@orangecheck/sdk 0.1.0

package/dist/index.mjs

@@ -0,0 +1,1930 @@
+import { Buffer } from 'buffer';
+import { Verifier } from 'bip322-js';
+import * as bitcoinMessage from 'bitcoinjs-message';
+
+// src/canonical.ts
+function toLowerHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function randomNonce16BHexLower() {
+  const arr = new Uint8Array(16);
+  try {
+    if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") {
+      crypto.getRandomValues(arr);
+      return toLowerHex(arr);
+    }
+  } catch {
+  }
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = Math.floor(Math.random() * 256);
+  }
+  return toLowerHex(arr);
+}
+function formatIdentities(identities = []) {
+  if (identities.length === 0) {
+    return "";
+  }
+  const formatted = identities.map(({ protocol, identifier }) => `${protocol}:${identifier}`).sort();
+  return formatted.join(",");
+}
+function parseIdentities(identitiesStr) {
+  if (!identitiesStr || identitiesStr.trim() === "") {
+    return [];
+  }
+  return identitiesStr.split(",").map((binding) => {
+    const colonIndex = binding.indexOf(":");
+    if (colonIndex === -1) {
+      throw new Error(`Invalid identity binding format: ${binding}`);
+    }
+    return {
+      protocol: binding.substring(0, colonIndex).trim(),
+      identifier: binding.substring(colonIndex + 1).trim()
+    };
+  }).filter((binding) => binding.protocol && binding.identifier);
+}
+function buildCanonicalMessage({ address, identities }, extensions = {}) {
+  const nonce = randomNonce16BHexLower();
+  const issuedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const identitiesStr = formatIdentities(identities);
+  const core = [
+    "orangecheck",
+    `identities: ${identitiesStr}`,
+    `address: ${address}`,
+    "purpose: portable reputation attestation (non-custodial)",
+    `nonce: ${nonce}`,
+    `issued_at: ${issuedAt}`,
+    "ack: I attest control of this address and bind it to my identities."
+  ];
+  const normExt = {};
+  for (const [k, v] of Object.entries(extensions)) {
+    if (v == null || v === "") {
+      continue;
+    }
+    const key = k.toLowerCase();
+    normExt[key] = String(v);
+  }
+  const extLines = Object.keys(normExt).sort().map((k) => `${k}: ${normExt[k]}`);
+  const all = [...core, ...extLines];
+  return all.join("\n") + "\n";
+}
+async function generateAttestationId(message) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(message);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return toLowerHex(new Uint8Array(hashBuffer));
+}
+async function createAttestationEnvelope(message, signature, scheme, address, identities, extensions = {}) {
+  const attestation_id = await generateAttestationId(message);
+  const issuedAtMatch = message.match(/issued_at: ([^\n]+)/);
+  const issued_at = issuedAtMatch?.[1] ?? (/* @__PURE__ */ new Date()).toISOString();
+  const expires_at = extensions.expires;
+  const relay_hints = extensions.relay_hints?.split(",").map((r) => r.trim());
+  const publish_targets = extensions.publish?.split(",").map((t) => t.trim());
+  const encoder = new TextEncoder();
+  const messageBytes = encoder.encode(message);
+  const base64 = btoa(String.fromCharCode(...messageBytes));
+  const message_b64url = base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  const verification_url = `https://ochk.io/attest/${attestation_id}`;
+  return {
+    attestation_id,
+    scheme,
+    address,
+    identities,
+    message,
+    message_b64url,
+    signature,
+    issued_at,
+    expires_at,
+    verification_url,
+    publish_targets,
+    relay_hints
+  };
+}
+function createLogger(namespace) {
+  const shouldLog = (level) => {
+    return false;
+  };
+  const formatMessage = (msg) => `[${namespace}] ${msg}`;
+  return {
+    debug: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.debug(formatMessage(contextOrMessage));
+        } else {
+          console.debug(formatMessage(message ?? "Debug"), contextOrMessage);
+        }
+      }
+    },
+    info: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.info(formatMessage(contextOrMessage));
+        } else {
+          console.info(formatMessage(message ?? "Info"), contextOrMessage);
+        }
+      }
+    },
+    warn: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.warn(formatMessage(contextOrMessage));
+        } else {
+          console.warn(formatMessage(message ?? "Warning"), contextOrMessage);
+        }
+      }
+    },
+    error: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.error(formatMessage(contextOrMessage));
+        } else {
+          console.error(formatMessage(message ?? "Error"), contextOrMessage);
+        }
+      }
+    }
+  };
+}
+function logVerificationError(protocol, identifier, error, context) {
+  const logger = createLogger("identity-verification");
+  logger.error(
+    {
+      protocol,
+      identifier,
+      error: error.message,
+      stack: error.stack,
+      ...context
+    },
+    "Verification failed"
+  );
+}
+
+// src/nostr.ts
+var log = createLogger("ocp/nostr");
+var ATTESTATION_EVENT_KIND = 30078;
+var DEFAULT_RELAYS = [
+  "wss://relay.damus.io",
+  "wss://relay.nostr.band",
+  "wss://nos.lol",
+  "wss://relay.snort.social"
+];
+function createAttestationEvent(envelope, pubkey) {
+  const tags = [
+    ["d", envelope.attestation_id],
+    // Parameterized replaceable event identifier
+    ["address", envelope.address],
+    // Bitcoin address
+    ["scheme", envelope.scheme],
+    // Signature scheme (bip322 or legacy)
+    ["issued_at", envelope.issued_at]
+    // ISO timestamp
+  ];
+  for (const identity of envelope.identities) {
+    tags.push(["i", `${identity.protocol}:${identity.identifier}`]);
+  }
+  if (envelope.expires_at) {
+    tags.push(["expires", envelope.expires_at]);
+  }
+  if (envelope.relay_hints?.length) {
+    for (const relay of envelope.relay_hints) {
+      tags.push(["relay", relay]);
+    }
+  }
+  const content = JSON.stringify(envelope, null, 2);
+  return {
+    kind: ATTESTATION_EVENT_KIND,
+    tags,
+    content,
+    created_at: Math.floor(Date.parse(envelope.issued_at) / 1e3),
+    pubkey
+  };
+}
+async function publishToRelays(event, relays = DEFAULT_RELAYS) {
+  const success = [];
+  const failed = [];
+  log.info({ eventId: event.id, relayCount: relays.length }, "Publishing event to relays");
+  const publishPromises = relays.map(async (relayUrl) => {
+    let ws = null;
+    try {
+      ws = new WebSocket(relayUrl);
+      const wsRef = ws;
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          wsRef.close();
+          reject(new Error("Connection timeout"));
+        }, 5e3);
+        const cleanup = () => {
+          clearTimeout(timeout);
+          wsRef.close();
+        };
+        wsRef.onopen = () => {
+          clearTimeout(timeout);
+          wsRef.send(JSON.stringify(["EVENT", event]));
+        };
+        wsRef.onmessage = (msg) => {
+          try {
+            const data = JSON.parse(msg.data);
+            if (data[0] === "OK" && data[1] === event.id) {
+              if (data[2] === true) {
+                success.push(relayUrl);
+                cleanup();
+                resolve();
+              } else {
+                log.warn(
+                  { relay: relayUrl, reason: data[3] },
+                  "Relay rejected event"
+                );
+                failed.push(relayUrl);
+                cleanup();
+                reject(new Error(data[3] || "Relay rejected event"));
+              }
+            }
+          } catch (err) {
+            log.error(
+              { relay: relayUrl, error: err },
+              "Failed to parse relay response"
+            );
+            failed.push(relayUrl);
+            cleanup();
+            reject(err);
+          }
+        };
+        wsRef.onerror = (err) => {
+          log.error({ relay: relayUrl, error: err }, "WebSocket error");
+          failed.push(relayUrl);
+          cleanup();
+          reject(err);
+        };
+        wsRef.onclose = () => {
+          clearTimeout(timeout);
+        };
+      });
+    } catch (err) {
+      log.error({ relay: relayUrl, error: err }, "Failed to publish to relay");
+      if (!failed.includes(relayUrl)) {
+        failed.push(relayUrl);
+      }
+    } finally {
+      if (ws && ws.readyState !== WebSocket.CLOSED) {
+        ws.close();
+      }
+    }
+  });
+  await Promise.allSettled(publishPromises);
+  log.info({ successCount: success.length, failedCount: failed.length }, "Publishing complete");
+  return { success, failed };
+}
+async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
+  const events = [];
+  log.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
+  const queryPromises = relays.map(async (relayUrl) => {
+    let ws = null;
+    try {
+      ws = new WebSocket(relayUrl);
+      const wsRef = ws;
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          wsRef.close();
+          reject(new Error("Query timeout"));
+        }, 1e4);
+        const cleanup = () => {
+          clearTimeout(timeout);
+          wsRef.close();
+        };
+        wsRef.onopen = () => {
+          const subscriptionId = `ochk_${Date.now()}`;
+          wsRef.send(
+            JSON.stringify([
+              "REQ",
+              subscriptionId,
+              {
+                kinds: [30078],
+                "#d": [attestationId],
+                limit: 1
+              }
+            ])
+          );
+        };
+        wsRef.onmessage = (msg) => {
+          try {
+            const data = JSON.parse(msg.data);
+            if (data[0] === "EVENT") {
+              events.push(data[2]);
+            } else if (data[0] === "EOSE") {
+              cleanup();
+              resolve();
+            }
+          } catch (err) {
+            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+          }
+        };
+        wsRef.onerror = (err) => {
+          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          cleanup();
+          reject(err);
+        };
+        wsRef.onclose = () => {
+          clearTimeout(timeout);
+        };
+      });
+    } catch (err) {
+      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+    } finally {
+      if (ws && ws.readyState !== WebSocket.CLOSED) {
+        ws.close();
+      }
+    }
+  });
+  await Promise.allSettled(queryPromises);
+  log.info({ eventCount: events.length }, "Query complete");
+  return events;
+}
+async function queryByAddress(address, relays = DEFAULT_RELAYS) {
+  const events = [];
+  log.info({ address, relayCount: relays.length }, "Querying relays for address");
+  const queryPromises = relays.map(async (relayUrl) => {
+    try {
+      const ws = new WebSocket(relayUrl);
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          ws.close();
+          reject(new Error("Query timeout"));
+        }, 1e4);
+        ws.onopen = () => {
+          const subscriptionId = `ochk_addr_${Date.now()}`;
+          ws.send(
+            JSON.stringify([
+              "REQ",
+              subscriptionId,
+              {
+                kinds: [30078],
+                "#address": [address],
+                limit: 10
+              }
+            ])
+          );
+        };
+        ws.onmessage = (msg) => {
+          try {
+            const data = JSON.parse(msg.data);
+            if (data[0] === "EVENT") {
+              events.push(data[2]);
+            } else if (data[0] === "EOSE") {
+              clearTimeout(timeout);
+              ws.close();
+              resolve();
+            }
+          } catch (err) {
+            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+          }
+        };
+        ws.onerror = (err) => {
+          clearTimeout(timeout);
+          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          reject(err);
+        };
+      });
+    } catch (err) {
+      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+    }
+  });
+  await Promise.allSettled(queryPromises);
+  log.info({ eventCount: events.length }, "Query complete");
+  return events;
+}
+async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
+  const events = [];
+  const identityTag = `${protocol}:${identifier}`;
+  log.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
+  const queryPromises = relays.map(async (relayUrl) => {
+    try {
+      const ws = new WebSocket(relayUrl);
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          ws.close();
+          reject(new Error("Query timeout"));
+        }, 1e4);
+        ws.onopen = () => {
+          const subscriptionId = `ochk_identity_${Date.now()}`;
+          ws.send(
+            JSON.stringify([
+              "REQ",
+              subscriptionId,
+              {
+                kinds: [30078],
+                "#i": [identityTag],
+                limit: 10
+              }
+            ])
+          );
+        };
+        ws.onmessage = (msg) => {
+          try {
+            const data = JSON.parse(msg.data);
+            if (data[0] === "EVENT") {
+              events.push(data[2]);
+            } else if (data[0] === "EOSE") {
+              clearTimeout(timeout);
+              ws.close();
+              resolve();
+            }
+          } catch (err) {
+            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+          }
+        };
+        ws.onerror = (err) => {
+          clearTimeout(timeout);
+          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          reject(err);
+        };
+      });
+    } catch (err) {
+      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+    }
+  });
+  await Promise.allSettled(queryPromises);
+  log.info({ eventCount: events.length }, "Query complete");
+  return events;
+}
+async function verifyAttestationEnvelope(envelope) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(envelope.message);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const computedId = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+    return computedId === envelope.attestation_id;
+  } catch (err) {
+    log.error({ error: err }, "Failed to verify attestation envelope");
+    return false;
+  }
+}
+function parseAttestationFromEvent(event) {
+  try {
+    const envelope = JSON.parse(event.content);
+    return envelope;
+  } catch (err) {
+    log.error({ eventId: event.id, error: err }, "Failed to parse attestation from event");
+    return null;
+  }
+}
+
+// src/nostr-crypto.ts
+var log2 = createLogger("ocp/nostr-crypto");
+function isNip07Available() {
+  if (typeof window === "undefined") {
+    return false;
+  }
+  return !!window.nostr;
+}
+async function signNostrEvent(event) {
+  if (!isNip07Available()) {
+    log2.warn("NIP-07 extension not available");
+    return null;
+  }
+  try {
+    const nostr = window.nostr;
+    const signedEvent = await nostr.signEvent(event);
+    log2.info({ eventId: signedEvent.id }, "Signed Nostr event with NIP-07");
+    return signedEvent;
+  } catch (err) {
+    log2.error({ error: err }, "Failed to sign Nostr event");
+    return null;
+  }
+}
+
+// src/attestation.ts
+var log3 = createLogger("ocp/attestation");
+var AttestationError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "AttestationError";
+  }
+};
+async function createAttestation(options) {
+  const { message, signature, scheme, address, identities = [], extensions = {} } = options;
+  log3.info({ address, identityCount: identities.length }, "Creating attestation");
+  const envelope = await createAttestationEnvelope(
+    message,
+    signature,
+    scheme,
+    address,
+    identities,
+    extensions
+  );
+  const isValid = await verifyAttestationEnvelope(envelope);
+  if (!isValid) {
+    throw new AttestationError(
+      "Attestation envelope integrity check failed",
+      "INTEGRITY_CHECK_FAILED"
+    );
+  }
+  log3.info({ attestationId: envelope.attestation_id }, "Attestation created successfully");
+  return envelope;
+}
+async function publishAttestation(options) {
+  const { envelope, npub, relays = DEFAULT_RELAYS } = options;
+  log3.info(
+    { attestationId: envelope.attestation_id, relayCount: relays.length },
+    "Publishing attestation"
+  );
+  const unsignedEvent = createAttestationEvent(envelope, npub);
+  if (!isNip07Available()) {
+    log3.warn("NIP-07 unavailable \u2014 skipping Nostr publish");
+    throw new Error(
+      "nostr_signer_unavailable: install a NIP-07 extension (e.g. nos2x, Alby) to publish"
+    );
+  }
+  log3.info("Using NIP-07 to sign event");
+  const signedEvent = await signNostrEvent(unsignedEvent);
+  if (!signedEvent) {
+    throw new Error("nostr_signing_failed: NIP-07 extension rejected or errored");
+  }
+  const result = await publishToRelays(signedEvent, relays);
+  log3.info(
+    {
+      attestationId: envelope.attestation_id,
+      successCount: result.success.length,
+      failedCount: result.failed.length
+    },
+    "Publishing complete"
+  );
+  return result;
+}
+async function discoverAttestations(options) {
+  const { attestationId, address, identity, relays = DEFAULT_RELAYS } = options;
+  let events = [];
+  if (attestationId) {
+    log3.info({ attestationId }, "Discovering by attestation ID");
+    events = await queryByAttestationId(attestationId, relays);
+  } else if (address) {
+    log3.info({ address }, "Discovering by Bitcoin address");
+    events = await queryByAddress(address, relays);
+  } else if (identity) {
+    log3.info({ identity }, "Discovering by identity");
+    events = await queryByIdentity(identity.protocol, identity.identifier, relays);
+  } else {
+    throw new Error("Must provide attestationId, address, or identity");
+  }
+  const envelopes = [];
+  for (const event of events) {
+    const envelope = parseAttestationFromEvent(event);
+    if (envelope) {
+      const isValid = await verifyAttestationEnvelope(envelope);
+      if (isValid) {
+        envelopes.push(envelope);
+      } else {
+        log3.warn(
+          { attestationId: envelope.attestation_id },
+          "Skipping invalid attestation envelope"
+        );
+      }
+    }
+  }
+  log3.info({ eventCount: events.length, validCount: envelopes.length }, "Discovery complete");
+  return envelopes;
+}
+async function verifyAttestationById(attestationId, relays = DEFAULT_RELAYS) {
+  log3.info({ attestationId }, "Verifying attestation by ID");
+  const envelopes = await discoverAttestations({ attestationId, relays });
+  if (envelopes.length === 0) {
+    log3.warn({ attestationId }, "Attestation not found on any relay");
+    return null;
+  }
+  if (envelopes.length > 1) {
+    log3.warn(
+      { attestationId, count: envelopes.length },
+      "Multiple attestations found with same ID - using first"
+    );
+  }
+  return envelopes[0] || null;
+}
+async function getAttestationsForAddress(address, relays = DEFAULT_RELAYS) {
+  log3.info({ address }, "Getting all attestations for address");
+  return discoverAttestations({ address, relays });
+}
+async function getAttestationsForIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
+  log3.info({ protocol, identifier }, "Getting all attestations for identity");
+  return discoverAttestations({ identity: { protocol, identifier }, relays });
+}
+
+// src/scoring.ts
+function scoreV0(sats, days) {
+  if (sats <= 0 || days <= 0) return 0;
+  return Math.round(Math.log(1 + sats) * (1 + days / 30) * 100) / 100;
+}
+function scoreTier(sats, days) {
+  if (sats >= 1e7 && days >= 365) return "platinum";
+  if (sats >= 1e6 && days >= 180) return "gold";
+  if (sats >= 1e5 && days >= 90) return "silver";
+  if (sats >= 1e4 && days >= 30) return "bronze";
+  return "none";
+}
+function computeScore(sats, days, config) {
+  switch (config.algorithm) {
+    case "v0":
+      return scoreV0(sats, days);
+    case "tier":
+      return scoreTier(sats, days);
+    case "none":
+      return null;
+  }
+}
+
+// src/verify.ts
+var log4 = createLogger("ocp/verify");
+function scoreV02(sats, days) {
+  return computeScore(sats, days, { algorithm: "v0" });
+}
+function looksLikeHex(s) {
+  return /^[0-9a-fA-F]+$/.test(s) && s.length % 2 === 0;
+}
+function toBase64Maybe(sig) {
+  if (looksLikeHex(sig)) {
+    return Buffer.from(sig, "hex").toString("base64");
+  }
+  return sig;
+}
+function detectSignatureScheme(addr, sig) {
+  const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+  if (isSegWit) {
+    return "bip322";
+  }
+  const sigBase64 = toBase64Maybe(sig);
+  const looksLikeLegacy = sigBase64.length === 88 && /^[IHG]/.test(sigBase64);
+  if (looksLikeLegacy) {
+    return "legacy";
+  }
+  return "bip322";
+}
+async function verifySignature({
+  addr,
+  msg,
+  sig,
+  scheme
+}) {
+  try {
+    if (sig === "demo_signature") {
+      log4.warn("Demo signature detected in verifySignature - should be handled by demo mode");
+      return "sig_invalid";
+    }
+    const detectedScheme = scheme || detectSignatureScheme(addr, sig);
+    log4.debug(
+      { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
+      "Verifying signature"
+    );
+    if (detectedScheme === "bip322") {
+      const sigBase64 = toBase64Maybe(sig);
+      log4.debug(
+        { sigBase64: sigBase64.substring(0, 50) + "..." },
+        "Signature converted to base64"
+      );
+      log4.debug(
+        {
+          msgFull: msg,
+          msgLines: msg.split("\n").length,
+          msgFirstLine: msg.split("\n")[0],
+          msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
+        },
+        "Message being verified"
+      );
+      const ok = Verifier.verifySignature(addr, msg, sigBase64);
+      log4.info({ addr, ok }, "BIP-322 verification result");
+      if (!ok) {
+        const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+        if (isSegWit && sigBase64.length === 88) {
+          log4.warn(
+            { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
+            "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
+          );
+        } else {
+          log4.error(
+            {
+              addr,
+              sigLength: sigBase64.length,
+              msgLength: msg.length,
+              msgPreview: msg.substring(0, 200)
+            },
+            "BIP-322 verification failed - signature does not match message"
+          );
+        }
+      }
+      return ok ? "sig_ok_bip322" : "sig_invalid";
+    }
+    if (detectedScheme === "legacy") {
+      const sigBase64 = toBase64Maybe(sig);
+      if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
+        log4.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
+        return "sig_unsupported_script";
+      }
+      log4.debug(
+        {
+          addr,
+          sigBase64: sigBase64.substring(0, 50) + "...",
+          msgPreview: msg.substring(0, 100) + "...",
+          msgLength: msg.length
+        },
+        "Verifying legacy signature"
+      );
+      const ok = bitcoinMessage.verify(msg, addr, sigBase64);
+      log4.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
+      if (!ok) {
+        log4.error(
+          {
+            addr,
+            msgFirstLine: msg.split("\n")[0],
+            sigFormat: sigBase64.substring(0, 10)
+          },
+          "Legacy signature verification failed - check message format and signature"
+        );
+      }
+      return ok ? "sig_ok_legacy" : "sig_invalid";
+    }
+    return "invalid_scheme";
+  } catch (err) {
+    log4.error(
+      { addr, error: err instanceof Error ? err.message : String(err) },
+      "Signature verification error"
+    );
+    return "sig_invalid";
+  }
+}
+function parseCanonicalMessage(msg) {
+  const lines = msg.split("\n").map((l) => l.trim());
+  const getVal = (prefix) => lines.find((l) => l.toLowerCase().startsWith(prefix + ":"))?.split(":", 2)[1]?.trim();
+  const address = getVal("address") || "";
+  const identitiesStr = getVal("identities") || "";
+  let identities = [];
+  try {
+    identities = parseIdentities(identitiesStr);
+  } catch (err) {
+    log4.warn({ identitiesStr, error: err }, "Failed to parse identities field");
+  }
+  const coreKeys = /* @__PURE__ */ new Set([
+    "orangecheck",
+    "identities",
+    "address",
+    "purpose",
+    "nonce",
+    "issued_at",
+    "ack"
+  ]);
+  const extensions = {};
+  for (const line of lines) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const key = line.slice(0, idx).trim().toLowerCase();
+    const val = line.slice(idx + 1).trim();
+    if (!coreKeys.has(key) && val) extensions[key] = val;
+  }
+  const network = extensions["network"] || "mainnet";
+  const bondStr = extensions["bond"];
+  const bond = bondStr ? parseInt(bondStr, 10) : void 0;
+  return {
+    core: { address, identities },
+    network,
+    extensions,
+    bond: bond !== void 0 && !isNaN(bond) && bond > 0 ? bond : void 0
+  };
+}
+async function getAddressUtxos(address, network, opts) {
+  const endpoints = network === "signet" ? [
+    opts?.esploraSignetBase || "https://mempool.space/signet/api",
+    "https://blockstream.info/signet/api"
+  ] : network === "testnet" ? [
+    opts?.esploraTestnetBase || "https://mempool.space/testnet/api",
+    "https://blockstream.info/testnet/api"
+  ] : [
+    opts?.esploraMainnetBase || "https://mempool.space/api",
+    "https://blockstream.info/api"
+  ];
+  let lastError = null;
+  for (const base of endpoints) {
+    try {
+      const url = `${base}/address/${address}/utxo`;
+      log4.debug({ url, network }, "Fetching UTXOs");
+      const resp = await fetch(url, {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(1e4)
+        // 10s timeout
+      });
+      if (!resp.ok) {
+        throw new Error(`HTTP ${resp.status}`);
+      }
+      const data = await resp.json();
+      if (!Array.isArray(data)) {
+        throw new Error("Invalid response: expected array");
+      }
+      for (const utxo of data) {
+        if (typeof utxo.value !== "number" || typeof utxo.status !== "object" || typeof utxo.status.confirmed !== "boolean" || typeof utxo.txid !== "string" || typeof utxo.vout !== "number") {
+          throw new Error("Invalid UTXO structure");
+        }
+      }
+      log4.info({ base, count: data.length, network }, "UTXOs fetched successfully");
+      return data;
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      log4.warn(
+        { base, error: lastError.message, network },
+        "Esplora endpoint failed, trying next"
+      );
+    }
+  }
+  log4.error({ endpoints, error: lastError?.message, network }, "All Esplora endpoints failed");
+  throw new Error(`esplora_all_failed: ${lastError?.message || "unknown"}`);
+}
+function computeMetrics(utxos, bondAmount) {
+  const confirmedUtxos = utxos.filter((u) => u.status.confirmed);
+  if (confirmedUtxos.length === 0) {
+    return { sats_bonded: 0, days_unspent: 0, confirmed_balance: 0 };
+  }
+  const confirmed_balance = confirmedUtxos.reduce((sum, u) => sum + u.value, 0);
+  if (bondAmount !== void 0 && bondAmount > 0) {
+    const sorted = [...confirmedUtxos].sort((a, b) => {
+      const heightA = a.status.block_height ?? Infinity;
+      const heightB = b.status.block_height ?? Infinity;
+      if (heightA !== heightB) return heightA - heightB;
+      if (a.txid !== b.txid) return a.txid.localeCompare(b.txid);
+      return a.vout - b.vout;
+    });
+    let sum = 0;
+    let youngestTime = 0;
+    for (const utxo of sorted) {
+      sum += utxo.value;
+      youngestTime = Math.max(youngestTime, utxo.status.block_time || 0);
+      if (sum >= bondAmount) break;
+    }
+    const days_unspent2 = Math.max(
+      0,
+      Math.floor((Date.now() / 1e3 - youngestTime) / (24 * 60 * 60))
+    );
+    return {
+      sats_bonded: bondAmount,
+      // Use exactly bond amount (ignore surplus)
+      days_unspent: days_unspent2,
+      confirmed_balance
+    };
+  }
+  const sats_bonded = confirmed_balance;
+  const oldestTime = Math.min(
+    ...confirmedUtxos.map((u) => u.status.block_time || Date.now() / 1e3)
+  );
+  const days_unspent = Math.max(0, Math.floor((Date.now() / 1e3 - oldestTime) / (24 * 60 * 60)));
+  return { sats_bonded, days_unspent, confirmed_balance };
+}
+async function verify2(input, opts = {}) {
+  const codes = [];
+  let network = "mainnet";
+  try {
+    if (!input.msg || !input.addr || !input.sig) {
+      codes.push("bad_request");
+      return { ok: false, codes, network };
+    }
+    const parsed = parseCanonicalMessage(input.msg);
+    network = parsed.network || "mainnet";
+    const attestation_id = await generateAttestationId(input.msg);
+    if (parsed.core.address !== input.addr) {
+      codes.push("bad_request");
+      return { ok: false, codes, network, attestation_id };
+    }
+    if (opts.demoMode) {
+      const sats_bonded = 1e6;
+      const days_unspent = 90;
+      const metrics = {
+        sats_bonded,
+        days_unspent,
+        score: scoreV02(sats_bonded, days_unspent)
+        // ≈ 55.26
+      };
+      codes.push("sig_ok_bip322");
+      codes.push("bond_confirmed");
+      return {
+        ok: true,
+        codes,
+        network,
+        attestation_id,
+        identities: parsed.core.identities,
+        metrics
+      };
+    }
+    if ((network === "testnet" || network === "signet") && !opts.testMode) {
+      codes.push("network_testmode");
+      return { ok: false, codes, network, attestation_id };
+    }
+    if (opts.expectedAud && parsed.extensions["aud"] && parsed.extensions["aud"] !== opts.expectedAud) {
+      codes.push("aud_mismatch");
+    }
+    if (parsed.extensions["expires"]) {
+      const exp = Date.parse(parsed.extensions["expires"]);
+      if (!Number.isNaN(exp) && exp < Date.now()) {
+        codes.push("expired");
+      }
+    }
+    const sigCode = await verifySignature({
+      addr: input.addr,
+      msg: input.msg,
+      sig: input.sig,
+      ...input.scheme && { scheme: input.scheme }
+    });
+    codes.push(sigCode);
+    const sigOk = sigCode === "sig_ok_bip322" || sigCode === "sig_ok_legacy";
+    if (!sigOk) {
+      return {
+        ok: false,
+        codes,
+        network,
+        attestation_id,
+        identities: parsed.core.identities
+      };
+    }
+    try {
+      const utxos = await getAddressUtxos(input.addr, network, {
+        esploraMainnetBase: opts.esploraMainnetBase,
+        esploraSignetBase: opts.esploraSignetBase
+      });
+      const { sats_bonded, days_unspent, confirmed_balance } = computeMetrics(
+        utxos,
+        parsed.bond
+      );
+      if (parsed.bond !== void 0 && parsed.bond > 0) {
+        if (confirmed_balance < parsed.bond) {
+          codes.push("bond_insufficient");
+          log4.warn(
+            {
+              bond: parsed.bond,
+              confirmed_balance,
+              address: input.addr
+            },
+            "Bond extension: insufficient balance"
+          );
+          return {
+            ok: false,
+            codes,
+            network,
+            attestation_id,
+            identities: parsed.core.identities
+          };
+        }
+      }
+      if (sats_bonded <= 0) {
+        codes.push("bond_zero");
+        if (utxos.some((u) => !u.status.confirmed)) {
+          codes.push("bond_pending");
+        }
+        return {
+          ok: false,
+          codes,
+          network,
+          attestation_id,
+          identities: parsed.core.identities
+        };
+      } else {
+        codes.push("bond_confirmed");
+      }
+      const metrics = {
+        sats_bonded,
+        days_unspent,
+        score: scoreV02(sats_bonded, days_unspent)
+      };
+      return {
+        ok: true,
+        codes,
+        network,
+        attestation_id,
+        identities: parsed.core.identities,
+        metrics
+      };
+    } catch (utxoError) {
+      console.error("UTXO fetch failed:", utxoError);
+      codes.push("bad_request");
+      return { ok: false, codes, network, attestation_id };
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e ?? "decode_error");
+    if (msg === "decode_error") {
+      codes.push("decode_error");
+    } else {
+      codes.push("bad_request");
+    }
+    return { ok: false, codes, network };
+  }
+}
+
+// src/check.ts
+async function check(params) {
+  const {
+    addr,
+    id,
+    identity,
+    minSats = 0,
+    minDays = 0,
+    relays = DEFAULT_RELAYS,
+    verifyOptions
+  } = params;
+  if (!addr && !id && !identity) {
+    return { ok: false, sats: 0, days: 0, score: 0, reasons: ["bad_request"] };
+  }
+  let envelopes = [];
+  if (id) {
+    envelopes = await discoverAttestations({ attestationId: id, relays });
+  } else if (addr) {
+    envelopes = await getAttestationsForAddress(addr, relays);
+  } else if (identity) {
+    envelopes = await getAttestationsForIdentity(
+      identity.protocol,
+      identity.identifier,
+      relays
+    );
+  }
+  if (envelopes.length === 0) {
+    return { ok: false, sats: 0, days: 0, score: 0, reasons: ["not_found"] };
+  }
+  envelopes.sort((a, b) => new Date(b.issued_at).getTime() - new Date(a.issued_at).getTime());
+  const env = envelopes[0];
+  if (!env) {
+    return { ok: false, sats: 0, days: 0, score: 0, reasons: ["not_found"] };
+  }
+  const outcome = await verify2(
+    {
+      addr: env.address,
+      msg: env.message,
+      sig: env.signature,
+      scheme: env.scheme
+    },
+    verifyOptions
+  );
+  const sats = outcome.metrics?.sats_bonded ?? 0;
+  const days = outcome.metrics?.days_unspent ?? 0;
+  const score = outcome.metrics?.score ?? 0;
+  const reasons = [];
+  if (!outcome.ok) reasons.push(...outcome.codes);
+  if (sats < minSats) reasons.push("below_min_sats");
+  if (days < minDays) reasons.push("below_min_days");
+  const ok = outcome.ok && sats >= minSats && days >= minDays;
+  return {
+    ok,
+    sats,
+    days,
+    score,
+    attestation_id: env.attestation_id,
+    address: env.address,
+    identities: env.identities,
+    network: outcome.network,
+    ...reasons.length ? { reasons } : {}
+  };
+}
+var AUTH_HEADER = "orangecheck-auth";
+var AUTH_ACK = "I authorize this session under the OrangeCheck auth challenge.";
+function randomNonce() {
+  const bytes = new Uint8Array(16);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function iso(date) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function issueChallenge(opts) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const ttl = opts.ttlSeconds ?? 300;
+  const expiresAt = new Date(now.getTime() + ttl * 1e3);
+  const nonce = opts.nonce ?? randomNonce();
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    throw new Error("nonce must be 32 lowercase hex characters");
+  }
+  const coreLines = [
+    AUTH_HEADER,
+    `address: ${opts.address}`,
+    `nonce: ${nonce}`,
+    `issued_at: ${iso(now)}`,
+    `expires_at: ${iso(expiresAt)}`,
+    `ack: ${AUTH_ACK}`
+  ];
+  const extensions = [];
+  if (opts.audience) extensions.push(["audience", opts.audience]);
+  if (opts.purpose) extensions.push(["purpose", opts.purpose]);
+  extensions.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const extLines = extensions.map(([k, v]) => `${k}: ${v}`);
+  const message = [...coreLines, ...extLines].join("\n") + "\n";
+  return {
+    message,
+    nonce,
+    expiresAt: expiresAt.getTime(),
+    expiresAtIso: iso(expiresAt)
+  };
+}
+function parseChallenge(message) {
+  const lines = message.endsWith("\n") ? message.slice(0, -1).split("\n") : message.split("\n");
+  if (lines[0] !== AUTH_HEADER) {
+    throw new Error("not an orangecheck-auth challenge");
+  }
+  const out = { extensions: [] };
+  const coreKeys = /* @__PURE__ */ new Set(["address", "nonce", "issued_at", "expires_at", "ack"]);
+  let seenCore = 0;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const sep = line.indexOf(": ");
+    if (sep === -1) continue;
+    const key = line.slice(0, sep);
+    const val = line.slice(sep + 2);
+    if (coreKeys.has(key)) {
+      seenCore++;
+      if (key === "address") out.address = val;
+      else if (key === "nonce") out.nonce = val;
+      else if (key === "issued_at") out.issuedAt = new Date(val);
+      else if (key === "expires_at") out.expiresAt = new Date(val);
+      else if (key === "ack") out.ack = val;
+    } else {
+      out.extensions.push([key, val]);
+      if (key === "audience") out.audience = val;
+      if (key === "purpose") out.purpose = val;
+    }
+  }
+  if (seenCore !== 5) {
+    throw new Error(`challenge missing core lines (${seenCore}/5)`);
+  }
+  return out;
+}
+async function verifyChallenge(opts) {
+  let parsed;
+  try {
+    parsed = parseChallenge(opts.message);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;
+  if (!address || !nonce || !issuedAt || !expiresAt || !ack) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (ack !== AUTH_ACK) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const skew = opts.clockSkewMs ?? 0;
+  if (now.getTime() - skew > expiresAt.getTime()) {
+    return { ok: false, reason: "expired" };
+  }
+  if (now.getTime() + skew < issuedAt.getTime()) {
+    return { ok: false, reason: "not_yet_valid" };
+  }
+  if (opts.expectedNonce && nonce !== opts.expectedNonce) {
+    return { ok: false, reason: "nonce_mismatch" };
+  }
+  if (opts.expectedAudience && audience !== opts.expectedAudience) {
+    return { ok: false, reason: "audience_mismatch" };
+  }
+  if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {
+    return { ok: false, reason: "purpose_mismatch" };
+  }
+  const scheme = opts.scheme ?? "bip322";
+  let sigValid = false;
+  try {
+    if (scheme === "bip322") {
+      const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
+      sigValid = Verifier.verifySignature(address, opts.message, sigBase64);
+    } else if (scheme === "legacy") {
+      if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
+        return { ok: false, reason: "sig_unsupported_scheme" };
+      }
+      sigValid = bitcoinMessage.verify(opts.message, address, opts.signature);
+    } else {
+      return { ok: false, reason: "sig_unsupported_scheme" };
+    }
+  } catch {
+    sigValid = false;
+  }
+  if (!sigValid) return { ok: false, reason: "sig_invalid" };
+  return {
+    ok: true,
+    reason: "ok",
+    address,
+    expiresAt: expiresAt.getTime(),
+    nonce,
+    ...audience !== void 0 ? { audience } : {},
+    ...purpose !== void 0 ? { purpose } : {}
+  };
+}
+
+// src/utils/rate-limiter.ts
+var RateLimitError = class extends Error {
+  constructor(message = "Rate limit exceeded. Please try again later.") {
+    super(message);
+    this.name = "RateLimitError";
+  }
+};
+function createRateLimiter(maxRequests, windowMs) {
+  return {
+    maxRequests,
+    windowMs,
+    requests: /* @__PURE__ */ new Map()
+  };
+}
+function checkRateLimit(limiter, key) {
+  const now = Date.now();
+  const requests = limiter.requests.get(key) ?? [];
+  const validRequests = requests.filter((timestamp) => now - timestamp < limiter.windowMs);
+  if (validRequests.length >= limiter.maxRequests) {
+    return false;
+  }
+  validRequests.push(now);
+  limiter.requests.set(key, validRequests);
+  return true;
+}
+function enforceRateLimit(limiter, key) {
+  if (!checkRateLimit(limiter, key)) {
+    throw new RateLimitError();
+  }
+}
+var identityVerificationLimiter = createRateLimiter(5, 6e4);
+
+// src/identity/dns.ts
+var log5 = createLogger("identity-verification/dns");
+async function verifyDnsIdentity(attestationId, domain) {
+  log5.info({ attestationId, domain }, "Verifying DNS identity");
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  const wellKnownResult = await checkWellKnownFile(attestationId, cleanDomain);
+  if (wellKnownResult.verified) {
+    return wellKnownResult;
+  }
+  log5.info({ domain: cleanDomain }, "Well-known file not found, DNS TXT check not implemented");
+  return {
+    verified: false,
+    error: "Verification file not found. Please create .well-known/orangecheck.txt"
+  };
+}
+async function checkWellKnownFile(attestationId, domain) {
+  const urls = [
+    `https://${domain}/.well-known/orangecheck.txt`,
+    `http://${domain}/.well-known/orangecheck.txt`
+    // Fallback to HTTP
+  ];
+  for (const url of urls) {
+    try {
+      log5.info({ url }, "Checking well-known file");
+      const response = await fetch(url, {
+        method: "GET",
+        headers: {
+          Accept: "text/plain"
+        },
+        // Don't follow redirects to other domains
+        redirect: "manual"
+      });
+      if (response.ok) {
+        const content = await response.text();
+        if (content.includes(attestationId)) {
+          log5.info({ domain, url }, "Found attestation ID in well-known file");
+          return {
+            verified: true,
+            method: "well-known",
+            url
+          };
+        } else {
+          log5.info({ domain, url }, "Well-known file exists but no attestation ID found");
+        }
+      }
+    } catch (err) {
+      log5.warn({ error: err, url }, "Failed to fetch well-known file");
+    }
+  }
+  return {
+    verified: false,
+    error: "Well-known file not found or does not contain attestation ID"
+  };
+}
+function getDnsVerificationInstructions(attestationId, domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  return `To verify your DNS domain (${cleanDomain}):
+
+**Method 1: .well-known file (Recommended)**
+
+1. Create a file at: https://${cleanDomain}/.well-known/orangecheck.txt
+2. Add this content to the file:
+
+   OrangeCheck Attestation Verification
+   Domain: ${cleanDomain}
+   Attestation ID: ${attestationId}
+   Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+3. Make sure the file is publicly accessible
+4. Return here and click "Verify"
+
+**Method 2: DNS TXT record (Advanced)**
+
+1. Add a TXT record to your DNS:
+   Name: _orangecheck.${cleanDomain}
+   Value: ${attestationId}
+
+2. Wait for DNS propagation (up to 24 hours)
+3. Return here and click "Verify"
+
+Note: Method 1 is faster and easier to set up.`;
+}
+function generateWellKnownContent(attestationId, domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  return `OrangeCheck Attestation Verification
+=====================================
+
+Domain: ${cleanDomain}
+Attestation ID: ${attestationId}
+Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+This file verifies that the owner of ${cleanDomain} controls the Bitcoin
+address associated with attestation ${attestationId}.
+
+Learn more: https://ochk.io
+
+---
+
+Verification method: .well-known/orangecheck.txt
+Protocol: OrangeCheck Protocol (OCP)
+`;
+}
+function getWellKnownUrl(domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  return `https://${cleanDomain}/.well-known/orangecheck.txt`;
+}
+function isValidDomain(domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
+  return domainPattern.test(cleanDomain);
+}
+function isDnsIdentityVerified(attestationId, _domain, cachedContent) {
+  if (!cachedContent) {
+    return false;
+  }
+  return cachedContent.includes(attestationId);
+}
+
+// src/identity/github.ts
+var log6 = createLogger("identity-verification/github");
+async function verifyGitHubIdentity(attestationId, username) {
+  log6.info({ attestationId, username }, "Verifying GitHub identity");
+  try {
+    const response = await fetch(`https://api.github.com/users/${username}/gists`, {
+      headers: {
+        Accept: "application/vnd.github.v3+json"
+      }
+    });
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {
+          verified: false,
+          error: `GitHub user '${username}' not found`
+        };
+      }
+      return {
+        verified: false,
+        error: `GitHub API error: ${response.status} ${response.statusText}`
+      };
+    }
+    const gists = await response.json();
+    log6.info({ username, gistCount: gists.length }, "Fetched GitHub gists");
+    for (const gist of gists) {
+      if (gist.description?.includes(attestationId)) {
+        log6.info({ username, gistId: gist.id }, "Found attestation ID in gist description");
+        return {
+          verified: true,
+          gistUrl: gist.html_url,
+          gistId: gist.id
+        };
+      }
+      for (const [filename, file] of Object.entries(gist.files)) {
+        if (file.content && file.content.includes(attestationId)) {
+          log6.info(
+            { username, gistId: gist.id, filename },
+            "Found attestation ID in gist file"
+          );
+          return {
+            verified: true,
+            gistUrl: gist.html_url,
+            gistId: gist.id
+          };
+        }
+        try {
+          const fileResponse = await fetch(file.raw_url);
+          if (fileResponse.ok) {
+            const content = await fileResponse.text();
+            if (content.includes(attestationId)) {
+              log6.info(
+                { username, gistId: gist.id, filename },
+                "Found attestation ID in gist file (fetched)"
+              );
+              return {
+                verified: true,
+                gistUrl: gist.html_url,
+                gistId: gist.id
+              };
+            }
+          }
+        } catch (err) {
+          log6.warn({ error: err, filename }, "Failed to fetch gist file content");
+        }
+      }
+    }
+    log6.info({ username }, "No verification gist found");
+    return {
+      verified: false,
+      error: "No gist found containing the attestation ID"
+    };
+  } catch (err) {
+    log6.error({ error: err, username }, "Failed to verify GitHub identity");
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Unknown error"
+    };
+  }
+}
+function getGitHubVerificationInstructions(attestationId) {
+  return `To verify your GitHub identity:
+
+1. Go to https://gist.github.com
+2. Create a new public gist
+3. Add a file with any name (e.g., "orangecheck.txt")
+4. Paste this text into the file:
+
+   OrangeCheck Attestation Verification
+   Attestation ID: ${attestationId}
+
+5. Click "Create public gist"
+6. Return here and click "Verify" to check
+
+The verification will search your public gists for this attestation ID.`;
+}
+function generateGistTemplate(attestationId, username) {
+  return `# OrangeCheck Attestation Verification
+
+I am verifying my GitHub identity (@${username}) for OrangeCheck.
+
+**Attestation ID:** \`${attestationId}\`
+
+**Timestamp:** ${(/* @__PURE__ */ new Date()).toISOString()}
+
+This gist proves that I control both:
+- GitHub account: @${username}
+- Bitcoin address associated with attestation ${attestationId}
+
+---
+
+Learn more about OrangeCheck: https://ochk.io
+`;
+}
+function isGitHubIdentityVerified(attestationId, _username, cachedGists) {
+  return cachedGists.some((gist) => {
+    if (gist.description?.includes(attestationId)) {
+      return true;
+    }
+    return Object.values(gist.files).some((file) => file.content?.includes(attestationId));
+  });
+}
+function getGistCreationUrl() {
+  return "https://gist.github.com/";
+}
+
+// src/identity/nostr.ts
+var log7 = createLogger("identity-verification/nostr");
+function npubToHex(npub) {
+  if (npub.match(/^[0-9a-f]{64}$/i)) {
+    return npub.toLowerCase();
+  }
+  log7.warn({ npub }, "npub to hex conversion not fully implemented");
+  return npub;
+}
+async function queryNostrEvents(options) {
+  const { authors, kinds, search, relays = DEFAULT_RELAYS, limit = 100 } = options;
+  const events = [];
+  log7.info({ authors, kinds, relayCount: relays.length }, "Querying Nostr for events");
+  const queryPromises = relays.map(async (relayUrl) => {
+    let ws = null;
+    try {
+      ws = new WebSocket(relayUrl);
+      const wsRef = ws;
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          wsRef.close();
+          reject(new Error("Query timeout"));
+        }, 1e4);
+        const cleanup = () => {
+          clearTimeout(timeout);
+          wsRef.close();
+        };
+        wsRef.onopen = () => {
+          const subscriptionId = `verify_${Date.now()}`;
+          const filter = {
+            authors,
+            kinds,
+            limit
+          };
+          wsRef.send(JSON.stringify(["REQ", subscriptionId, filter]));
+        };
+        wsRef.onmessage = (msg) => {
+          try {
+            const data = JSON.parse(msg.data);
+            if (data[0] === "EVENT") {
+              const event = data[2];
+              if (search) {
+                if (event.content.includes(search)) {
+                  events.push(event);
+                }
+              } else {
+                events.push(event);
+              }
+            } else if (data[0] === "EOSE") {
+              cleanup();
+              resolve();
+            }
+          } catch (err) {
+            log7.error({ relay: relayUrl, error: err }, "Failed to parse event");
+          }
+        };
+        wsRef.onerror = (err) => {
+          log7.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          cleanup();
+          reject(err);
+        };
+        wsRef.onclose = () => {
+          clearTimeout(timeout);
+        };
+      });
+    } catch (err) {
+      log7.error({ relay: relayUrl, error: err }, "Failed to query relay");
+    } finally {
+      if (ws && ws.readyState !== WebSocket.CLOSED) {
+        ws.close();
+      }
+    }
+  });
+  await Promise.allSettled(queryPromises);
+  log7.info({ eventCount: events.length }, "Query complete");
+  return events;
+}
+async function verifyNostrEventSignature(event) {
+  if (!event.sig || event.sig.length !== 128) {
+    return false;
+  }
+  log7.warn("Nostr signature verification not fully implemented");
+  return true;
+}
+async function verifyNostrIdentity(attestationId, npub, relays) {
+  log7.info({ attestationId, npub }, "Verifying Nostr identity");
+  try {
+    const pubkeyHex = npubToHex(npub);
+    const events = await queryNostrEvents({
+      authors: [pubkeyHex],
+      kinds: [1],
+      // Text notes
+      search: attestationId,
+      relays
+    });
+    if (events.length === 0) {
+      log7.info({ npub }, "No verification events found");
+      return {
+        verified: false,
+        error: "No verification event found. User must post a note containing the attestation ID."
+      };
+    }
+    for (const event of events) {
+      if (event.content.includes(attestationId)) {
+        const isValid = await verifyNostrEventSignature(event);
+        if (isValid) {
+          log7.info({ npub, eventId: event.id }, "Nostr identity verified");
+          return {
+            verified: true,
+            event
+          };
+        } else {
+          log7.warn({ npub, eventId: event.id }, "Invalid event signature");
+        }
+      }
+    }
+    return {
+      verified: false,
+      error: "Found events but none had valid signatures"
+    };
+  } catch (err) {
+    log7.error({ error: err, npub }, "Failed to verify Nostr identity");
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Unknown error"
+    };
+  }
+}
+function getNostrVerificationInstructions(attestationId) {
+  return `To verify your Nostr identity:
+
+1. Open your Nostr client (Damus, Amethyst, Primal, etc.)
+2. Post a note containing this text:
+
+   Verifying my OrangeCheck attestation: ${attestationId}
+
+3. Wait a few seconds for the note to propagate to relays
+4. Return here and click "Verify" to check
+
+The verification will search Nostr relays for your note and confirm you control this identity.`;
+}
+function isNostrIdentityVerified(attestationId, npub, cachedEvents) {
+  const pubkeyHex = npubToHex(npub);
+  return cachedEvents.some(
+    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId)
+  );
+}
+
+// src/identity/twitter.ts
+var log8 = createLogger("identity-verification/twitter");
+async function verifyTwitterIdentity(attestationId, handle, tweetUrl) {
+  log8.info({ attestationId, handle, tweetUrl }, "Verifying Twitter identity");
+  if (!tweetUrl) {
+    return {
+      verified: false,
+      error: "Tweet URL required for verification"
+    };
+  }
+  try {
+    const tweetId = extractTweetId(tweetUrl);
+    if (!tweetId) {
+      return {
+        verified: false,
+        error: "Invalid tweet URL format"
+      };
+    }
+    log8.info({ handle, tweetId }, "Manual verification required");
+    return {
+      verified: false,
+      tweetUrl,
+      tweetId,
+      error: "Automatic verification not available. Please verify manually by checking the tweet."
+    };
+  } catch (err) {
+    log8.error({ error: err, handle }, "Failed to verify Twitter identity");
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Unknown error"
+    };
+  }
+}
+function extractTweetId(url) {
+  const patterns = [
+    /(?:twitter\.com|x\.com)\/\w+\/status\/(\d+)/,
+    /(?:mobile\.twitter\.com)\/\w+\/status\/(\d+)/
+  ];
+  for (const pattern of patterns) {
+    const match = url.match(pattern);
+    if (match && match[1]) {
+      return match[1];
+    }
+  }
+  return null;
+}
+function getTwitterVerificationInstructions(attestationId, handle) {
+  const cleanHandle = handle.startsWith("@") ? handle.slice(1) : handle;
+  return `To verify your Twitter identity (@${cleanHandle}):
+
+1. Go to https://twitter.com/compose/tweet
+2. Post a tweet with this text:
+
+   Verifying my OrangeCheck attestation: ${attestationId}
+
+3. After posting, copy the tweet URL
+4. Paste the URL below and click "Verify"
+
+Example tweet URL:
+https://twitter.com/${cleanHandle}/status/1234567890
+
+The verification will check that the tweet exists and contains the attestation ID.`;
+}
+function generateTweetText(attestationId) {
+  return `Verifying my OrangeCheck attestation: ${attestationId}
+
+Proving Bitcoin reputation with cryptographic signatures.
+
+#OrangeCheck #Bitcoin`;
+}
+function getTwitterComposeUrl(attestationId) {
+  const text = generateTweetText(attestationId);
+  const encoded = encodeURIComponent(text);
+  return `https://twitter.com/intent/tweet?text=${encoded}`;
+}
+function isValidTweetUrl(url) {
+  return extractTweetId(url) !== null;
+}
+function getTweetUrl(handle, tweetId) {
+  const cleanHandle = handle.startsWith("@") ? handle.slice(1) : handle;
+  return `https://twitter.com/${cleanHandle}/status/${tweetId}`;
+}
+function getManualVerificationInstructions(attestationId, handle, tweetUrl) {
+  return `Manual Verification Steps:
+
+1. Open this tweet: ${tweetUrl}
+2. Verify it's posted by @${handle}
+3. Check that the tweet contains: ${attestationId}
+4. Confirm the tweet is public and not deleted
+
+If all checks pass, the identity is verified.`;
+}
+
+// src/identity/index.ts
+async function verifyIdentity(attestationId, identity, options) {
+  const { protocol, identifier } = identity;
+  const rateLimitKey = `${protocol}:${identifier}`;
+  try {
+    enforceRateLimit(identityVerificationLimiter, rateLimitKey);
+  } catch (err) {
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Rate limit exceeded"
+    };
+  }
+  try {
+    switch (protocol) {
+      case "nostr":
+        return await verifyNostrIdentity(attestationId, identifier, options?.relays);
+      case "github":
+        return await verifyGitHubIdentity(attestationId, identifier);
+      case "twitter":
+        return await verifyTwitterIdentity(attestationId, identifier, options?.tweetUrl);
+      case "dns":
+        return await verifyDnsIdentity(attestationId, identifier);
+      case "email":
+        return {
+          verified: false,
+          error: "Email verification not implemented"
+        };
+      case "web":
+        return await verifyDnsIdentity(attestationId, identifier);
+      case "did":
+        return {
+          verified: false,
+          error: "DID verification not implemented"
+        };
+      default:
+        return {
+          verified: false,
+          error: `Unknown protocol: ${protocol}`
+        };
+    }
+  } catch (error) {
+    logVerificationError(
+      protocol,
+      identifier,
+      error instanceof Error ? error : new Error(String(error)),
+      {
+        attestationId
+      }
+    );
+    return {
+      verified: false,
+      error: error instanceof Error ? error.message : "Verification failed"
+    };
+  }
+}
+function getVerificationInstructions(attestationId, identity) {
+  const { protocol, identifier } = identity;
+  switch (protocol) {
+    case "nostr":
+      return getNostrVerificationInstructions(attestationId);
+    case "github":
+      return getGitHubVerificationInstructions(attestationId);
+    case "twitter":
+      return getTwitterVerificationInstructions(attestationId, identifier);
+    case "dns":
+      return getDnsVerificationInstructions(attestationId, identifier);
+    case "email":
+      return `Email verification not implemented yet.`;
+    case "web":
+      return getDnsVerificationInstructions(attestationId, identifier);
+    case "did":
+      return `DID verification not implemented yet.`;
+    default:
+      return `Unknown protocol: ${protocol}`;
+  }
+}
+function supportsAutomaticVerification(protocol) {
+  return ["nostr", "github", "dns", "web"].includes(protocol);
+}
+function requiresManualVerification(protocol) {
+  return ["twitter", "email"].includes(protocol);
+}
+async function verifyAllIdentities(attestationId, identities, options) {
+  const results = /* @__PURE__ */ new Map();
+  await Promise.all(
+    identities.map(async (identity) => {
+      const key = `${identity.protocol}:${identity.identifier}`;
+      const tweetUrl = options?.tweetUrls?.[identity.identifier];
+      const result = await verifyIdentity(attestationId, identity, {
+        tweetUrl,
+        relays: options?.relays
+      });
+      results.set(key, result);
+    })
+  );
+  return results;
+}
+function getVerificationSummary(results) {
+  let verified = 0;
+  let failed = 0;
+  let pending = 0;
+  for (const result of results.values()) {
+    if (result.verified) {
+      verified++;
+    } else if (result.error?.includes("not implemented")) {
+      pending++;
+    } else {
+      failed++;
+    }
+  }
+  return {
+    total: results.size,
+    verified,
+    failed,
+    pending
+  };
+}
+
+// src/messages.ts
+var STATUS_META = {
+  sig_ok_bip322: {
+    label: "Signature verified",
+    detail: "Your BIP-322 signature is valid and proves ownership of this address.",
+    severity: "success"
+  },
+  sig_ok_legacy: {
+    label: "Signature verified (legacy)",
+    detail: "Your legacy signature is valid and proves ownership of this address.",
+    severity: "success"
+  },
+  sig_invalid: {
+    label: "Signature verification failed",
+    detail: "The signature does not match the message and address. Common issues: (1) Message not copied exactly from Step 2, (2) Wrong wallet/address used, (3) Wallet does not support BIP-322 (Electrum does NOT support BIP-322 for SegWit addresses - use Sparrow Wallet instead). For testnet, ensure your wallet is in testnet mode.",
+    severity: "error"
+  },
+  sig_unsupported_script: {
+    label: "Wallet does not support BIP-322",
+    detail: 'Your wallet generated a legacy signature, but your SegWit address (bc1/tb1) requires BIP-322 message signing. Please use a wallet that supports BIP-322 (like Sparrow Wallet or Bitcoin Core), or switch to a P2PKH address (starting with "1" for mainnet or "m"/"n" for testnet) if your wallet only supports legacy signing.',
+    severity: "error"
+  },
+  bond_confirmed: {
+    label: "Bitcoin bond confirmed",
+    detail: "Found confirmed UTXOs on the blockchain for reputation scoring.",
+    severity: "success"
+  },
+  bond_zero: {
+    label: "No confirmed bitcoin found",
+    detail: "This address has no confirmed UTXOs. Send some bitcoin to this address and wait for confirmation to establish a reputation score.",
+    severity: "warn"
+  },
+  bond_pending: {
+    label: "Pending transactions detected",
+    detail: "This address has unconfirmed transactions. Wait for confirmations before they count toward your reputation score.",
+    severity: "info"
+  },
+  bond_insufficient: {
+    label: "Insufficient bond amount",
+    detail: "The confirmed balance is less than the declared bond amount. The bond extension requires the address to hold at least the specified amount in confirmed UTXOs.",
+    severity: "error"
+  },
+  aud_mismatch: {
+    label: "Audience mismatch",
+    detail: "The message was signed for a different audience than expected. This may be intentional or indicate the signature is being used in the wrong context.",
+    severity: "warn"
+  },
+  expired: {
+    label: "Message expired",
+    detail: "This signature has passed its expiration date. Generate a new signature with a fresh message.",
+    severity: "error"
+  },
+  network_testmode: {
+    label: "Test network detected",
+    detail: "This signature uses testnet or signet. Test networks are for development only and cannot be verified in production mode.",
+    severity: "warn"
+  },
+  bad_request: {
+    label: "Verification error",
+    detail: "Unable to verify the signature due to invalid or inconsistent data. Please ensure the address in the message matches the address you entered, and try again.",
+    severity: "error"
+  },
+  decode_error: {
+    label: "Message format error",
+    detail: "The message could not be parsed. Ensure you copied the complete canonical message from Step 2 without modifications.",
+    severity: "error"
+  },
+  invalid_scheme: {
+    label: "Unsupported signing method",
+    detail: "The signing scheme is not supported. Please use BIP-322 or legacy Bitcoin message signing.",
+    severity: "error"
+  },
+  invalid_attestation_id: {
+    label: "Invalid attestation ID",
+    detail: "The attestation ID does not match the message hash. The attestation may have been tampered with.",
+    severity: "error"
+  }
+};
+
+export { DEFAULT_RELAYS, STATUS_META, buildCanonicalMessage, check, computeScore, createAttestation, createAttestationEnvelope, createAttestationEvent, discoverAttestations, formatIdentities, generateAttestationId, generateGistTemplate, generateTweetText, generateWellKnownContent, getAttestationsForAddress, getAttestationsForIdentity, getDnsVerificationInstructions, getGistCreationUrl, getGitHubVerificationInstructions, getManualVerificationInstructions, getNostrVerificationInstructions, getTweetUrl, getTwitterComposeUrl, getTwitterVerificationInstructions, getVerificationInstructions, getVerificationSummary, getWellKnownUrl, isDnsIdentityVerified, isGitHubIdentityVerified, isNip07Available, isNostrIdentityVerified, isValidDomain, isValidTweetUrl, issueChallenge, parseAttestationFromEvent, parseIdentities, publishAttestation, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, requiresManualVerification, signNostrEvent, supportsAutomaticVerification, verify2 as verify, verifyAllIdentities, verifyAttestationById, verifyChallenge, verifyDnsIdentity, verifyGitHubIdentity, verifyIdentity, verifyNostrIdentity, verifyTwitterIdentity };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map