# barcoding.dev — the universal barcode and identifier layer

> by visibility.cloud — the third developer site, beside epcis.dev and
> transactions.dev. Read the barcode, and name the thing that never had
> one. decode / resolve / verify / generate / serialize are pure and local
> TODAY on every scheme in the pinned registry (GS1 GTIN/GLN/SSCC/Digital Link,
> VIN, ISBN, UDI, NDC, tracking numbers, AAMVA DL), with no key and no account.
> label / enrich / bridge / hierarchy / party are designed and NOT BUILT — each
> gated on a launch blocker, listed as such below, never beside a live verb.
> Codec + data, never a resolver — resolution is id.org.ai's, served through
> this property's delegating doors.

## The two halves

**Read the barcode.** `decode` a frame, `resolve` what it said to canonical
identity, `verify` the check digit and structure from pinned tables. Pure,
local, no key.

**Name what has none.** Most of what moves through a building carries
no identifier at all — totes, bins, returnable crates, a pallet built forty
minutes ago, a fixed asset, a dock door, a form that is only a PDF.
`serialize` derives one serial from the request with no stored counter, on a
GS1 AI(21)-safe alphabet, and states in the response exactly what that serial
discloses. It needs nobody's permission — no license to buy, no membership to
join, no key, no account. What it still waits on is how you number things,
and whoever owns that decision.

## Run it, without us
Two commands, both run on 2026-08-06, both answered. No key, no
account, no meter on either.

    curl -s https://api.barcoding.dev/resolve -H 'content-type: application/json' -d '{"payload":"(01)09506000134352(17)261231(10)ABC123(21)1234"}'

    npx -y barcoding.dev@0.1.0 resolve '(01)09506000134352(17)261231(10)ABC123(21)1234'

The landing page performs the same read server-side before any script runs:
one GS1 label, encoded by this build, decoded back through an independent
decoder in the build's own round-trip gate, and split into the one field a
checkout register takes and the fields that arrive in the same scan and go
nowhere. Typing your own into that figure is a pure parser in the tab; a photo
is read in the tab and dropped; the camera is at /scan only, because
camera=() stays in this origin's headers on every other path. A driver's
license answers with the typed refusal personal-document-refused (422) and is
never shown, kept or sent.

## What is NOT built

Listed here so no reader has to infer it from silence. None of these is in the
tarball; each returned `404 no door at that path` from a terminal on
2026-08-05.

- `label` — P0-29
- `enrich` — P0-2
- `bridge` — P0-3
- `hierarchy` — P0-3
- `party` — P0-3

`label` is the one most likely to be assumed live, because the ASSIGN half
reads like it implies a printed tag: templates and print-ready output
(PNG/SVG/PDF/ZPL) will be that verb, and they are designed, not shipped.

## Fork the scan

From the end of December 2027, GS1's Sunrise 2027 program expects retail POS
to read and process 2D barcodes, extracting the GTIN — cited as GS1's program
on GS1's timeline, never as our forecast. When a brand encodes lot, expiry and
serial, all of it arrives in the same square on the same scan, and the register
keeps the GTIN and discards the rest. Fork it: GTIN to the register unchanged,
the rest out the other side as named fields. No behavior change at the lane,
no new hardware.

**This site's half is the split only** — `decode` · `resolve` · `verify`,
pure and local. The other side is not this site's: the event lands at
[epcis.dev](https://epcis.dev); the cross-source rollups and the tables you own
are [visibility.cloud](https://visibility.cloud). barcoding.dev holds no
history — no `query`, no `trace`, alone among the family's sites.

## Machine surfaces

- Capability card (AXP probe manifest): https://barcoding.dev/.well-known/agents.json
- OpenAPI 3.1 contract: https://barcoding.dev/openapi.json
- Pricing Document (the codec surface is free because it is near-zero to serve
  and a first loop does not close without it; managed SSCC ranges are the paid
  seam, answered as a typed 402 OFFER at the engine — nothing quoted yet,
  P0-22):
  https://barcoding.dev/pricing
- The scheme registry, typed (OK | EMPTY | BLOCKED on one address):
  https://barcoding.dev/schemes
- Family registry (sibling sites as typed edges): https://barcoding.dev/family.json
- llms.txt: https://barcoding.dev/llms.txt

## Pages

- https://barcoding.dev/ — the landing (this document's HTML face)
- https://barcoding.dev/blog/ — the explainer series and worked examples
- https://barcoding.dev/schemes/ — one reference page per scheme, three faces at one address
- https://barcoding.dev/scan/ — in-browser scan demo, decode-and-discard
- https://barcoding.dev/get-access/ — the access list

## The engine face

api.barcoding.dev — POST /resolve · /verify · /decode · /serialize,
GET|POST /generate, GET /pins · /version. Keyless, typed errors, proof
receipts on ?proof=true. The delegating doors (/01/{gtin14}, /vin/{vin}, …)
answer on this origin too — see the OpenAPI contract.

Verified from a terminal on 2026-08-05: GET /version returned engine 0.1.0 and
the four pinned digests; POST /resolve split an element string into its AIs
with `"check": "mod10 pass"` and the SGTIN URN; POST /serialize returned a
transparent serial carrying its own `discloses` list and `honesty` string;
GET /generate?gtin=…&symbol=qr returned the SVG, and a call with no encodable
input returned a typed USAGE error with a worked hint rather than a guess.