@orangecheck/sdk 0.1.0

package/dist/challenge.js

@@ -0,0 +1,169 @@
+'use strict';
+
+var buffer = require('buffer');
+var bip322Js = require('bip322-js');
+var bitcoinMessage = require('bitcoinjs-message');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var bitcoinMessage__namespace = /*#__PURE__*/_interopNamespace(bitcoinMessage);
+
+// src/challenge.ts
+var AUTH_HEADER = "orangecheck-auth";
+var AUTH_ACK = "I authorize this session under the OrangeCheck auth challenge.";
+function randomNonce() {
+  const bytes = new Uint8Array(16);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function iso(date) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function issueChallenge(opts) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const ttl = opts.ttlSeconds ?? 300;
+  const expiresAt = new Date(now.getTime() + ttl * 1e3);
+  const nonce = opts.nonce ?? randomNonce();
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    throw new Error("nonce must be 32 lowercase hex characters");
+  }
+  const coreLines = [
+    AUTH_HEADER,
+    `address: ${opts.address}`,
+    `nonce: ${nonce}`,
+    `issued_at: ${iso(now)}`,
+    `expires_at: ${iso(expiresAt)}`,
+    `ack: ${AUTH_ACK}`
+  ];
+  const extensions = [];
+  if (opts.audience) extensions.push(["audience", opts.audience]);
+  if (opts.purpose) extensions.push(["purpose", opts.purpose]);
+  extensions.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const extLines = extensions.map(([k, v]) => `${k}: ${v}`);
+  const message = [...coreLines, ...extLines].join("\n") + "\n";
+  return {
+    message,
+    nonce,
+    expiresAt: expiresAt.getTime(),
+    expiresAtIso: iso(expiresAt)
+  };
+}
+function parseChallenge(message) {
+  const lines = message.endsWith("\n") ? message.slice(0, -1).split("\n") : message.split("\n");
+  if (lines[0] !== AUTH_HEADER) {
+    throw new Error("not an orangecheck-auth challenge");
+  }
+  const out = { extensions: [] };
+  const coreKeys = /* @__PURE__ */ new Set(["address", "nonce", "issued_at", "expires_at", "ack"]);
+  let seenCore = 0;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const sep = line.indexOf(": ");
+    if (sep === -1) continue;
+    const key = line.slice(0, sep);
+    const val = line.slice(sep + 2);
+    if (coreKeys.has(key)) {
+      seenCore++;
+      if (key === "address") out.address = val;
+      else if (key === "nonce") out.nonce = val;
+      else if (key === "issued_at") out.issuedAt = new Date(val);
+      else if (key === "expires_at") out.expiresAt = new Date(val);
+      else if (key === "ack") out.ack = val;
+    } else {
+      out.extensions.push([key, val]);
+      if (key === "audience") out.audience = val;
+      if (key === "purpose") out.purpose = val;
+    }
+  }
+  if (seenCore !== 5) {
+    throw new Error(`challenge missing core lines (${seenCore}/5)`);
+  }
+  return out;
+}
+async function verifyChallenge(opts) {
+  let parsed;
+  try {
+    parsed = parseChallenge(opts.message);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;
+  if (!address || !nonce || !issuedAt || !expiresAt || !ack) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (ack !== AUTH_ACK) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const skew = opts.clockSkewMs ?? 0;
+  if (now.getTime() - skew > expiresAt.getTime()) {
+    return { ok: false, reason: "expired" };
+  }
+  if (now.getTime() + skew < issuedAt.getTime()) {
+    return { ok: false, reason: "not_yet_valid" };
+  }
+  if (opts.expectedNonce && nonce !== opts.expectedNonce) {
+    return { ok: false, reason: "nonce_mismatch" };
+  }
+  if (opts.expectedAudience && audience !== opts.expectedAudience) {
+    return { ok: false, reason: "audience_mismatch" };
+  }
+  if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {
+    return { ok: false, reason: "purpose_mismatch" };
+  }
+  const scheme = opts.scheme ?? "bip322";
+  let sigValid = false;
+  try {
+    if (scheme === "bip322") {
+      const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? buffer.Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
+      sigValid = bip322Js.Verifier.verifySignature(address, opts.message, sigBase64);
+    } else if (scheme === "legacy") {
+      if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
+        return { ok: false, reason: "sig_unsupported_scheme" };
+      }
+      sigValid = bitcoinMessage__namespace.verify(opts.message, address, opts.signature);
+    } else {
+      return { ok: false, reason: "sig_unsupported_scheme" };
+    }
+  } catch {
+    sigValid = false;
+  }
+  if (!sigValid) return { ok: false, reason: "sig_invalid" };
+  return {
+    ok: true,
+    reason: "ok",
+    address,
+    expiresAt: expiresAt.getTime(),
+    nonce,
+    ...audience !== void 0 ? { audience } : {},
+    ...purpose !== void 0 ? { purpose } : {}
+  };
+}
+
+exports.issueChallenge = issueChallenge;
+exports.verifyChallenge = verifyChallenge;
+//# sourceMappingURL=challenge.js.map
+//# sourceMappingURL=challenge.js.map

package/dist/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/challenge.ts"],"names":["Buffer","Verifier","bitcoinMessage"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAM,WAAA,GAAc,kBAAA;AACpB,IAAM,QAAA,GAAW,gEAAA;AAEjB,SAAS,WAAA,GAAsB;AAE3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAE/B,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,EAAQ,eAAA,KAAoB,UAAA,EAAY;AAC1D,IAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAAA,EAC3C,CAAA,MAAO;AAGH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5E;AAEA,SAAS,IAAI,IAAA,EAAoB;AAC7B,EAAA,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AACtD;AAiCO,SAAS,eAAe,IAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,GAAA,GAAM,KAAK,UAAA,IAAc,GAAA;AAC/B,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,IAAI,OAAA,EAAQ,GAAI,MAAM,GAAI,CAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,WAAA,EAAY;AAExC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,SAAA,GAAY;AAAA,IACd,WAAA;AAAA,IACA,CAAA,SAAA,EAAY,KAAK,OAAO,CAAA,CAAA;AAAA,IACxB,UAAU,KAAK,CAAA,CAAA;AAAA,IACf,CAAA,WAAA,EAAc,GAAA,CAAI,GAAG,CAAC,CAAA,CAAA;AAAA,IACtB,CAAA,YAAA,EAAe,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC7B,QAAQ,QAAQ,CAAA;AAAA,GACpB;AAEA,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,CAAW,IAAA,CAAK,CAAC,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,EAAW,IAAA,CAAK,OAAO,CAAC,CAAA;AAE3D,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,IAAI,CAAE,CAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,EAAW,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAEzD,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,YAAA,EAAc,IAAI,SAAS;AAAA,GAC/B;AACJ;AAaA,SAAS,eAAe,OAAA,EAAkC;AACtD,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,QAAA,CAAS,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,KAAA,CAAM,IAAI,CAAA,GAAI,OAAA,CAAQ,MAAM,IAAI,CAAA;AAE5F,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,WAAA,EAAa;AAC1B,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,GAAA,GAAuB,EAAE,UAAA,EAAY,EAAC,EAAE;AAC9C,EAAA,MAAM,QAAA,uBAAe,GAAA,CAAI,CAAC,WAAW,OAAA,EAAS,WAAA,EAAa,YAAA,EAAc,KAAK,CAAC,CAAA;AAC/E,EAAA,IAAI,QAAA,GAAW,CAAA;AAEf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAE9B,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,MAAA,QAAA,EAAA;AACA,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,WAAA,IAC5B,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,KAAA,GAAQ,GAAA;AAAA,WAAA,IAC7B,QAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,GAAW,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAChD,QAAQ,YAAA,EAAc,GAAA,CAAI,SAAA,GAAY,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAClD,GAAA,KAAQ,KAAA,EAAO,GAAA,CAAI,GAAA,GAAM,GAAA;AAAA,IACtC,CAAA,MAAO;AACH,MAAA,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC9B,MAAA,IAAI,GAAA,KAAQ,UAAA,EAAY,GAAA,CAAI,QAAA,GAAW,GAAA;AACvC,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,IACzC;AAAA,EACJ;AAEA,EAAA,IAAI,aAAa,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,QAAQ,CAAA,GAAA,CAAK,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,GAAA;AACX;AA0DA,eAAsB,gBAClB,IAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,cAAA,CAAe,KAAK,OAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,EAAE,SAAS,KAAA,EAAO,QAAA,EAAU,WAAW,GAAA,EAAK,QAAA,EAAU,SAAQ,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,WAAW,CAAC,KAAA,IAAS,CAAC,QAAA,IAAY,CAAC,SAAA,IAAa,CAAC,GAAA,EAAK;AACvD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,QAAQ,QAAA,EAAU;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,IAAe,CAAA;AAEjC,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,SAAA,CAAU,SAAQ,EAAG;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAU;AAAA,EAC1C;AACA,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,QAAA,CAAS,SAAQ,EAAG;AAC3C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,EAChD;AAEA,EAAA,IAAI,IAAA,CAAK,aAAA,IAAiB,KAAA,KAAU,IAAA,CAAK,aAAA,EAAe;AACpD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,QAAA,KAAa,IAAA,CAAK,gBAAA,EAAkB;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACpD;AACA,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,OAAA,KAAY,IAAA,CAAK,eAAA,EAAiB;AAC1D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACnD;AAEA,EAAA,MAAM,MAAA,GAAiB,KAAK,MAAA,IAAU,QAAA;AACtC,EAAA,IAAI,QAAA,GAAW,KAAA;AAEf,EAAA,IAAI;AACA,IAAA,IAAI,WAAW,QAAA,EAAU;AACrB,MAAA,MAAM,SAAA,GACF,iBAAiB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,IAAK,IAAA,CAAK,UAAU,MAAA,GAAS,CAAA,KAAM,IACjEA,aAAA,CAAO,IAAA,CAAK,KAAK,SAAA,EAAW,KAAK,EAAE,QAAA,CAAS,QAAQ,IACpD,IAAA,CAAK,SAAA;AACf,MAAA,QAAA,GAAWC,iBAAA,CAAS,eAAA,CAAgB,OAAA,EAAS,IAAA,CAAK,SAAS,SAAS,CAAA;AAAA,IACxE,CAAA,MAAA,IAAW,WAAW,QAAA,EAAU;AAE5B,MAAA,IAAI,CAAC,mCAAA,CAAoC,IAAA,CAAK,OAAO,CAAA,EAAG;AACpD,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,MACzD;AACA,MAAA,QAAA,GAA0BC,yBAAA,CAAA,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,OAAA,EAAS,KAAK,SAAS,CAAA;AAAA,IAC1E,CAAA,MAAO;AACH,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,IACzD;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,QAAA,GAAW,KAAA;AAAA,EACf;AAEA,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AAEzD,EAAA,OAAO;AAAA,IACH,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,KAAA;AAAA,IACA,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC/C;AACJ","file":"challenge.js","sourcesContent":["/**\n * Signed-challenge auth\n *\n * When a gate can't trust the address source (public header, query string,\n * unsigned cookie), run a one-shot BIP-322 challenge first to cryptographically\n * prove the caller controls the address. Bind the proven address to a session\n * cookie or JWT, and the gate reads from there.\n *\n * This is a different wire format from the main OCP attestation — the header\n * literal is `orangecheck-auth`, not `orangecheck`, so a signed auth challenge\n * can never be confused with a reputation attestation.\n *\n *   // Server, on the \"connect wallet\" flow:\n *   const challenge = issueChallenge({ address, ttlSeconds: 300 });\n *   // → send challenge.message to the client\n *\n *   // Client signs challenge.message with BIP-322 via the user's wallet,\n *   // then posts { message, signature } back.\n *\n *   // Server, on callback:\n *   const result = await verifyChallenge({ message, signature });\n *   if (result.ok) {\n *     // result.address is now cryptographically proven; attach to session.\n *   }\n */\n\nimport type { Scheme } from './types';\n\nimport { Buffer } from 'buffer';\n\nimport { Verifier } from 'bip322-js';\nimport * as bitcoinMessage from 'bitcoinjs-message';\n\nconst AUTH_HEADER = 'orangecheck-auth';\nconst AUTH_ACK = 'I authorize this session under the OrangeCheck auth challenge.';\n\nfunction randomNonce(): string {\n    // 16 bytes → 32 lowercase hex chars. Matches OCP core nonce format.\n    const bytes = new Uint8Array(16);\n    // Runtimes: Node 20+ (webcrypto), browsers.\n    if (typeof globalThis.crypto?.getRandomValues === 'function') {\n        globalThis.crypto.getRandomValues(bytes);\n    } else {\n        // Fallback: Math.random is *not* cryptographic — acceptable only for\n        // environments without webcrypto (old Node). Flagged explicitly.\n        for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);\n    }\n    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nfunction iso(date: Date): string {\n    return date.toISOString().replace(/\\.\\d{3}Z$/, 'Z');\n}\n\nexport interface IssueChallengeOptions {\n    /** Bitcoin address the caller claims to control. */\n    address: string;\n    /** How long the challenge is valid for. Default 300 (5 minutes). */\n    ttlSeconds?: number;\n    /** Explicit nonce. Rare; prefer auto-generated. */\n    nonce?: string;\n    /** Origin-binding extension. If set, verify will require a match. */\n    audience?: string;\n    /** Human-readable label baked into the signed message. */\n    purpose?: string;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport interface Challenge {\n    /** The canonical text the client MUST sign. */\n    message: string;\n    /** The generated nonce (kept for correlation / server-side storage). */\n    nonce: string;\n    /** Unix ms epoch the challenge expires at. */\n    expiresAt: number;\n    /** ISO string of the same. */\n    expiresAtIso: string;\n}\n\n/**\n * Build a new signed-challenge message. The server MUST remember the nonce\n * it issued against the session (Redis, signed cookie, DB) so it can detect\n * replay or a different nonce coming back on verify.\n */\nexport function issueChallenge(opts: IssueChallengeOptions): Challenge {\n    const now = opts.now ?? new Date();\n    const ttl = opts.ttlSeconds ?? 300;\n    const expiresAt = new Date(now.getTime() + ttl * 1000);\n    const nonce = opts.nonce ?? randomNonce();\n\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('nonce must be 32 lowercase hex characters');\n    }\n\n    const coreLines = [\n        AUTH_HEADER,\n        `address: ${opts.address}`,\n        `nonce: ${nonce}`,\n        `issued_at: ${iso(now)}`,\n        `expires_at: ${iso(expiresAt)}`,\n        `ack: ${AUTH_ACK}`,\n    ];\n\n    const extensions: Array<[string, string]> = [];\n    if (opts.audience) extensions.push(['audience', opts.audience]);\n    if (opts.purpose) extensions.push(['purpose', opts.purpose]);\n    // Lexicographic sort by key — matches OCP canonicalization rules.\n    extensions.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n\n    const extLines = extensions.map(([k, v]) => `${k}: ${v}`);\n    const message = [...coreLines, ...extLines].join('\\n') + '\\n';\n\n    return {\n        message,\n        nonce,\n        expiresAt: expiresAt.getTime(),\n        expiresAtIso: iso(expiresAt),\n    };\n}\n\ninterface ParsedChallenge {\n    address?: string;\n    nonce?: string;\n    issuedAt?: Date;\n    expiresAt?: Date;\n    ack?: string;\n    audience?: string;\n    purpose?: string;\n    extensions: Array<[string, string]>;\n}\n\nfunction parseChallenge(message: string): ParsedChallenge {\n    const lines = message.endsWith('\\n') ? message.slice(0, -1).split('\\n') : message.split('\\n');\n\n    if (lines[0] !== AUTH_HEADER) {\n        throw new Error('not an orangecheck-auth challenge');\n    }\n\n    const out: ParsedChallenge = { extensions: [] };\n    const coreKeys = new Set(['address', 'nonce', 'issued_at', 'expires_at', 'ack']);\n    let seenCore = 0;\n\n    for (let i = 1; i < lines.length; i++) {\n        const line = lines[i] ?? '';\n        const sep = line.indexOf(': ');\n        if (sep === -1) continue;\n        const key = line.slice(0, sep);\n        const val = line.slice(sep + 2);\n\n        if (coreKeys.has(key)) {\n            seenCore++;\n            if (key === 'address') out.address = val;\n            else if (key === 'nonce') out.nonce = val;\n            else if (key === 'issued_at') out.issuedAt = new Date(val);\n            else if (key === 'expires_at') out.expiresAt = new Date(val);\n            else if (key === 'ack') out.ack = val;\n        } else {\n            out.extensions.push([key, val]);\n            if (key === 'audience') out.audience = val;\n            if (key === 'purpose') out.purpose = val;\n        }\n    }\n\n    if (seenCore !== 5) {\n        throw new Error(`challenge missing core lines (${seenCore}/5)`);\n    }\n    return out;\n}\n\nexport interface VerifyChallengeOptions {\n    /** The signed canonical challenge text, exactly as issued. */\n    message: string;\n    /** BIP-322 or legacy signature. */\n    signature: string;\n    /** Scheme override. Default 'bip322'. */\n    scheme?: Scheme;\n\n    /** If set, require the challenge's `audience:` extension to match. */\n    expectedAudience?: string;\n    /** If set, require the challenge's `purpose:` extension to match. */\n    expectedPurpose?: string;\n    /**\n     * If set, require the challenge's `nonce:` to match. Use this to defeat\n     * replay — pair with server-side nonce storage (Redis / signed cookie).\n     */\n    expectedNonce?: string;\n\n    /** Tolerance on expiry check in ms. Default 0. */\n    clockSkewMs?: number;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport type VerifyChallengeReason =\n    | 'ok'\n    | 'malformed'\n    | 'expired'\n    | 'not_yet_valid'\n    | 'sig_invalid'\n    | 'sig_unsupported_scheme'\n    | 'audience_mismatch'\n    | 'purpose_mismatch'\n    | 'nonce_mismatch';\n\nexport interface VerifyChallengeResult {\n    ok: boolean;\n    reason: VerifyChallengeReason;\n    /** Present on success — the cryptographically proven Bitcoin address. */\n    address?: string;\n    /** Present on success — when the challenge expires (unix ms). */\n    expiresAt?: number;\n    /** Present on success — the nonce from the challenge. */\n    nonce?: string;\n    /** Present on success — the audience extension, if any. */\n    audience?: string;\n    /** Present on success — the purpose extension, if any. */\n    purpose?: string;\n}\n\n/**\n * Verify a signed challenge. Returns the proven address on success.\n *\n * The caller is responsible for nonce replay prevention — pass `expectedNonce`\n * with the value you stashed at issue time.\n */\nexport async function verifyChallenge(\n    opts: VerifyChallengeOptions\n): Promise<VerifyChallengeResult> {\n    let parsed: ParsedChallenge;\n    try {\n        parsed = parseChallenge(opts.message);\n    } catch {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;\n    if (!address || !nonce || !issuedAt || !expiresAt || !ack) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (ack !== AUTH_ACK) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const now = opts.now ?? new Date();\n    const skew = opts.clockSkewMs ?? 0;\n\n    if (now.getTime() - skew > expiresAt.getTime()) {\n        return { ok: false, reason: 'expired' };\n    }\n    if (now.getTime() + skew < issuedAt.getTime()) {\n        return { ok: false, reason: 'not_yet_valid' };\n    }\n\n    if (opts.expectedNonce && nonce !== opts.expectedNonce) {\n        return { ok: false, reason: 'nonce_mismatch' };\n    }\n    if (opts.expectedAudience && audience !== opts.expectedAudience) {\n        return { ok: false, reason: 'audience_mismatch' };\n    }\n    if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {\n        return { ok: false, reason: 'purpose_mismatch' };\n    }\n\n    const scheme: Scheme = opts.scheme ?? 'bip322';\n    let sigValid = false;\n\n    try {\n        if (scheme === 'bip322') {\n            const sigBase64 =\n                /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0\n                    ? Buffer.from(opts.signature, 'hex').toString('base64')\n                    : opts.signature;\n            sigValid = Verifier.verifySignature(address, opts.message, sigBase64);\n        } else if (scheme === 'legacy') {\n            // Legacy signmessage only works for P2PKH addresses.\n            if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {\n                return { ok: false, reason: 'sig_unsupported_scheme' };\n            }\n            sigValid = bitcoinMessage.verify(opts.message, address, opts.signature);\n        } else {\n            return { ok: false, reason: 'sig_unsupported_scheme' };\n        }\n    } catch {\n        sigValid = false;\n    }\n\n    if (!sigValid) return { ok: false, reason: 'sig_invalid' };\n\n    return {\n        ok: true,\n        reason: 'ok',\n        address,\n        expiresAt: expiresAt.getTime(),\n        nonce,\n        ...(audience !== undefined ? { audience } : {}),\n        ...(purpose !== undefined ? { purpose } : {}),\n    };\n}\n"]}

package/dist/challenge.mjs

@@ -0,0 +1,146 @@
+import { Buffer } from 'buffer';
+import { Verifier } from 'bip322-js';
+import * as bitcoinMessage from 'bitcoinjs-message';
+
+// src/challenge.ts
+var AUTH_HEADER = "orangecheck-auth";
+var AUTH_ACK = "I authorize this session under the OrangeCheck auth challenge.";
+function randomNonce() {
+  const bytes = new Uint8Array(16);
+  if (typeof globalThis.crypto?.getRandomValues === "function") {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function iso(date) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function issueChallenge(opts) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const ttl = opts.ttlSeconds ?? 300;
+  const expiresAt = new Date(now.getTime() + ttl * 1e3);
+  const nonce = opts.nonce ?? randomNonce();
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    throw new Error("nonce must be 32 lowercase hex characters");
+  }
+  const coreLines = [
+    AUTH_HEADER,
+    `address: ${opts.address}`,
+    `nonce: ${nonce}`,
+    `issued_at: ${iso(now)}`,
+    `expires_at: ${iso(expiresAt)}`,
+    `ack: ${AUTH_ACK}`
+  ];
+  const extensions = [];
+  if (opts.audience) extensions.push(["audience", opts.audience]);
+  if (opts.purpose) extensions.push(["purpose", opts.purpose]);
+  extensions.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const extLines = extensions.map(([k, v]) => `${k}: ${v}`);
+  const message = [...coreLines, ...extLines].join("\n") + "\n";
+  return {
+    message,
+    nonce,
+    expiresAt: expiresAt.getTime(),
+    expiresAtIso: iso(expiresAt)
+  };
+}
+function parseChallenge(message) {
+  const lines = message.endsWith("\n") ? message.slice(0, -1).split("\n") : message.split("\n");
+  if (lines[0] !== AUTH_HEADER) {
+    throw new Error("not an orangecheck-auth challenge");
+  }
+  const out = { extensions: [] };
+  const coreKeys = /* @__PURE__ */ new Set(["address", "nonce", "issued_at", "expires_at", "ack"]);
+  let seenCore = 0;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const sep = line.indexOf(": ");
+    if (sep === -1) continue;
+    const key = line.slice(0, sep);
+    const val = line.slice(sep + 2);
+    if (coreKeys.has(key)) {
+      seenCore++;
+      if (key === "address") out.address = val;
+      else if (key === "nonce") out.nonce = val;
+      else if (key === "issued_at") out.issuedAt = new Date(val);
+      else if (key === "expires_at") out.expiresAt = new Date(val);
+      else if (key === "ack") out.ack = val;
+    } else {
+      out.extensions.push([key, val]);
+      if (key === "audience") out.audience = val;
+      if (key === "purpose") out.purpose = val;
+    }
+  }
+  if (seenCore !== 5) {
+    throw new Error(`challenge missing core lines (${seenCore}/5)`);
+  }
+  return out;
+}
+async function verifyChallenge(opts) {
+  let parsed;
+  try {
+    parsed = parseChallenge(opts.message);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;
+  if (!address || !nonce || !issuedAt || !expiresAt || !ack) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (ack !== AUTH_ACK) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!/^[0-9a-f]{32}$/.test(nonce)) {
+    return { ok: false, reason: "malformed" };
+  }
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const skew = opts.clockSkewMs ?? 0;
+  if (now.getTime() - skew > expiresAt.getTime()) {
+    return { ok: false, reason: "expired" };
+  }
+  if (now.getTime() + skew < issuedAt.getTime()) {
+    return { ok: false, reason: "not_yet_valid" };
+  }
+  if (opts.expectedNonce && nonce !== opts.expectedNonce) {
+    return { ok: false, reason: "nonce_mismatch" };
+  }
+  if (opts.expectedAudience && audience !== opts.expectedAudience) {
+    return { ok: false, reason: "audience_mismatch" };
+  }
+  if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {
+    return { ok: false, reason: "purpose_mismatch" };
+  }
+  const scheme = opts.scheme ?? "bip322";
+  let sigValid = false;
+  try {
+    if (scheme === "bip322") {
+      const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
+      sigValid = Verifier.verifySignature(address, opts.message, sigBase64);
+    } else if (scheme === "legacy") {
+      if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
+        return { ok: false, reason: "sig_unsupported_scheme" };
+      }
+      sigValid = bitcoinMessage.verify(opts.message, address, opts.signature);
+    } else {
+      return { ok: false, reason: "sig_unsupported_scheme" };
+    }
+  } catch {
+    sigValid = false;
+  }
+  if (!sigValid) return { ok: false, reason: "sig_invalid" };
+  return {
+    ok: true,
+    reason: "ok",
+    address,
+    expiresAt: expiresAt.getTime(),
+    nonce,
+    ...audience !== void 0 ? { audience } : {},
+    ...purpose !== void 0 ? { purpose } : {}
+  };
+}
+
+export { issueChallenge, verifyChallenge };
+//# sourceMappingURL=challenge.mjs.map
+//# sourceMappingURL=challenge.mjs.map

package/dist/challenge.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/challenge.ts"],"names":[],"mappings":";;;;;AAiCA,IAAM,WAAA,GAAc,kBAAA;AACpB,IAAM,QAAA,GAAW,gEAAA;AAEjB,SAAS,WAAA,GAAsB;AAE3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAE/B,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,EAAQ,eAAA,KAAoB,UAAA,EAAY;AAC1D,IAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAAA,EAC3C,CAAA,MAAO;AAGH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5E;AAEA,SAAS,IAAI,IAAA,EAAoB;AAC7B,EAAA,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AACtD;AAiCO,SAAS,eAAe,IAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,GAAA,GAAM,KAAK,UAAA,IAAc,GAAA;AAC/B,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,IAAI,OAAA,EAAQ,GAAI,MAAM,GAAI,CAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,WAAA,EAAY;AAExC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,SAAA,GAAY;AAAA,IACd,WAAA;AAAA,IACA,CAAA,SAAA,EAAY,KAAK,OAAO,CAAA,CAAA;AAAA,IACxB,UAAU,KAAK,CAAA,CAAA;AAAA,IACf,CAAA,WAAA,EAAc,GAAA,CAAI,GAAG,CAAC,CAAA,CAAA;AAAA,IACtB,CAAA,YAAA,EAAe,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC7B,QAAQ,QAAQ,CAAA;AAAA,GACpB;AAEA,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,CAAW,IAAA,CAAK,CAAC,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,EAAW,IAAA,CAAK,OAAO,CAAC,CAAA;AAE3D,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,IAAI,CAAE,CAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,EAAW,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAEzD,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,YAAA,EAAc,IAAI,SAAS;AAAA,GAC/B;AACJ;AAaA,SAAS,eAAe,OAAA,EAAkC;AACtD,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,QAAA,CAAS,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,KAAA,CAAM,IAAI,CAAA,GAAI,OAAA,CAAQ,MAAM,IAAI,CAAA;AAE5F,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,WAAA,EAAa;AAC1B,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,GAAA,GAAuB,EAAE,UAAA,EAAY,EAAC,EAAE;AAC9C,EAAA,MAAM,QAAA,uBAAe,GAAA,CAAI,CAAC,WAAW,OAAA,EAAS,WAAA,EAAa,YAAA,EAAc,KAAK,CAAC,CAAA;AAC/E,EAAA,IAAI,QAAA,GAAW,CAAA;AAEf,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAE9B,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,MAAA,QAAA,EAAA;AACA,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,WAAA,IAC5B,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,KAAA,GAAQ,GAAA;AAAA,WAAA,IAC7B,QAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,GAAW,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAChD,QAAQ,YAAA,EAAc,GAAA,CAAI,SAAA,GAAY,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAClD,GAAA,KAAQ,KAAA,EAAO,GAAA,CAAI,GAAA,GAAM,GAAA;AAAA,IACtC,CAAA,MAAO;AACH,MAAA,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC9B,MAAA,IAAI,GAAA,KAAQ,UAAA,EAAY,GAAA,CAAI,QAAA,GAAW,GAAA;AACvC,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,IACzC;AAAA,EACJ;AAEA,EAAA,IAAI,aAAa,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,QAAQ,CAAA,GAAA,CAAK,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,GAAA;AACX;AA0DA,eAAsB,gBAClB,IAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,cAAA,CAAe,KAAK,OAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,EAAE,SAAS,KAAA,EAAO,QAAA,EAAU,WAAW,GAAA,EAAK,QAAA,EAAU,SAAQ,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,WAAW,CAAC,KAAA,IAAS,CAAC,QAAA,IAAY,CAAC,SAAA,IAAa,CAAC,GAAA,EAAK;AACvD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,QAAQ,QAAA,EAAU;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,IAAe,CAAA;AAEjC,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,SAAA,CAAU,SAAQ,EAAG;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAU;AAAA,EAC1C;AACA,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,QAAA,CAAS,SAAQ,EAAG;AAC3C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,EAChD;AAEA,EAAA,IAAI,IAAA,CAAK,aAAA,IAAiB,KAAA,KAAU,IAAA,CAAK,aAAA,EAAe;AACpD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,QAAA,KAAa,IAAA,CAAK,gBAAA,EAAkB;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACpD;AACA,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,OAAA,KAAY,IAAA,CAAK,eAAA,EAAiB;AAC1D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACnD;AAEA,EAAA,MAAM,MAAA,GAAiB,KAAK,MAAA,IAAU,QAAA;AACtC,EAAA,IAAI,QAAA,GAAW,KAAA;AAEf,EAAA,IAAI;AACA,IAAA,IAAI,WAAW,QAAA,EAAU;AACrB,MAAA,MAAM,SAAA,GACF,iBAAiB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,IAAK,IAAA,CAAK,UAAU,MAAA,GAAS,CAAA,KAAM,IACjE,MAAA,CAAO,IAAA,CAAK,KAAK,SAAA,EAAW,KAAK,EAAE,QAAA,CAAS,QAAQ,IACpD,IAAA,CAAK,SAAA;AACf,MAAA,QAAA,GAAW,QAAA,CAAS,eAAA,CAAgB,OAAA,EAAS,IAAA,CAAK,SAAS,SAAS,CAAA;AAAA,IACxE,CAAA,MAAA,IAAW,WAAW,QAAA,EAAU;AAE5B,MAAA,IAAI,CAAC,mCAAA,CAAoC,IAAA,CAAK,OAAO,CAAA,EAAG;AACpD,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,MACzD;AACA,MAAA,QAAA,GAA0B,cAAA,CAAA,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,OAAA,EAAS,KAAK,SAAS,CAAA;AAAA,IAC1E,CAAA,MAAO;AACH,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,IACzD;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,QAAA,GAAW,KAAA;AAAA,EACf;AAEA,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AAEzD,EAAA,OAAO;AAAA,IACH,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,KAAA;AAAA,IACA,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC/C;AACJ","file":"challenge.mjs","sourcesContent":["/**\n * Signed-challenge auth\n *\n * When a gate can't trust the address source (public header, query string,\n * unsigned cookie), run a one-shot BIP-322 challenge first to cryptographically\n * prove the caller controls the address. Bind the proven address to a session\n * cookie or JWT, and the gate reads from there.\n *\n * This is a different wire format from the main OCP attestation — the header\n * literal is `orangecheck-auth`, not `orangecheck`, so a signed auth challenge\n * can never be confused with a reputation attestation.\n *\n *   // Server, on the \"connect wallet\" flow:\n *   const challenge = issueChallenge({ address, ttlSeconds: 300 });\n *   // → send challenge.message to the client\n *\n *   // Client signs challenge.message with BIP-322 via the user's wallet,\n *   // then posts { message, signature } back.\n *\n *   // Server, on callback:\n *   const result = await verifyChallenge({ message, signature });\n *   if (result.ok) {\n *     // result.address is now cryptographically proven; attach to session.\n *   }\n */\n\nimport type { Scheme } from './types';\n\nimport { Buffer } from 'buffer';\n\nimport { Verifier } from 'bip322-js';\nimport * as bitcoinMessage from 'bitcoinjs-message';\n\nconst AUTH_HEADER = 'orangecheck-auth';\nconst AUTH_ACK = 'I authorize this session under the OrangeCheck auth challenge.';\n\nfunction randomNonce(): string {\n    // 16 bytes → 32 lowercase hex chars. Matches OCP core nonce format.\n    const bytes = new Uint8Array(16);\n    // Runtimes: Node 20+ (webcrypto), browsers.\n    if (typeof globalThis.crypto?.getRandomValues === 'function') {\n        globalThis.crypto.getRandomValues(bytes);\n    } else {\n        // Fallback: Math.random is *not* cryptographic — acceptable only for\n        // environments without webcrypto (old Node). Flagged explicitly.\n        for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);\n    }\n    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nfunction iso(date: Date): string {\n    return date.toISOString().replace(/\\.\\d{3}Z$/, 'Z');\n}\n\nexport interface IssueChallengeOptions {\n    /** Bitcoin address the caller claims to control. */\n    address: string;\n    /** How long the challenge is valid for. Default 300 (5 minutes). */\n    ttlSeconds?: number;\n    /** Explicit nonce. Rare; prefer auto-generated. */\n    nonce?: string;\n    /** Origin-binding extension. If set, verify will require a match. */\n    audience?: string;\n    /** Human-readable label baked into the signed message. */\n    purpose?: string;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport interface Challenge {\n    /** The canonical text the client MUST sign. */\n    message: string;\n    /** The generated nonce (kept for correlation / server-side storage). */\n    nonce: string;\n    /** Unix ms epoch the challenge expires at. */\n    expiresAt: number;\n    /** ISO string of the same. */\n    expiresAtIso: string;\n}\n\n/**\n * Build a new signed-challenge message. The server MUST remember the nonce\n * it issued against the session (Redis, signed cookie, DB) so it can detect\n * replay or a different nonce coming back on verify.\n */\nexport function issueChallenge(opts: IssueChallengeOptions): Challenge {\n    const now = opts.now ?? new Date();\n    const ttl = opts.ttlSeconds ?? 300;\n    const expiresAt = new Date(now.getTime() + ttl * 1000);\n    const nonce = opts.nonce ?? randomNonce();\n\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('nonce must be 32 lowercase hex characters');\n    }\n\n    const coreLines = [\n        AUTH_HEADER,\n        `address: ${opts.address}`,\n        `nonce: ${nonce}`,\n        `issued_at: ${iso(now)}`,\n        `expires_at: ${iso(expiresAt)}`,\n        `ack: ${AUTH_ACK}`,\n    ];\n\n    const extensions: Array<[string, string]> = [];\n    if (opts.audience) extensions.push(['audience', opts.audience]);\n    if (opts.purpose) extensions.push(['purpose', opts.purpose]);\n    // Lexicographic sort by key — matches OCP canonicalization rules.\n    extensions.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n\n    const extLines = extensions.map(([k, v]) => `${k}: ${v}`);\n    const message = [...coreLines, ...extLines].join('\\n') + '\\n';\n\n    return {\n        message,\n        nonce,\n        expiresAt: expiresAt.getTime(),\n        expiresAtIso: iso(expiresAt),\n    };\n}\n\ninterface ParsedChallenge {\n    address?: string;\n    nonce?: string;\n    issuedAt?: Date;\n    expiresAt?: Date;\n    ack?: string;\n    audience?: string;\n    purpose?: string;\n    extensions: Array<[string, string]>;\n}\n\nfunction parseChallenge(message: string): ParsedChallenge {\n    const lines = message.endsWith('\\n') ? message.slice(0, -1).split('\\n') : message.split('\\n');\n\n    if (lines[0] !== AUTH_HEADER) {\n        throw new Error('not an orangecheck-auth challenge');\n    }\n\n    const out: ParsedChallenge = { extensions: [] };\n    const coreKeys = new Set(['address', 'nonce', 'issued_at', 'expires_at', 'ack']);\n    let seenCore = 0;\n\n    for (let i = 1; i < lines.length; i++) {\n        const line = lines[i] ?? '';\n        const sep = line.indexOf(': ');\n        if (sep === -1) continue;\n        const key = line.slice(0, sep);\n        const val = line.slice(sep + 2);\n\n        if (coreKeys.has(key)) {\n            seenCore++;\n            if (key === 'address') out.address = val;\n            else if (key === 'nonce') out.nonce = val;\n            else if (key === 'issued_at') out.issuedAt = new Date(val);\n            else if (key === 'expires_at') out.expiresAt = new Date(val);\n            else if (key === 'ack') out.ack = val;\n        } else {\n            out.extensions.push([key, val]);\n            if (key === 'audience') out.audience = val;\n            if (key === 'purpose') out.purpose = val;\n        }\n    }\n\n    if (seenCore !== 5) {\n        throw new Error(`challenge missing core lines (${seenCore}/5)`);\n    }\n    return out;\n}\n\nexport interface VerifyChallengeOptions {\n    /** The signed canonical challenge text, exactly as issued. */\n    message: string;\n    /** BIP-322 or legacy signature. */\n    signature: string;\n    /** Scheme override. Default 'bip322'. */\n    scheme?: Scheme;\n\n    /** If set, require the challenge's `audience:` extension to match. */\n    expectedAudience?: string;\n    /** If set, require the challenge's `purpose:` extension to match. */\n    expectedPurpose?: string;\n    /**\n     * If set, require the challenge's `nonce:` to match. Use this to defeat\n     * replay — pair with server-side nonce storage (Redis / signed cookie).\n     */\n    expectedNonce?: string;\n\n    /** Tolerance on expiry check in ms. Default 0. */\n    clockSkewMs?: number;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport type VerifyChallengeReason =\n    | 'ok'\n    | 'malformed'\n    | 'expired'\n    | 'not_yet_valid'\n    | 'sig_invalid'\n    | 'sig_unsupported_scheme'\n    | 'audience_mismatch'\n    | 'purpose_mismatch'\n    | 'nonce_mismatch';\n\nexport interface VerifyChallengeResult {\n    ok: boolean;\n    reason: VerifyChallengeReason;\n    /** Present on success — the cryptographically proven Bitcoin address. */\n    address?: string;\n    /** Present on success — when the challenge expires (unix ms). */\n    expiresAt?: number;\n    /** Present on success — the nonce from the challenge. */\n    nonce?: string;\n    /** Present on success — the audience extension, if any. */\n    audience?: string;\n    /** Present on success — the purpose extension, if any. */\n    purpose?: string;\n}\n\n/**\n * Verify a signed challenge. Returns the proven address on success.\n *\n * The caller is responsible for nonce replay prevention — pass `expectedNonce`\n * with the value you stashed at issue time.\n */\nexport async function verifyChallenge(\n    opts: VerifyChallengeOptions\n): Promise<VerifyChallengeResult> {\n    let parsed: ParsedChallenge;\n    try {\n        parsed = parseChallenge(opts.message);\n    } catch {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;\n    if (!address || !nonce || !issuedAt || !expiresAt || !ack) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (ack !== AUTH_ACK) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const now = opts.now ?? new Date();\n    const skew = opts.clockSkewMs ?? 0;\n\n    if (now.getTime() - skew > expiresAt.getTime()) {\n        return { ok: false, reason: 'expired' };\n    }\n    if (now.getTime() + skew < issuedAt.getTime()) {\n        return { ok: false, reason: 'not_yet_valid' };\n    }\n\n    if (opts.expectedNonce && nonce !== opts.expectedNonce) {\n        return { ok: false, reason: 'nonce_mismatch' };\n    }\n    if (opts.expectedAudience && audience !== opts.expectedAudience) {\n        return { ok: false, reason: 'audience_mismatch' };\n    }\n    if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {\n        return { ok: false, reason: 'purpose_mismatch' };\n    }\n\n    const scheme: Scheme = opts.scheme ?? 'bip322';\n    let sigValid = false;\n\n    try {\n        if (scheme === 'bip322') {\n            const sigBase64 =\n                /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0\n                    ? Buffer.from(opts.signature, 'hex').toString('base64')\n                    : opts.signature;\n            sigValid = Verifier.verifySignature(address, opts.message, sigBase64);\n        } else if (scheme === 'legacy') {\n            // Legacy signmessage only works for P2PKH addresses.\n            if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {\n                return { ok: false, reason: 'sig_unsupported_scheme' };\n            }\n            sigValid = bitcoinMessage.verify(opts.message, address, opts.signature);\n        } else {\n            return { ok: false, reason: 'sig_unsupported_scheme' };\n        }\n    } catch {\n        sigValid = false;\n    }\n\n    if (!sigValid) return { ok: false, reason: 'sig_invalid' };\n\n    return {\n        ok: true,\n        reason: 'ok',\n        address,\n        expiresAt: expiresAt.getTime(),\n        nonce,\n        ...(audience !== undefined ? { audience } : {}),\n        ...(purpose !== undefined ? { purpose } : {}),\n    };\n}\n"]}

package/dist/identity.d.mts

@@ -0,0 +1,88 @@
+import { N as NostrEvent, I as IdentityBinding } from './types-BJKDroFv.mjs';
+
+interface DnsVerificationResult {
+    verified: boolean;
+    method?: 'well-known' | 'dns-txt';
+    url?: string;
+    error?: string;
+}
+declare function verifyDnsIdentity(attestationId: string, domain: string): Promise<DnsVerificationResult>;
+declare function getDnsVerificationInstructions(attestationId: string, domain: string): string;
+declare function generateWellKnownContent(attestationId: string, domain: string): string;
+declare function getWellKnownUrl(domain: string): string;
+declare function isValidDomain(domain: string): boolean;
+declare function isDnsIdentityVerified(attestationId: string, _domain: string, cachedContent?: string): boolean;
+
+interface GitHubVerificationResult {
+    verified: boolean;
+    gistUrl?: string;
+    gistId?: string;
+    error?: string;
+}
+interface GitHubGistFile {
+    filename: string;
+    type: string;
+    language: string | null;
+    raw_url: string;
+    size: number;
+    content?: string;
+}
+interface GitHubGist {
+    id: string;
+    html_url: string;
+    description: string;
+    public: boolean;
+    created_at: string;
+    updated_at: string;
+    files: Record<string, GitHubGistFile>;
+}
+declare function verifyGitHubIdentity(attestationId: string, username: string): Promise<GitHubVerificationResult>;
+declare function getGitHubVerificationInstructions(attestationId: string): string;
+declare function generateGistTemplate(attestationId: string, username: string): string;
+declare function isGitHubIdentityVerified(attestationId: string, _username: string, cachedGists: GitHubGist[]): boolean;
+declare function getGistCreationUrl(): string;
+
+interface NostrVerificationResult {
+    verified: boolean;
+    event?: NostrEvent;
+    error?: string;
+}
+declare function verifyNostrIdentity(attestationId: string, npub: string, relays?: string[]): Promise<NostrVerificationResult>;
+declare function getNostrVerificationInstructions(attestationId: string): string;
+declare function isNostrIdentityVerified(attestationId: string, npub: string, cachedEvents: NostrEvent[]): boolean;
+
+interface TwitterVerificationResult {
+    verified: boolean;
+    tweetUrl?: string;
+    tweetId?: string;
+    error?: string;
+}
+declare function verifyTwitterIdentity(attestationId: string, handle: string, tweetUrl?: string): Promise<TwitterVerificationResult>;
+declare function getTwitterVerificationInstructions(attestationId: string, handle: string): string;
+declare function generateTweetText(attestationId: string): string;
+declare function getTwitterComposeUrl(attestationId: string): string;
+declare function isValidTweetUrl(url: string): boolean;
+declare function getTweetUrl(handle: string, tweetId: string): string;
+declare function getManualVerificationInstructions(attestationId: string, handle: string, tweetUrl: string): string;
+
+type VerificationResult = NostrVerificationResult | GitHubVerificationResult | TwitterVerificationResult | DnsVerificationResult;
+interface VerifyIdentityOptions {
+    tweetUrl?: string;
+    relays?: string[];
+}
+declare function verifyIdentity(attestationId: string, identity: IdentityBinding, options?: VerifyIdentityOptions): Promise<VerificationResult>;
+declare function getVerificationInstructions(attestationId: string, identity: IdentityBinding): string;
+declare function supportsAutomaticVerification(protocol: string): boolean;
+declare function requiresManualVerification(protocol: string): boolean;
+declare function verifyAllIdentities(attestationId: string, identities: IdentityBinding[], options?: {
+    tweetUrls?: Record<string, string>;
+    relays?: string[];
+}): Promise<Map<string, VerificationResult>>;
+declare function getVerificationSummary(results: Map<string, VerificationResult>): {
+    total: number;
+    verified: number;
+    failed: number;
+    pending: number;
+};
+
+export { type DnsVerificationResult, type GitHubVerificationResult, type NostrVerificationResult, type TwitterVerificationResult, type VerificationResult, type VerifyIdentityOptions, generateGistTemplate, generateTweetText, generateWellKnownContent, getDnsVerificationInstructions, getGistCreationUrl, getGitHubVerificationInstructions, getManualVerificationInstructions, getNostrVerificationInstructions, getTweetUrl, getTwitterComposeUrl, getTwitterVerificationInstructions, getVerificationInstructions, getVerificationSummary, getWellKnownUrl, isDnsIdentityVerified, isGitHubIdentityVerified, isNostrIdentityVerified, isValidDomain, isValidTweetUrl, requiresManualVerification, supportsAutomaticVerification, verifyAllIdentities, verifyDnsIdentity, verifyGitHubIdentity, verifyIdentity, verifyNostrIdentity, verifyTwitterIdentity };

package/dist/identity.d.ts

@@ -0,0 +1,88 @@
+import { N as NostrEvent, I as IdentityBinding } from './types-BJKDroFv.js';
+
+interface DnsVerificationResult {
+    verified: boolean;
+    method?: 'well-known' | 'dns-txt';
+    url?: string;
+    error?: string;
+}
+declare function verifyDnsIdentity(attestationId: string, domain: string): Promise<DnsVerificationResult>;
+declare function getDnsVerificationInstructions(attestationId: string, domain: string): string;
+declare function generateWellKnownContent(attestationId: string, domain: string): string;
+declare function getWellKnownUrl(domain: string): string;
+declare function isValidDomain(domain: string): boolean;
+declare function isDnsIdentityVerified(attestationId: string, _domain: string, cachedContent?: string): boolean;
+
+interface GitHubVerificationResult {
+    verified: boolean;
+    gistUrl?: string;
+    gistId?: string;
+    error?: string;
+}
+interface GitHubGistFile {
+    filename: string;
+    type: string;
+    language: string | null;
+    raw_url: string;
+    size: number;
+    content?: string;
+}
+interface GitHubGist {
+    id: string;
+    html_url: string;
+    description: string;
+    public: boolean;
+    created_at: string;
+    updated_at: string;
+    files: Record<string, GitHubGistFile>;
+}
+declare function verifyGitHubIdentity(attestationId: string, username: string): Promise<GitHubVerificationResult>;
+declare function getGitHubVerificationInstructions(attestationId: string): string;
+declare function generateGistTemplate(attestationId: string, username: string): string;
+declare function isGitHubIdentityVerified(attestationId: string, _username: string, cachedGists: GitHubGist[]): boolean;
+declare function getGistCreationUrl(): string;
+
+interface NostrVerificationResult {
+    verified: boolean;
+    event?: NostrEvent;
+    error?: string;
+}
+declare function verifyNostrIdentity(attestationId: string, npub: string, relays?: string[]): Promise<NostrVerificationResult>;
+declare function getNostrVerificationInstructions(attestationId: string): string;
+declare function isNostrIdentityVerified(attestationId: string, npub: string, cachedEvents: NostrEvent[]): boolean;
+
+interface TwitterVerificationResult {
+    verified: boolean;
+    tweetUrl?: string;
+    tweetId?: string;
+    error?: string;
+}
+declare function verifyTwitterIdentity(attestationId: string, handle: string, tweetUrl?: string): Promise<TwitterVerificationResult>;
+declare function getTwitterVerificationInstructions(attestationId: string, handle: string): string;
+declare function generateTweetText(attestationId: string): string;
+declare function getTwitterComposeUrl(attestationId: string): string;
+declare function isValidTweetUrl(url: string): boolean;
+declare function getTweetUrl(handle: string, tweetId: string): string;
+declare function getManualVerificationInstructions(attestationId: string, handle: string, tweetUrl: string): string;
+
+type VerificationResult = NostrVerificationResult | GitHubVerificationResult | TwitterVerificationResult | DnsVerificationResult;
+interface VerifyIdentityOptions {
+    tweetUrl?: string;
+    relays?: string[];
+}
+declare function verifyIdentity(attestationId: string, identity: IdentityBinding, options?: VerifyIdentityOptions): Promise<VerificationResult>;
+declare function getVerificationInstructions(attestationId: string, identity: IdentityBinding): string;
+declare function supportsAutomaticVerification(protocol: string): boolean;
+declare function requiresManualVerification(protocol: string): boolean;
+declare function verifyAllIdentities(attestationId: string, identities: IdentityBinding[], options?: {
+    tweetUrls?: Record<string, string>;
+    relays?: string[];
+}): Promise<Map<string, VerificationResult>>;
+declare function getVerificationSummary(results: Map<string, VerificationResult>): {
+    total: number;
+    verified: number;
+    failed: number;
+    pending: number;
+};
+
+export { type DnsVerificationResult, type GitHubVerificationResult, type NostrVerificationResult, type TwitterVerificationResult, type VerificationResult, type VerifyIdentityOptions, generateGistTemplate, generateTweetText, generateWellKnownContent, getDnsVerificationInstructions, getGistCreationUrl, getGitHubVerificationInstructions, getManualVerificationInstructions, getNostrVerificationInstructions, getTweetUrl, getTwitterComposeUrl, getTwitterVerificationInstructions, getVerificationInstructions, getVerificationSummary, getWellKnownUrl, isDnsIdentityVerified, isGitHubIdentityVerified, isNostrIdentityVerified, isValidDomain, isValidTweetUrl, requiresManualVerification, supportsAutomaticVerification, verifyAllIdentities, verifyDnsIdentity, verifyGitHubIdentity, verifyIdentity, verifyNostrIdentity, verifyTwitterIdentity };