@thurinlabs/identity-kit 1.0.2 → 1.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Thurin Labs LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -264,6 +264,10 @@ The card talks directly to Ethereum and each proof platform — no intermediary,
 | Codeberg | Repository description |
 | Mastodon | Profile metadata |
 
+## How a claim is verified
+
+`verifyAttestation` checks three things: the stored key's fingerprint is the one on the claim; the stored clearsigned statement was made by that key (or one of its bound signing subkeys) and has not been altered; and the statement names the claim's address. Key validity is judged **now**, the way gpg does it: the key must currently be bound, unrevoked, and unexpired. It is deliberately not judged at the instant the signature was made, which is openpgp.js's default. That default rejects a perfectly good claim whenever the key's newest self-certification postdates the attest signature, which is exactly what happens when you add a proof after attesting and export with `export-minimal` (1.0.3).
+
 ## Key algorithms
 
 Any curve openpgp.js can compute is accepted: Ed25519, Cv25519, NIST P-256/384/521, brainpool, RSA, and **secp256k1**. openpgp.js rejects secp256k1 by default because RFC 9580 does not list it; identity-kit turns that rejection off, since it is a compatibility rule, not a security one. A secp256k1 PGP key doubles as an Ethereum key (the address is derived from the same public point), so anything that can sign with the PGP key can sign Ethereum transactions: hold such a key if you like, but do not fund its derived address. In Node, openpgp.js needs the `eckey-utils` package for this curve; identity-kit depends on it, so `npm install` brings it in. The browser build needs nothing extra.

package/dist/embed.global.js

@@ -31148,7 +31148,9 @@ ${prettyStateOverride(stateOverride)}`;
   }
 
   // src/core/pgp.ts
-  var PGP_CONFIG = { rejectCurves: /* @__PURE__ */ new Set() };
+  function pgpConfig(openpgp) {
+    return { ...openpgp.config, rejectCurves: /* @__PURE__ */ new Set() };
+  }
   function algorithmName(keyOrSubkey) {
     try {
       const info = keyOrSubkey.getAlgorithmInfo();
@@ -31170,7 +31172,9 @@ ${prettyStateOverride(stateOverride)}`;
   }
   async function parsePgpKey(armoredKey) {
     try {
-      const { readKey } = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const openpgp = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const { readKey } = openpgp;
+      const config = pgpConfig(openpgp);
       const key = await readKey({ armoredKey });
       const fingerprint = key.getFingerprint().toUpperCase();
       const algorithm = algorithmName(key);
@@ -31191,7 +31195,10 @@ ${prettyStateOverride(stateOverride)}`;
               cert.signatureType,
               { userID: user.userID, key: key.keyPacket },
               void 0,
-              PGP_CONFIG
+              // date: now
+              void 0,
+              // detached
+              config
             );
           } catch {
             continue;
@@ -31235,15 +31242,28 @@ ${prettyStateOverride(stateOverride)}`;
       if (!pgpPublicKey || !pgpSignature) {
         return { verified: false, reason: "Missing PGP data" };
       }
-      const { readKey, readCleartextMessage, verify } = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const openpgp = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const { readKey, readCleartextMessage, LiteralDataPacket } = openpgp;
+      const config = pgpConfig(openpgp);
       const publicKey = await readKey({ armoredKey: pgpPublicKey });
       const keyFingerprint = publicKey.getFingerprint().toUpperCase();
       if (keyFingerprint !== fingerprint.toUpperCase()) {
         return { verified: false, reason: "Key fingerprint mismatch" };
       }
       const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-      const { signatures } = await verify({ message, verificationKeys: publicKey, config: PGP_CONFIG });
-      await signatures[0].verified;
+      const msg = message;
+      const now = /* @__PURE__ */ new Date();
+      let signed2 = false;
+      for (const sig of msg.signature.packets) {
+        if (!publicKey.getKeys(sig.issuerKeyID).length) continue;
+        const signingKey = await publicKey.getSigningKey(sig.issuerKeyID, now, void 0, config);
+        const literal = new LiteralDataPacket();
+        literal.setText(msg.text ?? message.getText().replace(/\r?\n/g, "\r\n"));
+        await sig.verify(signingKey.keyPacket, sig.signatureType, literal, now, true, config);
+        signed2 = true;
+        break;
+      }
+      if (!signed2) return { verified: false, reason: "Message is not signed by this key" };
       const signedText = message.getText();
       if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
         return { verified: false, reason: "Signed message does not contain ETH address" };
@@ -31333,25 +31353,28 @@ ${prettyStateOverride(stateOverride)}`;
   var EFP_API = "https://api.ethfollow.xyz/api/v1";
   async function fetchEFPGraph(address) {
     try {
-      const listsResp = await fetch(`${EFP_API}/users/${address}/lists`);
-      if (!listsResp.ok) return null;
-      const listsData = await listsResp.json();
-      const listId = listsData.primary_list;
-      if (!listId) return null;
-      const [followingResp, statsResp, top8Resp] = await Promise.all([
-        fetch(`${EFP_API}/lists/${listId}/following?limit=100`),
+      const [statsResp, listsResp] = await Promise.all([
         fetch(`${EFP_API}/users/${address}/stats`),
-        fetch(`${EFP_API}/lists/${listId}/following?limit=8&tags=top8`)
+        fetch(`${EFP_API}/users/${address}/lists`)
       ]);
-      const followingData = followingResp.ok ? await followingResp.json() : { following: [] };
+      if (!statsResp.ok && !listsResp.ok) return null;
       const statsData = statsResp.ok ? await statsResp.json() : {};
-      const top8Data = top8Resp.ok ? await top8Resp.json() : { following: [] };
-      return {
-        followers: parseInt(statsData.followers_count) || 0,
-        following: (followingData.following || []).length,
-        top8: (top8Data.following || []).map((f2) => f2.data),
-        hasEfp: true
-      };
+      const listsData = listsResp.ok ? await listsResp.json() : {};
+      const followers = parseInt(statsData.followers_count) || 0;
+      const listId = listsData.primary_list;
+      let following = 0;
+      let top8 = [];
+      if (listId) {
+        const [followingResp, top8Resp] = await Promise.all([
+          fetch(`${EFP_API}/lists/${listId}/following?limit=100`),
+          fetch(`${EFP_API}/lists/${listId}/following?limit=8&tags=top8`)
+        ]);
+        const followingData = followingResp.ok ? await followingResp.json() : { following: [] };
+        const top8Data = top8Resp.ok ? await top8Resp.json() : { following: [] };
+        following = (followingData.following || []).length;
+        top8 = (top8Data.following || []).map((f2) => f2.data);
+      }
+      return { followers, following, top8, hasEfp: !!listId || followers > 0 };
     } catch {
       return null;
     }