@zkp2p/zkp2p-attestation 1.0.0-rc.0

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 1.0.0-rc.0
+
+- Rename `@zkp2p/verify-nitro-attestation` to `@zkp2p/zkp2p-attestation`.
+- Add browser/RN/Node WebCrypto verifier entrypoints.
+- Add seller credential upload compact JWE encryption.
+- Add environment-initialized client for staging and production/preprod deployments.
+- Rewrite the verifier CLI on top of the library.
+- Replace the deleted `verify.mjs` script with the `zkp2p-attestation-verify` package binary and `yarn verify` wrapper.
+- Migration: consumers should install/import `@zkp2p/zkp2p-attestation`; any direct references to `package/verify-nitro-attestation/verify.mjs` should move to the package CLI or public library entrypoints.

package/README.md

@@ -0,0 +1,114 @@
+# @zkp2p/zkp2p-attestation
+
+Client-side verifier and encryptor for ZKP2P Nitro seller credential uploads.
+
+The package runs in Chrome MV3 service workers, browser DOM contexts, React Native with a Web Crypto polyfill, and Node >= 20. Library entrypoints use `fetch`, `SubtleCrypto`, `crypto.getRandomValues`, and `Uint8Array`; they do not import `node:*` modules or use `Buffer`.
+
+## Install
+
+```bash
+yarn add @zkp2p/zkp2p-attestation
+```
+
+During monorepo development, point clients at `attestation-service/package/zkp2p-attestation`.
+
+## Environment Init
+
+Use the client factory when the host owns an environment variable:
+
+```ts
+import { createNitroAttestationClient } from "@zkp2p/zkp2p-attestation";
+
+const nitro = createNitroAttestationClient({
+  environment: process.env.ZKP2P_ATTESTATION_ENV === "production" ? "production" : "staging",
+});
+```
+
+Environment defaults:
+
+| Environment | Service URL | PCR8 source |
+|---|---|---|
+| `staging` | `https://attestation-service-staging.zkp2p.xyz` | bundled staging pin |
+| `production` | `https://attestation-service-preprod.zkp2p.xyz` | bundled production/preprod pin |
+
+Callers can still pass `attestationServiceUrl` and `trust.expectedPcr8Hex` directly. Explicit trust pins always win.
+
+## Fast Path
+
+```ts
+const encryptedUpload = await nitro.createEncryptedSellerCredentialUpload({
+  payeeId: "1130030979",
+  sessionMaterial: {
+    apiToken: "<wise-api-token>",
+    profileId: "41246868",
+    balanceId: "61249083",
+    currency: "EUR",
+  },
+});
+
+await fetch(`${attestationServiceUrl}/seller/credentials/wise`, {
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({ encryptedUpload }),
+});
+```
+
+This fetches `GET /attestation?nonce=...`, verifies the Nitro document to the pinned AWS root and PCR8, extracts the attested seller-upload RSA SPKI, and returns a compact JWE for `POST /seller/credentials/:platform`.
+
+## Cache-Friendly Path
+
+```ts
+const verified = await nitro.fetchAndVerifyAttestation();
+
+const encryptedUpload = await nitro.encryptSellerCredentialUpload({
+  key: verified.attestedSellerUploadKey,
+  payeeId: "1130030979",
+  sessionMaterial: {},
+});
+```
+
+The attested SPKI is stable within one enclave process. If the enclave restarts, cached keys become stale and upload decrypt will fail; fetch a fresh attestation for a new session.
+
+## React Native Wiring
+
+React Native must provide Web Crypto-compatible primitives when they are not on `globalThis.crypto`:
+
+```ts
+const nitro = createNitroAttestationClient({
+  environment: "staging",
+  subtle: webCrypto.subtle,
+  getRandomValues: (out) => webCrypto.getRandomValues(out),
+  fetch,
+});
+```
+
+Any conforming `SubtleCrypto` works. The package does not require `Buffer`.
+
+## Direct Entrypoints
+
+```ts
+import {
+  createEncryptedSellerCredentialUpload,
+  encryptSellerCredentialUpload,
+  fetchAndVerifyAttestation,
+} from "@zkp2p/zkp2p-attestation";
+```
+
+Direct functions accept `attestationServiceUrl`, `trust`, `fetch`, `subtle`, `getRandomValues`, `now`, `onWarning`, and `timeoutMs` overrides. If no caller or bundled PCR8 pin exists and `trust.strictPin !== true`, the verifier falls back to the service-advertised PCR8 and emits `TRUST_PIN_NOT_PROVIDED`; production callers should pin.
+
+## PCR8 Rotation Runbook
+
+1. Update `src/trust/pins.ts` from the deployment `STATE.md` published by the attestation-service team.
+2. Refresh `tests/golden/staging-2026-05-05.raw.json` and expected metadata if staging rotates.
+3. Run `yarn test:coverage` and `STAGING_E2E=true yarn test:integration`.
+4. Release a patch version for PCR8-only rotations. Use a major version for wire-format or algorithm changes.
+
+## CLI
+
+The existing verifier is preserved on top of the library:
+
+```bash
+yarn verify --service https://attestation-service-staging.zkp2p.xyz
+```
+
+Optional EIP-712 signer cross-check remains available through `--verify-signature`.