Verification SDK

1. The record’s hash matches its content.
2. The record’s Ed25519 signature is valid for the named key.
3. If the record is hybrid signed, every entry in its signatures array (Ed25519 and ML-DSA-65) is valid.

​

Install

npm install @parmana/sign

​

Quick start

curl -s -H "Authorization: Bearer $PARMANA_API_KEY" \
  https://parmana-sandbox.vercel.app/trust-records/$BUSINESS_TRANSACTION_ID > record.json

curl -s https://parmana-sandbox.vercel.app/keys/default > key.json

import { readFileSync } from "node:fs";
import { verifyExecutionTrustRecordOffline } from "@parmana/sign";

const record = JSON.parse(readFileSync("record.json", "utf8"));
const key = JSON.parse(readFileSync("key.json", "utf8"));

const result = await verifyExecutionTrustRecordOffline(record, {
  [key.keyId]: key.pem,
});

console.log(result.valid ? "valid" : result.errors);

node verify.mjs

​

What you can verify

​

How it relates to the other SDKs

​

Versioning and support

• Follows Semantic Versioning. Below 1.0.0, a minor release may include breaking changes, always listed in the changelog.
• Supported Node.js versions: 24.6.0 and later, on Linux, Windows and macOS.
• Releases carry SLSA provenance and a Sigstore signature on the GitHub release. See RELEASING.md to check them.
• Report bugs in GitHub issues, and security issues as described in its SECURITY.md.