@thurinlabs/identity-kit 0.7.0 → 0.7.2

package/README.md

@@ -1,6 +1,12 @@
 # @thurinlabs/identity-kit
 
-React SDK for embedding Thurin identity data. Drop-in components and hooks for displaying on-chain identity claims, PGP verification, social proofs, and EFP social graph data.
+The shared library for Thurin identity — the single source of truth for looking up and **verifying** on-chain identity claims, PGP key proofs, social proofs, and EFP social graph data. It powers both the [Scry](https://thurin.id) explorer and the embeddable `ScryCard`, so a "verified" result means the same thing everywhere.
+
+Three layers — use whichever fits:
+
+- **Core** — framework-agnostic functions (verify proofs, parse PGP keys, fetch EFP/claims). No React required.
+- **Hooks** — thin React wrappers around the core.
+- **ScryCard** — a drop-in identity card UI built on the hooks.
 
 A [Thurin Labs](https://thurin.id) project.
 
@@ -115,6 +121,55 @@ const { keyInfo, proofs, isLoading } = usePGPProofs('03E53D807CE38C...')
 // proofs[].provider, proofs[].status, proofs[].displayUrl
 ```
 
+## Core utilities (no React)
+
+The verification and data logic is exported as plain functions — no React, no provider. This is the layer the Scry explorer and the hooks both build on; use it directly when you need the validated data behind your own UI.
+
+### Proofs
+
+```ts
+import { identifyProof, verifyProof, displayUrl, proofHref, proofSecondaryHref } from '@thurinlabs/identity-kit'
+
+const proof = identifyProof({ name: 'proof@thurin.id', value: 'https://gist.github.com/alice/abc123' })
+// → { provider: 'github', label: 'GitHub', user: 'alice', gistId: 'abc123', url }
+
+const result = await verifyProof(proof, fingerprint, neynarApiKey /* only needed for Farcaster */)
+// → { verified: boolean, reason?: string }
+```
+
+`verifyProof` performs the real check per provider — including confirming the GitHub gist is **owned** by the claimed user, so a proof can't be forged by pointing at someone else's gist ID. `displayUrl` / `proofHref` / `proofSecondaryHref` build the display string and links.
+
+### PGP
+
+```ts
+import { parsePgpKey, verifyAttestation, fetchKeyByFingerprint, fetchKeyByKeyId } from '@thurinlabs/identity-kit'
+
+const keyInfo = await parsePgpKey(armoredKey)
+// → { fingerprint, userIDs, algorithm, created, expires, notations, subkeys } | null
+
+const verification = await verifyAttestation({ pgpPublicKey, pgpSignature, fingerprint, ethAddress })
+// → { verified: boolean, reason?: string }
+
+const armored = await fetchKeyByFingerprint(fingerprint) // from keys.openpgp.org
+```
+
+### EFP & claims
+
+```ts
+import { fetchEFPGraph } from '@thurinlabs/identity-kit'
+
+const graph = await fetchEFPGraph(address)
+// → { followers, following, top8: string[], hasEfp } | null
+```
+
+### Contract constants
+
+```ts
+import { REGISTRY_ADDRESS, REGISTRY_ABI, CONTRACT_DEPLOY_BLOCK } from '@thurinlabs/identity-kit'
+```
+
+Note `REGISTRY_ABI` here is read-only (events + `attestationCount` + `getAttestation`). Apps that write claims (the Signet flow) need their own ABI with the `attest`/`revoke` functions.
+
 ## Themes
 
 Three built-in themes: `thurin`, `dark`, `light`. All styles are scoped under `[data-scry-theme]` with `scry-` prefixed class names to avoid conflicts with your app's styles.
@@ -168,6 +223,7 @@ npm test
 - [Scry](https://thurin.id) — Identity explorer
 - [Signet](https://thurin.id/signet) — Create identity claims
 - [Documentation](https://docs.thurin.id)
+- [GitHub](https://github.com/thurinlabs/identity-kit)
 - [Codeberg](https://codeberg.org/thurinlabs/identity-kit)
 
 ## License

package/dist/embed.global.js

@@ -39353,30 +39353,46 @@ ${prettyStateOverride(stateOverride)}`;
       const { readKey } = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
       const key = await readKey({ armoredKey });
       const fingerprint = key.getFingerprint().toUpperCase();
-      const userIDs = key.users.map((u2) => u2.userID?.userID).filter(Boolean);
       const algorithm = String(key.keyPacket.algorithm);
       const created = key.keyPacket.created?.toISOString() ?? null;
       const expiration = await key.getExpirationTime();
       const expires = expiration && expiration !== Infinity ? new Date(expiration).toISOString() : null;
+      const userIDs = [];
       const notations = [];
       const seen = /* @__PURE__ */ new Set();
       for (const user of key.users) {
-        if (!user.selfCertifications) continue;
-        for (const cert of user.selfCertifications) {
+        const certs = user.selfCertifications;
+        if (!certs || certs.length === 0) continue;
+        let userVerified = false;
+        for (const cert of certs) {
+          try {
+            await cert.verify(
+              key.keyPacket,
+              cert.signatureType,
+              { userID: user.userID, key: key.keyPacket }
+            );
+          } catch {
+            continue;
+          }
+          userVerified = true;
           if (cert.rawNotations) {
             for (const n2 of cert.rawNotations) {
               const name = typeof n2.name === "string" ? n2.name : new TextDecoder().decode(n2.name);
               const value = n2.value instanceof Uint8Array ? new TextDecoder().decode(n2.value) : typeof n2.value === "string" ? n2.value : null;
               if (value) {
-                const key2 = `${name}:${value}`;
-                if (!seen.has(key2)) {
-                  seen.add(key2);
+                const dedupeKey = `${name}:${value}`;
+                if (!seen.has(dedupeKey)) {
+                  seen.add(dedupeKey);
                   notations.push({ name, value });
                 }
               }
             }
           }
         }
+        if (userVerified) {
+          const uid3 = user.userID?.userID;
+          if (uid3) userIDs.push(uid3);
+        }
       }
       const subkeys = key.subkeys.map((sk) => ({
         algorithm: String(sk.keyPacket.algorithm),
@@ -39512,7 +39528,8 @@ ${prettyStateOverride(stateOverride)}`;
     });
     const isLoading = countLoading || attestationsLoading || verifyLoading;
     const activeClaims = (claims || []).filter((c2) => !c2.revoked);
-    const currentFingerprint = activeClaims.length > 0 ? activeClaims[activeClaims.length - 1].fingerprint : null;
+    const verifiedClaims = activeClaims.filter((c2) => c2.verification?.verified);
+    const currentFingerprint = verifiedClaims.length > 0 ? verifiedClaims[verifiedClaims.length - 1].fingerprint : null;
     return {
       claims: claims || [],
       totalClaims: attestationCount,
@@ -39575,7 +39592,9 @@ ${prettyStateOverride(stateOverride)}`;
     {
       provider: "dns",
       label: "DNS",
-      pattern: /^dns:([^?]+)\?type=TXT$/i,
+      // domain is restricted to a hostname (labels may include underscores for
+      // records like _thurin.example.com); rejects slashes, userinfo, and spaces.
+      pattern: /^dns:([a-z0-9._-]+)\?type=TXT$/i,
       parse: (m2) => ({ domain: m2[1] })
     },
     {
@@ -39593,7 +39612,9 @@ ${prettyStateOverride(stateOverride)}`;
     {
       provider: "mastodon",
       label: "Mastodon",
-      pattern: /^https:\/\/([^/]+)\/@([^/]+)$/i,
+      // instance is restricted to a bare hostname (optional port) so a value
+      // like "mastodon.social@evil.com" can't redirect the lookup elsewhere.
+      pattern: /^https:\/\/([a-z0-9.-]+(?::\d+)?)\/@([^/@?#\s]+)$/i,
       parse: (m2) => ({ instance: m2[1], user: m2[2] })
     }
   ];
@@ -39643,6 +39664,9 @@ ${prettyStateOverride(stateOverride)}`;
       const resp = await fetch(`https://api.github.com/gists/${proof.gistId}`);
       if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
       const data = await resp.json();
+      if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
+        return { verified: false, reason: "Gist owner does not match claimed user" };
+      }
       for (const file of Object.values(data.files || {})) {
         if (file.content && containsFingerprint(file.content, fingerprint)) {
           return { verified: true };
@@ -39662,6 +39686,7 @@ ${prettyStateOverride(stateOverride)}`;
       if (!resp.ok) return { verified: false, reason: `DNS query returned ${resp.status}` };
       const data = await resp.json();
       for (const answer of data.Answer || []) {
+        if (answer.type !== 16) continue;
         if (answer.data && containsFingerprint(answer.data, fingerprint)) {
           return { verified: true };
         }
@@ -39701,7 +39726,6 @@ ${prettyStateOverride(stateOverride)}`;
             if (containsFingerprint(text, fingerprint)) {
               return { verified: true };
             }
-            return { verified: false, reason: "Cast found but fingerprint token not in text" };
           }
         }
         if (!data.nextPageToken) break;
@@ -39729,6 +39753,9 @@ ${prettyStateOverride(stateOverride)}`;
   }
   async function verifyMastodon(proof, fingerprint) {
     try {
+      if (!proof.instance || !/^[a-z0-9.-]+(?::\d+)?$/i.test(proof.instance)) {
+        return { verified: false, reason: "Invalid Mastodon instance host" };
+      }
       const resp = await fetch(
         `https://${proof.instance}/api/v1/accounts/lookup?acct=${encodeURIComponent(proof.user)}`
       );