@hashborn/verify 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## 0.1.1 · 2026-10-13
+
+First release as `@hashborn/verify`. It supersedes `@hashborne/verify` 0.1.0: the product is now
+named Hashborn and lives at https://hashborn.com.
+
+- Package renamed to `@hashborn/verify`. The CLI is `hashborn-verify`; `hashborne-verify` is kept
+  as a second name for the same command.
+- The default site for `fetchRecord`, `verifyRemote`, `encodeVerifyLink` and the CLI is
+  https://hashborn.com (was https://hashborne.vercel.app). The old address redirects there, and
+  fetch follows redirects, so 0.1.0 keeps working too.
+- `HashborneError` is renamed `HashbornError`; `HashborneError` stays exported as the same class.
+- Verify links on any host still parse: only the `attestation` parameter is read.
+- The README's CLI sample prints the anchoring transaction hash whole, as the CLI does.
+
+The protocol is unchanged (pqc-rh v1): every signature, digest and verdict is the same as in 0.1.0.
+
+## 0.1.0 · 2026-10-12
+
+First release, as `@hashborne/verify`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hashborn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,179 @@
-# Temporary Holding Version
+# @hashborn/verify
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Verify Hashborn records yourself, offline, with SHA-256 and nothing else.
+
+Hashborn signs every agent action, transfer, asset proof and vault withdrawal once with a
+hash-based one-time key (protocol `pqc-rh` v1) and anchors it on Robinhood Chain. This package
+checks those signatures in Node or the browser, with one dependency (`@noble/hashes`) and no
+server in the loop.
+
+## Why SHA-256 is enough
+
+A Hashborn identity is a Merkle tree of 256 WOTS one-time keys (w = 16, 67 chains, height 8).
+Its public key is 64 bytes: a Merkle `root` and a `pubSeed`. A signature is 2,404 bytes: the
+leaf index, 67 chain values and 8 sibling hashes. To verify one, you finish each of the 67 hash
+chains from the signed digest, hash the results into the leaf, and climb 8 levels to the root.
+Every step is one SHA-256 call: 45 to 990 on the chains, then nine more for the leaf and the
+climb. If the climb lands on the registered root, the signature is genuine.
+
+There is no elliptic curve and no lattice anywhere in that path. The only assumption is that
+SHA-256 resists second preimages, which a quantum computer weakens to about 2^128 work (Grover),
+not to a break. A verifier you run today keeps working after Q-day.
+
+## Install
+
+```sh
+npm install @hashborn/verify
+```
+
+ESM only, Node 20.19 or later, or any modern browser or bundler. TypeScript types are included.
+
+### Moving from @hashborne/verify
+
+This package supersedes `@hashborne/verify`, the same code under the product's earlier name.
+Swap the package name in your imports; the API is the same. The error class is now
+`HashbornError`, and `HashborneError` is still exported as the same class, so `instanceof` checks
+keep working. The CLI is `hashborn-verify`, with `hashborne-verify` kept as a second name for it.
+The default site is https://hashborn.com. Changes are listed in `CHANGELOG.md`.
+
+## Examples
+
+### Verify a link
+
+Every record page on the site has a verify link. Paste it, or pass just its `attestation`
+parameter.
+
+```ts
+import {parseVerifyLink, verifyAttestation} from '@hashborn/verify'
+
+const attestation = parseVerifyLink('https://hashborn.com/verify?attestation=eyJ2ZXJza...')
+const result = verifyAttestation(attestation)
+
+result.valid      // true
+result.pqAddress  // 'pq14DdQMGxcqXDfp4wBXypxHsoZY9W9', the signer
+result.leaf       // 3, the one-time key that signed
+result.domain     // 'pqc-rh/agent-action/v1'
+result.reason     // set when valid is false
+```
+
+Only the `attestation` parameter is read, so a link shared from the earlier address,
+`hashborne.vercel.app`, verifies the same way.
+
+### Verify a record by id
+
+A record id is the anchoring transaction hash followed by the log index, as in
+`https://hashborn.com/records/<id>`. `verifyRemote` reads the published bytes from the
+public API and verifies them here. The server's own verdict is never used.
+
+```ts
+import {verifyRemote} from '@hashborn/verify'
+
+const result = await verifyRemote('0x42c1acc3116dc13c56638cccd5fcaca5134a9653b7092883796afd74fd28d2a500000000')
+
+result.valid          // true: the record text hashes to the signed digest, and the signature climbs to the root
+result.remote.record  // the record exactly as anchored, e.g. {"agent":"smoke-test",...}
+result.remote.txHash  // the anchoring transaction on Robinhood Chain
+```
+
+Pass `{baseUrl, fetch}` to read from another deployment or through your own fetch.
+
+### Recompute a digest
+
+A record's `messageHash` is `SHA-256(domain || "\n" || canonical JSON of its fields)`, keys
+sorted. Recompute it from the fields you expect, then check the attestation signed exactly that.
+
+```ts
+import {DOMAINS, digest, verifyRecord} from '@hashborn/verify'
+
+const fields = {agent: 'smoke-test', at: '2026-10-10T06:36:23.653Z', kind: 'attest', summary: 'deployment smoke test'}
+
+digest(DOMAINS.agentAction, fields)  // '0x10ccea67...'
+verifyRecord(attestation, fields)    // signature check plus digest check, one verdict
+```
+
+For an RWA asset, `manifestRoot(documentHashes)` recomputes the Merkle root over the SHA-256
+hashes of its documents, in order, to compare with the record's `manifestRoot` field.
+
+## CLI
+
+```sh
+npx @hashborn/verify <input> [--base-url <url>] [--json]
+```
+
+Installed globally or as a dependency, the command is `hashborn-verify`. The input is a verify
+link, a path to an attestation saved as JSON (`-` reads stdin), a record id, or a record page
+URL (`https://hashborn.com/records/<id>`).
+
+```
+$ hashborn-verify 0x42c1acc3116dc13c56638cccd5fcaca5134a9653b7092883796afd74fd28d2a500000000
+valid
+  domain   pqc-rh/agent-action/v1
+  signer   pq14DdQMGxcqXDfp4wBXypxHsoZY9W9
+  leaf     3
+  root     0xd62ab9cd596a47725174077fe391069d1f0e4fc06323e636e0645090f70e1ef1
+  message  0x10ccea672702a258da36b5c05597805ec0cd243a66cf74097a69a4907cff0094
+  record   its published text hashes to the signed message
+  anchored 0x42c1acc3116dc13c56638cccd5fcaca5134a9653b7092883796afd74fd28d2a5 block 84792793 chain 4663 at 2026-10-10T06:36:24.000Z
+  hashes   555 SHA-256 calls on the chains
+```
+
+Exit code 0 when valid, 1 otherwise. `--json` prints the result object.
+
+## What it checks
+
+`verifyAttestation` checks, with SHA-256 alone:
+
+- the attestation's shape and sizes: 32-byte root, pubSeed and messageHash, 67 chain values of
+  32 bytes, 8 auth nodes, a leaf index in 0..255;
+- protocol fields: version 1, scheme `wots-merkle`, height 8, a v1 domain;
+- the WOTS signature and Merkle path over `messageHash`, against `root` and `pubSeed`;
+- that `pqAddress` derives from `root` and `pubSeed`.
+
+`verifyRecord` adds that the record's fields (or its published text) hash to `messageHash` under
+the attestation's domain. `verifyRemote` adds that the leaf the anchor burned is the leaf that
+signed.
+
+## What it does not check
+
+It does not check that a record was anchored on chain, or that its root belongs to the wallet
+that claims it. For that, read the registry: `PQRegistry` at
+`0xD791A8Eb2b8C48E5340579A9f91F983AB9597c56` on Robinhood Chain (chain id 4663). Its `Anchored`
+event carries the wallet, root, domain, record and the 2,404-byte signature, so `decodeSignature`
+and `verifyRecord` can run on bytes read straight from the chain, and its `IdentityRegistered`
+event binds each wallet to one root and pubSeed. `REGISTRY` exports the address and chain id.
+
+The pq address is a display form of the public key. Compare roots when you need certainty.
+
+## API
+
+| Export | What it does |
+|---|---|
+| `verifyAttestation(att)` | Verifies an attestation. Returns `{valid, code?, reason?, leaf, pqAddress, domain, messageHash, root, computedRoot, hashCalls}`. Never throws. |
+| `verifyRecord(att, fields)` | `verifyAttestation` plus the digest check. `fields` is the fields object or the record text as published. Adds `recordDigest`. |
+| `verifySignature(messageHash, signature, {root, pubSeed})` | Low level: does the signature climb to the root? Returns `{valid, computedRoot, hashCalls}`. |
+| `digest(domain, fields)` | `SHA-256(domain \|\| "\n" \|\| canonicalJson(fields))`, byte for byte as the site computes it. |
+| `recordDigest(domain, record)` | The same over record text exactly as anchored. This is what the registry computes. |
+| `canonicalJson(fields)` | Keys sorted by UTF-16 code unit, no whitespace; strings, finite numbers, booleans and null only. |
+| `manifestRoot(hashes)` | Merkle root over 32-byte document hashes, for RWA manifests. |
+| `pqAddress({root, pubSeed})` | The `pq1...` address a public key derives. |
+| `parseVerifyLink(urlOrParam)` | Reads the attestation out of a verify link, a query string or the bare parameter. |
+| `encodeVerifyLink(att, base?)` | Builds a verify link. `base` defaults to `https://hashborn.com`; `''` gives `/verify?attestation=...`. |
+| `parseAttestation(json)` / `checkAttestation(value)` | Strict shape check of untrusted JSON or an object, 64 kB cap. |
+| `encodeSignature(sig)` / `decodeSignature(hex)` | The 2,404-byte wire form the registry stores, both ways. |
+| `fetchRecord(id, {baseUrl, fetch})` | Reads an anchored record and builds its attestation from the published bytes. Does not verify. |
+| `verifyRemote(id, {baseUrl, fetch})` | `fetchRecord`, then `verifyRecord` locally, plus the leaf check. |
+| `PQ`, `DOMAINS`, `SCHEME_IDS`, `REGISTRY` | Protocol v1 parameters, attestation domains, scheme ids, registry address and chain id. |
+| `HashbornError` | Thrown on malformed input or a failed fetch, with `code`: `malformed`, `unsupported`, `not-found` or `network`. `HashborneError` is the same class under its earlier name. |
+| `Attestation`, `MerkleSignature`, `DigestFields`, `Domain`, `Hex` | Types. |
+
+Failure codes in a result: `malformed`, `unsupported`, `signature`, `pq-address`, `digest`, `leaf`.
+
+`fetchRecord` reads `GET /api/v1/records/<id>`. That view leaves the 2,404 signature bytes out,
+so the signature and the record text are then read from the site's index route,
+`GET /api/index?q=record&id=<id>`. Both are public and cached.
+
+The protocol is specified in full on the site's docs page, https://hashborn.com/docs.
+
+## License
+
+MIT

package/dist/address.d.ts

@@ -0,0 +1,9 @@
+/** pq address: "pq1" + base58(SHA-256("pqc-rh" || pubSeed || root)[0..20]). Display only. */
+import { type Hex } from './constants.js';
+export declare const PQ_ADDRESS_PREFIX = "pq1";
+export declare function pqAddressFromBytes(pubSeed: Uint8Array, root: Uint8Array): string;
+/** The pq address an identity's public key (root and pubSeed) derives. */
+export declare function pqAddress(pub: {
+    root: Hex;
+    pubSeed: Hex;
+}): string;

package/dist/address.js

@@ -0,0 +1,12 @@
+/** pq address: "pq1" + base58(SHA-256("pqc-rh" || pubSeed || root)[0..20]). Display only. */
+import { base58, fromHex, utf8ToBytes } from './bytes.js';
+import { PROTOCOL_DOMAIN } from './constants.js';
+import { H } from './hash.js';
+export const PQ_ADDRESS_PREFIX = 'pq1';
+export function pqAddressFromBytes(pubSeed, root) {
+    return PQ_ADDRESS_PREFIX + base58(H(utf8ToBytes(PROTOCOL_DOMAIN), pubSeed, root).slice(0, 20));
+}
+/** The pq address an identity's public key (root and pubSeed) derives. */
+export function pqAddress(pub) {
+    return pqAddressFromBytes(fromHex(pub.pubSeed, 32, 'pubSeed'), fromHex(pub.root, 32, 'root'));
+}

package/dist/attestation.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The Attestation boundary: checking untrusted JSON (pasted, read from a file or carried in a
+ * link) against the attestation shape, and the verify link that carries one.
+ *
+ * Link format: `<site>/verify?attestation=<base64url, no padding, of the UTF-8 JSON>`.
+ * The rules match the site's own parser (apps/web lib/pq/attestation.ts): the same fields, sizes
+ * and 64 kB cap, unknown keys dropped, keys returned in schema order.
+ */
+import { type Attestation } from './constants.js';
+/** Largest attestation text accepted. A real one is about 5 kB. */
+export declare const ATTESTATION_MAX_BYTES: number;
+export declare const ATTESTATION_PARAM = "attestation";
+/**
+ * Checks `value` against the attestation shape and returns a clean copy. `requireAnchor` makes
+ * `txHash` and `anchoredAt` mandatory (null allowed), as the site's parser does; without it a
+ * missing one reads as null, since neither is part of what the leaf signed.
+ * Throws a HashbornError naming the first bad field.
+ */
+export declare function checkAttestation(value: unknown, requireAnchor?: boolean): Attestation;
+/** Parses attestation JSON text, as pasted on the Verify page or saved to a file. */
+export declare function parseAttestation(text: string): Attestation;
+/** The `attestation` parameter of a verify link: base64url, no padding, of the UTF-8 JSON. */
+export declare function encodeAttestationParam(attestation: Attestation): string;
+export declare function decodeAttestationParam(param: string): Attestation;
+/**
+ * Reads the attestation out of a verify link. Accepts a full URL
+ * (`https://hashborn.com/verify?attestation=...`), a path (`/verify?attestation=...`),
+ * a query string (`?attestation=...` or `attestation=...`) or the bare parameter value.
+ * Throws a HashbornError when there is no attestation or it is malformed.
+ */
+export declare function parseVerifyLink(urlOrParam: string): Attestation;
+/**
+ * The verify link that carries `attestation`, on `base` (default the Hashborn site). With
+ * `base = ''` it is the site-relative `/verify?attestation=...` the site itself builds.
+ */
+export declare function encodeVerifyLink(attestation: Attestation, base?: string): string;

package/dist/attestation.js

@@ -0,0 +1,153 @@
+/**
+ * The Attestation boundary: checking untrusted JSON (pasted, read from a file or carried in a
+ * link) against the attestation shape, and the verify link that carries one.
+ *
+ * Link format: `<site>/verify?attestation=<base64url, no padding, of the UTF-8 JSON>`.
+ * The rules match the site's own parser (apps/web lib/pq/attestation.ts): the same fields, sizes
+ * and 64 kB cap, unknown keys dropped, keys returned in schema order.
+ */
+import { base64urlDecode, base64urlEncode } from './bytes.js';
+import { DEFAULT_BASE_URL, DOMAINS, PQ, SCHEME_IDS } from './constants.js';
+import { HashbornError } from './errors.js';
+/** Largest attestation text accepted. A real one is about 5 kB. */
+export const ATTESTATION_MAX_BYTES = 64 * 1024;
+export const ATTESTATION_PARAM = 'attestation';
+const PQ_ADDRESS_RE = /^pq1[1-9A-HJ-NP-Za-km-z]{20,40}$/;
+const DOMAIN_SET = new Set(Object.values(DOMAINS));
+const SCHEME_SET = new Set(SCHEME_IDS);
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hexField(value, bytes, path) {
+    if (typeof value !== 'string' || value.length !== 2 + bytes * 2 || !/^0x[0-9a-fA-F]*$/.test(value)) {
+        throw new HashbornError(`${path}: ${bytes}-byte 0x hex expected`);
+    }
+    return value;
+}
+/**
+ * Checks `value` against the attestation shape and returns a clean copy. `requireAnchor` makes
+ * `txHash` and `anchoredAt` mandatory (null allowed), as the site's parser does; without it a
+ * missing one reads as null, since neither is part of what the leaf signed.
+ * Throws a HashbornError naming the first bad field.
+ */
+export function checkAttestation(value, requireAnchor = true) {
+    if (!isObject(value))
+        throw new HashbornError('attestation: object expected');
+    if (value.version !== 1)
+        throw new HashbornError('version: protocol version 1 expected', 'unsupported');
+    if (typeof value.scheme !== 'string' || !SCHEME_SET.has(value.scheme))
+        throw new HashbornError('scheme: unknown scheme');
+    if (typeof value.domain !== 'string' || !DOMAIN_SET.has(value.domain)) {
+        throw new HashbornError('domain: not a protocol v1 domain', 'unsupported');
+    }
+    if (typeof value.pqAddress !== 'string' || !PQ_ADDRESS_RE.test(value.pqAddress)) {
+        throw new HashbornError('pqAddress: pq1 base58 address expected');
+    }
+    const root = hexField(value.root, PQ.n, 'root');
+    const pubSeed = hexField(value.pubSeed, PQ.n, 'pubSeed');
+    if (value.height !== PQ.height)
+        throw new HashbornError(`height: ${PQ.height} expected`, 'unsupported');
+    const messageHash = hexField(value.messageHash, PQ.n, 'messageHash');
+    const sig = value.signature;
+    if (!isObject(sig))
+        throw new HashbornError('signature: object expected');
+    const leaf = sig.leaf;
+    if (typeof leaf !== 'number' || !Number.isInteger(leaf) || leaf < 0 || leaf >= PQ.leaves) {
+        throw new HashbornError(`signature.leaf: integer in 0..${PQ.leaves - 1} expected`);
+    }
+    const wots = hexField(sig.wots, PQ.len * PQ.n, 'signature.wots');
+    if (!Array.isArray(sig.auth) || sig.auth.length !== PQ.height) {
+        throw new HashbornError(`signature.auth: ${PQ.height} nodes expected`);
+    }
+    const auth = sig.auth.map((node, i) => hexField(node, PQ.n, `signature.auth.${i}`));
+    let txHash = null;
+    if (value.txHash !== null && (requireAnchor || value.txHash !== undefined))
+        txHash = hexField(value.txHash, 32, 'txHash');
+    let anchoredAt = null;
+    if (value.anchoredAt !== null && (requireAnchor || value.anchoredAt !== undefined)) {
+        if (typeof value.anchoredAt !== 'string' || value.anchoredAt.length > 64)
+            throw new HashbornError('anchoredAt: string of at most 64 characters expected');
+        anchoredAt = value.anchoredAt;
+    }
+    return {
+        version: 1,
+        scheme: value.scheme,
+        domain: value.domain,
+        pqAddress: value.pqAddress,
+        root,
+        pubSeed,
+        height: PQ.height,
+        messageHash,
+        signature: { leaf, wots, auth },
+        txHash,
+        anchoredAt,
+    };
+}
+/** Parses attestation JSON text, as pasted on the Verify page or saved to a file. */
+export function parseAttestation(text) {
+    if (typeof text !== 'string')
+        throw new HashbornError('attestation must be text');
+    if (text.length > ATTESTATION_MAX_BYTES)
+        throw new HashbornError('attestation is too large');
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new HashbornError('attestation is not valid JSON');
+    }
+    return checkAttestation(raw);
+}
+/** The `attestation` parameter of a verify link: base64url, no padding, of the UTF-8 JSON. */
+export function encodeAttestationParam(attestation) {
+    return base64urlEncode(new TextEncoder().encode(JSON.stringify(attestation)));
+}
+export function decodeAttestationParam(param) {
+    if (typeof param !== 'string' || param.length > ATTESTATION_MAX_BYTES)
+        throw new HashbornError('attestation link is too large');
+    let bytes;
+    try {
+        bytes = base64urlDecode(param);
+    }
+    catch {
+        throw new HashbornError('attestation link is not base64url');
+    }
+    return parseAttestation(new TextDecoder().decode(bytes));
+}
+/**
+ * Reads the attestation out of a verify link. Accepts a full URL
+ * (`https://hashborn.com/verify?attestation=...`), a path (`/verify?attestation=...`),
+ * a query string (`?attestation=...` or `attestation=...`) or the bare parameter value.
+ * Throws a HashbornError when there is no attestation or it is malformed.
+ */
+export function parseVerifyLink(urlOrParam) {
+    if (typeof urlOrParam !== 'string')
+        throw new HashbornError('verify link must be a string');
+    const text = urlOrParam.trim();
+    let param = text;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(text) || text.includes('?') || text.includes('=') || text.startsWith('/')) {
+        let query = text;
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(text) || text.startsWith('/')) {
+            try {
+                query = new URL(text, 'https://link.invalid').search;
+            }
+            catch {
+                throw new HashbornError('verify link is not a URL');
+            }
+        }
+        else if (text.includes('?')) {
+            query = text.slice(text.indexOf('?'));
+        }
+        param = new URLSearchParams(query.split('#')[0]).get(ATTESTATION_PARAM);
+    }
+    if (!param)
+        throw new HashbornError(`verify link has no ${ATTESTATION_PARAM} parameter`);
+    return decodeAttestationParam(param);
+}
+/**
+ * The verify link that carries `attestation`, on `base` (default the Hashborn site). With
+ * `base = ''` it is the site-relative `/verify?attestation=...` the site itself builds.
+ */
+export function encodeVerifyLink(attestation, base = DEFAULT_BASE_URL) {
+    return `${base.replace(/\/+$/, '')}/verify?${ATTESTATION_PARAM}=${encodeAttestationParam(attestation)}`;
+}

package/dist/bytes.d.ts

@@ -0,0 +1,15 @@
+/** Byte helpers. Hex in and out is always 0x-prefixed. */
+import { concatBytes, utf8ToBytes } from '@noble/hashes/utils.js';
+import type { Hex } from './constants.js';
+export { concatBytes, utf8ToBytes };
+export declare function toHex(bytes: Uint8Array): Hex;
+export declare function isHex(value: unknown, length?: number): value is Hex;
+/** Parses 0x hex into bytes; `length` pins the byte count. Throws a HashbornError naming `label`. */
+export declare function fromHex(value: unknown, length: number | undefined, label: string): Uint8Array;
+export declare function equalBytes(a: Uint8Array, b: Uint8Array): boolean;
+/** Base58 with the Bitcoin alphabet; each leading zero byte becomes a leading "1". */
+export declare function base58(bytes: Uint8Array): string;
+/** Base64url without padding (RFC 4648 section 5). */
+export declare function base64urlEncode(bytes: Uint8Array): string;
+/** Strict base64url decode: no padding, no stray characters, unused trailing bits must be zero. */
+export declare function base64urlDecode(text: string): Uint8Array;

package/dist/bytes.js

@@ -0,0 +1,96 @@
+/** Byte helpers. Hex in and out is always 0x-prefixed. */
+import { bytesToHex, concatBytes, hexToBytes, utf8ToBytes } from '@noble/hashes/utils.js';
+import { HashbornError } from './errors.js';
+export { concatBytes, utf8ToBytes };
+const HEX_RE = /^0x(?:[0-9a-fA-F]{2})*$/;
+export function toHex(bytes) {
+    return `0x${bytesToHex(bytes)}`;
+}
+export function isHex(value, length) {
+    return typeof value === 'string' && HEX_RE.test(value) && (length === undefined || value.length === 2 + length * 2);
+}
+/** Parses 0x hex into bytes; `length` pins the byte count. Throws a HashbornError naming `label`. */
+export function fromHex(value, length, label) {
+    if (!isHex(value))
+        throw new HashbornError(`${label} must be 0x-prefixed hex`);
+    if (length !== undefined && value.length !== 2 + length * 2) {
+        throw new HashbornError(`${label} must be ${length} bytes, got ${(value.length - 2) / 2}`);
+    }
+    return hexToBytes(value.slice(2));
+}
+export function equalBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+/** Base58 with the Bitcoin alphabet; each leading zero byte becomes a leading "1". */
+export function base58(bytes) {
+    let zeros = 0;
+    while (zeros < bytes.length && bytes[zeros] === 0)
+        zeros++;
+    const digits = [];
+    for (let i = zeros; i < bytes.length; i++) {
+        let carry = bytes[i];
+        for (let j = 0; j < digits.length; j++) {
+            carry += digits[j] << 8;
+            digits[j] = carry % 58;
+            carry = (carry / 58) | 0;
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = (carry / 58) | 0;
+        }
+    }
+    let out = '1'.repeat(zeros);
+    for (let i = digits.length - 1; i >= 0; i--)
+        out += B58[digits[i]];
+    return out;
+}
+const B64URL = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const B64URL_INDEX = new Map([...B64URL].map((c, i) => [c, i]));
+/** Base64url without padding (RFC 4648 section 5). */
+export function base64urlEncode(bytes) {
+    let out = '';
+    let i = 0;
+    for (; i + 2 < bytes.length; i += 3) {
+        const n = (bytes[i] << 16) | (bytes[i + 1] << 8) | bytes[i + 2];
+        out += B64URL[n >> 18] + B64URL[(n >> 12) & 63] + B64URL[(n >> 6) & 63] + B64URL[n & 63];
+    }
+    const rest = bytes.length - i;
+    if (rest === 1) {
+        const n = bytes[i] << 16;
+        out += B64URL[n >> 18] + B64URL[(n >> 12) & 63];
+    }
+    else if (rest === 2) {
+        const n = (bytes[i] << 16) | (bytes[i + 1] << 8);
+        out += B64URL[n >> 18] + B64URL[(n >> 12) & 63] + B64URL[(n >> 6) & 63];
+    }
+    return out;
+}
+/** Strict base64url decode: no padding, no stray characters, unused trailing bits must be zero. */
+export function base64urlDecode(text) {
+    if (text.length % 4 === 1)
+        throw new HashbornError('not base64url');
+    const out = new Uint8Array(Math.floor((text.length * 3) / 4));
+    let acc = 0;
+    let bits = 0;
+    let o = 0;
+    for (const c of text) {
+        const v = B64URL_INDEX.get(c);
+        if (v === undefined)
+            throw new HashbornError('not base64url');
+        acc = ((acc << 6) | v) & 0xffff;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out[o++] = (acc >> bits) & 0xff;
+        }
+    }
+    if ((acc & ((1 << bits) - 1)) !== 0)
+        throw new HashbornError('not base64url');
+    return out;
+}

package/dist/cli.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+/**
+ * hashborn-verify <verify link | attestation.json | - | record id | record page URL>
+ *
+ * Verifies one Hashborn attestation with SHA-256 alone and prints the verdict. Exit code 0 when
+ * it is valid, 1 otherwise (invalid, malformed, not found, or the API did not answer).
+ */
+export {};