@thurinlabs/identity-kit 1.3.7 → 1.4.0

package/dist/core.js

@@ -1,6 +1,7 @@
 import {
   ARWEAVE_GATEWAY,
   AUTHORIZATION_TYPES,
+  CLAIM_CHECK_LABEL,
   EIP712_NAME,
   EIP712_VERSION,
   ENS_HINT_KEY,
@@ -23,17 +24,23 @@ import {
   avatarUrl,
   bytesToFingerprint,
   chainFor,
+  claimCheckText,
+  claimFateText,
+  claimFates,
   decodeRecord,
   displayUrl,
   encodeRecord,
   ensHintFor,
   ensHintValue,
   ensHintWrite,
+  expiresSoon,
+  expiresSoonText,
   fetchEFPGraph,
   fetchEnsHint,
   fetchRecords,
   fingerprintHash,
   fingerprintToBytes,
+  formatClaimDate,
   getRegistry,
   hasEmailUserID,
   identifyProof,
@@ -62,10 +69,11 @@ import {
   verifyAttestation,
   verifyClearsigned,
   verifyProof
-} from "./chunk-ROQWHCHP.js";
+} from "./chunk-ZAQ2EPF5.js";
 export {
   ARWEAVE_GATEWAY,
   AUTHORIZATION_TYPES,
+  CLAIM_CHECK_LABEL,
   EIP712_NAME,
   EIP712_VERSION,
   ENS_HINT_KEY,
@@ -88,17 +96,23 @@ export {
   avatarUrl,
   bytesToFingerprint,
   chainFor,
+  claimCheckText,
+  claimFateText,
+  claimFates,
   decodeRecord,
   displayUrl,
   encodeRecord,
   ensHintFor,
   ensHintValue,
   ensHintWrite,
+  expiresSoon,
+  expiresSoonText,
   fetchEFPGraph,
   fetchEnsHint,
   fetchRecords,
   fingerprintHash,
   fingerprintToBytes,
+  formatClaimDate,
   getRegistry,
   hasEmailUserID,
   identifyProof,

package/dist/embed.global.js

@@ -31342,6 +31342,61 @@ ${prettyStateOverride(stateOverride)}`;
       return { verified: false, reason: err instanceof Error ? err.message : "Verification failed", text: "" };
     }
   }
+  var REVOCATION_REASON = {
+    // 0 = "no reason specified", gpg's default: say nothing rather than "(reason: no reason given)"
+    1: "replaced by a newer key",
+    2: "compromised",
+    3: "no longer used",
+    32: "a user ID is no longer valid"
+  };
+  var iso = (d2) => d2 instanceof Date ? d2.toISOString() : typeof d2 === "number" && Number.isFinite(d2) ? new Date(d2).toISOString() : null;
+  function revocationOf(sigs) {
+    const sig = [...sigs ?? []].sort((a2, b2) => (b2.created?.getTime?.() ?? 0) - (a2.created?.getTime?.() ?? 0))[0];
+    const flag = sig?.reasonForRevocationFlag ?? null;
+    return {
+      at: iso(sig?.created),
+      compromised: flag === 2,
+      revocationReason: sig?.reasonForRevocationString || (flag !== null ? REVOCATION_REASON[flag] ?? null : null)
+    };
+  }
+  async function keyLife(openpgp, key, clearsigned, config) {
+    const now = /* @__PURE__ */ new Date();
+    let issuer = null;
+    try {
+      issuer = (await openpgp.readCleartextMessage({ cleartextMessage: clearsigned })).signature.packets[0]?.issuerKeyID ?? null;
+    } catch {
+    }
+    const signer = issuer && !key.getKeyID().equals(issuer) ? key.subkeys.find((s2) => s2.getKeyID().equals(issuer)) ?? null : key;
+    const signingKey = signer ? signer.getFingerprint().toUpperCase() : null;
+    const safe = async (f2, fallback2) => {
+      try {
+        return await f2();
+      } catch {
+        return fallback2;
+      }
+    };
+    const keyRevoked = await safe(() => key.isRevoked(void 0, void 0, now, config), false);
+    const keyExp = await safe(() => key.getExpirationTime(void 0, config), null);
+    const isSub = signer && signer !== key;
+    const subRevoked = isSub ? await safe(() => signer.isRevoked(null, key.keyPacket, now, config), false) : false;
+    const subExp = isSub ? await safe(() => signer.getExpirationTime(null, config), null) : null;
+    const finite = (d2) => d2 instanceof Date && Number.isFinite(d2.getTime()) ? d2 : null;
+    const kExp = finite(keyExp), sExp = finite(subExp);
+    let problem = null;
+    if (keyRevoked) {
+      const r2 = revocationOf(key.revocationSignatures);
+      problem = { kind: r2.compromised ? "compromised" : "revoked", at: r2.at, revocationReason: r2.revocationReason };
+    } else if (kExp && kExp <= now) {
+      problem = { kind: "expired", at: kExp.toISOString() };
+    } else if (subRevoked) {
+      const r2 = revocationOf(signer.revocationSignatures);
+      problem = { kind: r2.compromised ? "compromised" : "signing-key-revoked", at: r2.at, revocationReason: r2.revocationReason };
+    } else if (sExp && sExp <= now) {
+      problem = { kind: "signing-key-expired", at: sExp.toISOString() };
+    }
+    const earliest = [kExp, sExp].filter(Boolean).sort((a2, b2) => a2 - b2)[0];
+    return { problem, signingKey, expiresAt: earliest ? earliest.toISOString() : null, algorithm: algorithmName(signer ?? key) };
+  }
   async function verifyAttestation({
     pgpPublicKey,
     pgpSignature,
@@ -31350,24 +31405,31 @@ ${prettyStateOverride(stateOverride)}`;
   }) {
     try {
       if (!pgpPublicKey || !pgpSignature) {
-        return { verified: false, reason: "Missing PGP data" };
+        return { verified: false, reason: "Missing PGP data", kind: "bad-signature" };
       }
       const openpgp = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
       const { readKey } = openpgp;
       const publicKey = await readKey({ armoredKey: pgpPublicKey });
       const keyFingerprint = publicKey.getFingerprint().toUpperCase();
       if (keyFingerprint !== fingerprint.toUpperCase()) {
-        return { verified: false, reason: "Key fingerprint mismatch" };
+        return { verified: false, reason: "Key fingerprint mismatch", kind: "bad-signature" };
       }
+      const life = await keyLife(openpgp, publicKey, pgpSignature, pgpConfig(openpgp));
       const v2 = await verifyClearsigned({ armoredKey: pgpPublicKey, clearsigned: pgpSignature });
-      if (!v2.verified) return { verified: false, reason: v2.reason };
+      if (!v2.verified) {
+        if (life.problem) return { verified: false, reason: v2.reason, signingKey: life.signingKey, ...life.problem };
+        if (/too weak|reject|unsupported|not supported|unknown (curve|algorithm)/i.test(v2.reason || "")) {
+          return { verified: false, reason: v2.reason, kind: "unsupported", algorithm: life.algorithm, signingKey: life.signingKey };
+        }
+        return { verified: false, reason: v2.reason, kind: "bad-signature", signingKey: life.signingKey };
+      }
       const signedText = v2.text;
       if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
-        return { verified: false, reason: "Signed message does not contain ETH address" };
+        return { verified: false, reason: "Signed message does not contain ETH address", kind: "bad-signature", signingKey: life.signingKey };
       }
-      return { verified: true };
+      return { verified: true, kind: "verified", signingKey: life.signingKey, expiresAt: life.expiresAt };
     } catch {
-      return { verified: false, reason: "Signature verification failed" };
+      return { verified: false, reason: "Signature verification failed", kind: "bad-signature" };
     }
   }