@aarmos/avar-core

Source of truth: Aarmatix/avar-spec/reference/js. This directory in the Aarmos product monorepo is a working copy kept in lockstep with the spec repo. Bug reports, PRs, and RFCs go to Aarmatix/avar-spec — see SYNC.md.

Reference implementation of the AVAR specification — canonical JSON, Ed25519 signature verification, hash-chain math, and bundle verification.

Pure. No DOM references, no Node built-ins, no external dependencies. Runs identically in browsers (WebCrypto) and Node.js 20+ (globalThis.crypto.subtle).

Normative. Consumed by:

• The Aarmos PWA at /trust/verify (browser drop-zone).
• The aarmos verify CLI in @aarmos/cli.
• The Aarmos recorder (chain + signature production, closed source).

All three call the same verifyBundle(). Divergence between them is guarded by the golden fixtures in test/fixtures/ — see spec §9.

Install

npm i @aarmos/avar-core

Or verify a bundle without installing anything:

npx -p @aarmos/cli aarmos verify path/to/bundle.avar.zip

API

import {
  // Types
  type AvarEntry, type AvarBundle, type VerificationReport,
  // Canonical JSON
  canonicalize,
  // Hash / chain
  sha256Hex, computeEntryHash, computeStepHash,
  GENESIS_PREV_HASH, GENESIS_PREV_STEP_HASH,
  // Signature
  verifySignature, computeDeviceFingerprint,
  // Verification (top-level)
  verifyBundle,
} from "@aarmos/avar-core";

License

Apache-2.0. See LICENSE and NOTICE.

Spec revision

Tracks avar/1 spec revision 1.1 (release candidate; backward-compatible with 1.0-rc1). See the AVAR spec for the current revision and changelog.