fix: handle HMAC signature encodings correctly

[bytaesu]

Corrects Base64 and hex signature handling and adds a reusable hex-to-bytes API

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Greptile Summary

This PR fixes two distinct HMAC signature encoding bugs and adds a hex.toBytes convenience API. The changes are well-targeted and backed by solid parameterized tests.

• Hex verify bug fixed: verify previously called hex.decode, which UTF-8-decoded the raw signature bytes into a string before passing them to WebCrypto — the double-encoding corrupted the signature. It now calls hex.toBytes to keep the bytes intact.
• Standard base64 signing fixed: "base64" encoding previously called base64Url.encode (URL-safe alphabet), so the output contained -/_ instead of +//. It now correctly calls base64.encode.
• hex.toBytes API: New function wraps hexToBytes from @noble/hashes and is exposed on the hex object, enabling callers to obtain raw bytes from a hex string without a UTF-8 round-trip.

Confidence Score: 4/5

Safe to merge — all changes are focused bug fixes with matching expected-value tests that pin the corrected behaviour.

The logic is correct and the tests are self-consistent, but two real defects in the production signing/verification path are being fixed here and deserve a final sanity check before merging into a security-sensitive utility library.

Files Needing Attention: No files require special attention, though a quick read of src/hmac.ts verify path is worthwhile given the nature of the changes.

_{Reviews (1): Last reviewed commit: "fix(hmac): handle signature encodings co..." | Re-trigger Greptile}