verifyhash 0.1.0 → 0.1.1

package/verifier/lib/seal-evidence.js

@@ -0,0 +1,237 @@
+"use strict";
+
+// verifier/lib/seal-evidence.js — the FREE-TIER, ZERO-INSTALL evidence SEAL core (T-36.1).
+//
+// WHY THIS EXISTS
+//   `verifier/` already lets a stranger VERIFY a `vh.evidence-seal` with NO clone + NO `npm install`
+//   (verify-vh.js + ./merkle re-derive the root with no producer stack). The symmetric gap was the
+//   PRODUCE side: minting a seal still ran through cli/evidence.js -> cli/core/packetseal.js -> cli/hash.js,
+//   and cli/hash.js pulls keccak256/concat/toUtf8Bytes from `ethers`. So a prospect could verify a seal
+//   handed to them, but could not produce one of their OWN to hand to a counterparty without the heavy
+//   stack. This module closes that loop: a PURE, dependency-free `buildEvidenceSeal({ entries })` that emits
+//   an object whose canonical JSON is BYTE-IDENTICAL to what the paid cli/evidence.js seal path produces for
+//   the SAME { relPath, bytes } set — reusing the ALREADY-VENDORED, cross-checked ./merkle re-derivation of
+//   the family's pathLeaf / leafHash / nodeHash / root convention. No ethers, no js-sha3 (transitively via
+//   ./merkle -> ./keccak only), no parent-directory traversal, no bare third-party name. NO signing path
+//   lives here — signing is a PAID entitlement that stays in the producer stack; the free tier mints only
+//   the UNSIGNED baseline seal.
+//
+// HONEST POSTURE (must not drift from cli/evidence.js#EVIDENCE_TRUST_NOTE — pinned byte-for-byte below)
+//   The seal is TAMPER-EVIDENT + OFFLINE-RECOMPUTABLE, NOT a trusted timestamp and NOT a legal opinion. It
+//   is an UNTRUSTED transport container: verify (verify-vh.js / cli `vh evidence verify`) RE-DERIVES the root
+//   from the bytes the holder has, never from the seal's own stored hashes.
+//
+// PURE + I/O-FREE
+//   The CALLER reads the files and hands in already-loaded { relPath, bytes } entries. Nothing here touches
+//   the filesystem, the clock, the network, or a key — same inputs -> byte-identical bytes out.
+//
+// RELPATH CONTRACT (fail-closed, so the byte-identical promise can never SILENTLY break)
+//   Every relPath MUST already be in canonical POSIX form: forward-slash separators and NO leading "./"
+//   (i.e. relPath === toPosixRel(relPath)). This is exactly what a directory walk emits on a POSIX host
+//   (cli/evidence.js#loadDirEntries does `path.relative(...).split(path.sep).join("/")`), so the normal
+//   producer flow already satisfies it. A relPath that is NOT canonical (a Windows-style backslash, a
+//   leading "./") is REJECTED with a named FreeSealError rather than re-normalized — because the free core
+//   and the paid producer use DIFFERENT normalizations for those forms (the producer keeps a literal
+//   backslash as a content byte on POSIX; "./x" makes the producer throw), so silently accepting them
+//   would mint a seal that does NOT byte-match the paid path. Fail-closed means: for any input the free
+//   core ACCEPTS, its seal is byte-identical to the paid seal; for inputs it cannot guarantee that, it
+//   refuses (a symmetric, named rejection) instead of producing a surprising, non-reproducible artifact.
+
+const merkle = require("./merkle");
+
+// ---------------------------------------------------------------------------
+// Product framing — byte-identical to cli/evidence.js. These are the discriminators + the in-band trust
+// caveat the paid serializeSeal stamps into every seal; reproducing them here (NOT importing cli/) keeps
+// the free seal byte-identical without depending on the producer stack. A drift guard in the parity test
+// asserts these equal the producer's exported constants, so they can never silently diverge.
+// ---------------------------------------------------------------------------
+
+const SEAL_KIND = "vh.evidence-seal";
+const SEAL_SCHEMA_VERSION = 1;
+
+// The free SAMPLE size: how many files an UNLICENSED packet may seal. The free seal core refuses to mint a
+// packet over this cap — sealing more is the paid `evidence_unlimited` entitlement, which stays in the
+// producer stack. Kept byte-identical to cli/evidence.js#SAMPLE_LIMIT (drift-guarded in the parity test).
+const SAMPLE_LIMIT = 25;
+
+// The TRUST-BOUNDARIES one-liner, byte-for-byte identical to cli/evidence.js#EVIDENCE_TRUST_NOTE. It is the
+// load-bearing honesty of the artifact and is committed into the seal bytes, so it MUST match exactly.
+const EVIDENCE_TRUST_NOTE =
+  "This evidence seal is TAMPER-EVIDENT + OFFLINE-RECOMPUTABLE, NOT a trusted timestamp. Its Merkle " +
+  "`root` commits to the full set of (relPath, content) pairs in the directory: any edit, rename, add, " +
+  "or remove changes the root, and verify RE-DERIVES the root from the bytes you hold and LOCALIZES the " +
+  "change to the exact file (MATCH / CHANGED / MISSING / UNEXPECTED). It does NOT prove WHEN the sealing " +
+  'happened ("sealed at T" rides the human-owned signing/timestamp trust-root, STRATEGY.md P-3) and it ' +
+  "is NOT a legal opinion. The packet is an UNTRUSTED transport container: verify never trusts the " +
+  "packet's own stored hashes.";
+
+// ---------------------------------------------------------------------------
+// A NAMED error so a caller/test catches ONE free-seal error rather than a bare Error or a TypeError leaking
+// from the hasher. A malformed entry set raises this rather than being silently coerced or partly accepted.
+// ---------------------------------------------------------------------------
+
+class FreeSealError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FreeSealError";
+  }
+}
+
+function isPlainObject(v) {
+  return v != null && typeof v === "object" && !Array.isArray(v);
+}
+
+// ---------------------------------------------------------------------------
+// _normalizeEntries(params) — STRICT validation + normalization of the caller-supplied flat file set into
+// the ordered { relPath, bytes } list the hasher consumes. Same per-entry strictness the producer's
+// packetseal._normalizeEntries enforces (non-empty relPath, unique across the set, Buffer/Uint8Array bytes),
+// and the free-tier-only constraints: a non-empty set capped at SAMPLE_LIMIT files. Throws FreeSealError on
+// the FIRST problem; never half-accepts.
+// ---------------------------------------------------------------------------
+
+function _normalizeEntries(params) {
+  if (!isPlainObject(params)) {
+    throw new FreeSealError("buildEvidenceSeal requires a { entries } object");
+  }
+  const raw = Array.isArray(params.entries) ? params.entries : null;
+  if (raw === null) {
+    throw new FreeSealError("evidence seal `entries` must be an array of { relPath, bytes }");
+  }
+  if (raw.length === 0) {
+    throw new FreeSealError("evidence seal `entries` must be a non-empty array of { relPath, bytes }");
+  }
+  if (raw.length > SAMPLE_LIMIT) {
+    throw new FreeSealError(
+      `the free evidence seal is limited to ${SAMPLE_LIMIT} files (got ${raw.length}); sealing more ` +
+        "is the paid `evidence_unlimited` entitlement in the full verifyhash CLI (`vh evidence seal`)."
+    );
+  }
+
+  const seen = new Set();
+  const entries = raw.map((e) => {
+    if (!isPlainObject(e)) {
+      throw new FreeSealError("evidence seal entry must be an object with relPath + bytes");
+    }
+    if (typeof e.relPath !== "string" || e.relPath.length === 0) {
+      throw new FreeSealError("evidence seal entry relPath must be a non-empty string");
+    }
+    // FAIL-CLOSED on non-canonical relPaths (see RELPATH CONTRACT above). A relPath that toPosixRel would
+    // change (a backslash separator, a leading "./") does NOT byte-match the paid producer's normalization,
+    // so we refuse it BEFORE the dedup/hash rather than silently mint a non-parity seal. Checked against the
+    // SAME merkle.toPosixRel the leaf/root math uses, so the guard and the hashing can never disagree.
+    if (e.relPath !== merkle.toPosixRel(e.relPath)) {
+      throw new FreeSealError(
+        `evidence seal entry relPath must be canonical POSIX form (forward slashes, no leading "./"): ` +
+          `got ${JSON.stringify(e.relPath)}, expected ${JSON.stringify(merkle.toPosixRel(e.relPath))}. ` +
+          "Normalize relPaths before sealing (a POSIX directory walk already does this); the free core " +
+          "refuses non-canonical paths so its seal stays byte-identical to the paid CLI."
+      );
+    }
+    if (seen.has(e.relPath)) {
+      throw new FreeSealError(
+        `evidence seal has a duplicate relPath across the file set: ${JSON.stringify(e.relPath)} ` +
+          "(every entry must occupy a distinct path)"
+      );
+    }
+    seen.add(e.relPath);
+    if (!(e.bytes instanceof Uint8Array) && !Buffer.isBuffer(e.bytes)) {
+      throw new FreeSealError(
+        `evidence seal entry ${JSON.stringify(e.relPath)} bytes must be a Buffer/Uint8Array ` +
+          "(the core is I/O-free; the caller reads the file and hands in its bytes)"
+      );
+    }
+    const bytes = Buffer.isBuffer(e.bytes) ? e.bytes : Buffer.from(e.bytes);
+    return { relPath: e.relPath, bytes };
+  });
+  return entries;
+}
+
+// Stable string comparator matching cli/core/packetseal.js#buildSeal's file sort (and serializeSeal's
+// emitted order): relPath ascending by JS string comparison. Kept in ONE place so build + serialize agree.
+function _byRelPath(a, b) {
+  return a.relPath < b.relPath ? -1 : a.relPath > b.relPath ? 1 : 0;
+}
+
+// ---------------------------------------------------------------------------
+// buildEvidenceSeal({ entries }) — mint a BARE, UNSIGNED evidence seal object from a flat { relPath, bytes }
+// entry list. PURE + deterministic: same { relPath, bytes } set -> byte-identical seal, regardless of the
+// caller's array order (the files array is emitted sorted by relPath).
+//
+// Each file's per-record fields are re-derived via the ALREADY-VENDORED ./merkle convention (the SAME math
+// cli/hash.js computes with ethers, cross-checked byte-for-byte in test/verifier.cli.test.js):
+//   contentHash = keccak256(bytes)                         (merkle.hashBytes)
+//   leaf        = keccak256(DIR_LEAF_DOMAIN ++ relPath ++ 0x00 ++ contentHash)   (merkle.pathLeaf)
+//   root        = sorted-leaf, domain-separated Merkle root over the path-bound leaves (merkle.rootFromFlat)
+//
+// Returns: { kind, schemaVersion, note, root, fileCount, files: [{ relPath, contentHash, leaf }] }
+// — the EXACT shape + key order cli/evidence.js#serializeSeal emits, so serializeEvidenceSeal(...) below is
+// byte-identical to the paid path.
+// ---------------------------------------------------------------------------
+
+function buildEvidenceSeal(params) {
+  const entries = _normalizeEntries(params);
+
+  // Per-file (contentHash, leaf), sorted by relPath so the seal bytes are deterministic regardless of the
+  // caller's input order — exactly as the producer's buildSeal sorts its emitted `files`.
+  const files = entries
+    .map((e) => {
+      const contentHash = merkle.hashBytes(e.bytes);
+      const leaf = merkle.pathLeaf(e.relPath, contentHash);
+      return { relPath: e.relPath, contentHash, leaf };
+    })
+    .sort(_byRelPath);
+
+  // The root is re-derived from the SAME (relPath, contentHash) leaves the producer commits to. Order does
+  // not affect the root (rootFromLeaves sorts the leaves), but we feed the already-sorted list for clarity.
+  const root = merkle.rootFromFlat(files.map((f) => ({ relPath: f.relPath, contentHash: f.contentHash })));
+
+  return {
+    kind: SEAL_KIND,
+    schemaVersion: SEAL_SCHEMA_VERSION,
+    note: EVIDENCE_TRUST_NOTE,
+    root,
+    fileCount: files.length,
+    files,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// serializeEvidenceSeal(seal) — the canonical, byte-deterministic serialization (newline-terminated),
+// byte-identical to cli/evidence.js#serializeSeal. Emits an EXPLICIT ordered object literal (top-level key
+// order kind, schemaVersion, note, root, fileCount, files; per-file relPath, contentHash, leaf), no
+// insignificant whitespace, a single trailing "\n". Accepts the object buildEvidenceSeal returned (or any
+// structurally equivalent seal); does NOT re-validate (the producer's serializeSeal validates first, but the
+// free path always serializes a seal it just built, so the structure is known-good).
+// ---------------------------------------------------------------------------
+
+function serializeEvidenceSeal(seal) {
+  if (!isPlainObject(seal)) {
+    throw new FreeSealError("serializeEvidenceSeal requires a seal object");
+  }
+  if (!Array.isArray(seal.files)) {
+    throw new FreeSealError("serializeEvidenceSeal requires a seal with a `files` array");
+  }
+  const canonical = {
+    kind: seal.kind,
+    schemaVersion: seal.schemaVersion,
+    note: seal.note,
+    root: seal.root,
+    fileCount: seal.fileCount,
+    files: seal.files.map((e) => ({
+      relPath: e.relPath,
+      contentHash: e.contentHash,
+      leaf: e.leaf,
+    })),
+  };
+  return JSON.stringify(canonical) + "\n";
+}
+
+module.exports = {
+  SEAL_KIND,
+  SEAL_SCHEMA_VERSION,
+  SAMPLE_LIMIT,
+  EVIDENCE_TRUST_NOTE,
+  FreeSealError,
+  buildEvidenceSeal,
+  serializeEvidenceSeal,
+};

package/verifier/lib/secp256k1-recover.js

@@ -0,0 +1,249 @@
+"use strict";
+
+// verifier/lib/secp256k1-recover.js — INDEPENDENT EIP-191 personal_sign signer recovery.
+//
+// WHY THIS EXISTS
+//   `verifier/` is a near-zero-dependency, SECOND implementation of the family's signature recovery, kept
+//   deliberately separate from the production ethers path so the two can be CROSS-CHECKED and can never
+//   silently drift (the anti-divergence guard in test/verifier.crypto.test.js). This file recovers the
+//   secp256k1 signer ADDRESS from an `eip191-personal-sign` 65-byte (r||s||v) signature over a message,
+//   using ONLY:
+//     * `js-sha3` (via ./keccak) for keccak256, and
+//     * a single, tiny, vendored elliptic-curve routine (below) for the secp256k1 public-key RECOVERY.
+//   It does NOT require `ethers`, `hardhat`, `cli/`, or `trustledger/`.
+//
+// THE secp256k1 ROUTINE (vendored, audited, standard)
+//   Public-key recovery from an ECDSA signature is textbook curve math over the secp256k1 group
+//   (SEC 1, §4.1.6 / §2.3). We implement exactly that with Node BigInt: affine point add/double on
+//   y^2 = x^3 + 7 (mod p), a constant-time-agnostic double-and-add scalar multiply, and a Tonelli-Shanks
+//   style square root (p ≡ 3 mod 4, so √a = a^((p+1)/4)). No randomness, no secrets — recovery is a PUBLIC
+//   computation over the signature + message hash, so timing/side-channels are irrelevant here. The curve
+//   constants are the canonical secp256k1 domain parameters.
+
+const { keccak256 } = require("./keccak");
+
+// ---- secp256k1 domain parameters (canonical) -------------------------------------------------------
+const P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn; // field prime
+const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n; // group order
+const A = 0n; // curve a
+const B = 7n; // curve b
+const GX = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n;
+const GY = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n;
+
+// ---- modular arithmetic helpers --------------------------------------------------------------------
+function mod(a, m) {
+  const r = a % m;
+  return r >= 0n ? r : r + m;
+}
+
+// Modular inverse via the extended Euclidean algorithm (m is prime here, so a is invertible unless 0).
+function invmod(a, m) {
+  a = mod(a, m);
+  if (a === 0n) throw new Error("secp256k1: inverse of zero");
+  let [old_r, r] = [a, m];
+  let [old_s, s] = [1n, 0n];
+  while (r !== 0n) {
+    const q = old_r / r;
+    [old_r, r] = [r, old_r - q * r];
+    [old_s, s] = [s, old_s - q * s];
+  }
+  return mod(old_s, m);
+}
+
+// Modular exponentiation (square-and-multiply).
+function powmod(base, exp, m) {
+  base = mod(base, m);
+  let result = 1n;
+  while (exp > 0n) {
+    if (exp & 1n) result = mod(result * base, m);
+    base = mod(base * base, m);
+    exp >>= 1n;
+  }
+  return result;
+}
+
+// Square root mod p. secp256k1's p ≡ 3 (mod 4), so √a = a^((p+1)/4) mod p (when a is a QR).
+function sqrtmod(a) {
+  const r = powmod(a, (P + 1n) / 4n, P);
+  if (mod(r * r, P) !== mod(a, P)) throw new Error("secp256k1: no square root (x not on curve)");
+  return r;
+}
+
+// ---- elliptic-curve point arithmetic (affine; null = point at infinity) ---------------------------
+const INF = null;
+
+function isInf(Pt) {
+  return Pt === INF;
+}
+
+function pointAdd(p1, p2) {
+  if (isInf(p1)) return p2;
+  if (isInf(p2)) return p1;
+  const [x1, y1] = p1;
+  const [x2, y2] = p2;
+  if (x1 === x2 && mod(y1 + y2, P) === 0n) return INF; // p1 = -p2
+  let m;
+  if (x1 === x2 && y1 === y2) {
+    // doubling: m = (3x^2 + a) / (2y)
+    m = mod((3n * x1 * x1 + A) * invmod(2n * y1, P), P);
+  } else {
+    m = mod((y2 - y1) * invmod(x2 - x1, P), P);
+  }
+  const x3 = mod(m * m - x1 - x2, P);
+  const y3 = mod(m * (x1 - x3) - y1, P);
+  return [x3, y3];
+}
+
+function scalarMul(k, point) {
+  k = mod(k, N);
+  let result = INF;
+  let addend = point;
+  while (k > 0n) {
+    if (k & 1n) result = pointAdd(result, addend);
+    addend = pointAdd(addend, addend);
+    k >>= 1n;
+  }
+  return result;
+}
+
+const G = [GX, GY];
+
+// Decompress the curve point with x-coordinate `x` and the given y-parity (0 = even, 1 = odd).
+function liftX(x, yParity) {
+  const alpha = mod(x * x * x + A * x + B, P); // y^2
+  let y = sqrtmod(alpha);
+  if ((y & 1n) !== BigInt(yParity)) y = mod(P - y, P);
+  return [x, y];
+}
+
+// ---- big-endian buffer <-> BigInt ------------------------------------------------------------------
+function bufToBig(buf) {
+  let n = 0n;
+  for (const b of buf) n = (n << 8n) | BigInt(b);
+  return n;
+}
+
+function bigTo32(n) {
+  const out = Buffer.alloc(32);
+  for (let i = 31; i >= 0; i--) {
+    out[i] = Number(n & 0xffn);
+    n >>= 8n;
+  }
+  return out;
+}
+
+/**
+ * Recover the secp256k1 PUBLIC KEY from an ECDSA signature + 32-byte message hash (SEC 1, §4.1.6).
+ * @param {Buffer} msgHash 32-byte hash that was signed
+ * @param {bigint} r       signature r
+ * @param {bigint} s       signature s
+ * @param {number} recId   recovery id 0..3 (derived from v)
+ * @returns {{x: bigint, y: bigint}} the recovered public-key point
+ */
+function recoverPublicKey(msgHash, r, s, recId) {
+  if (r <= 0n || r >= N) throw new Error("secp256k1: r out of range");
+  if (s <= 0n || s >= N) throw new Error("secp256k1: s out of range");
+  if (recId < 0 || recId > 3) throw new Error("secp256k1: invalid recovery id");
+
+  // x = r + (recId >> 1) * N  (the high bit of recId says whether r overflowed the field by one order)
+  const x = r + (recId >> 1 ? N : 0n);
+  if (x >= P) throw new Error("secp256k1: recovered x not in field");
+
+  // R = point with x-coordinate x and y-parity = (recId & 1).
+  const R = liftX(x, recId & 1);
+
+  // Q = r^-1 (s*R - e*G), where e = msgHash mod N.
+  const e = mod(bufToBig(msgHash), N);
+  const rInv = invmod(r, N);
+  const sR = scalarMul(s, R);
+  const eG = scalarMul(e, G);
+  const negEG = isInf(eG) ? INF : [eG[0], mod(P - eG[1], P)];
+  const Q = scalarMul(rInv, pointAdd(sR, negEG));
+  if (isInf(Q)) throw new Error("secp256k1: recovered point at infinity");
+  return { x: Q[0], y: Q[1] };
+}
+
+/**
+ * Derive the lowercase 0x Ethereum address from a recovered public-key point.
+ * address = "0x" + last 20 bytes of keccak256( X(32) || Y(32) ).
+ */
+function pubKeyToAddress(pub) {
+  const raw = Buffer.concat([bigTo32(pub.x), bigTo32(pub.y)]); // 64-byte uncompressed (no 0x04 prefix)
+  const hash = keccak256(raw);
+  return "0x" + hash.slice(12).toString("hex");
+}
+
+/**
+ * Build the EIP-191 personal_sign pre-image for a message and return its keccak256 digest.
+ *
+ * EIP-191 personal_sign: keccak256( "\x19Ethereum Signed Message:\n" + <decimal byte length> + <message> ),
+ * where <message> is the EXACT canonical UTF-8 bytes (here, the canonical attestation string including its
+ * single trailing newline). This reproduces, byte-for-byte, what `cli/core/attestation.js` documents and
+ * what ethers' personal_sign hashes.
+ *
+ * @param {Buffer|Uint8Array|string} message UTF-8 message (string is encoded as UTF-8)
+ * @returns {Buffer} the 32-byte EIP-191 digest
+ */
+function eip191Hash(message) {
+  const msgBytes = Buffer.isBuffer(message)
+    ? message
+    : message instanceof Uint8Array
+    ? Buffer.from(message)
+    : Buffer.from(String(message), "utf8");
+  const prefix = Buffer.from("\x19Ethereum Signed Message:\n" + msgBytes.length, "utf8");
+  return keccak256(Buffer.concat([prefix, msgBytes]));
+}
+
+/**
+ * Recover the lowercase 0x signer ADDRESS from an `eip191-personal-sign` 65-byte (r||s||v) signature over
+ * `message`. INDEPENDENT of ethers/hardhat — only ./keccak (js-sha3) + the vendored secp256k1 above.
+ *
+ * @param {Buffer|Uint8Array|string} message    the EXACT canonical UTF-8 bytes that were signed
+ * @param {string|Buffer|Uint8Array} signature  65-byte r(32)||s(32)||v(1), as 0x-hex or raw bytes
+ * @returns {string} the recovered signer address, 0x-prefixed lowercase
+ */
+function recoverPersonalSignAddress(message, signature) {
+  const sig = normalizeSig(signature);
+  const r = bufToBig(sig.subarray(0, 32));
+  const s = bufToBig(sig.subarray(32, 64));
+  let v = sig[64];
+  // Accept v in {0,1} or {27,28} (and EIP-155-ish higher v reduced to parity). recId is v's low bit.
+  if (v >= 27) v -= 27;
+  if (v !== 0 && v !== 1) {
+    // Fall back to parity for any non-canonical encoding; reject only the wildly invalid.
+    v = v & 1;
+  }
+  const digest = eip191Hash(message);
+  const pub = recoverPublicKey(digest, r, s, v);
+  return pubKeyToAddress(pub);
+}
+
+function normalizeSig(signature) {
+  let buf;
+  if (Buffer.isBuffer(signature)) {
+    buf = signature;
+  } else if (signature instanceof Uint8Array) {
+    buf = Buffer.from(signature);
+  } else if (typeof signature === "string") {
+    const hex = signature.startsWith("0x") || signature.startsWith("0X") ? signature.slice(2) : signature;
+    if (!/^[0-9a-fA-F]*$/.test(hex) || hex.length % 2 !== 0) {
+      throw new Error("secp256k1: signature must be 0x-hex (even length)");
+    }
+    buf = Buffer.from(hex, "hex");
+  } else {
+    throw new TypeError("secp256k1: signature must be a 0x-hex string or byte buffer");
+  }
+  if (buf.length !== 65) {
+    throw new Error(`secp256k1: eip191-personal-sign signature must be 65 bytes (r||s||v), got ${buf.length}`);
+  }
+  return buf;
+}
+
+module.exports = {
+  recoverPersonalSignAddress,
+  eip191Hash,
+  recoverPublicKey,
+  pubKeyToAddress,
+  // exported for tests/audit:
+  _internal: { mod, invmod, powmod, sqrtmod, pointAdd, scalarMul, liftX, G, N, P },
+};

package/verifier/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "verify-vh",
+  "version": "0.1.0",
+  "description": "Standalone, read-only, OFFLINE verifier for verifyhash artifacts (evidence seals, reconciliation seals, dataset attestations, proof bundles). Near-zero-dependency: js-sha3 + a tiny vendored secp256k1 recovery — explicitly NO ethers/hardhat, so a third party can npm install it alone and audit it in an afternoon.",
+  "license": "Apache-2.0",
+  "bin": {
+    "verify-vh": "verify-vh.js"
+  },
+  "files": [
+    "verify-vh.js",
+    "lib/"
+  ],
+  "main": "verify-vh.js",
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/verifyhash/verifyhash.git",
+    "directory": "verifier"
+  },
+  "homepage": "https://github.com/verifyhash/verifyhash/tree/main/verifier#readme",
+  "bugs": {
+    "url": "https://github.com/verifyhash/verifyhash/issues"
+  },
+  "keywords": [
+    "verify",
+    "merkle",
+    "keccak",
+    "provenance",
+    "tamper-evident",
+    "attestation",
+    "offline",
+    "evidence"
+  ],
+  "dependencies": {
+    "js-sha3": "^0.8.0"
+  }
+}