Loading…
Verify
Check a Decision Dossier yourself.
@decionis/verify checks that a Decision Dossier and its artifacts are unchanged and that their Ed25519 signatures validate, using only Node's built-in crypto and no runtime dependencies. It needs no Decionis account, API key or SDK, and a saved dossier with saved keys can be checked fully offline.
- License
- Apache-2.0
- npm
- 0.3.0
- Checked
- 2026-09-25
Run it
Use the exact verification link from a dossier's share kit or verify page: both the /v1 prefix and the ?sig= token are required, and the id alone is not found. Or verify a dossier you saved, against the published keys.
npx @decionis/verify "https://api.decionis.com/v1/public/decision-dossiers/<id>/proof-bundle?sig=<token>"npx @decionis/verify --file dossier.json --jwks https://api.decionis.com/.well-known/decision-dossier-jwks.jsonnpx @decionis/verify <url> --json- exit 0
- every listed signature is valid against the selected key
- exit 1
- the dossier did not verify
- exit 2
- a usage error, or a file or URL that could not be read
What a pass means, and what it does not
CRYPTOGRAPHICALLY VERIFIED means the listed artifacts are unchanged and their signatures validate against the selected key. On its own it does not show that the key belongs to Decionis, or that the dossier makes an action eligible to execute; the report states each of those separately.
Decionis issuer authenticity needs the exact pinned production key set. Code that authorizes execution on the strength of a dossier should also require required_artifact_coverage_verified === true and an established trust anchor.
In code
import { verifyDossierFromUrls, verifyDossierProofBundle } from "@decionis/verify";
// From objects you already hold
const result = verifyDossierProofBundle({ dossier_payload, public_jwks });
if (!result.verified) throw new Error("dossier failed verification");
// Or fetch and verify from public URLs (JWKS auto-discovered)
const { result: r } = await verifyDossierFromUrls({ dossierUrl });Practice on the public corpus
The AgentSafe repository publishes synthetic ALLOW, BLOCK and ESCALATE dossiers signed with a key that is published on purpose, so a verifier can be tested against known answers. Its README shows how to check them.
License and source
Published on npm under Apache-2.0. The package's source repository is not public; the published package is what you run and can inspect.