Supplier accreditations anyone can check, and you can withdraw.

import {
  SUPPLIER_ACCREDITATION_SCHEMA,
  SUPPLIER_ACCREDITATION_UID,
  encodeAccreditation,
  evidenceHash,
} from '@cryptorail/pack-attestations'

SUPPLIER_ACCREDITATION_SCHEMA
// 'string supplierId,string accreditation,bytes32 evidenceHash'
// revocable, no resolver; the expiry is the attestation's own

SUPPLIER_ACCREDITATION_UID
// keccak256(schema, resolver 0x0, revocable): the same on every chain
// '0xd1f2429d9ded9746094cc4a4b6819260aeea2b7ccb52fdc61eaffeac25daf8ac'

const data = encodeAccreditation({
  supplierId: 'SUP-00042',                 // your internal id, never a name
  accreditation: 'quality-audit-2026',
  evidenceHash: evidenceHash('AUD-2026-0042'),  // the report stays with you
})
// encodeAccreditation({ supplierId: 'Jane Doe', … }) throws:
// what is attested is public for good

# Check EAS and the schema registry against the chain, at the pinned block:
# code hashes of proxy and implementation, version, every selector
node packages/pack-attestations/dist/bin.js verify --network base-sepolia

# Print the attestation policy for the service's configuration
node packages/pack-attestations/dist/bin.js policy --network base-sepolia \
  --approvers <approver id>

# Register EAS and the registry by name, the schema if the chain lacks it,
# the back office's webhook and the Attested and Revoked subscriptions
CRYPTORAIL_API_KEY=<admin key> \
node packages/pack-attestations/dist/bin.js setup --network base-sepolia \
  --url <service URL> --registrar <attester identity id> --webhook <back office URL>
# First run: schema "registered", with its transaction. Any later run: "found";
# nothing is registered twice

import { BASE_SEPOLIA, attestationPolicy } from '@cryptorail/pack-attestations'

const policy = attestationPolicy({
  version: 'accreditations-2026-10',   // recorded with every decision
  network: BASE_SEPOLIA,
  approverIds: [reviewerId],           // who lets a revocation through
})

// What it says, as the rules engine reads it:
// deny   attest, revoke   when request.schema is not ours
// deny   register         unless it is our schema, no resolver, revocable
// deny   raw calls or ether to EAS and the registry
// approve revoke          1 of the reviewers
//
// adapters: { policy: { kind: 'rules', options: policy } }

import { createClient } from '@cryptorail/sdk'
import { attestRequest } from '@cryptorail/pack-attestations'

const cryptorail = createClient({ baseUrl, apiKey })

const { data } = await cryptorail.POST('/v1/transactions', {
  params: { header: { 'idempotency-key': `accreditation-${checkId}` } },
  body: {
    chainId: 84532,                         // Base Sepolia
    actor: { kind: 'identity', identityId: attesterId },  // a key of its own
    target: {
      kind: 'contract',
      contractId: easId,                    // 'pack-eas', registered by the setup
      function: 'attest',
      args: [attestRequest({
        recipient: supplierAddress,         // from your list of suppliers
        expirationTime: validUntil,         // seconds; 0n for never
        accreditation: { supplierId: 'SUP-00042',
          accreditation: 'quality-audit-2026',
          evidenceHash: evidenceHash('AUD-2026-0042') },
      })],
    },
  },
})

// The same key, another schema: refused before anything is signed
{
  "state": "REJECTED_BY_POLICY",
  "failure": {
    "stage": "policy",
    "cause": "policy.operation-denied",
    …
  }
}

// In the back office's webhook endpoint, after verifyWebhook(...) passes
for (const event of JSON.parse(rawBody).events) {
  // event.type: 'contract.event'
  // event.payload: { contractLabel: 'pack-eas',
  //   eventName: 'Attested' | 'Revoked',
  //   params: { recipient, attester, uid, schemaUID }, … }
  // params.uid is the attestation's identifier: store it with the check
}

import { attestationValidity } from '@cryptorail/pack-attestations'

// getAttestation(uid) on EAS through CryptoRail: a read, nothing signed
const { status, accreditation } = await attestationValidity(
  cryptorail, { contractId: easId }, uid, BigInt(Math.floor(Date.now() / 1000)),
)
// status: 'valid' | 'revoked' | 'expired' | 'unknown'
// accreditation: { supplierId, accreditation, evidenceHash }

// Anyone else checks the same record without us, on any node or on
// https://base-sepolia.easscan.org/attestation/view/<uid>

import { revokeRequest } from '@cryptorail/pack-attestations'

const { data } = await cryptorail.POST('/v1/transactions', {
  params: { header: { 'idempotency-key': `withdraw-${checkId}` } },
  body: {
    chainId: 84532,
    actor: { kind: 'identity', identityId: attesterId },
    target: { kind: 'contract', contractId: easId,
      function: 'revoke', args: [revokeRequest(uid)] },
  },
})
// state: PENDING_APPROVAL until a reviewer signs what the decoded call says
// (POST /v1/approvals/{transactionId}/signatures); then CONFIRMED,
// a signed Revoked webhook with the same uid, and the status reads 'revoked'