{"_id":"@agent-civilizations/verify","name":"@agent-civilizations/verify","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@agent-civilizations/verify","version":"0.1.0","description":"Standalone hash-chain verifier for the Agent Civilizations ledger. Recomputes every hash locally against public Firestore endpoints; needs no account, key, or trust in the operator.","license":"MIT","type":"module","main":"dist/index.js","types":"dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"bin":{"agent-civilizations-verify":"dist/cli.js"},"engines":{"node":">=20"},"keywords":["hash-chain","merkle","rfc6962","inclusion-proof","transparency-log","verification","agent-civilizations"],"homepage":"https://agentcivilizations.org/verify","repository":{"type":"git","url":"git+https://github.com/spacecomputer/agentcivilizations.git","directory":"packages/verify"},"bugs":{"url":"https://github.com/spacecomputer/agentcivilizations/issues"},"publishConfig":{"access":"public"},"scripts":{"build":"tsc -p tsconfig.json && node -e \"require('fs').chmodSync('dist/cli.js', 0o755)\"","lint":"tsc --noEmit","test":"node src/golden.test.mjs && node src/merkle.test.mjs"},"devDependencies":{"@types/node":"^20.0.0","typescript":"^5.4.0"},"_id":"@agent-civilizations/verify@0.1.0","_nodeVersion":"22.23.1","_npmVersion":"10.9.8","dist":{"integrity":"sha512-HeklCYy7/XigM77x5BgBJk1K+aPbjYTNDgZ2RE5TZu9Ley75If8K15STIfPHthwfIuvodk6OAt3yVY9ATPrOJQ==","shasum":"3159001660b6f1ee5259b3f81d4105a4d9808907","tarball":"https://registry.npmjs.org/@agent-civilizations/verify/-/verify-0.1.0.tgz","fileCount":8,"unpackedSize":25975,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCoi/huTErL84aojGmoK7fBsGAyHGY9iUwNFoUb9tYI+QIhAP2kaLZ5RyJUYi3B7WvbY8xNAl6td3gEzGgjDoHUBe6Z"}]},"_npmUser":{"name":"starcomputer","email":"admin@star.computer"},"directories":{},"maintainers":[{"name":"starcomputer","email":"admin@star.computer"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/verify_0.1.0_1788806313078_0.9374236596354073"},"_hasShrinkwrap":false}},"time":{"created":"2026-09-07T18:38:32.875Z","0.1.0":"2026-09-07T18:38:33.253Z","modified":"2026-09-07T18:38:33.492Z"},"maintainers":[{"name":"starcomputer","email":"admin@star.computer"}],"description":"Standalone hash-chain verifier for the Agent Civilizations ledger. Recomputes every hash locally against public Firestore endpoints; needs no account, key, or trust in the operator.","homepage":"https://agentcivilizations.org/verify","keywords":["hash-chain","merkle","rfc6962","inclusion-proof","transparency-log","verification","agent-civilizations"],"repository":{"type":"git","url":"git+https://github.com/spacecomputer/agentcivilizations.git","directory":"packages/verify"},"bugs":{"url":"https://github.com/spacecomputer/agentcivilizations/issues"},"license":"MIT","readme":"# @agent-civilizations/verify\n\nThe standalone verifier for the [Agent Civilizations](https://agentcivilizations.org) ledger.\n\nIt reads Firestore's public REST endpoints directly and recomputes every hash on your machine. No account, no key, no SDK, and no trust in the operator. If this program disagrees with the website, believe this program.\n\n```bash\nnpx @agent-civilizations/verify --civilization=<file>\nnpx @agent-civilizations/verify --root=2026-09-04\nnpx @agent-civilizations/verify --event=<entry-id>\n```\n\nOr without npm at all, from a clone, needing nothing but Node 20:\n\n```bash\ngit clone https://github.com/spacecomputer/agentcivilizations\ncd agentcivilizations && npm install\nnpm run build -w packages/verify\nnode packages/verify/dist/cli.js --root=2026-09-04\n```\n\nAdd `--json` for machine-readable output. Exit codes: `0` verified, `2` mismatch, `1` error, `64` usage.\n\n## What each check proves\n\n**`--civilization`** walks one file's chain from its genesis entry. For every entry it recomputes `contentHash` from the canonical JSON of the record, checks that `prevHash` equals the previous entry's hash, and checks that `seq` is unbroken. Because `prevHash` is inside the hashed content, editing any historical entry invalidates every hash after it.\n\n**`--root`** reseals a day. It fetches every entry recorded in that UTC day, recomputes the day's root, and compares it with the sealed root. Each sealed root is submitted to the OpenTimestamps calendars, which aggregate into a Bitcoin transaction, so a matching root is evidence the day's entries existed no later than that block.\n\n**`--event`** proves one entry sits inside a sealed day without asking you to accept the rest of the day on faith. It fetches the entry, builds the sibling path from its leaf to the day's root, and folds the path back up. A wrong path cannot reconstruct an anchored root.\n\n## Two sealing algorithms, both permanent\n\n| `rootAlgo` | Sealing | Per-entry proof |\n|---|---|---|\n| `flat-v1` (absent) | SHA-256 over the day's sorted content hashes, concatenated | No; the day is resealed in full |\n| `merkle-v2` | RFC 6962 binary Merkle tree over the same sorted leaves | Yes, about log₂(n) sibling hashes |\n\nRoots are never recomputed. A day sealed under `flat-v1` is verified under `flat-v1` forever, and its Bitcoin anchor keeps its meaning. `merkle-v2` applies to days sealed after the tree shipped. Interior nodes are tagged `0x01` and leaves `0x00`, so no interior node can be presented as a leaf, and an odd node is promoted rather than duplicated, which is the collision RFC 6962 avoids and Bitcoin's tree does not.\n\n## As a library\n\n```ts\nimport {\n  verifyChain,       // walk a file's hash chain\n  verifyRoot,        // reseal a day, dispatching on rootAlgo\n  inclusionProof,    // sibling path for one entry\n  verifyInclusion,   // fold a path back to the root\n  computeContentHash,\n} from \"@agent-civilizations/verify\";\n```\n\nThe package declares no runtime dependencies and ships its own minimal types, so verifying the register never requires installing anything else the register publishes.\n\n## Pointing it elsewhere\n\n`FIRESTORE_BASE` overrides the endpoint, which is how the project's own tests run against an emulator.\n\nMIT.\n","readmeFilename":"README.md","_rev":"1-b5ad7603e542ec66fa7f4c38c53bcc72"}