@orangecheck/lock-device 0.1.0 → 0.2.0

package/README.md

@@ -1,5 +1,9 @@
 # @orangecheck/lock-device
 
+> **Full reference:** [docs.ochk.io/sdk/lock-device](https://docs.ochk.io/sdk/lock-device) — auto-generated from the TypeScript source on every release.
+> Hand-written prose below is the high-level overview; the docs site is the source of truth for every export, type, and signature.
+
+
 Device-key binding and Nostr kind-30078 directory publication helpers for [OC Lock](https://github.com/orangecheck/oc-lock-protocol).
 
 ## Install

package/dist/index.js

@@ -113,18 +113,67 @@ function parseDeviceEvent(event) {
   if (!address || !device_id || !device_pk || !binding_sig) {
     throw new Error("device event missing required tags");
   }
+  const signed = parseBindingStatement(event.content);
+  if (!signed) {
+    throw new Error("device event content is not a v2 bind or revoke statement");
+  }
+  if (signed.address !== address) {
+    throw new Error(
+      `device event addr tag (${address}) does not match the signed statement (${signed.address})`
+    );
+  }
+  if (signed.device_id !== device_id) {
+    throw new Error(
+      `device event device_id tag (${device_id}) does not match the signed statement (${signed.device_id})`
+    );
+  }
+  if (signed.kind === "bind") {
+    if (signed.device_pk !== device_pk) {
+      throw new Error(
+        `device event device_pk tag does not match the signed statement \u2014 tag says ${device_pk}, the signature covers ${signed.device_pk}`
+      );
+    }
+  } else if (device_pk !== "revoked") {
+    throw new Error(
+      `device event carries a revocation statement but its device_pk tag is ${device_pk}, not "revoked"`
+    );
+  }
   return {
-    address,
-    device_id,
-    device_pk,
+    address: signed.address,
+    device_id: signed.device_id,
+    // Take the key from the SIGNED bytes, never the tag.
+    device_pk: signed.kind === "bind" ? signed.device_pk : "revoked",
     bindingStatement: event.content,
     bindingSigBase64: binding_sig,
-    revoked: device_pk === "revoked",
+    revoked: signed.kind === "revoke",
     createdAtUnix: event.created_at,
     nostrPubkey: event.pubkey,
     eventId: event.id
   };
 }
+function parseBindingStatement(content) {
+  const lines = content.split("\n");
+  const header = lines[0];
+  const field = (name) => {
+    const prefix = `${name}: `;
+    for (const l of lines.slice(1)) {
+      if (l.startsWith(prefix)) return l.slice(prefix.length);
+    }
+    return null;
+  };
+  const address = field("address");
+  const device_id = field("device_id");
+  if (!address || !device_id) return null;
+  if (header === `oc-lock:device-bind:${BINDING_VERSION}`) {
+    const device_pk = field("device_pk");
+    if (!device_pk) return null;
+    return { kind: "bind", address, device_pk, device_id };
+  }
+  if (header === `oc-lock:device-revoke:${BINDING_VERSION}`) {
+    return { kind: "revoke", address, device_id };
+  }
+  return null;
+}
 
 exports.BINDING_VERSION = BINDING_VERSION;
 exports.DEVICE_KIND = DEVICE_KIND;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["generateX25519KeyPair","randomBytesN","hexEncode","hkdfSha256","utf8Encode","schnorr","hexDecode","sha256Bytes"],"mappings":";;;;;;AAcO,IAAM,WAAA,GAAc;AACpB,IAAM,eAAA,GAAkB;AASxB,SAAS,iBAAA,GAAmC;AAC/C,EAAA,MAAM,KAAKA,gCAAA,EAAsB;AACjC,EAAA,MAAM,aAAA,GAAgBC,wBAAa,EAAE,CAAA;AACrC,EAAA,OAAO;AAAA,IACH,SAAA,EAAWC,qBAAU,aAAa,CAAA;AAAA,IAClC,SAAA,EAAWA,oBAAA,CAAU,EAAA,CAAG,MAAM,CAAA;AAAA,IAC9B,WAAW,EAAA,CAAG,MAAA;AAAA,IACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,GACvC;AACJ;AAEO,SAAS,sBAAsB,MAAA,EAK3B;AAGP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,uBAAuB,eAAe,CAAA,CAAA;AAAA,IACtC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAEO,SAAS,yBAAyB,MAAA,EAI9B;AACP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,yBAAyB,eAAe,CAAA,CAAA;AAAA,IACxC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAoBO,SAAS,eAAe,QAAA,EAA4D;AACvF,EAAA,MAAM,EAAA,GAAKC,qBAAA;AAAA,IACP,QAAA;AAAA,IACAC,sBAAW,sBAAsB,CAAA;AAAA,IACjCA,sBAAW,UAAU,CAAA;AAAA,IACrB;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAKC,iBAAA,CAAQ,YAAA,CAAa,EAAE,CAAA;AAClC,EAAA,OAAO,EAAE,SAASH,oBAAA,CAAU,EAAE,GAAG,OAAA,EAASA,oBAAA,CAAU,EAAE,CAAA,EAAE;AAC5D;AAOO,SAAS,iBAAiB,MAAA,EAOsC;AACnE,EAAA,MAAM,IAAA,GAAmB;AAAA,IACrB,CAAC,GAAA,EAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IACxC,CAAC,MAAA,EAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,IACvB,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,OAAO,QAAQ,CAAA;AAAA,IAChB,CAAC,aAAA,EAAe,MAAA,CAAO,gBAAgB;AAAA,GAC3C;AACA,EAAA,MAAM,UAAA,GAAa,OAAO,aAAA,IAAiB,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACvE,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,WAAA;AAAA,IACN,IAAA;AAAA,IACA,SAAS,MAAA,CAAO,gBAAA;AAAA,IAChB;AAAA,GACJ;AACJ;AAMO,SAAS,cAAA,CACZ,OACA,UAAA,EACU;AACV,EAAA,MAAM,EAAA,GAAK,oBAAoB,KAAK,CAAA;AACpC,EAAA,MAAM,EAAA,GAAKI,qBAAU,UAAU,CAAA;AAC/B,EAAA,MAAM,MAAMD,iBAAA,CAAQ,IAAA,CAAKC,oBAAA,CAAU,EAAE,GAAG,EAAE,CAAA;AAC1C,EAAA,OAAO;AAAA,IACH,GAAG,KAAA;AAAA,IACH,EAAA;AAAA,IACA,GAAA,EAAKJ,qBAAU,GAAG;AAAA,GACtB;AACJ;AAEO,SAAS,oBAAoB,KAAA,EAA+C;AAG/E,EAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU;AAAA,IAC9B,CAAA;AAAA,IACA,KAAA,CAAM,MAAA;AAAA,IACN,KAAA,CAAM,UAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM;AAAA,GACT,CAAA;AACD,EAAA,OAAOA,oBAAA,CAAUK,sBAAA,CAAYH,qBAAA,CAAW,UAAU,CAAC,CAAC,CAAA;AACxD;AAMO,SAAS,oBAAoB,MAAA,EAQrB;AACX,EAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAQ,GAAI,cAAA,CAAe,OAAO,QAAQ,CAAA;AAC3D,EAAA,MAAM,OAAO,gBAAA,CAAiB;AAAA,IAC1B,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,eAAe,MAAA,CAAO;AAAA,GACzB,CAAA;AACD,EAAA,MAAM,UAAA,GAAa,EAAE,GAAG,IAAA,EAAM,QAAQ,OAAA,EAAQ;AAC9C,EAAA,OAAO,cAAA,CAAe,YAAY,OAAO,CAAA;AAC7C;AAkBO,SAAS,iBAAiB,KAAA,EAAsC;AACnE,EAAA,IAAI,KAAA,CAAM,SAAS,WAAA,EAAa;AAC5B,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAgC;AACzC,IAAA,KAAA,MAAW,CAAA,IAAK,MAAM,IAAA,EAAM;AACxB,MAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,IAAA,IAAQ,CAAA,CAAE,SAAS,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,MAAM,CAAA;AAC1B,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,IAAI,aAAa,CAAA;AACrC,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,aAAa,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AACtD,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AACA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,kBAAkB,KAAA,CAAM,OAAA;AAAA,IACxB,gBAAA,EAAkB,WAAA;AAAA,IAClB,SAAS,SAAA,KAAc,SAAA;AAAA,IACvB,eAAe,KAAA,CAAM,UAAA;AAAA,IACrB,aAAa,KAAA,CAAM,MAAA;AAAA,IACnB,SAAS,KAAA,CAAM;AAAA,GACnB;AACJ","file":"index.js","sourcesContent":["// Device key binding and Nostr directory publication.\n// See SPEC.md §3.\n\nimport { schnorr } from '@noble/curves/secp256k1';\nimport {\n    generateX25519KeyPair,\n    hexDecode,\n    hexEncode,\n    hkdfSha256,\n    randomBytesN,\n    sha256Bytes,\n    utf8Encode,\n} from '@orangecheck/lock-crypto';\n\nexport const DEVICE_KIND = 30078;\nexport const BINDING_VERSION = 'v2';\n\nexport interface DeviceKeyPair {\n    device_id: string;\n    device_pk: string; // 32-byte hex\n    device_sk: Uint8Array; // 32 bytes\n    created_at: string; // iso8601\n}\n\nexport function generateDeviceKey(): DeviceKeyPair {\n    const kp = generateX25519KeyPair();\n    const deviceIdBytes = randomBytesN(16);\n    return {\n        device_id: hexEncode(deviceIdBytes),\n        device_pk: hexEncode(kp.public),\n        device_sk: kp.secret,\n        created_at: new Date().toISOString(),\n    };\n}\n\nexport function buildBindingStatement(params: {\n    address: string;\n    device_pk: string;\n    device_id: string;\n    created_at: string;\n}): string {\n    // Exact byte layout per SPEC §3.2. Each line ends with LF; no trailing LF\n    // beyond the last field's. Order is fixed.\n    const lines = [\n        `oc-lock:device-bind:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_pk: ${params.device_pk}`,\n        `device_id: ${params.device_id}`,\n        `created_at: ${params.created_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\nexport function buildRevocationStatement(params: {\n    address: string;\n    device_id: string;\n    revoked_at: string;\n}): string {\n    const lines = [\n        `oc-lock:device-revoke:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_id: ${params.device_id}`,\n        `revoked_at: ${params.revoked_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\n// ---------------------------------------------------------------------------\n// Nostr event helpers\n// ---------------------------------------------------------------------------\n\nexport interface NostrEvent {\n    id: string;\n    pubkey: string;\n    created_at: number;\n    kind: number;\n    tags: string[][];\n    content: string;\n    sig: string;\n}\n\n/**\n * Derive an ephemeral Nostr keypair from a device secret per SPEC §3.4.\n * Returns a 32-byte private key (hex).\n */\nexport function deriveNostrKey(deviceSk: Uint8Array): { nostrSk: string; nostrPk: string } {\n    const sk = hkdfSha256(\n        deviceSk,\n        utf8Encode('oc-lock/v2/nostr-key'),\n        utf8Encode('nostr-sk'),\n        32\n    );\n    const pk = schnorr.getPublicKey(sk);\n    return { nostrSk: hexEncode(sk), nostrPk: hexEncode(pk) };\n}\n\n/**\n * Build a kind-30078 addressable event announcing a device binding.\n * The caller must supply the BIP-322 signature produced by the user's Bitcoin\n * wallet (we cannot sign BIP-322 in this package — that requires a wallet).\n */\nexport function buildDeviceEvent(params: {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined } {\n    const tags: string[][] = [\n        ['d', `oc-lock:device:${params.address}`],\n        ['addr', params.address],\n        ['device_id', params.device_id],\n        ['device_pk', params.device_pk],\n        ['alg', 'x25519'],\n        ['binding_sig', params.bindingSigBase64],\n    ];\n    const created_at = params.createdAtUnix ?? Math.floor(Date.now() / 1000);\n    return {\n        kind: DEVICE_KIND,\n        tags,\n        content: params.bindingStatement,\n        created_at,\n    } as unknown as Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined };\n}\n\n/**\n * Sign a Nostr event with a Schnorr key (derived via deriveNostrKey). Produces\n * the full NostrEvent with id and sig.\n */\nexport function signNostrEvent(\n    event: Omit<NostrEvent, 'id' | 'sig'>,\n    nostrSkHex: string\n): NostrEvent {\n    const id = computeNostrEventId(event);\n    const sk = hexDecode(nostrSkHex);\n    const sig = schnorr.sign(hexDecode(id), sk);\n    return {\n        ...event,\n        id,\n        sig: hexEncode(sig),\n    };\n}\n\nexport function computeNostrEventId(event: Omit<NostrEvent, 'id' | 'sig'>): string {\n    // Per NIP-01: id = sha256(utf8(JSON.stringify([0, pubkey, created_at, kind, tags, content]))).\n    // The array must be serialized in *exactly* this form with no whitespace.\n    const serialized = JSON.stringify([\n        0,\n        event.pubkey,\n        event.created_at,\n        event.kind,\n        event.tags,\n        event.content,\n    ]);\n    return hexEncode(sha256Bytes(utf8Encode(serialized)));\n}\n\n/**\n * Finalize a device event: derive Nostr key from device_sk, attach pubkey,\n * compute id, sign. Returns a fully-signed NIP-01 event ready to publish.\n */\nexport function finalizeDeviceEvent(params: {\n    deviceSk: Uint8Array;\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): NostrEvent {\n    const { nostrSk, nostrPk } = deriveNostrKey(params.deviceSk);\n    const base = buildDeviceEvent({\n        address: params.address,\n        device_id: params.device_id,\n        device_pk: params.device_pk,\n        bindingStatement: params.bindingStatement,\n        bindingSigBase64: params.bindingSigBase64,\n        createdAtUnix: params.createdAtUnix,\n    });\n    const withPubkey = { ...base, pubkey: nostrPk } as Omit<NostrEvent, 'id' | 'sig'>;\n    return signNostrEvent(withPubkey, nostrSk);\n}\n\n// ---------------------------------------------------------------------------\n// Parsing\n// ---------------------------------------------------------------------------\n\nexport interface ParsedDeviceEvent {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    revoked: boolean;\n    createdAtUnix: number;\n    nostrPubkey: string;\n    eventId: string;\n}\n\nexport function parseDeviceEvent(event: NostrEvent): ParsedDeviceEvent {\n    if (event.kind !== DEVICE_KIND) {\n        throw new Error('not a device event (kind mismatch)');\n    }\n    const tag = (name: string): string | null => {\n        for (const t of event.tags) {\n            if (t[0] === name && t.length > 1) return t[1] ?? null;\n        }\n        return null;\n    };\n    const address = tag('addr');\n    const device_id = tag('device_id');\n    const device_pk = tag('device_pk');\n    const binding_sig = tag('binding_sig');\n    if (!address || !device_id || !device_pk || !binding_sig) {\n        throw new Error('device event missing required tags');\n    }\n    return {\n        address,\n        device_id,\n        device_pk,\n        bindingStatement: event.content,\n        bindingSigBase64: binding_sig,\n        revoked: device_pk === 'revoked',\n        createdAtUnix: event.created_at,\n        nostrPubkey: event.pubkey,\n        eventId: event.id,\n    };\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["generateX25519KeyPair","randomBytesN","hexEncode","hkdfSha256","utf8Encode","schnorr","hexDecode","sha256Bytes"],"mappings":";;;;;;AAcO,IAAM,WAAA,GAAc;AACpB,IAAM,eAAA,GAAkB;AASxB,SAAS,iBAAA,GAAmC;AAC/C,EAAA,MAAM,KAAKA,gCAAA,EAAsB;AACjC,EAAA,MAAM,aAAA,GAAgBC,wBAAa,EAAE,CAAA;AACrC,EAAA,OAAO;AAAA,IACH,SAAA,EAAWC,qBAAU,aAAa,CAAA;AAAA,IAClC,SAAA,EAAWA,oBAAA,CAAU,EAAA,CAAG,MAAM,CAAA;AAAA,IAC9B,WAAW,EAAA,CAAG,MAAA;AAAA,IACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,GACvC;AACJ;AAEO,SAAS,sBAAsB,MAAA,EAK3B;AAGP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,uBAAuB,eAAe,CAAA,CAAA;AAAA,IACtC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAEO,SAAS,yBAAyB,MAAA,EAI9B;AACP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,yBAAyB,eAAe,CAAA,CAAA;AAAA,IACxC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAoBO,SAAS,eAAe,QAAA,EAA4D;AACvF,EAAA,MAAM,EAAA,GAAKC,qBAAA;AAAA,IACP,QAAA;AAAA,IACAC,sBAAW,sBAAsB,CAAA;AAAA,IACjCA,sBAAW,UAAU,CAAA;AAAA,IACrB;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAKC,iBAAA,CAAQ,YAAA,CAAa,EAAE,CAAA;AAClC,EAAA,OAAO,EAAE,SAASH,oBAAA,CAAU,EAAE,GAAG,OAAA,EAASA,oBAAA,CAAU,EAAE,CAAA,EAAE;AAC5D;AAOO,SAAS,iBAAiB,MAAA,EAOsC;AACnE,EAAA,MAAM,IAAA,GAAmB;AAAA,IACrB,CAAC,GAAA,EAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IACxC,CAAC,MAAA,EAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,IACvB,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,OAAO,QAAQ,CAAA;AAAA,IAChB,CAAC,aAAA,EAAe,MAAA,CAAO,gBAAgB;AAAA,GAC3C;AACA,EAAA,MAAM,UAAA,GAAa,OAAO,aAAA,IAAiB,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACvE,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,WAAA;AAAA,IACN,IAAA;AAAA,IACA,SAAS,MAAA,CAAO,gBAAA;AAAA,IAChB;AAAA,GACJ;AACJ;AAMO,SAAS,cAAA,CACZ,OACA,UAAA,EACU;AACV,EAAA,MAAM,EAAA,GAAK,oBAAoB,KAAK,CAAA;AACpC,EAAA,MAAM,EAAA,GAAKI,qBAAU,UAAU,CAAA;AAC/B,EAAA,MAAM,MAAMD,iBAAA,CAAQ,IAAA,CAAKC,oBAAA,CAAU,EAAE,GAAG,EAAE,CAAA;AAC1C,EAAA,OAAO;AAAA,IACH,GAAG,KAAA;AAAA,IACH,EAAA;AAAA,IACA,GAAA,EAAKJ,qBAAU,GAAG;AAAA,GACtB;AACJ;AAEO,SAAS,oBAAoB,KAAA,EAA+C;AAG/E,EAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU;AAAA,IAC9B,CAAA;AAAA,IACA,KAAA,CAAM,MAAA;AAAA,IACN,KAAA,CAAM,UAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM;AAAA,GACT,CAAA;AACD,EAAA,OAAOA,oBAAA,CAAUK,sBAAA,CAAYH,qBAAA,CAAW,UAAU,CAAC,CAAC,CAAA;AACxD;AAMO,SAAS,oBAAoB,MAAA,EAQrB;AACX,EAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAQ,GAAI,cAAA,CAAe,OAAO,QAAQ,CAAA;AAC3D,EAAA,MAAM,OAAO,gBAAA,CAAiB;AAAA,IAC1B,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,eAAe,MAAA,CAAO;AAAA,GACzB,CAAA;AACD,EAAA,MAAM,UAAA,GAAa,EAAE,GAAG,IAAA,EAAM,QAAQ,OAAA,EAAQ;AAC9C,EAAA,OAAO,cAAA,CAAe,YAAY,OAAO,CAAA;AAC7C;AAkBO,SAAS,iBAAiB,KAAA,EAAsC;AACnE,EAAA,IAAI,KAAA,CAAM,SAAS,WAAA,EAAa;AAC5B,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAgC;AACzC,IAAA,KAAA,MAAW,CAAA,IAAK,MAAM,IAAA,EAAM;AACxB,MAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,IAAA,IAAQ,CAAA,CAAE,SAAS,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,MAAM,CAAA;AAC1B,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,IAAI,aAAa,CAAA;AACrC,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,aAAa,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AACtD,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AAeA,EAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,KAAA,CAAM,OAAO,CAAA;AAClD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,MAAA,CAAO,YAAY,OAAA,EAAS;AAC5B,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,uBAAA,EAA0B,OAAO,CAAA,uCAAA,EAA0C,MAAA,CAAO,OAAO,CAAA,CAAA;AAAA,KAC7F;AAAA,EACJ;AACA,EAAA,IAAI,MAAA,CAAO,cAAc,SAAA,EAAW;AAChC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,4BAAA,EAA+B,SAAS,CAAA,uCAAA,EAA0C,MAAA,CAAO,SAAS,CAAA,CAAA;AAAA,KACtG;AAAA,EACJ;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ;AACxB,IAAA,IAAI,MAAA,CAAO,cAAc,SAAA,EAAW;AAChC,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,+EAAA,EACgB,SAAS,CAAA,uBAAA,EAA0B,MAAA,CAAO,SAAS,CAAA;AAAA,OACvE;AAAA,IACJ;AAAA,EACJ,CAAA,MAAA,IAAW,cAAc,SAAA,EAAW;AAChC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,wEAAwE,SAAS,CAAA,eAAA;AAAA,KACrF;AAAA,EACJ;AAEA,EAAA,OAAO;AAAA,IACH,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,WAAW,MAAA,CAAO,SAAA;AAAA;AAAA,IAElB,SAAA,EAAW,MAAA,CAAO,IAAA,KAAS,MAAA,GAAS,OAAO,SAAA,GAAY,SAAA;AAAA,IACvD,kBAAkB,KAAA,CAAM,OAAA;AAAA,IACxB,gBAAA,EAAkB,WAAA;AAAA,IAClB,OAAA,EAAS,OAAO,IAAA,KAAS,QAAA;AAAA,IACzB,eAAe,KAAA,CAAM,UAAA;AAAA,IACrB,aAAa,KAAA,CAAM,MAAA;AAAA,IACnB,SAAS,KAAA,CAAM;AAAA,GACnB;AACJ;AAOA,SAAS,sBACL,OAAA,EAIO;AACP,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,MAAM,CAAC,CAAA;AACtB,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAgC;AAC3C,IAAA,MAAM,MAAA,GAAS,GAAG,IAAI,CAAA,EAAA,CAAA;AACtB,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,EAAG;AAC5B,MAAA,IAAI,CAAA,CAAE,WAAW,MAAM,CAAA,SAAU,CAAA,CAAE,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,SAAS,CAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,EAAW,OAAO,IAAA;AAEnC,EAAA,IAAI,MAAA,KAAW,CAAA,oBAAA,EAAuB,eAAe,CAAA,CAAA,EAAI;AACrD,IAAA,MAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AACnC,IAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,WAAW,SAAA,EAAU;AAAA,EACzD;AACA,EAAA,IAAI,MAAA,KAAW,CAAA,sBAAA,EAAyB,eAAe,CAAA,CAAA,EAAI;AACvD,IAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,SAAA,EAAU;AAAA,EAChD;AACA,EAAA,OAAO,IAAA;AACX","file":"index.js","sourcesContent":["// Device key binding and Nostr directory publication.\n// See SPEC.md §3.\n\nimport { schnorr } from '@noble/curves/secp256k1';\nimport {\n    generateX25519KeyPair,\n    hexDecode,\n    hexEncode,\n    hkdfSha256,\n    randomBytesN,\n    sha256Bytes,\n    utf8Encode,\n} from '@orangecheck/lock-crypto';\n\nexport const DEVICE_KIND = 30078;\nexport const BINDING_VERSION = 'v2';\n\nexport interface DeviceKeyPair {\n    device_id: string;\n    device_pk: string; // 32-byte hex\n    device_sk: Uint8Array; // 32 bytes\n    created_at: string; // iso8601\n}\n\nexport function generateDeviceKey(): DeviceKeyPair {\n    const kp = generateX25519KeyPair();\n    const deviceIdBytes = randomBytesN(16);\n    return {\n        device_id: hexEncode(deviceIdBytes),\n        device_pk: hexEncode(kp.public),\n        device_sk: kp.secret,\n        created_at: new Date().toISOString(),\n    };\n}\n\nexport function buildBindingStatement(params: {\n    address: string;\n    device_pk: string;\n    device_id: string;\n    created_at: string;\n}): string {\n    // Exact byte layout per SPEC §3.2. Each line ends with LF; no trailing LF\n    // beyond the last field's. Order is fixed.\n    const lines = [\n        `oc-lock:device-bind:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_pk: ${params.device_pk}`,\n        `device_id: ${params.device_id}`,\n        `created_at: ${params.created_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\nexport function buildRevocationStatement(params: {\n    address: string;\n    device_id: string;\n    revoked_at: string;\n}): string {\n    const lines = [\n        `oc-lock:device-revoke:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_id: ${params.device_id}`,\n        `revoked_at: ${params.revoked_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\n// ---------------------------------------------------------------------------\n// Nostr event helpers\n// ---------------------------------------------------------------------------\n\nexport interface NostrEvent {\n    id: string;\n    pubkey: string;\n    created_at: number;\n    kind: number;\n    tags: string[][];\n    content: string;\n    sig: string;\n}\n\n/**\n * Derive an ephemeral Nostr keypair from a device secret per SPEC §3.4.\n * Returns a 32-byte private key (hex).\n */\nexport function deriveNostrKey(deviceSk: Uint8Array): { nostrSk: string; nostrPk: string } {\n    const sk = hkdfSha256(\n        deviceSk,\n        utf8Encode('oc-lock/v2/nostr-key'),\n        utf8Encode('nostr-sk'),\n        32\n    );\n    const pk = schnorr.getPublicKey(sk);\n    return { nostrSk: hexEncode(sk), nostrPk: hexEncode(pk) };\n}\n\n/**\n * Build a kind-30078 addressable event announcing a device binding.\n * The caller must supply the BIP-322 signature produced by the user's Bitcoin\n * wallet (we cannot sign BIP-322 in this package — that requires a wallet).\n */\nexport function buildDeviceEvent(params: {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined } {\n    const tags: string[][] = [\n        ['d', `oc-lock:device:${params.address}`],\n        ['addr', params.address],\n        ['device_id', params.device_id],\n        ['device_pk', params.device_pk],\n        ['alg', 'x25519'],\n        ['binding_sig', params.bindingSigBase64],\n    ];\n    const created_at = params.createdAtUnix ?? Math.floor(Date.now() / 1000);\n    return {\n        kind: DEVICE_KIND,\n        tags,\n        content: params.bindingStatement,\n        created_at,\n    } as unknown as Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined };\n}\n\n/**\n * Sign a Nostr event with a Schnorr key (derived via deriveNostrKey). Produces\n * the full NostrEvent with id and sig.\n */\nexport function signNostrEvent(\n    event: Omit<NostrEvent, 'id' | 'sig'>,\n    nostrSkHex: string\n): NostrEvent {\n    const id = computeNostrEventId(event);\n    const sk = hexDecode(nostrSkHex);\n    const sig = schnorr.sign(hexDecode(id), sk);\n    return {\n        ...event,\n        id,\n        sig: hexEncode(sig),\n    };\n}\n\nexport function computeNostrEventId(event: Omit<NostrEvent, 'id' | 'sig'>): string {\n    // Per NIP-01: id = sha256(utf8(JSON.stringify([0, pubkey, created_at, kind, tags, content]))).\n    // The array must be serialized in *exactly* this form with no whitespace.\n    const serialized = JSON.stringify([\n        0,\n        event.pubkey,\n        event.created_at,\n        event.kind,\n        event.tags,\n        event.content,\n    ]);\n    return hexEncode(sha256Bytes(utf8Encode(serialized)));\n}\n\n/**\n * Finalize a device event: derive Nostr key from device_sk, attach pubkey,\n * compute id, sign. Returns a fully-signed NIP-01 event ready to publish.\n */\nexport function finalizeDeviceEvent(params: {\n    deviceSk: Uint8Array;\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): NostrEvent {\n    const { nostrSk, nostrPk } = deriveNostrKey(params.deviceSk);\n    const base = buildDeviceEvent({\n        address: params.address,\n        device_id: params.device_id,\n        device_pk: params.device_pk,\n        bindingStatement: params.bindingStatement,\n        bindingSigBase64: params.bindingSigBase64,\n        createdAtUnix: params.createdAtUnix,\n    });\n    const withPubkey = { ...base, pubkey: nostrPk } as Omit<NostrEvent, 'id' | 'sig'>;\n    return signNostrEvent(withPubkey, nostrSk);\n}\n\n// ---------------------------------------------------------------------------\n// Parsing\n// ---------------------------------------------------------------------------\n\nexport interface ParsedDeviceEvent {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    revoked: boolean;\n    createdAtUnix: number;\n    nostrPubkey: string;\n    eventId: string;\n}\n\nexport function parseDeviceEvent(event: NostrEvent): ParsedDeviceEvent {\n    if (event.kind !== DEVICE_KIND) {\n        throw new Error('not a device event (kind mismatch)');\n    }\n    const tag = (name: string): string | null => {\n        for (const t of event.tags) {\n            if (t[0] === name && t.length > 1) return t[1] ?? null;\n        }\n        return null;\n    };\n    const address = tag('addr');\n    const device_id = tag('device_id');\n    const device_pk = tag('device_pk');\n    const binding_sig = tag('binding_sig');\n    if (!address || !device_id || !device_pk || !binding_sig) {\n        throw new Error('device event missing required tags');\n    }\n\n    // The BIP-322 signature covers `event.content` — the statement — and nothing\n    // else. Tags are an index the relay lets anyone write, so a value read from a\n    // tag has been authenticated by nobody.\n    //\n    // Skipping this check was a total confidentiality break, and it needed no key\n    // material: republish a victim's device event with their real content and\n    // real binding_sig, change only the `device_pk` TAG to your own X25519 key.\n    // verifyBip322(content, sig, addr) passes — every signed byte is genuine —\n    // and the sender then seals the content key to the attacker's key, because\n    // the recipient record was built from the tag. Proven against the published\n    // package before this existed.\n    //\n    // So the statement is the source of truth and the tags must agree with it.\n    const signed = parseBindingStatement(event.content);\n    if (!signed) {\n        throw new Error('device event content is not a v2 bind or revoke statement');\n    }\n    if (signed.address !== address) {\n        throw new Error(\n            `device event addr tag (${address}) does not match the signed statement (${signed.address})`,\n        );\n    }\n    if (signed.device_id !== device_id) {\n        throw new Error(\n            `device event device_id tag (${device_id}) does not match the signed statement (${signed.device_id})`,\n        );\n    }\n    if (signed.kind === 'bind') {\n        if (signed.device_pk !== device_pk) {\n            throw new Error(\n                `device event device_pk tag does not match the signed statement — ` +\n                    `tag says ${device_pk}, the signature covers ${signed.device_pk}`,\n            );\n        }\n    } else if (device_pk !== 'revoked') {\n        throw new Error(\n            `device event carries a revocation statement but its device_pk tag is ${device_pk}, not \"revoked\"`,\n        );\n    }\n\n    return {\n        address: signed.address,\n        device_id: signed.device_id,\n        // Take the key from the SIGNED bytes, never the tag.\n        device_pk: signed.kind === 'bind' ? signed.device_pk : 'revoked',\n        bindingStatement: event.content,\n        bindingSigBase64: binding_sig,\n        revoked: signed.kind === 'revoke',\n        createdAtUnix: event.created_at,\n        nostrPubkey: event.pubkey,\n        eventId: event.id,\n    };\n}\n\n/**\n * Read back the fields the signature actually commits to. Returns null for\n * anything that is not a well-formed v2 bind/revoke statement, which the caller\n * treats as an unusable record.\n */\nfunction parseBindingStatement(\n    content: string,\n):\n    | { kind: 'bind'; address: string; device_pk: string; device_id: string }\n    | { kind: 'revoke'; address: string; device_id: string }\n    | null {\n    const lines = content.split('\\n');\n    const header = lines[0];\n    const field = (name: string): string | null => {\n        const prefix = `${name}: `;\n        for (const l of lines.slice(1)) {\n            if (l.startsWith(prefix)) return l.slice(prefix.length);\n        }\n        return null;\n    };\n    const address = field('address');\n    const device_id = field('device_id');\n    if (!address || !device_id) return null;\n\n    if (header === `oc-lock:device-bind:${BINDING_VERSION}`) {\n        const device_pk = field('device_pk');\n        if (!device_pk) return null;\n        return { kind: 'bind', address, device_pk, device_id };\n    }\n    if (header === `oc-lock:device-revoke:${BINDING_VERSION}`) {\n        return { kind: 'revoke', address, device_id };\n    }\n    return null;\n}\n"]}

package/dist/index.mjs

@@ -111,18 +111,67 @@ function parseDeviceEvent(event) {
   if (!address || !device_id || !device_pk || !binding_sig) {
     throw new Error("device event missing required tags");
   }
+  const signed = parseBindingStatement(event.content);
+  if (!signed) {
+    throw new Error("device event content is not a v2 bind or revoke statement");
+  }
+  if (signed.address !== address) {
+    throw new Error(
+      `device event addr tag (${address}) does not match the signed statement (${signed.address})`
+    );
+  }
+  if (signed.device_id !== device_id) {
+    throw new Error(
+      `device event device_id tag (${device_id}) does not match the signed statement (${signed.device_id})`
+    );
+  }
+  if (signed.kind === "bind") {
+    if (signed.device_pk !== device_pk) {
+      throw new Error(
+        `device event device_pk tag does not match the signed statement \u2014 tag says ${device_pk}, the signature covers ${signed.device_pk}`
+      );
+    }
+  } else if (device_pk !== "revoked") {
+    throw new Error(
+      `device event carries a revocation statement but its device_pk tag is ${device_pk}, not "revoked"`
+    );
+  }
   return {
-    address,
-    device_id,
-    device_pk,
+    address: signed.address,
+    device_id: signed.device_id,
+    // Take the key from the SIGNED bytes, never the tag.
+    device_pk: signed.kind === "bind" ? signed.device_pk : "revoked",
     bindingStatement: event.content,
     bindingSigBase64: binding_sig,
-    revoked: device_pk === "revoked",
+    revoked: signed.kind === "revoke",
     createdAtUnix: event.created_at,
     nostrPubkey: event.pubkey,
     eventId: event.id
   };
 }
+function parseBindingStatement(content) {
+  const lines = content.split("\n");
+  const header = lines[0];
+  const field = (name) => {
+    const prefix = `${name}: `;
+    for (const l of lines.slice(1)) {
+      if (l.startsWith(prefix)) return l.slice(prefix.length);
+    }
+    return null;
+  };
+  const address = field("address");
+  const device_id = field("device_id");
+  if (!address || !device_id) return null;
+  if (header === `oc-lock:device-bind:${BINDING_VERSION}`) {
+    const device_pk = field("device_pk");
+    if (!device_pk) return null;
+    return { kind: "bind", address, device_pk, device_id };
+  }
+  if (header === `oc-lock:device-revoke:${BINDING_VERSION}`) {
+    return { kind: "revoke", address, device_id };
+  }
+  return null;
+}
 
 export { BINDING_VERSION, DEVICE_KIND, buildBindingStatement, buildDeviceEvent, buildRevocationStatement, computeNostrEventId, deriveNostrKey, finalizeDeviceEvent, generateDeviceKey, parseDeviceEvent, signNostrEvent };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;AAcO,IAAM,WAAA,GAAc;AACpB,IAAM,eAAA,GAAkB;AASxB,SAAS,iBAAA,GAAmC;AAC/C,EAAA,MAAM,KAAK,qBAAA,EAAsB;AACjC,EAAA,MAAM,aAAA,GAAgB,aAAa,EAAE,CAAA;AACrC,EAAA,OAAO;AAAA,IACH,SAAA,EAAW,UAAU,aAAa,CAAA;AAAA,IAClC,SAAA,EAAW,SAAA,CAAU,EAAA,CAAG,MAAM,CAAA;AAAA,IAC9B,WAAW,EAAA,CAAG,MAAA;AAAA,IACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,GACvC;AACJ;AAEO,SAAS,sBAAsB,MAAA,EAK3B;AAGP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,uBAAuB,eAAe,CAAA,CAAA;AAAA,IACtC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAEO,SAAS,yBAAyB,MAAA,EAI9B;AACP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,yBAAyB,eAAe,CAAA,CAAA;AAAA,IACxC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAoBO,SAAS,eAAe,QAAA,EAA4D;AACvF,EAAA,MAAM,EAAA,GAAK,UAAA;AAAA,IACP,QAAA;AAAA,IACA,WAAW,sBAAsB,CAAA;AAAA,IACjC,WAAW,UAAU,CAAA;AAAA,IACrB;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,YAAA,CAAa,EAAE,CAAA;AAClC,EAAA,OAAO,EAAE,SAAS,SAAA,CAAU,EAAE,GAAG,OAAA,EAAS,SAAA,CAAU,EAAE,CAAA,EAAE;AAC5D;AAOO,SAAS,iBAAiB,MAAA,EAOsC;AACnE,EAAA,MAAM,IAAA,GAAmB;AAAA,IACrB,CAAC,GAAA,EAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IACxC,CAAC,MAAA,EAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,IACvB,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,OAAO,QAAQ,CAAA;AAAA,IAChB,CAAC,aAAA,EAAe,MAAA,CAAO,gBAAgB;AAAA,GAC3C;AACA,EAAA,MAAM,UAAA,GAAa,OAAO,aAAA,IAAiB,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACvE,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,WAAA;AAAA,IACN,IAAA;AAAA,IACA,SAAS,MAAA,CAAO,gBAAA;AAAA,IAChB;AAAA,GACJ;AACJ;AAMO,SAAS,cAAA,CACZ,OACA,UAAA,EACU;AACV,EAAA,MAAM,EAAA,GAAK,oBAAoB,KAAK,CAAA;AACpC,EAAA,MAAM,EAAA,GAAK,UAAU,UAAU,CAAA;AAC/B,EAAA,MAAM,MAAM,OAAA,CAAQ,IAAA,CAAK,SAAA,CAAU,EAAE,GAAG,EAAE,CAAA;AAC1C,EAAA,OAAO;AAAA,IACH,GAAG,KAAA;AAAA,IACH,EAAA;AAAA,IACA,GAAA,EAAK,UAAU,GAAG;AAAA,GACtB;AACJ;AAEO,SAAS,oBAAoB,KAAA,EAA+C;AAG/E,EAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU;AAAA,IAC9B,CAAA;AAAA,IACA,KAAA,CAAM,MAAA;AAAA,IACN,KAAA,CAAM,UAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM;AAAA,GACT,CAAA;AACD,EAAA,OAAO,SAAA,CAAU,WAAA,CAAY,UAAA,CAAW,UAAU,CAAC,CAAC,CAAA;AACxD;AAMO,SAAS,oBAAoB,MAAA,EAQrB;AACX,EAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAQ,GAAI,cAAA,CAAe,OAAO,QAAQ,CAAA;AAC3D,EAAA,MAAM,OAAO,gBAAA,CAAiB;AAAA,IAC1B,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,eAAe,MAAA,CAAO;AAAA,GACzB,CAAA;AACD,EAAA,MAAM,UAAA,GAAa,EAAE,GAAG,IAAA,EAAM,QAAQ,OAAA,EAAQ;AAC9C,EAAA,OAAO,cAAA,CAAe,YAAY,OAAO,CAAA;AAC7C;AAkBO,SAAS,iBAAiB,KAAA,EAAsC;AACnE,EAAA,IAAI,KAAA,CAAM,SAAS,WAAA,EAAa;AAC5B,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAgC;AACzC,IAAA,KAAA,MAAW,CAAA,IAAK,MAAM,IAAA,EAAM;AACxB,MAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,IAAA,IAAQ,CAAA,CAAE,SAAS,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,MAAM,CAAA;AAC1B,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,IAAI,aAAa,CAAA;AACrC,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,aAAa,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AACtD,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AACA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,kBAAkB,KAAA,CAAM,OAAA;AAAA,IACxB,gBAAA,EAAkB,WAAA;AAAA,IAClB,SAAS,SAAA,KAAc,SAAA;AAAA,IACvB,eAAe,KAAA,CAAM,UAAA;AAAA,IACrB,aAAa,KAAA,CAAM,MAAA;AAAA,IACnB,SAAS,KAAA,CAAM;AAAA,GACnB;AACJ","file":"index.mjs","sourcesContent":["// Device key binding and Nostr directory publication.\n// See SPEC.md §3.\n\nimport { schnorr } from '@noble/curves/secp256k1';\nimport {\n    generateX25519KeyPair,\n    hexDecode,\n    hexEncode,\n    hkdfSha256,\n    randomBytesN,\n    sha256Bytes,\n    utf8Encode,\n} from '@orangecheck/lock-crypto';\n\nexport const DEVICE_KIND = 30078;\nexport const BINDING_VERSION = 'v2';\n\nexport interface DeviceKeyPair {\n    device_id: string;\n    device_pk: string; // 32-byte hex\n    device_sk: Uint8Array; // 32 bytes\n    created_at: string; // iso8601\n}\n\nexport function generateDeviceKey(): DeviceKeyPair {\n    const kp = generateX25519KeyPair();\n    const deviceIdBytes = randomBytesN(16);\n    return {\n        device_id: hexEncode(deviceIdBytes),\n        device_pk: hexEncode(kp.public),\n        device_sk: kp.secret,\n        created_at: new Date().toISOString(),\n    };\n}\n\nexport function buildBindingStatement(params: {\n    address: string;\n    device_pk: string;\n    device_id: string;\n    created_at: string;\n}): string {\n    // Exact byte layout per SPEC §3.2. Each line ends with LF; no trailing LF\n    // beyond the last field's. Order is fixed.\n    const lines = [\n        `oc-lock:device-bind:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_pk: ${params.device_pk}`,\n        `device_id: ${params.device_id}`,\n        `created_at: ${params.created_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\nexport function buildRevocationStatement(params: {\n    address: string;\n    device_id: string;\n    revoked_at: string;\n}): string {\n    const lines = [\n        `oc-lock:device-revoke:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_id: ${params.device_id}`,\n        `revoked_at: ${params.revoked_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\n// ---------------------------------------------------------------------------\n// Nostr event helpers\n// ---------------------------------------------------------------------------\n\nexport interface NostrEvent {\n    id: string;\n    pubkey: string;\n    created_at: number;\n    kind: number;\n    tags: string[][];\n    content: string;\n    sig: string;\n}\n\n/**\n * Derive an ephemeral Nostr keypair from a device secret per SPEC §3.4.\n * Returns a 32-byte private key (hex).\n */\nexport function deriveNostrKey(deviceSk: Uint8Array): { nostrSk: string; nostrPk: string } {\n    const sk = hkdfSha256(\n        deviceSk,\n        utf8Encode('oc-lock/v2/nostr-key'),\n        utf8Encode('nostr-sk'),\n        32\n    );\n    const pk = schnorr.getPublicKey(sk);\n    return { nostrSk: hexEncode(sk), nostrPk: hexEncode(pk) };\n}\n\n/**\n * Build a kind-30078 addressable event announcing a device binding.\n * The caller must supply the BIP-322 signature produced by the user's Bitcoin\n * wallet (we cannot sign BIP-322 in this package — that requires a wallet).\n */\nexport function buildDeviceEvent(params: {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined } {\n    const tags: string[][] = [\n        ['d', `oc-lock:device:${params.address}`],\n        ['addr', params.address],\n        ['device_id', params.device_id],\n        ['device_pk', params.device_pk],\n        ['alg', 'x25519'],\n        ['binding_sig', params.bindingSigBase64],\n    ];\n    const created_at = params.createdAtUnix ?? Math.floor(Date.now() / 1000);\n    return {\n        kind: DEVICE_KIND,\n        tags,\n        content: params.bindingStatement,\n        created_at,\n    } as unknown as Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined };\n}\n\n/**\n * Sign a Nostr event with a Schnorr key (derived via deriveNostrKey). Produces\n * the full NostrEvent with id and sig.\n */\nexport function signNostrEvent(\n    event: Omit<NostrEvent, 'id' | 'sig'>,\n    nostrSkHex: string\n): NostrEvent {\n    const id = computeNostrEventId(event);\n    const sk = hexDecode(nostrSkHex);\n    const sig = schnorr.sign(hexDecode(id), sk);\n    return {\n        ...event,\n        id,\n        sig: hexEncode(sig),\n    };\n}\n\nexport function computeNostrEventId(event: Omit<NostrEvent, 'id' | 'sig'>): string {\n    // Per NIP-01: id = sha256(utf8(JSON.stringify([0, pubkey, created_at, kind, tags, content]))).\n    // The array must be serialized in *exactly* this form with no whitespace.\n    const serialized = JSON.stringify([\n        0,\n        event.pubkey,\n        event.created_at,\n        event.kind,\n        event.tags,\n        event.content,\n    ]);\n    return hexEncode(sha256Bytes(utf8Encode(serialized)));\n}\n\n/**\n * Finalize a device event: derive Nostr key from device_sk, attach pubkey,\n * compute id, sign. Returns a fully-signed NIP-01 event ready to publish.\n */\nexport function finalizeDeviceEvent(params: {\n    deviceSk: Uint8Array;\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): NostrEvent {\n    const { nostrSk, nostrPk } = deriveNostrKey(params.deviceSk);\n    const base = buildDeviceEvent({\n        address: params.address,\n        device_id: params.device_id,\n        device_pk: params.device_pk,\n        bindingStatement: params.bindingStatement,\n        bindingSigBase64: params.bindingSigBase64,\n        createdAtUnix: params.createdAtUnix,\n    });\n    const withPubkey = { ...base, pubkey: nostrPk } as Omit<NostrEvent, 'id' | 'sig'>;\n    return signNostrEvent(withPubkey, nostrSk);\n}\n\n// ---------------------------------------------------------------------------\n// Parsing\n// ---------------------------------------------------------------------------\n\nexport interface ParsedDeviceEvent {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    revoked: boolean;\n    createdAtUnix: number;\n    nostrPubkey: string;\n    eventId: string;\n}\n\nexport function parseDeviceEvent(event: NostrEvent): ParsedDeviceEvent {\n    if (event.kind !== DEVICE_KIND) {\n        throw new Error('not a device event (kind mismatch)');\n    }\n    const tag = (name: string): string | null => {\n        for (const t of event.tags) {\n            if (t[0] === name && t.length > 1) return t[1] ?? null;\n        }\n        return null;\n    };\n    const address = tag('addr');\n    const device_id = tag('device_id');\n    const device_pk = tag('device_pk');\n    const binding_sig = tag('binding_sig');\n    if (!address || !device_id || !device_pk || !binding_sig) {\n        throw new Error('device event missing required tags');\n    }\n    return {\n        address,\n        device_id,\n        device_pk,\n        bindingStatement: event.content,\n        bindingSigBase64: binding_sig,\n        revoked: device_pk === 'revoked',\n        createdAtUnix: event.created_at,\n        nostrPubkey: event.pubkey,\n        eventId: event.id,\n    };\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;;AAcO,IAAM,WAAA,GAAc;AACpB,IAAM,eAAA,GAAkB;AASxB,SAAS,iBAAA,GAAmC;AAC/C,EAAA,MAAM,KAAK,qBAAA,EAAsB;AACjC,EAAA,MAAM,aAAA,GAAgB,aAAa,EAAE,CAAA;AACrC,EAAA,OAAO;AAAA,IACH,SAAA,EAAW,UAAU,aAAa,CAAA;AAAA,IAClC,SAAA,EAAW,SAAA,CAAU,EAAA,CAAG,MAAM,CAAA;AAAA,IAC9B,WAAW,EAAA,CAAG,MAAA;AAAA,IACd,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,GACvC;AACJ;AAEO,SAAS,sBAAsB,MAAA,EAK3B;AAGP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,uBAAuB,eAAe,CAAA,CAAA;AAAA,IACtC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAEO,SAAS,yBAAyB,MAAA,EAI9B;AACP,EAAA,MAAM,KAAA,GAAQ;AAAA,IACV,yBAAyB,eAAe,CAAA,CAAA;AAAA,IACxC,CAAA,SAAA,EAAY,OAAO,OAAO,CAAA,CAAA;AAAA,IAC1B,CAAA,WAAA,EAAc,OAAO,SAAS,CAAA,CAAA;AAAA,IAC9B,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,GACpC;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAC9B;AAoBO,SAAS,eAAe,QAAA,EAA4D;AACvF,EAAA,MAAM,EAAA,GAAK,UAAA;AAAA,IACP,QAAA;AAAA,IACA,WAAW,sBAAsB,CAAA;AAAA,IACjC,WAAW,UAAU,CAAA;AAAA,IACrB;AAAA,GACJ;AACA,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,YAAA,CAAa,EAAE,CAAA;AAClC,EAAA,OAAO,EAAE,SAAS,SAAA,CAAU,EAAE,GAAG,OAAA,EAAS,SAAA,CAAU,EAAE,CAAA,EAAE;AAC5D;AAOO,SAAS,iBAAiB,MAAA,EAOsC;AACnE,EAAA,MAAM,IAAA,GAAmB;AAAA,IACrB,CAAC,GAAA,EAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAAA,IACxC,CAAC,MAAA,EAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,IACvB,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA;AAAA,IAC9B,CAAC,OAAO,QAAQ,CAAA;AAAA,IAChB,CAAC,aAAA,EAAe,MAAA,CAAO,gBAAgB;AAAA,GAC3C;AACA,EAAA,MAAM,UAAA,GAAa,OAAO,aAAA,IAAiB,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACvE,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,WAAA;AAAA,IACN,IAAA;AAAA,IACA,SAAS,MAAA,CAAO,gBAAA;AAAA,IAChB;AAAA,GACJ;AACJ;AAMO,SAAS,cAAA,CACZ,OACA,UAAA,EACU;AACV,EAAA,MAAM,EAAA,GAAK,oBAAoB,KAAK,CAAA;AACpC,EAAA,MAAM,EAAA,GAAK,UAAU,UAAU,CAAA;AAC/B,EAAA,MAAM,MAAM,OAAA,CAAQ,IAAA,CAAK,SAAA,CAAU,EAAE,GAAG,EAAE,CAAA;AAC1C,EAAA,OAAO;AAAA,IACH,GAAG,KAAA;AAAA,IACH,EAAA;AAAA,IACA,GAAA,EAAK,UAAU,GAAG;AAAA,GACtB;AACJ;AAEO,SAAS,oBAAoB,KAAA,EAA+C;AAG/E,EAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU;AAAA,IAC9B,CAAA;AAAA,IACA,KAAA,CAAM,MAAA;AAAA,IACN,KAAA,CAAM,UAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM,IAAA;AAAA,IACN,KAAA,CAAM;AAAA,GACT,CAAA;AACD,EAAA,OAAO,SAAA,CAAU,WAAA,CAAY,UAAA,CAAW,UAAU,CAAC,CAAC,CAAA;AACxD;AAMO,SAAS,oBAAoB,MAAA,EAQrB;AACX,EAAA,MAAM,EAAE,OAAA,EAAS,OAAA,EAAQ,GAAI,cAAA,CAAe,OAAO,QAAQ,CAAA;AAC3D,EAAA,MAAM,OAAO,gBAAA,CAAiB;AAAA,IAC1B,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,eAAe,MAAA,CAAO;AAAA,GACzB,CAAA;AACD,EAAA,MAAM,UAAA,GAAa,EAAE,GAAG,IAAA,EAAM,QAAQ,OAAA,EAAQ;AAC9C,EAAA,OAAO,cAAA,CAAe,YAAY,OAAO,CAAA;AAC7C;AAkBO,SAAS,iBAAiB,KAAA,EAAsC;AACnE,EAAA,IAAI,KAAA,CAAM,SAAS,WAAA,EAAa;AAC5B,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAgC;AACzC,IAAA,KAAA,MAAW,CAAA,IAAK,MAAM,IAAA,EAAM;AACxB,MAAA,IAAI,CAAA,CAAE,CAAC,CAAA,KAAM,IAAA,IAAQ,CAAA,CAAE,SAAS,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,CAAA,IAAK,IAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,MAAM,CAAA;AAC1B,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAI,WAAW,CAAA;AACjC,EAAA,MAAM,WAAA,GAAc,IAAI,aAAa,CAAA;AACrC,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,aAAa,CAAC,SAAA,IAAa,CAAC,WAAA,EAAa;AACtD,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACxD;AAeA,EAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,KAAA,CAAM,OAAO,CAAA;AAClD,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,2DAA2D,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,MAAA,CAAO,YAAY,OAAA,EAAS;AAC5B,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,uBAAA,EAA0B,OAAO,CAAA,uCAAA,EAA0C,MAAA,CAAO,OAAO,CAAA,CAAA;AAAA,KAC7F;AAAA,EACJ;AACA,EAAA,IAAI,MAAA,CAAO,cAAc,SAAA,EAAW;AAChC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,4BAAA,EAA+B,SAAS,CAAA,uCAAA,EAA0C,MAAA,CAAO,SAAS,CAAA,CAAA;AAAA,KACtG;AAAA,EACJ;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,MAAA,EAAQ;AACxB,IAAA,IAAI,MAAA,CAAO,cAAc,SAAA,EAAW;AAChC,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,+EAAA,EACgB,SAAS,CAAA,uBAAA,EAA0B,MAAA,CAAO,SAAS,CAAA;AAAA,OACvE;AAAA,IACJ;AAAA,EACJ,CAAA,MAAA,IAAW,cAAc,SAAA,EAAW;AAChC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,wEAAwE,SAAS,CAAA,eAAA;AAAA,KACrF;AAAA,EACJ;AAEA,EAAA,OAAO;AAAA,IACH,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,WAAW,MAAA,CAAO,SAAA;AAAA;AAAA,IAElB,SAAA,EAAW,MAAA,CAAO,IAAA,KAAS,MAAA,GAAS,OAAO,SAAA,GAAY,SAAA;AAAA,IACvD,kBAAkB,KAAA,CAAM,OAAA;AAAA,IACxB,gBAAA,EAAkB,WAAA;AAAA,IAClB,OAAA,EAAS,OAAO,IAAA,KAAS,QAAA;AAAA,IACzB,eAAe,KAAA,CAAM,UAAA;AAAA,IACrB,aAAa,KAAA,CAAM,MAAA;AAAA,IACnB,SAAS,KAAA,CAAM;AAAA,GACnB;AACJ;AAOA,SAAS,sBACL,OAAA,EAIO;AACP,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,MAAM,CAAC,CAAA;AACtB,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAgC;AAC3C,IAAA,MAAM,MAAA,GAAS,GAAG,IAAI,CAAA,EAAA,CAAA;AACtB,IAAA,KAAA,MAAW,CAAA,IAAK,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,EAAG;AAC5B,MAAA,IAAI,CAAA,CAAE,WAAW,MAAM,CAAA,SAAU,CAAA,CAAE,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,SAAS,CAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,EAAW,OAAO,IAAA;AAEnC,EAAA,IAAI,MAAA,KAAW,CAAA,oBAAA,EAAuB,eAAe,CAAA,CAAA,EAAI;AACrD,IAAA,MAAM,SAAA,GAAY,MAAM,WAAW,CAAA;AACnC,IAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,WAAW,SAAA,EAAU;AAAA,EACzD;AACA,EAAA,IAAI,MAAA,KAAW,CAAA,sBAAA,EAAyB,eAAe,CAAA,CAAA,EAAI;AACvD,IAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,SAAA,EAAU;AAAA,EAChD;AACA,EAAA,OAAO,IAAA;AACX","file":"index.mjs","sourcesContent":["// Device key binding and Nostr directory publication.\n// See SPEC.md §3.\n\nimport { schnorr } from '@noble/curves/secp256k1';\nimport {\n    generateX25519KeyPair,\n    hexDecode,\n    hexEncode,\n    hkdfSha256,\n    randomBytesN,\n    sha256Bytes,\n    utf8Encode,\n} from '@orangecheck/lock-crypto';\n\nexport const DEVICE_KIND = 30078;\nexport const BINDING_VERSION = 'v2';\n\nexport interface DeviceKeyPair {\n    device_id: string;\n    device_pk: string; // 32-byte hex\n    device_sk: Uint8Array; // 32 bytes\n    created_at: string; // iso8601\n}\n\nexport function generateDeviceKey(): DeviceKeyPair {\n    const kp = generateX25519KeyPair();\n    const deviceIdBytes = randomBytesN(16);\n    return {\n        device_id: hexEncode(deviceIdBytes),\n        device_pk: hexEncode(kp.public),\n        device_sk: kp.secret,\n        created_at: new Date().toISOString(),\n    };\n}\n\nexport function buildBindingStatement(params: {\n    address: string;\n    device_pk: string;\n    device_id: string;\n    created_at: string;\n}): string {\n    // Exact byte layout per SPEC §3.2. Each line ends with LF; no trailing LF\n    // beyond the last field's. Order is fixed.\n    const lines = [\n        `oc-lock:device-bind:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_pk: ${params.device_pk}`,\n        `device_id: ${params.device_id}`,\n        `created_at: ${params.created_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\nexport function buildRevocationStatement(params: {\n    address: string;\n    device_id: string;\n    revoked_at: string;\n}): string {\n    const lines = [\n        `oc-lock:device-revoke:${BINDING_VERSION}`,\n        `address: ${params.address}`,\n        `device_id: ${params.device_id}`,\n        `revoked_at: ${params.revoked_at}`,\n    ];\n    return lines.join('\\n') + '\\n';\n}\n\n// ---------------------------------------------------------------------------\n// Nostr event helpers\n// ---------------------------------------------------------------------------\n\nexport interface NostrEvent {\n    id: string;\n    pubkey: string;\n    created_at: number;\n    kind: number;\n    tags: string[][];\n    content: string;\n    sig: string;\n}\n\n/**\n * Derive an ephemeral Nostr keypair from a device secret per SPEC §3.4.\n * Returns a 32-byte private key (hex).\n */\nexport function deriveNostrKey(deviceSk: Uint8Array): { nostrSk: string; nostrPk: string } {\n    const sk = hkdfSha256(\n        deviceSk,\n        utf8Encode('oc-lock/v2/nostr-key'),\n        utf8Encode('nostr-sk'),\n        32\n    );\n    const pk = schnorr.getPublicKey(sk);\n    return { nostrSk: hexEncode(sk), nostrPk: hexEncode(pk) };\n}\n\n/**\n * Build a kind-30078 addressable event announcing a device binding.\n * The caller must supply the BIP-322 signature produced by the user's Bitcoin\n * wallet (we cannot sign BIP-322 in this package — that requires a wallet).\n */\nexport function buildDeviceEvent(params: {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined } {\n    const tags: string[][] = [\n        ['d', `oc-lock:device:${params.address}`],\n        ['addr', params.address],\n        ['device_id', params.device_id],\n        ['device_pk', params.device_pk],\n        ['alg', 'x25519'],\n        ['binding_sig', params.bindingSigBase64],\n    ];\n    const created_at = params.createdAtUnix ?? Math.floor(Date.now() / 1000);\n    return {\n        kind: DEVICE_KIND,\n        tags,\n        content: params.bindingStatement,\n        created_at,\n    } as unknown as Omit<NostrEvent, 'id' | 'sig' | 'pubkey'> & { pubkey?: undefined };\n}\n\n/**\n * Sign a Nostr event with a Schnorr key (derived via deriveNostrKey). Produces\n * the full NostrEvent with id and sig.\n */\nexport function signNostrEvent(\n    event: Omit<NostrEvent, 'id' | 'sig'>,\n    nostrSkHex: string\n): NostrEvent {\n    const id = computeNostrEventId(event);\n    const sk = hexDecode(nostrSkHex);\n    const sig = schnorr.sign(hexDecode(id), sk);\n    return {\n        ...event,\n        id,\n        sig: hexEncode(sig),\n    };\n}\n\nexport function computeNostrEventId(event: Omit<NostrEvent, 'id' | 'sig'>): string {\n    // Per NIP-01: id = sha256(utf8(JSON.stringify([0, pubkey, created_at, kind, tags, content]))).\n    // The array must be serialized in *exactly* this form with no whitespace.\n    const serialized = JSON.stringify([\n        0,\n        event.pubkey,\n        event.created_at,\n        event.kind,\n        event.tags,\n        event.content,\n    ]);\n    return hexEncode(sha256Bytes(utf8Encode(serialized)));\n}\n\n/**\n * Finalize a device event: derive Nostr key from device_sk, attach pubkey,\n * compute id, sign. Returns a fully-signed NIP-01 event ready to publish.\n */\nexport function finalizeDeviceEvent(params: {\n    deviceSk: Uint8Array;\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    createdAtUnix?: number;\n}): NostrEvent {\n    const { nostrSk, nostrPk } = deriveNostrKey(params.deviceSk);\n    const base = buildDeviceEvent({\n        address: params.address,\n        device_id: params.device_id,\n        device_pk: params.device_pk,\n        bindingStatement: params.bindingStatement,\n        bindingSigBase64: params.bindingSigBase64,\n        createdAtUnix: params.createdAtUnix,\n    });\n    const withPubkey = { ...base, pubkey: nostrPk } as Omit<NostrEvent, 'id' | 'sig'>;\n    return signNostrEvent(withPubkey, nostrSk);\n}\n\n// ---------------------------------------------------------------------------\n// Parsing\n// ---------------------------------------------------------------------------\n\nexport interface ParsedDeviceEvent {\n    address: string;\n    device_id: string;\n    device_pk: string;\n    bindingStatement: string;\n    bindingSigBase64: string;\n    revoked: boolean;\n    createdAtUnix: number;\n    nostrPubkey: string;\n    eventId: string;\n}\n\nexport function parseDeviceEvent(event: NostrEvent): ParsedDeviceEvent {\n    if (event.kind !== DEVICE_KIND) {\n        throw new Error('not a device event (kind mismatch)');\n    }\n    const tag = (name: string): string | null => {\n        for (const t of event.tags) {\n            if (t[0] === name && t.length > 1) return t[1] ?? null;\n        }\n        return null;\n    };\n    const address = tag('addr');\n    const device_id = tag('device_id');\n    const device_pk = tag('device_pk');\n    const binding_sig = tag('binding_sig');\n    if (!address || !device_id || !device_pk || !binding_sig) {\n        throw new Error('device event missing required tags');\n    }\n\n    // The BIP-322 signature covers `event.content` — the statement — and nothing\n    // else. Tags are an index the relay lets anyone write, so a value read from a\n    // tag has been authenticated by nobody.\n    //\n    // Skipping this check was a total confidentiality break, and it needed no key\n    // material: republish a victim's device event with their real content and\n    // real binding_sig, change only the `device_pk` TAG to your own X25519 key.\n    // verifyBip322(content, sig, addr) passes — every signed byte is genuine —\n    // and the sender then seals the content key to the attacker's key, because\n    // the recipient record was built from the tag. Proven against the published\n    // package before this existed.\n    //\n    // So the statement is the source of truth and the tags must agree with it.\n    const signed = parseBindingStatement(event.content);\n    if (!signed) {\n        throw new Error('device event content is not a v2 bind or revoke statement');\n    }\n    if (signed.address !== address) {\n        throw new Error(\n            `device event addr tag (${address}) does not match the signed statement (${signed.address})`,\n        );\n    }\n    if (signed.device_id !== device_id) {\n        throw new Error(\n            `device event device_id tag (${device_id}) does not match the signed statement (${signed.device_id})`,\n        );\n    }\n    if (signed.kind === 'bind') {\n        if (signed.device_pk !== device_pk) {\n            throw new Error(\n                `device event device_pk tag does not match the signed statement — ` +\n                    `tag says ${device_pk}, the signature covers ${signed.device_pk}`,\n            );\n        }\n    } else if (device_pk !== 'revoked') {\n        throw new Error(\n            `device event carries a revocation statement but its device_pk tag is ${device_pk}, not \"revoked\"`,\n        );\n    }\n\n    return {\n        address: signed.address,\n        device_id: signed.device_id,\n        // Take the key from the SIGNED bytes, never the tag.\n        device_pk: signed.kind === 'bind' ? signed.device_pk : 'revoked',\n        bindingStatement: event.content,\n        bindingSigBase64: binding_sig,\n        revoked: signed.kind === 'revoke',\n        createdAtUnix: event.created_at,\n        nostrPubkey: event.pubkey,\n        eventId: event.id,\n    };\n}\n\n/**\n * Read back the fields the signature actually commits to. Returns null for\n * anything that is not a well-formed v2 bind/revoke statement, which the caller\n * treats as an unusable record.\n */\nfunction parseBindingStatement(\n    content: string,\n):\n    | { kind: 'bind'; address: string; device_pk: string; device_id: string }\n    | { kind: 'revoke'; address: string; device_id: string }\n    | null {\n    const lines = content.split('\\n');\n    const header = lines[0];\n    const field = (name: string): string | null => {\n        const prefix = `${name}: `;\n        for (const l of lines.slice(1)) {\n            if (l.startsWith(prefix)) return l.slice(prefix.length);\n        }\n        return null;\n    };\n    const address = field('address');\n    const device_id = field('device_id');\n    if (!address || !device_id) return null;\n\n    if (header === `oc-lock:device-bind:${BINDING_VERSION}`) {\n        const device_pk = field('device_pk');\n        if (!device_pk) return null;\n        return { kind: 'bind', address, device_pk, device_id };\n    }\n    if (header === `oc-lock:device-revoke:${BINDING_VERSION}`) {\n        return { kind: 'revoke', address, device_id };\n    }\n    return null;\n}\n"]}

package/package.json

@@ -1,59 +1,62 @@
 {
-    "name": "@orangecheck/lock-device",
-    "version": "0.1.0",
-    "description": "Device-key binding and Nostr kind-30078 directory publication for OC Lock.",
-    "keywords": [
-        "bitcoin",
-        "bip322",
-        "nostr",
-        "encryption",
-        "oc-lock",
-        "orangecheck"
-    ],
-    "author": "OrangeCheck",
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/orangecheck/oc-packages.git",
-        "directory": "lock-device"
-    },
-    "homepage": "https://github.com/orangecheck/oc-lock-protocol",
-    "bugs": {
-        "url": "https://github.com/orangecheck/oc-lock-protocol/issues"
-    },
-    "main": "./dist/index.js",
-    "module": "./dist/index.mjs",
-    "types": "./dist/index.d.ts",
-    "exports": {
-        ".": {
-            "types": "./dist/index.d.ts",
-            "import": "./dist/index.mjs",
-            "require": "./dist/index.js"
-        }
-    },
-    "files": [
-        "dist",
-        "src",
-        "README.md",
-        "LICENSE"
-    ],
-    "scripts": {
-        "build": "tsup",
-        "dev": "tsup --watch",
-        "type-check": "tsc --noEmit",
-        "test": "vitest run",
-        "test:watch": "vitest",
-        "clean": "rm -rf dist",
-        "prepublishOnly": "npm run clean && npm run build"
-    },
-    "dependencies": {
-        "@noble/curves": "^1.6.0",
-        "@orangecheck/lock-crypto": "^0.1.0"
-    },
-    "devDependencies": {
-        "@types/node": "^22.10.2",
-        "tsup": "^8.3.5",
-        "typescript": "^5.7.2",
-        "vitest": "^3.2.4"
+  "name": "@orangecheck/lock-device",
+  "version": "0.2.0",
+  "description": "Device-key binding and Nostr kind-30078 directory publication for OC Lock.",
+  "keywords": [
+    "bitcoin",
+    "bip322",
+    "nostr",
+    "encryption",
+    "oc-lock",
+    "orangecheck"
+  ],
+  "author": "OrangeCheck",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/orangecheck/oc-packages.git",
+    "directory": "lock-device"
+  },
+  "homepage": "https://github.com/orangecheck/oc-lock-protocol",
+  "bugs": {
+    "url": "https://github.com/orangecheck/oc-lock-protocol/issues"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
     }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "dependencies": {
+    "@noble/curves": "^1.6.0",
+    "@orangecheck/lock-crypto": "file:../lock-crypto"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/src/index.ts

@@ -215,15 +215,92 @@ export function parseDeviceEvent(event: NostrEvent): ParsedDeviceEvent {
     if (!address || !device_id || !device_pk || !binding_sig) {
         throw new Error('device event missing required tags');
     }
+
+    // The BIP-322 signature covers `event.content` — the statement — and nothing
+    // else. Tags are an index the relay lets anyone write, so a value read from a
+    // tag has been authenticated by nobody.
+    //
+    // Skipping this check was a total confidentiality break, and it needed no key
+    // material: republish a victim's device event with their real content and
+    // real binding_sig, change only the `device_pk` TAG to your own X25519 key.
+    // verifyBip322(content, sig, addr) passes — every signed byte is genuine —
+    // and the sender then seals the content key to the attacker's key, because
+    // the recipient record was built from the tag. Proven against the published
+    // package before this existed.
+    //
+    // So the statement is the source of truth and the tags must agree with it.
+    const signed = parseBindingStatement(event.content);
+    if (!signed) {
+        throw new Error('device event content is not a v2 bind or revoke statement');
+    }
+    if (signed.address !== address) {
+        throw new Error(
+            `device event addr tag (${address}) does not match the signed statement (${signed.address})`,
+        );
+    }
+    if (signed.device_id !== device_id) {
+        throw new Error(
+            `device event device_id tag (${device_id}) does not match the signed statement (${signed.device_id})`,
+        );
+    }
+    if (signed.kind === 'bind') {
+        if (signed.device_pk !== device_pk) {
+            throw new Error(
+                `device event device_pk tag does not match the signed statement — ` +
+                    `tag says ${device_pk}, the signature covers ${signed.device_pk}`,
+            );
+        }
+    } else if (device_pk !== 'revoked') {
+        throw new Error(
+            `device event carries a revocation statement but its device_pk tag is ${device_pk}, not "revoked"`,
+        );
+    }
+
     return {
-        address,
-        device_id,
-        device_pk,
+        address: signed.address,
+        device_id: signed.device_id,
+        // Take the key from the SIGNED bytes, never the tag.
+        device_pk: signed.kind === 'bind' ? signed.device_pk : 'revoked',
         bindingStatement: event.content,
         bindingSigBase64: binding_sig,
-        revoked: device_pk === 'revoked',
+        revoked: signed.kind === 'revoke',
         createdAtUnix: event.created_at,
         nostrPubkey: event.pubkey,
         eventId: event.id,
     };
 }
+
+/**
+ * Read back the fields the signature actually commits to. Returns null for
+ * anything that is not a well-formed v2 bind/revoke statement, which the caller
+ * treats as an unusable record.
+ */
+function parseBindingStatement(
+    content: string,
+):
+    | { kind: 'bind'; address: string; device_pk: string; device_id: string }
+    | { kind: 'revoke'; address: string; device_id: string }
+    | null {
+    const lines = content.split('\n');
+    const header = lines[0];
+    const field = (name: string): string | null => {
+        const prefix = `${name}: `;
+        for (const l of lines.slice(1)) {
+            if (l.startsWith(prefix)) return l.slice(prefix.length);
+        }
+        return null;
+    };
+    const address = field('address');
+    const device_id = field('device_id');
+    if (!address || !device_id) return null;
+
+    if (header === `oc-lock:device-bind:${BINDING_VERSION}`) {
+        const device_pk = field('device_pk');
+        if (!device_pk) return null;
+        return { kind: 'bind', address, device_pk, device_id };
+    }
+    if (header === `oc-lock:device-revoke:${BINDING_VERSION}`) {
+        return { kind: 'revoke', address, device_id };
+    }
+    return null;
+}

package/src/tag-substitution.test.ts

@@ -0,0 +1,101 @@
+// The BIP-322 signature covers event.content and nothing else. Tags are an
+// index a relay lets anyone write, so a value read from a tag is authenticated
+// by nobody.
+//
+// Before parseDeviceEvent cross-checked them, this was a total confidentiality
+// break that needed no key material: republish a victim's device event with
+// their REAL content and REAL binding_sig, change only the device_pk tag.
+// verifyBip322(content, sig, addr) passes — every signed byte is genuine — and
+// the sender seals the content key to the attacker, because the recipient
+// record was built from the tag.
+import { describe, expect, it } from 'vitest';
+
+import { buildBindingStatement, buildRevocationStatement, parseDeviceEvent } from './index.js';
+
+const VICTIM = 'bc1qvictim0000000000000000000000000000000';
+const VICTIM_PK = 'aa'.repeat(32);
+const ATTACKER_PK = 'bb'.repeat(32);
+const DEVICE = 'victim-laptop';
+
+const statement = buildBindingStatement({
+    address: VICTIM,
+    device_pk: VICTIM_PK,
+    device_id: DEVICE,
+    created_at: '2026-09-01T00:00:00Z',
+});
+
+function event(tags: string[][], content = statement) {
+    return {
+        id: 'f'.repeat(64),
+        pubkey: 'c'.repeat(64),
+        kind: 30078,
+        created_at: 1_780_000_000,
+        content,
+        tags,
+        sig: 'd'.repeat(128),
+    };
+}
+
+const honestTags = [
+    ['d', `oc-lock:device:${VICTIM}`],
+    ['addr', VICTIM],
+    ['device_id', DEVICE],
+    ['device_pk', VICTIM_PK],
+    ['binding_sig', 'VICTIMS_REAL_SIGNATURE'],
+];
+
+describe('parseDeviceEvent trusts the signed statement, not the tags', () => {
+    it('accepts an honest record and returns the signed key', () => {
+        const p = parseDeviceEvent(event(honestTags));
+        expect(p.device_pk).toBe(VICTIM_PK);
+        expect(p.address).toBe(VICTIM);
+        expect(p.revoked).toBe(false);
+    });
+
+    // The attack: one tag changed, every signed byte genuine.
+    it('REJECTS a substituted device_pk tag', () => {
+        const tags = honestTags.map((t) =>
+            t[0] === 'device_pk' ? ['device_pk', ATTACKER_PK] : t,
+        );
+        expect(() => parseDeviceEvent(event(tags))).toThrow(/device_pk tag does not match/i);
+    });
+
+    it('REJECTS a substituted addr tag', () => {
+        const tags = honestTags.map((t) => (t[0] === 'addr' ? ['addr', 'bc1qattacker'] : t));
+        expect(() => parseDeviceEvent(event(tags))).toThrow(/addr tag .* does not match/i);
+    });
+
+    it('REJECTS a substituted device_id tag', () => {
+        const tags = honestTags.map((t) =>
+            t[0] === 'device_id' ? ['device_id', 'other-device'] : t,
+        );
+        expect(() => parseDeviceEvent(event(tags))).toThrow(/device_id tag .* does not match/i);
+    });
+
+    it('REJECTS content that is not a v2 statement at all', () => {
+        expect(() => parseDeviceEvent(event(honestTags, 'hello'))).toThrow(/not a v2 bind or revoke/i);
+    });
+
+    it('accepts a genuine revocation and reports it revoked', () => {
+        const revoke = buildRevocationStatement({
+            address: VICTIM,
+            device_id: DEVICE,
+            revoked_at: '2026-09-02T00:00:00Z',
+        });
+        const tags = honestTags.map((t) => (t[0] === 'device_pk' ? ['device_pk', 'revoked'] : t));
+        const p = parseDeviceEvent(event(tags, revoke));
+        expect(p.revoked).toBe(true);
+        expect(p.device_pk).toBe('revoked');
+    });
+
+    // A revocation statement smuggled in under a live-looking key tag would
+    // otherwise read as an active device.
+    it('REJECTS a revocation statement whose device_pk tag claims a live key', () => {
+        const revoke = buildRevocationStatement({
+            address: VICTIM,
+            device_id: DEVICE,
+            revoked_at: '2026-09-02T00:00:00Z',
+        });
+        expect(() => parseDeviceEvent(event(honestTags, revoke))).toThrow(/not "revoked"/i);
+    });
+});