@provex/eas 1.9.2 → 1.10.0-rc.20260912192040.fdbb8fc

package/dist/eas-builder.d.ts

@@ -1,5 +1,6 @@
-import * as easSdkNamespace from '@ethereum-attestation-service/eas-sdk';
+import type * as EasSdkModule from '@ethereum-attestation-service/eas-sdk';
 import type { Address, Hex, LocalAccount } from 'viem';
+declare const easSdkNamespace: typeof EasSdkModule;
 type OffchainAttestationVersionEnum = (typeof easSdkNamespace)['OffchainAttestationVersion'][keyof (typeof easSdkNamespace)['OffchainAttestationVersion']];
 /**
  * @provex/eas — off-chain Ethereum Attestation Service attestation builder.

package/dist/eas-builder.js

@@ -1,18 +1,9 @@
-// The EAS SDK has two interop quirks that make a single import shape
-// unworkable across our two test runners:
-//   1. The package ships CJS (`main`) + ESM (`module`), with no `"type"`
-//      field at root and no `.js` extensions inside its ESM build.
-//   2. tsx (Node strict ESM) refuses the ESM build (extensionless paths)
-//      and falls back to the CJS build, where the named exports live on
-//      `default` — `* as` gives `{ default, 'module.exports' }`.
-//      vitest (Vite resolver) loads the ESM build directly, where
-//      `* as` gives a flat namespace of named exports.
-//
-// Resolve once, then reach into `default` if the flat namespace is empty.
-// This is the resolver-agnostic interop shape.
-import * as easSdkNamespace from '@ethereum-attestation-service/eas-sdk';
+import easSdkNamespaceRaw from '#eas-sdk-namespace';
 import { zeroAddress } from 'viem';
 import { getAgeSchemaUid, getEasAddress, getReleaseSchemaUid, getSchemaUid, PROVEX_AGE_SCHEMA, PROVEX_IDENTITY_SCHEMA, PROVEX_RELEASE_SCHEMA, } from './eas.js';
+// Runtime namespace, typed against the erased `import type` above so the shims
+// below (`typeof easSdkNamespace`) keep their exact SDK types.
+const easSdkNamespace = easSdkNamespaceRaw;
 const easSdkExports = (() => {
     const flat = easSdkNamespace;
     if (typeof flat.SchemaEncoder === 'function')

package/dist/eas-sdk-namespace.browser.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Browser resolution of the Ethereum Attestation Service software development
+ * kit.
+ *
+ * A bundler (Vite/Rollup, esbuild in browser mode) compiles this build, and
+ * unlike plain Node it adds the missing file extensions throughout the kit's
+ * ECMAScript build as it inlines the code — so an ordinary namespace import
+ * works and produces the flat shape the browser bundle expects. The Node twin's
+ * `createRequire` has no browser equivalent (there is no `node:module`), which
+ * is the whole reason these two files exist separately; `#eas-sdk-namespace` in
+ * the package's `imports` map selects this one under the `browser` condition.
+ */
+import * as easSdkNamespace from '@ethereum-attestation-service/eas-sdk';
+export default easSdkNamespace;

package/dist/eas-sdk-namespace.browser.js

@@ -0,0 +1,14 @@
+/**
+ * Browser resolution of the Ethereum Attestation Service software development
+ * kit.
+ *
+ * A bundler (Vite/Rollup, esbuild in browser mode) compiles this build, and
+ * unlike plain Node it adds the missing file extensions throughout the kit's
+ * ECMAScript build as it inlines the code — so an ordinary namespace import
+ * works and produces the flat shape the browser bundle expects. The Node twin's
+ * `createRequire` has no browser equivalent (there is no `node:module`), which
+ * is the whole reason these two files exist separately; `#eas-sdk-namespace` in
+ * the package's `imports` map selects this one under the `browser` condition.
+ */
+import * as easSdkNamespace from '@ethereum-attestation-service/eas-sdk';
+export default easSdkNamespace;

package/dist/eas-sdk-namespace.node.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Node resolution of the Ethereum Attestation Service software development kit.
+ *
+ * Plain Node's ECMAScript-module resolver rejects the kit's published
+ * ECMAScript build outright: its relative imports carry no file extension
+ * (`export ... from './eas'`), and so do a transitive dependency's subpaths
+ * (`lodash/isEqual`). Node's own resolver treats those as fatal —
+ * ERR_MODULE_NOT_FOUND — which crashed the gate's identity-verify route the
+ * instant it loaded `@provex/eas/build` at runtime (the built gate runs exactly
+ * that resolver, with this package left external).
+ *
+ * CommonJS `require` resolves every one of those extensionless paths
+ * transparently, across the whole dependency subtree, so this file forces the
+ * kit's `require` condition through createRequire. Callers load it lazily, so
+ * the kit still never touches the process boot path — the boot-safety property
+ * the gate depends on is preserved.
+ *
+ * The browser twin (`eas-sdk-namespace.browser.ts`) resolves the kit the other
+ * way; `#eas-sdk-namespace` in the package's `imports` map picks between them.
+ */
+import type * as EasSdkModule from '@ethereum-attestation-service/eas-sdk';
+declare const easSdkNamespace: typeof EasSdkModule;
+export default easSdkNamespace;

package/dist/eas-sdk-namespace.node.js

@@ -0,0 +1,24 @@
+/**
+ * Node resolution of the Ethereum Attestation Service software development kit.
+ *
+ * Plain Node's ECMAScript-module resolver rejects the kit's published
+ * ECMAScript build outright: its relative imports carry no file extension
+ * (`export ... from './eas'`), and so do a transitive dependency's subpaths
+ * (`lodash/isEqual`). Node's own resolver treats those as fatal —
+ * ERR_MODULE_NOT_FOUND — which crashed the gate's identity-verify route the
+ * instant it loaded `@provex/eas/build` at runtime (the built gate runs exactly
+ * that resolver, with this package left external).
+ *
+ * CommonJS `require` resolves every one of those extensionless paths
+ * transparently, across the whole dependency subtree, so this file forces the
+ * kit's `require` condition through createRequire. Callers load it lazily, so
+ * the kit still never touches the process boot path — the boot-safety property
+ * the gate depends on is preserved.
+ *
+ * The browser twin (`eas-sdk-namespace.browser.ts`) resolves the kit the other
+ * way; `#eas-sdk-namespace` in the package's `imports` map picks between them.
+ */
+import { createRequire } from 'node:module';
+const requireFromHere = createRequire(import.meta.url);
+const easSdkNamespace = requireFromHere('@ethereum-attestation-service/eas-sdk');
+export default easSdkNamespace;

package/dist/offchain-verify.d.ts

@@ -78,6 +78,31 @@ export declare const isOffchainAttestationShape: (value: unknown) => value is Of
  * attestation."
  */
 export declare const liftWireOffchainAttestation: (wire: Record<string, unknown>) => OffchainEasAttestation | null;
+/**
+ * Wire form of an off-chain attestation: identical to
+ * {@link OffchainEasAttestation} except `message.time` and
+ * `message.expirationTime` are base-10 strings rather than `bigint`.
+ */
+export type WireOffchainAttestation = Omit<OffchainEasAttestation, 'message'> & {
+    message: Omit<OffchainEasAttestation['message'], 'time' | 'expirationTime'> & {
+        time: string;
+        expirationTime: string;
+    };
+};
+/**
+ * Lower a signed off-chain attestation to its wire form, so it survives
+ * `JSON.stringify` — which throws outright on `bigint`.
+ *
+ * This is the exact inverse of {@link liftWireOffchainAttestation}, and the two
+ * are pinned as a round-trip pair by a test. Every server returning an
+ * attestation to a client must go through here: a raw `res.json(attestation)`
+ * does not fail gracefully, it throws `TypeError: Do not know how to serialize
+ * a BigInt` and turns a successful issuance into a 500.
+ *
+ * Only the two bigint fields are touched — the signature and every hashed field
+ * are copied verbatim, so lowering can never invalidate the attestation.
+ */
+export declare const toWireOffchainAttestation: (attestation: OffchainEasAttestation) => WireOffchainAttestation;
 export type OffchainSignatureCheck = {
     /** Signature recovered cleanly and (when an expected signer was given) matched. */
     valid: boolean;

package/dist/offchain-verify.js

@@ -170,6 +170,27 @@ export const liftWireOffchainAttestation = (wire) => {
         },
     };
 };
+/**
+ * Lower a signed off-chain attestation to its wire form, so it survives
+ * `JSON.stringify` — which throws outright on `bigint`.
+ *
+ * This is the exact inverse of {@link liftWireOffchainAttestation}, and the two
+ * are pinned as a round-trip pair by a test. Every server returning an
+ * attestation to a client must go through here: a raw `res.json(attestation)`
+ * does not fail gracefully, it throws `TypeError: Do not know how to serialize
+ * a BigInt` and turns a successful issuance into a 500.
+ *
+ * Only the two bigint fields are touched — the signature and every hashed field
+ * are copied verbatim, so lowering can never invalidate the attestation.
+ */
+export const toWireOffchainAttestation = (attestation) => ({
+    ...attestation,
+    message: {
+        ...attestation.message,
+        time: attestation.message.time.toString(),
+        expirationTime: attestation.message.expirationTime.toString(),
+    },
+});
 /**
  * Recover the signing address from an off-chain EAS attestation and
  * report whether the signature is cryptographically valid.

package/dist/offchain-verify.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { privateKeyToAccount } from 'viem/accounts';
 import { buildOffchainEasAttestation, encodeIdentityClaim, encodeReleaseClaim, } from './eas-builder.js';
 import { EAS_MAINNET_ADDRESS, PROVEX_IDENTITY_SCHEMA_UID } from './eas.js';
-import { decodeIdentityClaim, decodeReleaseClaim, liftWireOffchainAttestation, recoverOffchainAttestationSigner, } from './offchain-verify.js';
+import { decodeIdentityClaim, decodeReleaseClaim, liftWireOffchainAttestation, recoverOffchainAttestationSigner, toWireOffchainAttestation, } from './offchain-verify.js';
 const TEST_KEY = '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d';
 const SAMPLE_CLAIM = {
     platformHash: ('0x' + '11'.repeat(32)),
@@ -51,6 +51,36 @@ describe('liftWireOffchainAttestation', () => {
         assert.equal(liftWireOffchainAttestation({ not: 'an attestation' }), null);
     });
 });
+describe('toWireOffchainAttestation', () => {
+    it('produces output JSON.stringify accepts, which the raw attestation does not', async () => {
+        const signed = await signedSample();
+        // The whole reason this function exists: the raw form is unserializable.
+        assert.throws(() => JSON.stringify(signed), TypeError);
+        assert.doesNotThrow(() => JSON.stringify(toWireOffchainAttestation(signed)));
+    });
+    it('agrees with the bigint JSON replacer the UI already consumes', async () => {
+        const signed = await signedSample();
+        // `toWire` is an independent implementation (a JSON replacer, matching the
+        // notary-gate's existing convention). Agreement proves the new producer
+        // emits the exact shape every existing consumer is already parsing —
+        // otherwise this helper would silently fork the wire format.
+        assert.deepEqual(JSON.parse(JSON.stringify(toWireOffchainAttestation(signed))), toWire(signed));
+    });
+    it('round-trips through liftWireOffchainAttestation unchanged', async () => {
+        const signed = await signedSample();
+        const lifted = liftWireOffchainAttestation(JSON.parse(JSON.stringify(toWireOffchainAttestation(signed))));
+        assert.ok(lifted);
+        assert.deepEqual(lifted, signed);
+    });
+    it('preserves the signature, so lowering cannot invalidate an attestation', async () => {
+        const signed = await signedSample();
+        const lifted = liftWireOffchainAttestation(JSON.parse(JSON.stringify(toWireOffchainAttestation(signed))));
+        assert.ok(lifted);
+        const check = await recoverOffchainAttestationSigner(lifted);
+        assert.equal(check.valid, true);
+        assert.equal(check.signer?.toLowerCase(), privateKeyToAccount(TEST_KEY).address.toLowerCase());
+    });
+});
 describe('recoverOffchainAttestationSigner', () => {
     it('recovers the gate signer from a genuine attestation', async () => {
         const attester = privateKeyToAccount(TEST_KEY);

package/dist/viem-only.test.js

@@ -69,11 +69,18 @@ describe('viem-only invariant for @provex/eas/verify', () => {
         const reached = reachablePackageSpecifiers(resolve(HERE, 'offchain-verify.ts'));
         assert.deepEqual([...reached].sort(), ['viem']);
     });
-    it('confirms the builder DOES reach the software development kit, proving the walker works', () => {
+    it('confirms the software development kit IS reached where used, proving the walker works', () => {
         // WHY: a graph walker that silently resolves nothing would make the two
-        // assertions above vacuously pass. `eas-builder.ts` is the known-positive
-        // control — it must import the software development kit at runtime.
-        const reached = reachablePackageSpecifiers(resolve(HERE, 'eas-builder.ts'));
+        // assertions above vacuously pass, so it needs a known-positive control —
+        // a file that genuinely imports the software development kit at runtime.
+        //
+        // `eas-builder.ts` reaches the kit only transitively now, through the
+        // `#eas-sdk-namespace` conditional import (a bare specifier the walker
+        // treats as a leaf, exactly as it treats `viem`). The direct static import
+        // lives in `eas-sdk-namespace.browser.ts` — the browser half of that
+        // conditional — so that is the control. This still proves the walker
+        // detects the kit, and pins that the browser namespace path pulls it in.
+        const reached = reachablePackageSpecifiers(resolve(HERE, 'eas-sdk-namespace.browser.ts'));
         assert.ok(reached.has(EAS_SOFTWARE_DEVELOPMENT_KIT));
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provex/eas",
-  "version": "1.9.2",
+  "version": "1.10.0-rc.20260912192040.fdbb8fc",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
@@ -9,6 +9,15 @@
     "url": "git+https://github.com/provex-tech/monorepo.git",
     "directory": "packages/eas"
   },
+  "publishConfig": {
+    "access": "public"
+  },
+  "imports": {
+    "#eas-sdk-namespace": {
+      "browser": "./dist/eas-sdk-namespace.browser.js",
+      "default": "./dist/eas-sdk-namespace.node.js"
+    }
+  },
   "exports": {
     ".": {
       "import": "./dist/index.js",
@@ -56,4 +65,4 @@
     "typescript": "^5.9.2",
     "viem": "^2.38.0"
   }
-}
+}