@orangecheck/sdk 1.14.1 → 1.15.0

package/dist/nostr.mjs

@@ -1,4 +1,6 @@
 import { bech32 } from '@scure/base';
+import { Buffer } from 'buffer';
+import { verifySignature as verifySignature$1 } from '@orangecheck/bip322';
 
 // src/nostr-pubkey.ts
 var HEX_64_RE = /^[0-9a-f]{64}$/;
@@ -71,8 +73,216 @@ function createLogger(namespace) {
   };
 }
 
+// src/utils/time.ts
+var RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+function rfc3339Ms(value) {
+  if (!value || !RFC3339.test(value)) return null;
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : ms;
+}
+
+// src/canonical.ts
+var IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]*$/;
+var IDENTITY_FORBIDDEN_CHARS = /[\r\n,]/;
+function assertSafeIdentity({ protocol, identifier }) {
+  if (!IDENTITY_PROTOCOL_RE.test(protocol)) {
+    throw new Error(
+      `invalid identity protocol: ${JSON.stringify(protocol)} \u2014 must match /^[a-z][a-z0-9_-]*$/`
+    );
+  }
+  if (!identifier || IDENTITY_FORBIDDEN_CHARS.test(identifier)) {
+    throw new Error(
+      `invalid identity identifier: ${JSON.stringify(identifier)} \u2014 must be non-empty and contain no newlines or commas`
+    );
+  }
+}
+function parseIdentities(identitiesStr) {
+  if (!identitiesStr || identitiesStr.trim() === "") {
+    return [];
+  }
+  if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ""))) {
+    throw new Error("identities field contains forbidden characters (newline)");
+  }
+  const bindings = identitiesStr.split(",").map((binding) => {
+    const colonIndex = binding.indexOf(":");
+    if (colonIndex === -1) {
+      throw new Error(`Invalid identity binding format: ${binding}`);
+    }
+    return {
+      protocol: binding.substring(0, colonIndex).trim(),
+      identifier: binding.substring(colonIndex + 1).trim()
+    };
+  });
+  for (const b of bindings) {
+    if (!b.protocol || !b.identifier) {
+      throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);
+    }
+    assertSafeIdentity(b);
+  }
+  return bindings;
+}
+
+// src/verify.ts
+var log = createLogger("ocp/verify");
+function looksLikeHex(s) {
+  return /^[0-9a-fA-F]+$/.test(s) && s.length % 2 === 0;
+}
+function toBase64Maybe(sig) {
+  if (looksLikeHex(sig)) {
+    return Buffer.from(sig, "hex").toString("base64");
+  }
+  return sig;
+}
+function detectSignatureScheme(addr, sig) {
+  const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+  if (isSegWit) {
+    return "bip322";
+  }
+  const sigBase64 = toBase64Maybe(sig);
+  const looksLikeLegacy = sigBase64.length === 88 && /^[IHG]/.test(sigBase64);
+  if (looksLikeLegacy) {
+    return "legacy";
+  }
+  return "bip322";
+}
+async function verifySignature({
+  addr,
+  msg,
+  sig,
+  scheme
+}) {
+  const detectedScheme = scheme || detectSignatureScheme(addr, sig);
+  log.debug(
+    { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
+    "Verifying signature"
+  );
+  if (detectedScheme === "bip322") {
+    const sigBase64 = toBase64Maybe(sig);
+    log.debug(
+      { sigBase64: sigBase64.substring(0, 50) + "..." },
+      "Signature converted to base64"
+    );
+    log.debug(
+      {
+        msgFull: msg,
+        msgLines: msg.split("\n").length,
+        msgFirstLine: msg.split("\n")[0],
+        msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
+      },
+      "Message being verified"
+    );
+    const ok = verifySignature$1(addr, msg, sigBase64);
+    log.info({ addr, ok }, "BIP-322 verification result");
+    if (!ok) {
+      const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+      if (isSegWit && sigBase64.length === 88) {
+        log.warn(
+          { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
+          "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
+        );
+      } else {
+        log.error(
+          {
+            addr,
+            sigLength: sigBase64.length,
+            msgLength: msg.length,
+            msgPreview: msg.substring(0, 200)
+          },
+          "BIP-322 verification failed - signature does not match message"
+        );
+      }
+    }
+    return ok ? "sig_ok_bip322" : "sig_invalid";
+  }
+  if (detectedScheme === "legacy") {
+    const sigBase64 = toBase64Maybe(sig);
+    if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
+      log.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
+      return "sig_unsupported_script";
+    }
+    log.debug(
+      {
+        addr,
+        sigBase64: sigBase64.substring(0, 50) + "...",
+        msgPreview: msg.substring(0, 100) + "...",
+        msgLength: msg.length
+      },
+      "Verifying legacy signature"
+    );
+    const ok = verifySignature$1(addr, msg, sigBase64);
+    log.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
+    if (!ok) {
+      log.error(
+        {
+          addr,
+          msgFirstLine: msg.split("\n")[0],
+          sigFormat: sigBase64.substring(0, 10)
+        },
+        "Legacy signature verification failed - check message format and signature"
+      );
+    }
+    return ok ? "sig_ok_legacy" : "sig_invalid";
+  }
+  return "invalid_scheme";
+}
+async function signatureIsValid(input) {
+  try {
+    const code = await verifySignature(input);
+    return code === "sig_ok_bip322" || code === "sig_ok_legacy";
+  } catch {
+    return false;
+  }
+}
+function parseCanonicalMessage(msg) {
+  const lines = msg.split("\n").map((l) => l.trim());
+  const getVal = (prefix) => {
+    const needle = prefix + ":";
+    const hit = lines.find((l) => l.toLowerCase().startsWith(needle));
+    if (!hit) return void 0;
+    const idx = hit.indexOf(":");
+    return hit.slice(idx + 1).trim();
+  };
+  const address = getVal("address") || "";
+  const identitiesStr = getVal("identities") || "";
+  const issued_at = getVal("issued_at") || "";
+  const expires = getVal("expires");
+  let identities = [];
+  try {
+    identities = parseIdentities(identitiesStr);
+  } catch (err) {
+    log.warn({ identitiesStr, error: err }, "Failed to parse identities field");
+  }
+  const coreKeys = /* @__PURE__ */ new Set([
+    "orangecheck",
+    "identities",
+    "address",
+    "purpose",
+    "nonce",
+    "issued_at",
+    "ack"
+  ]);
+  const extensions = {};
+  for (const line of lines) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const key = line.slice(0, idx).trim().toLowerCase();
+    const val = line.slice(idx + 1).trim();
+    if (!coreKeys.has(key) && val) extensions[key] = val;
+  }
+  const network = extensions["network"] || "mainnet";
+  const bondStr = extensions["bond"];
+  const bond = bondStr ? parseInt(bondStr, 10) : void 0;
+  return {
+    core: { address, identities, issued_at },
+    expires,
+    network,
+    extensions,
+    bond: bond !== void 0 && !isNaN(bond) && bond > 0 ? bond : void 0
+  };
+}
+
 // src/nostr.ts
-var log = createLogger("ocp/nostr");
+var log2 = createLogger("ocp/nostr");
 var ATTESTATION_EVENT_KIND = 30078;
 var DEFAULT_RELAYS = [
   "wss://relay.damus.io",
@@ -148,7 +358,7 @@ function getAddressFromEvent(event) {
 async function publishToRelays(event, relays = DEFAULT_RELAYS) {
   const success = [];
   const failed = [];
-  log.info({ eventId: event.id, relayCount: relays.length }, "Publishing event to relays");
+  log2.info({ eventId: event.id, relayCount: relays.length }, "Publishing event to relays");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const publishPromises = relays.map(async (relayUrl) => {
     let ws = null;
@@ -187,7 +397,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
                 cleanup();
                 resolve();
               } else {
-                log.warn(
+                log2.warn(
                   { relay: relayUrl, reason: data[3] },
                   "Relay rejected event"
                 );
@@ -197,7 +407,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
               }
             }
           } catch (err) {
-            log.error(
+            log2.error(
               { relay: relayUrl, error: err },
               "Failed to parse relay response"
             );
@@ -207,7 +417,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
           }
         };
         wsRef.onerror = (err) => {
-          log.error({ relay: relayUrl, error: err }, "WebSocket error");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error");
           recordFailure();
           cleanup();
           reject(err);
@@ -217,7 +427,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to publish to relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to publish to relay");
       recordFailure();
     } finally {
       if (ws && ws.readyState !== WebSocket.CLOSED) {
@@ -226,12 +436,12 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
     }
   });
   await Promise.allSettled(publishPromises);
-  log.info({ successCount: success.length, failedCount: failed.length }, "Publishing complete");
+  log2.info({ successCount: success.length, failedCount: failed.length }, "Publishing complete");
   return { success, failed };
 }
 async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
   const events = [];
-  log.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
+  log2.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     let ws = null;
@@ -271,11 +481,11 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         wsRef.onerror = (err) => {
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           cleanup();
           reject(err);
         };
@@ -284,7 +494,7 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     } finally {
       if (ws && ws.readyState !== WebSocket.CLOSED) {
         ws.close();
@@ -292,12 +502,12 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
     }
   });
   await Promise.allSettled(queryPromises);
-  log.info({ eventCount: events.length }, "Query complete");
+  log2.info({ eventCount: events.length }, "Query complete");
   return events;
 }
 async function queryByAddress(address, relays = DEFAULT_RELAYS) {
   const events = [];
-  log.info({ address, relayCount: relays.length }, "Querying relays for address");
+  log2.info({ address, relayCount: relays.length }, "Querying relays for address");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
@@ -339,28 +549,28 @@ async function queryByAddress(address, relays = DEFAULT_RELAYS) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         ws.onerror = (err) => {
           clearTimeout(timeout);
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           reject(err);
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     }
   });
   await Promise.allSettled(queryPromises);
-  log.info({ eventCount: events.length }, "Query complete");
+  log2.info({ eventCount: events.length }, "Query complete");
   return events;
 }
 async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
   const events = [];
   const identityTag = `${protocol}:${identifier}`;
   const identityTags = protocol === "nostr" ? nostrIdentifierForms(identifier).map((f) => `nostr:${f}`) : [identityTag];
-  log.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
+  log2.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
@@ -395,26 +605,26 @@ async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         ws.onerror = (err) => {
           clearTimeout(timeout);
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           reject(err);
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     }
   });
   await Promise.allSettled(queryPromises);
-  log.info({ eventCount: events.length }, "Query complete");
+  log2.info({ eventCount: events.length }, "Query complete");
   return events;
 }
 async function queryRecent(relays = DEFAULT_RELAYS, limit = 200) {
   const events = [];
-  log.info({ relayCount: relays.length, limit }, "Querying relays for recent attestations");
+  log2.info({ relayCount: relays.length, limit }, "Querying relays for recent attestations");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
@@ -450,30 +660,22 @@ async function queryRecent(relays = DEFAULT_RELAYS, limit = 200) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         ws.onerror = (err) => {
           clearTimeout(timeout);
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           reject(err);
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     }
   });
   await Promise.allSettled(queryPromises);
-  const seen = /* @__PURE__ */ new Set();
-  const envelopes = [];
-  for (const ev of events) {
-    const envelope = parseAttestationFromEvent(ev);
-    if (!envelope || seen.has(envelope.attestation_id)) continue;
-    if (!await verifyAttestationEnvelope(envelope)) continue;
-    seen.add(envelope.attestation_id);
-    envelopes.push(envelope);
-  }
-  log.info({ eventCount: events.length, unique: envelopes.length }, "Recent query complete");
+  const envelopes = await collectSignedEnvelopes(events);
+  log2.info({ eventCount: events.length, unique: envelopes.length }, "Recent query complete");
   return envelopes;
 }
 async function verifyAttestationEnvelope(envelope) {
@@ -485,20 +687,72 @@ async function verifyAttestationEnvelope(envelope) {
     const computedId = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
     return computedId === envelope.attestation_id;
   } catch (err) {
-    log.error({ error: err }, "Failed to verify attestation envelope");
+    log2.error({ error: err }, "Failed to verify attestation envelope");
     return false;
   }
 }
+function base64Url(text) {
+  const base64 = btoa(String.fromCharCode(...new TextEncoder().encode(text)));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function signedEnvelope(envelope) {
+  let parsed;
+  try {
+    parsed = parseCanonicalMessage(envelope.message);
+  } catch {
+    return null;
+  }
+  if (!parsed.core.address || rfc3339Ms(parsed.core.issued_at) === null) return null;
+  const { expires_at: _copy, ...rest } = envelope;
+  return {
+    ...rest,
+    address: parsed.core.address,
+    identities: parsed.core.identities,
+    issued_at: parsed.core.issued_at,
+    ...parsed.expires !== void 0 ? { expires_at: parsed.expires } : {},
+    message_b64url: base64Url(envelope.message)
+  };
+}
+async function collectSignedEnvelopes(events, accept = () => true) {
+  const copies = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    const raw = parseAttestationFromEvent(event);
+    if (!raw || !await verifyAttestationEnvelope(raw)) continue;
+    const envelope = signedEnvelope(raw);
+    if (!envelope || !accept(event, envelope)) continue;
+    const same = copies.get(envelope.attestation_id) ?? [];
+    if (!same.some((e) => e.signature === envelope.signature && e.scheme === envelope.scheme)) {
+      same.push(envelope);
+    }
+    copies.set(envelope.attestation_id, same);
+  }
+  const kept = [];
+  for (const same of copies.values()) {
+    if (same.length === 1) {
+      kept.push(same[0]);
+      continue;
+    }
+    let valid;
+    for (const e of same) {
+      if (await signatureIsValid({ addr: e.address, msg: e.message, sig: e.signature, scheme: e.scheme })) {
+        valid = e;
+        break;
+      }
+    }
+    kept.push(valid ?? same[0]);
+  }
+  return kept;
+}
 function parseAttestationFromEvent(event) {
   try {
     const envelope = JSON.parse(event.content);
     return envelope;
   } catch (err) {
-    log.error({ eventId: event.id, error: err }, "Failed to parse attestation from event");
+    log2.error({ eventId: event.id, error: err }, "Failed to parse attestation from event");
     return null;
   }
 }
 
-export { ATTESTATION_EVENT_KIND, DEFAULT_RELAYS, FANOUT_DEADLINE_MS, createAttestationEvent, getAddressFromEvent, getAttestationIdFromEvent, parseAttestationFromEvent, parseIdentitiesFromEvent, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, verifyAttestationEnvelope };
+export { ATTESTATION_EVENT_KIND, DEFAULT_RELAYS, FANOUT_DEADLINE_MS, collectSignedEnvelopes, createAttestationEvent, getAddressFromEvent, getAttestationIdFromEvent, parseAttestationFromEvent, parseIdentitiesFromEvent, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, signedEnvelope, verifyAttestationEnvelope };
 //# sourceMappingURL=nostr.mjs.map
 //# sourceMappingURL=nostr.mjs.map