You don't need Callydus Sign to verify a document.

// Permissionless verification — @solana/web3.js, sem SDK Callydus
import { Connection, PublicKey } from "@solana/web3.js";
import * as crypto from "crypto";
import { readFileSync } from "fs";

const PROGRAM_ID = new PublicKey(
  "FD8rXcGgzMsgUNqpexKfGz4CuFPY2urvsML69rf37ifn"
);
const RPC = new Connection("https://api.devnet.solana.com");

// Step 1 — compute SHA-256 of the file locally
function hashFile(path: string): Buffer {
  const bytes = readFileSync(path);
  return crypto.createHash("sha256").update(bytes).digest();
}

// Step 2 — derive the DocumentRecord PDA address
// PDA seeds: ["document", document_hash] — determinístico a partir do hash
async function deriveDocumentPDA(hash: Buffer): Promise<PublicKey> {
  const [pda] = await PublicKey.findProgramAddress(
    [Buffer.from("document"), hash],
    PROGRAM_ID
  );
  return pda;
}

// Step 3 — fetch and deserialize the account
// Borsh layout after Anchor discriminator (8 bytes):
//   [u8;32] document_hash | Pubkey initiator | Vec<Pubkey> signatories
//   u8 mode | i64 created_at | u8 status | u8 approved_count | u8 bump
type Status = "Pending" | "PartialySigned" | "Completed" | "Declined";

interface DocumentRecord {
  documentHash:  string;  // hex
  initiator:     string;  // base58
  signatories:   string[]; // base58[]
  mode:          "Sequential" | "Parallel";
  status:        Status;
  approvedCount: number;  // u8 — readUInt8, não readUInt32LE
  createdAt:     Date;
}

function parseDocumentRecord(data: Buffer): DocumentRecord {
  let offset = 8; // skip Anchor discriminator

  const documentHash = data.slice(offset, (offset += 32)).toString("hex");
  const initiator = new PublicKey(data.slice(offset, (offset += 32))).toBase58();

  const sigLen = data.readUInt32LE(offset);
  offset += 4;
  const signatories: string[] = [];
  for (let i = 0; i < sigLen; i++) {
    signatories.push(new PublicKey(data.slice(offset, (offset += 32))).toBase58());
  }

  const MODES   = ["Sequential", "Parallel"] as const;
  const STATUSES = ["Pending", "PartialySigned", "Completed", "Declined"] as const;
  const mode         = MODES[data.readUInt8(offset++)];
  const createdAt = new Date(Number(data.readBigInt64LE(offset)) * 1000);
  offset += 8;
  const status       = STATUSES[data.readUInt8(offset++)];
  const approvedCount = data.readUInt8(offset++);

  return { documentHash, initiator, signatories, mode, status, approvedCount, createdAt };
}

// Step 4 — verify the document
async function verifyDocument(filePath: string) {
  const hash = hashFile(filePath);
  const pda  = await deriveDocumentPDA(hash);

  const accountInfo = await RPC.getAccountInfo(pda);
  if (!accountInfo) {
    return { verified: false, reason: "account not found" };
  }

  const record = parseDocumentRecord(Buffer.from(accountInfo.data));

  if (record.status !== "Completed") {
    return { verified: false, reason: "status: " + record.status };
  }

  // Step 5 (optional) — fetch individual SigningEvents
  const events = await fetchSigningEvents(pda, record.signatories);

  return { verified: true, record, events };
}

async function fetchSigningEvents(
  documentPda: PublicKey,
  signatories: string[]
) {
  return Promise.all(signatories.map(async (signatory) => {
    // Seeds: ["signing-event", document_record_pda, signatory_pubkey]
    const [eventPda] = await PublicKey.findProgramAddress([
      Buffer.from("signing-event"),
      documentPda.toBuffer(),
      new PublicKey(signatory).toBuffer(),
    ], PROGRAM_ID);
    const info = await RPC.getAccountInfo(eventPda);
    return { signatory, data: info?.data };
  }));
}