@orangecheck/sdk 1.14.1 → 1.16.0

package/dist/nostr.mjs

@@ -1,4 +1,6 @@
 import { bech32 } from '@scure/base';
+import { verifySignature as verifySignature$1 } from '@orangecheck/bip322';
+import { Buffer } from 'buffer';
 
 // src/nostr-pubkey.ts
 var HEX_64_RE = /^[0-9a-f]{64}$/;
@@ -71,8 +73,135 @@ function createLogger(namespace) {
   };
 }
 
+// src/utils/time.ts
+var RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+function rfc3339Ms(value) {
+  if (!value || !RFC3339.test(value)) return null;
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : ms;
+}
+
+// src/canonical.ts
+var IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]*$/;
+var IDENTITY_FORBIDDEN_CHARS = /[\r\n,]/;
+function assertSafeIdentity({ protocol, identifier }) {
+  if (!IDENTITY_PROTOCOL_RE.test(protocol)) {
+    throw new Error(
+      `invalid identity protocol: ${JSON.stringify(protocol)} \u2014 must match /^[a-z][a-z0-9_-]*$/`
+    );
+  }
+  if (!identifier || IDENTITY_FORBIDDEN_CHARS.test(identifier)) {
+    throw new Error(
+      `invalid identity identifier: ${JSON.stringify(identifier)} \u2014 must be non-empty and contain no newlines or commas`
+    );
+  }
+}
+function parseIdentities(identitiesStr) {
+  if (!identitiesStr || identitiesStr.trim() === "") {
+    return [];
+  }
+  if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ""))) {
+    throw new Error("identities field contains forbidden characters (newline)");
+  }
+  const bindings = identitiesStr.split(",").map((binding) => {
+    const colonIndex = binding.indexOf(":");
+    if (colonIndex === -1) {
+      throw new Error(`Invalid identity binding format: ${binding}`);
+    }
+    return {
+      protocol: binding.substring(0, colonIndex).trim(),
+      identifier: binding.substring(colonIndex + 1).trim()
+    };
+  });
+  for (const b of bindings) {
+    if (!b.protocol || !b.identifier) {
+      throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);
+    }
+    assertSafeIdentity(b);
+  }
+  return bindings;
+}
+function toBase64Maybe(sig) {
+  if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {
+    return Buffer.from(sig, "hex").toString("base64");
+  }
+  return sig;
+}
+function signatureScheme(sigBase64) {
+  if (/^(ful|pof)/.test(sigBase64)) return null;
+  if (sigBase64.startsWith("smp")) return "bip322";
+  return Buffer.from(sigBase64, "base64").length === 65 ? "legacy" : "bip322";
+}
+
+// src/verify.ts
+var log = createLogger("ocp/verify");
+async function verifySignature({ addr, msg, sig }) {
+  const sigBase64 = toBase64Maybe(sig);
+  const scheme = signatureScheme(sigBase64);
+  if (!scheme) return "sig_unsupported_script";
+  const ok = verifySignature$1(addr, msg, sigBase64);
+  log.info({ addr, ok, scheme, msgLength: msg.length }, "Signature verification result");
+  if (!ok) return "sig_invalid";
+  return scheme === "legacy" ? "sig_ok_legacy" : "sig_ok_bip322";
+}
+async function signatureIsValid(input) {
+  try {
+    const code = await verifySignature(input);
+    return code === "sig_ok_bip322" || code === "sig_ok_legacy";
+  } catch {
+    return false;
+  }
+}
+function parseCanonicalMessage(msg) {
+  const lines = msg.split("\n").map((l) => l.trim());
+  const getVal = (prefix) => {
+    const needle = prefix + ":";
+    const hit = lines.find((l) => l.toLowerCase().startsWith(needle));
+    if (!hit) return void 0;
+    const idx = hit.indexOf(":");
+    return hit.slice(idx + 1).trim();
+  };
+  const address = getVal("address") || "";
+  const identitiesStr = getVal("identities") || "";
+  const issued_at = getVal("issued_at") || "";
+  const expires = getVal("expires");
+  let identities = [];
+  try {
+    identities = parseIdentities(identitiesStr);
+  } catch (err) {
+    log.warn({ identitiesStr, error: err }, "Failed to parse identities field");
+  }
+  const coreKeys = /* @__PURE__ */ new Set([
+    "orangecheck",
+    "identities",
+    "address",
+    "purpose",
+    "nonce",
+    "issued_at",
+    "ack"
+  ]);
+  const extensions = {};
+  for (const line of lines) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const key = line.slice(0, idx).trim().toLowerCase();
+    const val = line.slice(idx + 1).trim();
+    if (!coreKeys.has(key) && val) extensions[key] = val;
+  }
+  const network = extensions["network"] || "mainnet";
+  const bondStr = extensions["bond"];
+  const bond = bondStr ? parseInt(bondStr, 10) : void 0;
+  return {
+    core: { address, identities, issued_at },
+    expires,
+    network,
+    extensions,
+    bond: bond !== void 0 && !isNaN(bond) && bond > 0 ? bond : void 0
+  };
+}
+
 // src/nostr.ts
-var log = createLogger("ocp/nostr");
+var log2 = createLogger("ocp/nostr");
 var ATTESTATION_EVENT_KIND = 30078;
 var DEFAULT_RELAYS = [
   "wss://relay.damus.io",
@@ -148,7 +277,7 @@ function getAddressFromEvent(event) {
 async function publishToRelays(event, relays = DEFAULT_RELAYS) {
   const success = [];
   const failed = [];
-  log.info({ eventId: event.id, relayCount: relays.length }, "Publishing event to relays");
+  log2.info({ eventId: event.id, relayCount: relays.length }, "Publishing event to relays");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const publishPromises = relays.map(async (relayUrl) => {
     let ws = null;
@@ -187,7 +316,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
                 cleanup();
                 resolve();
               } else {
-                log.warn(
+                log2.warn(
                   { relay: relayUrl, reason: data[3] },
                   "Relay rejected event"
                 );
@@ -197,7 +326,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
               }
             }
           } catch (err) {
-            log.error(
+            log2.error(
               { relay: relayUrl, error: err },
               "Failed to parse relay response"
             );
@@ -207,7 +336,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
           }
         };
         wsRef.onerror = (err) => {
-          log.error({ relay: relayUrl, error: err }, "WebSocket error");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error");
           recordFailure();
           cleanup();
           reject(err);
@@ -217,7 +346,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to publish to relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to publish to relay");
       recordFailure();
     } finally {
       if (ws && ws.readyState !== WebSocket.CLOSED) {
@@ -226,12 +355,12 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
     }
   });
   await Promise.allSettled(publishPromises);
-  log.info({ successCount: success.length, failedCount: failed.length }, "Publishing complete");
+  log2.info({ successCount: success.length, failedCount: failed.length }, "Publishing complete");
   return { success, failed };
 }
 async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
   const events = [];
-  log.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
+  log2.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     let ws = null;
@@ -271,11 +400,11 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         wsRef.onerror = (err) => {
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           cleanup();
           reject(err);
         };
@@ -284,7 +413,7 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     } finally {
       if (ws && ws.readyState !== WebSocket.CLOSED) {
         ws.close();
@@ -292,12 +421,12 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
     }
   });
   await Promise.allSettled(queryPromises);
-  log.info({ eventCount: events.length }, "Query complete");
+  log2.info({ eventCount: events.length }, "Query complete");
   return events;
 }
 async function queryByAddress(address, relays = DEFAULT_RELAYS) {
   const events = [];
-  log.info({ address, relayCount: relays.length }, "Querying relays for address");
+  log2.info({ address, relayCount: relays.length }, "Querying relays for address");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
@@ -339,28 +468,28 @@ async function queryByAddress(address, relays = DEFAULT_RELAYS) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         ws.onerror = (err) => {
           clearTimeout(timeout);
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           reject(err);
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     }
   });
   await Promise.allSettled(queryPromises);
-  log.info({ eventCount: events.length }, "Query complete");
+  log2.info({ eventCount: events.length }, "Query complete");
   return events;
 }
 async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
   const events = [];
   const identityTag = `${protocol}:${identifier}`;
   const identityTags = protocol === "nostr" ? nostrIdentifierForms(identifier).map((f) => `nostr:${f}`) : [identityTag];
-  log.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
+  log2.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
@@ -395,26 +524,26 @@ async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         ws.onerror = (err) => {
           clearTimeout(timeout);
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           reject(err);
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     }
   });
   await Promise.allSettled(queryPromises);
-  log.info({ eventCount: events.length }, "Query complete");
+  log2.info({ eventCount: events.length }, "Query complete");
   return events;
 }
 async function queryRecent(relays = DEFAULT_RELAYS, limit = 200) {
   const events = [];
-  log.info({ relayCount: relays.length, limit }, "Querying relays for recent attestations");
+  log2.info({ relayCount: relays.length, limit }, "Querying relays for recent attestations");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
@@ -450,30 +579,22 @@ async function queryRecent(relays = DEFAULT_RELAYS, limit = 200) {
               resolve();
             }
           } catch (err) {
-            log.error({ relay: relayUrl, error: err }, "Failed to parse event");
+            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
           }
         };
         ws.onerror = (err) => {
           clearTimeout(timeout);
-          log.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
           reject(err);
         };
       });
     } catch (err) {
-      log.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
     }
   });
   await Promise.allSettled(queryPromises);
-  const seen = /* @__PURE__ */ new Set();
-  const envelopes = [];
-  for (const ev of events) {
-    const envelope = parseAttestationFromEvent(ev);
-    if (!envelope || seen.has(envelope.attestation_id)) continue;
-    if (!await verifyAttestationEnvelope(envelope)) continue;
-    seen.add(envelope.attestation_id);
-    envelopes.push(envelope);
-  }
-  log.info({ eventCount: events.length, unique: envelopes.length }, "Recent query complete");
+  const envelopes = await collectSignedEnvelopes(events);
+  log2.info({ eventCount: events.length, unique: envelopes.length }, "Recent query complete");
   return envelopes;
 }
 async function verifyAttestationEnvelope(envelope) {
@@ -485,20 +606,72 @@ async function verifyAttestationEnvelope(envelope) {
     const computedId = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
     return computedId === envelope.attestation_id;
   } catch (err) {
-    log.error({ error: err }, "Failed to verify attestation envelope");
+    log2.error({ error: err }, "Failed to verify attestation envelope");
     return false;
   }
 }
+function base64Url(text) {
+  const base64 = btoa(String.fromCharCode(...new TextEncoder().encode(text)));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function signedEnvelope(envelope) {
+  let parsed;
+  try {
+    parsed = parseCanonicalMessage(envelope.message);
+  } catch {
+    return null;
+  }
+  if (!parsed.core.address || rfc3339Ms(parsed.core.issued_at) === null) return null;
+  const { expires_at: _copy, ...rest } = envelope;
+  return {
+    ...rest,
+    address: parsed.core.address,
+    identities: parsed.core.identities,
+    issued_at: parsed.core.issued_at,
+    ...parsed.expires !== void 0 ? { expires_at: parsed.expires } : {},
+    message_b64url: base64Url(envelope.message)
+  };
+}
+async function collectSignedEnvelopes(events, accept = () => true) {
+  const copies = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    const raw = parseAttestationFromEvent(event);
+    if (!raw || !await verifyAttestationEnvelope(raw)) continue;
+    const envelope = signedEnvelope(raw);
+    if (!envelope || !accept(event, envelope)) continue;
+    const same = copies.get(envelope.attestation_id) ?? [];
+    if (!same.some((e) => e.signature === envelope.signature && e.scheme === envelope.scheme)) {
+      same.push(envelope);
+    }
+    copies.set(envelope.attestation_id, same);
+  }
+  const kept = [];
+  for (const same of copies.values()) {
+    if (same.length === 1) {
+      kept.push(same[0]);
+      continue;
+    }
+    let valid;
+    for (const e of same) {
+      if (await signatureIsValid({ addr: e.address, msg: e.message, sig: e.signature, scheme: e.scheme })) {
+        valid = e;
+        break;
+      }
+    }
+    kept.push(valid ?? same[0]);
+  }
+  return kept;
+}
 function parseAttestationFromEvent(event) {
   try {
     const envelope = JSON.parse(event.content);
     return envelope;
   } catch (err) {
-    log.error({ eventId: event.id, error: err }, "Failed to parse attestation from event");
+    log2.error({ eventId: event.id, error: err }, "Failed to parse attestation from event");
     return null;
   }
 }
 
-export { ATTESTATION_EVENT_KIND, DEFAULT_RELAYS, FANOUT_DEADLINE_MS, createAttestationEvent, getAddressFromEvent, getAttestationIdFromEvent, parseAttestationFromEvent, parseIdentitiesFromEvent, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, verifyAttestationEnvelope };
+export { ATTESTATION_EVENT_KIND, DEFAULT_RELAYS, FANOUT_DEADLINE_MS, collectSignedEnvelopes, createAttestationEvent, getAddressFromEvent, getAttestationIdFromEvent, parseAttestationFromEvent, parseIdentitiesFromEvent, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, signedEnvelope, verifyAttestationEnvelope };
 //# sourceMappingURL=nostr.mjs.map
 //# sourceMappingURL=nostr.mjs.map