@securestamp/action-proof-verify
Offline, dependency-free verification of SecureStamp Action Proof bundles.
This is the entry point of the Action Proof ecosystem, not an accessory to it. It has no network
access: receipts verify offline without contacting SecureStamp, and verification does not depend on
a live SecureStamp service. It is published ahead of the artifacts it verifies — a released verifier
accepts a new receipt or bundle version before anything emits one. It accepts ActionReceiptV2 and
ActionReceiptV3, and ActionProofBundleV1 and ActionProofBundleV2.
The verifier does not import the SecureStamp action registry, contact SecureStamp Cloud, resolve JWKS over the network, or trust provider SDKs. Trust anchors are supplied by the caller and every signature, digest, audience, single-use grant, local policy binding, and transparency inclusion is checked locally.
The package also publishes the RFC 8785 interoperability corpus at
@securestamp/action-proof-verify/vectors/jcs-rfc8785.json. It is copied from the protocol's
canonical vector source during packaging and is included in the clean-install release smoke, so
the verifier can be audited and tested without the emitter package.
The verifier has an independent adoption cadence. A beta that has passed the external evidence
gate may advance this package's latest tag before the execution packages become stable; an
explicitly unverified beta never advances latest.
For V3 bundles, the returned verification summary includes the signed policyVersion and the
customer-signed localPolicyDigest. Historical V2 bundles remain unchanged and are reported with
policyEvidence: legacy_untrusted when no verifiable policy snapshot is included. V3 verification
also checks the complete local policy shape, the productive expiry requirement, the
provider/manifest/authority binding, and the resource, parameter and monetary ceilings that cover
the exact effect.