@orangecheck/sdk 0.1.0

package/dist/types-BJKDroFv.d.mts

@@ -0,0 +1,62 @@
+type Scheme = 'bip322' | 'legacy';
+type Network = 'mainnet' | 'testnet' | 'signet';
+type IdentityProtocol = 'nostr' | 'dns' | 'twitter' | 'github' | string;
+interface IdentityBinding {
+    protocol: string;
+    identifier: string;
+    proof?: string;
+}
+type StatusCode = 'sig_ok_bip322' | 'sig_ok_legacy' | 'sig_invalid' | 'sig_unsupported_script' | 'bond_confirmed' | 'bond_zero' | 'bond_pending' | 'bond_insufficient' | 'aud_mismatch' | 'expired' | 'network_testmode' | 'bad_request' | 'decode_error' | 'invalid_scheme' | 'invalid_attestation_id';
+interface VerifyOptions {
+    testMode?: boolean;
+    demoMode?: boolean;
+    expectedAud?: string;
+    esploraMainnetBase?: string;
+    esploraSignetBase?: string;
+    esploraTestnetBase?: string;
+}
+interface VerifyInput {
+    addr?: string;
+    msg?: string;
+    sig?: string;
+    scheme?: Scheme;
+    attestation_id?: string;
+}
+interface Metrics {
+    sats_bonded: number;
+    days_unspent: number;
+    score: number;
+}
+interface VerifyOutcome {
+    ok: boolean;
+    codes: StatusCode[];
+    network: Network;
+    attestation_id?: string;
+    identities?: IdentityBinding[];
+    metrics?: Metrics;
+}
+interface AttestationEnvelope {
+    attestation_id: string;
+    scheme: Scheme;
+    address: string;
+    identities: IdentityBinding[];
+    message: string;
+    message_b64url: string;
+    signature: string;
+    issued_at: string;
+    expires_at?: string;
+    verification_url: string;
+    publish_targets?: string[];
+    relay_hints?: string[];
+}
+interface NostrEvent {
+    kind: number;
+    tags: string[][];
+    content: string;
+    created_at: number;
+    pubkey: string;
+    id?: string;
+    sig?: string;
+}
+
+export type { AttestationEnvelope as A, IdentityBinding as I, Metrics as M, NostrEvent as N, Scheme as S, VerifyInput as V, VerifyOptions as a, VerifyOutcome as b, Network as c, StatusCode as d, IdentityProtocol as e };

package/dist/types-BJKDroFv.d.ts

@@ -0,0 +1,62 @@
+type Scheme = 'bip322' | 'legacy';
+type Network = 'mainnet' | 'testnet' | 'signet';
+type IdentityProtocol = 'nostr' | 'dns' | 'twitter' | 'github' | string;
+interface IdentityBinding {
+    protocol: string;
+    identifier: string;
+    proof?: string;
+}
+type StatusCode = 'sig_ok_bip322' | 'sig_ok_legacy' | 'sig_invalid' | 'sig_unsupported_script' | 'bond_confirmed' | 'bond_zero' | 'bond_pending' | 'bond_insufficient' | 'aud_mismatch' | 'expired' | 'network_testmode' | 'bad_request' | 'decode_error' | 'invalid_scheme' | 'invalid_attestation_id';
+interface VerifyOptions {
+    testMode?: boolean;
+    demoMode?: boolean;
+    expectedAud?: string;
+    esploraMainnetBase?: string;
+    esploraSignetBase?: string;
+    esploraTestnetBase?: string;
+}
+interface VerifyInput {
+    addr?: string;
+    msg?: string;
+    sig?: string;
+    scheme?: Scheme;
+    attestation_id?: string;
+}
+interface Metrics {
+    sats_bonded: number;
+    days_unspent: number;
+    score: number;
+}
+interface VerifyOutcome {
+    ok: boolean;
+    codes: StatusCode[];
+    network: Network;
+    attestation_id?: string;
+    identities?: IdentityBinding[];
+    metrics?: Metrics;
+}
+interface AttestationEnvelope {
+    attestation_id: string;
+    scheme: Scheme;
+    address: string;
+    identities: IdentityBinding[];
+    message: string;
+    message_b64url: string;
+    signature: string;
+    issued_at: string;
+    expires_at?: string;
+    verification_url: string;
+    publish_targets?: string[];
+    relay_hints?: string[];
+}
+interface NostrEvent {
+    kind: number;
+    tags: string[][];
+    content: string;
+    created_at: number;
+    pubkey: string;
+    id?: string;
+    sig?: string;
+}
+
+export type { AttestationEnvelope as A, IdentityBinding as I, Metrics as M, NostrEvent as N, Scheme as S, VerifyInput as V, VerifyOptions as a, VerifyOutcome as b, Network as c, StatusCode as d, IdentityProtocol as e };

package/dist/verify.d.mts

@@ -0,0 +1,6 @@
+export { ScoringAlgorithm, computeAllScores, computeScore } from './scoring.mjs';
+import { V as VerifyInput, a as VerifyOptions, b as VerifyOutcome } from './types-BJKDroFv.mjs';
+
+declare function verify(input: VerifyInput, opts?: VerifyOptions): Promise<VerifyOutcome>;
+
+export { verify };

package/dist/verify.d.ts

@@ -0,0 +1,6 @@
+export { ScoringAlgorithm, computeAllScores, computeScore } from './scoring.js';
+import { V as VerifyInput, a as VerifyOptions, b as VerifyOutcome } from './types-BJKDroFv.js';
+
+declare function verify(input: VerifyInput, opts?: VerifyOptions): Promise<VerifyOutcome>;
+
+export { verify };

package/dist/verify.js

@@ -0,0 +1,509 @@
+'use strict';
+
+var buffer = require('buffer');
+var bip322Js = require('bip322-js');
+var bitcoinMessage = require('bitcoinjs-message');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var bitcoinMessage__namespace = /*#__PURE__*/_interopNamespace(bitcoinMessage);
+
+// src/verify.ts
+
+// src/canonical.ts
+function toLowerHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function parseIdentities(identitiesStr) {
+  if (!identitiesStr || identitiesStr.trim() === "") {
+    return [];
+  }
+  return identitiesStr.split(",").map((binding) => {
+    const colonIndex = binding.indexOf(":");
+    if (colonIndex === -1) {
+      throw new Error(`Invalid identity binding format: ${binding}`);
+    }
+    return {
+      protocol: binding.substring(0, colonIndex).trim(),
+      identifier: binding.substring(colonIndex + 1).trim()
+    };
+  }).filter((binding) => binding.protocol && binding.identifier);
+}
+async function generateAttestationId(message) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(message);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return toLowerHex(new Uint8Array(hashBuffer));
+}
+
+// src/scoring.ts
+function scoreV0(sats, days) {
+  if (sats <= 0 || days <= 0) return 0;
+  return Math.round(Math.log(1 + sats) * (1 + days / 30) * 100) / 100;
+}
+function scoreTier(sats, days) {
+  if (sats >= 1e7 && days >= 365) return "platinum";
+  if (sats >= 1e6 && days >= 180) return "gold";
+  if (sats >= 1e5 && days >= 90) return "silver";
+  if (sats >= 1e4 && days >= 30) return "bronze";
+  return "none";
+}
+function computeScore(sats, days, config) {
+  switch (config.algorithm) {
+    case "v0":
+      return scoreV0(sats, days);
+    case "tier":
+      return scoreTier(sats, days);
+    case "none":
+      return null;
+  }
+}
+function computeAllScores(sats, days) {
+  return { v0: scoreV0(sats, days), tier: scoreTier(sats, days) };
+}
+function createLogger(namespace) {
+  const shouldLog = (level) => {
+    return false;
+  };
+  const formatMessage = (msg) => `[${namespace}] ${msg}`;
+  return {
+    debug: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.debug(formatMessage(contextOrMessage));
+        } else {
+          console.debug(formatMessage(message ?? "Debug"), contextOrMessage);
+        }
+      }
+    },
+    info: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.info(formatMessage(contextOrMessage));
+        } else {
+          console.info(formatMessage(message ?? "Info"), contextOrMessage);
+        }
+      }
+    },
+    warn: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.warn(formatMessage(contextOrMessage));
+        } else {
+          console.warn(formatMessage(message ?? "Warning"), contextOrMessage);
+        }
+      }
+    },
+    error: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.error(formatMessage(contextOrMessage));
+        } else {
+          console.error(formatMessage(message ?? "Error"), contextOrMessage);
+        }
+      }
+    }
+  };
+}
+
+// src/verify.ts
+var log = createLogger("ocp/verify");
+function scoreV02(sats, days) {
+  return computeScore(sats, days, { algorithm: "v0" });
+}
+function looksLikeHex(s) {
+  return /^[0-9a-fA-F]+$/.test(s) && s.length % 2 === 0;
+}
+function toBase64Maybe(sig) {
+  if (looksLikeHex(sig)) {
+    return buffer.Buffer.from(sig, "hex").toString("base64");
+  }
+  return sig;
+}
+function detectSignatureScheme(addr, sig) {
+  const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+  if (isSegWit) {
+    return "bip322";
+  }
+  const sigBase64 = toBase64Maybe(sig);
+  const looksLikeLegacy = sigBase64.length === 88 && /^[IHG]/.test(sigBase64);
+  if (looksLikeLegacy) {
+    return "legacy";
+  }
+  return "bip322";
+}
+async function verifySignature({
+  addr,
+  msg,
+  sig,
+  scheme
+}) {
+  try {
+    if (sig === "demo_signature") {
+      log.warn("Demo signature detected in verifySignature - should be handled by demo mode");
+      return "sig_invalid";
+    }
+    const detectedScheme = scheme || detectSignatureScheme(addr, sig);
+    log.debug(
+      { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
+      "Verifying signature"
+    );
+    if (detectedScheme === "bip322") {
+      const sigBase64 = toBase64Maybe(sig);
+      log.debug(
+        { sigBase64: sigBase64.substring(0, 50) + "..." },
+        "Signature converted to base64"
+      );
+      log.debug(
+        {
+          msgFull: msg,
+          msgLines: msg.split("\n").length,
+          msgFirstLine: msg.split("\n")[0],
+          msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
+        },
+        "Message being verified"
+      );
+      const ok = bip322Js.Verifier.verifySignature(addr, msg, sigBase64);
+      log.info({ addr, ok }, "BIP-322 verification result");
+      if (!ok) {
+        const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+        if (isSegWit && sigBase64.length === 88) {
+          log.warn(
+            { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
+            "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
+          );
+        } else {
+          log.error(
+            {
+              addr,
+              sigLength: sigBase64.length,
+              msgLength: msg.length,
+              msgPreview: msg.substring(0, 200)
+            },
+            "BIP-322 verification failed - signature does not match message"
+          );
+        }
+      }
+      return ok ? "sig_ok_bip322" : "sig_invalid";
+    }
+    if (detectedScheme === "legacy") {
+      const sigBase64 = toBase64Maybe(sig);
+      if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
+        log.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
+        return "sig_unsupported_script";
+      }
+      log.debug(
+        {
+          addr,
+          sigBase64: sigBase64.substring(0, 50) + "...",
+          msgPreview: msg.substring(0, 100) + "...",
+          msgLength: msg.length
+        },
+        "Verifying legacy signature"
+      );
+      const ok = bitcoinMessage__namespace.verify(msg, addr, sigBase64);
+      log.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
+      if (!ok) {
+        log.error(
+          {
+            addr,
+            msgFirstLine: msg.split("\n")[0],
+            sigFormat: sigBase64.substring(0, 10)
+          },
+          "Legacy signature verification failed - check message format and signature"
+        );
+      }
+      return ok ? "sig_ok_legacy" : "sig_invalid";
+    }
+    return "invalid_scheme";
+  } catch (err) {
+    log.error(
+      { addr, error: err instanceof Error ? err.message : String(err) },
+      "Signature verification error"
+    );
+    return "sig_invalid";
+  }
+}
+function parseCanonicalMessage(msg) {
+  const lines = msg.split("\n").map((l) => l.trim());
+  const getVal = (prefix) => lines.find((l) => l.toLowerCase().startsWith(prefix + ":"))?.split(":", 2)[1]?.trim();
+  const address = getVal("address") || "";
+  const identitiesStr = getVal("identities") || "";
+  let identities = [];
+  try {
+    identities = parseIdentities(identitiesStr);
+  } catch (err) {
+    log.warn({ identitiesStr, error: err }, "Failed to parse identities field");
+  }
+  const coreKeys = /* @__PURE__ */ new Set([
+    "orangecheck",
+    "identities",
+    "address",
+    "purpose",
+    "nonce",
+    "issued_at",
+    "ack"
+  ]);
+  const extensions = {};
+  for (const line of lines) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const key = line.slice(0, idx).trim().toLowerCase();
+    const val = line.slice(idx + 1).trim();
+    if (!coreKeys.has(key) && val) extensions[key] = val;
+  }
+  const network = extensions["network"] || "mainnet";
+  const bondStr = extensions["bond"];
+  const bond = bondStr ? parseInt(bondStr, 10) : void 0;
+  return {
+    core: { address, identities },
+    network,
+    extensions,
+    bond: bond !== void 0 && !isNaN(bond) && bond > 0 ? bond : void 0
+  };
+}
+async function getAddressUtxos(address, network, opts) {
+  const endpoints = network === "signet" ? [
+    opts?.esploraSignetBase || "https://mempool.space/signet/api",
+    "https://blockstream.info/signet/api"
+  ] : network === "testnet" ? [
+    opts?.esploraTestnetBase || "https://mempool.space/testnet/api",
+    "https://blockstream.info/testnet/api"
+  ] : [
+    opts?.esploraMainnetBase || "https://mempool.space/api",
+    "https://blockstream.info/api"
+  ];
+  let lastError = null;
+  for (const base of endpoints) {
+    try {
+      const url = `${base}/address/${address}/utxo`;
+      log.debug({ url, network }, "Fetching UTXOs");
+      const resp = await fetch(url, {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(1e4)
+        // 10s timeout
+      });
+      if (!resp.ok) {
+        throw new Error(`HTTP ${resp.status}`);
+      }
+      const data = await resp.json();
+      if (!Array.isArray(data)) {
+        throw new Error("Invalid response: expected array");
+      }
+      for (const utxo of data) {
+        if (typeof utxo.value !== "number" || typeof utxo.status !== "object" || typeof utxo.status.confirmed !== "boolean" || typeof utxo.txid !== "string" || typeof utxo.vout !== "number") {
+          throw new Error("Invalid UTXO structure");
+        }
+      }
+      log.info({ base, count: data.length, network }, "UTXOs fetched successfully");
+      return data;
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      log.warn(
+        { base, error: lastError.message, network },
+        "Esplora endpoint failed, trying next"
+      );
+    }
+  }
+  log.error({ endpoints, error: lastError?.message, network }, "All Esplora endpoints failed");
+  throw new Error(`esplora_all_failed: ${lastError?.message || "unknown"}`);
+}
+function computeMetrics(utxos, bondAmount) {
+  const confirmedUtxos = utxos.filter((u) => u.status.confirmed);
+  if (confirmedUtxos.length === 0) {
+    return { sats_bonded: 0, days_unspent: 0, confirmed_balance: 0 };
+  }
+  const confirmed_balance = confirmedUtxos.reduce((sum, u) => sum + u.value, 0);
+  if (bondAmount !== void 0 && bondAmount > 0) {
+    const sorted = [...confirmedUtxos].sort((a, b) => {
+      const heightA = a.status.block_height ?? Infinity;
+      const heightB = b.status.block_height ?? Infinity;
+      if (heightA !== heightB) return heightA - heightB;
+      if (a.txid !== b.txid) return a.txid.localeCompare(b.txid);
+      return a.vout - b.vout;
+    });
+    let sum = 0;
+    let youngestTime = 0;
+    for (const utxo of sorted) {
+      sum += utxo.value;
+      youngestTime = Math.max(youngestTime, utxo.status.block_time || 0);
+      if (sum >= bondAmount) break;
+    }
+    const days_unspent2 = Math.max(
+      0,
+      Math.floor((Date.now() / 1e3 - youngestTime) / (24 * 60 * 60))
+    );
+    return {
+      sats_bonded: bondAmount,
+      // Use exactly bond amount (ignore surplus)
+      days_unspent: days_unspent2,
+      confirmed_balance
+    };
+  }
+  const sats_bonded = confirmed_balance;
+  const oldestTime = Math.min(
+    ...confirmedUtxos.map((u) => u.status.block_time || Date.now() / 1e3)
+  );
+  const days_unspent = Math.max(0, Math.floor((Date.now() / 1e3 - oldestTime) / (24 * 60 * 60)));
+  return { sats_bonded, days_unspent, confirmed_balance };
+}
+async function verify2(input, opts = {}) {
+  const codes = [];
+  let network = "mainnet";
+  try {
+    if (!input.msg || !input.addr || !input.sig) {
+      codes.push("bad_request");
+      return { ok: false, codes, network };
+    }
+    const parsed = parseCanonicalMessage(input.msg);
+    network = parsed.network || "mainnet";
+    const attestation_id = await generateAttestationId(input.msg);
+    if (parsed.core.address !== input.addr) {
+      codes.push("bad_request");
+      return { ok: false, codes, network, attestation_id };
+    }
+    if (opts.demoMode) {
+      const sats_bonded = 1e6;
+      const days_unspent = 90;
+      const metrics = {
+        sats_bonded,
+        days_unspent,
+        score: scoreV02(sats_bonded, days_unspent)
+        // ≈ 55.26
+      };
+      codes.push("sig_ok_bip322");
+      codes.push("bond_confirmed");
+      return {
+        ok: true,
+        codes,
+        network,
+        attestation_id,
+        identities: parsed.core.identities,
+        metrics
+      };
+    }
+    if ((network === "testnet" || network === "signet") && !opts.testMode) {
+      codes.push("network_testmode");
+      return { ok: false, codes, network, attestation_id };
+    }
+    if (opts.expectedAud && parsed.extensions["aud"] && parsed.extensions["aud"] !== opts.expectedAud) {
+      codes.push("aud_mismatch");
+    }
+    if (parsed.extensions["expires"]) {
+      const exp = Date.parse(parsed.extensions["expires"]);
+      if (!Number.isNaN(exp) && exp < Date.now()) {
+        codes.push("expired");
+      }
+    }
+    const sigCode = await verifySignature({
+      addr: input.addr,
+      msg: input.msg,
+      sig: input.sig,
+      ...input.scheme && { scheme: input.scheme }
+    });
+    codes.push(sigCode);
+    const sigOk = sigCode === "sig_ok_bip322" || sigCode === "sig_ok_legacy";
+    if (!sigOk) {
+      return {
+        ok: false,
+        codes,
+        network,
+        attestation_id,
+        identities: parsed.core.identities
+      };
+    }
+    try {
+      const utxos = await getAddressUtxos(input.addr, network, {
+        esploraMainnetBase: opts.esploraMainnetBase,
+        esploraSignetBase: opts.esploraSignetBase
+      });
+      const { sats_bonded, days_unspent, confirmed_balance } = computeMetrics(
+        utxos,
+        parsed.bond
+      );
+      if (parsed.bond !== void 0 && parsed.bond > 0) {
+        if (confirmed_balance < parsed.bond) {
+          codes.push("bond_insufficient");
+          log.warn(
+            {
+              bond: parsed.bond,
+              confirmed_balance,
+              address: input.addr
+            },
+            "Bond extension: insufficient balance"
+          );
+          return {
+            ok: false,
+            codes,
+            network,
+            attestation_id,
+            identities: parsed.core.identities
+          };
+        }
+      }
+      if (sats_bonded <= 0) {
+        codes.push("bond_zero");
+        if (utxos.some((u) => !u.status.confirmed)) {
+          codes.push("bond_pending");
+        }
+        return {
+          ok: false,
+          codes,
+          network,
+          attestation_id,
+          identities: parsed.core.identities
+        };
+      } else {
+        codes.push("bond_confirmed");
+      }
+      const metrics = {
+        sats_bonded,
+        days_unspent,
+        score: scoreV02(sats_bonded, days_unspent)
+      };
+      return {
+        ok: true,
+        codes,
+        network,
+        attestation_id,
+        identities: parsed.core.identities,
+        metrics
+      };
+    } catch (utxoError) {
+      console.error("UTXO fetch failed:", utxoError);
+      codes.push("bad_request");
+      return { ok: false, codes, network, attestation_id };
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e ?? "decode_error");
+    if (msg === "decode_error") {
+      codes.push("decode_error");
+    } else {
+      codes.push("bad_request");
+    }
+    return { ok: false, codes, network };
+  }
+}
+
+exports.computeAllScores = computeAllScores;
+exports.computeScore = computeScore;
+exports.verify = verify2;
+//# sourceMappingURL=verify.js.map
+//# sourceMappingURL=verify.js.map