@jterrazz/attestation 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (45) hide show
  1. package/README.md +27 -0
  2. package/bin/attestation +2 -0
  3. package/dist/audit.cjs +57 -0
  4. package/dist/audit.cjs.map +1 -0
  5. package/dist/audit.js +52 -0
  6. package/dist/audit.js.map +1 -0
  7. package/dist/browser.cjs +183 -0
  8. package/dist/browser.cjs.map +1 -0
  9. package/dist/browser.d.cts +111 -0
  10. package/dist/browser.d.ts +111 -0
  11. package/dist/browser.js +168 -0
  12. package/dist/browser.js.map +1 -0
  13. package/dist/cli.cjs +284 -0
  14. package/dist/cli.cjs.map +1 -0
  15. package/dist/cli.d.cts +1 -0
  16. package/dist/cli.d.ts +1 -0
  17. package/dist/cli.js +285 -0
  18. package/dist/cli.js.map +1 -0
  19. package/dist/eip712-schema.cjs +96 -0
  20. package/dist/eip712-schema.cjs.map +1 -0
  21. package/dist/eip712-schema.d.cts +75 -0
  22. package/dist/eip712-schema.d.ts +75 -0
  23. package/dist/eip712-schema.js +73 -0
  24. package/dist/eip712-schema.js.map +1 -0
  25. package/dist/index.cjs +21 -0
  26. package/dist/index.d.cts +24 -0
  27. package/dist/index.d.ts +24 -0
  28. package/dist/index.js +4 -0
  29. package/dist/node.cjs +279 -0
  30. package/dist/node.cjs.map +1 -0
  31. package/dist/node.d.cts +87 -0
  32. package/dist/node.d.ts +87 -0
  33. package/dist/node.js +274 -0
  34. package/dist/node.js.map +1 -0
  35. package/dist/sign-flow.cjs +323 -0
  36. package/dist/sign-flow.cjs.map +1 -0
  37. package/dist/sign-flow.js +277 -0
  38. package/dist/sign-flow.js.map +1 -0
  39. package/dist/verify.cjs +276 -0
  40. package/dist/verify.cjs.map +1 -0
  41. package/dist/verify.d.cts +105 -0
  42. package/dist/verify.d.ts +105 -0
  43. package/dist/verify.js +199 -0
  44. package/dist/verify.js.map +1 -0
  45. package/package.json +67 -0
package/dist/node.js ADDED
@@ -0,0 +1,274 @@
1
+ import { n as ATTESTATION_PRIMARY_TYPE, r as ATTESTATION_TYPES_V1, t as ATTESTATION_DOMAIN_V1 } from "./eip712-schema.js";
2
+ import { i as upgradeProof, n as verifyOts, r as stampDigest, t as signViaBrowser } from "./sign-flow.js";
3
+ import { createServer } from "node:http";
4
+ //#region src/eth/sign-batch-page-html.ts
5
+ /**
6
+ * HTML page served by the local CLI server during batch signing. Loads the
7
+ * full list of EIP-712 typed-data messages, walks them sequentially, and POSTs
8
+ * each signature back as MetaMask returns it. The server closes after the user
9
+ * either signs the last entry or clicks "Done".
10
+ */
11
+ function buildBatchSignPageHtml(entries) {
12
+ return `<!doctype html>
13
+ <html lang="en">
14
+ <head>
15
+ <meta charset="utf-8" />
16
+ <title>Sign all attestations</title>
17
+ <style>
18
+ * { box-sizing: border-box; }
19
+ body { font-family: system-ui, sans-serif; max-width: 720px; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; color: #111; }
20
+ h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }
21
+ .lead { color: #666; margin: 0 0 2rem; }
22
+ .controls { display: flex; gap: 0.75rem; margin-bottom: 1.5rem; align-items: center; }
23
+ button { padding: 0.6rem 1rem; font-size: 0.95rem; cursor: pointer; border: 1px solid #ccc; background: #fff; border-radius: 6px; }
24
+ button.primary { background: #111; color: #fff; border-color: #111; }
25
+ button:disabled { opacity: 0.5; cursor: not-allowed; }
26
+ .progress { font-size: 0.85rem; color: #666; }
27
+ ul.entries { list-style: none; padding: 0; margin: 0; border-top: 1px solid #eee; }
28
+ ul.entries li { display: flex; align-items: center; gap: 0.75rem; padding: 0.6rem 0; border-bottom: 1px solid #eee; font-size: 0.9rem; }
29
+ .pill { font-family: ui-monospace, monospace; font-size: 0.7rem; text-transform: uppercase; letter-spacing: 0.06em; padding: 2px 8px; border-radius: 999px; border: 1px solid; }
30
+ .pill.idle { color: #999; border-color: #ddd; }
31
+ .pill.active { color: #0070f3; border-color: #c6dfff; background: #f0f7ff; }
32
+ .pill.signed { color: #0a7d22; border-color: #b8e6c1; background: #f0faf3; }
33
+ .pill.skipped { color: #b78403; border-color: #f1d57f; background: #fffaeb; }
34
+ .pill.error { color: #b00020; border-color: #f5b8c1; background: #fef0f2; }
35
+ .label { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
36
+ .err-msg { font-size: 0.75rem; color: #b00020; padding: 0 0 0.5rem 0; }
37
+ pre.preview { max-height: 200px; overflow: auto; font-size: 0.8rem; background: #f7f7f7; padding: 0.75rem; border-radius: 6px; margin: 0 0 1.5rem; }
38
+ </style>
39
+ </head>
40
+ <body>
41
+ <h1>Sign attestations</h1>
42
+ <p class="lead" id="lead"></p>
43
+ <div class="controls">
44
+ <button class="primary" id="run">Sign all</button>
45
+ <button id="finish" disabled>Done</button>
46
+ <span class="progress" id="progress"></span>
47
+ </div>
48
+ <ul class="entries" id="entries"></ul>
49
+ <script>
50
+ const ENTRIES = JSON.parse(\`${JSON.stringify(entries).replace(/\\/g, String.raw`\\`).replace(/`/g, "\\`").replace(/<\/script>/gi, String.raw`<\/script>`)}\`);
51
+ const ul = document.getElementById('entries');
52
+ const lead = document.getElementById('lead');
53
+ const progress = document.getElementById('progress');
54
+ const runBtn = document.getElementById('run');
55
+ const finishBtn = document.getElementById('finish');
56
+
57
+ lead.textContent = ENTRIES.length + ' article' + (ENTRIES.length === 1 ? '' : 's') + ' to sign. MetaMask will pop up once per article — review the typed data and confirm.';
58
+ progress.textContent = '0 / ' + ENTRIES.length;
59
+
60
+ const rows = ENTRIES.map((e, i) => {
61
+ const li = document.createElement('li');
62
+ const label = document.createElement('span');
63
+ label.className = 'label';
64
+ label.textContent = (i + 1) + '. ' + e.label;
65
+ const pill = document.createElement('span');
66
+ pill.className = 'pill idle';
67
+ pill.textContent = 'idle';
68
+ li.appendChild(pill);
69
+ li.appendChild(label);
70
+ ul.appendChild(li);
71
+ return { pill, li };
72
+ });
73
+
74
+ let signed = 0;
75
+
76
+ async function signOne(i) {
77
+ const entry = ENTRIES[i];
78
+ rows[i].pill.className = 'pill active';
79
+ rows[i].pill.textContent = 'signing';
80
+
81
+ if (!window.ethereum) throw new Error('No window.ethereum provider');
82
+
83
+ const accounts = await window.ethereum.request({ method: 'eth_requestAccounts' });
84
+ const signer = accounts[0];
85
+
86
+ let signature;
87
+ try {
88
+ signature = await window.ethereum.request({
89
+ method: 'eth_signTypedData_v4',
90
+ params: [signer, JSON.stringify(entry.typedData)],
91
+ });
92
+ } catch (err) {
93
+ const msg = err && err.message ? err.message : String(err);
94
+ rows[i].pill.className = 'pill error';
95
+ rows[i].pill.textContent = 'rejected';
96
+ const errLi = document.createElement('div');
97
+ errLi.className = 'err-msg';
98
+ errLi.textContent = msg;
99
+ rows[i].li.appendChild(errLi);
100
+ await fetch('/skip', {
101
+ method: 'POST',
102
+ headers: { 'content-type': 'application/json' },
103
+ body: JSON.stringify({ id: entry.id, reason: msg }),
104
+ });
105
+ return false;
106
+ }
107
+
108
+ const res = await fetch('/sig', {
109
+ method: 'POST',
110
+ headers: { 'content-type': 'application/json' },
111
+ body: JSON.stringify({ id: entry.id, signature, signerAddress: signer }),
112
+ });
113
+ if (!res.ok) {
114
+ rows[i].pill.className = 'pill error';
115
+ rows[i].pill.textContent = 'server-rejected';
116
+ return false;
117
+ }
118
+ rows[i].pill.className = 'pill signed';
119
+ rows[i].pill.textContent = 'signed';
120
+ signed++;
121
+ progress.textContent = signed + ' / ' + ENTRIES.length;
122
+ return true;
123
+ }
124
+
125
+ runBtn.addEventListener('click', async () => {
126
+ runBtn.disabled = true;
127
+ for (let i = 0; i < ENTRIES.length; i++) {
128
+ try { await signOne(i); } catch (err) {
129
+ console.error(err);
130
+ rows[i].pill.className = 'pill error';
131
+ rows[i].pill.textContent = 'error';
132
+ }
133
+ }
134
+ finishBtn.disabled = false;
135
+ finishBtn.classList.add('primary');
136
+ });
137
+
138
+ finishBtn.addEventListener('click', async () => {
139
+ finishBtn.disabled = true;
140
+ await fetch('/done', { method: 'POST' });
141
+ document.body.innerHTML = '<h1>Done.</h1><p>You can close this tab.</p>';
142
+ });
143
+ <\/script>
144
+ </body>
145
+ </html>`;
146
+ }
147
+ //#endregion
148
+ //#region src/eth/sign-batch-flow.ts
149
+ const DEFAULT_TIMEOUT_MS = 1800 * 1e3;
150
+ async function signBatchViaBrowser(opts) {
151
+ const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
152
+ const html = buildBatchSignPageHtml(opts.entries.map((e) => ({
153
+ id: e.id,
154
+ label: e.label,
155
+ typedData: {
156
+ domain: ATTESTATION_DOMAIN_V1,
157
+ message: serializeMessageForBrowser(e.message),
158
+ primaryType: ATTESTATION_PRIMARY_TYPE,
159
+ types: {
160
+ EIP712Domain: domainTypes(),
161
+ ...ATTESTATION_TYPES_V1
162
+ }
163
+ }
164
+ })));
165
+ const signatures = /* @__PURE__ */ new Map();
166
+ const skipped = /* @__PURE__ */ new Map();
167
+ return new Promise((resolve, reject) => {
168
+ const server = createServer((req, res) => {
169
+ if (req.method === "GET" && (req.url === "/" || req.url === "/index.html")) {
170
+ res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
171
+ res.end(html);
172
+ return;
173
+ }
174
+ if (req.method === "POST" && (req.url === "/sig" || req.url === "/skip")) {
175
+ let body = "";
176
+ req.on("data", (chunk) => {
177
+ body += chunk.toString("utf8");
178
+ });
179
+ req.on("end", () => {
180
+ let parsed;
181
+ try {
182
+ parsed = JSON.parse(body);
183
+ } catch {
184
+ res.writeHead(400);
185
+ res.end("Parse error");
186
+ return;
187
+ }
188
+ if (req.url === "/sig") {
189
+ if (typeof parsed.signature !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(parsed.signature) || typeof parsed.signerAddress !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(parsed.signerAddress)) {
190
+ res.writeHead(400);
191
+ res.end("Invalid payload");
192
+ return;
193
+ }
194
+ signatures.set(parsed.id, {
195
+ signature: parsed.signature,
196
+ signerAddress: parsed.signerAddress
197
+ });
198
+ } else skipped.set(parsed.id, parsed.reason ?? "skipped");
199
+ res.writeHead(200, { "content-type": "text/plain" });
200
+ res.end("OK");
201
+ });
202
+ return;
203
+ }
204
+ if (req.method === "POST" && req.url === "/done") {
205
+ res.writeHead(200, { "content-type": "text/plain" });
206
+ res.end("OK");
207
+ res.on("finish", () => {
208
+ clearTimeout(timer);
209
+ server.close();
210
+ resolve({
211
+ signatures,
212
+ skipped
213
+ });
214
+ });
215
+ return;
216
+ }
217
+ res.writeHead(404);
218
+ res.end("Not found");
219
+ });
220
+ const timer = setTimeout(() => {
221
+ server.close();
222
+ reject(/* @__PURE__ */ new Error(`Batch sign flow timed out after ${timeoutMs}ms`));
223
+ }, timeoutMs);
224
+ server.on("error", (err) => {
225
+ clearTimeout(timer);
226
+ reject(err);
227
+ });
228
+ server.listen(0, "127.0.0.1", () => {
229
+ const url = `http://127.0.0.1:${server.address().port}/`;
230
+ const ready = opts.onUrlReady ?? defaultOpenInBrowser;
231
+ Promise.resolve(ready(url)).catch((error) => {
232
+ clearTimeout(timer);
233
+ server.close();
234
+ reject(error);
235
+ });
236
+ });
237
+ });
238
+ }
239
+ async function defaultOpenInBrowser(url) {
240
+ const { default: open } = await import("open");
241
+ await open(url);
242
+ }
243
+ function serializeMessageForBrowser(message) {
244
+ return {
245
+ claims: {
246
+ priorAttestation: message.claims.priorAttestation,
247
+ publishedAt: message.claims.publishedAt.toString(),
248
+ revision: message.claims.revision,
249
+ slug: message.claims.slug
250
+ },
251
+ schemaVersion: message.schemaVersion,
252
+ subject: message.subject
253
+ };
254
+ }
255
+ function domainTypes() {
256
+ return [
257
+ {
258
+ name: "name",
259
+ type: "string"
260
+ },
261
+ {
262
+ name: "version",
263
+ type: "string"
264
+ },
265
+ {
266
+ name: "chainId",
267
+ type: "uint256"
268
+ }
269
+ ];
270
+ }
271
+ //#endregion
272
+ export { signBatchViaBrowser, signViaBrowser, stampDigest, upgradeProof, verifyOts };
273
+
274
+ //# sourceMappingURL=node.js.map
package/dist/node.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"node.js","names":[],"sources":["../src/eth/sign-batch-page-html.ts","../src/eth/sign-batch-flow.ts"],"sourcesContent":["/**\n * HTML page served by the local CLI server during batch signing. Loads the\n * full list of EIP-712 typed-data messages, walks them sequentially, and POSTs\n * each signature back as MetaMask returns it. The server closes after the user\n * either signs the last entry or clicks \"Done\".\n */\nexport function buildBatchSignPageHtml(\n entries: Array<{ id: string; label: string; typedData: object }>,\n): string {\n const escaped = JSON.stringify(entries)\n .replace(/\\\\/g, String.raw`\\\\`)\n .replace(/`/g, '\\\\`')\n .replace(/<\\/script>/gi, String.raw`<\\/script>`);\n\n return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\" />\n<title>Sign all attestations</title>\n<style>\n * { box-sizing: border-box; }\n body { font-family: system-ui, sans-serif; max-width: 720px; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; color: #111; }\n h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }\n .lead { color: #666; margin: 0 0 2rem; }\n .controls { display: flex; gap: 0.75rem; margin-bottom: 1.5rem; align-items: center; }\n button { padding: 0.6rem 1rem; font-size: 0.95rem; cursor: pointer; border: 1px solid #ccc; background: #fff; border-radius: 6px; }\n button.primary { background: #111; color: #fff; border-color: #111; }\n button:disabled { opacity: 0.5; cursor: not-allowed; }\n .progress { font-size: 0.85rem; color: #666; }\n ul.entries { list-style: none; padding: 0; margin: 0; border-top: 1px solid #eee; }\n ul.entries li { display: flex; align-items: center; gap: 0.75rem; padding: 0.6rem 0; border-bottom: 1px solid #eee; font-size: 0.9rem; }\n .pill { font-family: ui-monospace, monospace; font-size: 0.7rem; text-transform: uppercase; letter-spacing: 0.06em; padding: 2px 8px; border-radius: 999px; border: 1px solid; }\n .pill.idle { color: #999; border-color: #ddd; }\n .pill.active { color: #0070f3; border-color: #c6dfff; background: #f0f7ff; }\n .pill.signed { color: #0a7d22; border-color: #b8e6c1; background: #f0faf3; }\n .pill.skipped { color: #b78403; border-color: #f1d57f; background: #fffaeb; }\n .pill.error { color: #b00020; border-color: #f5b8c1; background: #fef0f2; }\n .label { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\n .err-msg { font-size: 0.75rem; color: #b00020; padding: 0 0 0.5rem 0; }\n pre.preview { max-height: 200px; overflow: auto; font-size: 0.8rem; background: #f7f7f7; padding: 0.75rem; border-radius: 6px; margin: 0 0 1.5rem; }\n</style>\n</head>\n<body>\n<h1>Sign attestations</h1>\n<p class=\"lead\" id=\"lead\"></p>\n<div class=\"controls\">\n <button class=\"primary\" id=\"run\">Sign all</button>\n <button id=\"finish\" disabled>Done</button>\n <span class=\"progress\" id=\"progress\"></span>\n</div>\n<ul class=\"entries\" id=\"entries\"></ul>\n<script>\n const ENTRIES = JSON.parse(\\`${escaped}\\`);\n const ul = document.getElementById('entries');\n const lead = document.getElementById('lead');\n const progress = document.getElementById('progress');\n const runBtn = document.getElementById('run');\n const finishBtn = document.getElementById('finish');\n\n lead.textContent = ENTRIES.length + ' article' + (ENTRIES.length === 1 ? '' : 's') + ' to sign. MetaMask will pop up once per article — review the typed data and confirm.';\n progress.textContent = '0 / ' + ENTRIES.length;\n\n const rows = ENTRIES.map((e, i) => {\n const li = document.createElement('li');\n const label = document.createElement('span');\n label.className = 'label';\n label.textContent = (i + 1) + '. ' + e.label;\n const pill = document.createElement('span');\n pill.className = 'pill idle';\n pill.textContent = 'idle';\n li.appendChild(pill);\n li.appendChild(label);\n ul.appendChild(li);\n return { pill, li };\n });\n\n let signed = 0;\n\n async function signOne(i) {\n const entry = ENTRIES[i];\n rows[i].pill.className = 'pill active';\n rows[i].pill.textContent = 'signing';\n\n if (!window.ethereum) throw new Error('No window.ethereum provider');\n\n const accounts = await window.ethereum.request({ method: 'eth_requestAccounts' });\n const signer = accounts[0];\n\n let signature;\n try {\n signature = await window.ethereum.request({\n method: 'eth_signTypedData_v4',\n params: [signer, JSON.stringify(entry.typedData)],\n });\n } catch (err) {\n const msg = err && err.message ? err.message : String(err);\n rows[i].pill.className = 'pill error';\n rows[i].pill.textContent = 'rejected';\n const errLi = document.createElement('div');\n errLi.className = 'err-msg';\n errLi.textContent = msg;\n rows[i].li.appendChild(errLi);\n await fetch('/skip', {\n method: 'POST',\n headers: { 'content-type': 'application/json' },\n body: JSON.stringify({ id: entry.id, reason: msg }),\n });\n return false;\n }\n\n const res = await fetch('/sig', {\n method: 'POST',\n headers: { 'content-type': 'application/json' },\n body: JSON.stringify({ id: entry.id, signature, signerAddress: signer }),\n });\n if (!res.ok) {\n rows[i].pill.className = 'pill error';\n rows[i].pill.textContent = 'server-rejected';\n return false;\n }\n rows[i].pill.className = 'pill signed';\n rows[i].pill.textContent = 'signed';\n signed++;\n progress.textContent = signed + ' / ' + ENTRIES.length;\n return true;\n }\n\n runBtn.addEventListener('click', async () => {\n runBtn.disabled = true;\n for (let i = 0; i < ENTRIES.length; i++) {\n try { await signOne(i); } catch (err) {\n console.error(err);\n rows[i].pill.className = 'pill error';\n rows[i].pill.textContent = 'error';\n }\n }\n finishBtn.disabled = false;\n finishBtn.classList.add('primary');\n });\n\n finishBtn.addEventListener('click', async () => {\n finishBtn.disabled = true;\n await fetch('/done', { method: 'POST' });\n document.body.innerHTML = '<h1>Done.</h1><p>You can close this tab.</p>';\n });\n</script>\n</body>\n</html>`;\n}\n","import { createServer } from 'node:http';\nimport { type AddressInfo } from 'node:net';\n\nimport {\n ATTESTATION_DOMAIN_V1,\n ATTESTATION_PRIMARY_TYPE,\n ATTESTATION_TYPES_V1,\n type AttestationMessage,\n} from '../core/eip712-schema.js';\nimport { buildBatchSignPageHtml } from './sign-batch-page-html.js';\n\nexport type BatchSignEntry = {\n /** Unique key — used to correlate signatures back to entries. */\n id: string;\n /** Human-readable label shown in the browser UI. */\n label: string;\n /** EIP-712 message to sign. */\n message: AttestationMessage;\n};\n\nexport type BatchSignFlowOptions = {\n entries: BatchSignEntry[];\n onUrlReady?: (url: string) => Promise<void> | void;\n /** Total session timeout. Default 30 minutes. */\n timeoutMs?: number;\n};\n\nexport type BatchSignature = {\n signature: `0x${string}`;\n signerAddress: `0x${string}`;\n};\n\nexport type BatchSignFlowResult = {\n signatures: Map<string, BatchSignature>;\n /** Entries the user explicitly skipped or that failed (rejected wallet, etc.). */\n skipped: Map<string, string>;\n};\n\nconst DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;\n\nexport async function signBatchViaBrowser(\n opts: BatchSignFlowOptions,\n): Promise<BatchSignFlowResult> {\n const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n const wireEntries = opts.entries.map((e) => ({\n id: e.id,\n label: e.label,\n typedData: {\n domain: ATTESTATION_DOMAIN_V1,\n message: serializeMessageForBrowser(e.message),\n primaryType: ATTESTATION_PRIMARY_TYPE,\n types: { EIP712Domain: domainTypes(), ...ATTESTATION_TYPES_V1 },\n },\n }));\n const html = buildBatchSignPageHtml(wireEntries);\n\n const signatures = new Map<string, BatchSignature>();\n const skipped = new Map<string, string>();\n\n return new Promise<BatchSignFlowResult>((resolve, reject) => {\n const server = createServer((req, res) => {\n if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) {\n res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n res.end(html);\n return;\n }\n\n if (req.method === 'POST' && (req.url === '/sig' || req.url === '/skip')) {\n let body = '';\n req.on('data', (chunk: Buffer) => {\n body += chunk.toString('utf8');\n });\n req.on('end', () => {\n let parsed: {\n id: string;\n signature?: `0x${string}`;\n signerAddress?: `0x${string}`;\n reason?: string;\n };\n try {\n parsed = JSON.parse(body) as typeof parsed;\n } catch {\n res.writeHead(400);\n res.end('Parse error');\n return;\n }\n if (req.url === '/sig') {\n if (\n typeof parsed.signature !== 'string' ||\n !/^0x[0-9a-fA-F]{130}$/.test(parsed.signature) ||\n typeof parsed.signerAddress !== 'string' ||\n !/^0x[0-9a-fA-F]{40}$/.test(parsed.signerAddress)\n ) {\n res.writeHead(400);\n res.end('Invalid payload');\n return;\n }\n signatures.set(parsed.id, {\n signature: parsed.signature,\n signerAddress: parsed.signerAddress,\n });\n } else {\n skipped.set(parsed.id, parsed.reason ?? 'skipped');\n }\n res.writeHead(200, { 'content-type': 'text/plain' });\n res.end('OK');\n });\n return;\n }\n\n if (req.method === 'POST' && req.url === '/done') {\n res.writeHead(200, { 'content-type': 'text/plain' });\n res.end('OK');\n res.on('finish', () => {\n clearTimeout(timer);\n server.close();\n resolve({ signatures, skipped });\n });\n return;\n }\n\n res.writeHead(404);\n res.end('Not found');\n });\n\n const timer = setTimeout(() => {\n server.close();\n reject(new Error(`Batch sign flow timed out after ${timeoutMs}ms`));\n }, timeoutMs);\n\n server.on('error', (err) => {\n clearTimeout(timer);\n reject(err);\n });\n\n server.listen(0, '127.0.0.1', () => {\n const addr = server.address() as AddressInfo;\n const url = `http://127.0.0.1:${addr.port}/`;\n const ready = opts.onUrlReady ?? defaultOpenInBrowser;\n void Promise.resolve(ready(url)).catch((error: unknown) => {\n clearTimeout(timer);\n server.close();\n reject(error);\n });\n });\n });\n}\n\nasync function defaultOpenInBrowser(url: string): Promise<void> {\n const { default: open } = await import('open');\n await open(url);\n}\n\nfunction serializeMessageForBrowser(message: AttestationMessage): Record<string, unknown> {\n return {\n claims: {\n priorAttestation: message.claims.priorAttestation,\n publishedAt: message.claims.publishedAt.toString(),\n revision: message.claims.revision,\n slug: message.claims.slug,\n },\n schemaVersion: message.schemaVersion,\n subject: message.subject,\n };\n}\n\nfunction domainTypes(): Array<{ name: string; type: string }> {\n return [\n { name: 'name', type: 'string' },\n { name: 'version', type: 'string' },\n { name: 'chainId', type: 'uint256' },\n ];\n}\n"],"mappings":";;;;;;;;;;AAMA,SAAgB,uBACZ,SACM;CAMN,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCALS,KAAK,UAAU,OAAO,CAAC,CAClC,QAAQ,OAAO,OAAO,GAAG,IAAI,CAAC,CAC9B,QAAQ,MAAM,KAAK,CAAC,CACpB,QAAQ,gBAAgB,OAAO,GAAG,YAwCF,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgG3C;;;AC9GA,MAAM,qBAAqB,OAAU;AAErC,eAAsB,oBAClB,MAC4B;CAC5B,MAAM,YAAY,KAAK,aAAa;CAYpC,MAAM,OAAO,uBAVO,KAAK,QAAQ,KAAK,OAAO;EACzC,IAAI,EAAE;EACN,OAAO,EAAE;EACT,WAAW;GACP,QAAQ;GACR,SAAS,2BAA2B,EAAE,OAAO;GAC7C,aAAa;GACb,OAAO;IAAE,cAAc,YAAY;IAAG,GAAG;GAAqB;EAClE;CACJ,EAC8C,CAAC;CAE/C,MAAM,6BAAa,IAAI,IAA4B;CACnD,MAAM,0BAAU,IAAI,IAAoB;CAExC,OAAO,IAAI,SAA8B,SAAS,WAAW;EACzD,MAAM,SAAS,cAAc,KAAK,QAAQ;GACtC,IAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,OAAO,IAAI,QAAQ,gBAAgB;IACxE,IAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;IACjE,IAAI,IAAI,IAAI;IACZ;GACJ;GAEA,IAAI,IAAI,WAAW,WAAW,IAAI,QAAQ,UAAU,IAAI,QAAQ,UAAU;IACtE,IAAI,OAAO;IACX,IAAI,GAAG,SAAS,UAAkB;KAC9B,QAAQ,MAAM,SAAS,MAAM;IACjC,CAAC;IACD,IAAI,GAAG,aAAa;KAChB,IAAI;KAMJ,IAAI;MACA,SAAS,KAAK,MAAM,IAAI;KAC5B,QAAQ;MACJ,IAAI,UAAU,GAAG;MACjB,IAAI,IAAI,aAAa;MACrB;KACJ;KACA,IAAI,IAAI,QAAQ,QAAQ;MACpB,IACI,OAAO,OAAO,cAAc,YAC5B,CAAC,uBAAuB,KAAK,OAAO,SAAS,KAC7C,OAAO,OAAO,kBAAkB,YAChC,CAAC,sBAAsB,KAAK,OAAO,aAAa,GAClD;OACE,IAAI,UAAU,GAAG;OACjB,IAAI,IAAI,iBAAiB;OACzB;MACJ;MACA,WAAW,IAAI,OAAO,IAAI;OACtB,WAAW,OAAO;OAClB,eAAe,OAAO;MAC1B,CAAC;KACL,OACI,QAAQ,IAAI,OAAO,IAAI,OAAO,UAAU,SAAS;KAErD,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;KACnD,IAAI,IAAI,IAAI;IAChB,CAAC;IACD;GACJ;GAEA,IAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,SAAS;IAC9C,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;IACnD,IAAI,IAAI,IAAI;IACZ,IAAI,GAAG,gBAAgB;KACnB,aAAa,KAAK;KAClB,OAAO,MAAM;KACb,QAAQ;MAAE;MAAY;KAAQ,CAAC;IACnC,CAAC;IACD;GACJ;GAEA,IAAI,UAAU,GAAG;GACjB,IAAI,IAAI,WAAW;EACvB,CAAC;EAED,MAAM,QAAQ,iBAAiB;GAC3B,OAAO,MAAM;GACb,uBAAO,IAAI,MAAM,mCAAmC,UAAU,GAAG,CAAC;EACtE,GAAG,SAAS;EAEZ,OAAO,GAAG,UAAU,QAAQ;GACxB,aAAa,KAAK;GAClB,OAAO,GAAG;EACd,CAAC;EAED,OAAO,OAAO,GAAG,mBAAmB;GAEhC,MAAM,MAAM,oBADC,OAAO,QACe,CAAC,CAAC,KAAK;GAC1C,MAAM,QAAQ,KAAK,cAAc;GACjC,QAAa,QAAQ,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,UAAmB;IACvD,aAAa,KAAK;IAClB,OAAO,MAAM;IACb,OAAO,KAAK;GAChB,CAAC;EACL,CAAC;CACL,CAAC;AACL;AAEA,eAAe,qBAAqB,KAA4B;CAC5D,MAAM,EAAE,SAAS,SAAS,MAAM,OAAO;CACvC,MAAM,KAAK,GAAG;AAClB;AAEA,SAAS,2BAA2B,SAAsD;CACtF,OAAO;EACH,QAAQ;GACJ,kBAAkB,QAAQ,OAAO;GACjC,aAAa,QAAQ,OAAO,YAAY,SAAS;GACjD,UAAU,QAAQ,OAAO;GACzB,MAAM,QAAQ,OAAO;EACzB;EACA,eAAe,QAAQ;EACvB,SAAS,QAAQ;CACrB;AACJ;AAEA,SAAS,cAAqD;CAC1D,OAAO;EACH;GAAE,MAAM;GAAQ,MAAM;EAAS;EAC/B;GAAE,MAAM;GAAW,MAAM;EAAS;EAClC;GAAE,MAAM;GAAW,MAAM;EAAU;CACvC;AACJ"}
package/dist/sign-flow.cjs ADDED
@@ -0,0 +1,323 @@
1
+ //#region \0rolldown/runtime.js
2
+ var __create = Object.create;
3
+ var __defProp = Object.defineProperty;
4
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
5
+ var __getOwnPropNames = Object.getOwnPropertyNames;
6
+ var __getProtoOf = Object.getPrototypeOf;
7
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
8
+ var __copyProps = (to, from, except, desc) => {
9
+ if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
10
+ key = keys[i];
11
+ if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
12
+ get: ((k) => from[k]).bind(null, key),
13
+ enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
14
+ });
15
+ }
16
+ return to;
17
+ };
18
+ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
19
+ value: mod,
20
+ enumerable: true
21
+ }) : target, mod));
22
+ //#endregion
23
+ const require_eip712_schema = require("./eip712-schema.cjs");
24
+ let javascript_opentimestamps = require("javascript-opentimestamps");
25
+ javascript_opentimestamps = __toESM(javascript_opentimestamps, 1);
26
+ let node_http = require("node:http");
27
+ //#region src/ots/stamp.ts
28
+ const { DetachedTimestampFile: DetachedTimestampFile$1, Ops: Ops$1 } = javascript_opentimestamps.default;
29
+ /**
30
+ * Submit a SHA-256 digest to OpenTimestamps calendars and return the proof bytes.
31
+ *
32
+ * The returned proof initially contains only calendar attestations. Run upgrade()
33
+ * after ~24h to anchor it in a Bitcoin block.
34
+ */
35
+ async function stampDigest(digest) {
36
+ if (digest.length !== 32) throw new Error(`Expected 32-byte SHA-256 digest, got ${digest.length} bytes`);
37
+ const detached = DetachedTimestampFile$1.fromHash(new Ops$1.OpSHA256(), Buffer.from(digest));
38
+ await javascript_opentimestamps.default.stamp(detached);
39
+ const bytes = detached.serializeToBytes.call(detached);
40
+ return new Uint8Array(bytes);
41
+ }
42
+ /**
43
+ * Try to upgrade a calendar-only proof to a Bitcoin-anchored proof.
44
+ *
45
+ * Returns the (possibly upgraded) proof bytes plus a flag indicating whether
46
+ * the upgrade actually attached a Bitcoin attestation this time.
47
+ */
48
+ async function upgradeProof(otsBytes) {
49
+ const detached = DetachedTimestampFile$1.deserialize(Buffer.from(otsBytes));
50
+ const upgraded = await javascript_opentimestamps.default.upgrade(detached);
51
+ const bytes = detached.serializeToBytes.call(detached);
52
+ return {
53
+ bytes: new Uint8Array(bytes),
54
+ upgraded
55
+ };
56
+ }
57
+ //#endregion
58
+ //#region src/ots/verify.ts
59
+ const { DetachedTimestampFile, Ops } = javascript_opentimestamps.default;
60
+ /**
61
+ * Verify an OTS proof attests the given digest, and return the Bitcoin block
62
+ * attestation time if present.
63
+ *
64
+ * Network: this calls a public Bitcoin block-info source via the OTS library
65
+ * to validate the Merkle path. In production-paranoid mode you should run your
66
+ * own Bitcoin node and pass it explicitly (future enhancement).
67
+ */
68
+ async function verifyOts(digest, otsBytes) {
69
+ if (digest.length !== 32) return {
70
+ details: `Expected 32-byte digest, got ${digest.length}`,
71
+ ok: false,
72
+ reason: "digest-mismatch"
73
+ };
74
+ let detached;
75
+ let original;
76
+ try {
77
+ detached = DetachedTimestampFile.deserialize(Buffer.from(otsBytes));
78
+ original = DetachedTimestampFile.fromHash(new Ops.OpSHA256(), Buffer.from(digest));
79
+ } catch (error) {
80
+ return {
81
+ details: error.message,
82
+ ok: false,
83
+ reason: "invalid-proof"
84
+ };
85
+ }
86
+ let attestations;
87
+ try {
88
+ attestations = await javascript_opentimestamps.default.verify(detached, original);
89
+ } catch (error) {
90
+ return {
91
+ details: error.message,
92
+ ok: false,
93
+ reason: "invalid-proof"
94
+ };
95
+ }
96
+ const bitcoin = attestations["bitcoin"];
97
+ if (bitcoin === void 0) return {
98
+ ok: false,
99
+ reason: "pending-bitcoin"
100
+ };
101
+ return {
102
+ bitcoinBlockTime: /* @__PURE__ */ new Date(bitcoin.timestamp * 1e3),
103
+ ok: true
104
+ };
105
+ }
106
+ //#endregion
107
+ //#region src/eth/sign-page-html.ts
108
+ /**
109
+ * Self-contained HTML page served by the local CLI server. Opens MetaMask
110
+ * (or any window.ethereum provider), requests EIP-712 v4 signature, POSTs
111
+ * the result back to the localhost callback.
112
+ *
113
+ * No bundler, no external script — just a string template. Keeping this
114
+ * pure-string makes it trivial to audit what gets shown to the wallet.
115
+ */
116
+ function buildSignPageHtml(typedDataJson) {
117
+ return `<!doctype html>
118
+ <html lang="en">
119
+ <head>
120
+ <meta charset="utf-8" />
121
+ <title>Sign attestation</title>
122
+ <style>
123
+ body { font-family: system-ui, sans-serif; max-width: 640px; margin: 4rem auto; padding: 0 1rem; line-height: 1.5; }
124
+ button { padding: 0.75rem 1.5rem; font-size: 1rem; cursor: pointer; }
125
+ pre { background: #f4f4f4; padding: 1rem; overflow-x: auto; font-size: 0.85rem; }
126
+ .ok { color: #0a7d22; }
127
+ .err { color: #b00020; white-space: pre-wrap; }
128
+ </style>
129
+ </head>
130
+ <body>
131
+ <h1>Sign attestation</h1>
132
+ <p>Review the structured data below, then click <strong>Sign</strong>. Your wallet will show the same fields.</p>
133
+ <pre id="preview"></pre>
134
+ <p><button id="sign">Sign with wallet</button></p>
135
+ <p id="status"></p>
136
+ <script>
137
+ const TYPED_DATA = JSON.parse(\`${typedDataJson.replace(/\\/g, String.raw`\\`).replace(/`/g, "\\`").replace(/<\/script>/gi, String.raw`<\/script>`)}\`);
138
+ document.getElementById('preview').textContent = JSON.stringify(TYPED_DATA.message, null, 2);
139
+
140
+ document.getElementById('sign').addEventListener('click', async () => {
141
+ const status = document.getElementById('status');
142
+ status.className = '';
143
+ status.textContent = 'Requesting account…';
144
+
145
+ if (!window.ethereum) {
146
+ status.className = 'err';
147
+ status.textContent = 'No window.ethereum provider found. Install MetaMask (or another wallet) and reload.';
148
+ return;
149
+ }
150
+
151
+ try {
152
+ const accounts = await window.ethereum.request({ method: 'eth_requestAccounts' });
153
+ const signer = accounts[0];
154
+
155
+ status.textContent = 'Awaiting wallet confirmation…';
156
+ const signature = await window.ethereum.request({
157
+ method: 'eth_signTypedData_v4',
158
+ params: [signer, JSON.stringify(TYPED_DATA)],
159
+ });
160
+
161
+ status.textContent = 'Submitting signature…';
162
+ const res = await fetch('/done', {
163
+ method: 'POST',
164
+ headers: { 'content-type': 'application/json' },
165
+ body: JSON.stringify({ signature, signerAddress: signer }),
166
+ });
167
+ if (!res.ok) throw new Error('Server rejected the signature: HTTP ' + res.status);
168
+
169
+ status.className = 'ok';
170
+ status.textContent = 'Signed. You can close this tab.';
171
+ document.getElementById('sign').disabled = true;
172
+ } catch (err) {
173
+ status.className = 'err';
174
+ status.textContent = 'Failed: ' + (err && err.message ? err.message : String(err));
175
+ }
176
+ });
177
+ <\/script>
178
+ </body>
179
+ </html>`;
180
+ }
181
+ //#endregion
182
+ //#region src/eth/sign-flow.ts
183
+ const DEFAULT_TIMEOUT_MS = 300 * 1e3;
184
+ /**
185
+ * Spin up a one-shot localhost HTTP server, open the browser, wait for the user
186
+ * to sign with their wallet, return the signature.
187
+ *
188
+ * The local server only accepts loopback requests (127.0.0.1).
189
+ */
190
+ async function signViaBrowser(opts) {
191
+ const message = opts.message;
192
+ const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
193
+ const typedData = {
194
+ domain: require_eip712_schema.ATTESTATION_DOMAIN_V1,
195
+ message: serializeMessageForBrowser(message),
196
+ primaryType: require_eip712_schema.ATTESTATION_PRIMARY_TYPE,
197
+ types: {
198
+ EIP712Domain: domainTypes(),
199
+ ...require_eip712_schema.ATTESTATION_TYPES_V1
200
+ }
201
+ };
202
+ const html = buildSignPageHtml(JSON.stringify(typedData));
203
+ return new Promise((resolve, reject) => {
204
+ const server = (0, node_http.createServer)((req, res) => {
205
+ if (req.method === "GET" && (req.url === "/" || req.url === "/index.html")) {
206
+ res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
207
+ res.end(html);
208
+ return;
209
+ }
210
+ if (req.method === "POST" && req.url === "/done") {
211
+ let body = "";
212
+ req.on("data", (chunk) => {
213
+ body += chunk.toString("utf8");
214
+ });
215
+ req.on("end", () => {
216
+ let parsed;
217
+ try {
218
+ parsed = JSON.parse(body);
219
+ } catch {
220
+ res.writeHead(400);
221
+ res.end("Parse error");
222
+ return;
223
+ }
224
+ if (typeof parsed.signature !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(parsed.signature) || typeof parsed.signerAddress !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(parsed.signerAddress)) {
225
+ res.writeHead(400);
226
+ res.end("Invalid payload");
227
+ return;
228
+ }
229
+ res.writeHead(200, { "content-type": "text/plain" });
230
+ res.end("OK");
231
+ res.on("finish", () => {
232
+ clearTimeout(timer);
233
+ server.close();
234
+ resolve(parsed);
235
+ });
236
+ });
237
+ return;
238
+ }
239
+ res.writeHead(404);
240
+ res.end("Not found");
241
+ });
242
+ const timer = setTimeout(() => {
243
+ server.close();
244
+ reject(/* @__PURE__ */ new Error(`Sign flow timed out after ${timeoutMs}ms`));
245
+ }, timeoutMs);
246
+ server.on("error", (err) => {
247
+ clearTimeout(timer);
248
+ reject(err);
249
+ });
250
+ server.listen(0, "127.0.0.1", () => {
251
+ const url = `http://127.0.0.1:${server.address().port}/`;
252
+ const ready = opts.onUrlReady ?? defaultOpenInBrowser;
253
+ Promise.resolve(ready(url)).catch((error) => {
254
+ clearTimeout(timer);
255
+ server.close();
256
+ reject(error);
257
+ });
258
+ });
259
+ });
260
+ }
261
+ async function defaultOpenInBrowser(url) {
262
+ const { default: open } = await import("open");
263
+ await open(url);
264
+ }
265
+ /**
266
+ * Convert AttestationMessage (with bigint publishedAt) to a JSON-serializable
267
+ * form for the browser. EIP-712 v4 expects numeric strings for uint64.
268
+ */
269
+ function serializeMessageForBrowser(message) {
270
+ return {
271
+ claims: {
272
+ priorAttestation: message.claims.priorAttestation,
273
+ publishedAt: message.claims.publishedAt.toString(),
274
+ revision: message.claims.revision,
275
+ slug: message.claims.slug
276
+ },
277
+ schemaVersion: message.schemaVersion,
278
+ subject: message.subject
279
+ };
280
+ }
281
+ function domainTypes() {
282
+ return [
283
+ {
284
+ name: "name",
285
+ type: "string"
286
+ },
287
+ {
288
+ name: "version",
289
+ type: "string"
290
+ },
291
+ {
292
+ name: "chainId",
293
+ type: "uint256"
294
+ }
295
+ ];
296
+ }
297
+ //#endregion
298
+ Object.defineProperty(exports, "signViaBrowser", {
299
+ enumerable: true,
300
+ get: function() {
301
+ return signViaBrowser;
302
+ }
303
+ });
304
+ Object.defineProperty(exports, "stampDigest", {
305
+ enumerable: true,
306
+ get: function() {
307
+ return stampDigest;
308
+ }
309
+ });
310
+ Object.defineProperty(exports, "upgradeProof", {
311
+ enumerable: true,
312
+ get: function() {
313
+ return upgradeProof;
314
+ }
315
+ });
316
+ Object.defineProperty(exports, "verifyOts", {
317
+ enumerable: true,
318
+ get: function() {
319
+ return verifyOts;
320
+ }
321
+ });
322
+
323
+ //# sourceMappingURL=sign-flow.cjs.map
package/dist/sign-flow.cjs.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sign-flow.cjs","names":["OpenTimestamps","DetachedTimestampFile","Ops","OpenTimestamps","ATTESTATION_DOMAIN_V1","ATTESTATION_PRIMARY_TYPE","ATTESTATION_TYPES_V1"],"sources":["../src/ots/stamp.ts","../src/ots/verify.ts","../src/eth/sign-page-html.ts","../src/eth/sign-flow.ts"],"sourcesContent":["import OpenTimestamps from 'javascript-opentimestamps';\n\nconst { DetachedTimestampFile, Ops } = OpenTimestamps as {\n DetachedTimestampFile: {\n deserialize: (bytes: Buffer | Uint8Array) => unknown;\n fromHash: (op: unknown, hash: Buffer) => unknown;\n };\n Ops: { OpSHA256: unknown };\n stamp: (detached: unknown) => Promise<void>;\n upgrade: (detached: unknown) => Promise<boolean>;\n verify: (\n detached: unknown,\n original: unknown,\n ) => Promise<Record<string, { timestamp: number }>>;\n};\n\n/**\n * Submit a SHA-256 digest to OpenTimestamps calendars and return the proof bytes.\n *\n * The returned proof initially contains only calendar attestations. Run upgrade()\n * after ~24h to anchor it in a Bitcoin block.\n */\nexport async function stampDigest(digest: Uint8Array): Promise<Uint8Array> {\n if (digest.length !== 32) {\n throw new Error(`Expected 32-byte SHA-256 digest, got ${digest.length} bytes`);\n }\n\n const detached = DetachedTimestampFile.fromHash(\n new (Ops.OpSHA256 as new () => unknown)(),\n Buffer.from(digest),\n );\n await (OpenTimestamps as unknown as { stamp: (d: unknown) => Promise<void> }).stamp(detached);\n\n const serialize = (detached as { serializeToBytes: () => Buffer | Uint8Array })\n .serializeToBytes;\n const bytes = serialize.call(detached);\n return new Uint8Array(bytes as Buffer);\n}\n\n/**\n * Try to upgrade a calendar-only proof to a Bitcoin-anchored proof.\n *\n * Returns the (possibly upgraded) proof bytes plus a flag indicating whether\n * the upgrade actually attached a Bitcoin attestation this time.\n */\nexport async function upgradeProof(\n otsBytes: Uint8Array,\n): Promise<{ bytes: Uint8Array; upgraded: boolean }> {\n const detached = DetachedTimestampFile.deserialize(Buffer.from(otsBytes));\n const upgraded = await (\n OpenTimestamps as unknown as { upgrade: (d: unknown) => Promise<boolean> }\n ).upgrade(detached);\n\n const serialize = (detached as { serializeToBytes: () => Buffer | Uint8Array })\n .serializeToBytes;\n const bytes = serialize.call(detached);\n return { bytes: new Uint8Array(bytes as Buffer), upgraded };\n}\n","import OpenTimestamps from 'javascript-opentimestamps';\n\nconst { DetachedTimestampFile, Ops } = OpenTimestamps as {\n DetachedTimestampFile: {\n deserialize: (bytes: Buffer | Uint8Array) => unknown;\n fromHash: (op: unknown, hash: Buffer) => unknown;\n };\n Ops: { OpSHA256: unknown };\n verify: (\n detached: unknown,\n original: unknown,\n ) => Promise<Record<string, { timestamp: number }>>;\n};\n\nexport type OtsVerifyOk = {\n ok: true;\n bitcoinBlockTime: Date;\n};\n\nexport type OtsVerifyFail = {\n ok: false;\n reason: 'digest-mismatch' | 'invalid-proof' | 'pending-bitcoin';\n details?: string;\n};\n\nexport type OtsVerifyResult = OtsVerifyFail | OtsVerifyOk;\n\n/**\n * Verify an OTS proof attests the given digest, and return the Bitcoin block\n * attestation time if present.\n *\n * Network: this calls a public Bitcoin block-info source via the OTS library\n * to validate the Merkle path. In production-paranoid mode you should run your\n * own Bitcoin node and pass it explicitly (future enhancement).\n */\nexport async function verifyOts(\n digest: Uint8Array,\n otsBytes: Uint8Array,\n): Promise<OtsVerifyResult> {\n if (digest.length !== 32) {\n return {\n details: `Expected 32-byte digest, got ${digest.length}`,\n ok: false,\n reason: 'digest-mismatch',\n };\n }\n\n let detached: unknown;\n let original: unknown;\n try {\n detached = DetachedTimestampFile.deserialize(Buffer.from(otsBytes));\n original = DetachedTimestampFile.fromHash(\n new (Ops.OpSHA256 as new () => unknown)(),\n Buffer.from(digest),\n );\n } catch (error) {\n return { details: (error as Error).message, ok: false, reason: 'invalid-proof' };\n }\n\n let attestations: Record<string, { timestamp: number }>;\n try {\n attestations = await (\n OpenTimestamps as unknown as {\n verify: (\n detached: unknown,\n original: unknown,\n ) => Promise<Record<string, { timestamp: number }>>;\n }\n ).verify(detached, original);\n } catch (error) {\n return { details: (error as Error).message, ok: false, reason: 'invalid-proof' };\n }\n\n const bitcoin = attestations['bitcoin'];\n if (bitcoin === undefined) {\n return { ok: false, reason: 'pending-bitcoin' };\n }\n\n return {\n bitcoinBlockTime: new Date(bitcoin.timestamp * 1000),\n ok: true,\n };\n}\n","/**\n * Self-contained HTML page served by the local CLI server. Opens MetaMask\n * (or any window.ethereum provider), requests EIP-712 v4 signature, POSTs\n * the result back to the localhost callback.\n *\n * No bundler, no external script — just a string template. Keeping this\n * pure-string makes it trivial to audit what gets shown to the wallet.\n */\nexport function buildSignPageHtml(typedDataJson: string): string {\n // TypedDataJson MUST already be a JSON string of EIP-712 v4 typed data\n // (with `domain`, `types`, `primaryType`, `message`).\n const escaped = typedDataJson\n .replace(/\\\\/g, String.raw`\\\\`)\n .replace(/`/g, '\\\\`')\n .replace(/<\\/script>/gi, String.raw`<\\/script>`);\n\n return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\" />\n<title>Sign attestation</title>\n<style>\n body { font-family: system-ui, sans-serif; max-width: 640px; margin: 4rem auto; padding: 0 1rem; line-height: 1.5; }\n button { padding: 0.75rem 1.5rem; font-size: 1rem; cursor: pointer; }\n pre { background: #f4f4f4; padding: 1rem; overflow-x: auto; font-size: 0.85rem; }\n .ok { color: #0a7d22; }\n .err { color: #b00020; white-space: pre-wrap; }\n</style>\n</head>\n<body>\n<h1>Sign attestation</h1>\n<p>Review the structured data below, then click <strong>Sign</strong>. Your wallet will show the same fields.</p>\n<pre id=\"preview\"></pre>\n<p><button id=\"sign\">Sign with wallet</button></p>\n<p id=\"status\"></p>\n<script>\n const TYPED_DATA = JSON.parse(\\`${escaped}\\`);\n document.getElementById('preview').textContent = JSON.stringify(TYPED_DATA.message, null, 2);\n\n document.getElementById('sign').addEventListener('click', async () => {\n const status = document.getElementById('status');\n status.className = '';\n status.textContent = 'Requesting account…';\n\n if (!window.ethereum) {\n status.className = 'err';\n status.textContent = 'No window.ethereum provider found. Install MetaMask (or another wallet) and reload.';\n return;\n }\n\n try {\n const accounts = await window.ethereum.request({ method: 'eth_requestAccounts' });\n const signer = accounts[0];\n\n status.textContent = 'Awaiting wallet confirmation…';\n const signature = await window.ethereum.request({\n method: 'eth_signTypedData_v4',\n params: [signer, JSON.stringify(TYPED_DATA)],\n });\n\n status.textContent = 'Submitting signature…';\n const res = await fetch('/done', {\n method: 'POST',\n headers: { 'content-type': 'application/json' },\n body: JSON.stringify({ signature, signerAddress: signer }),\n });\n if (!res.ok) throw new Error('Server rejected the signature: HTTP ' + res.status);\n\n status.className = 'ok';\n status.textContent = 'Signed. You can close this tab.';\n document.getElementById('sign').disabled = true;\n } catch (err) {\n status.className = 'err';\n status.textContent = 'Failed: ' + (err && err.message ? err.message : String(err));\n }\n });\n</script>\n</body>\n</html>`;\n}\n","import { createServer as createHttpServer } from 'node:http';\nimport { type AddressInfo, createServer } from 'node:net';\n\nimport {\n ATTESTATION_DOMAIN_V1,\n ATTESTATION_PRIMARY_TYPE,\n ATTESTATION_TYPES_V1,\n type AttestationMessage,\n} from '../core/eip712-schema.js';\nimport { buildSignPageHtml } from './sign-page-html.js';\n\nexport type SignFlowOptions = {\n message: AttestationMessage;\n onUrlReady?: (url: string) => Promise<void> | void;\n timeoutMs?: number;\n};\n\nexport type SignFlowResult = {\n signature: `0x${string}`;\n signerAddress: `0x${string}`;\n};\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;\n\n/**\n * Spin up a one-shot localhost HTTP server, open the browser, wait for the user\n * to sign with their wallet, return the signature.\n *\n * The local server only accepts loopback requests (127.0.0.1).\n */\nexport async function signViaBrowser(opts: SignFlowOptions): Promise<SignFlowResult> {\n const message = opts.message;\n const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n const typedData = {\n domain: ATTESTATION_DOMAIN_V1,\n message: serializeMessageForBrowser(message),\n primaryType: ATTESTATION_PRIMARY_TYPE,\n types: { EIP712Domain: domainTypes(), ...ATTESTATION_TYPES_V1 },\n };\n const html = buildSignPageHtml(JSON.stringify(typedData));\n\n return new Promise<SignFlowResult>((resolve, reject) => {\n const server = createHttpServer((req, res) => {\n if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) {\n res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n res.end(html);\n return;\n }\n\n if (req.method === 'POST' && req.url === '/done') {\n let body = '';\n req.on('data', (chunk: Buffer) => {\n body += chunk.toString('utf8');\n });\n req.on('end', () => {\n let parsed: { signature: `0x${string}`; signerAddress: `0x${string}` };\n try {\n parsed = JSON.parse(body) as typeof parsed;\n } catch {\n res.writeHead(400);\n res.end('Parse error');\n return; // Keep server running so user can retry\n }\n if (\n typeof parsed.signature !== 'string' ||\n !/^0x[0-9a-fA-F]{130}$/.test(parsed.signature) ||\n typeof parsed.signerAddress !== 'string' ||\n !/^0x[0-9a-fA-F]{40}$/.test(parsed.signerAddress)\n ) {\n res.writeHead(400);\n res.end('Invalid payload');\n return; // Keep server running so user can retry\n }\n res.writeHead(200, { 'content-type': 'text/plain' });\n res.end('OK');\n res.on('finish', () => {\n clearTimeout(timer);\n server.close();\n resolve(parsed);\n });\n });\n return;\n }\n\n res.writeHead(404);\n res.end('Not found');\n });\n\n const timer = setTimeout(() => {\n server.close();\n reject(new Error(`Sign flow timed out after ${timeoutMs}ms`));\n }, timeoutMs);\n\n server.on('error', (err) => {\n clearTimeout(timer);\n reject(err);\n });\n\n server.listen(0, '127.0.0.1', () => {\n const addr = server.address() as AddressInfo;\n const url = `http://127.0.0.1:${addr.port}/`;\n const ready = opts.onUrlReady ?? defaultOpenInBrowser;\n void Promise.resolve(ready(url)).catch((error: unknown) => {\n clearTimeout(timer);\n server.close();\n reject(error);\n });\n });\n });\n}\n\nasync function defaultOpenInBrowser(url: string): Promise<void> {\n const { default: open } = await import('open');\n await open(url);\n}\n\n/**\n * Convert AttestationMessage (with bigint publishedAt) to a JSON-serializable\n * form for the browser. EIP-712 v4 expects numeric strings for uint64.\n */\nfunction serializeMessageForBrowser(message: AttestationMessage): Record<string, unknown> {\n return {\n claims: {\n priorAttestation: message.claims.priorAttestation,\n publishedAt: message.claims.publishedAt.toString(),\n revision: message.claims.revision,\n slug: message.claims.slug,\n },\n schemaVersion: message.schemaVersion,\n subject: message.subject,\n };\n}\n\nfunction domainTypes(): Array<{ name: string; type: string }> {\n return [\n { name: 'name', type: 'string' },\n { name: 'version', type: 'string' },\n { name: 'chainId', type: 'uint256' },\n ];\n}\n\n// Suppress unused-import lint: createServer kept for future net-level helpers.\nvoid createServer;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,MAAM,EAAE,uBAAA,yBAAuB,KAAA,UAAQA,0BAAAA;;;;;;;AAoBvC,eAAsB,YAAY,QAAyC;CACvE,IAAI,OAAO,WAAW,IAClB,MAAM,IAAI,MAAM,wCAAwC,OAAO,OAAO,OAAO;CAGjF,MAAM,WAAWC,wBAAsB,SACnC,IAAKC,MAAI,SAA+B,GACxC,OAAO,KAAK,MAAM,CACtB;CACA,MAAOF,0BAAAA,QAAuE,MAAM,QAAQ;CAI5F,MAAM,QAFa,SACd,iBACmB,KAAK,QAAQ;CACrC,OAAO,IAAI,WAAW,KAAe;AACzC;;;;;;;AAQA,eAAsB,aAClB,UACiD;CACjD,MAAM,WAAWC,wBAAsB,YAAY,OAAO,KAAK,QAAQ,CAAC;CACxE,MAAM,WAAW,MACbD,0BAAAA,QACF,QAAQ,QAAQ;CAIlB,MAAM,QAFa,SACd,iBACmB,KAAK,QAAQ;CACrC,OAAO;EAAE,OAAO,IAAI,WAAW,KAAe;EAAG;CAAS;AAC9D;;;ACvDA,MAAM,EAAE,uBAAuB,QAAQG,0BAAAA;;;;;;;;;AAiCvC,eAAsB,UAClB,QACA,UACwB;CACxB,IAAI,OAAO,WAAW,IAClB,OAAO;EACH,SAAS,gCAAgC,OAAO;EAChD,IAAI;EACJ,QAAQ;CACZ;CAGJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACA,WAAW,sBAAsB,YAAY,OAAO,KAAK,QAAQ,CAAC;EAClE,WAAW,sBAAsB,SAC7B,IAAK,IAAI,SAA+B,GACxC,OAAO,KAAK,MAAM,CACtB;CACJ,SAAS,OAAO;EACZ,OAAO;GAAE,SAAU,MAAgB;GAAS,IAAI;GAAO,QAAQ;EAAgB;CACnF;CAEA,IAAI;CACJ,IAAI;EACA,eAAe,MACXA,0BAAAA,QAMF,OAAO,UAAU,QAAQ;CAC/B,SAAS,OAAO;EACZ,OAAO;GAAE,SAAU,MAAgB;GAAS,IAAI;GAAO,QAAQ;EAAgB;CACnF;CAEA,MAAM,UAAU,aAAa;CAC7B,IAAI,YAAY,KAAA,GACZ,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAkB;CAGlD,OAAO;EACH,kCAAkB,IAAI,KAAK,QAAQ,YAAY,GAAI;EACnD,IAAI;CACR;AACJ;;;;;;;;;;;AC1EA,SAAgB,kBAAkB,eAA+B;CAQ7D,OAAO;;;;;;;;;;;;;;;;;;;;sCALS,cACX,QAAQ,OAAO,OAAO,GAAG,IAAI,CAAC,CAC9B,QAAQ,MAAM,KAAK,CAAC,CACpB,QAAQ,gBAAgB,OAAO,GAAG,YAsBC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2C9C;;;ACzDA,MAAM,qBAAqB,MAAS;;;;;;;AAQpC,eAAsB,eAAe,MAAgD;CACjF,MAAM,UAAU,KAAK;CACrB,MAAM,YAAY,KAAK,aAAa;CAEpC,MAAM,YAAY;EACd,QAAQC,sBAAAA;EACR,SAAS,2BAA2B,OAAO;EAC3C,aAAaC,sBAAAA;EACb,OAAO;GAAE,cAAc,YAAY;GAAG,GAAGC,sBAAAA;EAAqB;CAClE;CACA,MAAM,OAAO,kBAAkB,KAAK,UAAU,SAAS,CAAC;CAExD,OAAO,IAAI,SAAyB,SAAS,WAAW;EACpD,MAAM,UAAA,GAAA,UAAA,aAAA,EAA2B,KAAK,QAAQ;GAC1C,IAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,OAAO,IAAI,QAAQ,gBAAgB;IACxE,IAAI,UAAU,KAAK,EAAE,gBAAgB,2BAA2B,CAAC;IACjE,IAAI,IAAI,IAAI;IACZ;GACJ;GAEA,IAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,SAAS;IAC9C,IAAI,OAAO;IACX,IAAI,GAAG,SAAS,UAAkB;KAC9B,QAAQ,MAAM,SAAS,MAAM;IACjC,CAAC;IACD,IAAI,GAAG,aAAa;KAChB,IAAI;KACJ,IAAI;MACA,SAAS,KAAK,MAAM,IAAI;KAC5B,QAAQ;MACJ,IAAI,UAAU,GAAG;MACjB,IAAI,IAAI,aAAa;MACrB;KACJ;KACA,IACI,OAAO,OAAO,cAAc,YAC5B,CAAC,uBAAuB,KAAK,OAAO,SAAS,KAC7C,OAAO,OAAO,kBAAkB,YAChC,CAAC,sBAAsB,KAAK,OAAO,aAAa,GAClD;MACE,IAAI,UAAU,GAAG;MACjB,IAAI,IAAI,iBAAiB;MACzB;KACJ;KACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;KACnD,IAAI,IAAI,IAAI;KACZ,IAAI,GAAG,gBAAgB;MACnB,aAAa,KAAK;MAClB,OAAO,MAAM;MACb,QAAQ,MAAM;KAClB,CAAC;IACL,CAAC;IACD;GACJ;GAEA,IAAI,UAAU,GAAG;GACjB,IAAI,IAAI,WAAW;EACvB,CAAC;EAED,MAAM,QAAQ,iBAAiB;GAC3B,OAAO,MAAM;GACb,uBAAO,IAAI,MAAM,6BAA6B,UAAU,GAAG,CAAC;EAChE,GAAG,SAAS;EAEZ,OAAO,GAAG,UAAU,QAAQ;GACxB,aAAa,KAAK;GAClB,OAAO,GAAG;EACd,CAAC;EAED,OAAO,OAAO,GAAG,mBAAmB;GAEhC,MAAM,MAAM,oBADC,OAAO,QACe,CAAC,CAAC,KAAK;GAC1C,MAAM,QAAQ,KAAK,cAAc;GACjC,QAAa,QAAQ,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,UAAmB;IACvD,aAAa,KAAK;IAClB,OAAO,MAAM;IACb,OAAO,KAAK;GAChB,CAAC;EACL,CAAC;CACL,CAAC;AACL;AAEA,eAAe,qBAAqB,KAA4B;CAC5D,MAAM,EAAE,SAAS,SAAS,MAAM,OAAO;CACvC,MAAM,KAAK,GAAG;AAClB;;;;;AAMA,SAAS,2BAA2B,SAAsD;CACtF,OAAO;EACH,QAAQ;GACJ,kBAAkB,QAAQ,OAAO;GACjC,aAAa,QAAQ,OAAO,YAAY,SAAS;GACjD,UAAU,QAAQ,OAAO;GACzB,MAAM,QAAQ,OAAO;EACzB;EACA,eAAe,QAAQ;EACvB,SAAS,QAAQ;CACrB;AACJ;AAEA,SAAS,cAAqD;CAC1D,OAAO;EACH;GAAE,MAAM;GAAQ,MAAM;EAAS;EAC/B;GAAE,MAAM;GAAW,MAAM;EAAS;EAClC;GAAE,MAAM;GAAW,MAAM;EAAU;CACvC;AACJ"}