Conversation
Dispatch curve on the in-band tag (multicodec varint for did:key, derivation code for CESR), never on byte length. Ed25519 (0xED01 / D,B) stays 32 bytes; P-256 (0x8024 / 1AAJ,1AAI) returns 33-byte compressed SEC1. Adds base64url + multicodec helpers and explicit unsupported-tag errors. Mirrors Rust KeriPublicKey::parse.
…eality The GitHub adapter resolves attestations from GitHub Release assets (*.auths.json), not Git refs. Correct the stale git-refs claims: - README Quick Start, How It Works (now forge-split: GitHub=Release assets, Gitea=refs, GitLab=unsupported), prerequisite, supported-forges, and the manual-mode public-key row (Ed25519 or P-256). - CHANGELOG: add [0.3.0] documenting the refs->Releases pivot + P-256; mark the 0.1.1 GitHub-adapter line superseded. - examples/auto-resolve.html: forge-accurate wording. - adapter.ts: forge-neutral interface doc. - e2e live-resolve test: GitHub listAuthsRefs is a [] stub; resolve asserts a well-formed bundle OR well-formed 'no asset' error (asset pending D-6). Gitea/GitLab refs wording left intact (legitimately refs-based).
detectForge now reduces the messy forms users paste to one {owner, repo}:
full URLs (+ .git, trailing slash, /tree/main, ?query#hash), protocol-less
hosts (github.com/org/repo), and owner/repo[.git] shorthand. Strips the .git
clone suffix on the shorthand path (was producing repo='repo.git'). Documents
full URL as canonical and the GitLab-subgroup limitation. Adds 8 normalization
unit tests (10 -> 18).
- README: replace the unpinned unpkg snippet with a version-pinned (@0.3.0), integrity + crossorigin one for both unpkg and jsDelivr; explain why pinning is mandatory with SRI and why crossorigin is required. - Document the slim-vs-full SRI truth: both builds inline the WASM into a single .mjs (verified: byte-identical, same hash), so one integrity hash covers the whole runtime — there is no separate .wasm fetch. Corrects the stale 'slim loads .wasm separately' claim. - Add scripts/sri.mjs + 'npm run sri' to generate the sha384 from the built bundle so the documented hash stays reproducible per release.
Paste a repo URL (full or owner/repo) -> copy a canonical, version-pinned, SRI-protected <auths-verify> embed. Logic extracted to examples/embed-snippet.ts (buildEmbed) which reuses detectForge for normalization (no duplicated parser); the page is DOM + clipboard wiring only. Accessible copy button: real <button>, aria-label, aria-live 'Copied' status, secure-context guard with a transient- textarea execCommand fallback. Config is reflected in the URL query for deep linking. Adds 9 unit tests; linked from examples/index.html.
- Add a sandboxed-iframe live preview (iframe srcdoc, sandbox=allow-scripts) that renders the real badge from the pinned CDN bundle. previewDocument() lives in embed-snippet.ts and reuses buildEmbed's forgeAttr so snippet and preview agree; integrity is omitted in the preview so it always loads the published bytes. - Rate-limit hygiene: preview is debounced (800ms) and deduped by canonical repo URL so it doesn't fire a GitHub API call per keystroke; page notes the ~60/hr unauthenticated limit. Defaults to the example repo on load. - Add vite.pages.config.ts + 'npm run build:pages' (bundles only the detect/snippet logic — no WASM) and .github/workflows/pages.yml to deploy to GitHub Pages. Enabling Pages (Settings -> Pages -> Source: GitHub Actions) is a one-time manual step, noted in the workflow. - README links to the hosted Embed Builder. Adds 4 previewDocument tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stream C —
auths-verify-widgetGTMMakes the widget's surface tell the truth about the substance, standardizes the embed, and adds the SRI / version-pinning + interactive-playground polish. From
roadmap/go_to_market/go_to_market.md→ Stream C (G0.5/G4.1 · G4.4 · G4.5), planned and executed as Flow epic fn-1.Scope discipline: zero new product features — drift-elimination, packaging, and UX polish only. One repo.
example-verify-badge(Stream D) is intentionally untouched.What's in here
b83d528, fn-1.6) — the in-flightdid-utilschange landed as the foundational commit: did:key (0x80 0x24) + CESR (1AAJ/1AAI) decode to 33-byte compressed SEC1, dispatched on the in-band curve tag. Mirrors RustKeriPublicKey::parse.ca8553e, fn-1.1, D-5) — the GitHub resolver fetches*.auths.jsonfrom GitHub Releases, not git refs. Corrected README Quick Start + "How It Works" (now forge-split), CHANGELOG ([0.3.0]pivot entry),auto-resolve.html, theadapter.tscomment, and the executable drift intests/e2e/live-resolve.test.ts(it assertedlistAuthsRefs()git-refs behavior that can't pass). Gitea/GitLab refs wording left intact — they're legitimately refs-based.repo=normalization (01bbb61, fn-1.2) —detectForgenow reduces full URLs (.git, trailing/,/tree/main,?query#hash), protocol-less hosts, andowner/repo[.git]shorthand to one{owner, repo}. Standardized docs on the full-URL form.78c3761, fn-1.3) — version-pinned@0.3.0snippet withintegrity+crossoriginfor unpkg & jsDelivr, plusscripts/sri.mjs(npm run sri) to keep the hash reproducible. Investigated and documented the slim build honestly: it inlines WASM too (byte-identical to full), so one hash covers the whole runtime — no separate.wasmfetch.43a01a9, fn-1.4) — paste a repo URL → copy a canonical, pinned, SRI-protected<auths-verify>snippet. Logic inexamples/embed-snippet.tsreusesdetectForge(no duplicated parser); accessible copy button (real<button>,aria-label,aria-live"Copied", secure-context fallback). Deep-linkable via?repo=.f8f3f83, fn-1.5) — sandboxediframe srcdocrenders the real badge from the pinned CDN bundle (debounced + deduped to respect GitHub's 60/hr unauthenticated limit).vite.pages.config.ts+npm run build:pages+.github/workflows/pages.ymlship it to GitHub Pages; README links it.Verification
npm run typecheckclean · 93/93 unit tests ·npm run build(full+slim) +npm run build:pagessucceed ·npm run srireproduces the documented hash · drift grep (refs/auths/identity|refs/auths/devices/nodes) clean across README/CHANGELOG/examples.Manual follow-ups (cannot be done from this PR)
pages.yml).example-verify-badgeto publish a real*.auths.jsonRelease asset (different repo).npm run sriagainst the published bytes when cutting the release and confirm it matches.🤖 Generated with Claude Code