@jterrazz/attestation 0.1.0

package/dist/index.cjs

@@ -0,0 +1,21 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_verify = require("./verify.cjs");
+const require_audit = require("./audit.cjs");
+const require_eip712_schema = require("./eip712-schema.cjs");
+exports.ATTESTATION_DOMAIN_V1 = require_eip712_schema.ATTESTATION_DOMAIN_V1;
+exports.ATTESTATION_PRIMARY_TYPE = require_eip712_schema.ATTESTATION_PRIMARY_TYPE;
+exports.ATTESTATION_TYPES_V1 = require_eip712_schema.ATTESTATION_TYPES_V1;
+exports.CANONICAL_VERSION = require_verify.CANONICAL_VERSION;
+exports.InvalidContentError = require_verify.InvalidContentError;
+exports.NO_PRIOR_ATTESTATION = require_eip712_schema.NO_PRIOR_ATTESTATION;
+exports.SCHEMA_VERSION = require_verify.SCHEMA_VERSION;
+exports.audit = require_audit.audit;
+exports.buildAttestationMessage = require_verify.buildAttestationMessage;
+exports.canonicalize = require_verify.canonicalize;
+exports.createAttestation = require_verify.createAttestation;
+exports.fromStored = require_verify.fromStored;
+exports.parse = require_verify.parse;
+exports.signAttestation = require_verify.signAttestation;
+exports.stringify = require_verify.stringify;
+exports.toStored = require_verify.toStored;
+exports.verifyAttestation = require_verify.verifyAttestation;

package/dist/index.d.cts

@@ -0,0 +1,24 @@
+import { _ as InvalidContentError, a as stringify, c as buildAttestationMessage, d as SignedAttestation, f as StoredAttestation, g as VerifyResult, h as VerifyOk, i as parse, l as createAttestation, m as VerifyFail, n as verifyAttestation, o as toStored, p as VerifyError, r as fromStored, s as CreateAttestationInput, t as VerifyInput, u as signAttestation, v as canonicalize } from "./verify.cjs";
+import { a as ArticleSubject, i as ArticleClaims, n as ATTESTATION_PRIMARY_TYPE, o as AttestationMessage, r as ATTESTATION_TYPES_V1, s as NO_PRIOR_ATTESTATION, t as ATTESTATION_DOMAIN_V1 } from "./eip712-schema.cjs";
+//#region src/version.d.ts
+declare const SCHEMA_VERSION: 1;
+declare const CANONICAL_VERSION: 1;
+//#endregion
+//#region src/core/audit.d.ts
+/**
+ * Suspicious-character audit — runs at SIGN time, never at verify time.
+ *
+ * Verify must always remain a function of canonicalize() alone, never adding
+ * stricter rules. Audit is a separate, mutable layer of advice for the author:
+ * "you probably don't want these invisible chars in a published article".
+ */
+type AuditFinding = {
+  line: number;
+  column: number;
+  codepoint: number;
+  name: string;
+};
+declare function audit(canonical: Uint8Array): AuditFinding[];
+//#endregion
+export { ATTESTATION_DOMAIN_V1, ATTESTATION_PRIMARY_TYPE, ATTESTATION_TYPES_V1, type ArticleClaims, type ArticleSubject, type AttestationMessage, type AuditFinding, CANONICAL_VERSION, type CreateAttestationInput, InvalidContentError, NO_PRIOR_ATTESTATION, SCHEMA_VERSION, type SignedAttestation, type StoredAttestation, type VerifyError, type VerifyFail, type VerifyInput, type VerifyOk, type VerifyResult, audit, buildAttestationMessage, canonicalize, createAttestation, fromStored, parse, signAttestation, stringify, toStored, verifyAttestation };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import { _ as InvalidContentError, a as stringify, c as buildAttestationMessage, d as SignedAttestation, f as StoredAttestation, g as VerifyResult, h as VerifyOk, i as parse, l as createAttestation, m as VerifyFail, n as verifyAttestation, o as toStored, p as VerifyError, r as fromStored, s as CreateAttestationInput, t as VerifyInput, u as signAttestation, v as canonicalize } from "./verify.js";
+import { a as ArticleSubject, i as ArticleClaims, n as ATTESTATION_PRIMARY_TYPE, o as AttestationMessage, r as ATTESTATION_TYPES_V1, s as NO_PRIOR_ATTESTATION, t as ATTESTATION_DOMAIN_V1 } from "./eip712-schema.js";
+//#region src/version.d.ts
+declare const SCHEMA_VERSION: 1;
+declare const CANONICAL_VERSION: 1;
+//#endregion
+//#region src/core/audit.d.ts
+/**
+ * Suspicious-character audit — runs at SIGN time, never at verify time.
+ *
+ * Verify must always remain a function of canonicalize() alone, never adding
+ * stricter rules. Audit is a separate, mutable layer of advice for the author:
+ * "you probably don't want these invisible chars in a published article".
+ */
+type AuditFinding = {
+  line: number;
+  column: number;
+  codepoint: number;
+  name: string;
+};
+declare function audit(canonical: Uint8Array): AuditFinding[];
+//#endregion
+export { ATTESTATION_DOMAIN_V1, ATTESTATION_PRIMARY_TYPE, ATTESTATION_TYPES_V1, type ArticleClaims, type ArticleSubject, type AttestationMessage, type AuditFinding, CANONICAL_VERSION, type CreateAttestationInput, InvalidContentError, NO_PRIOR_ATTESTATION, SCHEMA_VERSION, type SignedAttestation, type StoredAttestation, type VerifyError, type VerifyFail, type VerifyInput, type VerifyOk, type VerifyResult, audit, buildAttestationMessage, canonicalize, createAttestation, fromStored, parse, signAttestation, stringify, toStored, verifyAttestation };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,4 @@
+import { a as toStored, c as signAttestation, d as canonicalize, f as CANONICAL_VERSION, i as stringify, n as fromStored, o as buildAttestationMessage, p as SCHEMA_VERSION, r as parse, s as createAttestation, t as verifyAttestation, u as InvalidContentError } from "./verify.js";
+import { t as audit } from "./audit.js";
+import { i as NO_PRIOR_ATTESTATION, n as ATTESTATION_PRIMARY_TYPE, r as ATTESTATION_TYPES_V1, t as ATTESTATION_DOMAIN_V1 } from "./eip712-schema.js";
+export { ATTESTATION_DOMAIN_V1, ATTESTATION_PRIMARY_TYPE, ATTESTATION_TYPES_V1, CANONICAL_VERSION, InvalidContentError, NO_PRIOR_ATTESTATION, SCHEMA_VERSION, audit, buildAttestationMessage, canonicalize, createAttestation, fromStored, parse, signAttestation, stringify, toStored, verifyAttestation };

package/dist/node.cjs

@@ -0,0 +1,279 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_sign_flow = require("./sign-flow.cjs");
+const require_eip712_schema = require("./eip712-schema.cjs");
+let node_http = require("node:http");
+//#region src/eth/sign-batch-page-html.ts
+/**
+* HTML page served by the local CLI server during batch signing. Loads the
+* full list of EIP-712 typed-data messages, walks them sequentially, and POSTs
+* each signature back as MetaMask returns it. The server closes after the user
+* either signs the last entry or clicks "Done".
+*/
+function buildBatchSignPageHtml(entries) {
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<title>Sign all attestations</title>
+<style>
+    * { box-sizing: border-box; }
+    body { font-family: system-ui, sans-serif; max-width: 720px; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; color: #111; }
+    h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }
+    .lead { color: #666; margin: 0 0 2rem; }
+    .controls { display: flex; gap: 0.75rem; margin-bottom: 1.5rem; align-items: center; }
+    button { padding: 0.6rem 1rem; font-size: 0.95rem; cursor: pointer; border: 1px solid #ccc; background: #fff; border-radius: 6px; }
+    button.primary { background: #111; color: #fff; border-color: #111; }
+    button:disabled { opacity: 0.5; cursor: not-allowed; }
+    .progress { font-size: 0.85rem; color: #666; }
+    ul.entries { list-style: none; padding: 0; margin: 0; border-top: 1px solid #eee; }
+    ul.entries li { display: flex; align-items: center; gap: 0.75rem; padding: 0.6rem 0; border-bottom: 1px solid #eee; font-size: 0.9rem; }
+    .pill { font-family: ui-monospace, monospace; font-size: 0.7rem; text-transform: uppercase; letter-spacing: 0.06em; padding: 2px 8px; border-radius: 999px; border: 1px solid; }
+    .pill.idle { color: #999; border-color: #ddd; }
+    .pill.active { color: #0070f3; border-color: #c6dfff; background: #f0f7ff; }
+    .pill.signed { color: #0a7d22; border-color: #b8e6c1; background: #f0faf3; }
+    .pill.skipped { color: #b78403; border-color: #f1d57f; background: #fffaeb; }
+    .pill.error { color: #b00020; border-color: #f5b8c1; background: #fef0f2; }
+    .label { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+    .err-msg { font-size: 0.75rem; color: #b00020; padding: 0 0 0.5rem 0; }
+    pre.preview { max-height: 200px; overflow: auto; font-size: 0.8rem; background: #f7f7f7; padding: 0.75rem; border-radius: 6px; margin: 0 0 1.5rem; }
+</style>
+</head>
+<body>
+<h1>Sign attestations</h1>
+<p class="lead" id="lead"></p>
+<div class="controls">
+    <button class="primary" id="run">Sign all</button>
+    <button id="finish" disabled>Done</button>
+    <span class="progress" id="progress"></span>
+</div>
+<ul class="entries" id="entries"></ul>
+<script>
+    const ENTRIES = JSON.parse(\`${JSON.stringify(entries).replace(/\\/g, String.raw`\\`).replace(/`/g, "\\`").replace(/<\/script>/gi, String.raw`<\/script>`)}\`);
+    const ul = document.getElementById('entries');
+    const lead = document.getElementById('lead');
+    const progress = document.getElementById('progress');
+    const runBtn = document.getElementById('run');
+    const finishBtn = document.getElementById('finish');
+
+    lead.textContent = ENTRIES.length + ' article' + (ENTRIES.length === 1 ? '' : 's') + ' to sign. MetaMask will pop up once per article — review the typed data and confirm.';
+    progress.textContent = '0 / ' + ENTRIES.length;
+
+    const rows = ENTRIES.map((e, i) => {
+        const li = document.createElement('li');
+        const label = document.createElement('span');
+        label.className = 'label';
+        label.textContent = (i + 1) + '. ' + e.label;
+        const pill = document.createElement('span');
+        pill.className = 'pill idle';
+        pill.textContent = 'idle';
+        li.appendChild(pill);
+        li.appendChild(label);
+        ul.appendChild(li);
+        return { pill, li };
+    });
+
+    let signed = 0;
+
+    async function signOne(i) {
+        const entry = ENTRIES[i];
+        rows[i].pill.className = 'pill active';
+        rows[i].pill.textContent = 'signing';
+
+        if (!window.ethereum) throw new Error('No window.ethereum provider');
+
+        const accounts = await window.ethereum.request({ method: 'eth_requestAccounts' });
+        const signer = accounts[0];
+
+        let signature;
+        try {
+            signature = await window.ethereum.request({
+                method: 'eth_signTypedData_v4',
+                params: [signer, JSON.stringify(entry.typedData)],
+            });
+        } catch (err) {
+            const msg = err && err.message ? err.message : String(err);
+            rows[i].pill.className = 'pill error';
+            rows[i].pill.textContent = 'rejected';
+            const errLi = document.createElement('div');
+            errLi.className = 'err-msg';
+            errLi.textContent = msg;
+            rows[i].li.appendChild(errLi);
+            await fetch('/skip', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ id: entry.id, reason: msg }),
+            });
+            return false;
+        }
+
+        const res = await fetch('/sig', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ id: entry.id, signature, signerAddress: signer }),
+        });
+        if (!res.ok) {
+            rows[i].pill.className = 'pill error';
+            rows[i].pill.textContent = 'server-rejected';
+            return false;
+        }
+        rows[i].pill.className = 'pill signed';
+        rows[i].pill.textContent = 'signed';
+        signed++;
+        progress.textContent = signed + ' / ' + ENTRIES.length;
+        return true;
+    }
+
+    runBtn.addEventListener('click', async () => {
+        runBtn.disabled = true;
+        for (let i = 0; i < ENTRIES.length; i++) {
+            try { await signOne(i); } catch (err) {
+                console.error(err);
+                rows[i].pill.className = 'pill error';
+                rows[i].pill.textContent = 'error';
+            }
+        }
+        finishBtn.disabled = false;
+        finishBtn.classList.add('primary');
+    });
+
+    finishBtn.addEventListener('click', async () => {
+        finishBtn.disabled = true;
+        await fetch('/done', { method: 'POST' });
+        document.body.innerHTML = '<h1>Done.</h1><p>You can close this tab.</p>';
+    });
+<\/script>
+</body>
+</html>`;
+}
+//#endregion
+//#region src/eth/sign-batch-flow.ts
+const DEFAULT_TIMEOUT_MS = 1800 * 1e3;
+async function signBatchViaBrowser(opts) {
+	const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const html = buildBatchSignPageHtml(opts.entries.map((e) => ({
+		id: e.id,
+		label: e.label,
+		typedData: {
+			domain: require_eip712_schema.ATTESTATION_DOMAIN_V1,
+			message: serializeMessageForBrowser(e.message),
+			primaryType: require_eip712_schema.ATTESTATION_PRIMARY_TYPE,
+			types: {
+				EIP712Domain: domainTypes(),
+				...require_eip712_schema.ATTESTATION_TYPES_V1
+			}
+		}
+	})));
+	const signatures = /* @__PURE__ */ new Map();
+	const skipped = /* @__PURE__ */ new Map();
+	return new Promise((resolve, reject) => {
+		const server = (0, node_http.createServer)((req, res) => {
+			if (req.method === "GET" && (req.url === "/" || req.url === "/index.html")) {
+				res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+				res.end(html);
+				return;
+			}
+			if (req.method === "POST" && (req.url === "/sig" || req.url === "/skip")) {
+				let body = "";
+				req.on("data", (chunk) => {
+					body += chunk.toString("utf8");
+				});
+				req.on("end", () => {
+					let parsed;
+					try {
+						parsed = JSON.parse(body);
+					} catch {
+						res.writeHead(400);
+						res.end("Parse error");
+						return;
+					}
+					if (req.url === "/sig") {
+						if (typeof parsed.signature !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(parsed.signature) || typeof parsed.signerAddress !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(parsed.signerAddress)) {
+							res.writeHead(400);
+							res.end("Invalid payload");
+							return;
+						}
+						signatures.set(parsed.id, {
+							signature: parsed.signature,
+							signerAddress: parsed.signerAddress
+						});
+					} else skipped.set(parsed.id, parsed.reason ?? "skipped");
+					res.writeHead(200, { "content-type": "text/plain" });
+					res.end("OK");
+				});
+				return;
+			}
+			if (req.method === "POST" && req.url === "/done") {
+				res.writeHead(200, { "content-type": "text/plain" });
+				res.end("OK");
+				res.on("finish", () => {
+					clearTimeout(timer);
+					server.close();
+					resolve({
+						signatures,
+						skipped
+					});
+				});
+				return;
+			}
+			res.writeHead(404);
+			res.end("Not found");
+		});
+		const timer = setTimeout(() => {
+			server.close();
+			reject(/* @__PURE__ */ new Error(`Batch sign flow timed out after ${timeoutMs}ms`));
+		}, timeoutMs);
+		server.on("error", (err) => {
+			clearTimeout(timer);
+			reject(err);
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const url = `http://127.0.0.1:${server.address().port}/`;
+			const ready = opts.onUrlReady ?? defaultOpenInBrowser;
+			Promise.resolve(ready(url)).catch((error) => {
+				clearTimeout(timer);
+				server.close();
+				reject(error);
+			});
+		});
+	});
+}
+async function defaultOpenInBrowser(url) {
+	const { default: open } = await import("open");
+	await open(url);
+}
+function serializeMessageForBrowser(message) {
+	return {
+		claims: {
+			priorAttestation: message.claims.priorAttestation,
+			publishedAt: message.claims.publishedAt.toString(),
+			revision: message.claims.revision,
+			slug: message.claims.slug
+		},
+		schemaVersion: message.schemaVersion,
+		subject: message.subject
+	};
+}
+function domainTypes() {
+	return [
+		{
+			name: "name",
+			type: "string"
+		},
+		{
+			name: "version",
+			type: "string"
+		},
+		{
+			name: "chainId",
+			type: "uint256"
+		}
+	];
+}
+//#endregion
+exports.signBatchViaBrowser = signBatchViaBrowser;
+exports.signViaBrowser = require_sign_flow.signViaBrowser;
+exports.stampDigest = require_sign_flow.stampDigest;
+exports.upgradeProof = require_sign_flow.upgradeProof;
+exports.verifyOts = require_sign_flow.verifyOts;
+
+//# sourceMappingURL=node.cjs.map

package/dist/node.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.cjs","names":["ATTESTATION_DOMAIN_V1","ATTESTATION_PRIMARY_TYPE","ATTESTATION_TYPES_V1"],"sources":["../src/eth/sign-batch-page-html.ts","../src/eth/sign-batch-flow.ts"],"sourcesContent":["/**\n * HTML page served by the local CLI server during batch signing. Loads the\n * full list of EIP-712 typed-data messages, walks them sequentially, and POSTs\n * each signature back as MetaMask returns it. The server closes after the user\n * either signs the last entry or clicks \"Done\".\n */\nexport function buildBatchSignPageHtml(\n    entries: Array<{ id: string; label: string; typedData: object }>,\n): string {\n    const escaped = JSON.stringify(entries)\n        .replace(/\\\\/g, String.raw`\\\\`)\n        .replace(/`/g, '\\\\`')\n        .replace(/<\\/script>/gi, String.raw`<\\/script>`);\n\n    return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\" />\n<title>Sign all attestations</title>\n<style>\n    * { box-sizing: border-box; }\n    body { font-family: system-ui, sans-serif; max-width: 720px; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; color: #111; }\n    h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }\n    .lead { color: #666; margin: 0 0 2rem; }\n    .controls { display: flex; gap: 0.75rem; margin-bottom: 1.5rem; align-items: center; }\n    button { padding: 0.6rem 1rem; font-size: 0.95rem; cursor: pointer; border: 1px solid #ccc; background: #fff; border-radius: 6px; }\n    button.primary { background: #111; color: #fff; border-color: #111; }\n    button:disabled { opacity: 0.5; cursor: not-allowed; }\n    .progress { font-size: 0.85rem; color: #666; }\n    ul.entries { list-style: none; padding: 0; margin: 0; border-top: 1px solid #eee; }\n    ul.entries li { display: flex; align-items: center; gap: 0.75rem; padding: 0.6rem 0; border-bottom: 1px solid #eee; font-size: 0.9rem; }\n    .pill { font-family: ui-monospace, monospace; font-size: 0.7rem; text-transform: uppercase; letter-spacing: 0.06em; padding: 2px 8px; border-radius: 999px; border: 1px solid; }\n    .pill.idle { color: #999; border-color: #ddd; }\n    .pill.active { color: #0070f3; border-color: #c6dfff; background: #f0f7ff; }\n    .pill.signed { color: #0a7d22; border-color: #b8e6c1; background: #f0faf3; }\n    .pill.skipped { color: #b78403; border-color: #f1d57f; background: #fffaeb; }\n    .pill.error { color: #b00020; border-color: #f5b8c1; background: #fef0f2; }\n    .label { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\n    .err-msg { font-size: 0.75rem; color: #b00020; padding: 0 0 0.5rem 0; }\n    pre.preview { max-height: 200px; overflow: auto; font-size: 0.8rem; background: #f7f7f7; padding: 0.75rem; border-radius: 6px; margin: 0 0 1.5rem; }\n</style>\n</head>\n<body>\n<h1>Sign attestations</h1>\n<p class=\"lead\" id=\"lead\"></p>\n<div class=\"controls\">\n    <button class=\"primary\" id=\"run\">Sign all</button>\n    <button id=\"finish\" disabled>Done</button>\n    <span class=\"progress\" id=\"progress\"></span>\n</div>\n<ul class=\"entries\" id=\"entries\"></ul>\n<script>\n    const ENTRIES = JSON.parse(\\`${escaped}\\`);\n    const ul = document.getElementById('entries');\n    const lead = document.getElementById('lead');\n    const progress = document.getElementById('progress');\n    const runBtn = document.getElementById('run');\n    const finishBtn = document.getElementById('finish');\n\n    lead.textContent = ENTRIES.length + ' article' + (ENTRIES.length === 1 ? '' : 's') + ' to sign. MetaMask will pop up once per article — review the typed data and confirm.';\n    progress.textContent = '0 / ' + ENTRIES.length;\n\n    const rows = ENTRIES.map((e, i) => {\n        const li = document.createElement('li');\n        const label = document.createElement('span');\n        label.className = 'label';\n        label.textContent = (i + 1) + '. ' + e.label;\n        const pill = document.createElement('span');\n        pill.className = 'pill idle';\n        pill.textContent = 'idle';\n        li.appendChild(pill);\n        li.appendChild(label);\n        ul.appendChild(li);\n        return { pill, li };\n    });\n\n    let signed = 0;\n\n    async function signOne(i) {\n        const entry = ENTRIES[i];\n        rows[i].pill.className = 'pill active';\n        rows[i].pill.textContent = 'signing';\n\n        if (!window.ethereum) throw new Error('No window.ethereum provider');\n\n        const accounts = await window.ethereum.request({ method: 'eth_requestAccounts' });\n        const signer = accounts[0];\n\n        let signature;\n        try {\n            signature = await window.ethereum.request({\n                method: 'eth_signTypedData_v4',\n                params: [signer, JSON.stringify(entry.typedData)],\n            });\n        } catch (err) {\n            const msg = err && err.message ? err.message : String(err);\n            rows[i].pill.className = 'pill error';\n            rows[i].pill.textContent = 'rejected';\n            const errLi = document.createElement('div');\n            errLi.className = 'err-msg';\n            errLi.textContent = msg;\n            rows[i].li.appendChild(errLi);\n            await fetch('/skip', {\n                method: 'POST',\n                headers: { 'content-type': 'application/json' },\n                body: JSON.stringify({ id: entry.id, reason: msg }),\n            });\n            return false;\n        }\n\n        const res = await fetch('/sig', {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ id: entry.id, signature, signerAddress: signer }),\n        });\n        if (!res.ok) {\n            rows[i].pill.className = 'pill error';\n            rows[i].pill.textContent = 'server-rejected';\n            return false;\n        }\n        rows[i].pill.className = 'pill signed';\n        rows[i].pill.textContent = 'signed';\n        signed++;\n        progress.textContent = signed + ' / ' + ENTRIES.length;\n        return true;\n    }\n\n    runBtn.addEventListener('click', async () => {\n        runBtn.disabled = true;\n        for (let i = 0; i < ENTRIES.length; i++) {\n            try { await signOne(i); } catch (err) {\n                console.error(err);\n                rows[i].pill.className = 'pill error';\n                rows[i].pill.textContent = 'error';\n            }\n        }\n        finishBtn.disabled = false;\n        finishBtn.classList.add('primary');\n    });\n\n    finishBtn.addEventListener('click', async () => {\n        finishBtn.disabled = true;\n        await fetch('/done', { method: 'POST' });\n        document.body.innerHTML = '<h1>Done.</h1><p>You can close this tab.</p>';\n    });\n</script>\n</body>\n</html>`;\n}\n","import { createServer } from 'node:http';\nimport { type AddressInfo } from 'node:net';\n\nimport {\n    ATTESTATION_DOMAIN_V1,\n    ATTESTATION_PRIMARY_TYPE,\n    ATTESTATION_TYPES_V1,\n    type AttestationMessage,\n} from '../core/eip712-schema.js';\nimport { buildBatchSignPageHtml } from './sign-batch-page-html.js';\n\nexport type BatchSignEntry = {\n    /** Unique key — used to correlate signatures back to entries. */\n    id: string;\n    /** Human-readable label shown in the browser UI. */\n    label: string;\n    /** EIP-712 message to sign. */\n    message: AttestationMessage;\n};\n\nexport type BatchSignFlowOptions = {\n    entries: BatchSignEntry[];\n    onUrlReady?: (url: string) => Promise<void> | void;\n    /** Total session timeout. Default 30 minutes. */\n    timeoutMs?: number;\n};\n\nexport type BatchSignature = {\n    signature: `0x${string}`;\n    signerAddress: `0x${string}`;\n};\n\nexport type BatchSignFlowResult = {\n    signatures: Map<string, BatchSignature>;\n    /** Entries the user explicitly skipped or that failed (rejected wallet, etc.). */\n    skipped: Map<string, string>;\n};\n\nconst DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;\n\nexport async function signBatchViaBrowser(\n    opts: BatchSignFlowOptions,\n): Promise<BatchSignFlowResult> {\n    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n    const wireEntries = opts.entries.map((e) => ({\n        id: e.id,\n        label: e.label,\n        typedData: {\n            domain: ATTESTATION_DOMAIN_V1,\n            message: serializeMessageForBrowser(e.message),\n            primaryType: ATTESTATION_PRIMARY_TYPE,\n            types: { EIP712Domain: domainTypes(), ...ATTESTATION_TYPES_V1 },\n        },\n    }));\n    const html = buildBatchSignPageHtml(wireEntries);\n\n    const signatures = new Map<string, BatchSignature>();\n    const skipped = new Map<string, string>();\n\n    return new Promise<BatchSignFlowResult>((resolve, reject) => {\n        const server = createServer((req, res) => {\n            if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) {\n                res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n                res.end(html);\n                return;\n            }\n\n            if (req.method === 'POST' && (req.url === '/sig' || req.url === '/skip')) {\n                let body = '';\n                req.on('data', (chunk: Buffer) => {\n                    body += chunk.toString('utf8');\n                });\n                req.on('end', () => {\n                    let parsed: {\n                        id: string;\n                        signature?: `0x${string}`;\n                        signerAddress?: `0x${string}`;\n                        reason?: string;\n                    };\n                    try {\n                        parsed = JSON.parse(body) as typeof parsed;\n                    } catch {\n                        res.writeHead(400);\n                        res.end('Parse error');\n                        return;\n                    }\n                    if (req.url === '/sig') {\n                        if (\n                            typeof parsed.signature !== 'string' ||\n                            !/^0x[0-9a-fA-F]{130}$/.test(parsed.signature) ||\n                            typeof parsed.signerAddress !== 'string' ||\n                            !/^0x[0-9a-fA-F]{40}$/.test(parsed.signerAddress)\n                        ) {\n                            res.writeHead(400);\n                            res.end('Invalid payload');\n                            return;\n                        }\n                        signatures.set(parsed.id, {\n                            signature: parsed.signature,\n                            signerAddress: parsed.signerAddress,\n                        });\n                    } else {\n                        skipped.set(parsed.id, parsed.reason ?? 'skipped');\n                    }\n                    res.writeHead(200, { 'content-type': 'text/plain' });\n                    res.end('OK');\n                });\n                return;\n            }\n\n            if (req.method === 'POST' && req.url === '/done') {\n                res.writeHead(200, { 'content-type': 'text/plain' });\n                res.end('OK');\n                res.on('finish', () => {\n                    clearTimeout(timer);\n                    server.close();\n                    resolve({ signatures, skipped });\n                });\n                return;\n            }\n\n            res.writeHead(404);\n            res.end('Not found');\n        });\n\n        const timer = setTimeout(() => {\n            server.close();\n            reject(new Error(`Batch sign flow timed out after ${timeoutMs}ms`));\n        }, timeoutMs);\n\n        server.on('error', (err) => {\n            clearTimeout(timer);\n            reject(err);\n        });\n\n        server.listen(0, '127.0.0.1', () => {\n            const addr = server.address() as AddressInfo;\n            const url = `http://127.0.0.1:${addr.port}/`;\n            const ready = opts.onUrlReady ?? defaultOpenInBrowser;\n            void Promise.resolve(ready(url)).catch((error: unknown) => {\n                clearTimeout(timer);\n                server.close();\n                reject(error);\n            });\n        });\n    });\n}\n\nasync function defaultOpenInBrowser(url: string): Promise<void> {\n    const { default: open } = await import('open');\n    await open(url);\n}\n\nfunction serializeMessageForBrowser(message: AttestationMessage): Record<string, unknown> {\n    return {\n        claims: {\n            priorAttestation: message.claims.priorAttestation,\n            publishedAt: message.claims.publishedAt.toString(),\n            revision: message.claims.revision,\n            slug: message.claims.slug,\n        },\n        schemaVersion: message.schemaVersion,\n        subject: message.subject,\n    };\n}\n\nfunction domainTypes(): Array<{ name: string; type: string }> {\n    return [\n        { name: 'name', type: 'string' },\n        { name: 'version', type: 'string' },\n        { name: 'chainId', type: 'uint256' },\n    ];\n}\n"],"mappings":";;;;;;;;;;;AAMA,SAAgB,uBACZ,SACM;CAMN,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCALS,KAAK,UAAU,OAAO,CAAC,CAClC,QAAQ,OAAO,OAAO,GAAG,IAAI,CAAC,CAC9B,QAAQ,MAAM,KAAK,CAAC,CACpB,QAAQ,gBAAgB,OAAO,GAAG,YAwCF,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgG3C;;;AC9GA,MAAM,qBAAqB,OAAU;AAErC,eAAsB,oBAClB,MAC4B;CAC5B,MAAM,YAAY,KAAK,aAAa;CAYpC,MAAM,OAAO,uBAVO,KAAK,QAAQ,KAAK,OAAO;EACzC,IAAI,EAAE;EACN,OAAO,EAAE;EACT,WAAW;GACP,QAAQA,sBAAAA;GACR,SAAS,2BAA2B,EAAE,OAAO;GAC7C,aAAaC,sBAAAA;GACb,OAAO;IAAE,cAAc,YAAY;IAAG,GAAGC,sBAAAA;GAAqB;EAClE;CACJ,EAC8C,CAAC;CAE/C,MAAM,6BAAa,IAAI,IAA4B;CACnD,MAAM,0BAAU,IAAI,IAAoB;CAExC,OAAO,IAAI,SAA8B,SAAS,WAAW;EACzD,MAAM,UAAA,GAAA,UAAA,aAAA,EAAuB,KAAK,QAAQ;GACtC,IAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,OAAO,IAAI,QAAQ,gBAAgB;IACxE,IAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;IACjE,IAAI,IAAI,IAAI;IACZ;GACJ;GAEA,IAAI,IAAI,WAAW,WAAW,IAAI,QAAQ,UAAU,IAAI,QAAQ,UAAU;IACtE,IAAI,OAAO;IACX,IAAI,GAAG,SAAS,UAAkB;KAC9B,QAAQ,MAAM,SAAS,MAAM;IACjC,CAAC;IACD,IAAI,GAAG,aAAa;KAChB,IAAI;KAMJ,IAAI;MACA,SAAS,KAAK,MAAM,IAAI;KAC5B,QAAQ;MACJ,IAAI,UAAU,GAAG;MACjB,IAAI,IAAI,aAAa;MACrB;KACJ;KACA,IAAI,IAAI,QAAQ,QAAQ;MACpB,IACI,OAAO,OAAO,cAAc,YAC5B,CAAC,uBAAuB,KAAK,OAAO,SAAS,KAC7C,OAAO,OAAO,kBAAkB,YAChC,CAAC,sBAAsB,KAAK,OAAO,aAAa,GAClD;OACE,IAAI,UAAU,GAAG;OACjB,IAAI,IAAI,iBAAiB;OACzB;MACJ;MACA,WAAW,IAAI,OAAO,IAAI;OACtB,WAAW,OAAO;OAClB,eAAe,OAAO;MAC1B,CAAC;KACL,OACI,QAAQ,IAAI,OAAO,IAAI,OAAO,UAAU,SAAS;KAErD,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;KACnD,IAAI,IAAI,IAAI;IAChB,CAAC;IACD;GACJ;GAEA,IAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,SAAS;IAC9C,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;IACnD,IAAI,IAAI,IAAI;IACZ,IAAI,GAAG,gBAAgB;KACnB,aAAa,KAAK;KAClB,OAAO,MAAM;KACb,QAAQ;MAAE;MAAY;KAAQ,CAAC;IACnC,CAAC;IACD;GACJ;GAEA,IAAI,UAAU,GAAG;GACjB,IAAI,IAAI,WAAW;EACvB,CAAC;EAED,MAAM,QAAQ,iBAAiB;GAC3B,OAAO,MAAM;GACb,uBAAO,IAAI,MAAM,mCAAmC,UAAU,GAAG,CAAC;EACtE,GAAG,SAAS;EAEZ,OAAO,GAAG,UAAU,QAAQ;GACxB,aAAa,KAAK;GAClB,OAAO,GAAG;EACd,CAAC;EAED,OAAO,OAAO,GAAG,mBAAmB;GAEhC,MAAM,MAAM,oBADC,OAAO,QACe,CAAC,CAAC,KAAK;GAC1C,MAAM,QAAQ,KAAK,cAAc;GACjC,QAAa,QAAQ,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,UAAmB;IACvD,aAAa,KAAK;IAClB,OAAO,MAAM;IACb,OAAO,KAAK;GAChB,CAAC;EACL,CAAC;CACL,CAAC;AACL;AAEA,eAAe,qBAAqB,KAA4B;CAC5D,MAAM,EAAE,SAAS,SAAS,MAAM,OAAO;CACvC,MAAM,KAAK,GAAG;AAClB;AAEA,SAAS,2BAA2B,SAAsD;CACtF,OAAO;EACH,QAAQ;GACJ,kBAAkB,QAAQ,OAAO;GACjC,aAAa,QAAQ,OAAO,YAAY,SAAS;GACjD,UAAU,QAAQ,OAAO;GACzB,MAAM,QAAQ,OAAO;EACzB;EACA,eAAe,QAAQ;EACvB,SAAS,QAAQ;CACrB;AACJ;AAEA,SAAS,cAAqD;CAC1D,OAAO;EACH;GAAE,MAAM;GAAQ,MAAM;EAAS;EAC/B;GAAE,MAAM;GAAW,MAAM;EAAS;EAClC;GAAE,MAAM;GAAW,MAAM;EAAU;CACvC;AACJ"}

package/dist/node.d.cts

@@ -0,0 +1,87 @@
+import { o as AttestationMessage } from "./eip712-schema.cjs";
+//#region src/ots/stamp.d.ts
+/**
+ * Submit a SHA-256 digest to OpenTimestamps calendars and return the proof bytes.
+ *
+ * The returned proof initially contains only calendar attestations. Run upgrade()
+ * after ~24h to anchor it in a Bitcoin block.
+ */
+declare function stampDigest(digest: Uint8Array): Promise<Uint8Array>;
+/**
+ * Try to upgrade a calendar-only proof to a Bitcoin-anchored proof.
+ *
+ * Returns the (possibly upgraded) proof bytes plus a flag indicating whether
+ * the upgrade actually attached a Bitcoin attestation this time.
+ */
+declare function upgradeProof(otsBytes: Uint8Array): Promise<{
+  bytes: Uint8Array;
+  upgraded: boolean;
+}>;
+//#endregion
+//#region src/ots/verify.d.ts
+type OtsVerifyOk = {
+  ok: true;
+  bitcoinBlockTime: Date;
+};
+type OtsVerifyFail = {
+  ok: false;
+  reason: 'digest-mismatch' | 'invalid-proof' | 'pending-bitcoin';
+  details?: string;
+};
+type OtsVerifyResult = OtsVerifyFail | OtsVerifyOk;
+/**
+ * Verify an OTS proof attests the given digest, and return the Bitcoin block
+ * attestation time if present.
+ *
+ * Network: this calls a public Bitcoin block-info source via the OTS library
+ * to validate the Merkle path. In production-paranoid mode you should run your
+ * own Bitcoin node and pass it explicitly (future enhancement).
+ */
+declare function verifyOts(digest: Uint8Array, otsBytes: Uint8Array): Promise<OtsVerifyResult>;
+//#endregion
+//#region src/eth/sign-flow.d.ts
+type SignFlowOptions = {
+  message: AttestationMessage;
+  onUrlReady?: (url: string) => Promise<void> | void;
+  timeoutMs?: number;
+};
+type SignFlowResult = {
+  signature: `0x${string}`;
+  signerAddress: `0x${string}`;
+};
+/**
+ * Spin up a one-shot localhost HTTP server, open the browser, wait for the user
+ * to sign with their wallet, return the signature.
+ *
+ * The local server only accepts loopback requests (127.0.0.1).
+ */
+declare function signViaBrowser(opts: SignFlowOptions): Promise<SignFlowResult>;
+//#endregion
+//#region src/eth/sign-batch-flow.d.ts
+type BatchSignEntry = {
+  /** Unique key — used to correlate signatures back to entries. */
+  id: string;
+  /** Human-readable label shown in the browser UI. */
+  label: string;
+  /** EIP-712 message to sign. */
+  message: AttestationMessage;
+};
+type BatchSignFlowOptions = {
+  entries: BatchSignEntry[];
+  onUrlReady?: (url: string) => Promise<void> | void;
+  /** Total session timeout. Default 30 minutes. */
+  timeoutMs?: number;
+};
+type BatchSignature = {
+  signature: `0x${string}`;
+  signerAddress: `0x${string}`;
+};
+type BatchSignFlowResult = {
+  signatures: Map<string, BatchSignature>;
+  /** Entries the user explicitly skipped or that failed (rejected wallet, etc.). */
+  skipped: Map<string, string>;
+};
+declare function signBatchViaBrowser(opts: BatchSignFlowOptions): Promise<BatchSignFlowResult>;
+//#endregion
+export { type BatchSignEntry, type BatchSignFlowOptions, type BatchSignFlowResult, type BatchSignature, type OtsVerifyFail, type OtsVerifyOk, type OtsVerifyResult, type SignFlowOptions, type SignFlowResult, signBatchViaBrowser, signViaBrowser, stampDigest, upgradeProof, verifyOts };
+//# sourceMappingURL=node.d.cts.map

package/dist/node.d.ts

@@ -0,0 +1,87 @@
+import { o as AttestationMessage } from "./eip712-schema.js";
+//#region src/ots/stamp.d.ts
+/**
+ * Submit a SHA-256 digest to OpenTimestamps calendars and return the proof bytes.
+ *
+ * The returned proof initially contains only calendar attestations. Run upgrade()
+ * after ~24h to anchor it in a Bitcoin block.
+ */
+declare function stampDigest(digest: Uint8Array): Promise<Uint8Array>;
+/**
+ * Try to upgrade a calendar-only proof to a Bitcoin-anchored proof.
+ *
+ * Returns the (possibly upgraded) proof bytes plus a flag indicating whether
+ * the upgrade actually attached a Bitcoin attestation this time.
+ */
+declare function upgradeProof(otsBytes: Uint8Array): Promise<{
+  bytes: Uint8Array;
+  upgraded: boolean;
+}>;
+//#endregion
+//#region src/ots/verify.d.ts
+type OtsVerifyOk = {
+  ok: true;
+  bitcoinBlockTime: Date;
+};
+type OtsVerifyFail = {
+  ok: false;
+  reason: 'digest-mismatch' | 'invalid-proof' | 'pending-bitcoin';
+  details?: string;
+};
+type OtsVerifyResult = OtsVerifyFail | OtsVerifyOk;
+/**
+ * Verify an OTS proof attests the given digest, and return the Bitcoin block
+ * attestation time if present.
+ *
+ * Network: this calls a public Bitcoin block-info source via the OTS library
+ * to validate the Merkle path. In production-paranoid mode you should run your
+ * own Bitcoin node and pass it explicitly (future enhancement).
+ */
+declare function verifyOts(digest: Uint8Array, otsBytes: Uint8Array): Promise<OtsVerifyResult>;
+//#endregion
+//#region src/eth/sign-flow.d.ts
+type SignFlowOptions = {
+  message: AttestationMessage;
+  onUrlReady?: (url: string) => Promise<void> | void;
+  timeoutMs?: number;
+};
+type SignFlowResult = {
+  signature: `0x${string}`;
+  signerAddress: `0x${string}`;
+};
+/**
+ * Spin up a one-shot localhost HTTP server, open the browser, wait for the user
+ * to sign with their wallet, return the signature.
+ *
+ * The local server only accepts loopback requests (127.0.0.1).
+ */
+declare function signViaBrowser(opts: SignFlowOptions): Promise<SignFlowResult>;
+//#endregion
+//#region src/eth/sign-batch-flow.d.ts
+type BatchSignEntry = {
+  /** Unique key — used to correlate signatures back to entries. */
+  id: string;
+  /** Human-readable label shown in the browser UI. */
+  label: string;
+  /** EIP-712 message to sign. */
+  message: AttestationMessage;
+};
+type BatchSignFlowOptions = {
+  entries: BatchSignEntry[];
+  onUrlReady?: (url: string) => Promise<void> | void;
+  /** Total session timeout. Default 30 minutes. */
+  timeoutMs?: number;
+};
+type BatchSignature = {
+  signature: `0x${string}`;
+  signerAddress: `0x${string}`;
+};
+type BatchSignFlowResult = {
+  signatures: Map<string, BatchSignature>;
+  /** Entries the user explicitly skipped or that failed (rejected wallet, etc.). */
+  skipped: Map<string, string>;
+};
+declare function signBatchViaBrowser(opts: BatchSignFlowOptions): Promise<BatchSignFlowResult>;
+//#endregion
+export { type BatchSignEntry, type BatchSignFlowOptions, type BatchSignFlowResult, type BatchSignature, type OtsVerifyFail, type OtsVerifyOk, type OtsVerifyResult, type SignFlowOptions, type SignFlowResult, signBatchViaBrowser, signViaBrowser, stampDigest, upgradeProof, verifyOts };
+//# sourceMappingURL=node.d.ts.map