@thurinlabs/identity-kit 1.3.7 → 2.0.0

package/dist/{chunk-ROQWHCHP.js → chunk-AAJWERE2.js}

@@ -1,3 +1,874 @@
+// src/core/fingerprint.ts
+import { keccak256 } from "viem";
+var FINGERPRINT_HEX = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+function normalizeFingerprint(input) {
+  const hex = input.replace(/^0x/i, "").replace(/\s+/g, "").toLowerCase();
+  return FINGERPRINT_HEX.test(hex) ? hex : null;
+}
+function sameFingerprint(a, b) {
+  const x = a ? normalizeFingerprint(a) : null;
+  return x !== null && x === (b ? normalizeFingerprint(b) : null);
+}
+function fingerprintToBytes(fingerprint) {
+  const hex = normalizeFingerprint(fingerprint);
+  if (!hex) throw new Error(`Invalid PGP fingerprint: ${fingerprint}`);
+  return `0x${hex}`;
+}
+function bytesToFingerprint(bytes) {
+  return bytes.replace(/^0x/i, "").toLowerCase();
+}
+function fingerprintHash(fingerprint) {
+  return keccak256(fingerprintToBytes(fingerprint));
+}
+function keyIdOf(fingerprint) {
+  const hex = normalizeFingerprint(fingerprint);
+  if (!hex) throw new Error(`Invalid PGP fingerprint: ${fingerprint}`);
+  return `0x${keyIdHex(hex)}`;
+}
+function keyIdHex(normalizedFingerprint) {
+  return normalizedFingerprint.length === 64 ? normalizedFingerprint.slice(0, 16) : normalizedFingerprint.slice(-16);
+}
+function keyIdToBytes(keyId) {
+  const hex = keyId.replace(/^0x/i, "").replace(/\s+/g, "").toLowerCase();
+  return /^[0-9a-f]{16}$/.test(hex) ? `0x${hex}` : null;
+}
+
+// src/core/proofs.ts
+var get = (url, init = {}) => fetch(url, { referrerPolicy: "no-referrer", ...init });
+var PROVIDERS = [
+  {
+    provider: "github",
+    label: "GitHub",
+    pattern: /^https:\/\/gist\.github\.com\/([^/]+)\/([a-f0-9]+)$/i,
+    parse: (m) => ({ user: m[1], gistId: m[2] })
+  },
+  {
+    // A repository's description: the form an organisation can use, since gists belong to user
+    // accounts only. Same shape as the Codeberg proof.
+    provider: "github",
+    label: "GitHub",
+    pattern: /^https:\/\/github\.com\/([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/i,
+    parse: (m) => ({ user: m[1], repo: m[2] })
+  },
+  {
+    provider: "dns",
+    label: "DNS",
+    // A hostname only; underscores allowed for names like _thurin.example.com.
+    pattern: /^dns:([a-z0-9._-]+)\?type=TXT$/i,
+    parse: (m) => ({ domain: m[1] })
+  },
+  {
+    provider: "farcaster",
+    label: "Farcaster",
+    pattern: /^https:\/\/farcaster\.xyz\/([^/]+)\/(0x[a-f0-9]+)$/i,
+    parse: (m) => ({ user: m[1], castHash: m[2] })
+  },
+  {
+    provider: "codeberg",
+    label: "Codeberg",
+    pattern: /^https:\/\/codeberg\.org\/([^/]+)\/([^/]+)$/i,
+    parse: (m) => ({ user: m[1], repo: m[2] })
+  },
+  {
+    provider: "mastodon",
+    label: "Mastodon",
+    // A bare hostname (optional port), so "mastodon.social@evil.com" can't send the lookup elsewhere.
+    pattern: /^https:\/\/([a-z0-9.-]+(?::\d+)?)\/@([^/@?#\s]+)$/i,
+    parse: (m) => ({ instance: m[1], user: m[2] })
+  }
+];
+function identifyProof(notation) {
+  if (notation.name !== "proof@thurin.id") return null;
+  for (const { provider, label, pattern, parse } of PROVIDERS) {
+    const m = notation.value.match(pattern);
+    if (m) {
+      return { provider, label, url: notation.value, ...parse(m) };
+    }
+  }
+  return { provider: "unknown", label: "Unknown", url: notation.value };
+}
+function displayUrl(proof) {
+  if (proof.provider === "dns") return proof.domain;
+  if (proof.provider === "github") return proof.user;
+  if (proof.provider === "farcaster") return `@${proof.user}`;
+  if (proof.provider === "codeberg") return proof.user;
+  if (proof.provider === "mastodon") return `@${proof.user}@${proof.instance}`;
+  return proof.url;
+}
+function proofHref(proof) {
+  if (proof.provider === "dns") return `https://${proof.domain}`;
+  if (proof.provider === "github") return `https://github.com/${proof.user}`;
+  if (proof.provider === "farcaster") return `https://farcaster.xyz/${proof.user}`;
+  if (proof.provider === "codeberg") return `https://codeberg.org/${proof.user}`;
+  if (proof.provider === "mastodon") return `https://${proof.instance}/@${proof.user}`;
+  if (proof.url.startsWith("http")) return proof.url;
+  return null;
+}
+function proofSecondaryHref(proof) {
+  if (proof.provider === "github") return proof.url;
+  if (proof.provider === "farcaster") return proof.url;
+  if (proof.provider === "codeberg") return proof.url;
+  if (proof.provider === "mastodon") return proof.url;
+  return null;
+}
+var FPR_TOKEN = "OPENPGP4FPR:";
+function containsFingerprint(text, fingerprint) {
+  return text.toUpperCase().includes(FPR_TOKEN + fingerprint.toUpperCase());
+}
+function containsFingerprintUrl(text, fingerprint) {
+  return text.toUpperCase().includes(fingerprint.toUpperCase());
+}
+async function verifyGitHub(proof, fingerprint) {
+  if (proof.repo) return verifyGitHubRepo(proof, fingerprint);
+  try {
+    const resp = await get(`https://api.github.com/gists/${proof.gistId}`);
+    if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
+    const data = await resp.json();
+    if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
+      return { verified: false, reason: "Gist owner does not match claimed user" };
+    }
+    for (const file of Object.values(data.files || {})) {
+      if (file.content && containsFingerprint(file.content, fingerprint)) {
+        return { verified: true };
+      }
+    }
+    return { verified: false, reason: "Fingerprint token not found in gist" };
+  } catch (err) {
+    return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+  }
+}
+async function verifyGitHubRepo(proof, fingerprint) {
+  try {
+    const resp = await get(
+      `https://api.github.com/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
+    );
+    if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
+    const data = await resp.json();
+    if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
+      return { verified: false, reason: "Repository owner does not match claimed account" };
+    }
+    if (data.description && containsFingerprint(data.description, fingerprint)) {
+      return { verified: true };
+    }
+    return { verified: false, reason: "Fingerprint token not found in repository description" };
+  } catch (err) {
+    return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+  }
+}
+async function verifyDNS(proof, fingerprint) {
+  try {
+    const resp = await get(
+      `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(proof.domain)}&type=TXT`,
+      { headers: { Accept: "application/dns-json" } }
+    );
+    if (!resp.ok) return { verified: false, reason: `DNS query returned ${resp.status}` };
+    const data = await resp.json();
+    for (const answer of data.Answer || []) {
+      if (answer.type !== 16) continue;
+      if (answer.data && containsFingerprint(answer.data, fingerprint)) {
+        return { verified: true };
+      }
+    }
+    return { verified: false, reason: "Fingerprint token not found in TXT records" };
+  } catch (err) {
+    return { verified: false, reason: `DNS fetch failed: ${err.message}` };
+  }
+}
+var FARCASTER_HUB = "https://haatz.quilibrium.com";
+var NEYNAR_HUB = "https://hub-api.neynar.com";
+function farcasterSource(opts) {
+  if (opts.farcasterHub) return { base: opts.farcasterHub.replace(/\/+$/, ""), headers: {} };
+  if (opts.neynarApiKey) return { base: NEYNAR_HUB, headers: { "x-api-key": opts.neynarApiKey } };
+  return { base: FARCASTER_HUB, headers: {} };
+}
+async function verifyFarcaster(proof, fingerprint, opts = {}) {
+  const { base, headers } = farcasterSource(opts);
+  const host = base.replace(/^https?:\/\//, "");
+  try {
+    const nameResp = await get(`${base}/v1/userNameProofByName?name=${encodeURIComponent(proof.user)}`, { headers });
+    if (nameResp.status === 404) return { verified: false, reason: `Could not resolve Farcaster user "${proof.user}"` };
+    if (!nameResp.ok) return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) returned ${nameResp.status}` };
+    const fid = (await nameResp.json()).fid;
+    if (!fid) return { verified: false, reason: `Could not resolve Farcaster user "${proof.user}"` };
+    let pageToken = "";
+    for (let page = 0; page < 5; page++) {
+      const url = `${base}/v1/castsByFid?fid=${fid}&pageSize=100&reverse=true${pageToken ? `&pageToken=${pageToken}` : ""}`;
+      const resp = await get(url, { headers });
+      if (!resp.ok) return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) returned ${resp.status}` };
+      const data = await resp.json();
+      for (const msg of data.messages || []) {
+        if (msg.hash && msg.hash.startsWith(proof.castHash)) {
+          const text = msg.data?.castAddBody?.text || "";
+          if (containsFingerprint(text, fingerprint)) {
+            return { verified: true };
+          }
+        }
+      }
+      if (!data.nextPageToken) break;
+      pageToken = data.nextPageToken;
+    }
+    return { verified: false, reason: "Cast not found" };
+  } catch (err) {
+    return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) didn't answer (${err.message})` };
+  }
+}
+async function verifyCodeberg(proof, fingerprint) {
+  try {
+    const resp = await get(
+      `https://codeberg.org/api/v1/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
+    );
+    if (!resp.ok) return { verified: false, reason: `Codeberg API returned ${resp.status}` };
+    const data = await resp.json();
+    if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
+      return { verified: false, reason: "Repository owner does not match claimed account" };
+    }
+    if (data.description && containsFingerprint(data.description, fingerprint)) {
+      return { verified: true };
+    }
+    return { verified: false, reason: "Fingerprint token not found in repo description" };
+  } catch (err) {
+    return { verified: false, reason: `Codeberg fetch failed: ${err.message}` };
+  }
+}
+async function verifyMastodon(proof, fingerprint) {
+  try {
+    if (!proof.instance || !/^[a-z0-9.-]+(?::\d+)?$/i.test(proof.instance)) {
+      return { verified: false, reason: "Invalid Mastodon instance host" };
+    }
+    const resp = await get(
+      `https://${proof.instance}/api/v1/accounts/lookup?acct=${encodeURIComponent(proof.user)}`
+    );
+    if (!resp.ok) return { verified: false, reason: `Mastodon API returned ${resp.status}` };
+    const data = await resp.json();
+    const keyId = keyIdHex(fingerprint.replace(/^0x/i, "").replace(/\s+/g, "").toLowerCase());
+    for (const field of data.fields || []) {
+      const text = field.value.replace(/<[^>]*>/g, "");
+      if (containsFingerprintUrl(text, fingerprint) || containsFingerprintUrl(text, keyId)) {
+        return { verified: true };
+      }
+    }
+    if (data.note) {
+      const text = data.note.replace(/<[^>]*>/g, "");
+      if (containsFingerprintUrl(text, fingerprint) || containsFingerprintUrl(text, keyId)) {
+        return { verified: true };
+      }
+    }
+    return { verified: false, reason: "Fingerprint not found in profile fields or bio" };
+  } catch (err) {
+    return { verified: false, reason: `Mastodon fetch failed: ${err.message}` };
+  }
+}
+var verifiers = {
+  github: verifyGitHub,
+  dns: verifyDNS,
+  farcaster: verifyFarcaster,
+  codeberg: verifyCodeberg,
+  mastodon: verifyMastodon
+};
+async function verifyProof(proof, fingerprint, opts) {
+  const fn = verifiers[proof.provider];
+  if (!fn) return { verified: false, reason: "Unknown provider" };
+  return fn(proof, fingerprint, typeof opts === "string" ? { neynarApiKey: opts } : opts ?? {});
+}
+
+// src/core/pgp.ts
+function pgpConfig(openpgp) {
+  const rejectCurves = new Set([...openpgp.config.rejectCurves ?? []].filter((c) => c !== "secp256k1"));
+  return { ...openpgp.config, rejectCurves };
+}
+function newestSignature(sigs = []) {
+  return [...sigs].sort((x, y) => (y.created?.getTime?.() ?? 0) - (x.created?.getTime?.() ?? 0))[0];
+}
+function algorithmName(keyOrSubkey) {
+  try {
+    const info = keyOrSubkey.getAlgorithmInfo();
+    const curve = (info.curve || "").toLowerCase();
+    if (curve.startsWith("ed25519") || info.algorithm === "ed25519" || info.algorithm === "eddsaLegacy") return "Ed25519";
+    if (curve.startsWith("curve25519") || info.algorithm === "x25519") return "Cv25519";
+    if (curve.startsWith("ed448")) return "Ed448";
+    if (curve.startsWith("curve448") || info.algorithm === "x448") return "X448";
+    if (curve.startsWith("nistp") || curve.startsWith("p")) return `NIST P-${curve.replace(/\D/g, "")}`;
+    if (curve.startsWith("secp")) return curve;
+    if (curve.startsWith("brainpool")) return curve;
+    if (info.algorithm.startsWith("rsa")) return info.bits ? `RSA ${info.bits}` : "RSA";
+    if (info.algorithm.startsWith("dsa")) return info.bits ? `DSA ${info.bits}` : "DSA";
+    if (info.algorithm.startsWith("elgamal")) return info.bits ? `ElGamal ${info.bits}` : "ElGamal";
+    return info.curve || info.algorithm;
+  } catch {
+    return String(keyOrSubkey.keyPacket?.algorithm ?? "unknown");
+  }
+}
+var TEXT_START = 45;
+function hexToBytes(hex) {
+  const h = hex.slice(2);
+  const out = new Uint8Array(h.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(h.substr(i * 2, 2), 16);
+  return out;
+}
+function normalizeInput(input) {
+  if (typeof input === "string") {
+    const t = input.trim();
+    if (/^0x([0-9a-fA-F]{2})*$/.test(t)) return normalizeInput(hexToBytes(t));
+    return input;
+  }
+  if (input.length > 0 && input[0] === TEXT_START) return new TextDecoder().decode(input);
+  return input;
+}
+async function readKeyAny(openpgp, input) {
+  const v = normalizeInput(input);
+  return typeof v === "string" ? openpgp.readKey({ armoredKey: v }) : openpgp.readKey({ binaryKey: v });
+}
+async function readSignatureAny(openpgp, input) {
+  const v = normalizeInput(input);
+  if (typeof v === "string" && v.includes("-----BEGIN PGP SIGNED MESSAGE-----")) {
+    const message = await openpgp.readCleartextMessage({ cleartextMessage: v });
+    return { packets: message.signature.packets, text: message.getText(), signature: message.signature };
+  }
+  const signature = typeof v === "string" ? await openpgp.readSignature({ armoredSignature: v }) : await openpgp.readSignature({ binarySignature: v });
+  return { packets: signature.packets, text: null, signature };
+}
+function statementText(address) {
+  return `I control the Ethereum address: ${address.toLowerCase()}`;
+}
+async function parsePgpKey(armoredKey) {
+  try {
+    const openpgp = await import("openpgp");
+    const config = pgpConfig(openpgp);
+    const key = await readKeyAny(openpgp, armoredKey);
+    const fingerprint = key.getFingerprint().toUpperCase();
+    const algorithm = algorithmName(key);
+    const created = key.keyPacket.created?.toISOString() ?? null;
+    const expiration = await key.getExpirationTime();
+    const expires = expiration && expiration !== Infinity ? new Date(expiration).toISOString() : null;
+    const userIDs = [];
+    const notations = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const user of key.users) {
+      const certs = user.selfCertifications;
+      if (!certs || certs.length === 0) continue;
+      let userVerified = false;
+      for (const cert of certs) {
+        try {
+          await cert.verify(
+            key.keyPacket,
+            cert.signatureType,
+            { userID: user.userID, key: key.keyPacket },
+            void 0,
+            // date: now
+            void 0,
+            // detached
+            config
+          );
+        } catch {
+          continue;
+        }
+        userVerified = true;
+        if (cert.rawNotations) {
+          for (const n of cert.rawNotations) {
+            const name = typeof n.name === "string" ? n.name : new TextDecoder().decode(n.name);
+            const value = n.value instanceof Uint8Array ? new TextDecoder().decode(n.value) : typeof n.value === "string" ? n.value : null;
+            if (value) {
+              if (!seen.has(value)) {
+                seen.add(value);
+                notations.push({ name, value });
+              }
+            }
+          }
+        }
+      }
+      if (userVerified) {
+        const uid = user.userID?.userID;
+        if (uid) userIDs.push(uid);
+      }
+    }
+    const now = /* @__PURE__ */ new Date();
+    const subkeys = await Promise.all(key.subkeys.map(async (sk) => {
+      const flags = newestSignature(sk.bindingSignatures)?.keyFlags?.[0] ?? 0;
+      const usage = [];
+      if (flags & 2) usage.push("sign");
+      if (flags & 12) usage.push("encrypt");
+      if (flags & 32) usage.push("auth");
+      const exp = await sk.getExpirationTime(now, config).catch(() => null);
+      const valid = await sk.verify(now, config).then(() => true, () => false);
+      return {
+        algorithm: algorithmName(sk),
+        created: sk.keyPacket.created?.toISOString() ?? null,
+        fingerprint: sk.getFingerprint().toUpperCase(),
+        usage,
+        expires: exp && exp !== Infinity ? new Date(exp).toISOString() : null,
+        valid
+      };
+    }));
+    const canEncrypt = await key.getEncryptionKey(void 0, now, void 0, config).then(() => true, () => false);
+    return { fingerprint, userIDs, algorithm, created, expires, notations, subkeys, canEncrypt };
+  } catch {
+    return null;
+  }
+}
+async function verifySignedText(openpgp, publicKey, packets, text) {
+  const { LiteralDataPacket } = openpgp;
+  const config = pgpConfig(openpgp);
+  const now = /* @__PURE__ */ new Date();
+  for (const sig of packets) {
+    if (!publicKey.getKeys(sig.issuerKeyID).length) continue;
+    const signingKey = await publicKey.getSigningKey(sig.issuerKeyID, now, void 0, config);
+    const literal = new LiteralDataPacket();
+    literal.setText(text.replace(/\r?\n/g, "\r\n"));
+    await sig.verify(signingKey.keyPacket, sig.signatureType, literal, now, true, config);
+    return true;
+  }
+  return false;
+}
+async function verifyClearsigned({ armoredKey, clearsigned }) {
+  try {
+    const openpgp = await import("openpgp");
+    const publicKey = await readKeyAny(openpgp, armoredKey);
+    const message = await openpgp.readCleartextMessage({ cleartextMessage: clearsigned });
+    const text = message.text ?? message.getText();
+    if (await verifySignedText(openpgp, publicKey, message.signature.packets, text)) return { verified: true, text: message.getText() };
+    return { verified: false, reason: "Message is not signed by this key", text: message.getText() };
+  } catch (err) {
+    return { verified: false, reason: err instanceof Error ? err.message : "Verification failed", text: "" };
+  }
+}
+async function verifyStatementSignature({ key, signature, address }) {
+  const text = statementText(address);
+  try {
+    const openpgp = await import("openpgp");
+    const publicKey = await readKeyAny(openpgp, key);
+    const { packets } = await readSignatureAny(openpgp, signature);
+    if (await verifySignedText(openpgp, publicKey, packets, text)) return { verified: true, text };
+    return { verified: false, reason: "Message is not signed by this key", text };
+  } catch (err) {
+    return { verified: false, reason: err instanceof Error ? err.message : "Verification failed", text };
+  }
+}
+var REVOCATION_REASON = {
+  1: "replaced by a newer key",
+  2: "compromised",
+  3: "no longer used",
+  32: "a user ID is no longer valid"
+};
+var iso = (d) => d instanceof Date ? d.toISOString() : typeof d === "number" && Number.isFinite(d) ? new Date(d).toISOString() : null;
+function revocationOf(sigs) {
+  const sig = [...sigs ?? []].sort((a, b) => (b.created?.getTime?.() ?? 0) - (a.created?.getTime?.() ?? 0))[0];
+  const flag = sig?.reasonForRevocationFlag ?? null;
+  return {
+    at: iso(sig?.created),
+    compromised: flag === 2,
+    revocationReason: sig?.reasonForRevocationString || (flag !== null ? REVOCATION_REASON[flag] ?? null : null)
+  };
+}
+async function keyLife(key, issuer, config) {
+  const now = /* @__PURE__ */ new Date();
+  const signer = issuer && !key.getKeyID().equals(issuer) ? key.subkeys.find((s) => s.getKeyID().equals(issuer)) ?? null : key;
+  const signingKey = signer ? signer.getFingerprint().toUpperCase() : null;
+  const safe = async (f, fallback) => {
+    try {
+      return await f();
+    } catch {
+      return fallback;
+    }
+  };
+  const keyRevoked = await safe(() => key.isRevoked(void 0, void 0, now, config), false);
+  const keyExp = await safe(() => key.getExpirationTime(void 0, config), null);
+  const isSub = signer && signer !== key;
+  const subRevoked = isSub ? await safe(() => signer.isRevoked(null, key.keyPacket, now, config), false) : false;
+  const subExp = isSub ? await safe(() => signer.getExpirationTime(null, config), null) : null;
+  const finite = (d) => d instanceof Date && Number.isFinite(d.getTime()) ? d : null;
+  const kExp = finite(keyExp), sExp = finite(subExp);
+  let problem = null;
+  if (keyRevoked) {
+    const r = revocationOf(key.revocationSignatures);
+    problem = { kind: r.compromised ? "compromised" : "revoked", at: r.at, revocationReason: r.revocationReason };
+  } else if (kExp && kExp <= now) {
+    problem = { kind: "expired", at: kExp.toISOString() };
+  } else if (subRevoked) {
+    const r = revocationOf(signer.revocationSignatures);
+    problem = { kind: r.compromised ? "compromised" : "signing-key-revoked", at: r.at, revocationReason: r.revocationReason };
+  } else if (sExp && sExp <= now) {
+    problem = { kind: "signing-key-expired", at: sExp.toISOString() };
+  }
+  const earliest = [kExp, sExp].filter(Boolean).sort((a, b) => a - b)[0];
+  return { problem, signingKey, expiresAt: earliest ? earliest.toISOString() : null, algorithm: algorithmName(signer ?? key) };
+}
+async function verifyAttestation({
+  pgpPublicKey,
+  pgpSignature,
+  fingerprint,
+  ethAddress
+}) {
+  try {
+    if (!pgpPublicKey || !pgpSignature) {
+      return { verified: false, reason: "Missing PGP data", kind: "bad-signature" };
+    }
+    const openpgp = await import("openpgp");
+    const publicKey = await readKeyAny(openpgp, pgpPublicKey);
+    const keyFingerprint = publicKey.getFingerprint().toUpperCase();
+    if (keyFingerprint !== fingerprint.toUpperCase()) {
+      return { verified: false, reason: "Key fingerprint mismatch", kind: "bad-signature" };
+    }
+    let sig;
+    try {
+      sig = await readSignatureAny(openpgp, pgpSignature);
+    } catch {
+      return { verified: false, reason: "Unreadable signature", kind: "bad-signature" };
+    }
+    const life = await keyLife(publicKey, sig.packets[0]?.issuerKeyID ?? null, pgpConfig(openpgp));
+    const v = sig.text !== null ? await verifyClearsigned({ armoredKey: publicKey.armor(), clearsigned: normalizeInput(pgpSignature) }) : await verifyStatementSignature({ key: publicKey.armor(), signature: pgpSignature, address: ethAddress });
+    if (!v.verified) {
+      if (life.problem) return { verified: false, reason: v.reason, signingKey: life.signingKey, ...life.problem };
+      if (/too weak|reject|unsupported|not supported|unknown (curve|algorithm)/i.test(v.reason || "")) {
+        return { verified: false, reason: v.reason, kind: "unsupported", algorithm: life.algorithm, signingKey: life.signingKey };
+      }
+      return { verified: false, reason: v.reason, kind: "bad-signature", signingKey: life.signingKey };
+    }
+    if (v.text.trim().toLowerCase() !== statementText(ethAddress).toLowerCase()) {
+      return { verified: false, reason: "Signed text is not the statement for this address", kind: "bad-signature", signingKey: life.signingKey };
+    }
+    return { verified: true, kind: "verified", signingKey: life.signingKey, expiresAt: life.expiresAt };
+  } catch {
+    return { verified: false, reason: "Signature verification failed", kind: "bad-signature" };
+  }
+}
+var EMAIL_UID = /@/;
+var EMAIL_IN_TEXT = /(?:^|[^\w/.+-])([\w.+-]+@[\w-]+(?:\.[\w-]+)+)/;
+function notationEmails(sig) {
+  const out = [];
+  for (const n of sig?.rawNotations ?? []) {
+    const text = typeof n.value === "string" ? n.value : new TextDecoder().decode(n.value);
+    const m = text.match(EMAIL_IN_TEXT);
+    if (m) out.push(m[1]);
+  }
+  return out;
+}
+async function stripEmailUserIDs(armoredKey) {
+  try {
+    const openpgp = await import("openpgp");
+    const key = await readKeyAny(openpgp, armoredKey);
+    const kept = [];
+    const removed = [];
+    const users = key.users.filter((u) => {
+      const uid = u.userID?.userID;
+      if (!uid) return false;
+      if (EMAIL_UID.test(uid)) {
+        removed.push(uid);
+        return false;
+      }
+      kept.push(uid);
+      return true;
+    });
+    if (users.length === 0) return null;
+    key.users = users;
+    return { armored: key.armor(), binary: key.write(), kept, removed };
+  } catch {
+    return null;
+  }
+}
+async function hasEmailUserID(armoredKey) {
+  try {
+    const openpgp = await import("openpgp");
+    const key = await readKeyAny(openpgp, armoredKey);
+    return key.users.some((u) => EMAIL_UID.test(u.userID?.userID ?? ""));
+  } catch {
+    return false;
+  }
+}
+async function leanKey(input, { includeEmail = false } = {}) {
+  try {
+    const openpgp = await import("openpgp");
+    const key = await readKeyAny(openpgp, input);
+    const kept = [];
+    const removed = [];
+    const newest = (sigs = []) => sigs.length ? [[...sigs].sort((x, y) => (y.created?.getTime?.() ?? 0) - (x.created?.getTime?.() ?? 0))[0]] : [];
+    for (const u of key.users) {
+      u.selfCertifications = u.revocationSignatures?.length ? [] : newest(u.selfCertifications);
+      u.otherCertifications = [];
+    }
+    const users = key.users.filter((u) => {
+      const uid = u.userID?.userID;
+      if (!uid) return false;
+      if (!includeEmail && (EMAIL_UID.test(uid) || u.selfCertifications.some((c) => notationEmails(c).length))) {
+        removed.push(uid);
+        return false;
+      }
+      kept.push(uid);
+      return true;
+    });
+    if (users.length === 0) return null;
+    key.users = users;
+    key.directSignatures = newest(key.directSignatures);
+    const keyNotationEmails = includeEmail ? [] : key.directSignatures.flatMap(notationEmails);
+    for (const sk of key.subkeys) sk.bindingSignatures = newest(sk.bindingSignatures);
+    return { binary: key.write(), kept, removed, keyNotationEmails };
+  } catch {
+    return null;
+  }
+}
+async function claimSignature({ signature, key, address }) {
+  try {
+    const openpgp = await import("openpgp");
+    const sig = await readSignatureAny(openpgp, signature);
+    if (sig.text === null) {
+      const v = normalizeInput(signature);
+      const raw = typeof v === "string" ? (await openpgp.unarmor(v)).data : v;
+      return { signature: raw, messageVersion: 1 };
+    }
+    const packet = sig.signature.write();
+    if ((await verifyStatementSignature({ key, signature: packet, address })).verified) return { signature: packet, messageVersion: 1 };
+    return { signature: normalizeInput(signature), messageVersion: 0 };
+  } catch {
+    return null;
+  }
+}
+async function signatureEmail(signature) {
+  try {
+    const openpgp = await import("openpgp");
+    const { packets } = await readSignatureAny(openpgp, signature);
+    for (const p of packets) {
+      const uid = p.signersUserID ?? null;
+      if (uid && uid.includes("@")) return uid;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function payloadText(input, kind) {
+  try {
+    const v = normalizeInput(input);
+    if (typeof v === "string") return v;
+    const openpgp = await import("openpgp");
+    if (kind === "key") return (await openpgp.readKey({ binaryKey: v })).armor();
+    return (await openpgp.readSignature({ binarySignature: v })).armor();
+  } catch {
+    return null;
+  }
+}
+var AUTH_FLAG = 32;
+function sshString(bytes) {
+  const out = new Uint8Array(4 + bytes.length);
+  new DataView(out.buffer).setUint32(0, bytes.length);
+  out.set(bytes, 4);
+  return out;
+}
+function sshMpint(bytes) {
+  let i = 0;
+  while (i < bytes.length - 1 && bytes[i] === 0) i++;
+  const b = bytes.subarray(i);
+  return sshString(b[0] & 128 ? new Uint8Array([0, ...b]) : b);
+}
+function sshBlob(p) {
+  const text = (s) => new TextEncoder().encode(s);
+  const join = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, x) => n + x.length, 0));
+    let o = 0;
+    for (const x of parts) {
+      out.set(x, o);
+      o += x.length;
+    }
+    return out;
+  };
+  const { publicParams: pp } = p;
+  switch (p.algorithm) {
+    case 1:
+    case 3:
+      return { type: "ssh-rsa", blob: join(sshString(text("ssh-rsa")), sshMpint(pp.e), sshMpint(pp.n)) };
+    case 22:
+      if (pp.oid?.getName?.() !== "ed25519Legacy" || pp.Q?.length !== 33) return null;
+      return { type: "ssh-ed25519", blob: join(sshString(text("ssh-ed25519")), sshString(pp.Q.subarray(1))) };
+    case 27:
+      return { type: "ssh-ed25519", blob: join(sshString(text("ssh-ed25519")), sshString(pp.A)) };
+    case 19: {
+      const curve = { nistP256: "nistp256", nistP384: "nistp384", nistP521: "nistp521" }[pp.oid?.getName?.()];
+      if (!curve) return null;
+      const type = `ecdsa-sha2-${curve}`;
+      return { type, blob: join(sshString(text(type)), sshString(text(curve)), sshString(pp.Q)) };
+    }
+    default:
+      return null;
+  }
+}
+function base64(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s);
+}
+async function sshKeys(input) {
+  try {
+    const openpgp = await import("openpgp");
+    const config = pgpConfig(openpgp);
+    const key = await readKeyAny(openpgp, input);
+    const now = /* @__PURE__ */ new Date();
+    try {
+      await key.verifyPrimaryKey(now, void 0, config);
+    } catch {
+      return [];
+    }
+    const candidates = [];
+    const direct = newestSignature(key.directSignatures);
+    const primarySig = direct?.keyFlags ? direct : (await key.getPrimaryUser(now, void 0, config)).selfCertification;
+    candidates.push({ packet: key.keyPacket, flags: primarySig?.keyFlags?.[0] ?? 0 });
+    for (const sk of key.subkeys) {
+      try {
+        await sk.verify(now, config);
+      } catch {
+        continue;
+      }
+      candidates.push({ packet: sk.keyPacket, flags: newestSignature(sk.bindingSignatures)?.keyFlags?.[0] ?? 0 });
+    }
+    const out = [];
+    for (const { packet, flags } of candidates) {
+      if (!(flags & AUTH_FLAG)) continue;
+      const ssh = sshBlob(packet);
+      if (!ssh) continue;
+      const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", ssh.blob));
+      out.push({
+        line: `${ssh.type} ${base64(ssh.blob)}`,
+        sha256: `SHA256:${base64(digest).replace(/=+$/, "")}`,
+        fingerprint: packet.getFingerprint().toUpperCase()
+      });
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+
+// src/core/authorization.ts
+import { hashTypedData, keccak256 as keccak2562, stringToHex } from "viem";
+var EIP712_NAME = "Thurin PGPRegistry";
+var EIP712_VERSION = "3";
+function registryDomain(chainId, verifyingContract) {
+  return { name: EIP712_NAME, version: EIP712_VERSION, chainId, verifyingContract };
+}
+var AUTHORIZATION_TYPES = {
+  Attest: [
+    { name: "owner", type: "address" },
+    { name: "fingerprint", type: "bytes" },
+    { name: "signature", type: "bytes" },
+    { name: "key", type: "bytes" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ],
+  Reattest: [
+    { name: "owner", type: "address" },
+    { name: "revokeIndex", type: "uint256" },
+    { name: "fingerprint", type: "bytes" },
+    { name: "signature", type: "bytes" },
+    { name: "key", type: "bytes" },
+    { name: "keepRecords", type: "bool" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ],
+  UpdateKey: [
+    { name: "owner", type: "address" },
+    { name: "index", type: "uint256" },
+    { name: "key", type: "bytes" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ],
+  Revoke: [
+    { name: "owner", type: "address" },
+    { name: "index", type: "uint256" },
+    { name: "reason", type: "string" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ],
+  SetRecord: [
+    { name: "owner", type: "address" },
+    { name: "index", type: "uint256" },
+    { name: "kind", type: "string" },
+    { name: "value", type: "string" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ],
+  MarkCompromised: [
+    { name: "owner", type: "address" },
+    { name: "index", type: "uint256" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ]
+};
+var REVOKE_REASONS = ["", "compromised", "retired", "superseded", "other"];
+var OWNER_REVOKE_REASONS = ["", "compromised", "retired", "other"];
+function payloadBytes(v) {
+  return /^0x([0-9a-fA-F]{2})*$/.test(v) ? v : stringToHex(v);
+}
+function attestTypedData(chainId, registry, a) {
+  return {
+    domain: registryDomain(chainId, registry),
+    types: { Attest: AUTHORIZATION_TYPES.Attest },
+    primaryType: "Attest",
+    message: {
+      owner: a.owner,
+      fingerprint: fingerprintToBytes(a.fingerprint),
+      signature: payloadBytes(a.signature),
+      key: payloadBytes(a.key),
+      nonce: a.nonce,
+      deadline: a.deadline
+    }
+  };
+}
+function reattestTypedData(chainId, registry, a) {
+  return {
+    domain: registryDomain(chainId, registry),
+    types: { Reattest: AUTHORIZATION_TYPES.Reattest },
+    primaryType: "Reattest",
+    message: {
+      owner: a.owner,
+      revokeIndex: a.revokeIndex,
+      fingerprint: fingerprintToBytes(a.fingerprint),
+      signature: payloadBytes(a.signature),
+      key: payloadBytes(a.key),
+      keepRecords: a.keepRecords,
+      nonce: a.nonce,
+      deadline: a.deadline
+    }
+  };
+}
+function updateKeyTypedData(chainId, registry, a) {
+  return {
+    domain: registryDomain(chainId, registry),
+    types: { UpdateKey: AUTHORIZATION_TYPES.UpdateKey },
+    primaryType: "UpdateKey",
+    message: { owner: a.owner, index: a.index, key: payloadBytes(a.key), nonce: a.nonce, deadline: a.deadline }
+  };
+}
+function revokeTypedData(chainId, registry, a) {
+  return {
+    domain: registryDomain(chainId, registry),
+    types: { Revoke: AUTHORIZATION_TYPES.Revoke },
+    primaryType: "Revoke",
+    message: { owner: a.owner, index: a.index, reason: a.reason ?? "", nonce: a.nonce, deadline: a.deadline }
+  };
+}
+function setRecordTypedData(chainId, registry, a) {
+  return {
+    domain: registryDomain(chainId, registry),
+    types: { SetRecord: AUTHORIZATION_TYPES.SetRecord },
+    primaryType: "SetRecord",
+    message: { owner: a.owner, index: a.index, kind: a.kind, value: a.value, nonce: a.nonce, deadline: a.deadline }
+  };
+}
+function markCompromisedTypedData(chainId, registry, a) {
+  return {
+    domain: registryDomain(chainId, registry),
+    types: { MarkCompromised: AUTHORIZATION_TYPES.MarkCompromised },
+    primaryType: "MarkCompromised",
+    message: { owner: a.owner, index: a.index, nonce: a.nonce, deadline: a.deadline }
+  };
+}
+function authorizationDigest(typedData) {
+  return hashTypedData(typedData);
+}
+function recordKind(name) {
+  return keccak2562(stringToHex(name));
+}
+
+// src/core/contract.ts
+import { mainnet, sepolia, foundry } from "viem/chains";
+
 // src/core/abi.ts
 var REGISTRY_ABI = [
   {
@@ -52,6 +923,45 @@ var REGISTRY_ABI = [
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "EPOCH",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "MARK_COMPROMISED_TYPEHASH",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "MAX_CLAIMS_PER_OWNER",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "MAX_KEY_BYTES",
@@ -65,6 +975,32 @@ var REGISTRY_ABI = [
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "MAX_KIND_BYTES",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "MAX_PAYLOAD_BYTES",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "MAX_RECORD_BYTES",
@@ -80,7 +1016,7 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "MAX_SIG_BYTES",
+    "name": "MAX_SIGNATURE_BYTES",
     "inputs": [],
     "outputs": [
       {
@@ -93,7 +1029,20 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "MESSAGE_VERSION",
+    "name": "MESSAGE_CLEARSIGNED",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint8",
+        "internalType": "uint8"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "MESSAGE_DETACHED",
     "inputs": [],
     "outputs": [
       {
@@ -171,87 +1120,107 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "addressesFor",
+    "name": "armorToBytes",
     "inputs": [
       {
-        "name": "fingerprintHash",
-        "type": "bytes32",
-        "internalType": "bytes32"
+        "name": "armored",
+        "type": "string",
+        "internalType": "string"
       }
     ],
     "outputs": [
       {
         "name": "",
-        "type": "address[]",
-        "internalType": "address[]"
+        "type": "bytes",
+        "internalType": "bytes"
       }
     ],
-    "stateMutability": "view"
+    "stateMutability": "pure"
   },
   {
     "type": "function",
-    "name": "addressesForCount",
+    "name": "armoredKey",
     "inputs": [
       {
-        "name": "fingerprintHash",
-        "type": "bytes32",
-        "internalType": "bytes32"
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
       }
     ],
     "outputs": [
       {
         "name": "",
-        "type": "uint256",
-        "internalType": "uint256"
+        "type": "string",
+        "internalType": "string"
       }
     ],
     "stateMutability": "view"
   },
   {
     "type": "function",
-    "name": "addressesForRange",
+    "name": "attest",
     "inputs": [
       {
-        "name": "fingerprintHash",
-        "type": "bytes32",
-        "internalType": "bytes32"
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
       },
       {
-        "name": "start",
-        "type": "uint256",
-        "internalType": "uint256"
+        "name": "signature",
+        "type": "bytes",
+        "internalType": "bytes"
       },
       {
-        "name": "count",
-        "type": "uint256",
-        "internalType": "uint256"
+        "name": "key",
+        "type": "bytes",
+        "internalType": "bytes"
       }
     ],
     "outputs": [
       {
-        "name": "out",
-        "type": "address[]",
-        "internalType": "address[]"
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
       }
     ],
-    "stateMutability": "view"
+    "stateMutability": "nonpayable"
   },
   {
     "type": "function",
-    "name": "attest",
+    "name": "attestFor",
     "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
       {
         "name": "fingerprint",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "pgpSignature",
+        "name": "signature",
+        "type": "bytes",
+        "internalType": "bytes"
+      },
+      {
+        "name": "key",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "pgpPublicKey",
+        "name": "deadline",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "permission",
         "type": "bytes",
         "internalType": "bytes"
       }
@@ -267,7 +1236,14 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "attestFor",
+    "name": "cancelAuthorization",
+    "inputs": [],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "claim",
     "inputs": [
       {
         "name": "owner",
@@ -275,43 +1251,80 @@ var REGISTRY_ABI = [
         "internalType": "address"
       },
       {
-        "name": "fingerprint",
-        "type": "bytes",
-        "internalType": "bytes"
-      },
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [
       {
-        "name": "pgpSignature",
-        "type": "bytes",
-        "internalType": "bytes"
+        "name": "details",
+        "type": "tuple",
+        "internalType": "struct PGPRegistry.ClaimView",
+        "components": [
+          {
+            "name": "index",
+            "type": "uint256",
+            "internalType": "uint256"
+          },
+          {
+            "name": "fingerprint",
+            "type": "bytes",
+            "internalType": "bytes"
+          },
+          {
+            "name": "createdAt",
+            "type": "uint64",
+            "internalType": "uint64"
+          },
+          {
+            "name": "revokedAt",
+            "type": "uint64",
+            "internalType": "uint64"
+          },
+          {
+            "name": "state",
+            "type": "string",
+            "internalType": "string"
+          },
+          {
+            "name": "replacedBy",
+            "type": "uint256",
+            "internalType": "uint256"
+          },
+          {
+            "name": "revokeReason",
+            "type": "string",
+            "internalType": "string"
+          },
+          {
+            "name": "messageVersion",
+            "type": "uint8",
+            "internalType": "uint8"
+          }
+        ]
       },
       {
-        "name": "pgpPublicKey",
-        "type": "bytes",
-        "internalType": "bytes"
+        "name": "key",
+        "type": "string",
+        "internalType": "string"
       },
       {
-        "name": "deadline",
-        "type": "uint256",
-        "internalType": "uint256"
+        "name": "statement",
+        "type": "string",
+        "internalType": "string"
       },
       {
-        "name": "signature",
-        "type": "bytes",
-        "internalType": "bytes"
-      }
-    ],
-    "outputs": [
-      {
-        "name": "index",
-        "type": "uint256",
-        "internalType": "uint256"
+        "name": "recordKinds",
+        "type": "string[]",
+        "internalType": "string[]"
       }
     ],
-    "stateMutability": "nonpayable"
+    "stateMutability": "view"
   },
   {
     "type": "function",
-    "name": "attestationCount",
+    "name": "claimCount",
     "inputs": [
       {
         "name": "owner",
@@ -330,7 +1343,7 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "attestationsOf",
+    "name": "claimsOf",
     "inputs": [
       {
         "name": "owner",
@@ -340,10 +1353,15 @@ var REGISTRY_ABI = [
     ],
     "outputs": [
       {
-        "name": "",
+        "name": "out",
         "type": "tuple[]",
-        "internalType": "struct PGPRegistry.Attestation[]",
+        "internalType": "struct PGPRegistry.ClaimView[]",
         "components": [
+          {
+            "name": "index",
+            "type": "uint256",
+            "internalType": "uint256"
+          },
           {
             "name": "fingerprint",
             "type": "bytes",
@@ -360,19 +1378,24 @@ var REGISTRY_ABI = [
             "internalType": "uint64"
           },
           {
-            "name": "messageVersion",
-            "type": "uint8",
-            "internalType": "uint8"
+            "name": "state",
+            "type": "string",
+            "internalType": "string"
+          },
+          {
+            "name": "replacedBy",
+            "type": "uint256",
+            "internalType": "uint256"
           },
           {
-            "name": "keyPtr",
-            "type": "address",
-            "internalType": "address"
+            "name": "revokeReason",
+            "type": "string",
+            "internalType": "string"
           },
           {
-            "name": "sigPtr",
-            "type": "address",
-            "internalType": "address"
+            "name": "messageVersion",
+            "type": "uint8",
+            "internalType": "uint8"
           }
         ]
       }
@@ -381,7 +1404,7 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "attestationsOfRange",
+    "name": "claimsOfRange",
     "inputs": [
       {
         "name": "owner",
@@ -403,8 +1426,13 @@ var REGISTRY_ABI = [
       {
         "name": "out",
         "type": "tuple[]",
-        "internalType": "struct PGPRegistry.Attestation[]",
+        "internalType": "struct PGPRegistry.ClaimView[]",
         "components": [
+          {
+            "name": "index",
+            "type": "uint256",
+            "internalType": "uint256"
+          },
           {
             "name": "fingerprint",
             "type": "bytes",
@@ -421,19 +1449,24 @@ var REGISTRY_ABI = [
             "internalType": "uint64"
           },
           {
-            "name": "messageVersion",
-            "type": "uint8",
-            "internalType": "uint8"
+            "name": "state",
+            "type": "string",
+            "internalType": "string"
+          },
+          {
+            "name": "replacedBy",
+            "type": "uint256",
+            "internalType": "uint256"
           },
           {
-            "name": "keyPtr",
-            "type": "address",
-            "internalType": "address"
+            "name": "revokeReason",
+            "type": "string",
+            "internalType": "string"
           },
           {
-            "name": "sigPtr",
-            "type": "address",
-            "internalType": "address"
+            "name": "messageVersion",
+            "type": "uint8",
+            "internalType": "uint8"
           }
         ]
       }
@@ -442,10 +1475,27 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "cancelAuthorization",
-    "inputs": [],
-    "outputs": [],
-    "stateMutability": "nonpayable"
+    "name": "clearsigned",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "string",
+        "internalType": "string"
+      }
+    ],
+    "stateMutability": "view"
   },
   {
     "type": "function",
@@ -469,10 +1519,15 @@ var REGISTRY_ABI = [
         "internalType": "uint256"
       },
       {
-        "name": "attestation",
+        "name": "details",
         "type": "tuple",
-        "internalType": "struct PGPRegistry.Attestation",
+        "internalType": "struct PGPRegistry.ClaimView",
         "components": [
+          {
+            "name": "index",
+            "type": "uint256",
+            "internalType": "uint256"
+          },
           {
             "name": "fingerprint",
             "type": "bytes",
@@ -489,25 +1544,73 @@ var REGISTRY_ABI = [
             "internalType": "uint64"
           },
           {
-            "name": "messageVersion",
-            "type": "uint8",
-            "internalType": "uint8"
+            "name": "state",
+            "type": "string",
+            "internalType": "string"
+          },
+          {
+            "name": "replacedBy",
+            "type": "uint256",
+            "internalType": "uint256"
           },
           {
-            "name": "keyPtr",
-            "type": "address",
-            "internalType": "address"
+            "name": "revokeReason",
+            "type": "string",
+            "internalType": "string"
           },
           {
-            "name": "sigPtr",
-            "type": "address",
-            "internalType": "address"
+            "name": "messageVersion",
+            "type": "uint8",
+            "internalType": "uint8"
           }
         ]
       }
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "eip712Domain",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "fields",
+        "type": "bytes1",
+        "internalType": "bytes1"
+      },
+      {
+        "name": "name",
+        "type": "string",
+        "internalType": "string"
+      },
+      {
+        "name": "version",
+        "type": "string",
+        "internalType": "string"
+      },
+      {
+        "name": "chainId",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "verifyingContract",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "salt",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "extensions",
+        "type": "uint256[]",
+        "internalType": "uint256[]"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "fingerprintsForKeyId",
@@ -520,21 +1623,164 @@ var REGISTRY_ABI = [
     ],
     "outputs": [
       {
-        "name": "",
+        "name": "",
+        "type": "bytes[]",
+        "internalType": "bytes[]"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "fingerprintsForKeyIdCount",
+    "inputs": [
+      {
+        "name": "keyId",
+        "type": "bytes8",
+        "internalType": "bytes8"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "fingerprintsForKeyIdRange",
+    "inputs": [
+      {
+        "name": "keyId",
+        "type": "bytes8",
+        "internalType": "bytes8"
+      },
+      {
+        "name": "start",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "count",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "out",
+        "type": "bytes[]",
+        "internalType": "bytes[]"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "keyBytes",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "key",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "keyStatus",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "string",
+        "internalType": "string"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "markCompromisedFor",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "deadline",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "permission",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "multicall",
+    "inputs": [
+      {
+        "name": "calls",
+        "type": "bytes[]",
+        "internalType": "bytes[]"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "results",
         "type": "bytes[]",
         "internalType": "bytes[]"
       }
     ],
-    "stateMutability": "view"
+    "stateMutability": "nonpayable"
   },
   {
     "type": "function",
-    "name": "fingerprintsForKeyIdCount",
+    "name": "nonces",
     "inputs": [
       {
-        "name": "keyId",
-        "type": "bytes8",
-        "internalType": "bytes8"
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
       }
     ],
     "outputs": [
@@ -548,133 +1794,67 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "fingerprintsForKeyIdRange",
+    "name": "ownersOf",
     "inputs": [
       {
-        "name": "keyId",
-        "type": "bytes8",
-        "internalType": "bytes8"
-      },
-      {
-        "name": "start",
-        "type": "uint256",
-        "internalType": "uint256"
-      },
-      {
-        "name": "count",
-        "type": "uint256",
-        "internalType": "uint256"
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
       }
     ],
     "outputs": [
       {
-        "name": "out",
-        "type": "bytes[]",
-        "internalType": "bytes[]"
+        "name": "",
+        "type": "address[]",
+        "internalType": "address[]"
       }
     ],
     "stateMutability": "view"
   },
   {
     "type": "function",
-    "name": "getAttestation",
+    "name": "ownersOfCount",
     "inputs": [
       {
-        "name": "owner",
-        "type": "address",
-        "internalType": "address"
-      },
-      {
-        "name": "index",
-        "type": "uint256",
-        "internalType": "uint256"
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
       }
     ],
     "outputs": [
       {
         "name": "",
-        "type": "tuple",
-        "internalType": "struct PGPRegistry.Attestation",
-        "components": [
-          {
-            "name": "fingerprint",
-            "type": "bytes",
-            "internalType": "bytes"
-          },
-          {
-            "name": "createdAt",
-            "type": "uint64",
-            "internalType": "uint64"
-          },
-          {
-            "name": "revokedAt",
-            "type": "uint64",
-            "internalType": "uint64"
-          },
-          {
-            "name": "messageVersion",
-            "type": "uint8",
-            "internalType": "uint8"
-          },
-          {
-            "name": "keyPtr",
-            "type": "address",
-            "internalType": "address"
-          },
-          {
-            "name": "sigPtr",
-            "type": "address",
-            "internalType": "address"
-          }
-        ]
+        "type": "uint256",
+        "internalType": "uint256"
       }
     ],
     "stateMutability": "view"
   },
   {
     "type": "function",
-    "name": "getPayload",
+    "name": "ownersOfRange",
     "inputs": [
       {
-        "name": "owner",
-        "type": "address",
-        "internalType": "address"
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
       },
       {
-        "name": "index",
+        "name": "start",
         "type": "uint256",
         "internalType": "uint256"
-      }
-    ],
-    "outputs": [
-      {
-        "name": "pgpSignature",
-        "type": "bytes",
-        "internalType": "bytes"
       },
       {
-        "name": "pgpPublicKey",
-        "type": "bytes",
-        "internalType": "bytes"
-      }
-    ],
-    "stateMutability": "view"
-  },
-  {
-    "type": "function",
-    "name": "nonces",
-    "inputs": [
-      {
-        "name": "",
-        "type": "address",
-        "internalType": "address"
+        "name": "count",
+        "type": "uint256",
+        "internalType": "uint256"
       }
     ],
     "outputs": [
       {
-        "name": "",
-        "type": "uint256",
-        "internalType": "uint256"
+        "name": "out",
+        "type": "address[]",
+        "internalType": "address[]"
       }
     ],
     "stateMutability": "view"
@@ -694,14 +1874,19 @@ var REGISTRY_ABI = [
         "internalType": "bytes"
       },
       {
-        "name": "pgpSignature",
+        "name": "signature",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "pgpPublicKey",
+        "name": "key",
         "type": "bytes",
         "internalType": "bytes"
+      },
+      {
+        "name": "keepRecords",
+        "type": "bool",
+        "internalType": "bool"
       }
     ],
     "outputs": [
@@ -733,22 +1918,27 @@ var REGISTRY_ABI = [
         "internalType": "bytes"
       },
       {
-        "name": "pgpSignature",
+        "name": "signature",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "pgpPublicKey",
+        "name": "key",
         "type": "bytes",
         "internalType": "bytes"
       },
+      {
+        "name": "keepRecords",
+        "type": "bool",
+        "internalType": "bool"
+      },
       {
         "name": "deadline",
         "type": "uint256",
         "internalType": "uint256"
       },
       {
-        "name": "signature",
+        "name": "permission",
         "type": "bytes",
         "internalType": "bytes"
       }
@@ -764,7 +1954,7 @@ var REGISTRY_ABI = [
   },
   {
     "type": "function",
-    "name": "record",
+    "name": "recordText",
     "inputs": [
       {
         "name": "owner",
@@ -778,15 +1968,44 @@ var REGISTRY_ABI = [
       },
       {
         "name": "kind",
-        "type": "bytes32",
-        "internalType": "bytes32"
+        "type": "string",
+        "internalType": "string"
       }
     ],
     "outputs": [
       {
         "name": "",
-        "type": "bytes",
-        "internalType": "bytes"
+        "type": "string",
+        "internalType": "string"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "recordsOf",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "kinds",
+        "type": "string[]",
+        "internalType": "string[]"
+      },
+      {
+        "name": "values",
+        "type": "string[]",
+        "internalType": "string[]"
       }
     ],
     "stateMutability": "view"
@@ -799,6 +2018,11 @@ var REGISTRY_ABI = [
         "name": "index",
         "type": "uint256",
         "internalType": "uint256"
+      },
+      {
+        "name": "reason",
+        "type": "string",
+        "internalType": "string"
       }
     ],
     "outputs": [],
@@ -818,13 +2042,18 @@ var REGISTRY_ABI = [
         "type": "uint256",
         "internalType": "uint256"
       },
+      {
+        "name": "reason",
+        "type": "string",
+        "internalType": "string"
+      },
       {
         "name": "deadline",
         "type": "uint256",
         "internalType": "uint256"
       },
       {
-        "name": "signature",
+        "name": "permission",
         "type": "bytes",
         "internalType": "bytes"
       }
@@ -843,13 +2072,13 @@ var REGISTRY_ABI = [
       },
       {
         "name": "kind",
-        "type": "bytes32",
-        "internalType": "bytes32"
+        "type": "string",
+        "internalType": "string"
       },
       {
         "name": "value",
-        "type": "bytes",
-        "internalType": "bytes"
+        "type": "string",
+        "internalType": "string"
       }
     ],
     "outputs": [],
@@ -871,13 +2100,13 @@ var REGISTRY_ABI = [
       },
       {
         "name": "kind",
-        "type": "bytes32",
-        "internalType": "bytes32"
+        "type": "string",
+        "internalType": "string"
       },
       {
         "name": "value",
-        "type": "bytes",
-        "internalType": "bytes"
+        "type": "string",
+        "internalType": "string"
       },
       {
         "name": "deadline",
@@ -885,7 +2114,7 @@ var REGISTRY_ABI = [
         "internalType": "uint256"
       },
       {
-        "name": "signature",
+        "name": "permission",
         "type": "bytes",
         "internalType": "bytes"
       }
@@ -893,6 +2122,83 @@ var REGISTRY_ABI = [
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "signatureBytes",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "signature",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "statementFor",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "string",
+        "internalType": "string"
+      }
+    ],
+    "stateMutability": "pure"
+  },
+  {
+    "type": "function",
+    "name": "summary",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "total",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "active",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "hasCurrent",
+        "type": "bool",
+        "internalType": "bool"
+      },
+      {
+        "name": "currentIndex",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "updateKey",
@@ -903,7 +2209,7 @@ var REGISTRY_ABI = [
         "internalType": "uint256"
       },
       {
-        "name": "pgpPublicKey",
+        "name": "key",
         "type": "bytes",
         "internalType": "bytes"
       }
@@ -926,7 +2232,7 @@ var REGISTRY_ABI = [
         "internalType": "uint256"
       },
       {
-        "name": "pgpPublicKey",
+        "name": "key",
         "type": "bytes",
         "internalType": "bytes"
       },
@@ -936,7 +2242,7 @@ var REGISTRY_ABI = [
         "internalType": "uint256"
       },
       {
-        "name": "signature",
+        "name": "permission",
         "type": "bytes",
         "internalType": "bytes"
       }
@@ -973,22 +2279,16 @@ var REGISTRY_ABI = [
         "internalType": "bytes"
       },
       {
-        "name": "messageVersion",
-        "type": "uint8",
-        "indexed": false,
-        "internalType": "uint8"
-      },
-      {
-        "name": "keyPtr",
+        "name": "payload",
         "type": "address",
         "indexed": false,
         "internalType": "address"
       },
       {
-        "name": "sigPtr",
-        "type": "address",
+        "name": "messageVersion",
+        "type": "uint8",
         "indexed": false,
-        "internalType": "address"
+        "internalType": "uint8"
       },
       {
         "name": "submitter",
@@ -1022,13 +2322,13 @@ var REGISTRY_ABI = [
         "internalType": "uint256"
       },
       {
-        "name": "oldKeyPtr",
+        "name": "oldPayload",
         "type": "address",
         "indexed": false,
         "internalType": "address"
       },
       {
-        "name": "newKeyPtr",
+        "name": "newPayload",
         "type": "address",
         "indexed": false,
         "internalType": "address"
@@ -1078,11 +2378,23 @@ var REGISTRY_ABI = [
         "internalType": "uint256"
       },
       {
-        "name": "kind",
+        "name": "kindHash",
         "type": "bytes32",
         "indexed": true,
         "internalType": "bytes32"
       },
+      {
+        "name": "kind",
+        "type": "string",
+        "indexed": false,
+        "internalType": "string"
+      },
+      {
+        "name": "value",
+        "type": "string",
+        "indexed": false,
+        "internalType": "string"
+      },
       {
         "name": "submitter",
         "type": "address",
@@ -1092,6 +2404,31 @@ var REGISTRY_ABI = [
     ],
     "anonymous": false
   },
+  {
+    "type": "event",
+    "name": "RecordsMoved",
+    "inputs": [
+      {
+        "name": "owner",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "fromIndex",
+        "type": "uint256",
+        "indexed": true,
+        "internalType": "uint256"
+      },
+      {
+        "name": "toIndex",
+        "type": "uint256",
+        "indexed": true,
+        "internalType": "uint256"
+      }
+    ],
+    "anonymous": false
+  },
   {
     "type": "event",
     "name": "Revoked",
@@ -1114,6 +2451,18 @@ var REGISTRY_ABI = [
         "indexed": true,
         "internalType": "uint256"
       },
+      {
+        "name": "reason",
+        "type": "string",
+        "indexed": false,
+        "internalType": "string"
+      },
+      {
+        "name": "replacedBy",
+        "type": "uint256",
+        "indexed": false,
+        "internalType": "uint256"
+      },
       {
         "name": "submitter",
         "type": "address",
@@ -1126,831 +2475,629 @@ var REGISTRY_ABI = [
   {
     "type": "error",
     "name": "AlreadyRevoked",
-    "inputs": []
-  },
-  {
-    "type": "error",
-    "name": "AuthorizationExpired",
-    "inputs": []
-  },
-  {
-    "type": "error",
-    "name": "DeploymentFailed",
-    "inputs": []
+    "inputs": [
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
   },
   {
     "type": "error",
-    "name": "DuplicateActiveFingerprint",
+    "name": "BadArmorChecksum",
     "inputs": []
   },
   {
     "type": "error",
-    "name": "EmptyPublicKey",
+    "name": "BadBase64",
     "inputs": []
   },
   {
     "type": "error",
-    "name": "EmptySignature",
-    "inputs": []
+    "name": "ClaimActive",
+    "inputs": [
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
   },
   {
     "type": "error",
-    "name": "IndexOutOfBounds",
+    "name": "DeploymentFailed",
     "inputs": []
   },
   {
     "type": "error",
-    "name": "InvalidAuthorization",
-    "inputs": []
+    "name": "DuplicateActiveFingerprint",
+    "inputs": [
+      {
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ]
   },
   {
     "type": "error",
-    "name": "InvalidFingerprintLength",
+    "name": "EmptyKey",
     "inputs": []
   },
   {
     "type": "error",
-    "name": "InvalidPointer",
+    "name": "EmptySignature",
     "inputs": []
   },
   {
     "type": "error",
-    "name": "PublicKeyTooLarge",
-    "inputs": []
+    "name": "IndexOutOfBounds",
+    "inputs": [
+      {
+        "name": "index",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "count",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
   },
   {
     "type": "error",
-    "name": "RecordTooLarge",
-    "inputs": []
+    "name": "InvalidFingerprint",
+    "inputs": [
+      {
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ]
   },
   {
     "type": "error",
-    "name": "SignatureTooLarge",
-    "inputs": []
-  }
-];
-
-// src/core/contract.ts
-import { mainnet, sepolia, foundry } from "viem/chains";
-var REGISTRY_ADDRESS = "0x9302E02e2869e129aC8516fE5eFFd51EA3082c09";
-var NETWORKS = {
-  mainnet: {
-    chainId: 1,
-    address: REGISTRY_ADDRESS,
-    deployBlock: 25962908n,
-    // 2026-09-12, tx 0xda4c3a19cae4e71ffb02559a048403f664d5a7967c19d42158c39600ec63bad8
-    explorerUrl: "https://etherscan.io",
-    defaultRpcUrl: "https://ethereum.publicnode.com"
-    // same service as ethereum-rpc.publicnode.com; this hostname resolves on more networks
-  },
-  sepolia: {
-    chainId: 11155111,
-    address: REGISTRY_ADDRESS,
-    deployBlock: 11683667n,
-    // 2026-09-11, tx 0x3e40e8f5b9fbf82a4b8943561bcc9b964b2987de10640ac8ff3a1b4ef0725322
-    explorerUrl: "https://sepolia.etherscan.io",
-    defaultRpcUrl: "https://ethereum-sepolia.publicnode.com"
-  },
-  /** A local anvil instance (`anvil`, chain id 31337). Deploy with pgp-registry's Deploy script. */
-  local: {
-    chainId: 31337,
-    address: REGISTRY_ADDRESS,
-    deployBlock: 0n,
-    explorerUrl: "",
-    defaultRpcUrl: "http://127.0.0.1:8545"
-  }
-};
-function isNetworkName(value) {
-  return value === "mainnet" || value === "sepolia" || value === "local";
-}
-function getRegistry(network = "mainnet", addressOverride) {
-  const r = NETWORKS[network];
-  if (!r) throw new Error(`Unknown network: ${network}`);
-  if (addressOverride && /^0x[0-9a-fA-F]{40}$/.test(addressOverride)) {
-    return { ...r, address: addressOverride };
-  }
-  return r;
-}
-function chainFor(network = "mainnet") {
-  if (network === "sepolia") return sepolia;
-  if (network === "local") return foundry;
-  return mainnet;
-}
-
-// src/core/identityError.ts
-function needsRpcProbe(s) {
-  return s.ensEmpty || s.ensFailed || s.claimsFailed;
-}
-function identityErrorKind(s) {
-  if (!needsRpcProbe(s) || s.rpcAnswered === void 0) return null;
-  if (!s.rpcAnswered) return "rpc";
-  if (s.ensEmpty && !s.ensFailed) return "not-found";
-  return "read";
-}
-var IDENTITY_ERROR_TEXT = {
-  rpc: "Couldn't reach the RPC, so nothing here is known yet.",
-  "not-found": "No address for this name.",
-  read: "Couldn't read the registry."
-};
-
-// src/core/fingerprint.ts
-import { keccak256 } from "viem";
-var FINGERPRINT_HEX = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
-function normalizeFingerprint(input) {
-  const hex = input.replace(/^0x/i, "").replace(/\s+/g, "").toLowerCase();
-  return FINGERPRINT_HEX.test(hex) ? hex : null;
-}
-function fingerprintToBytes(fingerprint) {
-  const hex = normalizeFingerprint(fingerprint);
-  if (!hex) throw new Error(`Invalid PGP fingerprint: ${fingerprint}`);
-  return `0x${hex}`;
-}
-function bytesToFingerprint(bytes) {
-  return bytes.replace(/^0x/i, "").toLowerCase();
-}
-function fingerprintHash(fingerprint) {
-  return keccak256(fingerprintToBytes(fingerprint));
-}
-function keyIdOf(fingerprint) {
-  const hex = normalizeFingerprint(fingerprint);
-  if (!hex) throw new Error(`Invalid PGP fingerprint: ${fingerprint}`);
-  return `0x${keyIdHex(hex)}`;
-}
-function keyIdHex(normalizedFingerprint) {
-  return normalizedFingerprint.length === 64 ? normalizedFingerprint.slice(0, 16) : normalizedFingerprint.slice(-16);
-}
-function keyIdToBytes(keyId) {
-  const hex = keyId.replace(/^0x/i, "").replace(/\s+/g, "").toLowerCase();
-  return /^[0-9a-f]{16}$/.test(hex) ? `0x${hex}` : null;
-}
-
-// src/core/pgp.ts
-function pgpConfig(openpgp) {
-  const rejectCurves = new Set([...openpgp.config.rejectCurves ?? []].filter((c) => c !== "secp256k1"));
-  return { ...openpgp.config, rejectCurves };
-}
-function algorithmName(keyOrSubkey) {
-  try {
-    const info = keyOrSubkey.getAlgorithmInfo();
-    const curve = (info.curve || "").toLowerCase();
-    if (curve.startsWith("ed25519") || info.algorithm === "ed25519" || info.algorithm === "eddsaLegacy") return "Ed25519";
-    if (curve.startsWith("curve25519") || info.algorithm === "x25519") return "Cv25519";
-    if (curve.startsWith("ed448")) return "Ed448";
-    if (curve.startsWith("curve448") || info.algorithm === "x448") return "X448";
-    if (curve.startsWith("nistp") || curve.startsWith("p")) return `NIST P-${curve.replace(/\D/g, "")}`;
-    if (curve.startsWith("secp")) return curve;
-    if (curve.startsWith("brainpool")) return curve;
-    if (info.algorithm.startsWith("rsa")) return info.bits ? `RSA ${info.bits}` : "RSA";
-    if (info.algorithm.startsWith("dsa")) return info.bits ? `DSA ${info.bits}` : "DSA";
-    if (info.algorithm.startsWith("elgamal")) return info.bits ? `ElGamal ${info.bits}` : "ElGamal";
-    return info.curve || info.algorithm;
-  } catch {
-    return String(keyOrSubkey.keyPacket?.algorithm ?? "unknown");
-  }
-}
-async function parsePgpKey(armoredKey) {
-  try {
-    const openpgp = await import("openpgp");
-    const { readKey } = openpgp;
-    const config = pgpConfig(openpgp);
-    const key = await readKey({ armoredKey });
-    const fingerprint = key.getFingerprint().toUpperCase();
-    const algorithm = algorithmName(key);
-    const created = key.keyPacket.created?.toISOString() ?? null;
-    const expiration = await key.getExpirationTime();
-    const expires = expiration && expiration !== Infinity ? new Date(expiration).toISOString() : null;
-    const userIDs = [];
-    const notations = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const user of key.users) {
-      const certs = user.selfCertifications;
-      if (!certs || certs.length === 0) continue;
-      let userVerified = false;
-      for (const cert of certs) {
-        try {
-          await cert.verify(
-            key.keyPacket,
-            cert.signatureType,
-            { userID: user.userID, key: key.keyPacket },
-            void 0,
-            // date: now
-            void 0,
-            // detached
-            config
-          );
-        } catch {
-          continue;
-        }
-        userVerified = true;
-        if (cert.rawNotations) {
-          for (const n of cert.rawNotations) {
-            const name = typeof n.name === "string" ? n.name : new TextDecoder().decode(n.name);
-            const value = n.value instanceof Uint8Array ? new TextDecoder().decode(n.value) : typeof n.value === "string" ? n.value : null;
-            if (value) {
-              if (!seen.has(value)) {
-                seen.add(value);
-                notations.push({ name, value });
-              }
-            }
-          }
-        }
+    "name": "InvalidFingerprintLength",
+    "inputs": [
+      {
+        "name": "length",
+        "type": "uint256",
+        "internalType": "uint256"
       }
-      if (userVerified) {
-        const uid = user.userID?.userID;
-        if (uid) userIDs.push(uid);
+    ]
+  },
+  {
+    "type": "error",
+    "name": "InvalidKindName",
+    "inputs": [
+      {
+        "name": "kind",
+        "type": "string",
+        "internalType": "string"
       }
-    }
-    const subkeys = key.subkeys.map((sk) => ({
-      algorithm: algorithmName(sk),
-      created: sk.keyPacket.created?.toISOString() ?? null,
-      fingerprint: sk.getFingerprint().toUpperCase()
-    }));
-    return { fingerprint, userIDs, algorithm, created, expires, notations, subkeys };
-  } catch {
-    return null;
-  }
-}
-async function verifyClearsigned({ armoredKey, clearsigned }) {
-  try {
-    const openpgp = await import("openpgp");
-    const { readKey, readCleartextMessage, LiteralDataPacket } = openpgp;
-    const config = pgpConfig(openpgp);
-    const publicKey = await readKey({ armoredKey });
-    const message = await readCleartextMessage({ cleartextMessage: clearsigned });
-    const msg = message;
-    const now = /* @__PURE__ */ new Date();
-    for (const sig of msg.signature.packets) {
-      if (!publicKey.getKeys(sig.issuerKeyID).length) continue;
-      const signingKey = await publicKey.getSigningKey(sig.issuerKeyID, now, void 0, config);
-      const literal = new LiteralDataPacket();
-      literal.setText(msg.text ?? message.getText().replace(/\r?\n/g, "\r\n"));
-      await sig.verify(signingKey.keyPacket, sig.signatureType, literal, now, true, config);
-      return { verified: true, text: message.getText() };
-    }
-    return { verified: false, reason: "Message is not signed by this key", text: message.getText() };
-  } catch (err) {
-    return { verified: false, reason: err instanceof Error ? err.message : "Verification failed", text: "" };
-  }
-}
-async function verifyAttestation({
-  pgpPublicKey,
-  pgpSignature,
-  fingerprint,
-  ethAddress
-}) {
-  try {
-    if (!pgpPublicKey || !pgpSignature) {
-      return { verified: false, reason: "Missing PGP data" };
-    }
-    const openpgp = await import("openpgp");
-    const { readKey } = openpgp;
-    const publicKey = await readKey({ armoredKey: pgpPublicKey });
-    const keyFingerprint = publicKey.getFingerprint().toUpperCase();
-    if (keyFingerprint !== fingerprint.toUpperCase()) {
-      return { verified: false, reason: "Key fingerprint mismatch" };
-    }
-    const v = await verifyClearsigned({ armoredKey: pgpPublicKey, clearsigned: pgpSignature });
-    if (!v.verified) return { verified: false, reason: v.reason };
-    const signedText = v.text;
-    if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
-      return { verified: false, reason: "Signed message does not contain ETH address" };
-    }
-    return { verified: true };
-  } catch {
-    return { verified: false, reason: "Signature verification failed" };
-  }
-}
-var EMAIL_UID = /@/;
-async function stripEmailUserIDs(armoredKey) {
-  try {
-    const { readKey } = await import("openpgp");
-    const key = await readKey({ armoredKey });
-    const kept = [];
-    const removed = [];
-    const users = key.users.filter((u) => {
-      const uid = u.userID?.userID;
-      if (!uid) return false;
-      if (EMAIL_UID.test(uid)) {
-        removed.push(uid);
-        return false;
+    ]
+  },
+  {
+    "type": "error",
+    "name": "InvalidPermission",
+    "inputs": []
+  },
+  {
+    "type": "error",
+    "name": "InvalidPointer",
+    "inputs": []
+  },
+  {
+    "type": "error",
+    "name": "KeyCompromised",
+    "inputs": [
+      {
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
       }
-      kept.push(uid);
-      return true;
-    });
-    if (users.length === 0) return null;
-    key.users = users;
-    return { armored: key.armor(), kept, removed };
-  } catch {
-    return null;
-  }
-}
-async function hasEmailUserID(armoredKey) {
-  try {
-    const { readKey } = await import("openpgp");
-    const key = await readKey({ armoredKey });
-    return key.users.some((u) => EMAIL_UID.test(u.userID?.userID ?? ""));
-  } catch {
-    return false;
-  }
-}
-
-// src/core/efp.ts
-var EFP_API = "https://api.ethfollow.xyz/api/v1";
-async function fetchEFPGraph(address) {
-  try {
-    const [statsResp, listsResp] = await Promise.all([
-      fetch(`${EFP_API}/users/${address}/stats`),
-      fetch(`${EFP_API}/users/${address}/lists`)
-    ]);
-    if (!statsResp.ok && !listsResp.ok) return null;
-    const statsData = statsResp.ok ? await statsResp.json() : {};
-    const listsData = listsResp.ok ? await listsResp.json() : {};
-    const followers = parseInt(statsData.followers_count) || 0;
-    const listId = listsData.primary_list;
-    let following = 0;
-    let top8 = [];
-    if (listId) {
-      const [followingResp, top8Resp] = await Promise.all([
-        fetch(`${EFP_API}/lists/${listId}/following?limit=100`),
-        fetch(`${EFP_API}/lists/${listId}/following?limit=8&tags=top8`)
-      ]);
-      const followingData = followingResp.ok ? await followingResp.json() : { following: [] };
-      const top8Data = top8Resp.ok ? await top8Resp.json() : { following: [] };
-      following = (followingData.following || []).length;
-      top8 = (top8Data.following || []).map((f) => f.data);
-    }
-    return { followers, following, top8, hasEfp: !!listId || followers > 0 };
-  } catch {
-    return null;
-  }
-}
-
-// src/core/proofs.ts
-var PROVIDERS = [
+    ]
+  },
   {
-    provider: "github",
-    label: "GitHub",
-    pattern: /^https:\/\/gist\.github\.com\/([^/]+)\/([a-f0-9]+)$/i,
-    parse: (m) => ({ user: m[1], gistId: m[2] })
+    "type": "error",
+    "name": "KeyStillActive",
+    "inputs": [
+      {
+        "name": "fingerprint",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ]
   },
   {
-    // A repository's description — the form an organisation can use, since
-    // gists belong to user accounts only. Same shape as the Codeberg proof.
-    provider: "github",
-    label: "GitHub",
-    pattern: /^https:\/\/github\.com\/([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/i,
-    parse: (m) => ({ user: m[1], repo: m[2] })
+    "type": "error",
+    "name": "KeyTooLarge",
+    "inputs": [
+      {
+        "name": "size",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "max",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
   },
   {
-    provider: "dns",
-    label: "DNS",
-    // domain is restricted to a hostname (labels may include underscores for
-    // records like _thurin.example.com); rejects slashes, userinfo, and spaces.
-    pattern: /^dns:([a-z0-9._-]+)\?type=TXT$/i,
-    parse: (m) => ({ domain: m[1] })
+    "type": "error",
+    "name": "NotAKey",
+    "inputs": [
+      {
+        "name": "firstByte",
+        "type": "bytes1",
+        "internalType": "bytes1"
+      }
+    ]
   },
   {
-    provider: "farcaster",
-    label: "Farcaster",
-    pattern: /^https:\/\/farcaster\.xyz\/([^/]+)\/(0x[a-f0-9]+)$/i,
-    parse: (m) => ({ user: m[1], castHash: m[2] })
+    "type": "error",
+    "name": "NotASignature",
+    "inputs": [
+      {
+        "name": "firstByte",
+        "type": "bytes1",
+        "internalType": "bytes1"
+      }
+    ]
   },
   {
-    provider: "codeberg",
-    label: "Codeberg",
-    pattern: /^https:\/\/codeberg\.org\/([^/]+)\/([^/]+)$/i,
-    parse: (m) => ({ user: m[1], repo: m[2] })
+    "type": "error",
+    "name": "NotArmored",
+    "inputs": []
   },
   {
-    provider: "mastodon",
-    label: "Mastodon",
-    // instance is restricted to a bare hostname (optional port) so a value
-    // like "mastodon.social@evil.com" can't redirect the lookup elsewhere.
-    pattern: /^https:\/\/([a-z0-9.-]+(?::\d+)?)\/@([^/@?#\s]+)$/i,
-    parse: (m) => ({ instance: m[1], user: m[2] })
-  }
-];
-function identifyProof(notation) {
-  if (notation.name !== "proof@thurin.id") return null;
-  for (const { provider, label, pattern, parse } of PROVIDERS) {
-    const m = notation.value.match(pattern);
-    if (m) {
-      return { provider, label, url: notation.value, ...parse(m) };
-    }
-  }
-  return { provider: "unknown", label: "Unknown", url: notation.value };
-}
-function displayUrl(proof) {
-  if (proof.provider === "dns") return proof.domain;
-  if (proof.provider === "github") return proof.user;
-  if (proof.provider === "farcaster") return `@${proof.user}`;
-  if (proof.provider === "codeberg") return proof.user;
-  if (proof.provider === "mastodon") return `@${proof.user}@${proof.instance}`;
-  return proof.url;
-}
-function proofHref(proof) {
-  if (proof.provider === "dns") return `https://${proof.domain}`;
-  if (proof.provider === "github") return `https://github.com/${proof.user}`;
-  if (proof.provider === "farcaster") return `https://farcaster.xyz/${proof.user}`;
-  if (proof.provider === "codeberg") return `https://codeberg.org/${proof.user}`;
-  if (proof.provider === "mastodon") return `https://${proof.instance}/@${proof.user}`;
-  if (proof.url.startsWith("http")) return proof.url;
-  return null;
-}
-function proofSecondaryHref(proof) {
-  if (proof.provider === "github") return proof.url;
-  if (proof.provider === "farcaster") return proof.url;
-  if (proof.provider === "codeberg") return proof.url;
-  if (proof.provider === "mastodon") return proof.url;
-  return null;
-}
-var FPR_TOKEN = "OPENPGP4FPR:";
-function containsFingerprint(text, fingerprint) {
-  return text.toUpperCase().includes(FPR_TOKEN + fingerprint.toUpperCase());
-}
-function containsFingerprintUrl(text, fingerprint) {
-  return text.toUpperCase().includes(fingerprint.toUpperCase());
-}
-async function verifyGitHub(proof, fingerprint) {
-  if (proof.repo) return verifyGitHubRepo(proof, fingerprint);
-  try {
-    const resp = await fetch(`https://api.github.com/gists/${proof.gistId}`);
-    if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
-    const data = await resp.json();
-    if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
-      return { verified: false, reason: "Gist owner does not match claimed user" };
-    }
-    for (const file of Object.values(data.files || {})) {
-      if (file.content && containsFingerprint(file.content, fingerprint)) {
-        return { verified: true };
+    "type": "error",
+    "name": "PayloadTooLarge",
+    "inputs": [
+      {
+        "name": "size",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "max",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "PermissionExpired",
+    "inputs": [
+      {
+        "name": "deadline",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "RecordTooLarge",
+    "inputs": [
+      {
+        "name": "size",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "max",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "SignatureTooLarge",
+    "inputs": [
+      {
+        "name": "size",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "max",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "SupersededIsSetByReattest",
+    "inputs": []
+  },
+  {
+    "type": "error",
+    "name": "TooManyClaims",
+    "inputs": []
+  },
+  {
+    "type": "error",
+    "name": "UnknownRevokeReason",
+    "inputs": [
+      {
+        "name": "reason",
+        "type": "string",
+        "internalType": "string"
       }
-    }
-    return { verified: false, reason: "Fingerprint token not found in gist" };
-  } catch (err) {
-    return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+    ]
+  },
+  {
+    "type": "error",
+    "name": "UnsupportedHeader",
+    "inputs": []
   }
-}
-async function verifyGitHubRepo(proof, fingerprint) {
-  try {
-    const resp = await fetch(
-      `https://api.github.com/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
-    );
-    if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
-    const data = await resp.json();
-    if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
-      return { verified: false, reason: "Repository owner does not match claimed account" };
-    }
-    if (data.description && containsFingerprint(data.description, fingerprint)) {
-      return { verified: true };
-    }
-    return { verified: false, reason: "Fingerprint token not found in repository description" };
-  } catch (err) {
-    return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+];
+
+// src/core/contract.ts
+var REGISTRY_ADDRESS = "0xFa6956c11163517249f8A67F5560a4406B519451";
+var NETWORKS = {
+  mainnet: {
+    chainId: 1,
+    address: REGISTRY_ADDRESS,
+    explorerUrl: "https://etherscan.io",
+    defaultRpcUrl: "https://ethereum.publicnode.com"
+    // resolves on more networks than ethereum-rpc.publicnode.com
+  },
+  sepolia: {
+    chainId: 11155111,
+    address: REGISTRY_ADDRESS,
+    explorerUrl: "https://sepolia.etherscan.io",
+    defaultRpcUrl: "https://ethereum-sepolia.publicnode.com"
+  },
+  /** A local anvil instance (`anvil`, chain id 31337). Deploy with pgp-registry's Deploy script. */
+  local: {
+    chainId: 31337,
+    address: REGISTRY_ADDRESS,
+    explorerUrl: "",
+    defaultRpcUrl: "http://127.0.0.1:8545"
   }
+};
+function isNetworkName(value) {
+  return value === "mainnet" || value === "sepolia" || value === "local";
 }
-async function verifyDNS(proof, fingerprint) {
-  try {
-    const resp = await fetch(
-      `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(proof.domain)}&type=TXT`,
-      { headers: { Accept: "application/dns-json" } }
-    );
-    if (!resp.ok) return { verified: false, reason: `DNS query returned ${resp.status}` };
-    const data = await resp.json();
-    for (const answer of data.Answer || []) {
-      if (answer.type !== 16) continue;
-      if (answer.data && containsFingerprint(answer.data, fingerprint)) {
-        return { verified: true };
-      }
-    }
-    return { verified: false, reason: "Fingerprint token not found in TXT records" };
-  } catch (err) {
-    return { verified: false, reason: `DNS fetch failed: ${err.message}` };
+function getRegistry(network = "mainnet", addressOverride) {
+  const r = NETWORKS[network];
+  if (!r) throw new Error(`Unknown network: ${network}`);
+  if (addressOverride && /^0x[0-9a-fA-F]{40}$/.test(addressOverride)) {
+    return { ...r, address: addressOverride };
   }
+  return r;
 }
-var FARCASTER_HUB = "https://haatz.quilibrium.com";
-var NEYNAR_HUB = "https://hub-api.neynar.com";
-function farcasterSource(opts) {
-  if (opts.farcasterHub) return { base: opts.farcasterHub.replace(/\/+$/, ""), headers: {} };
-  if (opts.neynarApiKey) return { base: NEYNAR_HUB, headers: { "x-api-key": opts.neynarApiKey } };
-  return { base: FARCASTER_HUB, headers: {} };
+function chainFor(network = "mainnet") {
+  if (network === "sepolia") return sepolia;
+  if (network === "local") return foundry;
+  return mainnet;
 }
-async function verifyFarcaster(proof, fingerprint, opts = {}) {
-  const { base, headers } = farcasterSource(opts);
-  const host = base.replace(/^https?:\/\//, "");
-  try {
-    const nameResp = await fetch(`${base}/v1/userNameProofByName?name=${encodeURIComponent(proof.user)}`, { headers });
-    if (nameResp.status === 404) return { verified: false, reason: `Could not resolve Farcaster user "${proof.user}"` };
-    if (!nameResp.ok) return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) returned ${nameResp.status}` };
-    const fid = (await nameResp.json()).fid;
-    if (!fid) return { verified: false, reason: `Could not resolve Farcaster user "${proof.user}"` };
-    let pageToken = "";
-    for (let page = 0; page < 5; page++) {
-      const url = `${base}/v1/castsByFid?fid=${fid}&pageSize=100&reverse=true${pageToken ? `&pageToken=${pageToken}` : ""}`;
-      const resp = await fetch(url, { headers });
-      if (!resp.ok) return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) returned ${resp.status}` };
-      const data = await resp.json();
-      for (const msg of data.messages || []) {
-        if (msg.hash && msg.hash.startsWith(proof.castHash)) {
-          const text = msg.data?.castAddBody?.text || "";
-          if (containsFingerprint(text, fingerprint)) {
-            return { verified: true };
-          }
-        }
-      }
-      if (!data.nextPageToken) break;
-      pageToken = data.nextPageToken;
-    }
-    return { verified: false, reason: "Cast not found" };
-  } catch (err) {
-    return { verified: false, reason: `Couldn't check: the Farcaster node (${host}) didn't answer (${err.message})` };
-  }
+
+// src/core/claims.ts
+var CLAIM_LIMIT = 50;
+async function readClaims(client, owner, { registry = REGISTRY_ADDRESS, limit = CLAIM_LIMIT } = {}) {
+  const read = (functionName, args) => client.readContract({ address: registry, abi: REGISTRY_ABI, functionName, args });
+  const rows = await read("claimsOf", [owner]);
+  const first = Math.max(0, rows.length - limit);
+  return Promise.all(rows.map(async (row, index) => {
+    const revokedAt = Number(row.revokedAt);
+    const claim = {
+      index,
+      fingerprint: bytesToFingerprint(row.fingerprint),
+      createdAt: Number(row.createdAt),
+      revoked: revokedAt !== 0,
+      revokedAt: revokedAt || null,
+      state: row.state,
+      replacedBy: row.state === "replaced" ? Number(row.replacedBy) : null,
+      revokeReason: row.revokeReason,
+      messageVersion: Number(row.messageVersion),
+      pgpPublicKey: null,
+      pgpSignature: null,
+      verification: null
+    };
+    if (index < first) return claim;
+    const bytes = (fn) => read(fn, [owner, BigInt(index)]).catch(() => null);
+    const [keyHex, sigHex] = await Promise.all([bytes("keyBytes"), bytes("signatureBytes")]);
+    claim.pgpPublicKey = keyHex ? await payloadText(keyHex, "key") : null;
+    claim.pgpSignature = sigHex ? await payloadText(sigHex, "signature") : null;
+    claim.verification = await verifyAttestation({
+      pgpPublicKey: claim.pgpPublicKey,
+      pgpSignature: claim.pgpSignature,
+      fingerprint: claim.fingerprint,
+      ethAddress: owner
+    });
+    return claim;
+  }));
 }
-async function verifyCodeberg(proof, fingerprint) {
-  try {
-    const resp = await fetch(
-      `https://codeberg.org/api/v1/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
-    );
-    if (!resp.ok) return { verified: false, reason: `Codeberg API returned ${resp.status}` };
-    const data = await resp.json();
-    if (data.description && containsFingerprint(data.description, fingerprint)) {
-      return { verified: true };
-    }
-    return { verified: false, reason: "Fingerprint token not found in repo description" };
-  } catch (err) {
-    return { verified: false, reason: `Codeberg fetch failed: ${err.message}` };
-  }
+function keyStanding(claims) {
+  const active = claims.filter((c) => !c.revoked);
+  const verified = active.filter((c) => c.verification?.verified);
+  if (verified.length) return { kind: "verified", claim: verified[verified.length - 1] };
+  if (active.length) return { kind: "not-counted", claim: active[active.length - 1] };
+  if (claims.length) return { kind: "inactive", claim: claims[claims.length - 1] };
+  return { kind: "none", claim: null };
 }
-async function verifyMastodon(proof, fingerprint) {
-  try {
-    if (!proof.instance || !/^[a-z0-9.-]+(?::\d+)?$/i.test(proof.instance)) {
-      return { verified: false, reason: "Invalid Mastodon instance host" };
-    }
-    const resp = await fetch(
-      `https://${proof.instance}/api/v1/accounts/lookup?acct=${encodeURIComponent(proof.user)}`
-    );
-    if (!resp.ok) return { verified: false, reason: `Mastodon API returned ${resp.status}` };
-    const data = await resp.json();
-    const keyId = keyIdHex(fingerprint.replace(/^0x/i, "").replace(/\s+/g, "").toLowerCase());
-    for (const field of data.fields || []) {
-      const text = field.value.replace(/<[^>]*>/g, "");
-      if (containsFingerprintUrl(text, fingerprint) || containsFingerprintUrl(text, keyId)) {
-        return { verified: true };
-      }
-    }
-    if (data.note) {
-      const text = data.note.replace(/<[^>]*>/g, "");
-      if (containsFingerprintUrl(text, fingerprint) || containsFingerprintUrl(text, keyId)) {
-        return { verified: true };
-      }
+async function findOwners(client, key, { registry = REGISTRY_ADDRESS } = {}) {
+  const read = (functionName, args) => client.readContract({ address: registry, abi: REGISTRY_ABI, functionName, args });
+  let fingerprints;
+  if ("keyId" in key) {
+    const keyId = keyIdToBytes(key.keyId);
+    if (!keyId) return [];
+    fingerprints = (await read("fingerprintsForKeyId", [keyId])).map(bytesToFingerprint);
+  } else {
+    const fp = normalizeFingerprint(key.fingerprint);
+    if (!fp) return [];
+    fingerprints = [fp];
+  }
+  const found = [];
+  for (const fingerprint of fingerprints) {
+    for (const owner of await read("ownersOf", [fingerprintToBytes(fingerprint)])) {
+      if (!found.some((f) => f.owner.toLowerCase() === owner.toLowerCase() && f.fingerprint === fingerprint)) found.push({ owner, fingerprint });
     }
-    return { verified: false, reason: "Fingerprint not found in profile fields or bio" };
-  } catch (err) {
-    return { verified: false, reason: `Mastodon fetch failed: ${err.message}` };
   }
-}
-var verifiers = {
-  github: verifyGitHub,
-  dns: verifyDNS,
-  farcaster: verifyFarcaster,
-  codeberg: verifyCodeberg,
-  mastodon: verifyMastodon
-};
-async function verifyProof(proof, fingerprint, opts) {
-  const fn = verifiers[proof.provider];
-  if (!fn) return { verified: false, reason: "Unknown provider" };
-  return fn(proof, fingerprint, typeof opts === "string" ? { neynarApiKey: opts } : opts ?? {});
+  return found;
 }
 
-// src/core/avatar.ts
-var IPFS_GATEWAYS = ["https://ipfs.filebase.io/ipfs/", "https://gateway.pinata.cloud/ipfs/"];
-var IPFS_GATEWAY = IPFS_GATEWAYS[0];
-var ARWEAVE_GATEWAY = "https://arweave.net/";
-function avatarUrl(uri) {
-  if (typeof uri !== "string") return null;
-  const u = uri.trim();
-  if (/^data:image\/(png|jpe?g|gif|webp|avif|svg\+xml)[;,]/i.test(u)) return u;
-  let m = u.match(/^ipfs:\/\/(?:ipfs\/)?([a-zA-Z0-9]{46,}(?:\/[^?#\s]*)?)$/);
-  if (m) return IPFS_GATEWAY + m[1];
-  m = u.match(/^ar:\/\/([a-zA-Z0-9_-]{43}(?:\/[^?#\s]*)?)$/);
-  if (m) return ARWEAVE_GATEWAY + m[1];
-  if (/^https:\/\/euc\.li\/[^?#\s]+$/.test(u)) return u;
-  m = u.match(/^https:\/\/[^/]+\/ipfs\/([a-zA-Z0-9]{46,}(?:\/[^?#\s]*)?)$/);
-  if (m) return IPFS_GATEWAY + m[1];
-  return null;
-}
-function avatarFallbacks(url) {
-  if (!url || !url.startsWith(IPFS_GATEWAYS[0])) return [];
-  const path = url.slice(IPFS_GATEWAYS[0].length);
-  return IPFS_GATEWAYS.slice(1).map((g) => g + path);
+// src/core/claimStatus.ts
+var CLAIM_CHECK_LABEL = {
+  verified: "pgp verified",
+  expired: "key expired",
+  "signing-key-expired": "signing key expired",
+  revoked: "key revoked",
+  compromised: "key compromised",
+  "signing-key-revoked": "signing key revoked",
+  unsupported: "not supported",
+  "bad-signature": "doesn't verify"
+};
+function formatClaimDate(isoOrSeconds) {
+  if (isoOrSeconds === null || isoOrSeconds === void 0) return "an unknown date";
+  const d = typeof isoOrSeconds === "number" ? new Date(isoOrSeconds * 1e3) : new Date(isoOrSeconds);
+  if (Number.isNaN(d.getTime())) return "an unknown date";
+  return d.toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric", timeZone: "UTC" });
 }
-function parseNftAvatar(raw) {
-  const m = typeof raw === "string" && raw.trim().match(/^eip155:(\d+)\/(erc721|erc1155):(0x[0-9a-fA-F]{40})\/(\d+)$/i);
-  return m ? { chainId: Number(m[1]), standard: m[2].toLowerCase(), contract: m[3], tokenId: BigInt(m[4]) } : null;
+function shortFingerprint(fpr) {
+  if (!fpr) return "unknown";
+  const f = fpr.toUpperCase();
+  return `${f.slice(0, 4)} ${f.slice(4, 8)} \u2026`;
 }
-var NFT_AVATAR_ABI = [
-  { type: "function", name: "tokenURI", stateMutability: "view", inputs: [{ type: "uint256" }], outputs: [{ type: "string" }] },
-  { type: "function", name: "uri", stateMutability: "view", inputs: [{ type: "uint256" }], outputs: [{ type: "string" }] }
-];
-async function nftAvatarImage(tokenUri, tokenId, fetchFn = fetch) {
-  const uri = tokenUri.replace("{id}", tokenId.toString(16).padStart(64, "0"));
-  let meta;
-  const inline = uri.match(/^data:application\/json(;base64)?,([\s\S]*)$/);
-  if (inline) meta = JSON.parse(inline[1] ? atob(inline[2]) : decodeURIComponent(inline[2]));
-  else {
-    const url = uri.startsWith("data:") ? null : avatarUrl(uri);
-    if (!url) return null;
-    for (const candidate of [url, ...avatarFallbacks(url)]) {
-      try {
-        const res = await fetchFn(candidate);
-        if (res.ok) {
-          meta = await res.json();
-          break;
-        }
-      } catch {
-      }
-    }
-    if (!meta) return null;
+function claimCheckText(v, formatDate = formatClaimDate) {
+  const kind = v.kind ?? (v.verified ? "verified" : "bad-signature");
+  const at = formatDate(v.at);
+  const t = (sentence, fix = null) => ({ kind, label: CLAIM_CHECK_LABEL[kind], sentence, fix });
+  switch (kind) {
+    case "verified":
+      return t("The key signed a line naming this address, and the signature checks out.");
+    case "expired":
+      return t(
+        `The key on this claim expired on ${at}, so the claim no longer counts.`,
+        "Extend the key, then Update key. No new signature needed."
+      );
+    case "signing-key-expired":
+      return t(
+        `The subkey that signed this claim (${shortFingerprint(v.signingKey)}) expired on ${at}.`,
+        "Extend that subkey, then Update key."
+      );
+    case "revoked":
+      return t(
+        `Its owner revoked this PGP key on ${at}${v.revocationReason ? ` (reason: ${v.revocationReason})` : ""}. The claim no longer counts.`,
+        "Revoke this claim and attest your new key."
+      );
+    case "compromised":
+      return t(
+        `Its owner revoked this PGP key on ${at} as compromised. Don't trust anything it signed after that date.`,
+        "Revoke this claim and attest a new key."
+      );
+    case "signing-key-revoked":
+      return t(
+        `The subkey that signed this claim was revoked on ${at}.`,
+        "Replace the claim with a signature from a current key."
+      );
+    case "unsupported":
+      return t(`This key uses an algorithm Thurin doesn't check${v.algorithm ? ` (${v.algorithm})` : ""}. The claim is on-chain, but no lookup will vouch for it.`);
+    case "bad-signature":
+    default:
+      return t("The signature stored with this claim doesn't match its key, so nothing from this claim is shown.");
   }
-  return avatarUrl(meta?.image ?? meta?.image_url);
 }
-
-// src/core/ensHint.ts
-import { namehash, normalize } from "viem/ens";
-var ENS_HINT_KEY = "id.thurin";
-function ensHintFor(record, verifiedFingerprint) {
-  const raw = record?.trim() ?? "";
-  const expected = verifiedFingerprint ? normalizeFingerprint(verifiedFingerprint) : null;
-  if (!raw) return { key: ENS_HINT_KEY, state: "unset", record: null, fingerprint: null, expected };
-  const fingerprint = normalizeFingerprint(raw);
-  if (!fingerprint) return { key: ENS_HINT_KEY, state: "mismatch", record: raw, fingerprint: null, expected, reason: "The record is not a PGP fingerprint" };
-  if (!expected) return { key: ENS_HINT_KEY, state: "mismatch", record: raw, fingerprint, expected, reason: "The address has no verified claim" };
-  if (fingerprint === expected) return { key: ENS_HINT_KEY, state: "match", record: raw, fingerprint, expected };
-  return { key: ENS_HINT_KEY, state: "mismatch", record: raw, fingerprint, expected, reason: "The record names a key this address has not claimed" };
-}
-function ensHintValue(fingerprint) {
-  const fp = normalizeFingerprint(fingerprint);
-  if (!fp) throw new Error(`Not a fingerprint: ${fingerprint}`);
-  return fp.toUpperCase();
+function keyProblemText(v, formatDate = formatClaimDate) {
+  const at = formatDate(v.at);
+  const t = (kind, sentence, fix) => ({ kind, label: CLAIM_CHECK_LABEL[kind], sentence, fix });
+  switch (v.kind) {
+    case "expired":
+      return t("expired", `This key expired on ${at}, so a claim with it wouldn't count.`, "Extend it (gpg --quick-set-expire), then export it again.");
+    case "signing-key-expired":
+      return t("signing-key-expired", `The subkey that signed (${shortFingerprint(v.signingKey)}) expired on ${at}.`, "Extend that subkey, or sign with a current one.");
+    case "revoked":
+      return t("revoked", `This key was revoked on ${at}${v.revocationReason ? ` (reason: ${v.revocationReason})` : ""}.`, "Use a current key.");
+    case "compromised":
+      return t("compromised", `This key was revoked as compromised on ${at}.`, "Use a new key.");
+    case "signing-key-revoked":
+      return t("signing-key-revoked", `The subkey that signed was revoked on ${at}.`, "Sign with a current subkey.");
+    case "unsupported":
+      return t("unsupported", `This key uses an algorithm Thurin doesn't check${v.algorithm ? ` (${v.algorithm})` : ""}, so no lookup would vouch for the claim.`, "Use an Ed25519 or RSA key.");
+    default:
+      return null;
+  }
 }
-var ENS_TEXT_RESOLVER_ABI = [
-  { type: "function", name: "text", stateMutability: "view", inputs: [{ name: "node", type: "bytes32" }, { name: "key", type: "string" }], outputs: [{ name: "", type: "string" }] },
-  { type: "function", name: "setText", stateMutability: "nonpayable", inputs: [{ name: "node", type: "bytes32" }, { name: "key", type: "string" }, { name: "value", type: "string" }], outputs: [] }
-];
-function ensHintWrite(name, fingerprint) {
-  const normalized = normalize(name);
-  return {
-    abi: ENS_TEXT_RESOLVER_ABI,
-    functionName: "setText",
-    args: [namehash(normalized), ENS_HINT_KEY, ensHintValue(fingerprint)],
-    name: normalized
-  };
+function expiresSoon(v, now = Date.now(), withinDays = 30) {
+  if (!v?.verified || !v.expiresAt) return null;
+  const ms = new Date(v.expiresAt).getTime() - now;
+  if (!Number.isFinite(ms) || ms < 0 || ms > withinDays * 864e5) return null;
+  return { days: Math.floor(ms / 864e5), at: v.expiresAt };
 }
-async function fetchEnsHint(client, name, verifiedFingerprint) {
-  const record = await client.getEnsText({ name: normalize(name), key: ENS_HINT_KEY });
-  return ensHintFor(record, verifiedFingerprint);
+function expiresSoonText(soon, formatDate = formatClaimDate) {
+  const when = soon.days === 0 ? "today" : soon.days === 1 ? "in 1 day" : `in ${soon.days} days`;
+  return `Key expires ${when} (${formatDate(soon.at)}).`;
 }
-
-// src/core/authorization.ts
-import { hashTypedData, keccak256 as keccak2562, stringToHex } from "viem";
-var EIP712_NAME = "Thurin PGPRegistry";
-var EIP712_VERSION = "2";
-function registryDomain(chainId, verifyingContract) {
-  return { name: EIP712_NAME, version: EIP712_VERSION, chainId, verifyingContract };
+function claimFates(claims) {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of claims) {
+    if (c.state === "active" || !c.revokedAt) out.set(c.index, { state: "active" });
+    else if (c.state === "replaced" && c.replacedBy !== null) out.set(c.index, { state: "replaced", at: c.revokedAt, by: c.replacedBy, ...c.revokeReason === "compromised" ? { compromised: true } : {} });
+    else out.set(c.index, { state: "revoked", at: c.revokedAt, ...c.revokeReason ? { reason: c.revokeReason } : {} });
+  }
+  return out;
 }
-var AUTHORIZATION_TYPES = {
-  Attest: [
-    { name: "owner", type: "address" },
-    { name: "fingerprint", type: "bytes" },
-    { name: "pgpSignature", type: "bytes" },
-    { name: "pgpPublicKey", type: "bytes" },
-    { name: "nonce", type: "uint256" },
-    { name: "deadline", type: "uint256" }
-  ],
-  Reattest: [
-    { name: "owner", type: "address" },
-    { name: "revokeIndex", type: "uint256" },
-    { name: "fingerprint", type: "bytes" },
-    { name: "pgpSignature", type: "bytes" },
-    { name: "pgpPublicKey", type: "bytes" },
-    { name: "nonce", type: "uint256" },
-    { name: "deadline", type: "uint256" }
-  ],
-  UpdateKey: [
-    { name: "owner", type: "address" },
-    { name: "index", type: "uint256" },
-    { name: "pgpPublicKey", type: "bytes" },
-    { name: "nonce", type: "uint256" },
-    { name: "deadline", type: "uint256" }
-  ],
-  Revoke: [
-    { name: "owner", type: "address" },
-    { name: "index", type: "uint256" },
-    { name: "nonce", type: "uint256" },
-    { name: "deadline", type: "uint256" }
-  ],
-  SetRecord: [
-    { name: "owner", type: "address" },
-    { name: "index", type: "uint256" },
-    { name: "kind", type: "bytes32" },
-    { name: "value", type: "bytes" },
-    { name: "nonce", type: "uint256" },
-    { name: "deadline", type: "uint256" }
-  ]
-};
-function attestTypedData(chainId, registry, a) {
-  return {
-    domain: registryDomain(chainId, registry),
-    types: { Attest: AUTHORIZATION_TYPES.Attest },
-    primaryType: "Attest",
-    message: {
-      owner: a.owner,
-      fingerprint: fingerprintToBytes(a.fingerprint),
-      pgpSignature: stringToHex(a.pgpSignature),
-      pgpPublicKey: stringToHex(a.pgpPublicKey),
-      nonce: a.nonce,
-      deadline: a.deadline
-    }
-  };
+function claimFateText(fate, formatDate = (s) => formatClaimDate(s)) {
+  if (fate.state === "revoked") return `Revoked by its owner on ${formatDate(fate.at)}${fate.reason ? ` (${fate.reason})` : ""}.`;
+  if (fate.state === "replaced") return `Replaced by claim #${fate.by} on ${formatDate(fate.at)}.${fate.compromised ? " Its key was marked compromised." : ""}`;
+  return null;
 }
-function reattestTypedData(chainId, registry, a) {
-  const base = attestTypedData(chainId, registry, a);
-  return {
-    domain: base.domain,
-    types: { Reattest: AUTHORIZATION_TYPES.Reattest },
-    primaryType: "Reattest",
-    message: { ...base.message, revokeIndex: a.revokeIndex }
-  };
+
+// src/core/encrypt.ts
+async function encryptionKeyFor(claims, { now = Date.now(), recentDays = 7 } = {}) {
+  const standing = keyStanding(claims);
+  if (standing.kind === "none" || standing.kind === "inactive") return { ok: false, reason: "no-claim", claim: standing.claim };
+  if (standing.kind === "not-counted" || !standing.claim.pgpPublicKey) return { ok: false, reason: "unverified", claim: standing.claim };
+  const claim = standing.claim;
+  try {
+    const openpgp = await import("openpgp");
+    const config = pgpConfig(openpgp);
+    const key = await readKeyAny(openpgp, claim.pgpPublicKey);
+    const date = new Date(now);
+    const enc = await key.getEncryptionKey(void 0, date, void 0, config).catch(() => null);
+    if (!enc) {
+      let lastExpiry = null;
+      for (const sk of key.subkeys) {
+        const flags = newestSignature(sk.bindingSignatures)?.keyFlags?.[0] ?? 0;
+        if (!(flags & 12) || await sk.isRevoked(void 0, void 0, date, config).catch(() => false)) continue;
+        const exp2 = await sk.getExpirationTime(date, config).catch(() => null);
+        if (typeof exp2 === "number" || exp2 instanceof Date) {
+          const t = new Date(exp2).getTime();
+          if (t <= now && (lastExpiry === null || t > lastExpiry)) lastExpiry = t;
+        }
+      }
+      return lastExpiry !== null ? { ok: false, reason: "encryption-subkey-expired", claim, expired: new Date(lastExpiry).toISOString() } : { ok: false, reason: "no-encryption-subkey", claim };
+    }
+    const exp = await enc.getExpirationTime(date, config).catch(() => null);
+    return {
+      ok: true,
+      claim,
+      key: claim.pgpPublicKey,
+      subkey: {
+        fingerprint: enc.getFingerprint().toUpperCase(),
+        algorithm: algorithmName(enc),
+        expires: exp && exp !== Infinity ? new Date(exp).toISOString() : null
+      },
+      addedAt: claim.createdAt,
+      changedRecently: now / 1e3 - claim.createdAt < recentDays * 86400
+    };
+  } catch {
+    return { ok: false, reason: "unverified", claim };
+  }
 }
-function updateKeyTypedData(chainId, registry, a) {
-  return {
-    domain: registryDomain(chainId, registry),
-    types: { UpdateKey: AUTHORIZATION_TYPES.UpdateKey },
-    primaryType: "UpdateKey",
-    message: { owner: a.owner, index: a.index, pgpPublicKey: stringToHex(a.pgpPublicKey), nonce: a.nonce, deadline: a.deadline }
-  };
+function encryptRefusalText(r, formatDate = formatClaimDate) {
+  switch (r.reason) {
+    case "no-claim":
+      return "No claim counts for this identity, so there is no key to encrypt to.";
+    case "unverified":
+      return "Its newest claim doesn't verify, so its key can't be trusted with a message.";
+    case "no-encryption-subkey":
+      return "Its key has no encryption subkey, so it can sign but not receive.";
+    case "encryption-subkey-expired":
+      return `Its encryption subkey expired on ${formatDate(r.expired)}.`;
+  }
 }
-function revokeTypedData(chainId, registry, a) {
-  return {
-    domain: registryDomain(chainId, registry),
-    types: { Revoke: AUTHORIZATION_TYPES.Revoke },
-    primaryType: "Revoke",
-    message: { owner: a.owner, index: a.index, nonce: a.nonce, deadline: a.deadline }
-  };
+function keyChangedText(k, now = Date.now()) {
+  if (!k.changedRecently) return null;
+  const days = Math.floor((now / 1e3 - k.addedAt) / 86400);
+  const when = days <= 0 ? "today" : days === 1 ? "yesterday" : `${days} days ago`;
+  return `This key was added ${when}. If you were expecting a different one, check with them another way.`;
 }
-function setRecordTypedData(chainId, registry, a) {
-  return {
-    domain: registryDomain(chainId, registry),
-    types: { SetRecord: AUTHORIZATION_TYPES.SetRecord },
-    primaryType: "SetRecord",
-    message: { owner: a.owner, index: a.index, kind: a.kind, value: a.value, nonce: a.nonce, deadline: a.deadline }
-  };
+async function encryptTo(key, data, { filename, armor = typeof data === "string", hideRecipient = true, date = /* @__PURE__ */ new Date() } = {}) {
+  const openpgp = await import("openpgp");
+  const config = pgpConfig(openpgp);
+  const encryptionKeys = await readKeyAny(openpgp, key);
+  const message = typeof data === "string" ? await openpgp.createMessage({ text: data, date }) : await openpgp.createMessage({ binary: data, filename, format: "binary", date });
+  const opts = { message, encryptionKeys, config, wildcard: hideRecipient, date };
+  return armor ? await openpgp.encrypt({ ...opts, format: "armored" }) : await openpgp.encrypt({ ...opts, format: "binary" });
 }
-function authorizationDigest(typedData) {
-  return hashTypedData(typedData);
+
+// src/core/contractErrors.ts
+var CONTRACT_ERROR_TEXT = {
+  AlreadyRevoked: "That claim has already ended, or is already marked compromised.",
+  BadArmorChecksum: "The armor's checksum doesn't match its data: the paste was changed or cut short.",
+  BadBase64: "The armored data isn't valid base64.",
+  ClaimActive: 'That claim is still active: revoke it with the reason "compromised" instead.',
+  DeploymentFailed: "The key and signature couldn't be stored: together they're over the contract's size limit.",
+  DuplicateActiveFingerprint: "This address already has an active claim for this key: update it or replace it instead.",
+  EmptyKey: "No key was given.",
+  EmptySignature: "No signature was given.",
+  IndexOutOfBounds: "This address has no claim at that index.",
+  InvalidFingerprint: "That 32-byte fingerprint ends in 12 zero bytes, which no real v6 key has.",
+  InvalidFingerprintLength: "The fingerprint isn't 20 bytes (v4 key) or 32 bytes (v6 key).",
+  InvalidKindName: "The record name is empty, longer than 31 bytes, or uses something other than a-z, 0-9, '-', and '.'.",
+  InvalidPermission: "The permission isn't the owner's signature over exactly this change and their current nonce: it was already used, cancelled, or superseded by a newer one.",
+  InvalidPointer: "There is no stored data at that address.",
+  KeyCompromised: "This address marked the key compromised: it can never claim it again.",
+  KeyStillActive: 'This address still has an active claim for the key: revoke that claim as "compromised" instead.',
+  KeyTooLarge: "The key is over 16,384 bytes: export it without photos or old signatures.",
+  NotAKey: "The key doesn't start with an OpenPGP public-key packet: give gpg's export of the public key.",
+  NotASignature: "The signature is neither an OpenPGP signature nor a clearsigned message.",
+  NotArmored: "The paste has no -----BEGIN PGP and -----END PGP lines.",
+  PayloadTooLarge: "The signature and key together are over 24,000 bytes.",
+  PermissionExpired: "The permission is past its deadline: ask the owner for a new one.",
+  RecordTooLarge: "The record value is over 1,024 bytes.",
+  SignatureTooLarge: "The signature is over 8,192 bytes.",
+  SupersededIsSetByReattest: '"superseded" is set only by replacing a claim: pick another reason.',
+  TooManyClaims: "This address has reached the limit of 65,535 claims.",
+  UnknownRevokeReason: 'The revoke reason must be empty, "compromised", "retired", or "other".',
+  UnsupportedHeader: "Armor header lines (like Comment:) can't be told from the data, as when line breaks were lost: remove them."
+};
+function contractErrorName(err) {
+  for (let e = err, depth = 0; e && depth < 8; e = e.cause, depth++) {
+    const name = e.data?.errorName ?? e.errorName;
+    if (typeof name === "string" && name) return name;
+  }
+  return null;
 }
-function recordKind(name) {
-  return keccak2562(stringToHex(name));
+function contractErrorText(err) {
+  const name = contractErrorName(err);
+  return name ? CONTRACT_ERROR_TEXT[name] ?? `The registry refused it (${name}).` : null;
 }
 
 // src/core/records.ts
-import { hexToString, stringToHex as stringToHex2 } from "viem";
 var MAX_RECORD_BYTES = 1024;
+var MAX_KIND_BYTES = 31;
 function kindName(input) {
   return input.includes(".") ? input : `thurin.${input}`;
 }
+function checkKindName(input) {
+  if (!/^[a-z0-9.-]+$/.test(input)) throw new Error(`Record name "${input}": use a-z, 0-9, "-" and "." only`);
+  const name = kindName(input);
+  if (name.length > MAX_KIND_BYTES) throw new Error(`Record name "${name}" is ${name.length} bytes; the registry allows ${MAX_KIND_BYTES}`);
+  return name;
+}
+function checkRecordValue(value) {
+  const bytes = new TextEncoder().encode(value).length;
+  if (bytes > MAX_RECORD_BYTES) throw new Error(`Record is ${bytes} bytes; the registry accepts up to ${MAX_RECORD_BYTES}`);
+  return value;
+}
 var KNOWN_KINDS = [
   "thurin.railgun",
   "thurin.security",
   "thurin.successor",
   "thurin.affiliation",
   "thurin.canary",
-  "thurin.private",
-  "thurin.disclosure",
-  "thurin.pointer"
-];
-var IDENTITY_KINDS = [
-  "thurin.railgun",
-  "thurin.security",
-  "thurin.successor",
-  "thurin.affiliation",
-  "thurin.canary",
+  "thurin.releases",
   "thurin.private",
   "thurin.disclosure"
 ];
-function encodeRecord(value) {
-  const bytes = new TextEncoder().encode(value).length;
-  if (bytes > MAX_RECORD_BYTES) throw new Error(`Record is ${bytes} bytes; the registry accepts up to ${MAX_RECORD_BYTES}`);
-  return stringToHex2(value);
-}
-function decodeRecord(hex) {
-  return hex === "0x" ? "" : hexToString(hex);
-}
-function parsePointer(text) {
+function parseReleases(text) {
   const p = JSON.parse(text);
-  if (p?.v !== 1 || !Array.isArray(p.releases)) throw new Error("Not a v1 thurin.pointer record");
+  if (p?.v !== 1 || !Array.isArray(p.releases)) throw new Error("Not a v1 thurin.releases record");
   return p;
 }
-function addPointer(existing, entry) {
+function addRelease(existing, entry) {
   if (!/^[0-9a-f]{64}$/i.test(entry.sha256)) throw new Error("sha256 must be 64 hex characters");
   const releases = [entry, ...(existing?.releases ?? []).filter((r) => r.name !== entry.name)];
   const dropped = [];
@@ -1958,7 +3105,7 @@ function addPointer(existing, entry) {
   while (new TextEncoder().encode(JSON.stringify(record)).length > MAX_RECORD_BYTES && releases.length > 1) dropped.push(releases.pop());
   return { record, dropped };
 }
-function renderPointer(p) {
+function renderReleases(p) {
   return p.releases.map((r) => `${r.name.padEnd(22)} ${r.date}  sha256 ${r.sha256}${r.url ? `  ${r.url}` : ""}`).join("\n");
 }
 var RAILGUN_ADDRESS = /^0zk1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]{60,200}$/;
@@ -2018,90 +3165,213 @@ async function parseRecord(kind, text, opts = {}) {
       }
       return { ...base, valid: true, data: { type: "encrypted", recipients } };
     }
-    case "thurin.pointer": {
+    case "thurin.releases": {
       try {
-        return { ...base, valid: true, data: { type: "pointer", releases: parsePointer(t).releases } };
+        return { ...base, valid: true, data: { type: "releases", releases: parseReleases(t).releases } };
       } catch {
-        return invalid("Not a v1 pointer record");
+        return invalid('Not a v1 release list: expected {"v":1,"releases":[\u2026]}');
       }
     }
     default:
       return { ...base, valid: true, data: { type: "text" } };
   }
 }
-async function fetchRecords(client, registry, abi, owner, index, kinds = IDENTITY_KINDS, opts = {}) {
+function pickRecords(names, values, kinds = KNOWN_KINDS) {
+  const all = names.map((kind, i) => ({ kind, text: values[i] ?? "" })).filter((r) => r.text);
+  if (!kinds) return all;
+  return kinds.flatMap((k) => all.filter((r) => r.kind === k));
+}
+function pageRecords(names, values) {
+  const all = pickRecords(names, values, null);
+  const ours = KNOWN_KINDS.flatMap((k) => all.filter((r) => r.kind === k));
+  return [...ours, ...all.filter((r) => !KNOWN_KINDS.includes(r.kind))];
+}
+async function fetchRecords(client, registry, abi, owner, index, kinds = KNOWN_KINDS, opts = {}) {
+  const [names, values] = await client.readContract({ address: registry, abi, functionName: "recordsOf", args: [owner, BigInt(index)] });
   const out = [];
-  for (const kind of kinds) {
-    const hex = await client.readContract({ address: registry, abi, functionName: "record", args: [owner, BigInt(index), recordKind(kind)] });
-    const text = decodeRecord(hex);
-    if (text) out.push(await parseRecord(kind, text, opts));
-  }
+  for (const r of pickRecords(names, values, kinds)) out.push(await parseRecord(r.kind, r.text, opts));
   return out;
 }
 
+// src/core/avatar.ts
+var IPFS_GATEWAYS = ["https://ipfs.filebase.io/ipfs/", "https://gateway.pinata.cloud/ipfs/"];
+var IPFS_GATEWAY = IPFS_GATEWAYS[0];
+var ARWEAVE_GATEWAY = "https://arweave.net/";
+function avatarUrl(uri) {
+  if (typeof uri !== "string") return null;
+  const u = uri.trim();
+  if (/^data:image\/(png|jpe?g|gif|webp|avif|svg\+xml)[;,]/i.test(u)) return u;
+  let m = u.match(/^ipfs:\/\/(?:ipfs\/)?([a-zA-Z0-9]{46,}(?:\/[^?#\s]*)?)$/);
+  if (m) return IPFS_GATEWAY + m[1];
+  m = u.match(/^ar:\/\/([a-zA-Z0-9_-]{43}(?:\/[^?#\s]*)?)$/);
+  if (m) return ARWEAVE_GATEWAY + m[1];
+  if (/^https:\/\/euc\.li\/[^?#\s]+$/.test(u)) return u;
+  m = u.match(/^https:\/\/[^/]+\/ipfs\/([a-zA-Z0-9]{46,}(?:\/[^?#\s]*)?)$/);
+  if (m) return IPFS_GATEWAY + m[1];
+  return null;
+}
+function avatarFallbacks(url) {
+  if (!url || !url.startsWith(IPFS_GATEWAYS[0])) return [];
+  const path = url.slice(IPFS_GATEWAYS[0].length);
+  return IPFS_GATEWAYS.slice(1).map((g) => g + path);
+}
+function parseNftAvatar(raw) {
+  const m = typeof raw === "string" && raw.trim().match(/^eip155:(\d+)\/(erc721|erc1155):(0x[0-9a-fA-F]{40})\/(\d+)$/i);
+  return m ? { chainId: Number(m[1]), standard: m[2].toLowerCase(), contract: m[3], tokenId: BigInt(m[4]) } : null;
+}
+var NFT_AVATAR_ABI = [
+  { type: "function", name: "tokenURI", stateMutability: "view", inputs: [{ type: "uint256" }], outputs: [{ type: "string" }] },
+  { type: "function", name: "uri", stateMutability: "view", inputs: [{ type: "uint256" }], outputs: [{ type: "string" }] }
+];
+async function nftAvatarImage(tokenUri, tokenId, fetchFn = fetch) {
+  const uri = tokenUri.replace("{id}", tokenId.toString(16).padStart(64, "0"));
+  let meta;
+  const inline = uri.match(/^data:application\/json(;base64)?,([\s\S]*)$/);
+  if (inline) meta = JSON.parse(inline[1] ? atob(inline[2]) : decodeURIComponent(inline[2]));
+  else {
+    const url = uri.startsWith("data:") ? null : avatarUrl(uri);
+    if (!url) return null;
+    for (const candidate of [url, ...avatarFallbacks(url)]) {
+      try {
+        const res = await fetchFn(candidate);
+        if (res.ok) {
+          meta = await res.json();
+          break;
+        }
+      } catch {
+      }
+    }
+    if (!meta) return null;
+  }
+  return avatarUrl(meta?.image ?? meta?.image_url);
+}
+
+// src/core/ensHint.ts
+import { namehash, normalize } from "viem/ens";
+var ENS_HINT_KEY = "id.thurin";
+function ensHintFor(record, verifiedFingerprint) {
+  const raw = record?.trim() ?? "";
+  const expected = verifiedFingerprint ? normalizeFingerprint(verifiedFingerprint) : null;
+  if (!raw) return { key: ENS_HINT_KEY, state: "unset", record: null, fingerprint: null, expected };
+  const fingerprint = normalizeFingerprint(raw);
+  if (!fingerprint) return { key: ENS_HINT_KEY, state: "mismatch", record: raw, fingerprint: null, expected, reason: "The record is not a PGP fingerprint" };
+  if (!expected) return { key: ENS_HINT_KEY, state: "mismatch", record: raw, fingerprint, expected, reason: "The address has no verified claim" };
+  if (fingerprint === expected) return { key: ENS_HINT_KEY, state: "match", record: raw, fingerprint, expected };
+  return { key: ENS_HINT_KEY, state: "mismatch", record: raw, fingerprint, expected, reason: "The record names a key this address has not claimed" };
+}
+function ensHintValue(fingerprint) {
+  const fp = normalizeFingerprint(fingerprint);
+  if (!fp) throw new Error(`Not a fingerprint: ${fingerprint}`);
+  return fp.toUpperCase();
+}
+var ENS_TEXT_RESOLVER_ABI = [
+  { type: "function", name: "text", stateMutability: "view", inputs: [{ name: "node", type: "bytes32" }, { name: "key", type: "string" }], outputs: [{ name: "", type: "string" }] },
+  { type: "function", name: "setText", stateMutability: "nonpayable", inputs: [{ name: "node", type: "bytes32" }, { name: "key", type: "string" }, { name: "value", type: "string" }], outputs: [] }
+];
+function ensHintWrite(name, fingerprint) {
+  const normalized = normalize(name);
+  return {
+    abi: ENS_TEXT_RESOLVER_ABI,
+    functionName: "setText",
+    args: [namehash(normalized), ENS_HINT_KEY, ensHintValue(fingerprint)],
+    name: normalized
+  };
+}
+async function fetchEnsHint(client, name, verifiedFingerprint) {
+  const record = await client.getEnsText({ name: normalize(name), key: ENS_HINT_KEY });
+  return ensHintFor(record, verifiedFingerprint);
+}
+
 export {
-  REGISTRY_ABI,
-  REGISTRY_ADDRESS,
-  NETWORKS,
-  isNetworkName,
-  getRegistry,
-  chainFor,
-  needsRpcProbe,
-  identityErrorKind,
-  IDENTITY_ERROR_TEXT,
   normalizeFingerprint,
+  sameFingerprint,
   fingerprintToBytes,
   bytesToFingerprint,
   fingerprintHash,
   keyIdOf,
   keyIdToBytes,
-  parsePgpKey,
-  verifyClearsigned,
-  verifyAttestation,
-  stripEmailUserIDs,
-  hasEmailUserID,
-  fetchEFPGraph,
   identifyProof,
   displayUrl,
   proofHref,
   proofSecondaryHref,
   FARCASTER_HUB,
   verifyProof,
-  IPFS_GATEWAYS,
-  IPFS_GATEWAY,
-  ARWEAVE_GATEWAY,
-  avatarUrl,
-  avatarFallbacks,
-  parseNftAvatar,
-  NFT_AVATAR_ABI,
-  nftAvatarImage,
-  ENS_HINT_KEY,
-  ensHintFor,
-  ensHintValue,
-  ENS_TEXT_RESOLVER_ABI,
-  ensHintWrite,
-  fetchEnsHint,
+  statementText,
+  parsePgpKey,
+  verifyClearsigned,
+  verifyStatementSignature,
+  verifyAttestation,
+  stripEmailUserIDs,
+  hasEmailUserID,
+  leanKey,
+  claimSignature,
+  signatureEmail,
+  payloadText,
+  sshKeys,
   EIP712_NAME,
   EIP712_VERSION,
   registryDomain,
   AUTHORIZATION_TYPES,
+  REVOKE_REASONS,
+  OWNER_REVOKE_REASONS,
   attestTypedData,
   reattestTypedData,
   updateKeyTypedData,
   revokeTypedData,
   setRecordTypedData,
+  markCompromisedTypedData,
   authorizationDigest,
   recordKind,
+  REGISTRY_ABI,
+  REGISTRY_ADDRESS,
+  NETWORKS,
+  isNetworkName,
+  getRegistry,
+  chainFor,
+  CLAIM_LIMIT,
+  readClaims,
+  keyStanding,
+  findOwners,
+  CLAIM_CHECK_LABEL,
+  formatClaimDate,
+  claimCheckText,
+  keyProblemText,
+  expiresSoon,
+  expiresSoonText,
+  claimFates,
+  claimFateText,
+  encryptionKeyFor,
+  encryptRefusalText,
+  keyChangedText,
+  encryptTo,
+  CONTRACT_ERROR_TEXT,
+  contractErrorName,
+  contractErrorText,
   MAX_RECORD_BYTES,
+  MAX_KIND_BYTES,
   kindName,
+  checkKindName,
+  checkRecordValue,
   KNOWN_KINDS,
-  IDENTITY_KINDS,
-  encodeRecord,
-  decodeRecord,
-  parsePointer,
-  addPointer,
-  renderPointer,
+  parseReleases,
+  addRelease,
+  renderReleases,
   parseRecord,
-  fetchRecords
+  pickRecords,
+  pageRecords,
+  fetchRecords,
+  IPFS_GATEWAYS,
+  IPFS_GATEWAY,
+  ARWEAVE_GATEWAY,
+  avatarUrl,
+  avatarFallbacks,
+  parseNftAvatar,
+  NFT_AVATAR_ABI,
+  nftAvatarImage,
+  ENS_HINT_KEY,
+  ensHintFor,
+  ensHintValue,
+  ENS_TEXT_RESOLVER_ABI,
+  ensHintWrite,
+  fetchEnsHint
 };
-//# sourceMappingURL=chunk-ROQWHCHP.js.map