@sekyuriti/attest 0.2.4

package/README.md

@@ -0,0 +1,99 @@
+# @sekyuriti/attest
+
+API protection for Next.js applications. Verify that requests come from real browsers, not bots or scripts.
+
+## Quick Start
+
+One command setup:
+
+```bash
+npx @sekyuriti/attest login
+```
+
+This will:
+1. Open browser for authentication
+2. Let you select your project
+3. Auto-add environment variables to `.env.local`
+4. Auto-inject the ATTEST script into `layout.tsx`
+
+Done. Your API is protected.
+
+## What It Does
+
+- **Frontend script** automatically signs all `fetch()` and `XMLHttpRequest` calls
+- **Backend verification** validates signatures with SEKYURITI's API
+- **Bots and scripts** can't generate valid signatures without running in a real browser
+
+## Optional: Middleware
+
+Add server-side verification for all API routes:
+
+```ts
+// middleware.ts
+import { createAttestMiddleware } from "@sekyuriti/attest/middleware";
+
+export const middleware = createAttestMiddleware({
+  projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
+  apiKey: process.env.ATTEST_SECRET_KEY!,
+});
+
+export const config = {
+  matcher: "/api/:path*",
+};
+```
+
+## Optional: Per-Route Verification
+
+```ts
+// app/api/protected/route.ts
+import { verifyAttest } from "@sekyuriti/attest";
+
+export async function POST(request: Request) {
+  const result = await verifyAttest(request, {
+    projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
+    apiKey: process.env.ATTEST_SECRET_KEY!,
+  });
+
+  if (!result.attested) {
+    return Response.json({ error: "Not attested" }, { status: 403 });
+  }
+
+  // Handle request...
+}
+```
+
+## CLI Commands
+
+```bash
+attest login     # Authenticate and setup project
+attest logout    # Sign out
+attest status    # Show account and usage info
+attest init      # Re-run setup in current project
+attest whoami    # Print current user email
+attest help      # Show help
+```
+
+## Environment Variables
+
+Auto-generated by `attest login`:
+
+```env
+NEXT_PUBLIC_ATTEST_KEY=your_public_key
+ATTEST_SECRET_KEY=your_secret_key
+```
+
+## Protection Features
+
+- DevTools detection
+- Bot/headless browser detection
+- Request signing with HMAC-SHA256
+- Browser fingerprinting
+- Timestamp validation
+
+## Documentation
+
+https://sekyuriti.build/docs/attest
+
+## License
+
+MIT