@thurinlabs/identity-kit 1.0.2 → 1.0.4

package/dist/index.d.cts

@@ -1276,6 +1276,12 @@ declare function hasEmailUserID(armoredKey: string): Promise<boolean>;
 declare function fetchKeyByFingerprint(fingerprint: string): Promise<string | null>;
 declare function fetchKeyByKeyId(keyId: string): Promise<string | null>;
 
+/**
+ * EFP social graph for an address. Followers are counted by EFP for any address,
+ * whether or not it has published a list of its own; following and top-8 exist
+ * only when it has (its "primary list"). An address with followers but no list
+ * — a project account that has never followed anyone — is still on EFP.
+ */
 declare function fetchEFPGraph(address: string): Promise<EFPGraph | null>;
 
 /** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */

package/dist/index.d.ts

@@ -1276,6 +1276,12 @@ declare function hasEmailUserID(armoredKey: string): Promise<boolean>;
 declare function fetchKeyByFingerprint(fingerprint: string): Promise<string | null>;
 declare function fetchKeyByKeyId(keyId: string): Promise<string | null>;
 
+/**
+ * EFP social graph for an address. Followers are counted by EFP for any address,
+ * whether or not it has published a list of its own; following and top-8 exist
+ * only when it has (its "primary list"). An address with followers but no list
+ * — a project account that has never followed anyone — is still on EFP.
+ */
 declare function fetchEFPGraph(address: string): Promise<EFPGraph | null>;
 
 /** Normalize a fingerprint to lowercase hex with no prefix or spaces. Returns null if malformed. */

package/dist/index.js

@@ -1339,7 +1339,9 @@ function keyIdToBytes(keyId) {
 }
 
 // src/core/pgp.ts
-var PGP_CONFIG = { rejectCurves: /* @__PURE__ */ new Set() };
+function pgpConfig(openpgp) {
+  return { ...openpgp.config, rejectCurves: /* @__PURE__ */ new Set() };
+}
 function algorithmName(keyOrSubkey) {
   try {
     const info = keyOrSubkey.getAlgorithmInfo();
@@ -1361,7 +1363,9 @@ function algorithmName(keyOrSubkey) {
 }
 async function parsePgpKey(armoredKey) {
   try {
-    const { readKey } = await import("openpgp");
+    const openpgp = await import("openpgp");
+    const { readKey } = openpgp;
+    const config = pgpConfig(openpgp);
     const key = await readKey({ armoredKey });
     const fingerprint = key.getFingerprint().toUpperCase();
     const algorithm = algorithmName(key);
@@ -1382,7 +1386,10 @@ async function parsePgpKey(armoredKey) {
             cert.signatureType,
             { userID: user.userID, key: key.keyPacket },
             void 0,
-            PGP_CONFIG
+            // date: now
+            void 0,
+            // detached
+            config
           );
         } catch {
           continue;
@@ -1426,15 +1433,28 @@ async function verifyAttestation({
     if (!pgpPublicKey || !pgpSignature) {
       return { verified: false, reason: "Missing PGP data" };
     }
-    const { readKey, readCleartextMessage, verify } = await import("openpgp");
+    const openpgp = await import("openpgp");
+    const { readKey, readCleartextMessage, LiteralDataPacket } = openpgp;
+    const config = pgpConfig(openpgp);
     const publicKey = await readKey({ armoredKey: pgpPublicKey });
     const keyFingerprint = publicKey.getFingerprint().toUpperCase();
     if (keyFingerprint !== fingerprint.toUpperCase()) {
       return { verified: false, reason: "Key fingerprint mismatch" };
     }
     const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-    const { signatures } = await verify({ message, verificationKeys: publicKey, config: PGP_CONFIG });
-    await signatures[0].verified;
+    const msg = message;
+    const now = /* @__PURE__ */ new Date();
+    let signed = false;
+    for (const sig of msg.signature.packets) {
+      if (!publicKey.getKeys(sig.issuerKeyID).length) continue;
+      const signingKey = await publicKey.getSigningKey(sig.issuerKeyID, now, void 0, config);
+      const literal = new LiteralDataPacket();
+      literal.setText(msg.text ?? message.getText().replace(/\r?\n/g, "\r\n"));
+      await sig.verify(signingKey.keyPacket, sig.signatureType, literal, now, true, config);
+      signed = true;
+      break;
+    }
+    if (!signed) return { verified: false, reason: "Message is not signed by this key" };
     const signedText = message.getText();
     if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
       return { verified: false, reason: "Signed message does not contain ETH address" };
@@ -1579,25 +1599,28 @@ import { useQuery as useQuery2 } from "@tanstack/react-query";
 var EFP_API = "https://api.ethfollow.xyz/api/v1";
 async function fetchEFPGraph(address) {
   try {
-    const listsResp = await fetch(`${EFP_API}/users/${address}/lists`);
-    if (!listsResp.ok) return null;
-    const listsData = await listsResp.json();
-    const listId = listsData.primary_list;
-    if (!listId) return null;
-    const [followingResp, statsResp, top8Resp] = await Promise.all([
-      fetch(`${EFP_API}/lists/${listId}/following?limit=100`),
+    const [statsResp, listsResp] = await Promise.all([
       fetch(`${EFP_API}/users/${address}/stats`),
-      fetch(`${EFP_API}/lists/${listId}/following?limit=8&tags=top8`)
+      fetch(`${EFP_API}/users/${address}/lists`)
     ]);
-    const followingData = followingResp.ok ? await followingResp.json() : { following: [] };
+    if (!statsResp.ok && !listsResp.ok) return null;
     const statsData = statsResp.ok ? await statsResp.json() : {};
-    const top8Data = top8Resp.ok ? await top8Resp.json() : { following: [] };
-    return {
-      followers: parseInt(statsData.followers_count) || 0,
-      following: (followingData.following || []).length,
-      top8: (top8Data.following || []).map((f) => f.data),
-      hasEfp: true
-    };
+    const listsData = listsResp.ok ? await listsResp.json() : {};
+    const followers = parseInt(statsData.followers_count) || 0;
+    const listId = listsData.primary_list;
+    let following = 0;
+    let top8 = [];
+    if (listId) {
+      const [followingResp, top8Resp] = await Promise.all([
+        fetch(`${EFP_API}/lists/${listId}/following?limit=100`),
+        fetch(`${EFP_API}/lists/${listId}/following?limit=8&tags=top8`)
+      ]);
+      const followingData = followingResp.ok ? await followingResp.json() : { following: [] };
+      const top8Data = top8Resp.ok ? await top8Resp.json() : { following: [] };
+      following = (followingData.following || []).length;
+      top8 = (top8Data.following || []).map((f) => f.data);
+    }
+    return { followers, following, top8, hasEfp: !!listId || followers > 0 };
   } catch {
     return null;
   }