
Production trust
stays explicit.
The built-in root verifies synthetic test packages only. Official submissions fail closed until your application supplies a pinned production root reviewed through its own governance process.
import { verifyAuditPackageJson } from
"./wanted-audit-verifier.mjs";
const text = await file.text();
const result = await verifyAuditPackageJson(
text,
[productionRegistryRoot]
);
if (result.status !== "pass") {
throw new Error([
...result.seal.errors,
...result.credential.errors
].join(" "));
}03 / TRUST BOUNDARYIntegrity is proven.
Integrity is proven.
Truth still gets audited.
Cryptographic verification proves exact bytes, key possession, and a registry-issued key authorization. It does not prove the factual truth of evidence, auditor competence, independence, or legal conformity.