endpoint-attest 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Abdellah Ouadoudi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,80 @@
-# Temporary Holding Version
+# endpoint-attest
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Time-bounded, owner-requested security attestations for a network endpoint (for example an MCP server). The operator proves they control the endpoint, an independent attester runs some checks, and the outcome is recorded as a signed, content-addressed, expiring attestation that anyone can verify.
+
+This is deliberately narrow. It is not a security score, not a reputation system, and the format is built for checks the owner asked for: it has a required field that records how the owner proved control. Whether that proof was real is for the verifier to re-check (see "What this does not do"). Every attestation expires, after at most 366 days.
+
+Status: new, first release 0.1.0. Built to be reused by anything that needs "does this endpoint's operator have a recent, verifiable, opt-in check on record", the same way [capacity-attest](../capacity-attest) answers "was this delivery actually made". It reuses capacity-attest's canonical JSON hashing and EIP-191 signing rather than reimplementing them, but it is a separate package: capacity-attest's claim schema is closed by design (see its `ASSET_TYPES` enum), and an endpoint attestation is a different kind of claim about a different kind of thing.
+
+## Why this is a separate package, not a new claim type in capacity-attest
+
+capacity-attest answers "did the seller deliver what was paid for". An endpoint attestation answers "did this operator prove they control this endpoint, and did an independent party check it recently". Different subject, different trust model (a distinct attester is required, never the owner), different lifecycle (mandatory expiry). Bolting that onto capacity-attest's closed claim schema would blur both.
+
+## How it works
+
+1. **The owner proves control of the endpoint.** Two ACME-style methods, both stateless (no server-side session to manage): a DNS TXT record at `_endpoint-attest.<host>`, or a file at the RFC 8615 well-known path `/.well-known/endpoint-attest.txt`. The token to publish is an HMAC of the endpoint, the owner's address and a shared secret, so it is bound to that exact endpoint and that owner address. It cannot be reused on a different endpoint or claimed under a different owner address. What it proves is control of the host (a TXT record under the host, or a file at the root of the origin), not of one path on it, and the owner address is a label the requester names: nobody proves they hold that address's key. See "What this does not do".
+2. **A distinct attester runs checks and signs.** The attester can never be the owner (`verifyAttestation` rejects that as `attester_is_owner`). It records what it actually checked (`checksPerformed` must be non-empty, so "passed" can never be read as a blanket safety claim), an outcome, and a hash of its findings.
+3. **The attestation is content-addressed and signed.** `computeAttestationId` hashes the canonical JSON of the content (reusing capacity-attest's `canonicalize`), and `signAttestation` produces an EIP-191 signature over that id (reusing capacity-attest's signing primitives). Anyone can recompute the id and the signer independently, without trusting this package's code.
+4. **The attestation always expires.** `expiresAt` is required, must be after `checkedAt` and at most 366 days after it, and the ownership proof may be at most 30 days older than `checkedAt`. There is no way to construct a non-expiring attestation; `verifyAttestation` treats an expired one as failed by default (`ignoreExpiry` exists only for callers who explicitly want to inspect an expired record).
+
+## Usage
+
+```ts
+import {
+  challengeToken, verifyOwnership,
+  signAttestation, verifyAttestation, computeAttestationId,
+} from "endpoint-attest";
+// A server that checks endpoints for strangers must pass net-guard's guarded helpers as `deps`: they refuse loopback, private and
+// metadata addresses. (examples/demo.ts uses the plain global fetch on purpose, because its target is a local server.)
+import { guardedFetch, resolveTxtGuarded } from "tokenizen-net-guard";
+
+// 1. Attester derives the challenge token for this exact endpoint and owner.
+const token = challengeToken(endpoint, ownerAddress, sharedSecret);
+
+// 2. Owner publishes it (DNS TXT or the well-known file), attester verifies control.
+const proof = await verifyOwnership("well-known-file", endpoint, ownerAddress, sharedSecret, {
+  fetchImpl: guardedFetch,
+  resolveTxtRecords: resolveTxtGuarded,
+});
+
+// 3. Attester runs its own checks, then signs the result.
+const { attestationId, signature } = await signAttestation(attesterWallet, {
+  endpoint, ownerAddress, attesterAddress: attesterWallet.address,
+  ownershipProof: { method: proof.method, token, location: proof.location, verifiedAt: proof.verifiedAt },
+  checksPerformed: ["tls-config", "no-open-admin-route", "auth-required-on-write"],
+  outcome: "passed",
+  findingsHash: sha256HexOfYourFullFindingsReport,
+  checkedAt: new Date().toISOString(),
+  expiresAt: thirtyDaysFromNow.toISOString(),
+});
+
+// 4. Anyone, independently, verifies it.
+const result = verifyAttestation({ ...content, attestationId, signature });
+// result.ok === true, or result.ok === false with a reason: "attestation_id_mismatch", "signature_recovery_failed",
+// "signature_does_not_match_attester", "attester_is_owner" or "expired".
+```
+
+Full working example with a real local HTTP server proving the whole flow, including the mandatory expiry: [examples/demo.ts](examples/demo.ts) (`npx tsx examples/demo.ts`).
+
+## What this does not do
+
+- It does not re-check the ownership proof when it verifies an attestation. `verifyAttestation` checks the content id, the signature, that the attester is not the owner, and expiry. Anyone with a key can sign a well-formed attestation that names any endpoint and any owner address, and it will verify. To trust that the owner proved control, re-run `verifyOwnership` with guarded `deps`, or rely on the attester you trust.
+- It does not prove control of a path. Both methods prove control of the host (DNS) or of the root of the origin (the well-known file). On an origin shared by several parties, for example one that hosts every tenant under its own path, someone who can publish a file at the origin root, or who runs another tenant's path on that origin, can pass the check for an endpoint that is not theirs. Use it for endpoints that have their own host.
+- It does not prove that the owner address belongs to the requester. The token is bound to the owner address the requester typed in, but the person who publishes it only shows they control the endpoint. An attestation can therefore name an address whose holder never asked for it. Read `ownerAddress` as "the address this attestation was requested for", not as an identity check.
+- It does not run the checks for you. `checksPerformed` and `findingsHash` are supplied by whatever attester process calls this library; this package only handles ownership proof, signing and verification.
+- It does not publish attestations anywhere. Unlike capacity-attest, there is no built-in EAS/on-chain publishing path here yet. Storage and distribution are left to the caller.
+- It is not a guarantee. An attestation records what a specific attester checked at a specific time. It says nothing about what changed afterward, and `checksPerformed` should always be read literally, not as "this endpoint is safe".
+
+## Status
+
+78 tests passing (`npm test`), clean typecheck and build. No independent, external review of this code has been done; see [capacity-attest's own security notes](../capacity-attest/docs/SECURITY-REVIEW-2026-09-11.md) for how that project handles the same honesty requirement, which this package follows too.
+
+## Verifying your own implementation
+
+The full derivation, plus machine readable vectors you can check yourself in any language, lives in
+[docs/OWNERSHIP-CONFORMANCE.md](docs/OWNERSHIP-CONFORMANCE.md) and
+[examples/ownership-challenge-testvector.json](examples/ownership-challenge-testvector.json).
+
+The vectors are generated from this implementation and re-checked against it in CI, so they cannot
+drift away from the code. The secret in them is public on purpose: it exists so anyone can reproduce
+the tokens without asking us for anything.

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { OWNERSHIP_METHODS, OUTCOMES, ETH_ADDRESS_RE, AttestationContentSchema, EndpointAttestationSchema, OwnershipProofSchema, attestationPreimage, computeAttestationId, isExpired, type OwnershipMethod, type Outcome, type OwnershipProof, type AttestationContent, type EndpointAttestation, } from "./schema.js";
+export { signAttestation, verifyAttestation, type SignedAttestationParts, type VerifyResult, type VerifyReason, type VerifyOptions, } from "./signing.js";
+export { DNS_LABEL, WELL_KNOWN_PATH, ACTIVE_CONSENT_DNS_LABEL, ACTIVE_CONSENT_WELL_KNOWN_PATH, challengeToken, activeTestConsentToken, endpointHost, normalizeEndpoint, proofLocation, consentProofLocation, verifyOwnership, verifyActiveTestConsent, OwnershipError, type OwnershipCheckDeps, type OwnershipResult, } from "./ownership.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,wBAAwB,EACxB,8BAA8B,EAC9B,cAAc,EACd,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+// index.ts — public surface of this package.
+export { OWNERSHIP_METHODS, OUTCOMES, ETH_ADDRESS_RE, AttestationContentSchema, EndpointAttestationSchema, OwnershipProofSchema, attestationPreimage, computeAttestationId, isExpired, } from "./schema.js";
+export { signAttestation, verifyAttestation, } from "./signing.js";
+export { DNS_LABEL, WELL_KNOWN_PATH, ACTIVE_CONSENT_DNS_LABEL, ACTIVE_CONSENT_WELL_KNOWN_PATH, challengeToken, activeTestConsentToken, endpointHost, normalizeEndpoint, proofLocation, consentProofLocation, verifyOwnership, verifyActiveTestConsent, OwnershipError, } from "./ownership.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAE7C,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,SAAS,GAMV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,iBAAiB,GAKlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,eAAe,EACf,wBAAwB,EACxB,8BAA8B,EAC9B,cAAc,EACd,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,uBAAuB,EACvB,cAAc,GAGf,MAAM,gBAAgB,CAAC"}

package/dist/ownership.d.ts

@@ -0,0 +1,147 @@
+import { type OwnershipMethod } from "./schema.js";
+/** The DNS label the token is published under, prefixed to the endpoint's host. Mirrors ACME's _acme-challenge convention. */
+export declare const DNS_LABEL = "_endpoint-attest";
+/** The path the token is published at for the file method. Standard well-known location per RFC 8615. */
+export declare const WELL_KNOWN_PATH = "/.well-known/endpoint-attest.txt";
+/**
+ * A SECOND, distinct proof the owner publishes to opt IN to active testing.
+ * Separate from the ownership proof on purpose: proving control of an endpoint
+ * is not the same as consenting to have it actively connected-to and probed
+ * (an MCP client handshake and tools/list), so each is its own published
+ * token at its own location. Published at a distinct DNS label / well-known
+ * path so it never collides with the ownership proof (a file holds one value).
+ */
+export declare const ACTIVE_CONSENT_DNS_LABEL = "_endpoint-attest-active-consent";
+export declare const ACTIVE_CONSENT_WELL_KNOWN_PATH = "/.well-known/endpoint-attest-active-consent.txt";
+export declare class OwnershipError extends Error {
+    constructor(message: string);
+}
+/**
+ * Derive the challenge token for one (endpoint, owner) pair.
+ *
+ * Deterministic, so the same pair always yields the same token and no state
+ * needs to be kept between issuing and verifying. Unguessable without
+ * `attesterSecret`, so an outsider cannot publish a valid token for someone
+ * else's endpoint and claim to be its owner.
+ */
+export declare function challengeToken(endpoint: string, ownerAddress: string, attesterSecret: string): string;
+/**
+ * Derive the ACTIVE-TEST consent token for one (endpoint, owner) pair — the
+ * token the owner publishes to authorize active testing (an MCP client
+ * handshake and tools/list), distinct from the ownership challenge token.
+ *
+ * Domain-separated from challengeToken: the HMAC message is prefixed with
+ * "active-test-consent\n", so a consent token can never equal an ownership
+ * token for the same pair, and neither can be replayed as the other. Because a
+ * hostname cannot contain a newline and an owner address cannot either, the two
+ * messages ("host\nowner" vs "active-test-consent\nhost\nowner") can never
+ * collide. Same unguessable-without-the-secret property as the ownership token.
+ */
+export declare function activeTestConsentToken(endpoint: string, ownerAddress: string, attesterSecret: string): string;
+/** The exact host an endpoint's proof must be published under. Rejects anything that is not a plain http(s) URL, so a file:// or credential-bearing URL can never reach a DNS query or a fetch. */
+export declare function endpointHost(endpoint: string): string;
+/**
+ * The canonical form a token binds to and an attestation records: scheme +
+ * host + port + path, with credentials, query and fragment stripped and a
+ * single trailing slash removed (but the root "/" kept). Computed from a
+ * parsed URL, so a raw string can never smuggle a newline into the HMAC
+ * message (new URL rejects/strips control characters).
+ *
+ * WHY THE FULL ENDPOINT, NOT JUST THE HOST: the challenge/consent tokens used
+ * to bind only to the hostname, so one published proof (a single host-wide TXT
+ * record, or a host-root well-known file) authorized an attestation — and the
+ * consent-gated active probe — for EVERY scheme/port/path on that host. An
+ * attacker who could read a victim's published proof could then point the
+ * attester at http://victim:6379/anything and both mint a signed attestation
+ * the owner never requested and use the attester as a non-blind port/path
+ * probe. Binding the token to the normalized endpoint makes the token for
+ * one endpoint useless for any other, so only the exact endpoints the owner
+ * actually published a token for can be attested. The publish LOCATION stays
+ * host/origin-based (a DNS name cannot carry a path); distinctness comes from
+ * the token value, and verifyTokenPublished scans every record/finds the exact
+ * match, so one host can carry many endpoints' tokens side by side.
+ */
+export declare function normalizeEndpoint(endpoint: string): string;
+/** Where a reader can re-check the proof themselves, per method. Recorded verbatim in the attestation's ownershipProof.location. */
+export declare function proofLocation(method: OwnershipMethod, endpoint: string): string;
+/** Where the owner publishes the active-test consent token, per method. Distinct from proofLocation so the two proofs never share a file or DNS name. */
+export declare function consentProofLocation(method: OwnershipMethod, endpoint: string): string;
+/**
+ * The network operations this verifier performs, supplied by the CALLER
+ * rather than defaulted here. endpoint-attest deliberately does not ship the
+ * process that runs the check (see README "What this does not do"), and that
+ * now extends to the network primitives: a public server must inject a guarded
+ * fetch/resolver (net-guard) so an anonymous visitor cannot turn ownership
+ * verification into an SSRF or DNS-rebinding probe. Both are REQUIRED, so a
+ * caller physically cannot reach the network unguarded by forgetting to pass
+ * one — the previous global-fetch/node:dns defaults were exactly how one road
+ * stayed unguarded. Tests inject stubs, so this stays unit-testable offline.
+ */
+export interface OwnershipCheckDeps {
+    resolveTxtRecords: (name: string) => Promise<string[][]>;
+    fetchImpl: typeof fetch;
+    timeoutMs?: number;
+    maxFileBytes?: number;
+}
+/**
+ * WAAROM `token` HIERIN ZIT, en dat is geen uitbreiding maar een reparatie.
+ *
+ * Het gepubliceerde 402-contract van de betaalde route eist `token` als verplicht
+ * uitvoerveld, en dit type gaf het nooit terug. Gemeten op 2026-10-18: ons eigen
+ * leveringscontroleur leest precies dat veld, dus hij kon geen enkel echt antwoord
+ * van onze eigen dienst verwerken. Een belofte in een catalogus die de route niet
+ * nakomt is erger dan een ontbrekende belofte.
+ *
+ * WAAROM DIT VEILIG IS, EN DE EERSTE VERSIE VAN DEZE ONDERBOUWING WAS ONJUIST. Er stond
+ * dat het token "per constructie een publieke waarde" is omdat de eigenaar hem zelf moet
+ * publiceren. Dat klopt bij een GESLAAGDE controle en is bij een MISLUKTE per definitie
+ * onwaar: mislukt betekent juist dat hij hem NIET gepubliceerd heeft. Onze eigen tweede
+ * keuring wees dat aan, en de verkeerde formulering stond toen ook al in het publieke
+ * Bazaar-schema van de betaalde route.
+ *
+ * De echte reden dat dit niets weggeeft is gemeten en luidt anders. `/api/challenge`
+ * geeft precies hetzelfde token al terug voor een WILLEKEURIG paar van eindpunt en
+ * eigenaar, zonder enig bewijs, met een RUIMERE limiet (30 per 5 minuten tegen 10) en een
+ * LOSSERE gastheercontrole. Wie het token wil hebben, heeft deze route dus niet nodig en
+ * neemt de goedkopere. Drie scenario's zijn nagelopen (een overgenomen subdomein, een
+ * zwevend dns-record, een plek waar een ander een bestand kan zetten) en geen van de
+ * drie geeft een aanvaller iets extra: het token bindt aan het VOLLEDIGE eindpunt, dus
+ * schema plus host plus poort plus pad, en publiceren kan alleen wie die plek beheert.
+ *
+ * DE KOPPELING DIE HIERUIT VOLGT, en die is nergens anders vastgelegd dan hier en in de
+ * test ernaast: zet iemand `/api/challenge` later achter een inlog, dan wordt deze
+ * functie stil het goedkoopste orakel voor hetzelfde token. Dan hoort deze afweging
+ * opnieuw gemaakt te worden, en niet overgenomen.
+ *
+ * Het token gaat ook mee bij een MISLUKTE controle, want dan is hij het antwoord op "wat
+ * had er moeten staan", en dat is wat een eigenaar nodig heeft om het te repareren.
+ */
+export type OwnershipResult = {
+    ok: true;
+    method: OwnershipMethod;
+    token: string;
+    location: string;
+    verifiedAt: string;
+} | {
+    ok: false;
+    method: OwnershipMethod;
+    token: string;
+    location: string;
+    reason: string;
+};
+/**
+ * Verify control of `endpoint` by the holder of `ownerAddress`, using one
+ * named method. Read-only: this queries DNS or fetches one file, and never
+ * writes to, logs into, or probes anything on the operator's system.
+ */
+export declare function verifyOwnership(method: OwnershipMethod, endpoint: string, ownerAddress: string, attesterSecret: string, deps: OwnershipCheckDeps): Promise<OwnershipResult>;
+/**
+ * Verify the owner has published the ACTIVE-TEST consent token (opting in to
+ * being actively connected-to and probed), using the same channel they used
+ * for the ownership proof. Read-only, same posture as verifyOwnership. This is
+ * a SEPARATE gate: proving control of an endpoint does not by itself authorize
+ * active testing of it, so the attester runs the active path only when this
+ * returns ok.
+ */
+export declare function verifyActiveTestConsent(method: OwnershipMethod, endpoint: string, ownerAddress: string, attesterSecret: string, deps: OwnershipCheckDeps): Promise<OwnershipResult>;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,8HAA8H;AAC9H,eAAO,MAAM,SAAS,qBAAqB,CAAC;AAC5C,yGAAyG;AACzG,eAAO,MAAM,eAAe,qCAAqC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,oCAAoC,CAAC;AAC1E,eAAO,MAAM,8BAA8B,oDAAoD,CAAC;AAShG,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CASrG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAS7G;AAED,mMAAmM;AACnM,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAO1D;AAsBD,oIAAoI;AACpI,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK/E;AAED,yJAAyJ;AACzJ,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKtF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5F;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,eAAe,CAAC,CAO1B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,eAAe,CAAC,CAO1B"}

package/dist/ownership.js

@@ -0,0 +1,287 @@
+// ownership.ts — prove that whoever requested an attestation actually
+// controls the endpoint it is about.
+//
+// This is the part that keeps the whole system voluntary. Without it, an
+// "attestation" about an endpoint is an unsolicited report about a bystander
+// who never asked and gets no say. With it, the only attestations that can
+// exist are ones the operator asked for and proved they had the right to ask
+// for.
+//
+// DELIBERATELY NOT INVENTED HERE: the two challenge methods mirror ACME
+// (the protocol every certificate authority on the internet uses) rather
+// than a third scheme of our own. dns-txt is ACME's DNS-01, well-known-file
+// is ACME's HTTP-01 shape, and /.well-known/ is the standard location for
+// exactly this (RFC 8615). A reviewer who knows ACME needs no new concepts
+// to audit this.
+//
+// STATELESS ON PURPOSE: the challenge token is derived with HMAC from an
+// attester-held secret plus the (endpoint, owner) pair, so nothing has to be
+// stored between issuing a challenge and verifying it. No database, no
+// expiring session, no cleanup job. The token is not a credential: publishing
+// it grants nothing, it only demonstrates control at the moment it is read.
+//
+// HONEST LIMIT, stated here rather than discovered later: a DNS record or a
+// well-known file that stays in place after a domain changes hands keeps
+// proving the OLD owner's control. This is inherent to every control-proof
+// scheme built on DNS or HTTP, including ACME's, and it is the reason
+// certificates expire rather than the reason not to use them. Our mandatory
+// attestation expiry (schema.ts) is the same answer: control is re-proven at
+// every renewal, so a stale record can only carry a claim for the remaining
+// life of one attestation, not indefinitely.
+import { createHmac } from "node:crypto";
+import { OWNERSHIP_METHODS } from "./schema.js";
+/** The DNS label the token is published under, prefixed to the endpoint's host. Mirrors ACME's _acme-challenge convention. */
+export const DNS_LABEL = "_endpoint-attest";
+/** The path the token is published at for the file method. Standard well-known location per RFC 8615. */
+export const WELL_KNOWN_PATH = "/.well-known/endpoint-attest.txt";
+/**
+ * A SECOND, distinct proof the owner publishes to opt IN to active testing.
+ * Separate from the ownership proof on purpose: proving control of an endpoint
+ * is not the same as consenting to have it actively connected-to and probed
+ * (an MCP client handshake and tools/list), so each is its own published
+ * token at its own location. Published at a distinct DNS label / well-known
+ * path so it never collides with the ownership proof (a file holds one value).
+ */
+export const ACTIVE_CONSENT_DNS_LABEL = "_endpoint-attest-active-consent";
+export const ACTIVE_CONSENT_WELL_KNOWN_PATH = "/.well-known/endpoint-attest-active-consent.txt";
+const DEFAULT_TIMEOUT_MS = 10_000;
+// A well-known file only ever needs to hold one short token. Anything larger
+// is either a misconfiguration or an attempt to make the verifier chew
+// through a large body, so it is refused while streaming rather than
+// buffered first (same posture as capacity-attest's http-source.ts).
+const MAX_FILE_BYTES = 8 * 1024;
+export class OwnershipError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "OwnershipError";
+    }
+}
+/**
+ * Derive the challenge token for one (endpoint, owner) pair.
+ *
+ * Deterministic, so the same pair always yields the same token and no state
+ * needs to be kept between issuing and verifying. Unguessable without
+ * `attesterSecret`, so an outsider cannot publish a valid token for someone
+ * else's endpoint and claim to be its owner.
+ */
+export function challengeToken(endpoint, ownerAddress, attesterSecret) {
+    if (attesterSecret.length < 32) {
+        throw new OwnershipError("attesterSecret must be at least 32 characters: a short secret makes every token guessable");
+    }
+    const bound = normalizeEndpoint(endpoint);
+    const mac = createHmac("sha256", attesterSecret)
+        .update(`${bound}\n${ownerAddress.toLowerCase()}`, "utf-8")
+        .digest("hex");
+    return `tok_${mac}`;
+}
+/**
+ * Derive the ACTIVE-TEST consent token for one (endpoint, owner) pair — the
+ * token the owner publishes to authorize active testing (an MCP client
+ * handshake and tools/list), distinct from the ownership challenge token.
+ *
+ * Domain-separated from challengeToken: the HMAC message is prefixed with
+ * "active-test-consent\n", so a consent token can never equal an ownership
+ * token for the same pair, and neither can be replayed as the other. Because a
+ * hostname cannot contain a newline and an owner address cannot either, the two
+ * messages ("host\nowner" vs "active-test-consent\nhost\nowner") can never
+ * collide. Same unguessable-without-the-secret property as the ownership token.
+ */
+export function activeTestConsentToken(endpoint, ownerAddress, attesterSecret) {
+    if (attesterSecret.length < 32) {
+        throw new OwnershipError("attesterSecret must be at least 32 characters: a short secret makes every token guessable");
+    }
+    const bound = normalizeEndpoint(endpoint);
+    const mac = createHmac("sha256", attesterSecret)
+        .update(`active-test-consent\n${bound}\n${ownerAddress.toLowerCase()}`, "utf-8")
+        .digest("hex");
+    return `consent_${mac}`;
+}
+/** The exact host an endpoint's proof must be published under. Rejects anything that is not a plain http(s) URL, so a file:// or credential-bearing URL can never reach a DNS query or a fetch. */
+export function endpointHost(endpoint) {
+    return parseEndpoint(endpoint).hostname;
+}
+/**
+ * The canonical form a token binds to and an attestation records: scheme +
+ * host + port + path, with credentials, query and fragment stripped and a
+ * single trailing slash removed (but the root "/" kept). Computed from a
+ * parsed URL, so a raw string can never smuggle a newline into the HMAC
+ * message (new URL rejects/strips control characters).
+ *
+ * WHY THE FULL ENDPOINT, NOT JUST THE HOST: the challenge/consent tokens used
+ * to bind only to the hostname, so one published proof (a single host-wide TXT
+ * record, or a host-root well-known file) authorized an attestation — and the
+ * consent-gated active probe — for EVERY scheme/port/path on that host. An
+ * attacker who could read a victim's published proof could then point the
+ * attester at http://victim:6379/anything and both mint a signed attestation
+ * the owner never requested and use the attester as a non-blind port/path
+ * probe. Binding the token to the normalized endpoint makes the token for
+ * one endpoint useless for any other, so only the exact endpoints the owner
+ * actually published a token for can be attested. The publish LOCATION stays
+ * host/origin-based (a DNS name cannot carry a path); distinctness comes from
+ * the token value, and verifyTokenPublished scans every record/finds the exact
+ * match, so one host can carry many endpoints' tokens side by side.
+ */
+export function normalizeEndpoint(endpoint) {
+    const url = parseEndpoint(endpoint);
+    let path = url.pathname;
+    if (path.length > 1 && path.endsWith("/"))
+        path = path.slice(0, -1);
+    // url.host includes the port (unlike url.hostname) — the port is part of the
+    // identity we bind to, so a different port is a different endpoint.
+    return `${url.protocol}//${url.host}${path}`;
+}
+/** Parse + validate an endpoint as a plain, credential-free http(s) URL. Shared by endpointHost and normalizeEndpoint so both reject the same inputs identically. */
+function parseEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new OwnershipError(`endpoint is not a valid URL: ${JSON.stringify(endpoint)}`);
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new OwnershipError(`endpoint must be http or https, got ${url.protocol}`);
+    }
+    if (url.username !== "" || url.password !== "") {
+        throw new OwnershipError("endpoint must not contain credentials");
+    }
+    if (url.hostname === "") {
+        throw new OwnershipError("endpoint has no host");
+    }
+    return url;
+}
+/** Where a reader can re-check the proof themselves, per method. Recorded verbatim in the attestation's ownershipProof.location. */
+export function proofLocation(method, endpoint) {
+    const host = endpointHost(endpoint);
+    if (method === "dns-txt")
+        return `${DNS_LABEL}.${host}`;
+    const url = new URL(endpoint);
+    return `${url.protocol}//${url.host}${WELL_KNOWN_PATH}`;
+}
+/** Where the owner publishes the active-test consent token, per method. Distinct from proofLocation so the two proofs never share a file or DNS name. */
+export function consentProofLocation(method, endpoint) {
+    const host = endpointHost(endpoint);
+    if (method === "dns-txt")
+        return `${ACTIVE_CONSENT_DNS_LABEL}.${host}`;
+    const url = new URL(endpoint);
+    return `${url.protocol}//${url.host}${ACTIVE_CONSENT_WELL_KNOWN_PATH}`;
+}
+/**
+ * Verify control of `endpoint` by the holder of `ownerAddress`, using one
+ * named method. Read-only: this queries DNS or fetches one file, and never
+ * writes to, logs into, or probes anything on the operator's system.
+ */
+export async function verifyOwnership(method, endpoint, ownerAddress, attesterSecret, deps) {
+    if (!OWNERSHIP_METHODS.includes(method)) {
+        throw new OwnershipError(`unknown ownership method: ${JSON.stringify(method)}`);
+    }
+    const expected = challengeToken(endpoint, ownerAddress, attesterSecret);
+    const location = proofLocation(method, endpoint);
+    return verifyTokenPublished(method, expected, location, deps);
+}
+/**
+ * Verify the owner has published the ACTIVE-TEST consent token (opting in to
+ * being actively connected-to and probed), using the same channel they used
+ * for the ownership proof. Read-only, same posture as verifyOwnership. This is
+ * a SEPARATE gate: proving control of an endpoint does not by itself authorize
+ * active testing of it, so the attester runs the active path only when this
+ * returns ok.
+ */
+export async function verifyActiveTestConsent(method, endpoint, ownerAddress, attesterSecret, deps) {
+    if (!OWNERSHIP_METHODS.includes(method)) {
+        throw new OwnershipError(`unknown ownership method: ${JSON.stringify(method)}`);
+    }
+    const expected = activeTestConsentToken(endpoint, ownerAddress, attesterSecret);
+    const location = consentProofLocation(method, endpoint);
+    return verifyTokenPublished(method, expected, location, deps);
+}
+/**
+ * The shared read-only check behind both verifyOwnership and
+ * verifyActiveTestConsent: confirm that `expected` is exactly what is published
+ * at `location` via `method`. Factored out so the two gates can never drift
+ * apart in how they fetch, bound, and exact-match a published token.
+ */
+async function verifyTokenPublished(method, expected, location, deps) {
+    const now = () => new Date().toISOString();
+    if (method === "dns-txt") {
+        const resolver = deps.resolveTxtRecords;
+        let records;
+        try {
+            records = await resolver(location);
+        }
+        catch (e) {
+            return { ok: false, method, token: expected, location, reason: `dns lookup failed: ${e.message}` };
+        }
+        // A TXT record can be split into multiple strings by the resolver; the
+        // published value is their concatenation, which is how every DNS client
+        // reassembles long records.
+        const values = records.map((chunks) => chunks.join("").trim());
+        if (!values.includes(expected)) {
+            return { ok: false, method, token: expected, location, reason: "no TXT record at that name matched the expected token" };
+        }
+        return { ok: true, method, token: expected, location, verifiedAt: now() };
+    }
+    const fetchImpl = deps.fetchImpl;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxFileBytes = deps.maxFileBytes ?? MAX_FILE_BYTES;
+    let response;
+    try {
+        // redirect:"error" — a control proof must be served DIRECTLY at the exact
+        // well-known URL. Following redirects would let an open redirect (or a
+        // scheme downgrade) at that path turn some OTHER server's body into a
+        // "valid" proof, so a third party could forge ownership of a host that
+        // merely has an open redirect at /.well-known/endpoint-attest.txt.
+        response = await fetchImpl(location, { signal: AbortSignal.timeout(timeoutMs), redirect: "error" });
+    }
+    catch (e) {
+        return { ok: false, method, token: expected, location, reason: `fetch failed: ${e.message}` };
+    }
+    if (!response.ok) {
+        return { ok: false, method, token: expected, location, reason: `responded ${response.status} ${response.statusText}` };
+    }
+    let body;
+    try {
+        body = await readBounded(response, maxFileBytes);
+    }
+    catch (e) {
+        return { ok: false, method, token: expected, location, reason: e.message };
+    }
+    // Exact match on the trimmed content, not a substring search: a token
+    // buried in an otherwise unrelated page does not demonstrate that the
+    // operator deliberately published it.
+    if (body.trim() !== expected) {
+        return { ok: false, method, token: expected, location, reason: "file content did not exactly match the expected token" };
+    }
+    return { ok: true, method, token: expected, location, verifiedAt: now() };
+}
+/** Read a response body up to maxBytes, refusing the moment the limit is crossed instead of buffering the rest. */
+async function readBounded(response, maxBytes) {
+    const stream = response.body;
+    if (!stream)
+        return "";
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value) {
+                total += value.byteLength;
+                if (total > maxBytes) {
+                    await reader.cancel().catch(() => { });
+                    throw new OwnershipError(`proof file exceeded ${maxBytes} bytes, refused before reading further`);
+                }
+                chunks.push(value);
+            }
+        }
+    }
+    catch (e) {
+        if (e instanceof OwnershipError)
+            throw e;
+        throw new OwnershipError(`reading proof file failed: ${e.message}`);
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf-8");
+}
+//# sourceMappingURL=ownership.js.map

package/dist/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qCAAqC;AACrC,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,OAAO;AACP,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,iBAAiB;AACjB,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,6CAA6C;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAwB,MAAM,aAAa,CAAC;AAEtE,8HAA8H;AAC9H,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAC5C,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,iDAAiD,CAAC;AAEhG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,6EAA6E;AAC7E,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAEhC,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,YAAoB,EAAE,cAAsB;IAC3F,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CAAC,2FAA2F,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC;SAC7C,MAAM,CAAC,GAAG,KAAK,KAAK,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC;SAC1D,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,OAAO,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,YAAoB,EAAE,cAAsB;IACnG,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CAAC,2FAA2F,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC;SAC7C,MAAM,CAAC,wBAAwB,KAAK,KAAK,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC;SAC/E,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,WAAW,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,mMAAmM;AACnM,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,6EAA6E;IAC7E,oEAAoE;IACpE,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,qKAAqK;AACrK,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,cAAc,CAAC,uCAAuC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,cAAc,CAAC,uCAAuC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CAAC,sBAAsB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,aAAa,CAAC,MAAuB,EAAE,QAAgB;IACrE,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED,yJAAyJ;AACzJ,MAAM,UAAU,oBAAoB,CAAC,MAAuB,EAAE,QAAgB;IAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,wBAAwB,IAAI,IAAI,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,8BAA8B,EAAE,CAAC;AACzE,CAAC;AAyDD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,QAAgB,EAChB,YAAoB,EACpB,cAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAuB,EACvB,QAAgB,EAChB,YAAoB,EACpB,cAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,OAAO,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAAuB,EACvB,QAAgB,EAChB,QAAgB,EAChB,IAAwB;IAExB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAuB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAChH,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,4BAA4B;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;QAC3H,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC;IAEzD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAkB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC;IACzH,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC;IACD,sEAAsE;IACtE,sEAAsE;IACtE,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IAC3H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,mHAAmH;AACnH,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,QAAgB;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACtC,MAAM,IAAI,cAAc,CAAC,uBAAuB,QAAQ,wCAAwC,CAAC,CAAC;gBACpG,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,cAAc;YAAE,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,cAAc,CAAC,8BAA+B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC5E,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,145 @@
+import { z } from "zod";
+export declare const ETH_ADDRESS_RE: RegExp;
+/** How the endpoint operator proved they control the endpoint. Mirrors ACME's two proven challenge types rather than inventing a third. */
+export declare const OWNERSHIP_METHODS: readonly ["dns-txt", "well-known-file"];
+export type OwnershipMethod = (typeof OWNERSHIP_METHODS)[number];
+/**
+ * The outcome of the checks that were actually run. Deliberately NOT called
+ * "delivered" (that is capacity-attest's word for a different question) and
+ * deliberately not a score or a grade.
+ *
+ * - `passed`: every check in `checksPerformed` passed.
+ * - `failed`: at least one check in `checksPerformed` did not pass.
+ * - `inconclusive`: the checks could not be completed (endpoint unreachable,
+ *   rate-limited, ambiguous response). Fail-closed: this is NOT `passed`.
+ */
+export declare const OUTCOMES: readonly ["passed", "failed", "inconclusive"];
+export type Outcome = (typeof OUTCOMES)[number];
+export declare const OwnershipProofSchema: z.ZodObject<{
+    method: z.ZodEnum<{
+        "dns-txt": "dns-txt";
+        "well-known-file": "well-known-file";
+    }>;
+    token: z.ZodString;
+    location: z.ZodString;
+    verifiedAt: z.ZodString;
+}, z.core.$strict>;
+export type OwnershipProof = z.infer<typeof OwnershipProofSchema>;
+export declare const AttestationContentObject: z.ZodObject<{
+    endpoint: z.ZodString;
+    ownerAddress: z.ZodString;
+    attesterAddress: z.ZodString;
+    ownershipProof: z.ZodObject<{
+        method: z.ZodEnum<{
+            "dns-txt": "dns-txt";
+            "well-known-file": "well-known-file";
+        }>;
+        token: z.ZodString;
+        location: z.ZodString;
+        verifiedAt: z.ZodString;
+    }, z.core.$strict>;
+    checksPerformed: z.ZodArray<z.ZodString>;
+    outcome: z.ZodEnum<{
+        passed: "passed";
+        failed: "failed";
+        inconclusive: "inconclusive";
+    }>;
+    findingsHash: z.ZodString;
+    checkedAt: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+/** The longest an attestation may live, checkedAt to expiresAt. Without an upper bound "always expires" would still allow the year 9999. */
+export declare const MAX_ATTESTATION_LIFE_DAYS = 366;
+/** How much older than checkedAt the ownership proof may be. Control is re-proven for every attestation, so a stale proof is not carried forward. */
+export declare const MAX_OWNERSHIP_PROOF_AGE_DAYS = 30;
+export declare const AttestationContentSchema: z.ZodObject<{
+    endpoint: z.ZodString;
+    ownerAddress: z.ZodString;
+    attesterAddress: z.ZodString;
+    ownershipProof: z.ZodObject<{
+        method: z.ZodEnum<{
+            "dns-txt": "dns-txt";
+            "well-known-file": "well-known-file";
+        }>;
+        token: z.ZodString;
+        location: z.ZodString;
+        verifiedAt: z.ZodString;
+    }, z.core.$strict>;
+    checksPerformed: z.ZodArray<z.ZodString>;
+    outcome: z.ZodEnum<{
+        passed: "passed";
+        failed: "failed";
+        inconclusive: "inconclusive";
+    }>;
+    findingsHash: z.ZodString;
+    checkedAt: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type AttestationContent = z.infer<typeof AttestationContentSchema>;
+export declare const EndpointAttestationObject: z.ZodObject<{
+    endpoint: z.ZodString;
+    ownerAddress: z.ZodString;
+    attesterAddress: z.ZodString;
+    ownershipProof: z.ZodObject<{
+        method: z.ZodEnum<{
+            "dns-txt": "dns-txt";
+            "well-known-file": "well-known-file";
+        }>;
+        token: z.ZodString;
+        location: z.ZodString;
+        verifiedAt: z.ZodString;
+    }, z.core.$strict>;
+    checksPerformed: z.ZodArray<z.ZodString>;
+    outcome: z.ZodEnum<{
+        passed: "passed";
+        failed: "failed";
+        inconclusive: "inconclusive";
+    }>;
+    findingsHash: z.ZodString;
+    checkedAt: z.ZodString;
+    expiresAt: z.ZodString;
+    attestationId: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strip>;
+export declare const EndpointAttestationSchema: z.ZodObject<{
+    endpoint: z.ZodString;
+    ownerAddress: z.ZodString;
+    attesterAddress: z.ZodString;
+    ownershipProof: z.ZodObject<{
+        method: z.ZodEnum<{
+            "dns-txt": "dns-txt";
+            "well-known-file": "well-known-file";
+        }>;
+        token: z.ZodString;
+        location: z.ZodString;
+        verifiedAt: z.ZodString;
+    }, z.core.$strict>;
+    checksPerformed: z.ZodArray<z.ZodString>;
+    outcome: z.ZodEnum<{
+        passed: "passed";
+        failed: "failed";
+        inconclusive: "inconclusive";
+    }>;
+    findingsHash: z.ZodString;
+    checkedAt: z.ZodString;
+    expiresAt: z.ZodString;
+    attestationId: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strip>;
+export type EndpointAttestation = z.infer<typeof EndpointAttestationSchema>;
+/**
+ * The EXACT bytes that get hashed, as a string.
+ *
+ * Exported for the same reason capacity-attest exports claimPreimage: the
+ * preimage is `canonicalize(AttestationContentSchema.parse(content))`, NOT
+ * `canonicalize(content)`. The parse step normalises (lower-cases the two
+ * address fields, strips unknown top-level keys). Port only canonicalize()
+ * into another language and you will silently produce wrong ids for any
+ * attestation submitted with mixed-case addresses.
+ */
+export declare function attestationPreimage(content: AttestationContent): string;
+/** Content-addressed id: sha256 over the canonical JSON of the content fields (everything except attestationId and signature). */
+export declare function computeAttestationId(content: AttestationContent): string;
+/** True when `at` (default: now) is at or after expiresAt. An expired attestation is not a weaker attestation, it is not an attestation. */
+export declare function isExpired(content: Pick<AttestationContent, "expiresAt">, at?: Date): boolean;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,cAAc,QAAwB,CAAC;AAGpD,2IAA2I;AAC3I,eAAO,MAAM,iBAAiB,yCAA0C,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,+CAAgD,CAAC;AACtE,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;AAMhD,eAAO,MAAM,oBAAoB;;;;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;iBAgBnC,CAAC;AAEH,4IAA4I;AAC5I,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,qJAAqJ;AACrJ,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAG/C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;iBA6BnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;iBAGpC,CAAC;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAEvE;AAED,kIAAkI;AAClI,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAExE;AAWD,4IAA4I;AAC5I,wBAAgB,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,EAAE,GAAE,IAAiB,GAAG,OAAO,CAExG"}

package/dist/schema.js

@@ -0,0 +1,161 @@
+// schema.ts — the EndpointAttestation content type, its content-addressed id,
+// and the honesty constraints that are enforced by the schema itself rather
+// than left to a caller's good intentions.
+//
+// WHY THIS IS A SEPARATE PACKAGE AND NOT A NEW CLAIM TYPE INSIDE
+// capacity-attest: capacity-attest's ClaimContent has a deliberately CLOSED
+// assetType enum (gpu-hours, storage, api-credits, bandwidth) and its README
+// states plainly that the enum is closed on purpose. An endpoint security
+// attestation is none of those four. Widening that enum to fit this would
+// break a documented design boundary of an already-published package, and
+// reusing one of the four would put untrue data in the field. So this package
+// follows the pattern a third party (EmbryoSpace) already proved works in
+// this ecosystem: reuse the CONTENT-ADDRESSING primitives, bring your own
+// content shape, leave capacity-attest untouched. See
+// capacity-attest/docs/INTEGRATION-GUIDE.md.
+//
+// WHAT IS REUSED, DELIBERATELY: canonicalize() from capacity-attest. That
+// function carries the hard-won parts (recursive key sorting, a depth cap
+// that turns a pathological nesting crash into a catchable error, and
+// Object.create(null) so a key literally named "__proto__" is hashed as a
+// normal key instead of vanishing). Reimplementing that here would mean
+// reimplementing its bugs. What is NOT reused: the claim-specific preimage
+// and verify functions, which are typed to ClaimContent.
+//
+// THE THREE HONESTY CONSTRAINTS, enforced here in the schema:
+//   1. `expiresAt` is REQUIRED and must be after `checkedAt`. An attestation
+//      with no hard end date still looks valid months later, which is selling
+//      confidence that was never checked. There is no "never expires" option.
+//   2. `checksPerformed` must be non-empty. `outcome: "passed"` may therefore
+//      never be read as "this endpoint is secure", only as "these named
+//      checks passed at that moment". A blanket safety claim is not
+//      expressible in this format, by construction.
+//   3. `ownershipProof` is REQUIRED and may be at most MAX_OWNERSHIP_PROOF_AGE_DAYS
+//      older than `checkedAt`. The format CARRIES the proof (method, token, location,
+//      time); it does not RE-CHECK it. verifyAttestation checks the id, the signature,
+//      attester != owner and expiry, nothing more. Whoever relies on an attestation
+//      re-runs verifyOwnership (with guarded deps) or trusts the attester's word that
+//      the owner proved control. Anyone with a key can sign a well-formed attestation
+//      naming any endpoint and any owner address; the signature says who signed, not
+//      that the owner asked.
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { canonicalize } from "capacity-attest/dist/schema.js";
+export const ETH_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+/** How the endpoint operator proved they control the endpoint. Mirrors ACME's two proven challenge types rather than inventing a third. */
+export const OWNERSHIP_METHODS = ["dns-txt", "well-known-file"];
+/**
+ * The outcome of the checks that were actually run. Deliberately NOT called
+ * "delivered" (that is capacity-attest's word for a different question) and
+ * deliberately not a score or a grade.
+ *
+ * - `passed`: every check in `checksPerformed` passed.
+ * - `failed`: at least one check in `checksPerformed` did not pass.
+ * - `inconclusive`: the checks could not be completed (endpoint unreachable,
+ *   rate-limited, ambiguous response). Fail-closed: this is NOT `passed`.
+ */
+export const OUTCOMES = ["passed", "failed", "inconclusive"];
+const IsoTimestamp = z
+    .string()
+    .refine((s) => !Number.isNaN(Date.parse(s)), { message: "must be a parseable ISO-8601 timestamp" });
+export const OwnershipProofSchema = z.strictObject({
+    method: z.enum(OWNERSHIP_METHODS),
+    /** The exact challenge token the operator published. Not a secret: it only proves control at verification time. */
+    token: z.string().min(16).max(512),
+    /** Where the token was found: the DNS name queried, or the full URL fetched. Recorded so a reader can re-check it themselves. */
+    location: z.string().min(1).max(2048),
+    /** When control was verified. May be earlier than checkedAt (control is proven once, checks can run after). */
+    verifiedAt: IsoTimestamp,
+});
+export const AttestationContentObject = z.object({
+    /** The endpoint this attestation is about. Expected in normalised form (origin plus path, no credentials, no fragment); this package does not enforce that. */
+    endpoint: z.string().min(1).max(2048),
+    /** The operator who requested this attestation and proved control of `endpoint`. */
+    ownerAddress: z.string().regex(ETH_ADDRESS_RE, "ownerAddress must be a 0x-prefixed 20-byte address"),
+    /** Whoever ran the checks and signs this attestation. The party that carries the responsibility for what it asserts. */
+    attesterAddress: z.string().regex(ETH_ADDRESS_RE, "attesterAddress must be a 0x-prefixed 20-byte address"),
+    ownershipProof: OwnershipProofSchema,
+    /** The named checks that were actually run. Non-empty by design: see constraint 2 in this file's header. */
+    checksPerformed: z.array(z.string().min(1).max(200)).min(1).max(100),
+    outcome: z.enum(OUTCOMES),
+    /** sha256 of the full findings report. The report itself is never stored here, only its hash, same posture as capacity-attest's evidenceHash. */
+    findingsHash: z.string().regex(SHA256_HEX_RE, "findingsHash must be lower-case sha256 hex"),
+    checkedAt: IsoTimestamp,
+    /** REQUIRED. There is deliberately no way to express an attestation that never expires. */
+    expiresAt: IsoTimestamp,
+});
+/** The longest an attestation may live, checkedAt to expiresAt. Without an upper bound "always expires" would still allow the year 9999. */
+export const MAX_ATTESTATION_LIFE_DAYS = 366;
+/** How much older than checkedAt the ownership proof may be. Control is re-proven for every attestation, so a stale proof is not carried forward. */
+export const MAX_OWNERSHIP_PROOF_AGE_DAYS = 30;
+const DAY_MS = 24 * 60 * 60 * 1000;
+export const AttestationContentSchema = AttestationContentObject.superRefine((content, ctx) => {
+    if (Date.parse(content.expiresAt) <= Date.parse(content.checkedAt)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["expiresAt"],
+            message: "expiresAt must be strictly after checkedAt: an attestation that expires at or before the moment it was made asserts nothing",
+        });
+    }
+    if (Date.parse(content.expiresAt) - Date.parse(content.checkedAt) > MAX_ATTESTATION_LIFE_DAYS * DAY_MS) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["expiresAt"],
+            message: `expiresAt must be at most ${MAX_ATTESTATION_LIFE_DAYS} days after checkedAt: a far-future expiry is a non-expiring attestation by another name`,
+        });
+    }
+    if (Date.parse(content.checkedAt) - Date.parse(content.ownershipProof.verifiedAt) > MAX_OWNERSHIP_PROOF_AGE_DAYS * DAY_MS) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["ownershipProof", "verifiedAt"],
+            message: `ownershipProof.verifiedAt must be at most ${MAX_OWNERSHIP_PROOF_AGE_DAYS} days before checkedAt: control is re-proven for each attestation`,
+        });
+    }
+    if (Date.parse(content.ownershipProof.verifiedAt) > Date.parse(content.checkedAt)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["ownershipProof", "verifiedAt"],
+            message: "ownershipProof.verifiedAt must not be after checkedAt: control has to be proven before or when the checks run, not afterwards",
+        });
+    }
+});
+export const EndpointAttestationObject = AttestationContentObject.extend({
+    attestationId: z.string().regex(/^0x[0-9a-f]{64}$/, "attestationId must be 0x + lower-case sha256 hex"),
+    signature: z.string().regex(/^0x[0-9a-fA-F]{130}$/, "signature must be a 0x-prefixed 65-byte hex signature"),
+});
+export const EndpointAttestationSchema = EndpointAttestationObject.superRefine((content, ctx) => {
+    if (Date.parse(content.expiresAt) <= Date.parse(content.checkedAt)) {
+        ctx.addIssue({ code: "custom", path: ["expiresAt"], message: "expiresAt must be strictly after checkedAt" });
+    }
+});
+/**
+ * The EXACT bytes that get hashed, as a string.
+ *
+ * Exported for the same reason capacity-attest exports claimPreimage: the
+ * preimage is `canonicalize(AttestationContentSchema.parse(content))`, NOT
+ * `canonicalize(content)`. The parse step normalises (lower-cases the two
+ * address fields, strips unknown top-level keys). Port only canonicalize()
+ * into another language and you will silently produce wrong ids for any
+ * attestation submitted with mixed-case addresses.
+ */
+export function attestationPreimage(content) {
+    return canonicalize(normalise(AttestationContentSchema.parse(content)));
+}
+/** Content-addressed id: sha256 over the canonical JSON of the content fields (everything except attestationId and signature). */
+export function computeAttestationId(content) {
+    return "0x" + createHash("sha256").update(attestationPreimage(content), "utf-8").digest("hex");
+}
+/** Lower-case the address fields so the same attestation submitted with mixed-case addresses hashes identically. */
+function normalise(content) {
+    return {
+        ...content,
+        ownerAddress: content.ownerAddress.toLowerCase(),
+        attesterAddress: content.attesterAddress.toLowerCase(),
+    };
+}
+/** True when `at` (default: now) is at or after expiresAt. An expired attestation is not a weaker attestation, it is not an attestation. */
+export function isExpired(content, at = new Date()) {
+    return at.getTime() >= Date.parse(content.expiresAt);
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,2CAA2C;AAC3C,EAAE;AACF,iEAAiE;AACjE,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,sDAAsD;AACtD,6CAA6C;AAC7C,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,2EAA2E;AAC3E,yDAAyD;AACzD,EAAE;AACF,8DAA8D;AAC9D,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,oEAAoE;AACpE,oDAAoD;AACpD,oFAAoF;AACpF,sFAAsF;AACtF,uFAAuF;AACvF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,6BAA6B;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,2IAA2I;AAC3I,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAU,CAAC;AAGzE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAU,CAAC;AAGtE,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;AAEtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,mHAAmH;IACnH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,iIAAiI;IACjI,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACrC,+GAA+G;IAC/G,UAAU,EAAE,YAAY;CACzB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,+JAA+J;IAC/J,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACrC,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,oDAAoD,CAAC;IACpG,wHAAwH;IACxH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,uDAAuD,CAAC;IAC1G,cAAc,EAAE,oBAAoB;IACpC,4GAA4G;IAC5G,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACzB,iJAAiJ;IACjJ,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,4CAA4C,CAAC;IAC3F,SAAS,EAAE,YAAY;IACvB,2FAA2F;IAC3F,SAAS,EAAE,YAAY;CACxB,CAAC,CAAC;AAEH,4IAA4I;AAC5I,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,qJAAqJ;AACrJ,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5F,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,6HAA6H;SACvI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,yBAAyB,GAAG,MAAM,EAAE,CAAC;QACvG,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,6BAA6B,yBAAyB,0FAA0F;SAC1J,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,4BAA4B,GAAG,MAAM,EAAE,CAAC;QAC1H,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;YACtC,OAAO,EAAE,6CAA6C,4BAA4B,mEAAmE;SACtJ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;YACtC,OAAO,EAAE,+HAA+H;SACzI,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC,MAAM,CAAC;IACvE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,kDAAkD,CAAC;IACvG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,uDAAuD,CAAC;CAC7G,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9F,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,OAAO,YAAY,CAAC,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,kIAAkI;AAClI,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,OAAO,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC;AAED,oHAAoH;AACpH,SAAS,SAAS,CAAC,OAA2B;IAC5C,OAAO;QACL,GAAG,OAAO;QACV,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE;QAChD,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE;KACvD,CAAC;AACJ,CAAC;AAED,4IAA4I;AAC5I,MAAM,UAAU,SAAS,CAAC,OAA8C,EAAE,KAAW,IAAI,IAAI,EAAE;IAC7F,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACvD,CAAC"}

package/dist/signing.d.ts

@@ -0,0 +1,41 @@
+import { ethers } from "ethers";
+import { type AttestationContent, type EndpointAttestation } from "./schema.js";
+export interface SignedAttestationParts {
+    attestationId: string;
+    signature: string;
+}
+/** Sign an attestation as the attester. Returns the content-addressed id alongside the signature so a caller can assemble a full EndpointAttestation. */
+export declare function signAttestation(attester: ethers.Signer, content: AttestationContent): Promise<SignedAttestationParts>;
+export type VerifyReason = "attestation_id_mismatch" | "signature_recovery_failed" | "signature_does_not_match_attester" | "attester_is_owner" | "expired";
+export type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: VerifyReason;
+    detail?: string;
+};
+export interface VerifyOptions {
+    /** Treat this as "now" when checking expiry. Injectable so tests do not depend on the wall clock. */
+    now?: Date;
+    /**
+     * Skip the expiry check. Use ONLY when the caller genuinely needs to know
+     * "was this ever validly signed" separately from "is it valid today", for
+     * example when displaying an archived attestation as historical. Never use
+     * it to present an expired attestation as current: that is exactly the
+     * false confidence the mandatory expiry exists to prevent.
+     */
+    ignoreExpiry?: boolean;
+}
+/**
+ * Verify that an assembled attestation is internally consistent AND still valid:
+ *   1. `attestationId` really is the sha256 content-address of the content fields.
+ *   2. `signature` recovers to `attesterAddress`.
+ *   3. The attester is not the owner (a self-declaration is not an attestation).
+ *   4. It has not expired (unless the caller explicitly opts out, see VerifyOptions).
+ *
+ * Checks run in that order on purpose: an expired attestation whose signature
+ * is also forged reports the forgery, not the expiry, so a caller can never
+ * mistake a forged attestation for a merely stale one.
+ */
+export declare function verifyAttestation(attestation: EndpointAttestation, opts?: VerifyOptions): VerifyResult;
+//# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAGzB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yJAAyJ;AACzJ,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EACvB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,sBAAsB,CAAC,CAIjC;AAED,MAAM,MAAM,YAAY,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,mCAAmC,GACnC,mBAAmB,GACnB,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F,MAAM,WAAW,aAAa;IAC5B,qGAAqG;IACrG,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,mBAAmB,EAAE,IAAI,GAAE,aAAkB,GAAG,YAAY,CAkC1G"}

package/dist/signing.js

@@ -0,0 +1,70 @@
+// signing.ts — sign an endpoint attestation as the attester, and verify it later.
+//
+// Same deliberate choice as capacity-attest: EIP-191 personal-sign over the
+// content-address, not EIP-712 typed data, to keep the crypto surface small
+// enough to audit end to end. `recoverClaimSigner` is imported from
+// capacity-attest rather than reimplemented: it is a one-line
+// ethers.verifyMessage wrapper, but importing it keeps both packages
+// provably on the same recovery path instead of two copies that can drift.
+//
+// WHO SIGNS, AND WHY IT MATTERS: the ATTESTER signs, not the owner. The
+// owner's role is to prove control of the endpoint (see ownership.ts); the
+// attester's role is to state what the checks found and to carry the
+// responsibility for that statement. An attestation signed by the owner
+// about their own endpoint would be a self-declaration, which is worth
+// nothing to the third party reading it. verifyAttestation therefore
+// requires the signature to recover to `attesterAddress`, and deliberately
+// rejects an attestation where attester and owner are the same address.
+import { recoverClaimSigner } from "capacity-attest/dist/signing.js";
+import { computeAttestationId, isExpired, } from "./schema.js";
+/** Sign an attestation as the attester. Returns the content-addressed id alongside the signature so a caller can assemble a full EndpointAttestation. */
+export async function signAttestation(attester, content) {
+    const attestationId = computeAttestationId(content);
+    const signature = await attester.signMessage(attestationId);
+    return { attestationId, signature };
+}
+/**
+ * Verify that an assembled attestation is internally consistent AND still valid:
+ *   1. `attestationId` really is the sha256 content-address of the content fields.
+ *   2. `signature` recovers to `attesterAddress`.
+ *   3. The attester is not the owner (a self-declaration is not an attestation).
+ *   4. It has not expired (unless the caller explicitly opts out, see VerifyOptions).
+ *
+ * Checks run in that order on purpose: an expired attestation whose signature
+ * is also forged reports the forgery, not the expiry, so a caller can never
+ * mistake a forged attestation for a merely stale one.
+ */
+export function verifyAttestation(attestation, opts = {}) {
+    let expectedId;
+    try {
+        expectedId = computeAttestationId(attestation);
+    }
+    catch (e) {
+        // Content that cannot even be canonicalised (pathological nesting, or a
+        // shape that fails AttestationContentSchema) can never have a matching
+        // id, so report it as the mismatch it is rather than throwing at a
+        // caller who asked a yes/no question.
+        return { ok: false, reason: "attestation_id_mismatch", detail: e.message };
+    }
+    if (expectedId.toLowerCase() !== attestation.attestationId.toLowerCase()) {
+        return { ok: false, reason: "attestation_id_mismatch" };
+    }
+    let recovered;
+    try {
+        recovered = recoverClaimSigner(attestation.attestationId, attestation.signature);
+    }
+    catch (e) {
+        return { ok: false, reason: "signature_recovery_failed", detail: e.message };
+    }
+    if (recovered.toLowerCase() !== attestation.attesterAddress.toLowerCase()) {
+        return { ok: false, reason: "signature_does_not_match_attester" };
+    }
+    if (attestation.attesterAddress.toLowerCase() === attestation.ownerAddress.toLowerCase()) {
+        return { ok: false, reason: "attester_is_owner" };
+    }
+    if (!opts.ignoreExpiry && isExpired(attestation, opts.now ?? new Date())) {
+        return { ok: false, reason: "expired" };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,oEAAoE;AACpE,8DAA8D;AAC9D,qEAAqE;AACrE,2EAA2E;AAC3E,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,2EAA2E;AAC3E,wEAAwE;AAGxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAGL,oBAAoB,EACpB,SAAS,GACV,MAAM,aAAa,CAAC;AAOrB,yJAAyJ;AACzJ,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAuB,EACvB,OAA2B;IAE3B,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAC5D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAwBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAgC,EAAE,OAAsB,EAAE;IAC1F,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,sCAAsC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,WAAW,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "endpoint-attest",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Time-bounded, owner-requested security attestations for a network endpoint: the operator proves control of the endpoint, a check is run, and the outcome is recorded as a signed, content-addressed, expiring attestation. Reuses capacity-attest's canonical hashing and EIP-191 signing rather than reimplementing them. Never a security score, never a claim about a party that did not ask.",
+  "keywords": [
+    "attestation",
+    "mcp",
+    "endpoint",
+    "domain-control",
+    "x402",
+    "agent-commerce"
+  ],
+  "author": "holistis",
+  "license": "MIT",
+  "homepage": "https://tokenizen.nl",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/holistis/tokenizen.git",
+    "directory": "packages/endpoint-attest"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "capacity-attest": "^0.9.0",
+    "ethers": "^6.13.0",
+    "zod": "^4.5.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "tsx": "^4.23.15",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.11"
+  }
+}