@provex/eas 1.9.2-rc.20260720143033.2906fda

package/README.md

@@ -0,0 +1,114 @@
+# @provex/eas
+
+Ethereum Attestation Service primitives behind Provex identity, age, and
+release credentials — the schema definitions, the per-chain deployment
+addresses, the claim encoders, and the decoders and signature-recovery
+helpers a third party needs to **verify** a Provex credential.
+
+Provex issues credentials as Ethereum Attestation Service **off-chain
+attestations**: a signed EIP-712 payload carrying an encoded claim. Anyone
+holding that payload can verify it without a blockchain read and without
+asking Provex.
+
+## Install
+
+```
+npm install @provex/eas viem
+```
+
+`viem` is a peer dependency.
+
+## Entry points
+
+| Import path | Contents | Runtime dependencies |
+| --- | --- | --- |
+| `@provex/eas` | Schema strings, chain deployment addresses, schema unique identifiers, claim encoders, off-chain and delegated builders | `viem`, Ethereum Attestation Service software development kit |
+| `@provex/eas/build` | Claim encoders and attestation builders only | `viem`, Ethereum Attestation Service software development kit |
+| `@provex/eas/verify` | Claim decoders and signature recovery | **`viem` only** |
+
+If you are verifying rather than issuing, import from `@provex/eas/verify`.
+That path never touches the Ethereum Attestation Service software
+development kit, at any depth — the invariant is enforced by a test that
+walks the module graph. It keeps browser bundles small and keeps your
+dependency footprint to `viem`.
+
+## Schemas
+
+```
+Identity  bytes32 platformHash,string handle,address user,uint64 expiresAt
+Release   bytes32 dappKey,bytes32 manifestHash,string domain,string version
+Age       bytes32 nullifier,bool overN,uint8 threshold,bool identityVerified,uint64 expiresAt
+```
+
+Field order is load-bearing: the decoders read positionally.
+
+The age claim deliberately carries no personal field. The date of birth,
+legal name, and account identifier stay inside the issuer's trust boundary;
+only `overN` ("is at least `threshold` years old") escapes it. `overN: false`
+is a real signed answer, not an absence. The subject is bound by the
+attestation's `recipient`, not by anything inside the claim.
+
+Exported as `PROVEX_IDENTITY_SCHEMA`, `PROVEX_RELEASE_SCHEMA`, and
+`PROVEX_AGE_SCHEMA` from `@provex/eas`.
+
+## Schema unique identifiers
+
+A schema's unique identifier is derived deterministically from the schema
+itself:
+
+```
+uid = keccak256(abi.encodePacked(schema, resolver, revocable))
+```
+
+Provex registers every schema with `resolver = address(0)` and
+`revocable = true`, so the unique identifier is reproducible from the schema
+string alone — you do not have to trust a value we publish. The pinned
+per-chain values are available through `getSchemaUid(chainId)`,
+`getAgeSchemaUid(chainId)`, and `getReleaseSchemaUid(chainId)`.
+
+## Verifying a Provex age credential
+
+```ts
+import {
+  decodeAgeClaim,
+  liftWireOffchainAttestation,
+  recoverOffchainAttestationSigner,
+} from '@provex/eas/verify'
+
+// `wire` is the attestation as it arrived — JSON, so its numeric fields are
+// strings. `liftWireOffchainAttestation` validates the shape and lifts
+// `time` / `expirationTime` back to bigint, which signature recovery needs.
+const attestation = liftWireOffchainAttestation(wire)
+
+const { valid, signer } = await recoverOffchainAttestationSigner(
+  attestation,
+  PROVEX_ATTESTER_ADDRESS, // optional; omit to recover without asserting
+)
+
+if (!valid) throw new Error('Attestation signature did not verify')
+
+const claim = decodeAgeClaim(attestation.message.data)
+
+const nowInSeconds = BigInt(Math.floor(Date.now() / 1000))
+const accepted =
+  claim.overN &&
+  claim.threshold >= 18 &&
+  claim.expiresAt > nowInSeconds
+```
+
+Three things are worth being explicit about:
+
+1. **Without `expectedSigner`, `valid` means only that recovery succeeded.**
+   The signer could be anyone. Compare `signer` against an attester you
+   actually trust before acting on the claim.
+2. **Check `expiresAt` yourself.** Signature validity says nothing about
+   freshness.
+3. **Check `threshold` against your own requirement.** A credential attesting
+   `overN` at `threshold: 13` is a valid signature that does not establish
+   that the holder is 18.
+
+The `nullifier` is a stable per-subject identifier you can use to detect the
+same person presenting twice, without learning who they are.
+
+Identity and release credentials verify the same way, via `decodeIdentityClaim`
+and `decodeReleaseClaim`.

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@provex/eas",
+  "version": "1.9.2-rc.20260720143033.2906fda",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/provex-tech/monorepo.git",
+    "directory": "packages/eas"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./build": {
+      "import": "./dist/eas-builder.js",
+      "types": "./dist/eas-builder.d.ts"
+    },
+    "./verify": {
+      "import": "./dist/offchain-verify.js",
+      "types": "./dist/offchain-verify.d.ts"
+    },
+    "./eas": {
+      "import": "./dist/eas.js",
+      "types": "./dist/eas.d.ts"
+    },
+    "./eas-builder": {
+      "import": "./dist/eas-builder.js",
+      "types": "./dist/eas-builder.d.ts"
+    },
+    "./offchain-verify": {
+      "import": "./dist/offchain-verify.js",
+      "types": "./dist/offchain-verify.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "node --import tsx --test 'src/**/*.test.ts'",
+    "test:watch": "node --import tsx --test --watch 'src/**/*.test.ts'"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@ethereum-attestation-service/eas-sdk": "^2.9.0"
+  },
+  "peerDependencies": {
+    "viem": "^2.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.20.3",
+    "typescript": "^5.9.2",
+    "viem": "^2.38.0"
+  }
+}