web-agent-bridge 3.3.0 → 3.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. package/LICENSE +12 -0
  2. package/README.ar.md +18 -0
  3. package/README.md +198 -1664
  4. package/bin/wab-init.js +223 -0
  5. package/examples/azure-dns-wab.js +83 -0
  6. package/examples/cloudflare-wab-dns.js +121 -0
  7. package/examples/cpanel-wab-dns.js +114 -0
  8. package/examples/dns-discovery-agent.js +166 -0
  9. package/examples/gcp-dns-wab.js +76 -0
  10. package/examples/governance-agent.js +169 -0
  11. package/examples/plesk-wab-dns.js +103 -0
  12. package/examples/route53-wab-dns.js +144 -0
  13. package/examples/safe-mode-agent.js +96 -0
  14. package/examples/wab-sign.js +74 -0
  15. package/examples/wab-verify.js +60 -0
  16. package/package.json +5 -5
  17. package/public/.well-known/wab.json +28 -0
  18. package/public/activate.html +368 -0
  19. package/public/adoption-metrics.html +188 -0
  20. package/public/api.html +1 -1
  21. package/public/azure-dns-integration.html +289 -0
  22. package/public/cloudflare-integration.html +380 -0
  23. package/public/cpanel-integration.html +398 -0
  24. package/public/css/styles.css +28 -0
  25. package/public/dashboard.html +1 -0
  26. package/public/dns.html +101 -172
  27. package/public/docs.html +1 -0
  28. package/public/gcp-dns-integration.html +318 -0
  29. package/public/growth.html +4 -2
  30. package/public/index.html +227 -31
  31. package/public/integrations.html +1 -1
  32. package/public/js/activate.js +145 -0
  33. package/public/js/auth-nav.js +34 -0
  34. package/public/js/dns.js +438 -0
  35. package/public/openapi.json +89 -0
  36. package/public/plesk-integration.html +375 -0
  37. package/public/premium.html +1 -1
  38. package/public/provider-onboarding.html +172 -0
  39. package/public/provider-sandbox.html +134 -0
  40. package/public/providers.html +359 -0
  41. package/public/registrar-integrations.html +141 -0
  42. package/public/robots.txt +12 -0
  43. package/public/route53-integration.html +531 -0
  44. package/public/shieldqr.html +231 -0
  45. package/public/sitemap.xml +6 -0
  46. package/public/wab-trust.html +200 -0
  47. package/public/wab-vs-protocols.html +210 -0
  48. package/public/whitepaper.html +449 -0
  49. package/sdk/auto-discovery.js +288 -0
  50. package/sdk/governance.js +262 -0
  51. package/sdk/index.js +13 -0
  52. package/sdk/package.json +2 -2
  53. package/sdk/safe-mode.js +221 -0
  54. package/server/index.js +144 -5
  55. package/server/migrations/007_governance.sql +106 -0
  56. package/server/migrations/008_plans.sql +144 -0
  57. package/server/migrations/009_shieldqr.sql +30 -0
  58. package/server/migrations/010_extended_trust.sql +33 -0
  59. package/server/models/adapters/mysql.js +1 -1
  60. package/server/models/adapters/postgresql.js +1 -1
  61. package/server/models/db.js +60 -1
  62. package/server/routes/admin-plans.js +76 -0
  63. package/server/routes/admin-premium.js +4 -2
  64. package/server/routes/admin-shieldqr.js +90 -0
  65. package/server/routes/admin-trust-monitor.js +83 -0
  66. package/server/routes/admin.js +289 -1
  67. package/server/routes/billing.js +16 -4
  68. package/server/routes/discovery.js +1933 -2
  69. package/server/routes/governance.js +208 -0
  70. package/server/routes/plans.js +33 -0
  71. package/server/routes/providers.js +650 -0
  72. package/server/routes/shieldqr.js +88 -0
  73. package/server/services/email.js +29 -0
  74. package/server/services/governance.js +466 -0
  75. package/server/services/plans.js +214 -0
  76. package/server/services/premium.js +1 -1
  77. package/server/services/provider-clients.js +740 -0
  78. package/server/services/shieldqr.js +322 -0
  79. package/server/services/ssl-inspector.js +42 -0
  80. package/server/services/ssl-monitor.js +167 -0
  81. package/server/services/stripe.js +18 -5
  82. package/server/services/vision.js +1 -1
  83. package/server/services/wab-crypto.js +178 -0
package/public/shieldqr.html ADDED
@@ -0,0 +1,231 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>WAB ShieldQR — Scan QR codes safely</title>
7
+ <meta name="description" content="Scan any QR code in your browser and instantly verify the destination with WAB ShieldQR — DNS trust, Ed25519 signatures, SSL inspection.">
8
+ <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
9
+ <link rel="stylesheet" href="/css/styles.css">
10
+ <style>
11
+ body { font-family: 'Inter', system-ui, sans-serif; margin:0; background:#0f172a; color:#e2e8f0; min-height:100vh; }
12
+ .wrap { max-width: 720px; margin: 0 auto; padding: 28px 18px 60px; }
13
+ h1 { font-size: 1.8rem; margin: 0 0 6px; display:flex; align-items:center; gap:10px; }
14
+ .sub { color:#94a3b8; margin: 0 0 22px; }
15
+ .card { background:#1e293b; border:1px solid #334155; border-radius:14px; padding:18px; margin-bottom:16px; }
16
+ #reader { width:100%; border-radius:10px; overflow:hidden; background:#000; }
17
+ #reader video { width:100%; max-height:60vh; }
18
+ .controls { display:flex; gap:8px; flex-wrap:wrap; margin-top:10px; }
19
+ .btn { padding:10px 16px; border-radius:8px; border:none; font-weight:600; cursor:pointer; font-size:.95rem; }
20
+ .btn-primary { background:#6366f1; color:#fff; }
21
+ .btn-primary:hover { background:#4f46e5; }
22
+ .btn-secondary { background:#334155; color:#e2e8f0; }
23
+ .btn-danger { background:#dc2626; color:#fff; }
24
+ .btn-success { background:#16a34a; color:#fff; }
25
+ input[type=text] { flex:1; min-width:200px; padding:10px 12px; border-radius:8px; border:1px solid #475569; background:#0f172a; color:#e2e8f0; font-size:.95rem; }
26
+ .verdict { padding:18px; border-radius:14px; border:2px solid; }
27
+ .verdict.green { border-color:#16a34a; background:rgba(22,163,74,.08); }
28
+ .verdict.yellow { border-color:#ca8a04; background:rgba(202,138,4,.08); }
29
+ .verdict.red { border-color:#dc2626; background:rgba(220,38,38,.08); }
30
+ .verdict h2 { margin:0 0 6px; font-size:1.4rem; }
31
+ .verdict .score { font-size:2.4rem; font-weight:800; }
32
+ .verdict .url { font-family: ui-monospace, Menlo, monospace; font-size:.85rem; word-break: break-all; color:#cbd5e1; margin: 6px 0 12px; }
33
+ .signals { margin-top:10px; }
34
+ .signal { padding:8px 10px; border-radius:8px; background:#0f172a; margin-bottom:6px; font-size:.85rem; display:flex; gap:8px; align-items:flex-start; }
35
+ .signal .sev { font-size:.7rem; font-weight:700; padding:1px 6px; border-radius:4px; text-transform:uppercase; flex-shrink:0; }
36
+ .sev-low { background:#0ea5e9; color:#fff; }
37
+ .sev-medium { background:#ca8a04; color:#fff; }
38
+ .sev-high { background:#dc2626; color:#fff; }
39
+ .meta { display:grid; grid-template-columns:repeat(auto-fit, minmax(140px,1fr)); gap:8px; margin-top:10px; font-size:.85rem; }
40
+ .meta div { background:#0f172a; padding:8px 10px; border-radius:8px; }
41
+ .meta .lbl { color:#94a3b8; font-size:.7rem; text-transform:uppercase; letter-spacing:.04em; }
42
+ .hidden { display:none !important; }
43
+ .footer-note { color:#64748b; font-size:.8rem; text-align:center; margin-top:30px; }
44
+ a { color:#a5b4fc; }
45
+ </style>
46
+ <!-- html5-qrcode loader (CSP-allowed origin) -->
47
+ <script src="https://unpkg.com/html5-qrcode@2.3.8/html5-qrcode.min.js"></script>
48
+ </head>
49
+ <body>
50
+ <div class="wrap">
51
+ <h1>🛡️ WAB ShieldQR</h1>
52
+ <p class="sub">Scan any QR code in your browser. We verify the destination with DNS trust records, Ed25519 signatures, and live SSL inspection — <strong>before</strong> you ever open the link.</p>
53
+
54
+ <div class="card">
55
+ <div id="reader"></div>
56
+ <div class="controls">
57
+ <button id="startCam" class="btn btn-primary">📷 Start camera</button>
58
+ <button id="stopCam" class="btn btn-secondary hidden">⏹ Stop</button>
59
+ </div>
60
+ </div>
61
+
62
+ <div class="card">
63
+ <strong>Or paste a URL manually:</strong>
64
+ <div class="controls" style="margin-top:8px;">
65
+ <input id="manualUrl" type="text" placeholder="https://example.com/...">
66
+ <button id="manualScan" class="btn btn-primary">Verify</button>
67
+ </div>
68
+ </div>
69
+
70
+ <div id="result" class="card hidden"></div>
71
+
72
+ <p class="footer-note">
73
+ Powered by <a href="/">Web Agent Bridge</a> · ShieldQR is open and free for everyone ·
74
+ <a href="/api/shieldqr/recent" target="_blank">Recent scans</a>
75
+ </p>
76
+ </div>
77
+
78
+ <script>
79
+ (function () {
80
+ const el = (id) => document.getElementById(id);
81
+ const H = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) =>
82
+ ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
83
+
84
+ let scanner = null; let lastResult = null;
85
+
86
+ function startCamera() {
87
+ if (typeof Html5Qrcode === 'undefined') {
88
+ alert('QR library failed to load. Check your network or use the manual URL field.');
89
+ return;
90
+ }
91
+ el('startCam').classList.add('hidden');
92
+ el('stopCam').classList.remove('hidden');
93
+ scanner = new Html5Qrcode('reader');
94
+ scanner.start(
95
+ { facingMode: 'environment' },
96
+ { fps: 10, qrbox: { width: 260, height: 260 } },
97
+ (decodedText) => {
98
+ scanner.stop().catch(() => {});
99
+ el('startCam').classList.remove('hidden');
100
+ el('stopCam').classList.add('hidden');
101
+ verify(decodedText);
102
+ },
103
+ () => {} // ignore per-frame errors
104
+ ).catch((err) => {
105
+ alert('Camera error: ' + err);
106
+ el('startCam').classList.remove('hidden');
107
+ el('stopCam').classList.add('hidden');
108
+ });
109
+ }
110
+
111
+ function stopCamera() {
112
+ if (!scanner) return;
113
+ scanner.stop().catch(() => {}).finally(() => {
114
+ el('startCam').classList.remove('hidden');
115
+ el('stopCam').classList.add('hidden');
116
+ scanner = null;
117
+ });
118
+ }
119
+
120
+ async function verify(url) {
121
+ const result = el('result');
122
+ result.classList.remove('hidden');
123
+ result.innerHTML = '<div style="text-align:center;padding:20px;">⏳ Verifying <strong>' + H(url) + '</strong>…</div>';
124
+ try {
125
+ const r = await fetch('/api/shieldqr/scan', {
126
+ method: 'POST',
127
+ headers: { 'Content-Type': 'application/json' },
128
+ body: JSON.stringify({ url }),
129
+ });
130
+ const data = await r.json();
131
+ if (!r.ok) throw new Error(data.error || 'scan failed');
132
+ lastResult = data;
133
+ renderVerdict(data, url);
134
+ } catch (err) {
135
+ result.innerHTML = '<div style="color:#fca5a5;text-align:center;padding:20px;">❌ ' + H(err.message) + '</div>';
136
+ }
137
+ }
138
+
139
+ function renderVerdict(d, url) {
140
+ const lvl = d.level || 'yellow';
141
+ const icon = { green: '✅', yellow: '⚠️', red: '🛑' }[lvl] || '⚠️';
142
+ const headline = { green: 'Safe — verified', yellow: 'Caution — incomplete trust', red: 'Dangerous — do not open' }[lvl];
143
+ const sslDays = d.ssl && d.ssl.days_until_expiry != null ? d.ssl.days_until_expiry : '—';
144
+ const trustOk = d.trust && d.trust.ok ? '✅ Signed' : '—';
145
+ const dnsOk = d.dns && Array.isArray(d.dns.discovery) && d.dns.discovery.length ? '✅ Present' : '—';
146
+ const signals = (d.signals || []).map((s) => `
147
+ <div class="signal">
148
+ <span class="sev sev-${H(s.severity || 'low')}">${H(s.severity || 'low')}</span>
149
+ <div><strong>${H(s.id || '')}</strong> — ${H(s.message || '')}</div>
150
+ </div>
151
+ `).join('') || '<div class="signal"><span class="sev sev-low">ok</span><div>No signals raised.</div></div>';
152
+
153
+ const openBtn = lvl === 'green'
154
+ ? `<a class="btn btn-success" href="${H(url)}" target="_blank" rel="noopener noreferrer">Open destination →</a>`
155
+ : `<button class="btn btn-danger" data-action="forceOpen">Open anyway (risky)</button>`;
156
+
157
+ el('result').innerHTML = `
158
+ <div class="verdict ${H(lvl)}">
159
+ <div style="display:flex;justify-content:space-between;align-items:flex-start;gap:14px;flex-wrap:wrap;">
160
+ <div>
161
+ <h2>${icon} ${H(headline)}</h2>
162
+ <div class="url">${H(url)}</div>
163
+ </div>
164
+ <div style="text-align:right;">
165
+ <div class="score">${d.score ?? '—'}</div>
166
+ <div style="font-size:.7rem;color:#94a3b8;text-transform:uppercase;letter-spacing:.05em;">score / 100</div>
167
+ </div>
168
+ </div>
169
+
170
+ <div class="meta">
171
+ <div><div class="lbl">Host</div>${H(d.host || '—')}</div>
172
+ <div><div class="lbl">DNS _wab</div>${dnsOk}</div>
173
+ <div><div class="lbl">Signed wab.json</div>${trustOk}</div>
174
+ <div><div class="lbl">SSL valid for</div>${sslDays} days</div>
175
+ </div>
176
+
177
+ <div class="signals">${signals}</div>
178
+
179
+ <div class="controls" style="margin-top:14px;">
180
+ ${openBtn}
181
+ <button class="btn btn-secondary" data-action="rescan">Scan another</button>
182
+ <button class="btn btn-danger" data-action="report">Report this URL</button>
183
+ </div>
184
+ </div>
185
+ `;
186
+
187
+ el('result').querySelector('[data-action="rescan"]').addEventListener('click', () => {
188
+ el('result').classList.add('hidden');
189
+ el('manualUrl').value = '';
190
+ });
191
+ const forceBtn = el('result').querySelector('[data-action="forceOpen"]');
192
+ if (forceBtn) {
193
+ forceBtn.addEventListener('click', () => {
194
+ if (confirm('This site has not been verified as safe. Open anyway?')) {
195
+ window.open(url, '_blank', 'noopener,noreferrer');
196
+ }
197
+ });
198
+ }
199
+ el('result').querySelector('[data-action="report"]').addEventListener('click', () => reportUrl(url));
200
+ }
201
+
202
+ async function reportUrl(url) {
203
+ const reason = prompt('Why are you reporting this URL? (e.g. phishing, malware, scam)');
204
+ if (!reason || reason.trim().length < 4) return;
205
+ try {
206
+ const r = await fetch('/api/shieldqr/report', {
207
+ method: 'POST',
208
+ headers: { 'Content-Type': 'application/json' },
209
+ body: JSON.stringify({ url, reason: reason.trim(), scan_id: lastResult && lastResult.scan_id }),
210
+ });
211
+ const data = await r.json();
212
+ if (!r.ok) throw new Error(data.error || 'report failed');
213
+ alert('Thank you — your report has been submitted.');
214
+ } catch (err) {
215
+ alert('Report failed: ' + err.message);
216
+ }
217
+ }
218
+
219
+ el('startCam').addEventListener('click', startCamera);
220
+ el('stopCam').addEventListener('click', stopCamera);
221
+ el('manualScan').addEventListener('click', () => {
222
+ const u = el('manualUrl').value.trim();
223
+ if (u) verify(u);
224
+ });
225
+ el('manualUrl').addEventListener('keydown', (e) => {
226
+ if (e.key === 'Enter') { e.preventDefault(); el('manualScan').click(); }
227
+ });
228
+ })();
229
+ </script>
230
+ </body>
231
+ </html>
package/public/sitemap.xml CHANGED
@@ -12,6 +12,12 @@
12
12
  <changefreq>weekly</changefreq>
13
13
  <priority>0.9</priority>
14
14
  </url>
15
+ <url>
16
+ <loc>https://webagentbridge.com/whitepaper</loc>
17
+ <lastmod>2026-05-03</lastmod>
18
+ <changefreq>yearly</changefreq>
19
+ <priority>0.95</priority>
20
+ </url>
15
21
  <url>
16
22
  <loc>https://webagentbridge.com/premium</loc>
17
23
  <lastmod>2026-03-28</lastmod>
package/public/wab-trust.html ADDED
@@ -0,0 +1,200 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en" dir="ltr">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>WAB Trust — Cryptographic Verification (v1.3)</title>
7
+ <meta name="description" content="WAB DNS Discovery v1.3 trust layer: DNSSEC + Ed25519 signed manifests anchored in domain ownership. Verify any domain's cryptographic trust score live.">
8
+ <link rel="stylesheet" href="/css/styles.css?v=3.3.0">
9
+ <style>
10
+ body { background:#081123; color:#e8efff; }
11
+ .hero { padding:100px 20px 26px; text-align:center; }
12
+ .hero .badge { display:inline-block; background:linear-gradient(135deg,#10b981,#059669); padding:4px 12px; border-radius:999px; font-size:.78rem; font-weight:700; letter-spacing:.5px; margin-bottom:12px; }
13
+ .hero h1 { font-size:clamp(1.9rem,4vw,2.8rem); margin:6px 0 8px; }
14
+ .hero p { color:#9eb1d8; max-width:840px; margin:0 auto; font-size:1rem; }
15
+ .wrap { max-width:1180px; margin:0 auto; padding:0 18px 70px; }
16
+ .panel { background:linear-gradient(180deg,rgba(17,24,39,.92),rgba(10,16,30,.96)); border:1px solid rgba(148,163,184,.2); border-radius:14px; padding:18px; margin-bottom:16px; }
17
+ .panel h3 { margin:0 0 10px; color:#fcd34d; font-size:1rem; }
18
+ .grid2 { display:grid; grid-template-columns:1.2fr 1fr; gap:14px; }
19
+ @media (max-width:880px) { .grid2 { grid-template-columns:1fr; } }
20
+ label { display:block; font-size:.78rem; color:#a8b7d7; margin-bottom:5px; }
21
+ input, textarea, select { width:100%; background:#0b162a; border:1px solid rgba(148,163,184,.28); color:#e8efff; border-radius:10px; padding:10px; font-family:Consolas,monospace; font-size:.85rem; }
22
+ button { background:linear-gradient(135deg,#10b981,#047857); color:#fff; border:none; border-radius:10px; padding:10px 14px; cursor:pointer; font-weight:700; font-size:.85rem; }
23
+ button.alt { background:linear-gradient(135deg,#334155,#1f2937); }
24
+ button.warn { background:linear-gradient(135deg,#f59e0b,#b45309); }
25
+ .actions { display:flex; gap:8px; flex-wrap:wrap; margin-top:8px; }
26
+ pre { background:#020617; border:1px solid rgba(148,163,184,.26); border-radius:10px; padding:12px; color:#c4b5fd; overflow:auto; font-size:.78rem; }
27
+ .score-card { text-align:center; padding:20px; border-radius:14px; }
28
+ .score-num { font-size:3.4rem; font-weight:800; line-height:1; }
29
+ .score-label { font-size:.86rem; text-transform:uppercase; letter-spacing:1.4px; margin-top:6px; }
30
+ .platinum { background:linear-gradient(135deg,#a855f7,#6366f1); color:#fff; }
31
+ .gold { background:linear-gradient(135deg,#fbbf24,#d97706); color:#1f2937; }
32
+ .silver { background:linear-gradient(135deg,#cbd5e1,#94a3b8); color:#1f2937; }
33
+ .bronze { background:linear-gradient(135deg,#f97316,#c2410c); color:#fff; }
34
+ .basic { background:linear-gradient(135deg,#475569,#1f2937); color:#fff; }
35
+ .unverified { background:#1f2937; color:#a8b7d7; border:1px solid rgba(148,163,184,.26); }
36
+ .check-row { display:flex; align-items:center; gap:10px; padding:8px 0; border-bottom:1px solid rgba(148,163,184,.12); font-size:.9rem; }
37
+ .check-row:last-child { border-bottom:0; }
38
+ .check-icon { width:22px; height:22px; border-radius:50%; display:flex; align-items:center; justify-content:center; font-weight:800; font-size:.78rem; }
39
+ .check-icon.ok { background:#064e3b; color:#a7f3d0; }
40
+ .check-icon.no { background:#7f1d1d; color:#fecaca; }
41
+ .findings { background:#0b162a; border-left:3px solid #f59e0b; padding:10px 14px; border-radius:6px; font-size:.84rem; color:#fde68a; margin-top:10px; }
42
+ .findings ul { margin:6px 0 0 18px; padding:0; }
43
+ table { width:100%; border-collapse:collapse; font-size:.84rem; }
44
+ th, td { padding:8px 10px; text-align:left; border-bottom:1px solid rgba(148,163,184,.14); }
45
+ th { color:#a8b7d7; font-weight:600; font-size:.74rem; text-transform:uppercase; letter-spacing:.5px; }
46
+ .pill { display:inline-block; padding:2px 8px; border-radius:999px; font-size:.7rem; font-weight:700; }
47
+ .pill.ok { background:#064e3b; color:#a7f3d0; }
48
+ .pill.no { background:#7f1d1d; color:#fecaca; }
49
+ .keyout { display:none; }
50
+ a { color:#fcd34d; }
51
+ .small { font-size:.8rem; color:#9eb1d8; }
52
+ </style>
53
+ </head>
54
+ <body>
55
+ <section class="hero">
56
+ <span class="badge">WAB v1.3 · Trust Layer</span>
57
+ <h1>Cryptographic Trust for Agent Discovery</h1>
58
+ <p>WAB v1.3 binds every domain's discovery manifest to an <strong>Ed25519 signature</strong>, with the public key published in DNS and protected by <strong>DNSSEC</strong>. No CA. No central registry. Trust is rooted exactly where it should be — in domain ownership.</p>
59
+ </section>
60
+
61
+ <div class="wrap">
62
+
63
+ <div class="grid2">
64
+ <!-- LIVE VERIFIER -->
65
+ <div class="panel">
66
+ <h3>Verify any domain</h3>
67
+ <p class="small">Runs the full 5-check trust report: DNS · DNSSEC · public key · HTTPS manifest · signature.</p>
68
+ <label>Domain</label>
69
+ <input id="vDomain" placeholder="example.com" value="webagentbridge.com" />
70
+ <div class="actions">
71
+ <button onclick="runVerify()">Run Trust Check</button>
72
+ <button class="alt" onclick="loadLeaderboard()">View Leaderboard</button>
73
+ </div>
74
+ <div id="vResult" style="margin-top:14px;"></div>
75
+ </div>
76
+
77
+ <!-- KEY GENERATOR -->
78
+ <div class="panel">
79
+ <h3>Generate Ed25519 keypair</h3>
80
+ <p class="small">Stateless. The server never stores your private key — save it offline and use it to sign your <code>wab.json</code>.</p>
81
+ <div class="actions">
82
+ <button class="warn" onclick="genKeys()">Generate New Keypair</button>
83
+ <button class="alt" onclick="document.getElementById('keyout').style.display='none'">Hide</button>
84
+ </div>
85
+ <div id="keyout" class="keyout" style="margin-top:14px;">
86
+ <label>TXT record (publish in DNS)</label>
87
+ <pre id="kTxt"></pre>
88
+ <label>Public key (base64)</label>
89
+ <pre id="kPub"></pre>
90
+ <label>Private key (base64) — save offline NOW</label>
91
+ <pre id="kPriv" style="border-color:#7f1d1d;color:#fecaca;"></pre>
92
+ <p class="small" style="color:#fde68a;">⚠ This is the only time the private key is shown. Copy it now.</p>
93
+ </div>
94
+ </div>
95
+ </div>
96
+
97
+ <!-- LEADERBOARD -->
98
+ <div class="panel" id="leaderboardPanel" style="display:none;">
99
+ <h3>Trust Leaderboard</h3>
100
+ <div id="leaderboard">Loading…</div>
101
+ </div>
102
+
103
+ <!-- HOW IT WORKS -->
104
+ <div class="panel">
105
+ <h3>How WAB v1.3 trust works</h3>
106
+ <ol style="color:#cbd5e1;font-size:.9rem;line-height:1.7;padding-left:20px;">
107
+ <li><strong>Generate keypair</strong> (Ed25519, 32 bytes each) — offline or via the button above.</li>
108
+ <li><strong>Publish public key in DNS</strong>: <code>_wab IN TXT "v=wab1; endpoint=https://example.com/.well-known/wab.json; pk=ed25519:&lt;BASE64&gt;"</code>.</li>
109
+ <li><strong>Enable DNSSEC</strong> on your zone (most registrars: 1-click). DNSSEC chain protects the key from spoofing.</li>
110
+ <li><strong>Sign your manifest</strong> with the private key: <code>node wab-sign.js sign wab.json key.priv</code> → <code>wab.signed.json</code>.</li>
111
+ <li><strong>Upload signed manifest</strong> to <code>https://example.com/.well-known/wab.json</code>.</li>
112
+ <li>Agents fetch the TXT (verify DNSSEC) → fetch the manifest (verify signature with DNS-published key) → trust established.</li>
113
+ </ol>
114
+ <p class="small" style="margin-top:10px;">Compare to ANS, sitemap.xml, llms.txt, ai.txt:
115
+ <a href="/wab-vs-protocols">WAB vs other protocols →</a></p>
116
+ <p class="small">Offline tools: <a href="/examples/wab-sign.js" target="_blank">wab-sign.js</a> · <a href="/examples/wab-verify.js" target="_blank">wab-verify.js</a></p>
117
+ </div>
118
+
119
+ </div>
120
+
121
+ <script>
122
+ const tick = (b) => b ? '<div class="check-icon ok">✓</div>' : '<div class="check-icon no">✗</div>';
123
+
124
+ async function runVerify() {
125
+ const d = document.getElementById('vDomain').value.trim();
126
+ if (!d) return;
127
+ const out = document.getElementById('vResult');
128
+ out.innerHTML = '<p class="small">Running trust check…</p>';
129
+ try {
130
+ const r = await fetch(`/api/discovery/trust/${encodeURIComponent(d)}`);
131
+ const data = await r.json();
132
+ if (!r.ok) { out.innerHTML = `<p style="color:#fecaca;">Error: ${data.error || r.status}</p>`; return; }
133
+ const c = data.checks || {};
134
+ const cls = data.trust_label || 'unverified';
135
+ out.innerHTML = `
136
+ <div class="score-card ${cls}">
137
+ <div class="score-num">${data.trust_score}<span style="font-size:1.2rem;opacity:.7">/100</span></div>
138
+ <div class="score-label">${cls}</div>
139
+ </div>
140
+ <div style="margin-top:10px;">
141
+ <div class="check-row">${tick(c.dns_resolved)}<span>DNS <code>_wab</code> record present</span></div>
142
+ <div class="check-row">${tick(c.dnssec_verified)}<span>DNSSEC verified (AD flag set)</span></div>
143
+ <div class="check-row">${tick(c.has_public_key)}<span>Public key in DNS (<code>pk=${c.pk_algorithm || '—'}</code>)</span></div>
144
+ <div class="check-row">${tick(c.https_endpoint && c.manifest_fetched)}<span>HTTPS manifest reachable</span></div>
145
+ <div class="check-row">${tick(c.signature_valid)}<span>Manifest signature valid (Ed25519)</span></div>
146
+ </div>
147
+ ${data.public_key ? `<p class="small" style="margin-top:10px;">Key fingerprint: <code>${data.public_key.fingerprint}</code></p>` : ''}
148
+ ${data.findings && data.findings.length ? `<div class="findings"><strong>Findings:</strong><ul>${data.findings.map(f=>`<li>${f}</li>`).join('')}</ul></div>` : ''}
149
+ `;
150
+ } catch (err) {
151
+ out.innerHTML = `<p style="color:#fecaca;">Error: ${err.message}</p>`;
152
+ }
153
+ }
154
+
155
+ async function genKeys() {
156
+ try {
157
+ const r = await fetch('/api/discovery/keys/generate', { method:'POST' });
158
+ const k = await r.json();
159
+ document.getElementById('keyout').style.display = 'block';
160
+ document.getElementById('kTxt').textContent = k.txt_record_snippet;
161
+ document.getElementById('kPub').textContent = k.public_key;
162
+ document.getElementById('kPriv').textContent = k.private_key;
163
+ } catch (err) {
164
+ alert('Key generation failed: ' + err.message);
165
+ }
166
+ }
167
+
168
+ async function loadLeaderboard() {
169
+ const panel = document.getElementById('leaderboardPanel');
170
+ panel.style.display = 'block';
171
+ const out = document.getElementById('leaderboard');
172
+ try {
173
+ const r = await fetch('/api/discovery/trust-leaderboard');
174
+ const data = await r.json();
175
+ if (!data.domains || !data.domains.length) {
176
+ out.innerHTML = '<p class="small">No trust runs recorded yet. Run a verify to populate.</p>';
177
+ return;
178
+ }
179
+ out.innerHTML = `<table>
180
+ <thead><tr><th>#</th><th>Domain</th><th>Score</th><th>DNSSEC</th><th>pk</th><th>Signed</th><th>Sig OK</th><th>Last check</th></tr></thead>
181
+ <tbody>${data.domains.map((d,i)=>`
182
+ <tr>
183
+ <td>${i+1}</td>
184
+ <td>${d.domain}</td>
185
+ <td><strong>${d.score}</strong></td>
186
+ <td>${d.dnssec === 'verified' ? '<span class="pill ok">✓</span>' : '<span class="pill no">'+d.dnssec+'</span>'}</td>
187
+ <td>${d.has_pk ? '<span class="pill ok">✓</span>' : '<span class="pill no">—</span>'}</td>
188
+ <td>${d.signed_manifest ? '<span class="pill ok">✓</span>' : '<span class="pill no">—</span>'}</td>
189
+ <td>${d.signature_valid ? '<span class="pill ok">✓</span>' : '<span class="pill no">—</span>'}</td>
190
+ <td class="small">${(d.last_checked||'').replace('T',' ').slice(0,16)}</td>
191
+ </tr>
192
+ `).join('')}</tbody>
193
+ </table>`;
194
+ } catch (err) {
195
+ out.innerHTML = `<p style="color:#fecaca;">Error: ${err.message}</p>`;
196
+ }
197
+ }
198
+ </script>
199
+ </body>
200
+ </html>