@thurinlabs/identity-kit 1.0.0 → 1.0.1

package/README.md

@@ -258,7 +258,7 @@ The card talks directly to Ethereum and each proof platform — no intermediary,
 
 | Provider | Proof Method |
 |----------|-------------|
-| GitHub | Public gist |
+| GitHub | Public gist, or a repository description (the form an organisation can use) |
 | DNS | TXT record |
 | Farcaster | Public cast (requires Neynar API key) |
 | Codeberg | Repository description |

package/dist/embed.global.js

@@ -31376,6 +31376,14 @@ ${prettyStateOverride(stateOverride)}`;
       pattern: /^https:\/\/gist\.github\.com\/([^/]+)\/([a-f0-9]+)$/i,
       parse: (m2) => ({ user: m2[1], gistId: m2[2] })
     },
+    {
+      // A repository's description — the form an organisation can use, since
+      // gists belong to user accounts only. Same shape as the Codeberg proof.
+      provider: "github",
+      label: "GitHub",
+      pattern: /^https:\/\/github\.com\/([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/i,
+      parse: (m2) => ({ user: m2[1], repo: m2[2] })
+    },
     {
       provider: "dns",
       label: "DNS",
@@ -31447,6 +31455,7 @@ ${prettyStateOverride(stateOverride)}`;
     return text.toUpperCase().includes(fingerprint.toUpperCase());
   }
   async function verifyGitHub(proof, fingerprint) {
+    if (proof.repo) return verifyGitHubRepo(proof, fingerprint);
     try {
       const resp = await fetch(`https://api.github.com/gists/${proof.gistId}`);
       if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
@@ -31464,6 +31473,24 @@ ${prettyStateOverride(stateOverride)}`;
       return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
     }
   }
+  async function verifyGitHubRepo(proof, fingerprint) {
+    try {
+      const resp = await fetch(
+        `https://api.github.com/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
+      );
+      if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
+      const data = await resp.json();
+      if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
+        return { verified: false, reason: "Repository owner does not match claimed account" };
+      }
+      if (data.description && containsFingerprint(data.description, fingerprint)) {
+        return { verified: true };
+      }
+      return { verified: false, reason: "Fingerprint token not found in repository description" };
+    } catch (err) {
+      return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+    }
+  }
   async function verifyDNS(proof, fingerprint) {
     try {
       const resp = await fetch(