Prima Evidence — Source Code

Overview

The problem

A document-timestamping service needs client-side hashing so files stay private, a permanent public record, accounts and payments, and an operator console. This source provides a working implementation of each, built for Cloudflare Workers, Flutterwave and Arweave.

What it does

• Client-side SHA-256 hashing in the browser; files are not uploaded.
• Proof records written to Arweave through the Irys bundler, with a direct Arweave transaction as fallback and a circuit breaker around both.
• Public lookup by hash. It reads the backend's own store, not the chain. A separate endpoint checks an Arweave transaction against the service wallet's address.
• Accounts with scrypt password hashing, JWT sessions (jose), optional TOTP two-factor login, and hashed developer API keys for a versioned API.
• Flutterwave payments for single proofs, batches and prepaid credit packs, with a constant-time webhook secret check; a free trial proof; printable certificate pages.
• Admin routes and pages for proofs, users and statistics, plus Resend or SendGrid email and KV-based rate limiting.
• GitHub Actions: CI type-checks and tests the backend, website and agent; the deploy workflow deploys the backend and website.

Value in your own metrics

File confidentiality

Only the hash leaves the browser. The file content never reaches the backend or the chain.

Permanence

Each paid proof becomes a public Arweave record that the operator cannot alter or delete afterwards.

Serverless operation

Backend, uploads and scheduled jobs run on Cloudflare Workers, KV, Durable Objects and Queues, so there are no servers to manage.

Developer access

Proofs can be created through a versioned HTTP API with API keys, or through the Node and Python SDKs.

Assurance and build

Language

TypeScript (strict mode in every TypeScript package) · Python SDK

Frameworks

Hono on Cloudflare Workers · React 18 with Vite · Next.js 15.5.2 via @cloudflare/next-on-pages

Edge runtime

Cloudflare Workers · KV · Durable Objects · Queues · Cron Triggers; D1 for the agent

External services

Flutterwave · Irys and Arweave · Resend or SendGrid · Anthropic API, X and Resend (agent)

Integrity

Client-side SHA-256 · records on Arweave

Tests

Backend: 621 of 621 Vitest cases passing in the Cloudflare Workers pool, run by Vlaander's quality gate on 7 October 2026 and again from the delivered archive on 8 October 2026, with tsc clean. Agent: 323 of 323 passing (Vlaander, 5 October 2026; agent code unchanged since). In the same run, 4 of the Next.js website's pricing tests failed. The React app's unit and Playwright tests are not run by CI and were not re-run by Vlaander. The SDKs have no tests

Internal review

Vlaander quality gate, 7 October 2026: 1 critical and 6 high findings. Fixed in the delivered source (8 October 2026): any successful Flutterwave transaction could mark any proof as paid; credit packs could be bought in a cheaper currency; the Node SDK hashed the wrong bytes. Open: customer emails written permanently to Arweave; a stored cross-site-scripting sink in the website's articles; deploy settings (reported, not reproduced): npm run deploy and the runbook use the development configuration, and CI deploys to a differently named production worker. About 16 medium findings were reported and not fixed.

Releases are not yet cryptographically signed, and no release manifests or external audit summaries are published. Check the source tarball you receive against its SHA-256 in Schedule 1 of your Sale and Assignment Agreement, which you see before you sign.

Scope and maturity

What is real today, what is deliberately excluded, and what is pending — published unprompted.

Who it's for

• Legal technology and intellectual-property services firms adding a timestamping product line.
• Notarisation, registry and records businesses digitising evidentiary services.
• Creative-industry platforms serving authorship and provenance claims.

Before you buy

1. Decide how the proof record should identify a registrant without plain-text email (for example, a salted hash) before any proofs are written.
2. Read Vlaander's review report and confirm the open findings are fixed before launch.
3. Run wrangler deployments list and check the production worker name, vars and prices before any redeploy.
4. Confirm the Arweave and Irys cost per proof and who funds the upload wallet at your projected volume.
5. Establish, with counsel, the evidentiary weight a hash timestamp carries in your target jurisdictions.
6. Review the Flutterwave integration against your payment and acquirer requirements.
7. Review the prima-agent worker before enabling it: auto-approval of posts from the brand X account is on by default, and it ships seed data aimed at the Japanese and Nigerian markets.

What transfers

• The asset's sourceSubject to the Sale and Assignment Agreement, Vlaander assigns to the verified Buyer the transferable right, title and interest that Vlaander owns in the specified Asset. The assignment excludes Third Party Materials, open-source components, Vlaander’s pre-existing tools, generic know-how, development methods, trademarks, confidential information and any rights that cannot lawfully be assigned.
• Its testsThe test suite the published assurance claims rest on, as delivered in the source archive.
• Its audit artefactsSpecifications, model-checking output, reviews and the software bill of materials, where the asset has them.
• Not includedThird-party and open-source materials are not sold or assigned by Vlaander. They remain under their own licences, listed in each asset’s software bill of materials (SBOM.md in the archive), and the Buyer is responsible for complying with those licences.

Sale and ownership terms → Sale and Assignment Agreement →