@orangecheck/sdk 1.15.0 → 1.16.0

package/dist/challenge.js

@@ -1,7 +1,20 @@
 'use strict';
 
-var buffer = require('buffer');
 var bip322 = require('@orangecheck/bip322');
+var buffer = require('buffer');
+
+// src/challenge.ts
+function toBase64Maybe(sig) {
+  if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {
+    return buffer.Buffer.from(sig, "hex").toString("base64");
+  }
+  return sig;
+}
+function signatureScheme(sigBase64) {
+  if (/^(ful|pof)/.test(sigBase64)) return null;
+  if (sigBase64.startsWith("smp")) return "bip322";
+  return buffer.Buffer.from(sigBase64, "base64").length === 65 ? "legacy" : "bip322";
+}
 
 // src/challenge.ts
 var AUTH_HEADER = "orangecheck-auth";
@@ -117,24 +130,17 @@ async function verifyChallenge(opts) {
   if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {
     return { ok: false, reason: "purpose_mismatch" };
   }
-  const scheme = opts.scheme ?? "bip322";
-  let sigValid;
-  if (scheme === "bip322") {
-    const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? buffer.Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
-    sigValid = bip322.verifySignature(address, opts.message, sigBase64);
-  } else if (scheme === "legacy") {
-    if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
-      return { ok: false, reason: "sig_unsupported_scheme" };
-    }
-    sigValid = bip322.verifySignature(address, opts.message, opts.signature);
-  } else {
-    return { ok: false, reason: "sig_unsupported_scheme" };
+  const sigBase64 = toBase64Maybe(opts.signature);
+  const scheme = signatureScheme(sigBase64);
+  if (!scheme) return { ok: false, reason: "sig_unsupported_scheme" };
+  if (!bip322.verifySignature(address, opts.message, sigBase64)) {
+    return { ok: false, reason: "sig_invalid" };
   }
-  if (!sigValid) return { ok: false, reason: "sig_invalid" };
   return {
     ok: true,
     reason: "ok",
     address,
+    scheme,
     expiresAt: expiresAt.getTime(),
     nonce,
     ...audience !== void 0 ? { audience } : {},

package/dist/challenge.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/challenge.ts"],"names":["Buffer","verifyBitcoinSignature"],"mappings":";;;;;;AAgCA,IAAM,WAAA,GAAc,kBAAA;AACpB,IAAM,QAAA,GAAW,gEAAA;AAEjB,SAAS,WAAA,GAAsB;AAE3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAE/B,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,EAAQ,eAAA,KAAoB,UAAA,EAAY;AAC1D,IAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAAA,EAC3C,CAAA,MAAO;AAGH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5E;AAEA,SAAS,IAAI,IAAA,EAAoB;AAC7B,EAAA,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AACtD;AAiCO,SAAS,eAAe,IAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,GAAA,GAAM,KAAK,UAAA,IAAc,GAAA;AAC/B,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,IAAI,OAAA,EAAQ,GAAI,MAAM,GAAI,CAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,WAAA,EAAY;AAExC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,SAAA,GAAY;AAAA,IACd,WAAA;AAAA,IACA,CAAA,SAAA,EAAY,KAAK,OAAO,CAAA,CAAA;AAAA,IACxB,UAAU,KAAK,CAAA,CAAA;AAAA,IACf,CAAA,WAAA,EAAc,GAAA,CAAI,GAAG,CAAC,CAAA,CAAA;AAAA,IACtB,CAAA,YAAA,EAAe,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC7B,QAAQ,QAAQ,CAAA;AAAA,GACpB;AAEA,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,CAAW,IAAA,CAAK,CAAC,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,EAAW,IAAA,CAAK,OAAO,CAAC,CAAA;AAE3D,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,IAAI,CAAE,CAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,EAAW,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAEzD,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,YAAA,EAAc,IAAI,SAAS;AAAA,GAC/B;AACJ;AAaA,SAAS,eAAe,OAAA,EAAkC;AACtD,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,QAAA,CAAS,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,KAAA,CAAM,IAAI,CAAA,GAAI,OAAA,CAAQ,MAAM,IAAI,CAAA;AAE5F,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,WAAA,EAAa;AAC1B,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,GAAA,GAAuB,EAAE,UAAA,EAAY,EAAC,EAAE;AAC9C,EAAA,MAAM,WAAW,CAAC,SAAA,EAAW,OAAA,EAAS,WAAA,EAAa,cAAc,KAAK,CAAA;AACtE,EAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAY,QAAQ,CAAA;AAK3C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAE9B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,MAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AAAA,MAC7D;AACA,MAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,WAAA,IAC5B,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,KAAA,GAAQ,GAAA;AAAA,WAAA,IAC7B,QAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,GAAW,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAChD,QAAQ,YAAA,EAAc,GAAA,CAAI,SAAA,GAAY,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAClD,GAAA,KAAQ,KAAA,EAAO,GAAA,CAAI,GAAA,GAAM,GAAA;AAAA,IACtC,CAAA,MAAO;AACH,MAAA,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC9B,MAAA,IAAI,GAAA,KAAQ,UAAA,EAAY,GAAA,CAAI,QAAA,GAAW,GAAA;AACvC,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,IACzC;AAAA,EACJ;AAEA,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,MAAA,EAAQ;AACnC,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,QAAA,CAAS,IAAI,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,GAAA;AACX;AA0DA,eAAsB,gBAClB,IAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,cAAA,CAAe,KAAK,OAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,EAAE,SAAS,KAAA,EAAO,QAAA,EAAU,WAAW,GAAA,EAAK,QAAA,EAAU,SAAQ,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,WAAW,CAAC,KAAA,IAAS,CAAC,QAAA,IAAY,CAAC,SAAA,IAAa,CAAC,GAAA,EAAK;AACvD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,QAAQ,QAAA,EAAU;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,IAAe,CAAA;AAEjC,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,SAAA,CAAU,SAAQ,EAAG;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAU;AAAA,EAC1C;AACA,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,QAAA,CAAS,SAAQ,EAAG;AAC3C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,EAChD;AAEA,EAAA,IAAI,IAAA,CAAK,aAAA,IAAiB,KAAA,KAAU,IAAA,CAAK,aAAA,EAAe;AACpD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,QAAA,KAAa,IAAA,CAAK,gBAAA,EAAkB;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACpD;AACA,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,OAAA,KAAY,IAAA,CAAK,eAAA,EAAiB;AAC1D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACnD;AAEA,EAAA,MAAM,MAAA,GAAiB,KAAK,MAAA,IAAU,QAAA;AACtC,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,WAAW,QAAA,EAAU;AACrB,IAAA,MAAM,SAAA,GACF,iBAAiB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,IAAK,IAAA,CAAK,UAAU,MAAA,GAAS,CAAA,KAAM,IACjEA,aAAA,CAAO,IAAA,CAAK,KAAK,SAAA,EAAW,KAAK,EAAE,QAAA,CAAS,QAAQ,IACpD,IAAA,CAAK,SAAA;AACf,IAAA,QAAA,GAAWC,sBAAA,CAAuB,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,SAAS,CAAA;AAAA,EACtE,CAAA,MAAA,IAAW,WAAW,QAAA,EAAU;AAE5B,IAAA,IAAI,CAAC,mCAAA,CAAoC,IAAA,CAAK,OAAO,CAAA,EAAG;AACpD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,IACzD;AACA,IAAA,QAAA,GAAWA,sBAAA,CAAuB,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,KAAK,SAAS,CAAA;AAAA,EAC3E,CAAA,MAAO;AACH,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AAEzD,EAAA,OAAO;AAAA,IACH,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,KAAA;AAAA,IACA,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC/C;AACJ","file":"challenge.js","sourcesContent":["/**\n * Signed-challenge auth\n *\n * When a gate can't trust the address source (public header, query string,\n * unsigned cookie), run a one-shot BIP-322 challenge first to cryptographically\n * prove the caller controls the address. Bind the proven address to a session\n * cookie or JWT, and the gate reads from there.\n *\n * This is a different wire format from the main OCP attestation — the header\n * literal is `orangecheck-auth`, not `orangecheck`, so a signed auth challenge\n * can never be confused with a reputation attestation.\n *\n *   // Server, on the \"connect wallet\" flow:\n *   const challenge = issueChallenge({ address, ttlSeconds: 300 });\n *   // → send challenge.message to the client\n *\n *   // Client signs challenge.message with BIP-322 via the user's wallet,\n *   // then posts { message, signature } back.\n *\n *   // Server, on callback:\n *   const result = await verifyChallenge({ message, signature });\n *   if (result.ok) {\n *     // result.address is now cryptographically proven; attach to session.\n *   }\n */\n\nimport type { Scheme } from './types';\n\nimport { Buffer } from 'buffer';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nconst AUTH_HEADER = 'orangecheck-auth';\nconst AUTH_ACK = 'I authorize this session under the OrangeCheck auth challenge.';\n\nfunction randomNonce(): string {\n    // 16 bytes → 32 lowercase hex chars. Matches OCP core nonce format.\n    const bytes = new Uint8Array(16);\n    // Runtimes: Node 20+ (webcrypto), browsers.\n    if (typeof globalThis.crypto?.getRandomValues === 'function') {\n        globalThis.crypto.getRandomValues(bytes);\n    } else {\n        // Fallback: Math.random is *not* cryptographic — acceptable only for\n        // environments without webcrypto (old Node). Flagged explicitly.\n        for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);\n    }\n    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nfunction iso(date: Date): string {\n    return date.toISOString().replace(/\\.\\d{3}Z$/, 'Z');\n}\n\nexport interface IssueChallengeOptions {\n    /** Bitcoin address the caller claims to control. */\n    address: string;\n    /** How long the challenge is valid for. Default 300 (5 minutes). */\n    ttlSeconds?: number;\n    /** Explicit nonce. Rare; prefer auto-generated. */\n    nonce?: string;\n    /** Origin-binding extension. If set, verify will require a match. */\n    audience?: string;\n    /** Human-readable label baked into the signed message. */\n    purpose?: string;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport interface Challenge {\n    /** The canonical text the client MUST sign. */\n    message: string;\n    /** The generated nonce (kept for correlation / server-side storage). */\n    nonce: string;\n    /** Unix ms epoch the challenge expires at. */\n    expiresAt: number;\n    /** ISO string of the same. */\n    expiresAtIso: string;\n}\n\n/**\n * Build a new signed-challenge message. The server MUST remember the nonce\n * it issued against the session (Redis, signed cookie, DB) so it can detect\n * replay or a different nonce coming back on verify.\n */\nexport function issueChallenge(opts: IssueChallengeOptions): Challenge {\n    const now = opts.now ?? new Date();\n    const ttl = opts.ttlSeconds ?? 300;\n    const expiresAt = new Date(now.getTime() + ttl * 1000);\n    const nonce = opts.nonce ?? randomNonce();\n\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('nonce must be 32 lowercase hex characters');\n    }\n\n    const coreLines = [\n        AUTH_HEADER,\n        `address: ${opts.address}`,\n        `nonce: ${nonce}`,\n        `issued_at: ${iso(now)}`,\n        `expires_at: ${iso(expiresAt)}`,\n        `ack: ${AUTH_ACK}`,\n    ];\n\n    const extensions: Array<[string, string]> = [];\n    if (opts.audience) extensions.push(['audience', opts.audience]);\n    if (opts.purpose) extensions.push(['purpose', opts.purpose]);\n    // Lexicographic sort by key — matches OCP canonicalization rules.\n    extensions.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n\n    const extLines = extensions.map(([k, v]) => `${k}: ${v}`);\n    const message = [...coreLines, ...extLines].join('\\n') + '\\n';\n\n    return {\n        message,\n        nonce,\n        expiresAt: expiresAt.getTime(),\n        expiresAtIso: iso(expiresAt),\n    };\n}\n\ninterface ParsedChallenge {\n    address?: string;\n    nonce?: string;\n    issuedAt?: Date;\n    expiresAt?: Date;\n    ack?: string;\n    audience?: string;\n    purpose?: string;\n    extensions: Array<[string, string]>;\n}\n\nfunction parseChallenge(message: string): ParsedChallenge {\n    const lines = message.endsWith('\\n') ? message.slice(0, -1).split('\\n') : message.split('\\n');\n\n    if (lines[0] !== AUTH_HEADER) {\n        throw new Error('not an orangecheck-auth challenge');\n    }\n\n    const out: ParsedChallenge = { extensions: [] };\n    const coreKeys = ['address', 'nonce', 'issued_at', 'expires_at', 'ack'] as const;\n    const coreKeySet = new Set<string>(coreKeys);\n    // Duplicate detection: a challenge with two `address:` lines would\n    // previously let the second overwrite the first. A signer who saw both\n    // lines would still sign the whole text — which means the verifier and\n    // the signer disagree about what the message \"said\". Refuse instead.\n    const seenCore = new Set<string>();\n\n    for (let i = 1; i < lines.length; i++) {\n        const line = lines[i] ?? '';\n        const sep = line.indexOf(': ');\n        if (sep === -1) continue;\n        const key = line.slice(0, sep);\n        const val = line.slice(sep + 2);\n\n        if (coreKeySet.has(key)) {\n            if (seenCore.has(key)) {\n                throw new Error(`duplicate core key in challenge: ${key}`);\n            }\n            seenCore.add(key);\n            if (key === 'address') out.address = val;\n            else if (key === 'nonce') out.nonce = val;\n            else if (key === 'issued_at') out.issuedAt = new Date(val);\n            else if (key === 'expires_at') out.expiresAt = new Date(val);\n            else if (key === 'ack') out.ack = val;\n        } else {\n            out.extensions.push([key, val]);\n            if (key === 'audience') out.audience = val;\n            if (key === 'purpose') out.purpose = val;\n        }\n    }\n\n    if (seenCore.size !== coreKeys.length) {\n        throw new Error(`challenge missing core lines (${seenCore.size}/${coreKeys.length})`);\n    }\n    return out;\n}\n\nexport interface VerifyChallengeOptions {\n    /** The signed canonical challenge text, exactly as issued. */\n    message: string;\n    /** BIP-322 or legacy signature. */\n    signature: string;\n    /** Scheme override. Default 'bip322'. */\n    scheme?: Scheme;\n\n    /** If set, require the challenge's `audience:` extension to match. */\n    expectedAudience?: string;\n    /** If set, require the challenge's `purpose:` extension to match. */\n    expectedPurpose?: string;\n    /**\n     * If set, require the challenge's `nonce:` to match. Use this to defeat\n     * replay — pair with server-side nonce storage (Redis / signed cookie).\n     */\n    expectedNonce?: string;\n\n    /** Tolerance on expiry check in ms. Default 0. */\n    clockSkewMs?: number;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport type VerifyChallengeReason =\n    | 'ok'\n    | 'malformed'\n    | 'expired'\n    | 'not_yet_valid'\n    | 'sig_invalid'\n    | 'sig_unsupported_scheme'\n    | 'audience_mismatch'\n    | 'purpose_mismatch'\n    | 'nonce_mismatch';\n\nexport interface VerifyChallengeResult {\n    ok: boolean;\n    reason: VerifyChallengeReason;\n    /** Present on success — the cryptographically proven Bitcoin address. */\n    address?: string;\n    /** Present on success — when the challenge expires (unix ms). */\n    expiresAt?: number;\n    /** Present on success — the nonce from the challenge. */\n    nonce?: string;\n    /** Present on success — the audience extension, if any. */\n    audience?: string;\n    /** Present on success — the purpose extension, if any. */\n    purpose?: string;\n}\n\n/**\n * Verify a signed challenge. Returns the proven address on success.\n *\n * The caller is responsible for nonce replay prevention — pass `expectedNonce`\n * with the value you stashed at issue time.\n */\nexport async function verifyChallenge(\n    opts: VerifyChallengeOptions\n): Promise<VerifyChallengeResult> {\n    let parsed: ParsedChallenge;\n    try {\n        parsed = parseChallenge(opts.message);\n    } catch {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;\n    if (!address || !nonce || !issuedAt || !expiresAt || !ack) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (ack !== AUTH_ACK) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const now = opts.now ?? new Date();\n    const skew = opts.clockSkewMs ?? 0;\n\n    if (now.getTime() - skew > expiresAt.getTime()) {\n        return { ok: false, reason: 'expired' };\n    }\n    if (now.getTime() + skew < issuedAt.getTime()) {\n        return { ok: false, reason: 'not_yet_valid' };\n    }\n\n    if (opts.expectedNonce && nonce !== opts.expectedNonce) {\n        return { ok: false, reason: 'nonce_mismatch' };\n    }\n    if (opts.expectedAudience && audience !== opts.expectedAudience) {\n        return { ok: false, reason: 'audience_mismatch' };\n    }\n    if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {\n        return { ok: false, reason: 'purpose_mismatch' };\n    }\n\n    const scheme: Scheme = opts.scheme ?? 'bip322';\n    let sigValid: boolean;\n    if (scheme === 'bip322') {\n        const sigBase64 =\n            /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0\n                ? Buffer.from(opts.signature, 'hex').toString('base64')\n                : opts.signature;\n        sigValid = verifyBitcoinSignature(address, opts.message, sigBase64);\n    } else if (scheme === 'legacy') {\n        // Legacy signmessage only works for P2PKH addresses.\n        if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {\n            return { ok: false, reason: 'sig_unsupported_scheme' };\n        }\n        sigValid = verifyBitcoinSignature(address, opts.message, opts.signature);\n    } else {\n        return { ok: false, reason: 'sig_unsupported_scheme' };\n    }\n\n    if (!sigValid) return { ok: false, reason: 'sig_invalid' };\n\n    return {\n        ok: true,\n        reason: 'ok',\n        address,\n        expiresAt: expiresAt.getTime(),\n        nonce,\n        ...(audience !== undefined ? { audience } : {}),\n        ...(purpose !== undefined ? { purpose } : {}),\n    };\n}\n"]}
+{"version":3,"sources":["../src/utils/signature.ts","../src/challenge.ts"],"names":["Buffer","verifyBitcoinSignature"],"mappings":";;;;;;AAKO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,IAAI,iBAAiB,IAAA,CAAK,GAAG,KAAK,GAAA,CAAI,MAAA,GAAS,MAAM,CAAA,EAAG;AACpD,IAAA,OAAOA,cAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,gBAAgB,SAAA,EAAkC;AAC9D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,IAAA;AACzC,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,QAAA;AACxC,EAAA,OAAOA,cAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA,CAAE,MAAA,KAAW,KAAK,QAAA,GAAW,QAAA;AACvE;;;ACUA,IAAM,WAAA,GAAc,kBAAA;AACpB,IAAM,QAAA,GAAW,gEAAA;AAEjB,SAAS,WAAA,GAAsB;AAE3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAE/B,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,EAAQ,eAAA,KAAoB,UAAA,EAAY;AAC1D,IAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAAA,EAC3C,CAAA,MAAO;AAGH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5E;AAEA,SAAS,IAAI,IAAA,EAAoB;AAC7B,EAAA,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AACtD;AAiCO,SAAS,eAAe,IAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,GAAA,GAAM,KAAK,UAAA,IAAc,GAAA;AAC/B,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,IAAI,OAAA,EAAQ,GAAI,MAAM,GAAI,CAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,WAAA,EAAY;AAExC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,SAAA,GAAY;AAAA,IACd,WAAA;AAAA,IACA,CAAA,SAAA,EAAY,KAAK,OAAO,CAAA,CAAA;AAAA,IACxB,UAAU,KAAK,CAAA,CAAA;AAAA,IACf,CAAA,WAAA,EAAc,GAAA,CAAI,GAAG,CAAC,CAAA,CAAA;AAAA,IACtB,CAAA,YAAA,EAAe,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC7B,QAAQ,QAAQ,CAAA;AAAA,GACpB;AAEA,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,CAAW,IAAA,CAAK,CAAC,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,EAAW,IAAA,CAAK,OAAO,CAAC,CAAA;AAE3D,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,IAAI,CAAE,CAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,EAAW,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAEzD,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,YAAA,EAAc,IAAI,SAAS;AAAA,GAC/B;AACJ;AAaA,SAAS,eAAe,OAAA,EAAkC;AACtD,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,QAAA,CAAS,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,KAAA,CAAM,IAAI,CAAA,GAAI,OAAA,CAAQ,MAAM,IAAI,CAAA;AAE5F,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,WAAA,EAAa;AAC1B,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,GAAA,GAAuB,EAAE,UAAA,EAAY,EAAC,EAAE;AAC9C,EAAA,MAAM,WAAW,CAAC,SAAA,EAAW,OAAA,EAAS,WAAA,EAAa,cAAc,KAAK,CAAA;AACtE,EAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAY,QAAQ,CAAA;AAK3C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAE9B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,MAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AAAA,MAC7D;AACA,MAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,WAAA,IAC5B,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,KAAA,GAAQ,GAAA;AAAA,WAAA,IAC7B,QAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,GAAW,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAChD,QAAQ,YAAA,EAAc,GAAA,CAAI,SAAA,GAAY,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAClD,GAAA,KAAQ,KAAA,EAAO,GAAA,CAAI,GAAA,GAAM,GAAA;AAAA,IACtC,CAAA,MAAO;AACH,MAAA,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC9B,MAAA,IAAI,GAAA,KAAQ,UAAA,EAAY,GAAA,CAAI,QAAA,GAAW,GAAA;AACvC,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,IACzC;AAAA,EACJ;AAEA,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,MAAA,EAAQ;AACnC,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,QAAA,CAAS,IAAI,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,GAAA;AACX;AA4DA,eAAsB,gBAClB,IAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,cAAA,CAAe,KAAK,OAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,EAAE,SAAS,KAAA,EAAO,QAAA,EAAU,WAAW,GAAA,EAAK,QAAA,EAAU,SAAQ,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,WAAW,CAAC,KAAA,IAAS,CAAC,QAAA,IAAY,CAAC,SAAA,IAAa,CAAC,GAAA,EAAK;AACvD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,QAAQ,QAAA,EAAU;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,IAAe,CAAA;AAEjC,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,SAAA,CAAU,SAAQ,EAAG;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAU;AAAA,EAC1C;AACA,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,QAAA,CAAS,SAAQ,EAAG;AAC3C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,EAChD;AAEA,EAAA,IAAI,IAAA,CAAK,aAAA,IAAiB,KAAA,KAAU,IAAA,CAAK,aAAA,EAAe;AACpD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,QAAA,KAAa,IAAA,CAAK,gBAAA,EAAkB;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACpD;AACA,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,OAAA,KAAY,IAAA,CAAK,eAAA,EAAiB;AAC1D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACnD;AAEA,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,IAAA,CAAK,SAAS,CAAA;AAC9C,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,wBAAA,EAAyB;AAClE,EAAA,IAAI,CAACC,sBAAA,CAAuB,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,SAAS,CAAA,EAAG;AAC3D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AAAA,EAC9C;AAEA,EAAA,OAAO;AAAA,IACH,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,KAAA;AAAA,IACA,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC/C;AACJ","file":"challenge.js","sourcesContent":["import type { Scheme } from '../types';\n\nimport { Buffer } from 'buffer';\n\n/** A signature as base64: hex input is converted, anything else passes through. */\nexport function toBase64Maybe(sig: string): string {\n    if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {\n        return Buffer.from(sig, 'hex').toString('base64');\n    }\n    return sig;\n}\n\n/**\n * The scheme a signature's bytes say it is, the same rule @orangecheck/bip322\n * verifies by: 65 bytes is a BIP-137 compact signature, whatever the address,\n * and anything else is BIP-322 simple. `null` for a BIP-322 full or\n * proof-of-funds signature, which is not supported.\n */\nexport function signatureScheme(sigBase64: string): Scheme | null {\n    if (/^(ful|pof)/.test(sigBase64)) return null;\n    if (sigBase64.startsWith('smp')) return 'bip322';\n    return Buffer.from(sigBase64, 'base64').length === 65 ? 'legacy' : 'bip322';\n}\n","/**\n * Signed-challenge auth\n *\n * When a gate can't trust the address source (public header, query string,\n * unsigned cookie), run a one-shot BIP-322 challenge first to cryptographically\n * prove the caller controls the address. Bind the proven address to a session\n * cookie or JWT, and the gate reads from there.\n *\n * This is a different wire format from the main OCP attestation — the header\n * literal is `orangecheck-auth`, not `orangecheck`, so a signed auth challenge\n * can never be confused with a reputation attestation.\n *\n *   // Server, on the \"connect wallet\" flow:\n *   const challenge = issueChallenge({ address, ttlSeconds: 300 });\n *   // → send challenge.message to the client\n *\n *   // Client signs challenge.message with BIP-322 via the user's wallet,\n *   // then posts { message, signature } back.\n *\n *   // Server, on callback:\n *   const result = await verifyChallenge({ message, signature });\n *   if (result.ok) {\n *     // result.address is now cryptographically proven; attach to session.\n *   }\n */\n\nimport type { Scheme } from './types';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nimport { signatureScheme, toBase64Maybe } from './utils/signature';\n\nconst AUTH_HEADER = 'orangecheck-auth';\nconst AUTH_ACK = 'I authorize this session under the OrangeCheck auth challenge.';\n\nfunction randomNonce(): string {\n    // 16 bytes → 32 lowercase hex chars. Matches OCP core nonce format.\n    const bytes = new Uint8Array(16);\n    // Runtimes: Node 20+ (webcrypto), browsers.\n    if (typeof globalThis.crypto?.getRandomValues === 'function') {\n        globalThis.crypto.getRandomValues(bytes);\n    } else {\n        // Fallback: Math.random is *not* cryptographic — acceptable only for\n        // environments without webcrypto (old Node). Flagged explicitly.\n        for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);\n    }\n    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nfunction iso(date: Date): string {\n    return date.toISOString().replace(/\\.\\d{3}Z$/, 'Z');\n}\n\nexport interface IssueChallengeOptions {\n    /** Bitcoin address the caller claims to control. */\n    address: string;\n    /** How long the challenge is valid for. Default 300 (5 minutes). */\n    ttlSeconds?: number;\n    /** Explicit nonce. Rare; prefer auto-generated. */\n    nonce?: string;\n    /** Origin-binding extension. If set, verify will require a match. */\n    audience?: string;\n    /** Human-readable label baked into the signed message. */\n    purpose?: string;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport interface Challenge {\n    /** The canonical text the client MUST sign. */\n    message: string;\n    /** The generated nonce (kept for correlation / server-side storage). */\n    nonce: string;\n    /** Unix ms epoch the challenge expires at. */\n    expiresAt: number;\n    /** ISO string of the same. */\n    expiresAtIso: string;\n}\n\n/**\n * Build a new signed-challenge message. The server MUST remember the nonce\n * it issued against the session (Redis, signed cookie, DB) so it can detect\n * replay or a different nonce coming back on verify.\n */\nexport function issueChallenge(opts: IssueChallengeOptions): Challenge {\n    const now = opts.now ?? new Date();\n    const ttl = opts.ttlSeconds ?? 300;\n    const expiresAt = new Date(now.getTime() + ttl * 1000);\n    const nonce = opts.nonce ?? randomNonce();\n\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('nonce must be 32 lowercase hex characters');\n    }\n\n    const coreLines = [\n        AUTH_HEADER,\n        `address: ${opts.address}`,\n        `nonce: ${nonce}`,\n        `issued_at: ${iso(now)}`,\n        `expires_at: ${iso(expiresAt)}`,\n        `ack: ${AUTH_ACK}`,\n    ];\n\n    const extensions: Array<[string, string]> = [];\n    if (opts.audience) extensions.push(['audience', opts.audience]);\n    if (opts.purpose) extensions.push(['purpose', opts.purpose]);\n    // Lexicographic sort by key — matches OCP canonicalization rules.\n    extensions.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n\n    const extLines = extensions.map(([k, v]) => `${k}: ${v}`);\n    const message = [...coreLines, ...extLines].join('\\n') + '\\n';\n\n    return {\n        message,\n        nonce,\n        expiresAt: expiresAt.getTime(),\n        expiresAtIso: iso(expiresAt),\n    };\n}\n\ninterface ParsedChallenge {\n    address?: string;\n    nonce?: string;\n    issuedAt?: Date;\n    expiresAt?: Date;\n    ack?: string;\n    audience?: string;\n    purpose?: string;\n    extensions: Array<[string, string]>;\n}\n\nfunction parseChallenge(message: string): ParsedChallenge {\n    const lines = message.endsWith('\\n') ? message.slice(0, -1).split('\\n') : message.split('\\n');\n\n    if (lines[0] !== AUTH_HEADER) {\n        throw new Error('not an orangecheck-auth challenge');\n    }\n\n    const out: ParsedChallenge = { extensions: [] };\n    const coreKeys = ['address', 'nonce', 'issued_at', 'expires_at', 'ack'] as const;\n    const coreKeySet = new Set<string>(coreKeys);\n    // Duplicate detection: a challenge with two `address:` lines would\n    // previously let the second overwrite the first. A signer who saw both\n    // lines would still sign the whole text — which means the verifier and\n    // the signer disagree about what the message \"said\". Refuse instead.\n    const seenCore = new Set<string>();\n\n    for (let i = 1; i < lines.length; i++) {\n        const line = lines[i] ?? '';\n        const sep = line.indexOf(': ');\n        if (sep === -1) continue;\n        const key = line.slice(0, sep);\n        const val = line.slice(sep + 2);\n\n        if (coreKeySet.has(key)) {\n            if (seenCore.has(key)) {\n                throw new Error(`duplicate core key in challenge: ${key}`);\n            }\n            seenCore.add(key);\n            if (key === 'address') out.address = val;\n            else if (key === 'nonce') out.nonce = val;\n            else if (key === 'issued_at') out.issuedAt = new Date(val);\n            else if (key === 'expires_at') out.expiresAt = new Date(val);\n            else if (key === 'ack') out.ack = val;\n        } else {\n            out.extensions.push([key, val]);\n            if (key === 'audience') out.audience = val;\n            if (key === 'purpose') out.purpose = val;\n        }\n    }\n\n    if (seenCore.size !== coreKeys.length) {\n        throw new Error(`challenge missing core lines (${seenCore.size}/${coreKeys.length})`);\n    }\n    return out;\n}\n\nexport interface VerifyChallengeOptions {\n    /** The signed canonical challenge text, exactly as issued. */\n    message: string;\n    /** BIP-322 or legacy signature, base64 or hex. */\n    signature: string;\n    /** @deprecated Ignored: the signature's own bytes decide the scheme. */\n    scheme?: Scheme;\n\n    /** If set, require the challenge's `audience:` extension to match. */\n    expectedAudience?: string;\n    /** If set, require the challenge's `purpose:` extension to match. */\n    expectedPurpose?: string;\n    /**\n     * If set, require the challenge's `nonce:` to match. Use this to defeat\n     * replay — pair with server-side nonce storage (Redis / signed cookie).\n     */\n    expectedNonce?: string;\n\n    /** Tolerance on expiry check in ms. Default 0. */\n    clockSkewMs?: number;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport type VerifyChallengeReason =\n    | 'ok'\n    | 'malformed'\n    | 'expired'\n    | 'not_yet_valid'\n    | 'sig_invalid'\n    | 'sig_unsupported_scheme'\n    | 'audience_mismatch'\n    | 'purpose_mismatch'\n    | 'nonce_mismatch';\n\nexport interface VerifyChallengeResult {\n    ok: boolean;\n    reason: VerifyChallengeReason;\n    /** Present on success — the cryptographically proven Bitcoin address. */\n    address?: string;\n    /** Present on success — the scheme that verified the signature. */\n    scheme?: Scheme;\n    /** Present on success — when the challenge expires (unix ms). */\n    expiresAt?: number;\n    /** Present on success — the nonce from the challenge. */\n    nonce?: string;\n    /** Present on success — the audience extension, if any. */\n    audience?: string;\n    /** Present on success — the purpose extension, if any. */\n    purpose?: string;\n}\n\n/**\n * Verify a signed challenge. Returns the proven address on success.\n *\n * The caller is responsible for nonce replay prevention — pass `expectedNonce`\n * with the value you stashed at issue time.\n */\nexport async function verifyChallenge(\n    opts: VerifyChallengeOptions\n): Promise<VerifyChallengeResult> {\n    let parsed: ParsedChallenge;\n    try {\n        parsed = parseChallenge(opts.message);\n    } catch {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;\n    if (!address || !nonce || !issuedAt || !expiresAt || !ack) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (ack !== AUTH_ACK) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const now = opts.now ?? new Date();\n    const skew = opts.clockSkewMs ?? 0;\n\n    if (now.getTime() - skew > expiresAt.getTime()) {\n        return { ok: false, reason: 'expired' };\n    }\n    if (now.getTime() + skew < issuedAt.getTime()) {\n        return { ok: false, reason: 'not_yet_valid' };\n    }\n\n    if (opts.expectedNonce && nonce !== opts.expectedNonce) {\n        return { ok: false, reason: 'nonce_mismatch' };\n    }\n    if (opts.expectedAudience && audience !== opts.expectedAudience) {\n        return { ok: false, reason: 'audience_mismatch' };\n    }\n    if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {\n        return { ok: false, reason: 'purpose_mismatch' };\n    }\n\n    const sigBase64 = toBase64Maybe(opts.signature);\n    const scheme = signatureScheme(sigBase64);\n    if (!scheme) return { ok: false, reason: 'sig_unsupported_scheme' };\n    if (!verifyBitcoinSignature(address, opts.message, sigBase64)) {\n        return { ok: false, reason: 'sig_invalid' };\n    }\n\n    return {\n        ok: true,\n        reason: 'ok',\n        address,\n        scheme,\n        expiresAt: expiresAt.getTime(),\n        nonce,\n        ...(audience !== undefined ? { audience } : {}),\n        ...(purpose !== undefined ? { purpose } : {}),\n    };\n}\n"]}

package/dist/challenge.mjs

@@ -1,5 +1,18 @@
-import { Buffer } from 'buffer';
 import { verifySignature } from '@orangecheck/bip322';
+import { Buffer } from 'buffer';
+
+// src/challenge.ts
+function toBase64Maybe(sig) {
+  if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {
+    return Buffer.from(sig, "hex").toString("base64");
+  }
+  return sig;
+}
+function signatureScheme(sigBase64) {
+  if (/^(ful|pof)/.test(sigBase64)) return null;
+  if (sigBase64.startsWith("smp")) return "bip322";
+  return Buffer.from(sigBase64, "base64").length === 65 ? "legacy" : "bip322";
+}
 
 // src/challenge.ts
 var AUTH_HEADER = "orangecheck-auth";
@@ -115,24 +128,17 @@ async function verifyChallenge(opts) {
   if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {
     return { ok: false, reason: "purpose_mismatch" };
   }
-  const scheme = opts.scheme ?? "bip322";
-  let sigValid;
-  if (scheme === "bip322") {
-    const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
-    sigValid = verifySignature(address, opts.message, sigBase64);
-  } else if (scheme === "legacy") {
-    if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
-      return { ok: false, reason: "sig_unsupported_scheme" };
-    }
-    sigValid = verifySignature(address, opts.message, opts.signature);
-  } else {
-    return { ok: false, reason: "sig_unsupported_scheme" };
+  const sigBase64 = toBase64Maybe(opts.signature);
+  const scheme = signatureScheme(sigBase64);
+  if (!scheme) return { ok: false, reason: "sig_unsupported_scheme" };
+  if (!verifySignature(address, opts.message, sigBase64)) {
+    return { ok: false, reason: "sig_invalid" };
   }
-  if (!sigValid) return { ok: false, reason: "sig_invalid" };
   return {
     ok: true,
     reason: "ok",
     address,
+    scheme,
     expiresAt: expiresAt.getTime(),
     nonce,
     ...audience !== void 0 ? { audience } : {},

package/dist/challenge.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/challenge.ts"],"names":["verifyBitcoinSignature"],"mappings":";;;;AAgCA,IAAM,WAAA,GAAc,kBAAA;AACpB,IAAM,QAAA,GAAW,gEAAA;AAEjB,SAAS,WAAA,GAAsB;AAE3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAE/B,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,EAAQ,eAAA,KAAoB,UAAA,EAAY;AAC1D,IAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAAA,EAC3C,CAAA,MAAO;AAGH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5E;AAEA,SAAS,IAAI,IAAA,EAAoB;AAC7B,EAAA,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AACtD;AAiCO,SAAS,eAAe,IAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,GAAA,GAAM,KAAK,UAAA,IAAc,GAAA;AAC/B,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,IAAI,OAAA,EAAQ,GAAI,MAAM,GAAI,CAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,WAAA,EAAY;AAExC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,SAAA,GAAY;AAAA,IACd,WAAA;AAAA,IACA,CAAA,SAAA,EAAY,KAAK,OAAO,CAAA,CAAA;AAAA,IACxB,UAAU,KAAK,CAAA,CAAA;AAAA,IACf,CAAA,WAAA,EAAc,GAAA,CAAI,GAAG,CAAC,CAAA,CAAA;AAAA,IACtB,CAAA,YAAA,EAAe,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC7B,QAAQ,QAAQ,CAAA;AAAA,GACpB;AAEA,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,CAAW,IAAA,CAAK,CAAC,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,EAAW,IAAA,CAAK,OAAO,CAAC,CAAA;AAE3D,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,IAAI,CAAE,CAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,EAAW,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAEzD,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,YAAA,EAAc,IAAI,SAAS;AAAA,GAC/B;AACJ;AAaA,SAAS,eAAe,OAAA,EAAkC;AACtD,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,QAAA,CAAS,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,KAAA,CAAM,IAAI,CAAA,GAAI,OAAA,CAAQ,MAAM,IAAI,CAAA;AAE5F,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,WAAA,EAAa;AAC1B,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,GAAA,GAAuB,EAAE,UAAA,EAAY,EAAC,EAAE;AAC9C,EAAA,MAAM,WAAW,CAAC,SAAA,EAAW,OAAA,EAAS,WAAA,EAAa,cAAc,KAAK,CAAA;AACtE,EAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAY,QAAQ,CAAA;AAK3C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAE9B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,MAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AAAA,MAC7D;AACA,MAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,WAAA,IAC5B,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,KAAA,GAAQ,GAAA;AAAA,WAAA,IAC7B,QAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,GAAW,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAChD,QAAQ,YAAA,EAAc,GAAA,CAAI,SAAA,GAAY,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAClD,GAAA,KAAQ,KAAA,EAAO,GAAA,CAAI,GAAA,GAAM,GAAA;AAAA,IACtC,CAAA,MAAO;AACH,MAAA,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC9B,MAAA,IAAI,GAAA,KAAQ,UAAA,EAAY,GAAA,CAAI,QAAA,GAAW,GAAA;AACvC,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,IACzC;AAAA,EACJ;AAEA,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,MAAA,EAAQ;AACnC,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,QAAA,CAAS,IAAI,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,GAAA;AACX;AA0DA,eAAsB,gBAClB,IAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,cAAA,CAAe,KAAK,OAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,EAAE,SAAS,KAAA,EAAO,QAAA,EAAU,WAAW,GAAA,EAAK,QAAA,EAAU,SAAQ,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,WAAW,CAAC,KAAA,IAAS,CAAC,QAAA,IAAY,CAAC,SAAA,IAAa,CAAC,GAAA,EAAK;AACvD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,QAAQ,QAAA,EAAU;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,IAAe,CAAA;AAEjC,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,SAAA,CAAU,SAAQ,EAAG;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAU;AAAA,EAC1C;AACA,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,QAAA,CAAS,SAAQ,EAAG;AAC3C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,EAChD;AAEA,EAAA,IAAI,IAAA,CAAK,aAAA,IAAiB,KAAA,KAAU,IAAA,CAAK,aAAA,EAAe;AACpD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,QAAA,KAAa,IAAA,CAAK,gBAAA,EAAkB;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACpD;AACA,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,OAAA,KAAY,IAAA,CAAK,eAAA,EAAiB;AAC1D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACnD;AAEA,EAAA,MAAM,MAAA,GAAiB,KAAK,MAAA,IAAU,QAAA;AACtC,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,WAAW,QAAA,EAAU;AACrB,IAAA,MAAM,SAAA,GACF,iBAAiB,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,IAAK,IAAA,CAAK,UAAU,MAAA,GAAS,CAAA,KAAM,IACjE,MAAA,CAAO,IAAA,CAAK,KAAK,SAAA,EAAW,KAAK,EAAE,QAAA,CAAS,QAAQ,IACpD,IAAA,CAAK,SAAA;AACf,IAAA,QAAA,GAAWA,eAAA,CAAuB,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,SAAS,CAAA;AAAA,EACtE,CAAA,MAAA,IAAW,WAAW,QAAA,EAAU;AAE5B,IAAA,IAAI,CAAC,mCAAA,CAAoC,IAAA,CAAK,OAAO,CAAA,EAAG;AACpD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,IACzD;AACA,IAAA,QAAA,GAAWA,eAAA,CAAuB,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,KAAK,SAAS,CAAA;AAAA,EAC3E,CAAA,MAAO;AACH,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,aAAA,EAAc;AAEzD,EAAA,OAAO;AAAA,IACH,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,KAAA;AAAA,IACA,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC/C;AACJ","file":"challenge.mjs","sourcesContent":["/**\n * Signed-challenge auth\n *\n * When a gate can't trust the address source (public header, query string,\n * unsigned cookie), run a one-shot BIP-322 challenge first to cryptographically\n * prove the caller controls the address. Bind the proven address to a session\n * cookie or JWT, and the gate reads from there.\n *\n * This is a different wire format from the main OCP attestation — the header\n * literal is `orangecheck-auth`, not `orangecheck`, so a signed auth challenge\n * can never be confused with a reputation attestation.\n *\n *   // Server, on the \"connect wallet\" flow:\n *   const challenge = issueChallenge({ address, ttlSeconds: 300 });\n *   // → send challenge.message to the client\n *\n *   // Client signs challenge.message with BIP-322 via the user's wallet,\n *   // then posts { message, signature } back.\n *\n *   // Server, on callback:\n *   const result = await verifyChallenge({ message, signature });\n *   if (result.ok) {\n *     // result.address is now cryptographically proven; attach to session.\n *   }\n */\n\nimport type { Scheme } from './types';\n\nimport { Buffer } from 'buffer';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nconst AUTH_HEADER = 'orangecheck-auth';\nconst AUTH_ACK = 'I authorize this session under the OrangeCheck auth challenge.';\n\nfunction randomNonce(): string {\n    // 16 bytes → 32 lowercase hex chars. Matches OCP core nonce format.\n    const bytes = new Uint8Array(16);\n    // Runtimes: Node 20+ (webcrypto), browsers.\n    if (typeof globalThis.crypto?.getRandomValues === 'function') {\n        globalThis.crypto.getRandomValues(bytes);\n    } else {\n        // Fallback: Math.random is *not* cryptographic — acceptable only for\n        // environments without webcrypto (old Node). Flagged explicitly.\n        for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);\n    }\n    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nfunction iso(date: Date): string {\n    return date.toISOString().replace(/\\.\\d{3}Z$/, 'Z');\n}\n\nexport interface IssueChallengeOptions {\n    /** Bitcoin address the caller claims to control. */\n    address: string;\n    /** How long the challenge is valid for. Default 300 (5 minutes). */\n    ttlSeconds?: number;\n    /** Explicit nonce. Rare; prefer auto-generated. */\n    nonce?: string;\n    /** Origin-binding extension. If set, verify will require a match. */\n    audience?: string;\n    /** Human-readable label baked into the signed message. */\n    purpose?: string;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport interface Challenge {\n    /** The canonical text the client MUST sign. */\n    message: string;\n    /** The generated nonce (kept for correlation / server-side storage). */\n    nonce: string;\n    /** Unix ms epoch the challenge expires at. */\n    expiresAt: number;\n    /** ISO string of the same. */\n    expiresAtIso: string;\n}\n\n/**\n * Build a new signed-challenge message. The server MUST remember the nonce\n * it issued against the session (Redis, signed cookie, DB) so it can detect\n * replay or a different nonce coming back on verify.\n */\nexport function issueChallenge(opts: IssueChallengeOptions): Challenge {\n    const now = opts.now ?? new Date();\n    const ttl = opts.ttlSeconds ?? 300;\n    const expiresAt = new Date(now.getTime() + ttl * 1000);\n    const nonce = opts.nonce ?? randomNonce();\n\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('nonce must be 32 lowercase hex characters');\n    }\n\n    const coreLines = [\n        AUTH_HEADER,\n        `address: ${opts.address}`,\n        `nonce: ${nonce}`,\n        `issued_at: ${iso(now)}`,\n        `expires_at: ${iso(expiresAt)}`,\n        `ack: ${AUTH_ACK}`,\n    ];\n\n    const extensions: Array<[string, string]> = [];\n    if (opts.audience) extensions.push(['audience', opts.audience]);\n    if (opts.purpose) extensions.push(['purpose', opts.purpose]);\n    // Lexicographic sort by key — matches OCP canonicalization rules.\n    extensions.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n\n    const extLines = extensions.map(([k, v]) => `${k}: ${v}`);\n    const message = [...coreLines, ...extLines].join('\\n') + '\\n';\n\n    return {\n        message,\n        nonce,\n        expiresAt: expiresAt.getTime(),\n        expiresAtIso: iso(expiresAt),\n    };\n}\n\ninterface ParsedChallenge {\n    address?: string;\n    nonce?: string;\n    issuedAt?: Date;\n    expiresAt?: Date;\n    ack?: string;\n    audience?: string;\n    purpose?: string;\n    extensions: Array<[string, string]>;\n}\n\nfunction parseChallenge(message: string): ParsedChallenge {\n    const lines = message.endsWith('\\n') ? message.slice(0, -1).split('\\n') : message.split('\\n');\n\n    if (lines[0] !== AUTH_HEADER) {\n        throw new Error('not an orangecheck-auth challenge');\n    }\n\n    const out: ParsedChallenge = { extensions: [] };\n    const coreKeys = ['address', 'nonce', 'issued_at', 'expires_at', 'ack'] as const;\n    const coreKeySet = new Set<string>(coreKeys);\n    // Duplicate detection: a challenge with two `address:` lines would\n    // previously let the second overwrite the first. A signer who saw both\n    // lines would still sign the whole text — which means the verifier and\n    // the signer disagree about what the message \"said\". Refuse instead.\n    const seenCore = new Set<string>();\n\n    for (let i = 1; i < lines.length; i++) {\n        const line = lines[i] ?? '';\n        const sep = line.indexOf(': ');\n        if (sep === -1) continue;\n        const key = line.slice(0, sep);\n        const val = line.slice(sep + 2);\n\n        if (coreKeySet.has(key)) {\n            if (seenCore.has(key)) {\n                throw new Error(`duplicate core key in challenge: ${key}`);\n            }\n            seenCore.add(key);\n            if (key === 'address') out.address = val;\n            else if (key === 'nonce') out.nonce = val;\n            else if (key === 'issued_at') out.issuedAt = new Date(val);\n            else if (key === 'expires_at') out.expiresAt = new Date(val);\n            else if (key === 'ack') out.ack = val;\n        } else {\n            out.extensions.push([key, val]);\n            if (key === 'audience') out.audience = val;\n            if (key === 'purpose') out.purpose = val;\n        }\n    }\n\n    if (seenCore.size !== coreKeys.length) {\n        throw new Error(`challenge missing core lines (${seenCore.size}/${coreKeys.length})`);\n    }\n    return out;\n}\n\nexport interface VerifyChallengeOptions {\n    /** The signed canonical challenge text, exactly as issued. */\n    message: string;\n    /** BIP-322 or legacy signature. */\n    signature: string;\n    /** Scheme override. Default 'bip322'. */\n    scheme?: Scheme;\n\n    /** If set, require the challenge's `audience:` extension to match. */\n    expectedAudience?: string;\n    /** If set, require the challenge's `purpose:` extension to match. */\n    expectedPurpose?: string;\n    /**\n     * If set, require the challenge's `nonce:` to match. Use this to defeat\n     * replay — pair with server-side nonce storage (Redis / signed cookie).\n     */\n    expectedNonce?: string;\n\n    /** Tolerance on expiry check in ms. Default 0. */\n    clockSkewMs?: number;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport type VerifyChallengeReason =\n    | 'ok'\n    | 'malformed'\n    | 'expired'\n    | 'not_yet_valid'\n    | 'sig_invalid'\n    | 'sig_unsupported_scheme'\n    | 'audience_mismatch'\n    | 'purpose_mismatch'\n    | 'nonce_mismatch';\n\nexport interface VerifyChallengeResult {\n    ok: boolean;\n    reason: VerifyChallengeReason;\n    /** Present on success — the cryptographically proven Bitcoin address. */\n    address?: string;\n    /** Present on success — when the challenge expires (unix ms). */\n    expiresAt?: number;\n    /** Present on success — the nonce from the challenge. */\n    nonce?: string;\n    /** Present on success — the audience extension, if any. */\n    audience?: string;\n    /** Present on success — the purpose extension, if any. */\n    purpose?: string;\n}\n\n/**\n * Verify a signed challenge. Returns the proven address on success.\n *\n * The caller is responsible for nonce replay prevention — pass `expectedNonce`\n * with the value you stashed at issue time.\n */\nexport async function verifyChallenge(\n    opts: VerifyChallengeOptions\n): Promise<VerifyChallengeResult> {\n    let parsed: ParsedChallenge;\n    try {\n        parsed = parseChallenge(opts.message);\n    } catch {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;\n    if (!address || !nonce || !issuedAt || !expiresAt || !ack) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (ack !== AUTH_ACK) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const now = opts.now ?? new Date();\n    const skew = opts.clockSkewMs ?? 0;\n\n    if (now.getTime() - skew > expiresAt.getTime()) {\n        return { ok: false, reason: 'expired' };\n    }\n    if (now.getTime() + skew < issuedAt.getTime()) {\n        return { ok: false, reason: 'not_yet_valid' };\n    }\n\n    if (opts.expectedNonce && nonce !== opts.expectedNonce) {\n        return { ok: false, reason: 'nonce_mismatch' };\n    }\n    if (opts.expectedAudience && audience !== opts.expectedAudience) {\n        return { ok: false, reason: 'audience_mismatch' };\n    }\n    if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {\n        return { ok: false, reason: 'purpose_mismatch' };\n    }\n\n    const scheme: Scheme = opts.scheme ?? 'bip322';\n    let sigValid: boolean;\n    if (scheme === 'bip322') {\n        const sigBase64 =\n            /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0\n                ? Buffer.from(opts.signature, 'hex').toString('base64')\n                : opts.signature;\n        sigValid = verifyBitcoinSignature(address, opts.message, sigBase64);\n    } else if (scheme === 'legacy') {\n        // Legacy signmessage only works for P2PKH addresses.\n        if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {\n            return { ok: false, reason: 'sig_unsupported_scheme' };\n        }\n        sigValid = verifyBitcoinSignature(address, opts.message, opts.signature);\n    } else {\n        return { ok: false, reason: 'sig_unsupported_scheme' };\n    }\n\n    if (!sigValid) return { ok: false, reason: 'sig_invalid' };\n\n    return {\n        ok: true,\n        reason: 'ok',\n        address,\n        expiresAt: expiresAt.getTime(),\n        nonce,\n        ...(audience !== undefined ? { audience } : {}),\n        ...(purpose !== undefined ? { purpose } : {}),\n    };\n}\n"]}
+{"version":3,"sources":["../src/utils/signature.ts","../src/challenge.ts"],"names":["verifyBitcoinSignature"],"mappings":";;;;AAKO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,IAAI,iBAAiB,IAAA,CAAK,GAAG,KAAK,GAAA,CAAI,MAAA,GAAS,MAAM,CAAA,EAAG;AACpD,IAAA,OAAO,OAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,gBAAgB,SAAA,EAAkC;AAC9D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,IAAA;AACzC,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,QAAA;AACxC,EAAA,OAAO,OAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA,CAAE,MAAA,KAAW,KAAK,QAAA,GAAW,QAAA;AACvE;;;ACUA,IAAM,WAAA,GAAc,kBAAA;AACpB,IAAM,QAAA,GAAW,gEAAA;AAEjB,SAAS,WAAA,GAAsB;AAE3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAE/B,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,EAAQ,eAAA,KAAoB,UAAA,EAAY;AAC1D,IAAA,UAAA,CAAW,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAAA,EAC3C,CAAA,MAAO;AAGH,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5E;AAEA,SAAS,IAAI,IAAA,EAAoB;AAC7B,EAAA,OAAO,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,aAAa,GAAG,CAAA;AACtD;AAiCO,SAAS,eAAe,IAAA,EAAwC;AACnE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,GAAA,GAAM,KAAK,UAAA,IAAc,GAAA;AAC/B,EAAA,MAAM,YAAY,IAAI,IAAA,CAAK,IAAI,OAAA,EAAQ,GAAI,MAAM,GAAI,CAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,WAAA,EAAY;AAExC,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,SAAA,GAAY;AAAA,IACd,WAAA;AAAA,IACA,CAAA,SAAA,EAAY,KAAK,OAAO,CAAA,CAAA;AAAA,IACxB,UAAU,KAAK,CAAA,CAAA;AAAA,IACf,CAAA,WAAA,EAAc,GAAA,CAAI,GAAG,CAAC,CAAA,CAAA;AAAA,IACtB,CAAA,YAAA,EAAe,GAAA,CAAI,SAAS,CAAC,CAAA,CAAA;AAAA,IAC7B,QAAQ,QAAQ,CAAA;AAAA,GACpB;AAEA,EAAA,MAAM,aAAsC,EAAC;AAC7C,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,CAAW,IAAA,CAAK,CAAC,UAAA,EAAY,IAAA,CAAK,QAAQ,CAAC,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,SAAS,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,EAAW,IAAA,CAAK,OAAO,CAAC,CAAA;AAE3D,EAAA,UAAA,CAAW,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,IAAI,CAAE,CAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE,CAAA;AACxD,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,SAAA,EAAW,GAAG,QAAQ,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAEzD,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,YAAA,EAAc,IAAI,SAAS;AAAA,GAC/B;AACJ;AAaA,SAAS,eAAe,OAAA,EAAkC;AACtD,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,QAAA,CAAS,IAAI,IAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,KAAA,CAAM,IAAI,CAAA,GAAI,OAAA,CAAQ,MAAM,IAAI,CAAA;AAE5F,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,KAAM,WAAA,EAAa;AAC1B,IAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,EACvD;AAEA,EAAA,MAAM,GAAA,GAAuB,EAAE,UAAA,EAAY,EAAC,EAAE;AAC9C,EAAA,MAAM,WAAW,CAAC,SAAA,EAAW,OAAA,EAAS,WAAA,EAAa,cAAc,KAAK,CAAA;AACtE,EAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAY,QAAQ,CAAA;AAK3C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAE9B,IAAA,IAAI,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,MAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AAAA,MAC7D;AACA,MAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,WAAA,IAC5B,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,KAAA,GAAQ,GAAA;AAAA,WAAA,IAC7B,QAAQ,WAAA,EAAa,GAAA,CAAI,QAAA,GAAW,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAChD,QAAQ,YAAA,EAAc,GAAA,CAAI,SAAA,GAAY,IAAI,KAAK,GAAG,CAAA;AAAA,WAAA,IAClD,GAAA,KAAQ,KAAA,EAAO,GAAA,CAAI,GAAA,GAAM,GAAA;AAAA,IACtC,CAAA,MAAO;AACH,MAAA,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,CAAC,GAAA,EAAK,GAAG,CAAC,CAAA;AAC9B,MAAA,IAAI,GAAA,KAAQ,UAAA,EAAY,GAAA,CAAI,QAAA,GAAW,GAAA;AACvC,MAAA,IAAI,GAAA,KAAQ,SAAA,EAAW,GAAA,CAAI,OAAA,GAAU,GAAA;AAAA,IACzC;AAAA,EACJ;AAEA,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,MAAA,EAAQ;AACnC,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,QAAA,CAAS,IAAI,CAAA,CAAA,EAAI,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,GAAA;AACX;AA4DA,eAAsB,gBAClB,IAAA,EAC8B;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,cAAA,CAAe,KAAK,OAAO,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,EAAE,SAAS,KAAA,EAAO,QAAA,EAAU,WAAW,GAAA,EAAK,QAAA,EAAU,SAAQ,GAAI,MAAA;AACxE,EAAA,IAAI,CAAC,WAAW,CAAC,KAAA,IAAS,CAAC,QAAA,IAAY,CAAC,SAAA,IAAa,CAAC,GAAA,EAAK;AACvD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,QAAQ,QAAA,EAAU;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,WAAA,EAAY;AAAA,EAC5C;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,oBAAO,IAAI,IAAA,EAAK;AACjC,EAAA,MAAM,IAAA,GAAO,KAAK,WAAA,IAAe,CAAA;AAEjC,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,SAAA,CAAU,SAAQ,EAAG;AAC5C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAU;AAAA,EAC1C;AACA,EAAA,IAAI,IAAI,OAAA,EAAQ,GAAI,IAAA,GAAO,QAAA,CAAS,SAAQ,EAAG;AAC3C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,eAAA,EAAgB;AAAA,EAChD;AAEA,EAAA,IAAI,IAAA,CAAK,aAAA,IAAiB,KAAA,KAAU,IAAA,CAAK,aAAA,EAAe;AACpD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,gBAAA,EAAiB;AAAA,EACjD;AACA,EAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,QAAA,KAAa,IAAA,CAAK,gBAAA,EAAkB;AAC7D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACpD;AACA,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,OAAA,KAAY,IAAA,CAAK,eAAA,EAAiB;AAC1D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kBAAA,EAAmB;AAAA,EACnD;AAEA,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,IAAA,CAAK,SAAS,CAAA;AAC9C,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,wBAAA,EAAyB;AAClE,EAAA,IAAI,CAACA,eAAA,CAAuB,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,SAAS,CAAA,EAAG;AAC3D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAc;AAAA,EAC9C;AAEA,EAAA,OAAO;AAAA,IACH,EAAA,EAAI,IAAA;AAAA,IACJ,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA,EAAW,UAAU,OAAA,EAAQ;AAAA,IAC7B,KAAA;AAAA,IACA,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC/C;AACJ","file":"challenge.mjs","sourcesContent":["import type { Scheme } from '../types';\n\nimport { Buffer } from 'buffer';\n\n/** A signature as base64: hex input is converted, anything else passes through. */\nexport function toBase64Maybe(sig: string): string {\n    if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {\n        return Buffer.from(sig, 'hex').toString('base64');\n    }\n    return sig;\n}\n\n/**\n * The scheme a signature's bytes say it is, the same rule @orangecheck/bip322\n * verifies by: 65 bytes is a BIP-137 compact signature, whatever the address,\n * and anything else is BIP-322 simple. `null` for a BIP-322 full or\n * proof-of-funds signature, which is not supported.\n */\nexport function signatureScheme(sigBase64: string): Scheme | null {\n    if (/^(ful|pof)/.test(sigBase64)) return null;\n    if (sigBase64.startsWith('smp')) return 'bip322';\n    return Buffer.from(sigBase64, 'base64').length === 65 ? 'legacy' : 'bip322';\n}\n","/**\n * Signed-challenge auth\n *\n * When a gate can't trust the address source (public header, query string,\n * unsigned cookie), run a one-shot BIP-322 challenge first to cryptographically\n * prove the caller controls the address. Bind the proven address to a session\n * cookie or JWT, and the gate reads from there.\n *\n * This is a different wire format from the main OCP attestation — the header\n * literal is `orangecheck-auth`, not `orangecheck`, so a signed auth challenge\n * can never be confused with a reputation attestation.\n *\n *   // Server, on the \"connect wallet\" flow:\n *   const challenge = issueChallenge({ address, ttlSeconds: 300 });\n *   // → send challenge.message to the client\n *\n *   // Client signs challenge.message with BIP-322 via the user's wallet,\n *   // then posts { message, signature } back.\n *\n *   // Server, on callback:\n *   const result = await verifyChallenge({ message, signature });\n *   if (result.ok) {\n *     // result.address is now cryptographically proven; attach to session.\n *   }\n */\n\nimport type { Scheme } from './types';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nimport { signatureScheme, toBase64Maybe } from './utils/signature';\n\nconst AUTH_HEADER = 'orangecheck-auth';\nconst AUTH_ACK = 'I authorize this session under the OrangeCheck auth challenge.';\n\nfunction randomNonce(): string {\n    // 16 bytes → 32 lowercase hex chars. Matches OCP core nonce format.\n    const bytes = new Uint8Array(16);\n    // Runtimes: Node 20+ (webcrypto), browsers.\n    if (typeof globalThis.crypto?.getRandomValues === 'function') {\n        globalThis.crypto.getRandomValues(bytes);\n    } else {\n        // Fallback: Math.random is *not* cryptographic — acceptable only for\n        // environments without webcrypto (old Node). Flagged explicitly.\n        for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);\n    }\n    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nfunction iso(date: Date): string {\n    return date.toISOString().replace(/\\.\\d{3}Z$/, 'Z');\n}\n\nexport interface IssueChallengeOptions {\n    /** Bitcoin address the caller claims to control. */\n    address: string;\n    /** How long the challenge is valid for. Default 300 (5 minutes). */\n    ttlSeconds?: number;\n    /** Explicit nonce. Rare; prefer auto-generated. */\n    nonce?: string;\n    /** Origin-binding extension. If set, verify will require a match. */\n    audience?: string;\n    /** Human-readable label baked into the signed message. */\n    purpose?: string;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport interface Challenge {\n    /** The canonical text the client MUST sign. */\n    message: string;\n    /** The generated nonce (kept for correlation / server-side storage). */\n    nonce: string;\n    /** Unix ms epoch the challenge expires at. */\n    expiresAt: number;\n    /** ISO string of the same. */\n    expiresAtIso: string;\n}\n\n/**\n * Build a new signed-challenge message. The server MUST remember the nonce\n * it issued against the session (Redis, signed cookie, DB) so it can detect\n * replay or a different nonce coming back on verify.\n */\nexport function issueChallenge(opts: IssueChallengeOptions): Challenge {\n    const now = opts.now ?? new Date();\n    const ttl = opts.ttlSeconds ?? 300;\n    const expiresAt = new Date(now.getTime() + ttl * 1000);\n    const nonce = opts.nonce ?? randomNonce();\n\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        throw new Error('nonce must be 32 lowercase hex characters');\n    }\n\n    const coreLines = [\n        AUTH_HEADER,\n        `address: ${opts.address}`,\n        `nonce: ${nonce}`,\n        `issued_at: ${iso(now)}`,\n        `expires_at: ${iso(expiresAt)}`,\n        `ack: ${AUTH_ACK}`,\n    ];\n\n    const extensions: Array<[string, string]> = [];\n    if (opts.audience) extensions.push(['audience', opts.audience]);\n    if (opts.purpose) extensions.push(['purpose', opts.purpose]);\n    // Lexicographic sort by key — matches OCP canonicalization rules.\n    extensions.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n\n    const extLines = extensions.map(([k, v]) => `${k}: ${v}`);\n    const message = [...coreLines, ...extLines].join('\\n') + '\\n';\n\n    return {\n        message,\n        nonce,\n        expiresAt: expiresAt.getTime(),\n        expiresAtIso: iso(expiresAt),\n    };\n}\n\ninterface ParsedChallenge {\n    address?: string;\n    nonce?: string;\n    issuedAt?: Date;\n    expiresAt?: Date;\n    ack?: string;\n    audience?: string;\n    purpose?: string;\n    extensions: Array<[string, string]>;\n}\n\nfunction parseChallenge(message: string): ParsedChallenge {\n    const lines = message.endsWith('\\n') ? message.slice(0, -1).split('\\n') : message.split('\\n');\n\n    if (lines[0] !== AUTH_HEADER) {\n        throw new Error('not an orangecheck-auth challenge');\n    }\n\n    const out: ParsedChallenge = { extensions: [] };\n    const coreKeys = ['address', 'nonce', 'issued_at', 'expires_at', 'ack'] as const;\n    const coreKeySet = new Set<string>(coreKeys);\n    // Duplicate detection: a challenge with two `address:` lines would\n    // previously let the second overwrite the first. A signer who saw both\n    // lines would still sign the whole text — which means the verifier and\n    // the signer disagree about what the message \"said\". Refuse instead.\n    const seenCore = new Set<string>();\n\n    for (let i = 1; i < lines.length; i++) {\n        const line = lines[i] ?? '';\n        const sep = line.indexOf(': ');\n        if (sep === -1) continue;\n        const key = line.slice(0, sep);\n        const val = line.slice(sep + 2);\n\n        if (coreKeySet.has(key)) {\n            if (seenCore.has(key)) {\n                throw new Error(`duplicate core key in challenge: ${key}`);\n            }\n            seenCore.add(key);\n            if (key === 'address') out.address = val;\n            else if (key === 'nonce') out.nonce = val;\n            else if (key === 'issued_at') out.issuedAt = new Date(val);\n            else if (key === 'expires_at') out.expiresAt = new Date(val);\n            else if (key === 'ack') out.ack = val;\n        } else {\n            out.extensions.push([key, val]);\n            if (key === 'audience') out.audience = val;\n            if (key === 'purpose') out.purpose = val;\n        }\n    }\n\n    if (seenCore.size !== coreKeys.length) {\n        throw new Error(`challenge missing core lines (${seenCore.size}/${coreKeys.length})`);\n    }\n    return out;\n}\n\nexport interface VerifyChallengeOptions {\n    /** The signed canonical challenge text, exactly as issued. */\n    message: string;\n    /** BIP-322 or legacy signature, base64 or hex. */\n    signature: string;\n    /** @deprecated Ignored: the signature's own bytes decide the scheme. */\n    scheme?: Scheme;\n\n    /** If set, require the challenge's `audience:` extension to match. */\n    expectedAudience?: string;\n    /** If set, require the challenge's `purpose:` extension to match. */\n    expectedPurpose?: string;\n    /**\n     * If set, require the challenge's `nonce:` to match. Use this to defeat\n     * replay — pair with server-side nonce storage (Redis / signed cookie).\n     */\n    expectedNonce?: string;\n\n    /** Tolerance on expiry check in ms. Default 0. */\n    clockSkewMs?: number;\n    /** Freeze `now` for tests. */\n    now?: Date;\n}\n\nexport type VerifyChallengeReason =\n    | 'ok'\n    | 'malformed'\n    | 'expired'\n    | 'not_yet_valid'\n    | 'sig_invalid'\n    | 'sig_unsupported_scheme'\n    | 'audience_mismatch'\n    | 'purpose_mismatch'\n    | 'nonce_mismatch';\n\nexport interface VerifyChallengeResult {\n    ok: boolean;\n    reason: VerifyChallengeReason;\n    /** Present on success — the cryptographically proven Bitcoin address. */\n    address?: string;\n    /** Present on success — the scheme that verified the signature. */\n    scheme?: Scheme;\n    /** Present on success — when the challenge expires (unix ms). */\n    expiresAt?: number;\n    /** Present on success — the nonce from the challenge. */\n    nonce?: string;\n    /** Present on success — the audience extension, if any. */\n    audience?: string;\n    /** Present on success — the purpose extension, if any. */\n    purpose?: string;\n}\n\n/**\n * Verify a signed challenge. Returns the proven address on success.\n *\n * The caller is responsible for nonce replay prevention — pass `expectedNonce`\n * with the value you stashed at issue time.\n */\nexport async function verifyChallenge(\n    opts: VerifyChallengeOptions\n): Promise<VerifyChallengeResult> {\n    let parsed: ParsedChallenge;\n    try {\n        parsed = parseChallenge(opts.message);\n    } catch {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const { address, nonce, issuedAt, expiresAt, ack, audience, purpose } = parsed;\n    if (!address || !nonce || !issuedAt || !expiresAt || !ack) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (ack !== AUTH_ACK) {\n        return { ok: false, reason: 'malformed' };\n    }\n    if (!/^[0-9a-f]{32}$/.test(nonce)) {\n        return { ok: false, reason: 'malformed' };\n    }\n\n    const now = opts.now ?? new Date();\n    const skew = opts.clockSkewMs ?? 0;\n\n    if (now.getTime() - skew > expiresAt.getTime()) {\n        return { ok: false, reason: 'expired' };\n    }\n    if (now.getTime() + skew < issuedAt.getTime()) {\n        return { ok: false, reason: 'not_yet_valid' };\n    }\n\n    if (opts.expectedNonce && nonce !== opts.expectedNonce) {\n        return { ok: false, reason: 'nonce_mismatch' };\n    }\n    if (opts.expectedAudience && audience !== opts.expectedAudience) {\n        return { ok: false, reason: 'audience_mismatch' };\n    }\n    if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {\n        return { ok: false, reason: 'purpose_mismatch' };\n    }\n\n    const sigBase64 = toBase64Maybe(opts.signature);\n    const scheme = signatureScheme(sigBase64);\n    if (!scheme) return { ok: false, reason: 'sig_unsupported_scheme' };\n    if (!verifyBitcoinSignature(address, opts.message, sigBase64)) {\n        return { ok: false, reason: 'sig_invalid' };\n    }\n\n    return {\n        ok: true,\n        reason: 'ok',\n        address,\n        scheme,\n        expiresAt: expiresAt.getTime(),\n        nonce,\n        ...(audience !== undefined ? { audience } : {}),\n        ...(purpose !== undefined ? { purpose } : {}),\n    };\n}\n"]}

package/dist/identity.js

@@ -3,8 +3,8 @@
 var secp256k1_js = require('@noble/curves/secp256k1.js');
 var sha2_js = require('@noble/hashes/sha2.js');
 var base = require('@scure/base');
-require('buffer');
 require('@orangecheck/bip322');
+require('buffer');
 
 // src/utils/logger.ts
 function createLogger(namespace) {

package/dist/identity.mjs

@@ -1,8 +1,8 @@
 import { schnorr } from '@noble/curves/secp256k1.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { bech32 } from '@scure/base';
-import 'buffer';
 import '@orangecheck/bip322';
+import 'buffer';
 
 // src/utils/logger.ts
 function createLogger(namespace) {

package/dist/index.js

@@ -1,8 +1,8 @@
 'use strict';
 
 var base = require('@scure/base');
-var buffer = require('buffer');
 var bip322 = require('@orangecheck/bip322');
+var buffer = require('buffer');
 var hmac_js = require('@noble/hashes/hmac.js');
 var sha2_js = require('@noble/hashes/sha2.js');
 var utils_js = require('@noble/hashes/utils.js');
@@ -247,109 +247,28 @@ function computeScore(sats, days, config) {
 function computeAllScores(sats, days) {
   return { v0: scoreV0(sats, days), tier: scoreTier(sats, days) };
 }
-
-// src/verify.ts
-var log = createLogger("ocp/verify");
-function looksLikeHex(s) {
-  return /^[0-9a-fA-F]+$/.test(s) && s.length % 2 === 0;
-}
 function toBase64Maybe(sig) {
-  if (looksLikeHex(sig)) {
+  if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {
     return buffer.Buffer.from(sig, "hex").toString("base64");
   }
   return sig;
 }
-function detectSignatureScheme(addr, sig) {
-  const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
-  if (isSegWit) {
-    return "bip322";
-  }
+function signatureScheme(sigBase64) {
+  if (/^(ful|pof)/.test(sigBase64)) return null;
+  if (sigBase64.startsWith("smp")) return "bip322";
+  return buffer.Buffer.from(sigBase64, "base64").length === 65 ? "legacy" : "bip322";
+}
+
+// src/verify.ts
+var log = createLogger("ocp/verify");
+async function verifySignature({ addr, msg, sig }) {
   const sigBase64 = toBase64Maybe(sig);
-  const looksLikeLegacy = sigBase64.length === 88 && /^[IHG]/.test(sigBase64);
-  if (looksLikeLegacy) {
-    return "legacy";
-  }
-  return "bip322";
-}
-async function verifySignature({
-  addr,
-  msg,
-  sig,
-  scheme
-}) {
-  const detectedScheme = scheme || detectSignatureScheme(addr, sig);
-  log.debug(
-    { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
-    "Verifying signature"
-  );
-  if (detectedScheme === "bip322") {
-    const sigBase64 = toBase64Maybe(sig);
-    log.debug(
-      { sigBase64: sigBase64.substring(0, 50) + "..." },
-      "Signature converted to base64"
-    );
-    log.debug(
-      {
-        msgFull: msg,
-        msgLines: msg.split("\n").length,
-        msgFirstLine: msg.split("\n")[0],
-        msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
-      },
-      "Message being verified"
-    );
-    const ok = bip322.verifySignature(addr, msg, sigBase64);
-    log.info({ addr, ok }, "BIP-322 verification result");
-    if (!ok) {
-      const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
-      if (isSegWit && sigBase64.length === 88) {
-        log.warn(
-          { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
-          "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
-        );
-      } else {
-        log.error(
-          {
-            addr,
-            sigLength: sigBase64.length,
-            msgLength: msg.length,
-            msgPreview: msg.substring(0, 200)
-          },
-          "BIP-322 verification failed - signature does not match message"
-        );
-      }
-    }
-    return ok ? "sig_ok_bip322" : "sig_invalid";
-  }
-  if (detectedScheme === "legacy") {
-    const sigBase64 = toBase64Maybe(sig);
-    if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
-      log.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
-      return "sig_unsupported_script";
-    }
-    log.debug(
-      {
-        addr,
-        sigBase64: sigBase64.substring(0, 50) + "...",
-        msgPreview: msg.substring(0, 100) + "...",
-        msgLength: msg.length
-      },
-      "Verifying legacy signature"
-    );
-    const ok = bip322.verifySignature(addr, msg, sigBase64);
-    log.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
-    if (!ok) {
-      log.error(
-        {
-          addr,
-          msgFirstLine: msg.split("\n")[0],
-          sigFormat: sigBase64.substring(0, 10)
-        },
-        "Legacy signature verification failed - check message format and signature"
-      );
-    }
-    return ok ? "sig_ok_legacy" : "sig_invalid";
-  }
-  return "invalid_scheme";
+  const scheme = signatureScheme(sigBase64);
+  if (!scheme) return "sig_unsupported_script";
+  const ok = bip322.verifySignature(addr, msg, sigBase64);
+  log.info({ addr, ok, scheme, msgLength: msg.length }, "Signature verification result");
+  if (!ok) return "sig_invalid";
+  return scheme === "legacy" ? "sig_ok_legacy" : "sig_ok_bip322";
 }
 async function signatureIsValid(input) {
   try {
@@ -1488,24 +1407,17 @@ async function verifyChallenge(opts) {
   if (opts.expectedPurpose && purpose !== opts.expectedPurpose) {
     return { ok: false, reason: "purpose_mismatch" };
   }
-  const scheme = opts.scheme ?? "bip322";
-  let sigValid;
-  if (scheme === "bip322") {
-    const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? buffer.Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
-    sigValid = bip322.verifySignature(address, opts.message, sigBase64);
-  } else if (scheme === "legacy") {
-    if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
-      return { ok: false, reason: "sig_unsupported_scheme" };
-    }
-    sigValid = bip322.verifySignature(address, opts.message, opts.signature);
-  } else {
-    return { ok: false, reason: "sig_unsupported_scheme" };
+  const sigBase64 = toBase64Maybe(opts.signature);
+  const scheme = signatureScheme(sigBase64);
+  if (!scheme) return { ok: false, reason: "sig_unsupported_scheme" };
+  if (!bip322.verifySignature(address, opts.message, sigBase64)) {
+    return { ok: false, reason: "sig_invalid" };
   }
-  if (!sigValid) return { ok: false, reason: "sig_invalid" };
   return {
     ok: true,
     reason: "ok",
     address,
+    scheme,
     expiresAt: expiresAt.getTime(),
     nonce,
     ...audience !== void 0 ? { audience } : {},
@@ -2411,12 +2323,12 @@ var STATUS_META = {
   },
   sig_invalid: {
     label: "Signature verification failed",
-    detail: "The signature does not match the message and address. Common issues: (1) Message not copied exactly from Step 2, (2) Wrong wallet/address used, (3) Wallet does not support BIP-322 (Electrum does NOT support BIP-322 for SegWit addresses - use Sparrow Wallet instead). For testnet, ensure your wallet is in testnet mode.",
+    detail: "The signature does not match the message and address. Common issues: (1) the message was not copied exactly, (2) a different address signed it, (3) the wallet signed on another network.",
     severity: "error"
   },
   sig_unsupported_script: {
-    label: "Wallet does not support BIP-322",
-    detail: 'Your wallet generated a legacy signature, but your SegWit address (bc1/tb1) requires BIP-322 message signing. Please use a wallet that supports BIP-322 (like Sparrow Wallet or Bitcoin Core), or switch to a P2PKH address (starting with "1" for mainnet or "m"/"n" for testnet) if your wallet only supports legacy signing.',
+    label: "Signature form not supported",
+    detail: "Your wallet made a BIP-322 full or proof-of-funds signature. Sign with a BIP-322 simple signature, or with legacy message signing, which every address type here accepts.",
     severity: "error"
   },
   bond_confirmed: {