twzrd-receipt-verifier 1.0.4 → 1.0.6

package/README.md

@@ -1,7 +1,7 @@
 # TWZRD Receipt Verifier (standalone)
 
-Verify a TWZRD **AO-Receipt V5** offline, trusting **nothing from TWZRD's servers
-or codebase** - only the receipt, TWZRD's published public key, and two
+Verify a **signed TWZRD trust receipt** offline, trusting **nothing from TWZRD's
+servers or codebase** - only the receipt, TWZRD's published public key, and two
 widely-audited crypto libraries.
 
 A TWZRD trust receipt has two layers:
@@ -32,6 +32,16 @@ npx twzrd-receipt-verifier receipt.json --pubkey 9V6Pn19kiUA5Rn6JpQfNduanvGt2aXG
 npx twzrd-receipt-verifier receipt.json --pubkey 9V6Pn19kiUA5Rn6JpQfNduanvGt2aXGwsarosNfa2Ldf --max-age 60
 ```
 
+## Ingest the corpus
+
+The receipts this tool verifies are issued from the only live cross-facilitator x402
+payer corpus on Solana. Pull the scored signal population as a feed (no auth, paginated):
+
+    curl -s 'https://intel.twzrd.xyz/v1/intel/corpus_feed?limit=5' | jq .
+
+Browser demo: https://twzrd.xyz/demo/ingest/ · schema: https://intel.twzrd.xyz/docs ·
+ingestion pilots: https://twzrd.xyz/grants (email privacy@twzrd.xyz).
+
 ## The published signing key
 
 | field | value |
@@ -50,8 +60,8 @@ Also published, machine-readable, at:
 
 ## Get a receipt to verify
 
-Any TWZRD V5 receipt works. To mint a fresh one, pay the trust endpoint (x402,
-0.05 USDC on Solana mainnet) - e.g. via AgentCash:
+Any signed TWZRD trust receipt works. To mint a fresh one, pay the trust endpoint
+(x402, 0.05 USDC on Solana mainnet) - e.g. via AgentCash:
 
 ```bash
 npx agentcash@latest fetch https://intel.twzrd.xyz/v1/intel/trust/<PUBKEY> > resp.json
@@ -75,21 +85,27 @@ The receipt object looks like:
 ## Python
 
 ```bash
-pip install pynacl pycryptodome     # libsodium Ed25519 + original Keccak-256
+pip install twzrd-receipt-verifier   # PyPI; or: pip install pynacl pycryptodome for script-only use
 
 # fetch the published key and verify:
-python verify_twzrd_receipt.py receipt.json
+twzrd-verify-receipt receipt.json
+# or: python verify_twzrd_receipt.py receipt.json
 
 # pin the key out-of-band (recommended):
 python verify_twzrd_receipt.py receipt.json --pubkey 9V6Pn19kiUA5Rn6JpQfNduanvGt2aXGwsarosNfa2Ldf
 
 # also confirm a tampered copy FAILS:
-python verify_twzrd_receipt.py receipt.json --self-test
+twzrd-verify-receipt receipt.json --self-test
+
+# replay-resistance (opt-in; same semantics as the npm CLI --max-age):
+twzrd-verify-receipt receipt.json --max-age 300
 
 # from stdin:
-cat receipt.json | python verify_twzrd_receipt.py -
+cat receipt.json | twzrd-verify-receipt -
 ```
 
+Source: [packages/twzrd-agent-intel/verifier](https://github.com/twzrd-sol/wzrd-final/tree/main/packages/twzrd-agent-intel/verifier)
+
 ## Node
 
 ```bash

package/package.json

@@ -1,9 +1,27 @@
 {
   "name": "twzrd-receipt-verifier",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Standalone offline verifier for TWZRD AO-Receipt V5 (Ed25519-signed keccak256 leaf). No trust in TWZRD servers or code.",
-  "keywords": ["twzrd", "x402", "solana", "ed25519", "keccak256", "receipt", "verifier", "agent", "attestation"],
+  "keywords": [
+    "twzrd",
+    "x402",
+    "solana",
+    "ed25519",
+    "keccak256",
+    "receipt",
+    "verifier",
+    "agent",
+    "attestation"
+  ],
   "homepage": "https://intel.twzrd.xyz",
+  "bugs": {
+    "url": "https://github.com/twzrd-sol/wzrd-final/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/twzrd-sol/wzrd-final.git",
+    "directory": "packages/twzrd-agent-intel/verifier"
+  },
   "license": "MIT",
   "author": "TWZRD",
   "bin": {
@@ -15,7 +33,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "verify": "node verify_twzrd_receipt.js"
+    "verify": "node verify_twzrd_receipt.js",
+    "test": "node --test test/*.test.js"
   },
   "engines": {
     "node": ">=16"

package/verify_twzrd_receipt.js

@@ -220,4 +220,9 @@ key source: ${DEFAULT_BASE_URL}/.well-known/x402`;
   process.exit(ok ? 0 : 1);
 }
 
-main().catch((e) => { console.error('error:', e.message); process.exit(1); });
+// Run the CLI only when invoked directly; stay importable for tests.
+if (require.main === module) {
+  main().catch((e) => { console.error('error:', e.message); process.exit(1); });
+}
+
+module.exports = { verify, recomputeLeaf, b58decode, payer32, anchor32 };