ARR SDK

1. Installation

ARR packages are published to npm and available for install.

Install from npm

npm install @allrightsrespected/sdk
npm install -g @allrightsrespected/cli

Package Names

@allrightsrespected/sdk
@allrightsrespected/cli

Repository Workflow (Contributors)

git clone https://github.com/kanoliban/All-Rights-Respected.git
cd All-Rights-Respected
npm install
npm run build

Implementation Location

packages/arr-core   # protocol + adapters
packages/arr-cli    # CLI entrypoint
fixtures/conformance/v0.1

Requirements

• Node.js 18+ (Node LTS recommended)
• TypeScript 5.x

2. Quick Start

Create and sign your first attestation in a few lines of code:

import { generateKeyPair, signAttestation, verifyAttestation } from '@allrightsrespected/sdk';

// Generate a new Ed25519 keypair
const { privateKeyPem, publicKeyPem, creator } = generateKeyPair();

// Create an attestation
const attestation = {
  version: 'arr/0.1',
  id: crypto.randomUUID(),
  created: new Date().toISOString(),
  creator: creator,
  intent: 'Album cover for indie rock EP',
  tool: 'midjourney/6.1',
  revocable: true
};

// Sign it
const signed = signAttestation(attestation, privateKeyPem);

console.log(signed);
// {
//   attestation: { version: 'arr/0.1', id: '...', ... },
//   signature: 'ed25519:kF2h9Jx3mN7pQr...'
// }

Verify an Attestation

import { verifyAttestation } from '@allrightsrespected/sdk';

const result = verifyAttestation(signed, publicKeyPem);

if (result.valid) {
  console.log('Attestation is valid.');
  console.log(`Expired: ${result.expired}`);
} else {
  console.log(`Invalid: ${result.reason}`);
}

3. Signing Attestations

M1 supports Ed25519 only.

3.1 Ed25519 (Recommended)

import { generateKeyPair, signAttestation } from '@allrightsrespected/sdk';

// Generate Ed25519 keypair
const keys = generateKeyPair();

// Sign with private key
const signed = signAttestation(attestation, keys.privateKeyPem);

3.2 Planned Algorithms (Not in M1)

ecdsa-p256, rsa-sha256

4. API Reference

Attestation Object (Build Manually in M1)

M1 does not ship a createAttestation() helper. Build the unsigned attestation object directly before signing.

signAttestation(attestation, privateKeyPem)

Signs an attestation and returns the complete signed object.

verifyAttestation(signed, publicKey)

Verifies a signed attestation.

interface VerificationResult {
  valid: boolean;
  expired?: boolean;
  reason?: 'invalid_signature' | 'unsupported_version' | 'malformed' | 'missing_public_key';
}

embedAttestationInMetadata(file, signed)

Embeds a signed attestation into PNG/JPEG metadata.

const embeddedFile = embedAttestationInMetadata(imageBuffer, signed);

// Write to disk
await fs.writeFile('artwork-with-arr.png', embeddedFile);

extractAttestationFromMetadata(file)

Extracts an attestation from PNG/JPEG metadata.

const extracted = extractAttestationFromMetadata(imageBuffer);
const signed = extracted?.signed;

if (signed) {
  console.log(signed.attestation.creator);
  console.log(signed.attestation.intent);
}

5. Schema Definition

The complete TypeScript type definitions for ARR attestations:

interface Attestation {
  version: 'arr/0.1';
  id: string;           // UUID v4
  created: string;      // ISO-8601 timestamp
  creator: string;      // Creator identifier
  intent?: string;      // Creative intent description
  tool?: string;        // Tool name/version
  upstream?: string[];  // Upstream attestation IDs
  expires?: string;     // ISO-8601 date
  revocable?: boolean; // Default: true
  license?: string;     // SPDX identifier or URL
  extensions?: Record<string, unknown>;
}

interface SignedAttestation {
  attestation: Attestation;
  signature: string;    // algorithm:base64-signature
}

type CreatorIdentifier =
  | `hash:sha256:${string}`
  | `pubkey:ed25519:${string}`
  | `pubkey:ecdsa-p256:${string}`
  | `did:${string}`
  | `https://${string}`
  | `email:sha256:${string}`;

JSON Schema

For canonical schema details, see Section 2 of SPEC.md in the repository.

6. Supported Formats

M1 format support in the shipped implementation:

Sidecar Files

For formats that don't support metadata embedding, use sidecar files:

artwork.png
artwork.png.arr    # JSON attestation file

import { writeSidecar, readSidecar } from '@allrightsrespected/sdk';

// Write sidecar
await writeSidecar('./artwork.png', signed);

// Read sidecar
const attestation = await readSidecar('./artwork.png');