npm - @orangecheck/sdk - Versions diffs - 1.16.1 → 1.16.2 - Mend

@orangecheck/sdk 1.16.1 → 1.16.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (21) hide show

package/dist/verify.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/canonical.ts","../src/scoring.ts","../src/utils/logger.ts","../src/utils/signature.ts","../src/utils/time.ts","../src/verify.ts"],"names":["Buffer","verifyBitcoinSignature","days_unspent"],"mappings":";;;;;;;;AA8BA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CAClB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAChB;AAmCA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,wBAAA,GAA2B,SAAA;AAEjC,SAAS,kBAAA,CAAmB,EAAE,QAAA,EAAU,UAAA,EAAW,EAA0B;AACzE,EAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,2BAAA,EAA8B,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,uCAAA;AAAA,KAC1D;AAAA,EACJ;AACA,EAAA,IAAI,CAAC,UAAA,IAAc,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1D,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,6BAAA,EAAgC,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA,2DAAA;AAAA,KAC9D;AAAA,EACJ;AACJ;AA2BO,SAAS,gBAAgB,aAAA,EAA0C;AACtE,EAAA,IAAI,CAAC,aAAA,IAAiB,aAAA,CAAc,IAAA,OAAW,EAAA,EAAI;AAC/C,IAAA,OAAO,EAAC;AAAA,EACZ;AAIA,EAAA,IAAI,yBAAyB,IAAA,CAAK,aAAA,CAAc,QAAQ,IAAA,EAAM,EAAE,CAAC,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAAA,EAC9E;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAY;AACvD,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,eAAe,EAAA,EAAI;AACnB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,CAAE,CAAA;AAAA,IACjE;AACA,IAAA,OAAO;AAAA,MACH,UAAU,OAAA,CAAQ,SAAA,CAAU,CAAA,EAAG,UAAU,EAAE,IAAA,EAAK;AAAA,MAChD,YAAY,OAAA,CAAQ,SAAA,CAAU,UAAA,GAAa,CAAC,EAAE,IAAA;AAAK,KACvD;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACtB,IAAA,IAAI,CAAC,CAAA,CAAE,QAAA,IAAY,CAAC,EAAE,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,MAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAI,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AAAA,IAC7E;AACA,IAAA,kBAAA,CAAmB,CAAC,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,QAAA;AACX;AA0EA,eAAsB,sBAAsB,OAAA,EAAkC;AAE1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAGnC,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAG7D,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AAChD;;;AC5MA,SAAS,OAAA,CAAQ,MAAc,IAAA,EAAsB;AACjD,EAAA,IAAI,IAAA,IAAQ,CAAA,IAAK,IAAA,IAAQ,CAAA,EAAG,OAAO,CAAA;AACnC,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,IAAI,CAAA,IAAK,CAAA,GAAI,IAAA,GAAO,EAAA,CAAA,GAAM,GAAG,CAAA,GAAI,GAAA;AACpE;AAEA,SAAS,SAAA,CAAU,MAAc,IAAA,EAAoB;AACjD,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAc,IAAA,IAAQ,GAAA,EAAK,OAAO,UAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAa,IAAA,IAAQ,GAAA,EAAK,OAAO,MAAA;AAC7C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAW,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AAC1C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAU,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AACzC,EAAA,OAAO,MAAA;AACX;AAEO,SAAS,YAAA,CAAa,IAAA,EAAc,IAAA,EAAc,MAAA,EAAoC;AACzF,EAAA,QAAQ,OAAO,SAAA;AAAW,IACtB,KAAK,IAAA;AACD,MAAA,OAAO,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,IAC7B,KAAK,MAAA;AACD,MAAA,OAAO,SAAA,CAAU,MAAM,IAAI,CAAA;AAAA,IAC/B,KAAK,MAAA;AACD,MAAA,OAAO,IAAA;AAAA;AAEnB;AAEO,SAAS,gBAAA,CAAiB,MAAc,IAAA,EAAc;AACzD,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,GAAG,IAAA,EAAM,SAAA,CAAU,IAAA,EAAM,IAAI,CAAA,EAAE;AAClE;ACGO,SAAS,aAAa,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAA8C;AAC7D,IAAyB,OAAO,KAAA;AAMJ,EAChC,CAAA;AAEA,EAAA,MAAM,gBAAgB,CAAC,GAAA,KAAwB,CAAA,CAAA,EAAI,SAAS,KAAK,GAAG,CAAA,CAAA;AAEpE,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,MAAM,GAAG,gBAAgB,CAAA;AAAA,QACnE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,SAAS,GAAG,gBAAgB,CAAA;AAAA,QACtE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;AC9FO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,IAAI,iBAAiB,IAAA,CAAK,GAAG,KAAK,GAAA,CAAI,MAAA,GAAS,MAAM,CAAA,EAAG;AACpD,IAAA,OAAOA,cAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,gBAAgB,SAAA,EAAkC;AAC9D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,IAAA;AACzC,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,QAAA;AACxC,EAAA,OAAOA,cAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA,CAAE,MAAA,KAAW,KAAK,QAAA,GAAW,QAAA;AACvE;;;ACrBO,IAAM,eAAA,GAAkB,IAAA;AAE/B,IAAM,OAAA,GAAU,sEAAA;AAGT,SAAS,UAAU,KAAA,EAA0C;AAChE,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAQ,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC3C,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA,GAAI,IAAA,GAAO,EAAA;AACrC;;;ACiBA,IAAM,GAAA,GAAM,aAAa,YAAY,CAAA;AAsCrC,eAAe,eAAA,CAAgB,EAAE,IAAA,EAAM,GAAA,EAAK,KAAI,EAA8C;AAC1F,EAAA,MAAM,SAAA,GAAY,cAAc,GAAG,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,IAAI,CAAC,QAAQ,OAAO,wBAAA;AAEpB,EAAA,MAAM,EAAA,GAAKC,sBAAA,CAAuB,IAAA,EAAM,GAAA,EAAK,SAAS,CAAA;AACtD,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,EAAA,EAAI,QAAQ,SAAA,EAAW,GAAA,CAAI,MAAA,EAAO,EAAG,+BAA+B,CAAA;AACrF,EAAA,IAAI,CAAC,IAAI,OAAO,aAAA;AAChB,EAAA,OAAO,MAAA,KAAW,WAAW,eAAA,GAAkB,eAAA;AACnD;AAGA,eAAsB,iBAAiB,KAAA,EAA+C;AAClF,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,eAAA,CAAgB,KAAK,CAAA;AACxC,IAAA,OAAO,IAAA,KAAS,mBAAmB,IAAA,KAAS,eAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAGO,SAAS,sBAAsB,GAAA,EAAa;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAKjD,EAAA,MAAM,MAAA,GAAS,CAAC,MAAA,KAAuC;AACnD,IAAA,MAAM,SAAS,MAAA,GAAS,GAAA;AACxB,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,WAAA,EAAY,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,SAAS,CAAA,IAAK,EAAA;AACrC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,YAAY,CAAA,IAAK,EAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,WAAW,CAAA,IAAK,EAAA;AAEzC,EAAA,MAAM,OAAA,GAAU,OAAO,SAAS,CAAA;AAGhC,EAAA,IAAI,aAAgC,EAAC;AACrC,EAAA,IAAI;AACA,IAAA,UAAA,GAAa,gBAAgB,aAAa,CAAA;AAAA,EAC9C,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAK,EAAE,aAAA,EAAe,KAAA,EAAO,GAAA,IAAO,kCAAkC,CAAA;AAAA,EAC9E;AAGA,EAAA,MAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,IACrB,aAAA;AAAA,IACA,YAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACH,CAAA;AACD,EAAA,MAAM,aAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AAClD,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACrC,IAAA,IAAI,CAAC,SAAS,GAAA,CAAI,GAAG,KAAK,GAAA,EAAK,UAAA,CAAW,GAAG,CAAA,GAAI,GAAA;AAAA,EACrD;AAEA,EAAA,MAAM,OAAA,GAAW,UAAA,CAAW,SAAS,CAAA,IAAK,SAAA;AAG1C,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,GAAU,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA,GAAI,MAAA;AAE/C,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,EAAE,OAAA,EAAS,UAAA,EAAY,SAAA,EAAU;AAAA,IACvC,OAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,IAAA,EAAM,SAAS,MAAA,IAAa,CAAC,MAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,GAAI,IAAA,GAAO;AAAA,GAClE;AACJ;AAkCA,eAAe,eAAA,CACX,OAAA,EACA,OAAA,EACA,IAAA,EAKsB;AAEtB,EAAA,MAAM,SAAA,GACF,YAAY,QAAA,GACN;AAAA,IACI,MAAM,iBAAA,IAAqB,kCAAA;AAAA,IAC3B;AAAA,GACJ,GACA,YAAY,SAAA,GACV;AAAA,IACI,MAAM,kBAAA,IAAsB,mCAAA;AAAA,IAC5B;AAAA,GACJ,GACA;AAAA,IACI,MAAM,kBAAA,IAAsB,2BAAA;AAAA,IAC5B;AAAA,GACJ;AAEZ,EAAA,IAAI,SAAA,GAA0B,IAAA;AAK9B,EAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,SAAA,EAAY,OAAO,CAAA,KAAA,CAAA;AACtC,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,OAAA,IAAW,gBAAgB,CAAA;AAE5C,MAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAC1B,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACnC,CAAA;AAED,MAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,MACzC;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAG7B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,MACtD;AAGA,MAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACrB,QAAA,IACI,OAAO,KAAK,KAAA,KAAU,QAAA,IACtB,OAAO,IAAA,CAAK,MAAA,KAAW,YACvB,OAAO,IAAA,CAAK,OAAO,SAAA,KAAc,SAAA,IACjC,OAAO,IAAA,CAAK,IAAA,KAAS,YACrB,OAAO,IAAA,CAAK,SAAS,QAAA,EACvB;AACE,UAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,QAC5C;AAAA,MACJ;AAEA,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,MAAA,EAAQ,OAAA,IAAW,4BAA4B,CAAA;AAC5E,MAAA,OAAO,IAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,SAAA,GAAY,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC9D,MAAA,GAAA,CAAI,IAAA;AAAA,QACA,EAAE,IAAA,EAAM,KAAA,EAAO,SAAA,CAAU,SAAS,OAAA,EAAQ;AAAA,QAC1C;AAAA,OACJ;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,GAAA,CAAI,KAAA,CAAM,EAAE,SAAA,EAAW,KAAA,EAAO,WAAW,OAAA,EAAS,OAAA,IAAW,8BAA8B,CAAA;AAC3F,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,SAAA,EAAW,OAAA,IAAW,SAAS,CAAA,CAAE,CAAA;AAC5E;AAWA,SAAS,cAAA,CACL,KAAA,EACA,UAAA,EACA,SAAA,EAQF;AAEE,EAAA,MAAM,iBAAiB,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,SAAS,CAAA;AAC7D,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,EAAE,WAAA,EAAa,CAAA,EAAG,YAAA,EAAc,CAAA,EAAG,mBAAmB,CAAA,EAAE;AAAA,EACnE;AAGA,EAAA,MAAM,iBAAA,GAAoB,eAAe,MAAA,CAAO,CAAC,KAAK,CAAA,KAAM,GAAA,GAAM,CAAA,CAAE,KAAA,EAAO,CAAC,CAAA;AAG5E,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,UAAA,GAAa,CAAA,EAAG;AAE5C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM;AAC9C,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,IAAI,OAAA,KAAY,OAAA,EAAS,OAAO,OAAA,GAAU,OAAA;AAC1C,MAAA,IAAI,CAAA,CAAE,SAAS,CAAA,CAAE,IAAA,SAAa,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA;AACzD,MAAA,OAAO,CAAA,CAAE,OAAO,CAAA,CAAE,IAAA;AAAA,IACtB,CAAC,CAAA;AAGD,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,KAAK,GAAA,CAAI,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,cAAc,CAAC,CAAA;AACjE,MAAA,IAAI,OAAO,UAAA,EAAY;AAAA,IAC3B;AAGA,IAAA,MAAMC,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AAEA,IAAA,OAAO;AAAA,MACH,WAAA,EAAa,UAAA;AAAA;AAAA,MACb,YAAA,EAAAA,aAAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAGA,EAAA,MAAM,WAAA,GAAc,iBAAA;AAIpB,EAAA,IAAI,SAAA,KAAc,MAAA,IAAa,SAAA,GAAY,CAAA,EAAG;AAC1C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,CAAA,CAAE,IAAA;AAAA,MAC/B,CAAC,GAAG,CAAA,KAAA,CAAO,CAAA,CAAE,OAAO,YAAA,IAAgB,QAAA,KAAa,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AAAA,KAC9E;AACA,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,IAAA,CAAK,IAAI,YAAA,EAAc,IAAA,CAAK,OAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA;AACjF,MAAA,IAAI,OAAO,SAAA,EAAW;AAAA,IAC1B;AACA,IAAA,MAAMA,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AACA,IAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAAA,aAAAA,EAAc,iBAAA,EAAkB;AAAA,EAC1D;AAGA,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA;AAAA,IACpB,GAAG,cAAA,CAAe,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,CAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI;AAAA,GACzE;AACA,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAA,CAAO,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,UAAA,KAAe,EAAA,GAAK,EAAA,GAAK,GAAG,CAAC,CAAA;AAE9F,EAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB;AAC1D;AA4BA,eAAsB,MAAA,CAAO,KAAA,EAAoB,IAAA,GAAsB,EAAC,EAA2B;AAC/F,EAAA,MAAM,QAAsB,EAAC;AAC7B,EAAA,IAAI,OAAA,GAAmB,SAAA;AAEvB,EAAA,IAAI;AAEA,IAAA,IAAI,CAAC,MAAM,GAAA,IAAO,CAAC,MAAM,IAAA,IAAQ,CAAC,MAAM,GAAA,EAAK;AACzC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,IACvC;AAGA,IAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAC9C,IAAA,OAAA,GAAU,OAAO,OAAA,IAAW,SAAA;AAG5B,IAAA,MAAM,cAAA,GAAiB,MAAM,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAG5D,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,OAAA,KAAY,KAAA,CAAM,IAAA,EAAM;AACpC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAGA,IAAA,IAAA,CAAK,YAAY,SAAA,IAAa,OAAA,KAAY,QAAA,KAAa,CAAC,KAAK,QAAA,EAAU;AACnE,MAAA,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAC7B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAMA,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AACnC,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,KAAQ,IAAA,CAAK,WAAA,EAAa;AAClC,QAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAIA,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,IAAI,WAAW,IAAA,EAAM;AACjB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AACA,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI,GAAI,eAAA,EAAiB;AACvC,MAAA,KAAA,CAAM,KAAK,eAAe,CAAA;AAC1B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAIA,IAAA,IAAI,MAAA,CAAO,YAAY,KAAA,CAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,SAAA,CAAU,MAAA,CAAO,OAAO,CAAA;AACpC,MAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,GAAM,IAAA,CAAK,KAAI,EAAG;AAClC,QAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AACpB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,eAAA,CAAgB;AAAA,MAClC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,MAAA,IAAU,EAAE,MAAA,EAAQ,MAAM,MAAA;AAAO,KAC9C,CAAA;AACD,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAElB,IAAA,MAAM,KAAA,GAAQ,OAAA,KAAY,eAAA,IAAmB,OAAA,KAAY,eAAA;AACzD,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,OAC5B;AAAA,IACJ;AAGA,IAAA,IAAI;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,eAAA,CAAgB,KAAA,CAAM,MAAM,OAAA,EAAS;AAAA,QACrD,oBAAoB,IAAA,CAAK,kBAAA;AAAA,QACzB,mBAAmB,IAAA,CAAK;AAAA,OAC3B,CAAA;AAGD,MAAA,MAAM,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB,GAAI,cAAA;AAAA,QACrD,KAAA;AAAA,QACA,MAAA,CAAO,IAAA;AAAA,QACP,IAAA,CAAK;AAAA,OACT;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,KAAS,KAAA,CAAA,IAAa,MAAA,CAAO,OAAO,CAAA,EAAG;AAC9C,QAAA,IAAI,iBAAA,GAAoB,OAAO,IAAA,EAAM;AACjC,UAAA,KAAA,CAAM,KAAK,mBAAmB,CAAA;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACA;AAAA,cACI,MAAM,MAAA,CAAO,IAAA;AAAA,cACb,iBAAA;AAAA,cACA,SAAS,KAAA,CAAM;AAAA,aACnB;AAAA,YACA;AAAA,WACJ;AACA,UAAA,OAAO;AAAA,YACH,EAAA,EAAI,KAAA;AAAA,YACJ,KAAA;AAAA,YACA,OAAA;AAAA,YACA,cAAA;AAAA,YACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,WAC5B;AAAA,QACJ;AAAA,MACJ;AAGA,MAAA,IAAI,eAAe,CAAA,EAAG;AAClB,QAAA,KAAA,CAAM,KAAK,WAAW,CAAA;AAEtB,QAAA,IAAI,KAAA,CAAM,KAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,EAAG;AACxC,UAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,QAC7B;AACA,QAAA,OAAO;AAAA,UACH,EAAA,EAAI,KAAA;AAAA,UACJ,KAAA;AAAA,UACA,OAAA;AAAA,UACA,cAAA;AAAA,UACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,SAC5B;AAAA,MACJ,CAAA,MAAO;AACH,QAAA,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAAA,MAC/B;AAGA,MAAA,MAAM,OAAA,GAAmB;AAAA,QACrB,WAAA;AAAA,QACA,YAAA;AAAA,QACA,OAAQ,YAAA,CAAa,WAAA,EAAa,cAAc,EAAE,SAAA,EAAW,MAAM;AAAA,OACvE;AAEA,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,IAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK,UAAA;AAAA,QACxB;AAAA,OACJ;AAAA,IACJ,SAAS,SAAA,EAAW;AAChB,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,SAAA,IAAa,mBAAmB,CAAA;AACjD,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAAA,EACJ,SAAS,CAAA,EAAY;AACjB,IAAA,MAAM,MAAM,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,KAAK,cAAc,CAAA;AACvE,IAAA,IAAI,QAAQ,cAAA,EAAgB;AACxB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,IAC7B,CAAA,MAAO;AACH,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,EACvC;AACJ","file":"verify.js","sourcesContent":["/*\n Canonical message builder per SPEC.md §2\n \n - LF line endings, exactly one trailing LF\n * - 7 fixed core lines in strict order and wording\n * - Optional extensions appended as key: value with lexicographically sorted lowercase keys\n /\n\nimport type { AttestationEnvelope, IdentityBinding, Scheme } from './types';\n\n/\n Input for building a canonical message\n /\nexport interface CanonicalInput {\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n}\n\n/\n Extension key-value pairs for canonical message\n /\nexport type Extensions = Record<string, string \| undefined>;\n\n/\n Convert bytes to lowercase hex string\n * @param bytes - Byte array to convert\n * @returns Lowercase hex string\n /\nfunction toLowerHex(bytes: Uint8Array): string {\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n}\n\n/\n Generate a random 16-byte nonce as lowercase hex\n * Uses Web Crypto API when available, falls back to Math.random()\n * @returns 32-character lowercase hex string\n /\nexport function randomNonce16BHexLower(): string {\n const arr = new Uint8Array(16);\n\n try {\n if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {\n crypto.getRandomValues(arr);\n return toLowerHex(arr);\n }\n } catch {\n // Fall through to non-cryptographic fallback\n }\n\n // No silent Math.random fallback: a nonce is a load-bearing security\n // primitive. A deployment without `crypto.getRandomValues` MUST fix its\n // environment rather than sign with weak randomness.\n throw new Error('crypto.getRandomValues unavailable — refusing to mint a weak nonce');\n}\n\n/\n Reject characters that would break the line-oriented canonical grammar\n * or the comma-separated identities list. If any of these slipped through,\n * an attacker could smuggle a forged `address:` or extension line into the\n * signed payload: `identities: alice\\naddress: bc1qEVIL…` would parse as a\n * second address line. Catch it at the boundary, not at verification time.\n \n Also rejects a colon in the identifier so a bad actor can't turn\n * `github:alice:extra` into a different protocol binding on parse.\n /\nconst IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]$/;\nconst IDENTITY_FORBIDDEN_CHARS = /[\\r\\n,]/;\n\nfunction assertSafeIdentity({ protocol, identifier }: IdentityBinding): void {\n if (!IDENTITY_PROTOCOL_RE.test(protocol)) {\n throw new Error(\n `invalid identity protocol: ${JSON.stringify(protocol)} — must match /^[a-z][a-z0-9_-]$/`\n );\n }\n if (!identifier \|\| IDENTITY_FORBIDDEN_CHARS.test(identifier)) {\n throw new Error(\n `invalid identity identifier: ${JSON.stringify(identifier)} — must be non-empty and contain no newlines or commas`\n );\n }\n}\n\n/\n Format identities as comma-separated protocol:identifier pairs, sorted lexicographically\n * @param identities - Array of identity bindings\n * @returns Comma-separated string of protocol:identifier pairs\n /\nexport function formatIdentities(identities: IdentityBinding[] = []): string {\n if (identities.length === 0) {\n return '';\n }\n for (const id of identities) assertSafeIdentity(id);\n\n // Format as protocol:identifier and sort lexicographically\n const formatted = identities\n .map(({ protocol, identifier }) => `${protocol}:${identifier}`)\n .sort();\n\n return formatted.join(',');\n}\n\n/\n Parse identities from comma-separated protocol:identifier format\n * @param identitiesStr - Comma-separated identity string\n * @returns Array of identity bindings\n * @throws {Error} If identity format is invalid\n /\nexport function parseIdentities(identitiesStr: string): IdentityBinding[] {\n if (!identitiesStr \|\| identitiesStr.trim() === '') {\n return [];\n }\n // The identities field lives on one line of the canonical message. If it\n // contains a raw LF/CR, it's either corrupt or an attempt to smuggle a\n // fake core line into the parser. Refuse instead of trying to recover.\n if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ''))) {\n throw new Error('identities field contains forbidden characters (newline)');\n }\n\n const bindings = identitiesStr.split(',').map((binding) => {\n const colonIndex = binding.indexOf(':');\n if (colonIndex === -1) {\n throw new Error(`Invalid identity binding format: ${binding}`);\n }\n return {\n protocol: binding.substring(0, colonIndex).trim(),\n identifier: binding.substring(colonIndex + 1).trim(),\n };\n });\n\n for (const b of bindings) {\n if (!b.protocol \|\| !b.identifier) {\n throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);\n }\n assertSafeIdentity(b);\n }\n return bindings;\n}\n\n/\n Optional deterministic overrides for message building. Only intended for\n * tests / conformance vectors; production callers should let the builder\n * mint a fresh nonce + timestamp per message.\n /\nexport interface BuildOptions {\n /* 32-char lowercase hex. Default: freshly-generated cryptographic nonce. /\n nonce?: string;\n /* RFC-3339 UTC. Default: `new Date().toISOString()`. /\n issuedAt?: string;\n}\n\n/\n Build a canonical message following OrangeCheck Protocol v0 specification\n * @param input - Canonical input with address and identities\n * @param extensions - Optional extension key-value pairs\n * @param options - Optional deterministic overrides (testing only)\n * @returns Canonical message string with LF line endings\n /\nexport function buildCanonicalMessage(\n { address, identities }: CanonicalInput,\n extensions: Extensions = {},\n options: BuildOptions = {}\n): string {\n const nonce = options.nonce ?? randomNonce16BHexLower();\n if (!/^[0-9a-f]{32}$/.test(nonce)) {\n throw new Error(`invalid nonce: must be 32 lowercase hex chars`);\n }\n const issuedAt = options.issuedAt ?? new Date().toISOString();\n\n // Format identities\n const identitiesStr = formatIdentities(identities);\n\n // Core (strict wording + order per SPEC.md §2)\n const core = [\n 'orangecheck',\n `identities: ${identitiesStr}`,\n `address: ${address}`,\n 'purpose: portable reputation attestation (non-custodial)',\n `nonce: ${nonce}`,\n `issued_at: ${issuedAt}`,\n 'ack: I attest control of this address and bind it to my identities.',\n ];\n\n // Normalize and sort extensions\n const normExt: Record<string, string> = {};\n for (const [k, v] of Object.entries(extensions)) {\n if (v == null \|\| v === '') {\n continue;\n }\n const key = k.toLowerCase();\n normExt[key] = String(v);\n }\n\n const extLines = Object.keys(normExt)\n .sort()\n .map((k) => `${k}: ${normExt[k]!}`);\n\n const all = [...core, ...extLines];\n\n // Join with LF and ensure exactly one trailing LF\n return all.join('\\n') + '\\n';\n}\n\n/\n Generate attestation ID from canonical message\n \n attestation_id = SHA-256(canonical_message)\n \n @param message - Canonical message string\n * @returns Lowercase hex SHA-256 hash\n /\nexport async function generateAttestationId(message: string): Promise<string> {\n // Convert message to UTF-8 bytes\n const encoder = new TextEncoder();\n const data = encoder.encode(message);\n\n // Compute SHA-256 hash\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n return toLowerHex(new Uint8Array(hashBuffer));\n}\n\n/\n Create an attestation envelope for publishing\n \n This wraps the canonical message with metadata for Nostr publishing\n \n @param message - Canonical message\n * @param signature - BIP-322 or legacy signature\n * @param scheme - Signature scheme used\n * @param address - Bitcoin address\n * @param identities - Identity bindings\n * @param extensions - Optional extensions\n * @returns Attestation envelope ready for publishing\n /\nexport async function createAttestationEnvelope(\n message: string,\n signature: string,\n scheme: Scheme,\n address: string,\n identities: IdentityBinding[],\n extensions: Extensions = {}\n): Promise<AttestationEnvelope> {\n const attestation_id = await generateAttestationId(message);\n\n // Extract issued_at from message\n const issuedAtMatch = message.match(/issued_at: ([^\\n]+)/);\n const issued_at = issuedAtMatch?.[1] ?? new Date().toISOString();\n\n // Extract expires from extensions if present\n const expires_at = extensions.expires;\n\n // Extract relay hints from extensions if present\n const relay_hints = extensions.relay_hints?.split(',').map((r) => r.trim());\n\n // Extract publish targets from extensions if present\n const publish_targets = extensions.publish?.split(',').map((t) => t.trim());\n\n // Base64url encode the message\n const encoder = new TextEncoder();\n const messageBytes = encoder.encode(message);\n const base64 = btoa(String.fromCharCode(...messageBytes));\n const message_b64url = base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n\n // Construct verification URL\n const verification_url = `https://attest.ochk.io/attest/${attestation_id}`;\n\n return {\n attestation_id,\n scheme,\n address,\n identities,\n message,\n message_b64url,\n signature,\n issued_at,\n expires_at,\n verification_url,\n publish_targets,\n relay_hints,\n };\n}\n","/\n OrangeCheck Scoring\n \n The protocol registers exactly one scoring algorithm: `v0`. A `tier` helper\n * is also provided for UI convenience. RPs with specialized needs compute\n * their own score against raw metrics — the protocol does not ship an\n * algorithm zoo.\n \n See: docs/oc-protocol/registry/scoring.md\n /\n\nexport type ScoringAlgorithm = 'v0' \| 'tier' \| 'none';\nexport type Tier = 'platinum' \| 'gold' \| 'silver' \| 'bronze' \| 'none';\nexport type ScoreResult = number \| Tier \| null;\n\nexport interface ScoringConfig {\n algorithm: ScoringAlgorithm;\n}\n\nfunction scoreV0(sats: number, days: number): number {\n if (sats <= 0 \|\| days <= 0) return 0;\n return Math.round(Math.log(1 + sats) (1 + days / 30) * 100) / 100;\n}\n\nfunction scoreTier(sats: number, days: number): Tier {\n if (sats >= 10_000_000 && days >= 365) return 'platinum';\n if (sats >= 1_000_000 && days >= 180) return 'gold';\n if (sats >= 100_000 && days >= 90) return 'silver';\n if (sats >= 10_000 && days >= 30) return 'bronze';\n return 'none';\n}\n\nexport function computeScore(sats: number, days: number, config: ScoringConfig): ScoreResult {\n switch (config.algorithm) {\n case 'v0':\n return scoreV0(sats, days);\n case 'tier':\n return scoreTier(sats, days);\n case 'none':\n return null;\n }\n}\n\nexport function computeAllScores(sats: number, days: number) {\n return { v0: scoreV0(sats, days), tier: scoreTier(sats, days) };\n}\n\nexport function formatScore(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (score === null \|\| algorithm === 'none') return 'N/A';\n if (algorithm === 'v0') return (score as number).toFixed(1);\n const tier = score as Tier;\n const labels: Record<Tier, string> = {\n platinum: 'Platinum',\n gold: 'Gold',\n silver: 'Silver',\n bronze: 'Bronze',\n none: '—',\n };\n return labels[tier];\n}\n\nexport function getScoreColor(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (algorithm === 'tier') {\n const colors: Record<Tier, string> = {\n platinum: '#a855f7',\n gold: '#eab308',\n silver: '#94a3b8',\n bronze: '#f97316',\n none: '#64748b',\n };\n return colors[(score as Tier) ?? 'none'] ?? '#64748b';\n }\n const n = (score as number) ?? 0;\n if (n >= 100) return '#22c55e';\n if (n >= 50) return '#3b82f6';\n if (n >= 20) return '#eab308';\n return '#f97316';\n}\n\nexport function getTierNumber(tier: Tier): number {\n const map: Record<Tier, number> = {\n platinum: 4,\n gold: 3,\n silver: 2,\n bronze: 1,\n none: 0,\n };\n return map[tier] ?? 0;\n}\n","/*\n Simple logger for SDK\n * Can be disabled in production builds\n /\n\n/\n Log level type\n /\nexport type LogLevel = 'debug' \| 'info' \| 'warn' \| 'error' \| 'none';\n\n/\n Logger context type\n /\nexport type LogContext = Record<string, unknown>;\n\n/\n Logger interface\n /\nexport interface Logger {\n debug: (contextOrMessage: string \| LogContext, message?: string) => void;\n info: (contextOrMessage: string \| LogContext, message?: string) => void;\n warn: (contextOrMessage: string \| LogContext, message?: string) => void;\n error: (contextOrMessage: string \| LogContext, message?: string) => void;\n}\n\nlet logLevel: LogLevel = 'none';\n\n/\n Set the global log level\n * @param level - Log level to set\n /\nexport function setLogLevel(level: LogLevel): void {\n logLevel = level;\n}\n\n/\n Get the current log level\n * @returns Current log level\n /\nexport function getLogLevel(): LogLevel {\n return logLevel;\n}\n\n/\n Create a namespaced logger\n * @param namespace - Logger namespace\n * @returns Logger instance\n /\nexport function createLogger(namespace: string): Logger {\n const shouldLog = (level: Exclude<LogLevel, 'none'>): boolean => {\n if (logLevel === 'none') return false;\n\n const levels: Exclude<LogLevel, 'none'>[] = ['debug', 'info', 'warn', 'error'];\n const currentLevelIndex = levels.indexOf(logLevel as Exclude<LogLevel, 'none'>);\n const messageLevelIndex = levels.indexOf(level);\n\n return messageLevelIndex >= currentLevelIndex;\n };\n\n const formatMessage = (msg: string): string => `[${namespace}] ${msg}`;\n\n return {\n debug: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('debug')) {\n if (typeof contextOrMessage === 'string') {\n console.debug(formatMessage(contextOrMessage));\n } else {\n console.debug(formatMessage(message ?? 'Debug'), contextOrMessage);\n }\n }\n },\n info: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('info')) {\n if (typeof contextOrMessage === 'string') {\n console.info(formatMessage(contextOrMessage));\n } else {\n console.info(formatMessage(message ?? 'Info'), contextOrMessage);\n }\n }\n },\n warn: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('warn')) {\n if (typeof contextOrMessage === 'string') {\n console.warn(formatMessage(contextOrMessage));\n } else {\n console.warn(formatMessage(message ?? 'Warning'), contextOrMessage);\n }\n }\n },\n error: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('error')) {\n if (typeof contextOrMessage === 'string') {\n console.error(formatMessage(contextOrMessage));\n } else {\n console.error(formatMessage(message ?? 'Error'), contextOrMessage);\n }\n }\n },\n };\n}\n\n/\n Log verification error\n * @param protocol - Identity protocol\n * @param identifier - Identity identifier\n * @param error - Error object\n * @param context - Additional context\n /\nexport function logVerificationError(\n protocol: string,\n identifier: string,\n error: Error,\n context?: LogContext\n): void {\n const logger = createLogger('identity-verification');\n logger.error(\n {\n protocol,\n identifier,\n error: error.message,\n stack: error.stack,\n ...context,\n },\n 'Verification failed'\n );\n}\n","import type { Scheme } from '../types';\n\nimport { Buffer } from 'buffer';\n\n/* A signature as base64: hex input is converted, anything else passes through. /\nexport function toBase64Maybe(sig: string): string {\n if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {\n return Buffer.from(sig, 'hex').toString('base64');\n }\n return sig;\n}\n\n/\n The scheme a signature's bytes say it is, the same rule @orangecheck/bip322\n * verifies by: 65 bytes is a BIP-137 compact signature, whatever the address,\n * and anything else is BIP-322 simple. `null` for a BIP-322 full or\n * proof-of-funds signature, which is not supported.\n /\nexport function signatureScheme(sigBase64: string): Scheme \| null {\n if (/^(ful\|pof)/.test(sigBase64)) return null;\n if (sigBase64.startsWith('smp')) return 'bip322';\n return Buffer.from(sigBase64, 'base64').length === 65 ? 'legacy' : 'bip322';\n}\n","/* How far ahead of the verifier's clock a signed issued_at may be (OC Attest SPEC §7). /\nexport const ISSUED_AHEAD_MS = 120_000;\n\nconst RFC3339 = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z\|[+-]\\d{2}:\\d{2})$/;\n\n/* An RFC 3339 date-time as epoch milliseconds, or null when it is not one. /\nexport function rfc3339Ms(value: string \| undefined): number \| null {\n if (!value \|\| !RFC3339.test(value)) return null;\n const ms = Date.parse(value);\n return Number.isNaN(ms) ? null : ms;\n}\n","/\n OrangeCheck Protocol Verification\n \n Core verification logic for BIP-322 and legacy signatures,\n * UTXO analysis, and reputation metrics computation\n /\n\nimport type { ScoringAlgorithm } from './scoring';\nimport type {\n IdentityBinding,\n Metrics,\n Network,\n Scheme,\n StatusCode,\n VerifyInput,\n VerifyOptions,\n VerifyOutcome,\n} from './types';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nimport { generateAttestationId, parseIdentities } from './canonical';\nimport { computeAllScores, computeScore } from './scoring';\nimport { createLogger } from './utils/logger';\nimport { signatureScheme, toBase64Maybe } from './utils/signature';\nimport { ISSUED_AHEAD_MS, rfc3339Ms } from './utils/time';\n\nconst log = createLogger('ocp/verify');\n\n/\n Scoring function per OCP v0 specification (SPEC.md §6)\n * Formula: score = round( ln(1 + sats_bonded) * (1 + days_unspent / 30), 2 )\n \n This produces an unbounded score that combines both sats and time.\n * Typical ranges:\n * - 10k sats, 30 days ≈ 18\n * - 100k sats, 90 days ≈ 46\n * - 1M sats, 365 days ≈ 182\n * - 100M sats, 365 days ≈ 243\n /\n/\n Export scoring functions for use in other modules\n /\nexport { computeScore, computeAllScores, type ScoringAlgorithm };\n\n/\n Input for signature verification\n /\ninterface SignatureVerifyInput {\n /* Bitcoin address /\n addr: string;\n /* Message to verify /\n msg: string;\n /* Signature (hex or base64) /\n sig: string;\n /* @deprecated Ignored: the signature's own bytes decide the scheme. /\n scheme?: Scheme;\n}\n\n/\n Verify a signature and name the scheme that verified it. The scheme comes\n * from the signature's bytes (see `signatureScheme`), never from the address\n * or a caller's hint, so a valid BIP-137 signature verifies on every address\n * it can stand for, whatever its recovery id.\n /\nasync function verifySignature({ addr, msg, sig }: SignatureVerifyInput): Promise<StatusCode> {\n const sigBase64 = toBase64Maybe(sig);\n const scheme = signatureScheme(sigBase64);\n if (!scheme) return 'sig_unsupported_script';\n\n const ok = verifyBitcoinSignature(addr, msg, sigBase64);\n log.info({ addr, ok, scheme, msgLength: msg.length }, 'Signature verification result');\n if (!ok) return 'sig_invalid';\n return scheme === 'legacy' ? 'sig_ok_legacy' : 'sig_ok_bip322';\n}\n\n/* True when `sig` is a valid signature by `addr` over `msg`; no chain lookup. /\nexport async function signatureIsValid(input: SignatureVerifyInput): Promise<boolean> {\n try {\n const code = await verifySignature(input);\n return code === 'sig_ok_bip322' \|\| code === 'sig_ok_legacy';\n } catch {\n return false;\n }\n}\n\n// Canonical message parsing per SPEC + our builder (lowercase keys, extensions)\nexport function parseCanonicalMessage(msg: string) {\n const lines = msg.split('\\n').map((l) => l.trim());\n // `.split(':', 2)[1]` truncates values containing a colon (e.g. URLs in\n // extensions, or npubs in identities). Use the first colon as the\n // separator and keep everything after it — same approach as the\n // extensions loop below.\n const getVal = (prefix: string): string \| undefined => {\n const needle = prefix + ':';\n const hit = lines.find((l) => l.toLowerCase().startsWith(needle));\n if (!hit) return undefined;\n const idx = hit.indexOf(':');\n return hit.slice(idx + 1).trim();\n };\n\n const address = getVal('address') \|\| '';\n const identitiesStr = getVal('identities') \|\| '';\n const issued_at = getVal('issued_at') \|\| '';\n // Present but empty is kept as '', so a reader can refuse it rather than skip it.\n const expires = getVal('expires');\n\n // Parse identities\n let identities: IdentityBinding[] = [];\n try {\n identities = parseIdentities(identitiesStr);\n } catch (err) {\n log.warn({ identitiesStr, error: err }, 'Failed to parse identities field');\n }\n\n // Extensions: collect all key: value pairs excluding core known keys\n const coreKeys = new Set([\n 'orangecheck',\n 'identities',\n 'address',\n 'purpose',\n 'nonce',\n 'issued_at',\n 'ack',\n ]);\n const extensions: Record<string, string> = {};\n for (const line of lines) {\n const idx = line.indexOf(':');\n if (idx === -1) continue;\n const key = line.slice(0, idx).trim().toLowerCase();\n const val = line.slice(idx + 1).trim();\n if (!coreKeys.has(key) && val) extensions[key] = val;\n }\n\n const network = (extensions['network'] \|\| 'mainnet') as Network;\n\n // Parse bond extension if present (integer satoshis)\n const bondStr = extensions['bond'];\n const bond = bondStr ? parseInt(bondStr, 10) : undefined;\n\n return {\n core: { address, identities, issued_at },\n expires,\n network,\n extensions,\n bond: bond !== undefined && !isNaN(bond) && bond > 0 ? bond : undefined,\n };\n}\n\n/\n UTXO type from Esplora API\n /\ninterface EsploraUtxo {\n /* Transaction ID /\n txid: string;\n /* Output index /\n vout: number;\n /* Value in satoshis /\n value: number;\n /* Confirmation status /\n status: {\n /* Whether UTXO is confirmed /\n confirmed: boolean;\n /* Block height (if confirmed) /\n block_height?: number;\n /* Block timestamp (if confirmed) /\n block_time?: number;\n };\n}\n\n/\n Fetch UTXOs for an address from Esplora API\n \n Tries multiple endpoints in order with automatic fallback\n \n @param address - Bitcoin address\n * @param network - Bitcoin network\n * @param opts - Optional custom Esplora endpoints\n * @returns Array of UTXOs\n * @throws {Error} If all endpoints fail\n /\nasync function getAddressUtxos(\n address: string,\n network: Network,\n opts?: {\n esploraMainnetBase?: string;\n esploraSignetBase?: string;\n esploraTestnetBase?: string;\n }\n): Promise<EsploraUtxo[]> {\n // Define primary and fallback endpoints\n const endpoints =\n network === 'signet'\n ? [\n opts?.esploraSignetBase \|\| 'https://mempool.space/signet/api',\n 'https://blockstream.info/signet/api',\n ]\n : network === 'testnet'\n ? [\n opts?.esploraTestnetBase \|\| 'https://mempool.space/testnet/api',\n 'https://blockstream.info/testnet/api',\n ]\n : [\n opts?.esploraMainnetBase \|\| 'https://mempool.space/api',\n 'https://blockstream.info/api',\n ];\n\n let lastError: Error \| null = null;\n\n // Try each endpoint in order. Per-endpoint timeout kept tight (5s) so\n // a slow upstream doesn't stack against the next one; callers who want\n // a hard overall deadline should wrap this call with their own timeout.\n for (const base of endpoints) {\n try {\n const url = `${base}/address/${address}/utxo`;\n log.debug({ url, network }, 'Fetching UTXOs');\n\n const resp = await fetch(url, {\n method: 'GET',\n headers: { Accept: 'application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (!resp.ok) {\n throw new Error(`HTTP ${resp.status}`);\n }\n\n const data = await resp.json();\n\n // Validate response structure\n if (!Array.isArray(data)) {\n throw new Error('Invalid response: expected array');\n }\n\n // Validate each UTXO has required fields\n for (const utxo of data) {\n if (\n typeof utxo.value !== 'number' \|\|\n typeof utxo.status !== 'object' \|\|\n typeof utxo.status.confirmed !== 'boolean' \|\|\n typeof utxo.txid !== 'string' \|\|\n typeof utxo.vout !== 'number'\n ) {\n throw new Error('Invalid UTXO structure');\n }\n }\n\n log.info({ base, count: data.length, network }, 'UTXOs fetched successfully');\n return data as EsploraUtxo[];\n } catch (err) {\n lastError = err instanceof Error ? err : new Error(String(err));\n log.warn(\n { base, error: lastError.message, network },\n 'Esplora endpoint failed, trying next'\n );\n }\n }\n\n // All endpoints failed\n log.error({ endpoints, error: lastError?.message, network }, 'All Esplora endpoints failed');\n throw new Error(`esplora_all_failed: ${lastError?.message \|\| 'unknown'}`);\n}\n\n/\n Enhanced metrics computation per SPEC.md §5.4 and §6.1\n \n Supports bond extension with oldest-first greedy UTXO selection\n \n @param utxos - Array of UTXOs from Esplora\n * @param bondAmount - Optional bond amount (enables greedy selection)\n * @returns Computed metrics (sats_bonded, days_unspent, confirmed_balance)\n /\nfunction computeMetrics(\n utxos: EsploraUtxo[],\n bondAmount?: number,\n coverSats?: number\n): {\n /* Bonded satoshis (confirmed balance or bond amount) /\n sats_bonded: number;\n /* Days since oldest/youngest UTXO /\n days_unspent: number;\n /* Total confirmed balance /\n confirmed_balance: number;\n} {\n // Filter out unconfirmed UTXOs\n const confirmedUtxos = utxos.filter((u) => u.status.confirmed);\n if (confirmedUtxos.length === 0) {\n return { sats_bonded: 0, days_unspent: 0, confirmed_balance: 0 };\n }\n\n // Compute total confirmed balance\n const confirmed_balance = confirmedUtxos.reduce((sum, u) => sum + u.value, 0);\n\n // If bond extension is present, use oldest-first greedy algorithm\n if (bondAmount !== undefined && bondAmount > 0) {\n // Sort UTXOs by (block_height ASC, txid ASC, vout ASC) - oldest first\n const sorted = [...confirmedUtxos].sort((a, b) => {\n const heightA = a.status.block_height ?? Infinity;\n const heightB = b.status.block_height ?? Infinity;\n if (heightA !== heightB) return heightA - heightB;\n if (a.txid !== b.txid) return a.txid.localeCompare(b.txid);\n return a.vout - b.vout;\n });\n\n // Greedily select UTXOs until sum >= bond\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| 0);\n if (sum >= bondAmount) break;\n }\n\n // Age is computed from the youngest UTXO in the bonded set\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 60 * 60))\n );\n\n return {\n sats_bonded: bondAmount, // Use exactly bond amount (ignore surplus)\n days_unspent,\n confirmed_balance,\n };\n }\n\n // Default behavior (no bond extension): sum all confirmed UTXOs\n const sats_bonded = confirmed_balance;\n\n // A checker asking for an amount gets the age of the coins that make it\n // up, oldest first, not the age of whichever coin is oldest.\n if (coverSats !== undefined && coverSats > 0) {\n const sorted = [...confirmedUtxos].sort(\n (a, b) => (a.status.block_height ?? Infinity) - (b.status.block_height ?? Infinity)\n );\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| Date.now() / 1000);\n if (sum >= coverSats) break;\n }\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 * 60 * 60))\n );\n return { sats_bonded, days_unspent, confirmed_balance };\n }\n\n // Find the oldest confirmed UTXO for days_unspent\n const oldestTime = Math.min(\n ...confirmedUtxos.map((u) => u.status.block_time \|\| Date.now() / 1000)\n );\n const days_unspent = Math.max(0, Math.floor((Date.now() / 1000 - oldestTime) / (24 * 60 * 60)));\n\n return { sats_bonded, days_unspent, confirmed_balance };\n}\n\n/*\n Verify an OrangeCheck attestation\n \n This is the main verification function that:\n * 1. Validates the canonical message format\n * 2. Verifies the Bitcoin signature (BIP-322 or legacy)\n * 3. Fetches and analyzes UTXOs\n * 4. Computes reputation metrics\n \n @param input - Verification input (message, address, signature)\n * @param opts - Optional verification options (test mode, audience, esplora bases)\n * @returns Verification outcome with status codes and metrics\n \n @example\n * ```typescript\n * const result = await verify({\n * msg: canonicalMessage,\n * addr: 'bc1q...',\n * sig: 'AkcwRAIg...',\n * });\n \n if (result.ok) {\n * console.log('Score:', result.metrics?.score);\n * }\n * ```\n */\nexport async function verify(input: VerifyInput, opts: VerifyOptions = {}): Promise<VerifyOutcome> {\n const codes: StatusCode[] = [];\n let network: Network = 'mainnet';\n\n try {\n // Check if we have required fields\n if (!input.msg \|\| !input.addr \|\| !input.sig) {\n codes.push('bad_request');\n return { ok: false, codes, network };\n }\n\n // Parse canonical message with extensions\n const parsed = parseCanonicalMessage(input.msg);\n network = parsed.network \|\| 'mainnet';\n\n // Compute attestation ID\n const attestation_id = await generateAttestationId(input.msg);\n\n // Validate address consistency\n if (parsed.core.address !== input.addr) {\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Testnet/Signet policy enforcement\n if ((network === 'testnet' \|\| network === 'signet') && !opts.testMode) {\n codes.push('network_testmode');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Optional policy checks for extensions.\n // `aud` binds the attestation to an origin. If the caller passed\n // `expectedAud`, the check must be load-bearing — a mismatch is a\n // phishing signal, not an advisory. Fail hard (spec-aligned).\n if (opts.expectedAud) {\n const aud = parsed.extensions['aud'];\n if (!aud \|\| aud !== opts.expectedAud) {\n codes.push('aud_mismatch');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // The signed issue time is an RFC 3339 time (SPEC §7.1.g) and not ahead\n // of this clock by more than the allowed skew.\n const issued = rfc3339Ms(parsed.core.issued_at);\n if (issued === null) {\n codes.push('decode_error');\n return { ok: false, codes, network, attestation_id };\n }\n if (issued > Date.now() + ISSUED_AHEAD_MS) {\n codes.push('not_yet_valid');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Check message expiration. An expiry that is not an RFC 3339 time is\n // refused as expired: nothing shows it lies ahead.\n if (parsed.expires !== undefined) {\n const exp = rfc3339Ms(parsed.expires);\n if (exp === null \|\| exp < Date.now()) {\n codes.push('expired');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // Enhanced signature verification\n const sigCode = await verifySignature({\n addr: input.addr,\n msg: input.msg,\n sig: input.sig,\n ...(input.scheme && { scheme: input.scheme }),\n });\n codes.push(sigCode);\n\n const sigOk = sigCode === 'sig_ok_bip322' \|\| sigCode === 'sig_ok_legacy';\n if (!sigOk) {\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n\n // Enhanced UTXO analysis and metrics computation\n try {\n const utxos = await getAddressUtxos(input.addr, network, {\n esploraMainnetBase: opts.esploraMainnetBase,\n esploraSignetBase: opts.esploraSignetBase,\n });\n\n // Compute metrics with bond extension support (SPEC.md §5.4)\n const { sats_bonded, days_unspent, confirmed_balance } = computeMetrics(\n utxos,\n parsed.bond,\n opts.coverSats\n );\n\n // If bond extension is present, enforce minimum balance (SPEC.md §5.4.c)\n if (parsed.bond !== undefined && parsed.bond > 0) {\n if (confirmed_balance < parsed.bond) {\n codes.push('bond_insufficient');\n log.warn(\n {\n bond: parsed.bond,\n confirmed_balance,\n address: input.addr,\n },\n 'Bond extension: insufficient balance'\n );\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n }\n\n // Analyze bond status\n if (sats_bonded <= 0) {\n codes.push('bond_zero');\n // Check for pending UTXOs\n if (utxos.some((u) => !u.status.confirmed)) {\n codes.push('bond_pending');\n }\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n } else {\n codes.push('bond_confirmed');\n }\n\n // Compute final metrics with enhanced scoring\n const metrics: Metrics = {\n sats_bonded,\n days_unspent,\n score: (computeScore(sats_bonded, days_unspent, { algorithm: 'v0' }) as number),\n };\n\n return {\n ok: true,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n metrics,\n };\n } catch (utxoError) {\n log.error({ err: utxoError }, 'UTXO fetch failed');\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n } catch (e: unknown) {\n const msg = e instanceof Error ? e.message : String(e ?? 'decode_error');\n if (msg === 'decode_error') {\n codes.push('decode_error');\n } else {\n codes.push('bad_request');\n }\n return { ok: false, codes, network };\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/canonical.ts","../src/scoring.ts","../src/utils/logger.ts","../src/utils/signature.ts","../src/utils/time.ts","../src/verify.ts"],"names":["Buffer","verifyBitcoinSignature","days_unspent"],"mappings":";;;;;;;;AA8BA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CAClB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAChB;AAmCA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,wBAAA,GAA2B,SAAA;AAEjC,SAAS,kBAAA,CAAmB,EAAE,QAAA,EAAU,UAAA,EAAW,EAA0B;AACzE,EAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,2BAAA,EAA8B,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,uCAAA;AAAA,KAC1D;AAAA,EACJ;AACA,EAAA,IAAI,CAAC,UAAA,IAAc,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1D,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,6BAAA,EAAgC,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA,2DAAA;AAAA,KAC9D;AAAA,EACJ;AACJ;AA2BO,SAAS,gBAAgB,aAAA,EAA0C;AACtE,EAAA,IAAI,CAAC,aAAA,IAAiB,aAAA,CAAc,IAAA,OAAW,EAAA,EAAI;AAC/C,IAAA,OAAO,EAAC;AAAA,EACZ;AAIA,EAAA,IAAI,yBAAyB,IAAA,CAAK,aAAA,CAAc,QAAQ,IAAA,EAAM,EAAE,CAAC,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAAA,EAC9E;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAY;AACvD,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,eAAe,EAAA,EAAI;AACnB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,CAAE,CAAA;AAAA,IACjE;AACA,IAAA,OAAO;AAAA,MACH,UAAU,OAAA,CAAQ,SAAA,CAAU,CAAA,EAAG,UAAU,EAAE,IAAA,EAAK;AAAA,MAChD,YAAY,OAAA,CAAQ,SAAA,CAAU,UAAA,GAAa,CAAC,EAAE,IAAA;AAAK,KACvD;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACtB,IAAA,IAAI,CAAC,CAAA,CAAE,QAAA,IAAY,CAAC,EAAE,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,MAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAI,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AAAA,IAC7E;AACA,IAAA,kBAAA,CAAmB,CAAC,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,QAAA;AACX;AA0EA,eAAsB,sBAAsB,OAAA,EAAkC;AAE1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAGnC,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAG7D,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AAChD;;;AC5MA,SAAS,OAAA,CAAQ,MAAc,IAAA,EAAsB;AACjD,EAAA,IAAI,IAAA,IAAQ,CAAA,IAAK,IAAA,IAAQ,CAAA,EAAG,OAAO,CAAA;AACnC,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,IAAI,CAAA,IAAK,CAAA,GAAI,IAAA,GAAO,EAAA,CAAA,GAAM,GAAG,CAAA,GAAI,GAAA;AACpE;AAEA,SAAS,SAAA,CAAU,MAAc,IAAA,EAAoB;AACjD,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAc,IAAA,IAAQ,GAAA,EAAK,OAAO,UAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAa,IAAA,IAAQ,GAAA,EAAK,OAAO,MAAA;AAC7C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAW,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AAC1C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAU,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AACzC,EAAA,OAAO,MAAA;AACX;AAEO,SAAS,YAAA,CAAa,IAAA,EAAc,IAAA,EAAc,MAAA,EAAoC;AACzF,EAAA,QAAQ,OAAO,SAAA;AAAW,IACtB,KAAK,IAAA;AACD,MAAA,OAAO,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,IAC7B,KAAK,MAAA;AACD,MAAA,OAAO,SAAA,CAAU,MAAM,IAAI,CAAA;AAAA,IAC/B,KAAK,MAAA;AACD,MAAA,OAAO,IAAA;AAAA;AAEnB;AAEO,SAAS,gBAAA,CAAiB,MAAc,IAAA,EAAc;AACzD,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,GAAG,IAAA,EAAM,SAAA,CAAU,IAAA,EAAM,IAAI,CAAA,EAAE;AAClE;ACGO,SAAS,aAAa,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAA8C;AAC7D,IAAyB,OAAO,KAAA;AAMJ,EAChC,CAAA;AAEA,EAAA,MAAM,gBAAgB,CAAC,GAAA,KAAwB,CAAA,CAAA,EAAI,SAAS,KAAK,GAAG,CAAA,CAAA;AAEpE,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,MAAM,GAAG,gBAAgB,CAAA;AAAA,QACnE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,SAAS,GAAG,gBAAgB,CAAA;AAAA,QACtE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;AC9FO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,IAAI,iBAAiB,IAAA,CAAK,GAAG,KAAK,GAAA,CAAI,MAAA,GAAS,MAAM,CAAA,EAAG;AACpD,IAAA,OAAOA,cAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,gBAAgB,SAAA,EAAkC;AAC9D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,IAAA;AACzC,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,QAAA;AACxC,EAAA,OAAOA,cAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA,CAAE,MAAA,KAAW,KAAK,QAAA,GAAW,QAAA;AACvE;;;ACrBO,IAAM,eAAA,GAAkB,IAAA;AAE/B,IAAM,OAAA,GAAU,sEAAA;AAGT,SAAS,UAAU,KAAA,EAA0C;AAChE,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAQ,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC3C,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA,GAAI,IAAA,GAAO,EAAA;AACrC;;;ACiBA,IAAM,GAAA,GAAM,aAAa,YAAY,CAAA;AAsCrC,eAAe,eAAA,CAAgB,EAAE,IAAA,EAAM,GAAA,EAAK,KAAI,EAA8C;AAC1F,EAAA,MAAM,SAAA,GAAY,cAAc,GAAG,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,IAAI,CAAC,QAAQ,OAAO,wBAAA;AAEpB,EAAA,MAAM,EAAA,GAAKC,sBAAA,CAAuB,IAAA,EAAM,GAAA,EAAK,SAAS,CAAA;AACtD,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,EAAA,EAAI,QAAQ,SAAA,EAAW,GAAA,CAAI,MAAA,EAAO,EAAG,+BAA+B,CAAA;AACrF,EAAA,IAAI,CAAC,IAAI,OAAO,aAAA;AAChB,EAAA,OAAO,MAAA,KAAW,WAAW,eAAA,GAAkB,eAAA;AACnD;AAGA,eAAsB,iBAAiB,KAAA,EAA+C;AAClF,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,eAAA,CAAgB,KAAK,CAAA;AACxC,IAAA,OAAO,IAAA,KAAS,mBAAmB,IAAA,KAAS,eAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAGO,SAAS,sBAAsB,GAAA,EAAa;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAKjD,EAAA,MAAM,MAAA,GAAS,CAAC,MAAA,KAAuC;AACnD,IAAA,MAAM,SAAS,MAAA,GAAS,GAAA;AACxB,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,WAAA,EAAY,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,SAAS,CAAA,IAAK,EAAA;AACrC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,YAAY,CAAA,IAAK,EAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,WAAW,CAAA,IAAK,EAAA;AAEzC,EAAA,MAAM,OAAA,GAAU,OAAO,SAAS,CAAA;AAGhC,EAAA,IAAI,aAAgC,EAAC;AACrC,EAAA,IAAI;AACA,IAAA,UAAA,GAAa,gBAAgB,aAAa,CAAA;AAAA,EAC9C,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAK,EAAE,aAAA,EAAe,KAAA,EAAO,GAAA,IAAO,kCAAkC,CAAA;AAAA,EAC9E;AAGA,EAAA,MAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,IACrB,aAAA;AAAA,IACA,YAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACH,CAAA;AACD,EAAA,MAAM,aAAqC,EAAC;AAE5C,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AAClD,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACrC,IAAA,IAAI,KAAK,GAAA,CAAI,GAAG,CAAA,EAAG,QAAA,CAAS,KAAK,GAAG,CAAA;AACpC,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,IAAI,CAAC,SAAS,GAAA,CAAI,GAAG,KAAK,GAAA,EAAK,UAAA,CAAW,GAAG,CAAA,GAAI,GAAA;AAAA,EACrD;AAEA,EAAA,MAAM,OAAA,GAAW,UAAA,CAAW,SAAS,CAAA,IAAK,SAAA;AAG1C,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,GAAU,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA,GAAI,MAAA;AAE/C,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,EAAE,OAAA,EAAS,UAAA,EAAY,SAAA,EAAU;AAAA,IACvC,OAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,IAAA,EAAM,SAAS,MAAA,IAAa,CAAC,MAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,GAAI,IAAA,GAAO;AAAA,GAClE;AACJ;AAkCA,eAAe,eAAA,CACX,OAAA,EACA,OAAA,EACA,IAAA,EAKsB;AAEtB,EAAA,MAAM,SAAA,GACF,YAAY,QAAA,GACN;AAAA,IACI,MAAM,iBAAA,IAAqB,kCAAA;AAAA,IAC3B;AAAA,GACJ,GACA,YAAY,SAAA,GACV;AAAA,IACI,MAAM,kBAAA,IAAsB,mCAAA;AAAA,IAC5B;AAAA,GACJ,GACA;AAAA,IACI,MAAM,kBAAA,IAAsB,2BAAA;AAAA,IAC5B;AAAA,GACJ;AAEZ,EAAA,IAAI,SAAA,GAA0B,IAAA;AAK9B,EAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,SAAA,EAAY,OAAO,CAAA,KAAA,CAAA;AACtC,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,OAAA,IAAW,gBAAgB,CAAA;AAE5C,MAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAC1B,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACnC,CAAA;AAED,MAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,MACzC;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAG7B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,MACtD;AAGA,MAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACrB,QAAA,IACI,OAAO,KAAK,KAAA,KAAU,QAAA,IACtB,OAAO,IAAA,CAAK,MAAA,KAAW,YACvB,OAAO,IAAA,CAAK,OAAO,SAAA,KAAc,SAAA,IACjC,OAAO,IAAA,CAAK,IAAA,KAAS,YACrB,OAAO,IAAA,CAAK,SAAS,QAAA,EACvB;AACE,UAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,QAC5C;AAAA,MACJ;AAEA,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,MAAA,EAAQ,OAAA,IAAW,4BAA4B,CAAA;AAC5E,MAAA,OAAO,IAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,SAAA,GAAY,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC9D,MAAA,GAAA,CAAI,IAAA;AAAA,QACA,EAAE,IAAA,EAAM,KAAA,EAAO,SAAA,CAAU,SAAS,OAAA,EAAQ;AAAA,QAC1C;AAAA,OACJ;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,GAAA,CAAI,KAAA,CAAM,EAAE,SAAA,EAAW,KAAA,EAAO,WAAW,OAAA,EAAS,OAAA,IAAW,8BAA8B,CAAA;AAC3F,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,SAAA,EAAW,OAAA,IAAW,SAAS,CAAA,CAAE,CAAA;AAC5E;AAWA,SAAS,cAAA,CACL,KAAA,EACA,UAAA,EACA,SAAA,EAQF;AAEE,EAAA,MAAM,iBAAiB,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,SAAS,CAAA;AAC7D,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,EAAE,WAAA,EAAa,CAAA,EAAG,YAAA,EAAc,CAAA,EAAG,mBAAmB,CAAA,EAAE;AAAA,EACnE;AAGA,EAAA,MAAM,iBAAA,GAAoB,eAAe,MAAA,CAAO,CAAC,KAAK,CAAA,KAAM,GAAA,GAAM,CAAA,CAAE,KAAA,EAAO,CAAC,CAAA;AAG5E,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,UAAA,GAAa,CAAA,EAAG;AAE5C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM;AAC9C,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,IAAI,OAAA,KAAY,OAAA,EAAS,OAAO,OAAA,GAAU,OAAA;AAC1C,MAAA,IAAI,CAAA,CAAE,SAAS,CAAA,CAAE,IAAA,SAAa,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA;AACzD,MAAA,OAAO,CAAA,CAAE,OAAO,CAAA,CAAE,IAAA;AAAA,IACtB,CAAC,CAAA;AAGD,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,KAAK,GAAA,CAAI,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,cAAc,CAAC,CAAA;AACjE,MAAA,IAAI,OAAO,UAAA,EAAY;AAAA,IAC3B;AAGA,IAAA,MAAMC,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AAEA,IAAA,OAAO;AAAA,MACH,WAAA,EAAa,UAAA;AAAA;AAAA,MACb,YAAA,EAAAA,aAAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAGA,EAAA,MAAM,WAAA,GAAc,iBAAA;AAIpB,EAAA,IAAI,SAAA,KAAc,MAAA,IAAa,SAAA,GAAY,CAAA,EAAG;AAC1C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,CAAA,CAAE,IAAA;AAAA,MAC/B,CAAC,GAAG,CAAA,KAAA,CAAO,CAAA,CAAE,OAAO,YAAA,IAAgB,QAAA,KAAa,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AAAA,KAC9E;AACA,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,IAAA,CAAK,IAAI,YAAA,EAAc,IAAA,CAAK,OAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA;AACjF,MAAA,IAAI,OAAO,SAAA,EAAW;AAAA,IAC1B;AACA,IAAA,MAAMA,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AACA,IAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAAA,aAAAA,EAAc,iBAAA,EAAkB;AAAA,EAC1D;AAGA,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA;AAAA,IACpB,GAAG,cAAA,CAAe,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,CAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI;AAAA,GACzE;AACA,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAA,CAAO,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,UAAA,KAAe,EAAA,GAAK,EAAA,GAAK,GAAG,CAAC,CAAA;AAE9F,EAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB;AAC1D;AA4BA,eAAsB,MAAA,CAAO,KAAA,EAAoB,IAAA,GAAsB,EAAC,EAA2B;AAC/F,EAAA,MAAM,QAAsB,EAAC;AAC7B,EAAA,IAAI,OAAA,GAAmB,SAAA;AAEvB,EAAA,IAAI;AAEA,IAAA,IAAI,CAAC,MAAM,GAAA,IAAO,CAAC,MAAM,IAAA,IAAQ,CAAC,MAAM,GAAA,EAAK;AACzC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,IACvC;AAGA,IAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAC9C,IAAA,OAAA,GAAU,OAAO,OAAA,IAAW,SAAA;AAG5B,IAAA,MAAM,cAAA,GAAiB,MAAM,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAG5D,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,OAAA,KAAY,KAAA,CAAM,IAAA,EAAM;AACpC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAGA,IAAA,IAAA,CAAK,YAAY,SAAA,IAAa,OAAA,KAAY,QAAA,KAAa,CAAC,KAAK,QAAA,EAAU;AACnE,MAAA,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAC7B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAMA,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AACnC,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,KAAQ,IAAA,CAAK,WAAA,EAAa;AAClC,QAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAIA,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,IAAI,WAAW,IAAA,EAAM;AACjB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AACA,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI,GAAI,eAAA,EAAiB;AACvC,MAAA,KAAA,CAAM,KAAK,eAAe,CAAA;AAC1B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAIA,IAAA,IAAI,MAAA,CAAO,YAAY,KAAA,CAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,SAAA,CAAU,MAAA,CAAO,OAAO,CAAA;AACpC,MAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,GAAM,IAAA,CAAK,KAAI,EAAG;AAClC,QAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AACpB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,eAAA,CAAgB;AAAA,MAClC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,MAAA,IAAU,EAAE,MAAA,EAAQ,MAAM,MAAA;AAAO,KAC9C,CAAA;AACD,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAElB,IAAA,MAAM,KAAA,GAAQ,OAAA,KAAY,eAAA,IAAmB,OAAA,KAAY,eAAA;AACzD,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,OAC5B;AAAA,IACJ;AAGA,IAAA,IAAI;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,eAAA,CAAgB,KAAA,CAAM,MAAM,OAAA,EAAS;AAAA,QACrD,oBAAoB,IAAA,CAAK,kBAAA;AAAA,QACzB,mBAAmB,IAAA,CAAK;AAAA,OAC3B,CAAA;AAGD,MAAA,MAAM,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB,GAAI,cAAA;AAAA,QACrD,KAAA;AAAA,QACA,MAAA,CAAO,IAAA;AAAA,QACP,IAAA,CAAK;AAAA,OACT;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,KAAS,KAAA,CAAA,IAAa,MAAA,CAAO,OAAO,CAAA,EAAG;AAC9C,QAAA,IAAI,iBAAA,GAAoB,OAAO,IAAA,EAAM;AACjC,UAAA,KAAA,CAAM,KAAK,mBAAmB,CAAA;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACA;AAAA,cACI,MAAM,MAAA,CAAO,IAAA;AAAA,cACb,iBAAA;AAAA,cACA,SAAS,KAAA,CAAM;AAAA,aACnB;AAAA,YACA;AAAA,WACJ;AACA,UAAA,OAAO;AAAA,YACH,EAAA,EAAI,KAAA;AAAA,YACJ,KAAA;AAAA,YACA,OAAA;AAAA,YACA,cAAA;AAAA,YACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,WAC5B;AAAA,QACJ;AAAA,MACJ;AAGA,MAAA,IAAI,eAAe,CAAA,EAAG;AAClB,QAAA,KAAA,CAAM,KAAK,WAAW,CAAA;AAEtB,QAAA,IAAI,KAAA,CAAM,KAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,EAAG;AACxC,UAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,QAC7B;AACA,QAAA,OAAO;AAAA,UACH,EAAA,EAAI,KAAA;AAAA,UACJ,KAAA;AAAA,UACA,OAAA;AAAA,UACA,cAAA;AAAA,UACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,SAC5B;AAAA,MACJ,CAAA,MAAO;AACH,QAAA,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAAA,MAC/B;AAGA,MAAA,MAAM,OAAA,GAAmB;AAAA,QACrB,WAAA;AAAA,QACA,YAAA;AAAA,QACA,OAAQ,YAAA,CAAa,WAAA,EAAa,cAAc,EAAE,SAAA,EAAW,MAAM;AAAA,OACvE;AAEA,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,IAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK,UAAA;AAAA,QACxB;AAAA,OACJ;AAAA,IACJ,SAAS,SAAA,EAAW;AAChB,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,SAAA,IAAa,mBAAmB,CAAA;AACjD,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAAA,EACJ,SAAS,CAAA,EAAY;AACjB,IAAA,MAAM,MAAM,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,KAAK,cAAc,CAAA;AACvE,IAAA,IAAI,QAAQ,cAAA,EAAgB;AACxB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,IAC7B,CAAA,MAAO;AACH,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,EACvC;AACJ","file":"verify.js","sourcesContent":["/*\n Canonical message builder per SPEC.md §2\n \n - LF line endings, exactly one trailing LF\n * - 7 fixed core lines in strict order and wording\n * - Optional extensions appended as key: value with lexicographically sorted lowercase keys\n /\n\nimport type { AttestationEnvelope, IdentityBinding, Scheme } from './types';\n\n/\n Input for building a canonical message\n /\nexport interface CanonicalInput {\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n}\n\n/\n Extension key-value pairs for canonical message\n /\nexport type Extensions = Record<string, string \| undefined>;\n\n/\n Convert bytes to lowercase hex string\n * @param bytes - Byte array to convert\n * @returns Lowercase hex string\n /\nfunction toLowerHex(bytes: Uint8Array): string {\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n}\n\n/\n Generate a random 16-byte nonce as lowercase hex\n * Uses Web Crypto API when available, falls back to Math.random()\n * @returns 32-character lowercase hex string\n /\nexport function randomNonce16BHexLower(): string {\n const arr = new Uint8Array(16);\n\n try {\n if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {\n crypto.getRandomValues(arr);\n return toLowerHex(arr);\n }\n } catch {\n // Fall through to non-cryptographic fallback\n }\n\n // No silent Math.random fallback: a nonce is a load-bearing security\n // primitive. A deployment without `crypto.getRandomValues` MUST fix its\n // environment rather than sign with weak randomness.\n throw new Error('crypto.getRandomValues unavailable — refusing to mint a weak nonce');\n}\n\n/\n Reject characters that would break the line-oriented canonical grammar\n * or the comma-separated identities list. If any of these slipped through,\n * an attacker could smuggle a forged `address:` or extension line into the\n * signed payload: `identities: alice\\naddress: bc1qEVIL…` would parse as a\n * second address line. Catch it at the boundary, not at verification time.\n \n Also rejects a colon in the identifier so a bad actor can't turn\n * `github:alice:extra` into a different protocol binding on parse.\n /\nconst IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]$/;\nconst IDENTITY_FORBIDDEN_CHARS = /[\\r\\n,]/;\n\nfunction assertSafeIdentity({ protocol, identifier }: IdentityBinding): void {\n if (!IDENTITY_PROTOCOL_RE.test(protocol)) {\n throw new Error(\n `invalid identity protocol: ${JSON.stringify(protocol)} — must match /^[a-z][a-z0-9_-]$/`\n );\n }\n if (!identifier \|\| IDENTITY_FORBIDDEN_CHARS.test(identifier)) {\n throw new Error(\n `invalid identity identifier: ${JSON.stringify(identifier)} — must be non-empty and contain no newlines or commas`\n );\n }\n}\n\n/\n Format identities as comma-separated protocol:identifier pairs, sorted lexicographically\n * @param identities - Array of identity bindings\n * @returns Comma-separated string of protocol:identifier pairs\n /\nexport function formatIdentities(identities: IdentityBinding[] = []): string {\n if (identities.length === 0) {\n return '';\n }\n for (const id of identities) assertSafeIdentity(id);\n\n // Format as protocol:identifier and sort lexicographically\n const formatted = identities\n .map(({ protocol, identifier }) => `${protocol}:${identifier}`)\n .sort();\n\n return formatted.join(',');\n}\n\n/\n Parse identities from comma-separated protocol:identifier format\n * @param identitiesStr - Comma-separated identity string\n * @returns Array of identity bindings\n * @throws {Error} If identity format is invalid\n /\nexport function parseIdentities(identitiesStr: string): IdentityBinding[] {\n if (!identitiesStr \|\| identitiesStr.trim() === '') {\n return [];\n }\n // The identities field lives on one line of the canonical message. If it\n // contains a raw LF/CR, it's either corrupt or an attempt to smuggle a\n // fake core line into the parser. Refuse instead of trying to recover.\n if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ''))) {\n throw new Error('identities field contains forbidden characters (newline)');\n }\n\n const bindings = identitiesStr.split(',').map((binding) => {\n const colonIndex = binding.indexOf(':');\n if (colonIndex === -1) {\n throw new Error(`Invalid identity binding format: ${binding}`);\n }\n return {\n protocol: binding.substring(0, colonIndex).trim(),\n identifier: binding.substring(colonIndex + 1).trim(),\n };\n });\n\n for (const b of bindings) {\n if (!b.protocol \|\| !b.identifier) {\n throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);\n }\n assertSafeIdentity(b);\n }\n return bindings;\n}\n\n/\n Optional deterministic overrides for message building. Only intended for\n * tests / conformance vectors; production callers should let the builder\n * mint a fresh nonce + timestamp per message.\n /\nexport interface BuildOptions {\n /* 32-char lowercase hex. Default: freshly-generated cryptographic nonce. /\n nonce?: string;\n /* RFC-3339 UTC. Default: `new Date().toISOString()`. /\n issuedAt?: string;\n}\n\n/\n Build a canonical message following OrangeCheck Protocol v0 specification\n * @param input - Canonical input with address and identities\n * @param extensions - Optional extension key-value pairs\n * @param options - Optional deterministic overrides (testing only)\n * @returns Canonical message string with LF line endings\n /\nexport function buildCanonicalMessage(\n { address, identities }: CanonicalInput,\n extensions: Extensions = {},\n options: BuildOptions = {}\n): string {\n const nonce = options.nonce ?? randomNonce16BHexLower();\n if (!/^[0-9a-f]{32}$/.test(nonce)) {\n throw new Error(`invalid nonce: must be 32 lowercase hex chars`);\n }\n const issuedAt = options.issuedAt ?? new Date().toISOString();\n\n // Format identities\n const identitiesStr = formatIdentities(identities);\n\n // Core (strict wording + order per SPEC.md §2)\n const core = [\n 'orangecheck',\n `identities: ${identitiesStr}`,\n `address: ${address}`,\n 'purpose: portable reputation attestation (non-custodial)',\n `nonce: ${nonce}`,\n `issued_at: ${issuedAt}`,\n 'ack: I attest control of this address and bind it to my identities.',\n ];\n\n // Normalize and sort extensions\n const normExt: Record<string, string> = {};\n for (const [k, v] of Object.entries(extensions)) {\n if (v == null \|\| v === '') {\n continue;\n }\n const key = k.toLowerCase();\n normExt[key] = String(v);\n }\n\n const extLines = Object.keys(normExt)\n .sort()\n .map((k) => `${k}: ${normExt[k]!}`);\n\n const all = [...core, ...extLines];\n\n // Join with LF and ensure exactly one trailing LF\n return all.join('\\n') + '\\n';\n}\n\n/\n Generate attestation ID from canonical message\n \n attestation_id = SHA-256(canonical_message)\n \n @param message - Canonical message string\n * @returns Lowercase hex SHA-256 hash\n /\nexport async function generateAttestationId(message: string): Promise<string> {\n // Convert message to UTF-8 bytes\n const encoder = new TextEncoder();\n const data = encoder.encode(message);\n\n // Compute SHA-256 hash\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n return toLowerHex(new Uint8Array(hashBuffer));\n}\n\n/\n Create an attestation envelope for publishing\n \n This wraps the canonical message with metadata for Nostr publishing\n \n @param message - Canonical message\n * @param signature - BIP-322 or legacy signature\n * @param scheme - Signature scheme used\n * @param address - Bitcoin address\n * @param identities - Identity bindings\n * @param extensions - Optional extensions\n * @returns Attestation envelope ready for publishing\n /\nexport async function createAttestationEnvelope(\n message: string,\n signature: string,\n scheme: Scheme,\n address: string,\n identities: IdentityBinding[],\n extensions: Extensions = {}\n): Promise<AttestationEnvelope> {\n const attestation_id = await generateAttestationId(message);\n\n // Extract issued_at from message\n const issuedAtMatch = message.match(/issued_at: ([^\\n]+)/);\n const issued_at = issuedAtMatch?.[1] ?? new Date().toISOString();\n\n // Extract expires from extensions if present\n const expires_at = extensions.expires;\n\n // Extract relay hints from extensions if present\n const relay_hints = extensions.relay_hints?.split(',').map((r) => r.trim());\n\n // Extract publish targets from extensions if present\n const publish_targets = extensions.publish?.split(',').map((t) => t.trim());\n\n // Base64url encode the message\n const encoder = new TextEncoder();\n const messageBytes = encoder.encode(message);\n const base64 = btoa(String.fromCharCode(...messageBytes));\n const message_b64url = base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n\n // Construct verification URL\n const verification_url = `https://attest.ochk.io/attest/${attestation_id}`;\n\n return {\n attestation_id,\n scheme,\n address,\n identities,\n message,\n message_b64url,\n signature,\n issued_at,\n expires_at,\n verification_url,\n publish_targets,\n relay_hints,\n };\n}\n","/\n OrangeCheck Scoring\n \n The protocol registers exactly one scoring algorithm: `v0`. A `tier` helper\n * is also provided for UI convenience. RPs with specialized needs compute\n * their own score against raw metrics — the protocol does not ship an\n * algorithm zoo.\n \n See: docs/oc-protocol/registry/scoring.md\n /\n\nexport type ScoringAlgorithm = 'v0' \| 'tier' \| 'none';\nexport type Tier = 'platinum' \| 'gold' \| 'silver' \| 'bronze' \| 'none';\nexport type ScoreResult = number \| Tier \| null;\n\nexport interface ScoringConfig {\n algorithm: ScoringAlgorithm;\n}\n\nfunction scoreV0(sats: number, days: number): number {\n if (sats <= 0 \|\| days <= 0) return 0;\n return Math.round(Math.log(1 + sats) (1 + days / 30) * 100) / 100;\n}\n\nfunction scoreTier(sats: number, days: number): Tier {\n if (sats >= 10_000_000 && days >= 365) return 'platinum';\n if (sats >= 1_000_000 && days >= 180) return 'gold';\n if (sats >= 100_000 && days >= 90) return 'silver';\n if (sats >= 10_000 && days >= 30) return 'bronze';\n return 'none';\n}\n\nexport function computeScore(sats: number, days: number, config: ScoringConfig): ScoreResult {\n switch (config.algorithm) {\n case 'v0':\n return scoreV0(sats, days);\n case 'tier':\n return scoreTier(sats, days);\n case 'none':\n return null;\n }\n}\n\nexport function computeAllScores(sats: number, days: number) {\n return { v0: scoreV0(sats, days), tier: scoreTier(sats, days) };\n}\n\nexport function formatScore(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (score === null \|\| algorithm === 'none') return 'N/A';\n if (algorithm === 'v0') return (score as number).toFixed(1);\n const tier = score as Tier;\n const labels: Record<Tier, string> = {\n platinum: 'Platinum',\n gold: 'Gold',\n silver: 'Silver',\n bronze: 'Bronze',\n none: '—',\n };\n return labels[tier];\n}\n\nexport function getScoreColor(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (algorithm === 'tier') {\n const colors: Record<Tier, string> = {\n platinum: '#a855f7',\n gold: '#eab308',\n silver: '#94a3b8',\n bronze: '#f97316',\n none: '#64748b',\n };\n return colors[(score as Tier) ?? 'none'] ?? '#64748b';\n }\n const n = (score as number) ?? 0;\n if (n >= 100) return '#22c55e';\n if (n >= 50) return '#3b82f6';\n if (n >= 20) return '#eab308';\n return '#f97316';\n}\n\nexport function getTierNumber(tier: Tier): number {\n const map: Record<Tier, number> = {\n platinum: 4,\n gold: 3,\n silver: 2,\n bronze: 1,\n none: 0,\n };\n return map[tier] ?? 0;\n}\n","/*\n Simple logger for SDK\n * Can be disabled in production builds\n /\n\n/\n Log level type\n /\nexport type LogLevel = 'debug' \| 'info' \| 'warn' \| 'error' \| 'none';\n\n/\n Logger context type\n /\nexport type LogContext = Record<string, unknown>;\n\n/\n Logger interface\n /\nexport interface Logger {\n debug: (contextOrMessage: string \| LogContext, message?: string) => void;\n info: (contextOrMessage: string \| LogContext, message?: string) => void;\n warn: (contextOrMessage: string \| LogContext, message?: string) => void;\n error: (contextOrMessage: string \| LogContext, message?: string) => void;\n}\n\nlet logLevel: LogLevel = 'none';\n\n/\n Set the global log level\n * @param level - Log level to set\n /\nexport function setLogLevel(level: LogLevel): void {\n logLevel = level;\n}\n\n/\n Get the current log level\n * @returns Current log level\n /\nexport function getLogLevel(): LogLevel {\n return logLevel;\n}\n\n/\n Create a namespaced logger\n * @param namespace - Logger namespace\n * @returns Logger instance\n /\nexport function createLogger(namespace: string): Logger {\n const shouldLog = (level: Exclude<LogLevel, 'none'>): boolean => {\n if (logLevel === 'none') return false;\n\n const levels: Exclude<LogLevel, 'none'>[] = ['debug', 'info', 'warn', 'error'];\n const currentLevelIndex = levels.indexOf(logLevel as Exclude<LogLevel, 'none'>);\n const messageLevelIndex = levels.indexOf(level);\n\n return messageLevelIndex >= currentLevelIndex;\n };\n\n const formatMessage = (msg: string): string => `[${namespace}] ${msg}`;\n\n return {\n debug: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('debug')) {\n if (typeof contextOrMessage === 'string') {\n console.debug(formatMessage(contextOrMessage));\n } else {\n console.debug(formatMessage(message ?? 'Debug'), contextOrMessage);\n }\n }\n },\n info: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('info')) {\n if (typeof contextOrMessage === 'string') {\n console.info(formatMessage(contextOrMessage));\n } else {\n console.info(formatMessage(message ?? 'Info'), contextOrMessage);\n }\n }\n },\n warn: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('warn')) {\n if (typeof contextOrMessage === 'string') {\n console.warn(formatMessage(contextOrMessage));\n } else {\n console.warn(formatMessage(message ?? 'Warning'), contextOrMessage);\n }\n }\n },\n error: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('error')) {\n if (typeof contextOrMessage === 'string') {\n console.error(formatMessage(contextOrMessage));\n } else {\n console.error(formatMessage(message ?? 'Error'), contextOrMessage);\n }\n }\n },\n };\n}\n\n/\n Log verification error\n * @param protocol - Identity protocol\n * @param identifier - Identity identifier\n * @param error - Error object\n * @param context - Additional context\n /\nexport function logVerificationError(\n protocol: string,\n identifier: string,\n error: Error,\n context?: LogContext\n): void {\n const logger = createLogger('identity-verification');\n logger.error(\n {\n protocol,\n identifier,\n error: error.message,\n stack: error.stack,\n ...context,\n },\n 'Verification failed'\n );\n}\n","import type { Scheme } from '../types';\n\nimport { Buffer } from 'buffer';\n\n/* A signature as base64: hex input is converted, anything else passes through. /\nexport function toBase64Maybe(sig: string): string {\n if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {\n return Buffer.from(sig, 'hex').toString('base64');\n }\n return sig;\n}\n\n/\n The scheme a signature's bytes say it is, the same rule @orangecheck/bip322\n * verifies by: 65 bytes is a BIP-137 compact signature, whatever the address,\n * and anything else is BIP-322 simple. `null` for a BIP-322 full or\n * proof-of-funds signature, which is not supported.\n /\nexport function signatureScheme(sigBase64: string): Scheme \| null {\n if (/^(ful\|pof)/.test(sigBase64)) return null;\n if (sigBase64.startsWith('smp')) return 'bip322';\n return Buffer.from(sigBase64, 'base64').length === 65 ? 'legacy' : 'bip322';\n}\n","/* How far ahead of the verifier's clock a signed issued_at may be (OC Attest SPEC §7). /\nexport const ISSUED_AHEAD_MS = 120_000;\n\nconst RFC3339 = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z\|[+-]\\d{2}:\\d{2})$/;\n\n/* An RFC 3339 date-time as epoch milliseconds, or null when it is not one. /\nexport function rfc3339Ms(value: string \| undefined): number \| null {\n if (!value \|\| !RFC3339.test(value)) return null;\n const ms = Date.parse(value);\n return Number.isNaN(ms) ? null : ms;\n}\n","/\n OrangeCheck Protocol Verification\n \n Core verification logic for BIP-322 and legacy signatures,\n * UTXO analysis, and reputation metrics computation\n /\n\nimport type { ScoringAlgorithm } from './scoring';\nimport type {\n IdentityBinding,\n Metrics,\n Network,\n Scheme,\n StatusCode,\n VerifyInput,\n VerifyOptions,\n VerifyOutcome,\n} from './types';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nimport { generateAttestationId, parseIdentities } from './canonical';\nimport { computeAllScores, computeScore } from './scoring';\nimport { createLogger } from './utils/logger';\nimport { signatureScheme, toBase64Maybe } from './utils/signature';\nimport { ISSUED_AHEAD_MS, rfc3339Ms } from './utils/time';\n\nconst log = createLogger('ocp/verify');\n\n/\n Scoring function per OCP v0 specification (SPEC.md §6)\n * Formula: score = round( ln(1 + sats_bonded) * (1 + days_unspent / 30), 2 )\n \n This produces an unbounded score that combines both sats and time.\n * Typical ranges:\n * - 10k sats, 30 days ≈ 18\n * - 100k sats, 90 days ≈ 46\n * - 1M sats, 365 days ≈ 182\n * - 100M sats, 365 days ≈ 243\n /\n/\n Export scoring functions for use in other modules\n /\nexport { computeScore, computeAllScores, type ScoringAlgorithm };\n\n/\n Input for signature verification\n /\ninterface SignatureVerifyInput {\n /* Bitcoin address /\n addr: string;\n /* Message to verify /\n msg: string;\n /* Signature (hex or base64) /\n sig: string;\n /* @deprecated Ignored: the signature's own bytes decide the scheme. /\n scheme?: Scheme;\n}\n\n/\n Verify a signature and name the scheme that verified it. The scheme comes\n * from the signature's bytes (see `signatureScheme`), never from the address\n * or a caller's hint, so a valid BIP-137 signature verifies on every address\n * it can stand for, whatever its recovery id.\n /\nasync function verifySignature({ addr, msg, sig }: SignatureVerifyInput): Promise<StatusCode> {\n const sigBase64 = toBase64Maybe(sig);\n const scheme = signatureScheme(sigBase64);\n if (!scheme) return 'sig_unsupported_script';\n\n const ok = verifyBitcoinSignature(addr, msg, sigBase64);\n log.info({ addr, ok, scheme, msgLength: msg.length }, 'Signature verification result');\n if (!ok) return 'sig_invalid';\n return scheme === 'legacy' ? 'sig_ok_legacy' : 'sig_ok_bip322';\n}\n\n/* True when `sig` is a valid signature by `addr` over `msg`; no chain lookup. /\nexport async function signatureIsValid(input: SignatureVerifyInput): Promise<boolean> {\n try {\n const code = await verifySignature(input);\n return code === 'sig_ok_bip322' \|\| code === 'sig_ok_legacy';\n } catch {\n return false;\n }\n}\n\n// Canonical message parsing per SPEC + our builder (lowercase keys, extensions)\nexport function parseCanonicalMessage(msg: string) {\n const lines = msg.split('\\n').map((l) => l.trim());\n // `.split(':', 2)[1]` truncates values containing a colon (e.g. URLs in\n // extensions, or npubs in identities). Use the first colon as the\n // separator and keep everything after it — same approach as the\n // extensions loop below.\n const getVal = (prefix: string): string \| undefined => {\n const needle = prefix + ':';\n const hit = lines.find((l) => l.toLowerCase().startsWith(needle));\n if (!hit) return undefined;\n const idx = hit.indexOf(':');\n return hit.slice(idx + 1).trim();\n };\n\n const address = getVal('address') \|\| '';\n const identitiesStr = getVal('identities') \|\| '';\n const issued_at = getVal('issued_at') \|\| '';\n // Present but empty is kept as '', so a reader can refuse it rather than skip it.\n const expires = getVal('expires');\n\n // Parse identities\n let identities: IdentityBinding[] = [];\n try {\n identities = parseIdentities(identitiesStr);\n } catch (err) {\n log.warn({ identitiesStr, error: err }, 'Failed to parse identities field');\n }\n\n // Extensions: collect all key: value pairs excluding core known keys\n const coreKeys = new Set([\n 'orangecheck',\n 'identities',\n 'address',\n 'purpose',\n 'nonce',\n 'issued_at',\n 'ack',\n ]);\n const extensions: Record<string, string> = {};\n // A key signed twice has two meanings, and readers could pick either one.\n const keys = new Set<string>();\n const repeated: string[] = [];\n for (const line of lines) {\n const idx = line.indexOf(':');\n if (idx === -1) continue;\n const key = line.slice(0, idx).trim().toLowerCase();\n const val = line.slice(idx + 1).trim();\n if (keys.has(key)) repeated.push(key);\n keys.add(key);\n if (!coreKeys.has(key) && val) extensions[key] = val;\n }\n\n const network = (extensions['network'] \|\| 'mainnet') as Network;\n\n // Parse bond extension if present (integer satoshis)\n const bondStr = extensions['bond'];\n const bond = bondStr ? parseInt(bondStr, 10) : undefined;\n\n return {\n core: { address, identities, issued_at },\n expires,\n repeated,\n network,\n extensions,\n bond: bond !== undefined && !isNaN(bond) && bond > 0 ? bond : undefined,\n };\n}\n\n/\n UTXO type from Esplora API\n /\ninterface EsploraUtxo {\n /* Transaction ID /\n txid: string;\n /* Output index /\n vout: number;\n /* Value in satoshis /\n value: number;\n /* Confirmation status /\n status: {\n /* Whether UTXO is confirmed /\n confirmed: boolean;\n /* Block height (if confirmed) /\n block_height?: number;\n /* Block timestamp (if confirmed) /\n block_time?: number;\n };\n}\n\n/\n Fetch UTXOs for an address from Esplora API\n \n Tries multiple endpoints in order with automatic fallback\n \n @param address - Bitcoin address\n * @param network - Bitcoin network\n * @param opts - Optional custom Esplora endpoints\n * @returns Array of UTXOs\n * @throws {Error} If all endpoints fail\n /\nasync function getAddressUtxos(\n address: string,\n network: Network,\n opts?: {\n esploraMainnetBase?: string;\n esploraSignetBase?: string;\n esploraTestnetBase?: string;\n }\n): Promise<EsploraUtxo[]> {\n // Define primary and fallback endpoints\n const endpoints =\n network === 'signet'\n ? [\n opts?.esploraSignetBase \|\| 'https://mempool.space/signet/api',\n 'https://blockstream.info/signet/api',\n ]\n : network === 'testnet'\n ? [\n opts?.esploraTestnetBase \|\| 'https://mempool.space/testnet/api',\n 'https://blockstream.info/testnet/api',\n ]\n : [\n opts?.esploraMainnetBase \|\| 'https://mempool.space/api',\n 'https://blockstream.info/api',\n ];\n\n let lastError: Error \| null = null;\n\n // Try each endpoint in order. Per-endpoint timeout kept tight (5s) so\n // a slow upstream doesn't stack against the next one; callers who want\n // a hard overall deadline should wrap this call with their own timeout.\n for (const base of endpoints) {\n try {\n const url = `${base}/address/${address}/utxo`;\n log.debug({ url, network }, 'Fetching UTXOs');\n\n const resp = await fetch(url, {\n method: 'GET',\n headers: { Accept: 'application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (!resp.ok) {\n throw new Error(`HTTP ${resp.status}`);\n }\n\n const data = await resp.json();\n\n // Validate response structure\n if (!Array.isArray(data)) {\n throw new Error('Invalid response: expected array');\n }\n\n // Validate each UTXO has required fields\n for (const utxo of data) {\n if (\n typeof utxo.value !== 'number' \|\|\n typeof utxo.status !== 'object' \|\|\n typeof utxo.status.confirmed !== 'boolean' \|\|\n typeof utxo.txid !== 'string' \|\|\n typeof utxo.vout !== 'number'\n ) {\n throw new Error('Invalid UTXO structure');\n }\n }\n\n log.info({ base, count: data.length, network }, 'UTXOs fetched successfully');\n return data as EsploraUtxo[];\n } catch (err) {\n lastError = err instanceof Error ? err : new Error(String(err));\n log.warn(\n { base, error: lastError.message, network },\n 'Esplora endpoint failed, trying next'\n );\n }\n }\n\n // All endpoints failed\n log.error({ endpoints, error: lastError?.message, network }, 'All Esplora endpoints failed');\n throw new Error(`esplora_all_failed: ${lastError?.message \|\| 'unknown'}`);\n}\n\n/\n Enhanced metrics computation per SPEC.md §5.4 and §6.1\n \n Supports bond extension with oldest-first greedy UTXO selection\n \n @param utxos - Array of UTXOs from Esplora\n * @param bondAmount - Optional bond amount (enables greedy selection)\n * @returns Computed metrics (sats_bonded, days_unspent, confirmed_balance)\n /\nfunction computeMetrics(\n utxos: EsploraUtxo[],\n bondAmount?: number,\n coverSats?: number\n): {\n /* Bonded satoshis (confirmed balance or bond amount) /\n sats_bonded: number;\n /* Days since oldest/youngest UTXO /\n days_unspent: number;\n /* Total confirmed balance /\n confirmed_balance: number;\n} {\n // Filter out unconfirmed UTXOs\n const confirmedUtxos = utxos.filter((u) => u.status.confirmed);\n if (confirmedUtxos.length === 0) {\n return { sats_bonded: 0, days_unspent: 0, confirmed_balance: 0 };\n }\n\n // Compute total confirmed balance\n const confirmed_balance = confirmedUtxos.reduce((sum, u) => sum + u.value, 0);\n\n // If bond extension is present, use oldest-first greedy algorithm\n if (bondAmount !== undefined && bondAmount > 0) {\n // Sort UTXOs by (block_height ASC, txid ASC, vout ASC) - oldest first\n const sorted = [...confirmedUtxos].sort((a, b) => {\n const heightA = a.status.block_height ?? Infinity;\n const heightB = b.status.block_height ?? Infinity;\n if (heightA !== heightB) return heightA - heightB;\n if (a.txid !== b.txid) return a.txid.localeCompare(b.txid);\n return a.vout - b.vout;\n });\n\n // Greedily select UTXOs until sum >= bond\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| 0);\n if (sum >= bondAmount) break;\n }\n\n // Age is computed from the youngest UTXO in the bonded set\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 60 * 60))\n );\n\n return {\n sats_bonded: bondAmount, // Use exactly bond amount (ignore surplus)\n days_unspent,\n confirmed_balance,\n };\n }\n\n // Default behavior (no bond extension): sum all confirmed UTXOs\n const sats_bonded = confirmed_balance;\n\n // A checker asking for an amount gets the age of the coins that make it\n // up, oldest first, not the age of whichever coin is oldest.\n if (coverSats !== undefined && coverSats > 0) {\n const sorted = [...confirmedUtxos].sort(\n (a, b) => (a.status.block_height ?? Infinity) - (b.status.block_height ?? Infinity)\n );\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| Date.now() / 1000);\n if (sum >= coverSats) break;\n }\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 * 60 * 60))\n );\n return { sats_bonded, days_unspent, confirmed_balance };\n }\n\n // Find the oldest confirmed UTXO for days_unspent\n const oldestTime = Math.min(\n ...confirmedUtxos.map((u) => u.status.block_time \|\| Date.now() / 1000)\n );\n const days_unspent = Math.max(0, Math.floor((Date.now() / 1000 - oldestTime) / (24 * 60 * 60)));\n\n return { sats_bonded, days_unspent, confirmed_balance };\n}\n\n/*\n Verify an OrangeCheck attestation\n \n This is the main verification function that:\n * 1. Validates the canonical message format\n * 2. Verifies the Bitcoin signature (BIP-322 or legacy)\n * 3. Fetches and analyzes UTXOs\n * 4. Computes reputation metrics\n \n @param input - Verification input (message, address, signature)\n * @param opts - Optional verification options (test mode, audience, esplora bases)\n * @returns Verification outcome with status codes and metrics\n \n @example\n * ```typescript\n * const result = await verify({\n * msg: canonicalMessage,\n * addr: 'bc1q...',\n * sig: 'AkcwRAIg...',\n * });\n \n if (result.ok) {\n * console.log('Score:', result.metrics?.score);\n * }\n * ```\n */\nexport async function verify(input: VerifyInput, opts: VerifyOptions = {}): Promise<VerifyOutcome> {\n const codes: StatusCode[] = [];\n let network: Network = 'mainnet';\n\n try {\n // Check if we have required fields\n if (!input.msg \|\| !input.addr \|\| !input.sig) {\n codes.push('bad_request');\n return { ok: false, codes, network };\n }\n\n // Parse canonical message with extensions\n const parsed = parseCanonicalMessage(input.msg);\n network = parsed.network \|\| 'mainnet';\n\n // Compute attestation ID\n const attestation_id = await generateAttestationId(input.msg);\n\n // One value per key (SPEC §2.2).\n if (parsed.repeated.length > 0) {\n codes.push('decode_error');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Validate address consistency\n if (parsed.core.address !== input.addr) {\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Testnet/Signet policy enforcement\n if ((network === 'testnet' \|\| network === 'signet') && !opts.testMode) {\n codes.push('network_testmode');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Optional policy checks for extensions.\n // `aud` binds the attestation to an origin. If the caller passed\n // `expectedAud`, the check must be load-bearing — a mismatch is a\n // phishing signal, not an advisory. Fail hard (spec-aligned).\n if (opts.expectedAud) {\n const aud = parsed.extensions['aud'];\n if (!aud \|\| aud !== opts.expectedAud) {\n codes.push('aud_mismatch');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // The signed issue time is an RFC 3339 time (SPEC §7.1.g) and not ahead\n // of this clock by more than the allowed skew.\n const issued = rfc3339Ms(parsed.core.issued_at);\n if (issued === null) {\n codes.push('decode_error');\n return { ok: false, codes, network, attestation_id };\n }\n if (issued > Date.now() + ISSUED_AHEAD_MS) {\n codes.push('not_yet_valid');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Check message expiration. An expiry that is not an RFC 3339 time is\n // refused as expired: nothing shows it lies ahead.\n if (parsed.expires !== undefined) {\n const exp = rfc3339Ms(parsed.expires);\n if (exp === null \|\| exp < Date.now()) {\n codes.push('expired');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // Enhanced signature verification\n const sigCode = await verifySignature({\n addr: input.addr,\n msg: input.msg,\n sig: input.sig,\n ...(input.scheme && { scheme: input.scheme }),\n });\n codes.push(sigCode);\n\n const sigOk = sigCode === 'sig_ok_bip322' \|\| sigCode === 'sig_ok_legacy';\n if (!sigOk) {\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n\n // Enhanced UTXO analysis and metrics computation\n try {\n const utxos = await getAddressUtxos(input.addr, network, {\n esploraMainnetBase: opts.esploraMainnetBase,\n esploraSignetBase: opts.esploraSignetBase,\n });\n\n // Compute metrics with bond extension support (SPEC.md §5.4)\n const { sats_bonded, days_unspent, confirmed_balance } = computeMetrics(\n utxos,\n parsed.bond,\n opts.coverSats\n );\n\n // If bond extension is present, enforce minimum balance (SPEC.md §5.4.c)\n if (parsed.bond !== undefined && parsed.bond > 0) {\n if (confirmed_balance < parsed.bond) {\n codes.push('bond_insufficient');\n log.warn(\n {\n bond: parsed.bond,\n confirmed_balance,\n address: input.addr,\n },\n 'Bond extension: insufficient balance'\n );\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n }\n\n // Analyze bond status\n if (sats_bonded <= 0) {\n codes.push('bond_zero');\n // Check for pending UTXOs\n if (utxos.some((u) => !u.status.confirmed)) {\n codes.push('bond_pending');\n }\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n } else {\n codes.push('bond_confirmed');\n }\n\n // Compute final metrics with enhanced scoring\n const metrics: Metrics = {\n sats_bonded,\n days_unspent,\n score: (computeScore(sats_bonded, days_unspent, { algorithm: 'v0' }) as number),\n };\n\n return {\n ok: true,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n metrics,\n };\n } catch (utxoError) {\n log.error({ err: utxoError }, 'UTXO fetch failed');\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n } catch (e: unknown) {\n const msg = e instanceof Error ? e.message : String(e ?? 'decode_error');\n if (msg === 'decode_error') {\n codes.push('decode_error');\n } else {\n codes.push('bad_request');\n }\n return { ok: false, codes, network };\n }\n}\n"]}

package/dist/verify.mjs CHANGED Viewed

@@ -191,11 +191,15 @@ function parseCanonicalMessage(msg) {
     "ack"
   ]);
   const extensions = {};
+  const keys = /* @__PURE__ */ new Set();
+  const repeated = [];
   for (const line of lines) {
     const idx = line.indexOf(":");
     if (idx === -1) continue;
     const key = line.slice(0, idx).trim().toLowerCase();
     const val = line.slice(idx + 1).trim();
+    if (keys.has(key)) repeated.push(key);
+    keys.add(key);
     if (!coreKeys.has(key) && val) extensions[key] = val;
   }
   const network = extensions["network"] || "mainnet";
@@ -204,6 +208,7 @@ function parseCanonicalMessage(msg) {
   return {
     core: { address, identities, issued_at },
     expires,
+    repeated,
     network,
     extensions,
     bond: bond !== void 0 && !isNaN(bond) && bond > 0 ? bond : void 0
@@ -322,6 +327,10 @@ async function verify(input, opts = {}) {
     const parsed = parseCanonicalMessage(input.msg);
     network = parsed.network || "mainnet";
     const attestation_id = await generateAttestationId(input.msg);
+    if (parsed.repeated.length > 0) {
+      codes.push("decode_error");
+      return { ok: false, codes, network, attestation_id };
+    }
     if (parsed.core.address !== input.addr) {
       codes.push("bad_request");
       return { ok: false, codes, network, attestation_id };

package/dist/verify.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/canonical.ts","../src/scoring.ts","../src/utils/logger.ts","../src/utils/signature.ts","../src/utils/time.ts","../src/verify.ts"],"names":["verifyBitcoinSignature","days_unspent"],"mappings":";;;;;;AA8BA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CAClB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAChB;AAmCA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,wBAAA,GAA2B,SAAA;AAEjC,SAAS,kBAAA,CAAmB,EAAE,QAAA,EAAU,UAAA,EAAW,EAA0B;AACzE,EAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,2BAAA,EAA8B,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,uCAAA;AAAA,KAC1D;AAAA,EACJ;AACA,EAAA,IAAI,CAAC,UAAA,IAAc,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1D,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,6BAAA,EAAgC,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA,2DAAA;AAAA,KAC9D;AAAA,EACJ;AACJ;AA2BO,SAAS,gBAAgB,aAAA,EAA0C;AACtE,EAAA,IAAI,CAAC,aAAA,IAAiB,aAAA,CAAc,IAAA,OAAW,EAAA,EAAI;AAC/C,IAAA,OAAO,EAAC;AAAA,EACZ;AAIA,EAAA,IAAI,yBAAyB,IAAA,CAAK,aAAA,CAAc,QAAQ,IAAA,EAAM,EAAE,CAAC,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAAA,EAC9E;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAY;AACvD,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,eAAe,EAAA,EAAI;AACnB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,CAAE,CAAA;AAAA,IACjE;AACA,IAAA,OAAO;AAAA,MACH,UAAU,OAAA,CAAQ,SAAA,CAAU,CAAA,EAAG,UAAU,EAAE,IAAA,EAAK;AAAA,MAChD,YAAY,OAAA,CAAQ,SAAA,CAAU,UAAA,GAAa,CAAC,EAAE,IAAA;AAAK,KACvD;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACtB,IAAA,IAAI,CAAC,CAAA,CAAE,QAAA,IAAY,CAAC,EAAE,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,MAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAI,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AAAA,IAC7E;AACA,IAAA,kBAAA,CAAmB,CAAC,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,QAAA;AACX;AA0EA,eAAsB,sBAAsB,OAAA,EAAkC;AAE1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAGnC,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAG7D,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AAChD;;;AC5MA,SAAS,OAAA,CAAQ,MAAc,IAAA,EAAsB;AACjD,EAAA,IAAI,IAAA,IAAQ,CAAA,IAAK,IAAA,IAAQ,CAAA,EAAG,OAAO,CAAA;AACnC,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,IAAI,CAAA,IAAK,CAAA,GAAI,IAAA,GAAO,EAAA,CAAA,GAAM,GAAG,CAAA,GAAI,GAAA;AACpE;AAEA,SAAS,SAAA,CAAU,MAAc,IAAA,EAAoB;AACjD,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAc,IAAA,IAAQ,GAAA,EAAK,OAAO,UAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAa,IAAA,IAAQ,GAAA,EAAK,OAAO,MAAA;AAC7C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAW,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AAC1C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAU,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AACzC,EAAA,OAAO,MAAA;AACX;AAEO,SAAS,YAAA,CAAa,IAAA,EAAc,IAAA,EAAc,MAAA,EAAoC;AACzF,EAAA,QAAQ,OAAO,SAAA;AAAW,IACtB,KAAK,IAAA;AACD,MAAA,OAAO,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,IAC7B,KAAK,MAAA;AACD,MAAA,OAAO,SAAA,CAAU,MAAM,IAAI,CAAA;AAAA,IAC/B,KAAK,MAAA;AACD,MAAA,OAAO,IAAA;AAAA;AAEnB;AAEO,SAAS,gBAAA,CAAiB,MAAc,IAAA,EAAc;AACzD,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,GAAG,IAAA,EAAM,SAAA,CAAU,IAAA,EAAM,IAAI,CAAA,EAAE;AAClE;ACGO,SAAS,aAAa,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAA8C;AAC7D,IAAyB,OAAO,KAAA;AAMJ,EAChC,CAAA;AAEA,EAAA,MAAM,gBAAgB,CAAC,GAAA,KAAwB,CAAA,CAAA,EAAI,SAAS,KAAK,GAAG,CAAA,CAAA;AAEpE,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,MAAM,GAAG,gBAAgB,CAAA;AAAA,QACnE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,SAAS,GAAG,gBAAgB,CAAA;AAAA,QACtE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;AC9FO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,IAAI,iBAAiB,IAAA,CAAK,GAAG,KAAK,GAAA,CAAI,MAAA,GAAS,MAAM,CAAA,EAAG;AACpD,IAAA,OAAO,OAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,gBAAgB,SAAA,EAAkC;AAC9D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,IAAA;AACzC,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,QAAA;AACxC,EAAA,OAAO,OAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA,CAAE,MAAA,KAAW,KAAK,QAAA,GAAW,QAAA;AACvE;;;ACrBO,IAAM,eAAA,GAAkB,IAAA;AAE/B,IAAM,OAAA,GAAU,sEAAA;AAGT,SAAS,UAAU,KAAA,EAA0C;AAChE,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAQ,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC3C,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA,GAAI,IAAA,GAAO,EAAA;AACrC;;;ACiBA,IAAM,GAAA,GAAM,aAAa,YAAY,CAAA;AAsCrC,eAAe,eAAA,CAAgB,EAAE,IAAA,EAAM,GAAA,EAAK,KAAI,EAA8C;AAC1F,EAAA,MAAM,SAAA,GAAY,cAAc,GAAG,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,IAAI,CAAC,QAAQ,OAAO,wBAAA;AAEpB,EAAA,MAAM,EAAA,GAAKA,iBAAA,CAAuB,IAAA,EAAM,GAAA,EAAK,SAAS,CAAA;AACtD,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,EAAA,EAAI,QAAQ,SAAA,EAAW,GAAA,CAAI,MAAA,EAAO,EAAG,+BAA+B,CAAA;AACrF,EAAA,IAAI,CAAC,IAAI,OAAO,aAAA;AAChB,EAAA,OAAO,MAAA,KAAW,WAAW,eAAA,GAAkB,eAAA;AACnD;AAGA,eAAsB,iBAAiB,KAAA,EAA+C;AAClF,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,eAAA,CAAgB,KAAK,CAAA;AACxC,IAAA,OAAO,IAAA,KAAS,mBAAmB,IAAA,KAAS,eAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAGO,SAAS,sBAAsB,GAAA,EAAa;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAKjD,EAAA,MAAM,MAAA,GAAS,CAAC,MAAA,KAAuC;AACnD,IAAA,MAAM,SAAS,MAAA,GAAS,GAAA;AACxB,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,WAAA,EAAY,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,SAAS,CAAA,IAAK,EAAA;AACrC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,YAAY,CAAA,IAAK,EAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,WAAW,CAAA,IAAK,EAAA;AAEzC,EAAA,MAAM,OAAA,GAAU,OAAO,SAAS,CAAA;AAGhC,EAAA,IAAI,aAAgC,EAAC;AACrC,EAAA,IAAI;AACA,IAAA,UAAA,GAAa,gBAAgB,aAAa,CAAA;AAAA,EAC9C,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAK,EAAE,aAAA,EAAe,KAAA,EAAO,GAAA,IAAO,kCAAkC,CAAA;AAAA,EAC9E;AAGA,EAAA,MAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,IACrB,aAAA;AAAA,IACA,YAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACH,CAAA;AACD,EAAA,MAAM,aAAqC,EAAC;AAC5C,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AAClD,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACrC,IAAA,IAAI,CAAC,SAAS,GAAA,CAAI,GAAG,KAAK,GAAA,EAAK,UAAA,CAAW,GAAG,CAAA,GAAI,GAAA;AAAA,EACrD;AAEA,EAAA,MAAM,OAAA,GAAW,UAAA,CAAW,SAAS,CAAA,IAAK,SAAA;AAG1C,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,GAAU,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA,GAAI,MAAA;AAE/C,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,EAAE,OAAA,EAAS,UAAA,EAAY,SAAA,EAAU;AAAA,IACvC,OAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,IAAA,EAAM,SAAS,MAAA,IAAa,CAAC,MAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,GAAI,IAAA,GAAO;AAAA,GAClE;AACJ;AAkCA,eAAe,eAAA,CACX,OAAA,EACA,OAAA,EACA,IAAA,EAKsB;AAEtB,EAAA,MAAM,SAAA,GACF,YAAY,QAAA,GACN;AAAA,IACI,MAAM,iBAAA,IAAqB,kCAAA;AAAA,IAC3B;AAAA,GACJ,GACA,YAAY,SAAA,GACV;AAAA,IACI,MAAM,kBAAA,IAAsB,mCAAA;AAAA,IAC5B;AAAA,GACJ,GACA;AAAA,IACI,MAAM,kBAAA,IAAsB,2BAAA;AAAA,IAC5B;AAAA,GACJ;AAEZ,EAAA,IAAI,SAAA,GAA0B,IAAA;AAK9B,EAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,SAAA,EAAY,OAAO,CAAA,KAAA,CAAA;AACtC,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,OAAA,IAAW,gBAAgB,CAAA;AAE5C,MAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAC1B,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACnC,CAAA;AAED,MAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,MACzC;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAG7B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,MACtD;AAGA,MAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACrB,QAAA,IACI,OAAO,KAAK,KAAA,KAAU,QAAA,IACtB,OAAO,IAAA,CAAK,MAAA,KAAW,YACvB,OAAO,IAAA,CAAK,OAAO,SAAA,KAAc,SAAA,IACjC,OAAO,IAAA,CAAK,IAAA,KAAS,YACrB,OAAO,IAAA,CAAK,SAAS,QAAA,EACvB;AACE,UAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,QAC5C;AAAA,MACJ;AAEA,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,MAAA,EAAQ,OAAA,IAAW,4BAA4B,CAAA;AAC5E,MAAA,OAAO,IAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,SAAA,GAAY,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC9D,MAAA,GAAA,CAAI,IAAA;AAAA,QACA,EAAE,IAAA,EAAM,KAAA,EAAO,SAAA,CAAU,SAAS,OAAA,EAAQ;AAAA,QAC1C;AAAA,OACJ;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,GAAA,CAAI,KAAA,CAAM,EAAE,SAAA,EAAW,KAAA,EAAO,WAAW,OAAA,EAAS,OAAA,IAAW,8BAA8B,CAAA;AAC3F,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,SAAA,EAAW,OAAA,IAAW,SAAS,CAAA,CAAE,CAAA;AAC5E;AAWA,SAAS,cAAA,CACL,KAAA,EACA,UAAA,EACA,SAAA,EAQF;AAEE,EAAA,MAAM,iBAAiB,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,SAAS,CAAA;AAC7D,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,EAAE,WAAA,EAAa,CAAA,EAAG,YAAA,EAAc,CAAA,EAAG,mBAAmB,CAAA,EAAE;AAAA,EACnE;AAGA,EAAA,MAAM,iBAAA,GAAoB,eAAe,MAAA,CAAO,CAAC,KAAK,CAAA,KAAM,GAAA,GAAM,CAAA,CAAE,KAAA,EAAO,CAAC,CAAA;AAG5E,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,UAAA,GAAa,CAAA,EAAG;AAE5C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM;AAC9C,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,IAAI,OAAA,KAAY,OAAA,EAAS,OAAO,OAAA,GAAU,OAAA;AAC1C,MAAA,IAAI,CAAA,CAAE,SAAS,CAAA,CAAE,IAAA,SAAa,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA;AACzD,MAAA,OAAO,CAAA,CAAE,OAAO,CAAA,CAAE,IAAA;AAAA,IACtB,CAAC,CAAA;AAGD,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,KAAK,GAAA,CAAI,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,cAAc,CAAC,CAAA;AACjE,MAAA,IAAI,OAAO,UAAA,EAAY;AAAA,IAC3B;AAGA,IAAA,MAAMC,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AAEA,IAAA,OAAO;AAAA,MACH,WAAA,EAAa,UAAA;AAAA;AAAA,MACb,YAAA,EAAAA,aAAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAGA,EAAA,MAAM,WAAA,GAAc,iBAAA;AAIpB,EAAA,IAAI,SAAA,KAAc,MAAA,IAAa,SAAA,GAAY,CAAA,EAAG;AAC1C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,CAAA,CAAE,IAAA;AAAA,MAC/B,CAAC,GAAG,CAAA,KAAA,CAAO,CAAA,CAAE,OAAO,YAAA,IAAgB,QAAA,KAAa,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AAAA,KAC9E;AACA,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,IAAA,CAAK,IAAI,YAAA,EAAc,IAAA,CAAK,OAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA;AACjF,MAAA,IAAI,OAAO,SAAA,EAAW;AAAA,IAC1B;AACA,IAAA,MAAMA,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AACA,IAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAAA,aAAAA,EAAc,iBAAA,EAAkB;AAAA,EAC1D;AAGA,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA;AAAA,IACpB,GAAG,cAAA,CAAe,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,CAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI;AAAA,GACzE;AACA,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAA,CAAO,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,UAAA,KAAe,EAAA,GAAK,EAAA,GAAK,GAAG,CAAC,CAAA;AAE9F,EAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB;AAC1D;AA4BA,eAAsB,MAAA,CAAO,KAAA,EAAoB,IAAA,GAAsB,EAAC,EAA2B;AAC/F,EAAA,MAAM,QAAsB,EAAC;AAC7B,EAAA,IAAI,OAAA,GAAmB,SAAA;AAEvB,EAAA,IAAI;AAEA,IAAA,IAAI,CAAC,MAAM,GAAA,IAAO,CAAC,MAAM,IAAA,IAAQ,CAAC,MAAM,GAAA,EAAK;AACzC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,IACvC;AAGA,IAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAC9C,IAAA,OAAA,GAAU,OAAO,OAAA,IAAW,SAAA;AAG5B,IAAA,MAAM,cAAA,GAAiB,MAAM,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAG5D,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,OAAA,KAAY,KAAA,CAAM,IAAA,EAAM;AACpC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAGA,IAAA,IAAA,CAAK,YAAY,SAAA,IAAa,OAAA,KAAY,QAAA,KAAa,CAAC,KAAK,QAAA,EAAU;AACnE,MAAA,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAC7B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAMA,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AACnC,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,KAAQ,IAAA,CAAK,WAAA,EAAa;AAClC,QAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAIA,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,IAAI,WAAW,IAAA,EAAM;AACjB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AACA,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI,GAAI,eAAA,EAAiB;AACvC,MAAA,KAAA,CAAM,KAAK,eAAe,CAAA;AAC1B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAIA,IAAA,IAAI,MAAA,CAAO,YAAY,KAAA,CAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,SAAA,CAAU,MAAA,CAAO,OAAO,CAAA;AACpC,MAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,GAAM,IAAA,CAAK,KAAI,EAAG;AAClC,QAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AACpB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,eAAA,CAAgB;AAAA,MAClC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,MAAA,IAAU,EAAE,MAAA,EAAQ,MAAM,MAAA;AAAO,KAC9C,CAAA;AACD,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAElB,IAAA,MAAM,KAAA,GAAQ,OAAA,KAAY,eAAA,IAAmB,OAAA,KAAY,eAAA;AACzD,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,OAC5B;AAAA,IACJ;AAGA,IAAA,IAAI;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,eAAA,CAAgB,KAAA,CAAM,MAAM,OAAA,EAAS;AAAA,QACrD,oBAAoB,IAAA,CAAK,kBAAA;AAAA,QACzB,mBAAmB,IAAA,CAAK;AAAA,OAC3B,CAAA;AAGD,MAAA,MAAM,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB,GAAI,cAAA;AAAA,QACrD,KAAA;AAAA,QACA,MAAA,CAAO,IAAA;AAAA,QACP,IAAA,CAAK;AAAA,OACT;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,KAAS,KAAA,CAAA,IAAa,MAAA,CAAO,OAAO,CAAA,EAAG;AAC9C,QAAA,IAAI,iBAAA,GAAoB,OAAO,IAAA,EAAM;AACjC,UAAA,KAAA,CAAM,KAAK,mBAAmB,CAAA;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACA;AAAA,cACI,MAAM,MAAA,CAAO,IAAA;AAAA,cACb,iBAAA;AAAA,cACA,SAAS,KAAA,CAAM;AAAA,aACnB;AAAA,YACA;AAAA,WACJ;AACA,UAAA,OAAO;AAAA,YACH,EAAA,EAAI,KAAA;AAAA,YACJ,KAAA;AAAA,YACA,OAAA;AAAA,YACA,cAAA;AAAA,YACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,WAC5B;AAAA,QACJ;AAAA,MACJ;AAGA,MAAA,IAAI,eAAe,CAAA,EAAG;AAClB,QAAA,KAAA,CAAM,KAAK,WAAW,CAAA;AAEtB,QAAA,IAAI,KAAA,CAAM,KAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,EAAG;AACxC,UAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,QAC7B;AACA,QAAA,OAAO;AAAA,UACH,EAAA,EAAI,KAAA;AAAA,UACJ,KAAA;AAAA,UACA,OAAA;AAAA,UACA,cAAA;AAAA,UACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,SAC5B;AAAA,MACJ,CAAA,MAAO;AACH,QAAA,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAAA,MAC/B;AAGA,MAAA,MAAM,OAAA,GAAmB;AAAA,QACrB,WAAA;AAAA,QACA,YAAA;AAAA,QACA,OAAQ,YAAA,CAAa,WAAA,EAAa,cAAc,EAAE,SAAA,EAAW,MAAM;AAAA,OACvE;AAEA,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,IAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK,UAAA;AAAA,QACxB;AAAA,OACJ;AAAA,IACJ,SAAS,SAAA,EAAW;AAChB,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,SAAA,IAAa,mBAAmB,CAAA;AACjD,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAAA,EACJ,SAAS,CAAA,EAAY;AACjB,IAAA,MAAM,MAAM,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,KAAK,cAAc,CAAA;AACvE,IAAA,IAAI,QAAQ,cAAA,EAAgB;AACxB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,IAC7B,CAAA,MAAO;AACH,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,EACvC;AACJ","file":"verify.mjs","sourcesContent":["/*\n Canonical message builder per SPEC.md §2\n \n - LF line endings, exactly one trailing LF\n * - 7 fixed core lines in strict order and wording\n * - Optional extensions appended as key: value with lexicographically sorted lowercase keys\n /\n\nimport type { AttestationEnvelope, IdentityBinding, Scheme } from './types';\n\n/\n Input for building a canonical message\n /\nexport interface CanonicalInput {\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n}\n\n/\n Extension key-value pairs for canonical message\n /\nexport type Extensions = Record<string, string \| undefined>;\n\n/\n Convert bytes to lowercase hex string\n * @param bytes - Byte array to convert\n * @returns Lowercase hex string\n /\nfunction toLowerHex(bytes: Uint8Array): string {\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n}\n\n/\n Generate a random 16-byte nonce as lowercase hex\n * Uses Web Crypto API when available, falls back to Math.random()\n * @returns 32-character lowercase hex string\n /\nexport function randomNonce16BHexLower(): string {\n const arr = new Uint8Array(16);\n\n try {\n if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {\n crypto.getRandomValues(arr);\n return toLowerHex(arr);\n }\n } catch {\n // Fall through to non-cryptographic fallback\n }\n\n // No silent Math.random fallback: a nonce is a load-bearing security\n // primitive. A deployment without `crypto.getRandomValues` MUST fix its\n // environment rather than sign with weak randomness.\n throw new Error('crypto.getRandomValues unavailable — refusing to mint a weak nonce');\n}\n\n/\n Reject characters that would break the line-oriented canonical grammar\n * or the comma-separated identities list. If any of these slipped through,\n * an attacker could smuggle a forged `address:` or extension line into the\n * signed payload: `identities: alice\\naddress: bc1qEVIL…` would parse as a\n * second address line. Catch it at the boundary, not at verification time.\n \n Also rejects a colon in the identifier so a bad actor can't turn\n * `github:alice:extra` into a different protocol binding on parse.\n /\nconst IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]$/;\nconst IDENTITY_FORBIDDEN_CHARS = /[\\r\\n,]/;\n\nfunction assertSafeIdentity({ protocol, identifier }: IdentityBinding): void {\n if (!IDENTITY_PROTOCOL_RE.test(protocol)) {\n throw new Error(\n `invalid identity protocol: ${JSON.stringify(protocol)} — must match /^[a-z][a-z0-9_-]$/`\n );\n }\n if (!identifier \|\| IDENTITY_FORBIDDEN_CHARS.test(identifier)) {\n throw new Error(\n `invalid identity identifier: ${JSON.stringify(identifier)} — must be non-empty and contain no newlines or commas`\n );\n }\n}\n\n/\n Format identities as comma-separated protocol:identifier pairs, sorted lexicographically\n * @param identities - Array of identity bindings\n * @returns Comma-separated string of protocol:identifier pairs\n /\nexport function formatIdentities(identities: IdentityBinding[] = []): string {\n if (identities.length === 0) {\n return '';\n }\n for (const id of identities) assertSafeIdentity(id);\n\n // Format as protocol:identifier and sort lexicographically\n const formatted = identities\n .map(({ protocol, identifier }) => `${protocol}:${identifier}`)\n .sort();\n\n return formatted.join(',');\n}\n\n/\n Parse identities from comma-separated protocol:identifier format\n * @param identitiesStr - Comma-separated identity string\n * @returns Array of identity bindings\n * @throws {Error} If identity format is invalid\n /\nexport function parseIdentities(identitiesStr: string): IdentityBinding[] {\n if (!identitiesStr \|\| identitiesStr.trim() === '') {\n return [];\n }\n // The identities field lives on one line of the canonical message. If it\n // contains a raw LF/CR, it's either corrupt or an attempt to smuggle a\n // fake core line into the parser. Refuse instead of trying to recover.\n if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ''))) {\n throw new Error('identities field contains forbidden characters (newline)');\n }\n\n const bindings = identitiesStr.split(',').map((binding) => {\n const colonIndex = binding.indexOf(':');\n if (colonIndex === -1) {\n throw new Error(`Invalid identity binding format: ${binding}`);\n }\n return {\n protocol: binding.substring(0, colonIndex).trim(),\n identifier: binding.substring(colonIndex + 1).trim(),\n };\n });\n\n for (const b of bindings) {\n if (!b.protocol \|\| !b.identifier) {\n throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);\n }\n assertSafeIdentity(b);\n }\n return bindings;\n}\n\n/\n Optional deterministic overrides for message building. Only intended for\n * tests / conformance vectors; production callers should let the builder\n * mint a fresh nonce + timestamp per message.\n /\nexport interface BuildOptions {\n /* 32-char lowercase hex. Default: freshly-generated cryptographic nonce. /\n nonce?: string;\n /* RFC-3339 UTC. Default: `new Date().toISOString()`. /\n issuedAt?: string;\n}\n\n/\n Build a canonical message following OrangeCheck Protocol v0 specification\n * @param input - Canonical input with address and identities\n * @param extensions - Optional extension key-value pairs\n * @param options - Optional deterministic overrides (testing only)\n * @returns Canonical message string with LF line endings\n /\nexport function buildCanonicalMessage(\n { address, identities }: CanonicalInput,\n extensions: Extensions = {},\n options: BuildOptions = {}\n): string {\n const nonce = options.nonce ?? randomNonce16BHexLower();\n if (!/^[0-9a-f]{32}$/.test(nonce)) {\n throw new Error(`invalid nonce: must be 32 lowercase hex chars`);\n }\n const issuedAt = options.issuedAt ?? new Date().toISOString();\n\n // Format identities\n const identitiesStr = formatIdentities(identities);\n\n // Core (strict wording + order per SPEC.md §2)\n const core = [\n 'orangecheck',\n `identities: ${identitiesStr}`,\n `address: ${address}`,\n 'purpose: portable reputation attestation (non-custodial)',\n `nonce: ${nonce}`,\n `issued_at: ${issuedAt}`,\n 'ack: I attest control of this address and bind it to my identities.',\n ];\n\n // Normalize and sort extensions\n const normExt: Record<string, string> = {};\n for (const [k, v] of Object.entries(extensions)) {\n if (v == null \|\| v === '') {\n continue;\n }\n const key = k.toLowerCase();\n normExt[key] = String(v);\n }\n\n const extLines = Object.keys(normExt)\n .sort()\n .map((k) => `${k}: ${normExt[k]!}`);\n\n const all = [...core, ...extLines];\n\n // Join with LF and ensure exactly one trailing LF\n return all.join('\\n') + '\\n';\n}\n\n/\n Generate attestation ID from canonical message\n \n attestation_id = SHA-256(canonical_message)\n \n @param message - Canonical message string\n * @returns Lowercase hex SHA-256 hash\n /\nexport async function generateAttestationId(message: string): Promise<string> {\n // Convert message to UTF-8 bytes\n const encoder = new TextEncoder();\n const data = encoder.encode(message);\n\n // Compute SHA-256 hash\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n return toLowerHex(new Uint8Array(hashBuffer));\n}\n\n/\n Create an attestation envelope for publishing\n \n This wraps the canonical message with metadata for Nostr publishing\n \n @param message - Canonical message\n * @param signature - BIP-322 or legacy signature\n * @param scheme - Signature scheme used\n * @param address - Bitcoin address\n * @param identities - Identity bindings\n * @param extensions - Optional extensions\n * @returns Attestation envelope ready for publishing\n /\nexport async function createAttestationEnvelope(\n message: string,\n signature: string,\n scheme: Scheme,\n address: string,\n identities: IdentityBinding[],\n extensions: Extensions = {}\n): Promise<AttestationEnvelope> {\n const attestation_id = await generateAttestationId(message);\n\n // Extract issued_at from message\n const issuedAtMatch = message.match(/issued_at: ([^\\n]+)/);\n const issued_at = issuedAtMatch?.[1] ?? new Date().toISOString();\n\n // Extract expires from extensions if present\n const expires_at = extensions.expires;\n\n // Extract relay hints from extensions if present\n const relay_hints = extensions.relay_hints?.split(',').map((r) => r.trim());\n\n // Extract publish targets from extensions if present\n const publish_targets = extensions.publish?.split(',').map((t) => t.trim());\n\n // Base64url encode the message\n const encoder = new TextEncoder();\n const messageBytes = encoder.encode(message);\n const base64 = btoa(String.fromCharCode(...messageBytes));\n const message_b64url = base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n\n // Construct verification URL\n const verification_url = `https://attest.ochk.io/attest/${attestation_id}`;\n\n return {\n attestation_id,\n scheme,\n address,\n identities,\n message,\n message_b64url,\n signature,\n issued_at,\n expires_at,\n verification_url,\n publish_targets,\n relay_hints,\n };\n}\n","/\n OrangeCheck Scoring\n \n The protocol registers exactly one scoring algorithm: `v0`. A `tier` helper\n * is also provided for UI convenience. RPs with specialized needs compute\n * their own score against raw metrics — the protocol does not ship an\n * algorithm zoo.\n \n See: docs/oc-protocol/registry/scoring.md\n /\n\nexport type ScoringAlgorithm = 'v0' \| 'tier' \| 'none';\nexport type Tier = 'platinum' \| 'gold' \| 'silver' \| 'bronze' \| 'none';\nexport type ScoreResult = number \| Tier \| null;\n\nexport interface ScoringConfig {\n algorithm: ScoringAlgorithm;\n}\n\nfunction scoreV0(sats: number, days: number): number {\n if (sats <= 0 \|\| days <= 0) return 0;\n return Math.round(Math.log(1 + sats) (1 + days / 30) * 100) / 100;\n}\n\nfunction scoreTier(sats: number, days: number): Tier {\n if (sats >= 10_000_000 && days >= 365) return 'platinum';\n if (sats >= 1_000_000 && days >= 180) return 'gold';\n if (sats >= 100_000 && days >= 90) return 'silver';\n if (sats >= 10_000 && days >= 30) return 'bronze';\n return 'none';\n}\n\nexport function computeScore(sats: number, days: number, config: ScoringConfig): ScoreResult {\n switch (config.algorithm) {\n case 'v0':\n return scoreV0(sats, days);\n case 'tier':\n return scoreTier(sats, days);\n case 'none':\n return null;\n }\n}\n\nexport function computeAllScores(sats: number, days: number) {\n return { v0: scoreV0(sats, days), tier: scoreTier(sats, days) };\n}\n\nexport function formatScore(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (score === null \|\| algorithm === 'none') return 'N/A';\n if (algorithm === 'v0') return (score as number).toFixed(1);\n const tier = score as Tier;\n const labels: Record<Tier, string> = {\n platinum: 'Platinum',\n gold: 'Gold',\n silver: 'Silver',\n bronze: 'Bronze',\n none: '—',\n };\n return labels[tier];\n}\n\nexport function getScoreColor(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (algorithm === 'tier') {\n const colors: Record<Tier, string> = {\n platinum: '#a855f7',\n gold: '#eab308',\n silver: '#94a3b8',\n bronze: '#f97316',\n none: '#64748b',\n };\n return colors[(score as Tier) ?? 'none'] ?? '#64748b';\n }\n const n = (score as number) ?? 0;\n if (n >= 100) return '#22c55e';\n if (n >= 50) return '#3b82f6';\n if (n >= 20) return '#eab308';\n return '#f97316';\n}\n\nexport function getTierNumber(tier: Tier): number {\n const map: Record<Tier, number> = {\n platinum: 4,\n gold: 3,\n silver: 2,\n bronze: 1,\n none: 0,\n };\n return map[tier] ?? 0;\n}\n","/*\n Simple logger for SDK\n * Can be disabled in production builds\n /\n\n/\n Log level type\n /\nexport type LogLevel = 'debug' \| 'info' \| 'warn' \| 'error' \| 'none';\n\n/\n Logger context type\n /\nexport type LogContext = Record<string, unknown>;\n\n/\n Logger interface\n /\nexport interface Logger {\n debug: (contextOrMessage: string \| LogContext, message?: string) => void;\n info: (contextOrMessage: string \| LogContext, message?: string) => void;\n warn: (contextOrMessage: string \| LogContext, message?: string) => void;\n error: (contextOrMessage: string \| LogContext, message?: string) => void;\n}\n\nlet logLevel: LogLevel = 'none';\n\n/\n Set the global log level\n * @param level - Log level to set\n /\nexport function setLogLevel(level: LogLevel): void {\n logLevel = level;\n}\n\n/\n Get the current log level\n * @returns Current log level\n /\nexport function getLogLevel(): LogLevel {\n return logLevel;\n}\n\n/\n Create a namespaced logger\n * @param namespace - Logger namespace\n * @returns Logger instance\n /\nexport function createLogger(namespace: string): Logger {\n const shouldLog = (level: Exclude<LogLevel, 'none'>): boolean => {\n if (logLevel === 'none') return false;\n\n const levels: Exclude<LogLevel, 'none'>[] = ['debug', 'info', 'warn', 'error'];\n const currentLevelIndex = levels.indexOf(logLevel as Exclude<LogLevel, 'none'>);\n const messageLevelIndex = levels.indexOf(level);\n\n return messageLevelIndex >= currentLevelIndex;\n };\n\n const formatMessage = (msg: string): string => `[${namespace}] ${msg}`;\n\n return {\n debug: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('debug')) {\n if (typeof contextOrMessage === 'string') {\n console.debug(formatMessage(contextOrMessage));\n } else {\n console.debug(formatMessage(message ?? 'Debug'), contextOrMessage);\n }\n }\n },\n info: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('info')) {\n if (typeof contextOrMessage === 'string') {\n console.info(formatMessage(contextOrMessage));\n } else {\n console.info(formatMessage(message ?? 'Info'), contextOrMessage);\n }\n }\n },\n warn: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('warn')) {\n if (typeof contextOrMessage === 'string') {\n console.warn(formatMessage(contextOrMessage));\n } else {\n console.warn(formatMessage(message ?? 'Warning'), contextOrMessage);\n }\n }\n },\n error: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('error')) {\n if (typeof contextOrMessage === 'string') {\n console.error(formatMessage(contextOrMessage));\n } else {\n console.error(formatMessage(message ?? 'Error'), contextOrMessage);\n }\n }\n },\n };\n}\n\n/\n Log verification error\n * @param protocol - Identity protocol\n * @param identifier - Identity identifier\n * @param error - Error object\n * @param context - Additional context\n /\nexport function logVerificationError(\n protocol: string,\n identifier: string,\n error: Error,\n context?: LogContext\n): void {\n const logger = createLogger('identity-verification');\n logger.error(\n {\n protocol,\n identifier,\n error: error.message,\n stack: error.stack,\n ...context,\n },\n 'Verification failed'\n );\n}\n","import type { Scheme } from '../types';\n\nimport { Buffer } from 'buffer';\n\n/* A signature as base64: hex input is converted, anything else passes through. /\nexport function toBase64Maybe(sig: string): string {\n if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {\n return Buffer.from(sig, 'hex').toString('base64');\n }\n return sig;\n}\n\n/\n The scheme a signature's bytes say it is, the same rule @orangecheck/bip322\n * verifies by: 65 bytes is a BIP-137 compact signature, whatever the address,\n * and anything else is BIP-322 simple. `null` for a BIP-322 full or\n * proof-of-funds signature, which is not supported.\n /\nexport function signatureScheme(sigBase64: string): Scheme \| null {\n if (/^(ful\|pof)/.test(sigBase64)) return null;\n if (sigBase64.startsWith('smp')) return 'bip322';\n return Buffer.from(sigBase64, 'base64').length === 65 ? 'legacy' : 'bip322';\n}\n","/* How far ahead of the verifier's clock a signed issued_at may be (OC Attest SPEC §7). /\nexport const ISSUED_AHEAD_MS = 120_000;\n\nconst RFC3339 = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z\|[+-]\\d{2}:\\d{2})$/;\n\n/* An RFC 3339 date-time as epoch milliseconds, or null when it is not one. /\nexport function rfc3339Ms(value: string \| undefined): number \| null {\n if (!value \|\| !RFC3339.test(value)) return null;\n const ms = Date.parse(value);\n return Number.isNaN(ms) ? null : ms;\n}\n","/\n OrangeCheck Protocol Verification\n \n Core verification logic for BIP-322 and legacy signatures,\n * UTXO analysis, and reputation metrics computation\n /\n\nimport type { ScoringAlgorithm } from './scoring';\nimport type {\n IdentityBinding,\n Metrics,\n Network,\n Scheme,\n StatusCode,\n VerifyInput,\n VerifyOptions,\n VerifyOutcome,\n} from './types';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nimport { generateAttestationId, parseIdentities } from './canonical';\nimport { computeAllScores, computeScore } from './scoring';\nimport { createLogger } from './utils/logger';\nimport { signatureScheme, toBase64Maybe } from './utils/signature';\nimport { ISSUED_AHEAD_MS, rfc3339Ms } from './utils/time';\n\nconst log = createLogger('ocp/verify');\n\n/\n Scoring function per OCP v0 specification (SPEC.md §6)\n * Formula: score = round( ln(1 + sats_bonded) * (1 + days_unspent / 30), 2 )\n \n This produces an unbounded score that combines both sats and time.\n * Typical ranges:\n * - 10k sats, 30 days ≈ 18\n * - 100k sats, 90 days ≈ 46\n * - 1M sats, 365 days ≈ 182\n * - 100M sats, 365 days ≈ 243\n /\n/\n Export scoring functions for use in other modules\n /\nexport { computeScore, computeAllScores, type ScoringAlgorithm };\n\n/\n Input for signature verification\n /\ninterface SignatureVerifyInput {\n /* Bitcoin address /\n addr: string;\n /* Message to verify /\n msg: string;\n /* Signature (hex or base64) /\n sig: string;\n /* @deprecated Ignored: the signature's own bytes decide the scheme. /\n scheme?: Scheme;\n}\n\n/\n Verify a signature and name the scheme that verified it. The scheme comes\n * from the signature's bytes (see `signatureScheme`), never from the address\n * or a caller's hint, so a valid BIP-137 signature verifies on every address\n * it can stand for, whatever its recovery id.\n /\nasync function verifySignature({ addr, msg, sig }: SignatureVerifyInput): Promise<StatusCode> {\n const sigBase64 = toBase64Maybe(sig);\n const scheme = signatureScheme(sigBase64);\n if (!scheme) return 'sig_unsupported_script';\n\n const ok = verifyBitcoinSignature(addr, msg, sigBase64);\n log.info({ addr, ok, scheme, msgLength: msg.length }, 'Signature verification result');\n if (!ok) return 'sig_invalid';\n return scheme === 'legacy' ? 'sig_ok_legacy' : 'sig_ok_bip322';\n}\n\n/* True when `sig` is a valid signature by `addr` over `msg`; no chain lookup. /\nexport async function signatureIsValid(input: SignatureVerifyInput): Promise<boolean> {\n try {\n const code = await verifySignature(input);\n return code === 'sig_ok_bip322' \|\| code === 'sig_ok_legacy';\n } catch {\n return false;\n }\n}\n\n// Canonical message parsing per SPEC + our builder (lowercase keys, extensions)\nexport function parseCanonicalMessage(msg: string) {\n const lines = msg.split('\\n').map((l) => l.trim());\n // `.split(':', 2)[1]` truncates values containing a colon (e.g. URLs in\n // extensions, or npubs in identities). Use the first colon as the\n // separator and keep everything after it — same approach as the\n // extensions loop below.\n const getVal = (prefix: string): string \| undefined => {\n const needle = prefix + ':';\n const hit = lines.find((l) => l.toLowerCase().startsWith(needle));\n if (!hit) return undefined;\n const idx = hit.indexOf(':');\n return hit.slice(idx + 1).trim();\n };\n\n const address = getVal('address') \|\| '';\n const identitiesStr = getVal('identities') \|\| '';\n const issued_at = getVal('issued_at') \|\| '';\n // Present but empty is kept as '', so a reader can refuse it rather than skip it.\n const expires = getVal('expires');\n\n // Parse identities\n let identities: IdentityBinding[] = [];\n try {\n identities = parseIdentities(identitiesStr);\n } catch (err) {\n log.warn({ identitiesStr, error: err }, 'Failed to parse identities field');\n }\n\n // Extensions: collect all key: value pairs excluding core known keys\n const coreKeys = new Set([\n 'orangecheck',\n 'identities',\n 'address',\n 'purpose',\n 'nonce',\n 'issued_at',\n 'ack',\n ]);\n const extensions: Record<string, string> = {};\n for (const line of lines) {\n const idx = line.indexOf(':');\n if (idx === -1) continue;\n const key = line.slice(0, idx).trim().toLowerCase();\n const val = line.slice(idx + 1).trim();\n if (!coreKeys.has(key) && val) extensions[key] = val;\n }\n\n const network = (extensions['network'] \|\| 'mainnet') as Network;\n\n // Parse bond extension if present (integer satoshis)\n const bondStr = extensions['bond'];\n const bond = bondStr ? parseInt(bondStr, 10) : undefined;\n\n return {\n core: { address, identities, issued_at },\n expires,\n network,\n extensions,\n bond: bond !== undefined && !isNaN(bond) && bond > 0 ? bond : undefined,\n };\n}\n\n/\n UTXO type from Esplora API\n /\ninterface EsploraUtxo {\n /* Transaction ID /\n txid: string;\n /* Output index /\n vout: number;\n /* Value in satoshis /\n value: number;\n /* Confirmation status /\n status: {\n /* Whether UTXO is confirmed /\n confirmed: boolean;\n /* Block height (if confirmed) /\n block_height?: number;\n /* Block timestamp (if confirmed) /\n block_time?: number;\n };\n}\n\n/\n Fetch UTXOs for an address from Esplora API\n \n Tries multiple endpoints in order with automatic fallback\n \n @param address - Bitcoin address\n * @param network - Bitcoin network\n * @param opts - Optional custom Esplora endpoints\n * @returns Array of UTXOs\n * @throws {Error} If all endpoints fail\n /\nasync function getAddressUtxos(\n address: string,\n network: Network,\n opts?: {\n esploraMainnetBase?: string;\n esploraSignetBase?: string;\n esploraTestnetBase?: string;\n }\n): Promise<EsploraUtxo[]> {\n // Define primary and fallback endpoints\n const endpoints =\n network === 'signet'\n ? [\n opts?.esploraSignetBase \|\| 'https://mempool.space/signet/api',\n 'https://blockstream.info/signet/api',\n ]\n : network === 'testnet'\n ? [\n opts?.esploraTestnetBase \|\| 'https://mempool.space/testnet/api',\n 'https://blockstream.info/testnet/api',\n ]\n : [\n opts?.esploraMainnetBase \|\| 'https://mempool.space/api',\n 'https://blockstream.info/api',\n ];\n\n let lastError: Error \| null = null;\n\n // Try each endpoint in order. Per-endpoint timeout kept tight (5s) so\n // a slow upstream doesn't stack against the next one; callers who want\n // a hard overall deadline should wrap this call with their own timeout.\n for (const base of endpoints) {\n try {\n const url = `${base}/address/${address}/utxo`;\n log.debug({ url, network }, 'Fetching UTXOs');\n\n const resp = await fetch(url, {\n method: 'GET',\n headers: { Accept: 'application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (!resp.ok) {\n throw new Error(`HTTP ${resp.status}`);\n }\n\n const data = await resp.json();\n\n // Validate response structure\n if (!Array.isArray(data)) {\n throw new Error('Invalid response: expected array');\n }\n\n // Validate each UTXO has required fields\n for (const utxo of data) {\n if (\n typeof utxo.value !== 'number' \|\|\n typeof utxo.status !== 'object' \|\|\n typeof utxo.status.confirmed !== 'boolean' \|\|\n typeof utxo.txid !== 'string' \|\|\n typeof utxo.vout !== 'number'\n ) {\n throw new Error('Invalid UTXO structure');\n }\n }\n\n log.info({ base, count: data.length, network }, 'UTXOs fetched successfully');\n return data as EsploraUtxo[];\n } catch (err) {\n lastError = err instanceof Error ? err : new Error(String(err));\n log.warn(\n { base, error: lastError.message, network },\n 'Esplora endpoint failed, trying next'\n );\n }\n }\n\n // All endpoints failed\n log.error({ endpoints, error: lastError?.message, network }, 'All Esplora endpoints failed');\n throw new Error(`esplora_all_failed: ${lastError?.message \|\| 'unknown'}`);\n}\n\n/\n Enhanced metrics computation per SPEC.md §5.4 and §6.1\n \n Supports bond extension with oldest-first greedy UTXO selection\n \n @param utxos - Array of UTXOs from Esplora\n * @param bondAmount - Optional bond amount (enables greedy selection)\n * @returns Computed metrics (sats_bonded, days_unspent, confirmed_balance)\n /\nfunction computeMetrics(\n utxos: EsploraUtxo[],\n bondAmount?: number,\n coverSats?: number\n): {\n /* Bonded satoshis (confirmed balance or bond amount) /\n sats_bonded: number;\n /* Days since oldest/youngest UTXO /\n days_unspent: number;\n /* Total confirmed balance /\n confirmed_balance: number;\n} {\n // Filter out unconfirmed UTXOs\n const confirmedUtxos = utxos.filter((u) => u.status.confirmed);\n if (confirmedUtxos.length === 0) {\n return { sats_bonded: 0, days_unspent: 0, confirmed_balance: 0 };\n }\n\n // Compute total confirmed balance\n const confirmed_balance = confirmedUtxos.reduce((sum, u) => sum + u.value, 0);\n\n // If bond extension is present, use oldest-first greedy algorithm\n if (bondAmount !== undefined && bondAmount > 0) {\n // Sort UTXOs by (block_height ASC, txid ASC, vout ASC) - oldest first\n const sorted = [...confirmedUtxos].sort((a, b) => {\n const heightA = a.status.block_height ?? Infinity;\n const heightB = b.status.block_height ?? Infinity;\n if (heightA !== heightB) return heightA - heightB;\n if (a.txid !== b.txid) return a.txid.localeCompare(b.txid);\n return a.vout - b.vout;\n });\n\n // Greedily select UTXOs until sum >= bond\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| 0);\n if (sum >= bondAmount) break;\n }\n\n // Age is computed from the youngest UTXO in the bonded set\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 60 * 60))\n );\n\n return {\n sats_bonded: bondAmount, // Use exactly bond amount (ignore surplus)\n days_unspent,\n confirmed_balance,\n };\n }\n\n // Default behavior (no bond extension): sum all confirmed UTXOs\n const sats_bonded = confirmed_balance;\n\n // A checker asking for an amount gets the age of the coins that make it\n // up, oldest first, not the age of whichever coin is oldest.\n if (coverSats !== undefined && coverSats > 0) {\n const sorted = [...confirmedUtxos].sort(\n (a, b) => (a.status.block_height ?? Infinity) - (b.status.block_height ?? Infinity)\n );\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| Date.now() / 1000);\n if (sum >= coverSats) break;\n }\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 * 60 * 60))\n );\n return { sats_bonded, days_unspent, confirmed_balance };\n }\n\n // Find the oldest confirmed UTXO for days_unspent\n const oldestTime = Math.min(\n ...confirmedUtxos.map((u) => u.status.block_time \|\| Date.now() / 1000)\n );\n const days_unspent = Math.max(0, Math.floor((Date.now() / 1000 - oldestTime) / (24 * 60 * 60)));\n\n return { sats_bonded, days_unspent, confirmed_balance };\n}\n\n/*\n Verify an OrangeCheck attestation\n \n This is the main verification function that:\n * 1. Validates the canonical message format\n * 2. Verifies the Bitcoin signature (BIP-322 or legacy)\n * 3. Fetches and analyzes UTXOs\n * 4. Computes reputation metrics\n \n @param input - Verification input (message, address, signature)\n * @param opts - Optional verification options (test mode, audience, esplora bases)\n * @returns Verification outcome with status codes and metrics\n \n @example\n * ```typescript\n * const result = await verify({\n * msg: canonicalMessage,\n * addr: 'bc1q...',\n * sig: 'AkcwRAIg...',\n * });\n \n if (result.ok) {\n * console.log('Score:', result.metrics?.score);\n * }\n * ```\n */\nexport async function verify(input: VerifyInput, opts: VerifyOptions = {}): Promise<VerifyOutcome> {\n const codes: StatusCode[] = [];\n let network: Network = 'mainnet';\n\n try {\n // Check if we have required fields\n if (!input.msg \|\| !input.addr \|\| !input.sig) {\n codes.push('bad_request');\n return { ok: false, codes, network };\n }\n\n // Parse canonical message with extensions\n const parsed = parseCanonicalMessage(input.msg);\n network = parsed.network \|\| 'mainnet';\n\n // Compute attestation ID\n const attestation_id = await generateAttestationId(input.msg);\n\n // Validate address consistency\n if (parsed.core.address !== input.addr) {\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Testnet/Signet policy enforcement\n if ((network === 'testnet' \|\| network === 'signet') && !opts.testMode) {\n codes.push('network_testmode');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Optional policy checks for extensions.\n // `aud` binds the attestation to an origin. If the caller passed\n // `expectedAud`, the check must be load-bearing — a mismatch is a\n // phishing signal, not an advisory. Fail hard (spec-aligned).\n if (opts.expectedAud) {\n const aud = parsed.extensions['aud'];\n if (!aud \|\| aud !== opts.expectedAud) {\n codes.push('aud_mismatch');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // The signed issue time is an RFC 3339 time (SPEC §7.1.g) and not ahead\n // of this clock by more than the allowed skew.\n const issued = rfc3339Ms(parsed.core.issued_at);\n if (issued === null) {\n codes.push('decode_error');\n return { ok: false, codes, network, attestation_id };\n }\n if (issued > Date.now() + ISSUED_AHEAD_MS) {\n codes.push('not_yet_valid');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Check message expiration. An expiry that is not an RFC 3339 time is\n // refused as expired: nothing shows it lies ahead.\n if (parsed.expires !== undefined) {\n const exp = rfc3339Ms(parsed.expires);\n if (exp === null \|\| exp < Date.now()) {\n codes.push('expired');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // Enhanced signature verification\n const sigCode = await verifySignature({\n addr: input.addr,\n msg: input.msg,\n sig: input.sig,\n ...(input.scheme && { scheme: input.scheme }),\n });\n codes.push(sigCode);\n\n const sigOk = sigCode === 'sig_ok_bip322' \|\| sigCode === 'sig_ok_legacy';\n if (!sigOk) {\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n\n // Enhanced UTXO analysis and metrics computation\n try {\n const utxos = await getAddressUtxos(input.addr, network, {\n esploraMainnetBase: opts.esploraMainnetBase,\n esploraSignetBase: opts.esploraSignetBase,\n });\n\n // Compute metrics with bond extension support (SPEC.md §5.4)\n const { sats_bonded, days_unspent, confirmed_balance } = computeMetrics(\n utxos,\n parsed.bond,\n opts.coverSats\n );\n\n // If bond extension is present, enforce minimum balance (SPEC.md §5.4.c)\n if (parsed.bond !== undefined && parsed.bond > 0) {\n if (confirmed_balance < parsed.bond) {\n codes.push('bond_insufficient');\n log.warn(\n {\n bond: parsed.bond,\n confirmed_balance,\n address: input.addr,\n },\n 'Bond extension: insufficient balance'\n );\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n }\n\n // Analyze bond status\n if (sats_bonded <= 0) {\n codes.push('bond_zero');\n // Check for pending UTXOs\n if (utxos.some((u) => !u.status.confirmed)) {\n codes.push('bond_pending');\n }\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n } else {\n codes.push('bond_confirmed');\n }\n\n // Compute final metrics with enhanced scoring\n const metrics: Metrics = {\n sats_bonded,\n days_unspent,\n score: (computeScore(sats_bonded, days_unspent, { algorithm: 'v0' }) as number),\n };\n\n return {\n ok: true,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n metrics,\n };\n } catch (utxoError) {\n log.error({ err: utxoError }, 'UTXO fetch failed');\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n } catch (e: unknown) {\n const msg = e instanceof Error ? e.message : String(e ?? 'decode_error');\n if (msg === 'decode_error') {\n codes.push('decode_error');\n } else {\n codes.push('bad_request');\n }\n return { ok: false, codes, network };\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/canonical.ts","../src/scoring.ts","../src/utils/logger.ts","../src/utils/signature.ts","../src/utils/time.ts","../src/verify.ts"],"names":["verifyBitcoinSignature","days_unspent"],"mappings":";;;;;;AA8BA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CAClB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAChB;AAmCA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,wBAAA,GAA2B,SAAA;AAEjC,SAAS,kBAAA,CAAmB,EAAE,QAAA,EAAU,UAAA,EAAW,EAA0B;AACzE,EAAA,IAAI,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,2BAAA,EAA8B,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,uCAAA;AAAA,KAC1D;AAAA,EACJ;AACA,EAAA,IAAI,CAAC,UAAA,IAAc,wBAAA,CAAyB,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1D,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,6BAAA,EAAgC,IAAA,CAAK,SAAA,CAAU,UAAU,CAAC,CAAA,2DAAA;AAAA,KAC9D;AAAA,EACJ;AACJ;AA2BO,SAAS,gBAAgB,aAAA,EAA0C;AACtE,EAAA,IAAI,CAAC,aAAA,IAAiB,aAAA,CAAc,IAAA,OAAW,EAAA,EAAI;AAC/C,IAAA,OAAO,EAAC;AAAA,EACZ;AAIA,EAAA,IAAI,yBAAyB,IAAA,CAAK,aAAA,CAAc,QAAQ,IAAA,EAAM,EAAE,CAAC,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,0DAA0D,CAAA;AAAA,EAC9E;AAEA,EAAA,MAAM,WAAW,aAAA,CAAc,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAY;AACvD,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,eAAe,EAAA,EAAI;AACnB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,CAAE,CAAA;AAAA,IACjE;AACA,IAAA,OAAO;AAAA,MACH,UAAU,OAAA,CAAQ,SAAA,CAAU,CAAA,EAAG,UAAU,EAAE,IAAA,EAAK;AAAA,MAChD,YAAY,OAAA,CAAQ,SAAA,CAAU,UAAA,GAAa,CAAC,EAAE,IAAA;AAAK,KACvD;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACtB,IAAA,IAAI,CAAC,CAAA,CAAE,QAAA,IAAY,CAAC,EAAE,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,MAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAI,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AAAA,IAC7E;AACA,IAAA,kBAAA,CAAmB,CAAC,CAAA;AAAA,EACxB;AACA,EAAA,OAAO,QAAA;AACX;AA0EA,eAAsB,sBAAsB,OAAA,EAAkC;AAE1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAGnC,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAG7D,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AAChD;;;AC5MA,SAAS,OAAA,CAAQ,MAAc,IAAA,EAAsB;AACjD,EAAA,IAAI,IAAA,IAAQ,CAAA,IAAK,IAAA,IAAQ,CAAA,EAAG,OAAO,CAAA;AACnC,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,IAAI,CAAA,IAAK,CAAA,GAAI,IAAA,GAAO,EAAA,CAAA,GAAM,GAAG,CAAA,GAAI,GAAA;AACpE;AAEA,SAAS,SAAA,CAAU,MAAc,IAAA,EAAoB;AACjD,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAc,IAAA,IAAQ,GAAA,EAAK,OAAO,UAAA;AAC9C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAa,IAAA,IAAQ,GAAA,EAAK,OAAO,MAAA;AAC7C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAW,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AAC1C,EAAA,IAAI,IAAA,IAAQ,GAAA,IAAU,IAAA,IAAQ,EAAA,EAAI,OAAO,QAAA;AACzC,EAAA,OAAO,MAAA;AACX;AAEO,SAAS,YAAA,CAAa,IAAA,EAAc,IAAA,EAAc,MAAA,EAAoC;AACzF,EAAA,QAAQ,OAAO,SAAA;AAAW,IACtB,KAAK,IAAA;AACD,MAAA,OAAO,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,IAC7B,KAAK,MAAA;AACD,MAAA,OAAO,SAAA,CAAU,MAAM,IAAI,CAAA;AAAA,IAC/B,KAAK,MAAA;AACD,MAAA,OAAO,IAAA;AAAA;AAEnB;AAEO,SAAS,gBAAA,CAAiB,MAAc,IAAA,EAAc;AACzD,EAAA,OAAO,EAAE,EAAA,EAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,GAAG,IAAA,EAAM,SAAA,CAAU,IAAA,EAAM,IAAI,CAAA,EAAE;AAClE;ACGO,SAAS,aAAa,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAA8C;AAC7D,IAAyB,OAAO,KAAA;AAMJ,EAChC,CAAA;AAEA,EAAA,MAAM,gBAAgB,CAAC,GAAA,KAAwB,CAAA,CAAA,EAAI,SAAS,KAAK,GAAG,CAAA,CAAA;AAEpE,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,MAAM,GAAG,gBAAgB,CAAA;AAAA,QACnE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,SAAS,GAAG,gBAAgB,CAAA;AAAA,QACtE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;AC9FO,SAAS,cAAc,GAAA,EAAqB;AAC/C,EAAA,IAAI,iBAAiB,IAAA,CAAK,GAAG,KAAK,GAAA,CAAI,MAAA,GAAS,MAAM,CAAA,EAAG;AACpD,IAAA,OAAO,OAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,gBAAgB,SAAA,EAAkC;AAC9D,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,SAAS,CAAA,EAAG,OAAO,IAAA;AACzC,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,QAAA;AACxC,EAAA,OAAO,OAAO,IAAA,CAAK,SAAA,EAAW,QAAQ,CAAA,CAAE,MAAA,KAAW,KAAK,QAAA,GAAW,QAAA;AACvE;;;ACrBO,IAAM,eAAA,GAAkB,IAAA;AAE/B,IAAM,OAAA,GAAU,sEAAA;AAGT,SAAS,UAAU,KAAA,EAA0C;AAChE,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAQ,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC3C,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC3B,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA,GAAI,IAAA,GAAO,EAAA;AACrC;;;ACiBA,IAAM,GAAA,GAAM,aAAa,YAAY,CAAA;AAsCrC,eAAe,eAAA,CAAgB,EAAE,IAAA,EAAM,GAAA,EAAK,KAAI,EAA8C;AAC1F,EAAA,MAAM,SAAA,GAAY,cAAc,GAAG,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,gBAAgB,SAAS,CAAA;AACxC,EAAA,IAAI,CAAC,QAAQ,OAAO,wBAAA;AAEpB,EAAA,MAAM,EAAA,GAAKA,iBAAA,CAAuB,IAAA,EAAM,GAAA,EAAK,SAAS,CAAA;AACtD,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,EAAA,EAAI,QAAQ,SAAA,EAAW,GAAA,CAAI,MAAA,EAAO,EAAG,+BAA+B,CAAA;AACrF,EAAA,IAAI,CAAC,IAAI,OAAO,aAAA;AAChB,EAAA,OAAO,MAAA,KAAW,WAAW,eAAA,GAAkB,eAAA;AACnD;AAGA,eAAsB,iBAAiB,KAAA,EAA+C;AAClF,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,MAAM,eAAA,CAAgB,KAAK,CAAA;AACxC,IAAA,OAAO,IAAA,KAAS,mBAAmB,IAAA,KAAS,eAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAGO,SAAS,sBAAsB,GAAA,EAAa;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAKjD,EAAA,MAAM,MAAA,GAAS,CAAC,MAAA,KAAuC;AACnD,IAAA,MAAM,SAAS,MAAA,GAAS,GAAA;AACxB,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,EAAE,WAAA,EAAY,CAAE,UAAA,CAAW,MAAM,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,KAAK,OAAO,MAAA;AACjB,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,SAAS,CAAA,IAAK,EAAA;AACrC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,YAAY,CAAA,IAAK,EAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,WAAW,CAAA,IAAK,EAAA;AAEzC,EAAA,MAAM,OAAA,GAAU,OAAO,SAAS,CAAA;AAGhC,EAAA,IAAI,aAAgC,EAAC;AACrC,EAAA,IAAI;AACA,IAAA,UAAA,GAAa,gBAAgB,aAAa,CAAA;AAAA,EAC9C,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAK,EAAE,aAAA,EAAe,KAAA,EAAO,GAAA,IAAO,kCAAkC,CAAA;AAAA,EAC9E;AAGA,EAAA,MAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,IACrB,aAAA;AAAA,IACA,YAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACH,CAAA;AACD,EAAA,MAAM,aAAqC,EAAC;AAE5C,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AAClD,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACrC,IAAA,IAAI,KAAK,GAAA,CAAI,GAAG,CAAA,EAAG,QAAA,CAAS,KAAK,GAAG,CAAA;AACpC,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,IAAI,CAAC,SAAS,GAAA,CAAI,GAAG,KAAK,GAAA,EAAK,UAAA,CAAW,GAAG,CAAA,GAAI,GAAA;AAAA,EACrD;AAEA,EAAA,MAAM,OAAA,GAAW,UAAA,CAAW,SAAS,CAAA,IAAK,SAAA;AAG1C,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,OAAA,GAAU,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA,GAAI,MAAA;AAE/C,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,EAAE,OAAA,EAAS,UAAA,EAAY,SAAA,EAAU;AAAA,IACvC,OAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,IAAA,EAAM,SAAS,MAAA,IAAa,CAAC,MAAM,IAAI,CAAA,IAAK,IAAA,GAAO,CAAA,GAAI,IAAA,GAAO;AAAA,GAClE;AACJ;AAkCA,eAAe,eAAA,CACX,OAAA,EACA,OAAA,EACA,IAAA,EAKsB;AAEtB,EAAA,MAAM,SAAA,GACF,YAAY,QAAA,GACN;AAAA,IACI,MAAM,iBAAA,IAAqB,kCAAA;AAAA,IAC3B;AAAA,GACJ,GACA,YAAY,SAAA,GACV;AAAA,IACI,MAAM,kBAAA,IAAsB,mCAAA;AAAA,IAC5B;AAAA,GACJ,GACA;AAAA,IACI,MAAM,kBAAA,IAAsB,2BAAA;AAAA,IAC5B;AAAA,GACJ;AAEZ,EAAA,IAAI,SAAA,GAA0B,IAAA;AAK9B,EAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC1B,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,SAAA,EAAY,OAAO,CAAA,KAAA,CAAA;AACtC,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,OAAA,IAAW,gBAAgB,CAAA;AAE5C,MAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAC1B,MAAA,EAAQ,KAAA;AAAA,QACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACnC,CAAA;AAED,MAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,MACzC;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,EAAK;AAG7B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,MACtD;AAGA,MAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACrB,QAAA,IACI,OAAO,KAAK,KAAA,KAAU,QAAA,IACtB,OAAO,IAAA,CAAK,MAAA,KAAW,YACvB,OAAO,IAAA,CAAK,OAAO,SAAA,KAAc,SAAA,IACjC,OAAO,IAAA,CAAK,IAAA,KAAS,YACrB,OAAO,IAAA,CAAK,SAAS,QAAA,EACvB;AACE,UAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,QAC5C;AAAA,MACJ;AAEA,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,MAAA,EAAQ,OAAA,IAAW,4BAA4B,CAAA;AAC5E,MAAA,OAAO,IAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,SAAA,GAAY,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC9D,MAAA,GAAA,CAAI,IAAA;AAAA,QACA,EAAE,IAAA,EAAM,KAAA,EAAO,SAAA,CAAU,SAAS,OAAA,EAAQ;AAAA,QAC1C;AAAA,OACJ;AAAA,IACJ;AAAA,EACJ;AAGA,EAAA,GAAA,CAAI,KAAA,CAAM,EAAE,SAAA,EAAW,KAAA,EAAO,WAAW,OAAA,EAAS,OAAA,IAAW,8BAA8B,CAAA;AAC3F,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,SAAA,EAAW,OAAA,IAAW,SAAS,CAAA,CAAE,CAAA;AAC5E;AAWA,SAAS,cAAA,CACL,KAAA,EACA,UAAA,EACA,SAAA,EAQF;AAEE,EAAA,MAAM,iBAAiB,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,SAAS,CAAA;AAC7D,EAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,EAAE,WAAA,EAAa,CAAA,EAAG,YAAA,EAAc,CAAA,EAAG,mBAAmB,CAAA,EAAE;AAAA,EACnE;AAGA,EAAA,MAAM,iBAAA,GAAoB,eAAe,MAAA,CAAO,CAAC,KAAK,CAAA,KAAM,GAAA,GAAM,CAAA,CAAE,KAAA,EAAO,CAAC,CAAA;AAG5E,EAAA,IAAI,UAAA,KAAe,MAAA,IAAa,UAAA,GAAa,CAAA,EAAG;AAE5C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,EAAE,IAAA,CAAK,CAAC,GAAG,CAAA,KAAM;AAC9C,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AACzC,MAAA,IAAI,OAAA,KAAY,OAAA,EAAS,OAAO,OAAA,GAAU,OAAA;AAC1C,MAAA,IAAI,CAAA,CAAE,SAAS,CAAA,CAAE,IAAA,SAAa,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA;AACzD,MAAA,OAAO,CAAA,CAAE,OAAO,CAAA,CAAE,IAAA;AAAA,IACtB,CAAC,CAAA;AAGD,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,KAAK,GAAA,CAAI,YAAA,EAAc,IAAA,CAAK,MAAA,CAAO,cAAc,CAAC,CAAA;AACjE,MAAA,IAAI,OAAO,UAAA,EAAY;AAAA,IAC3B;AAGA,IAAA,MAAMC,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AAEA,IAAA,OAAO;AAAA,MACH,WAAA,EAAa,UAAA;AAAA;AAAA,MACb,YAAA,EAAAA,aAAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAGA,EAAA,MAAM,WAAA,GAAc,iBAAA;AAIpB,EAAA,IAAI,SAAA,KAAc,MAAA,IAAa,SAAA,GAAY,CAAA,EAAG;AAC1C,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,cAAc,CAAA,CAAE,IAAA;AAAA,MAC/B,CAAC,GAAG,CAAA,KAAA,CAAO,CAAA,CAAE,OAAO,YAAA,IAAgB,QAAA,KAAa,CAAA,CAAE,MAAA,CAAO,YAAA,IAAgB,QAAA;AAAA,KAC9E;AACA,IAAA,IAAI,GAAA,GAAM,CAAA;AACV,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACvB,MAAA,GAAA,IAAO,IAAA,CAAK,KAAA;AACZ,MAAA,YAAA,GAAe,IAAA,CAAK,IAAI,YAAA,EAAc,IAAA,CAAK,OAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA;AACjF,MAAA,IAAI,OAAO,SAAA,EAAW;AAAA,IAC1B;AACA,IAAA,MAAMA,gBAAe,IAAA,CAAK,GAAA;AAAA,MACtB,CAAA;AAAA,MACA,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,GAAA,GAAO,YAAA,KAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,CAAG;AAAA,KAClE;AACA,IAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAAA,aAAAA,EAAc,iBAAA,EAAkB;AAAA,EAC1D;AAGA,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA;AAAA,IACpB,GAAG,cAAA,CAAe,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,CAAO,UAAA,IAAc,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI;AAAA,GACzE;AACA,EAAA,MAAM,YAAA,GAAe,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAA,CAAO,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA,GAAO,UAAA,KAAe,EAAA,GAAK,EAAA,GAAK,GAAG,CAAC,CAAA;AAE9F,EAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB;AAC1D;AA4BA,eAAsB,MAAA,CAAO,KAAA,EAAoB,IAAA,GAAsB,EAAC,EAA2B;AAC/F,EAAA,MAAM,QAAsB,EAAC;AAC7B,EAAA,IAAI,OAAA,GAAmB,SAAA;AAEvB,EAAA,IAAI;AAEA,IAAA,IAAI,CAAC,MAAM,GAAA,IAAO,CAAC,MAAM,IAAA,IAAQ,CAAC,MAAM,GAAA,EAAK;AACzC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,IACvC;AAGA,IAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAC9C,IAAA,OAAA,GAAU,OAAO,OAAA,IAAW,SAAA;AAG5B,IAAA,MAAM,cAAA,GAAiB,MAAM,qBAAA,CAAsB,KAAA,CAAM,GAAG,CAAA;AAG5D,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAGA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,OAAA,KAAY,KAAA,CAAM,IAAA,EAAM;AACpC,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAGA,IAAA,IAAA,CAAK,YAAY,SAAA,IAAa,OAAA,KAAY,QAAA,KAAa,CAAC,KAAK,QAAA,EAAU;AACnE,MAAA,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAC7B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAMA,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AACnC,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,KAAQ,IAAA,CAAK,WAAA,EAAa;AAClC,QAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAIA,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AAC9C,IAAA,IAAI,WAAW,IAAA,EAAM;AACjB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AACA,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI,GAAI,eAAA,EAAiB;AACvC,MAAA,KAAA,CAAM,KAAK,eAAe,CAAA;AAC1B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAIA,IAAA,IAAI,MAAA,CAAO,YAAY,KAAA,CAAA,EAAW;AAC9B,MAAA,MAAM,GAAA,GAAM,SAAA,CAAU,MAAA,CAAO,OAAO,CAAA;AACpC,MAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,GAAM,IAAA,CAAK,KAAI,EAAG;AAClC,QAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AACpB,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,MACvD;AAAA,IACJ;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,eAAA,CAAgB;AAAA,MAClC,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,KAAK,KAAA,CAAM,GAAA;AAAA,MACX,GAAI,KAAA,CAAM,MAAA,IAAU,EAAE,MAAA,EAAQ,MAAM,MAAA;AAAO,KAC9C,CAAA;AACD,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAElB,IAAA,MAAM,KAAA,GAAQ,OAAA,KAAY,eAAA,IAAmB,OAAA,KAAY,eAAA;AACzD,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,OAC5B;AAAA,IACJ;AAGA,IAAA,IAAI;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,eAAA,CAAgB,KAAA,CAAM,MAAM,OAAA,EAAS;AAAA,QACrD,oBAAoB,IAAA,CAAK,kBAAA;AAAA,QACzB,mBAAmB,IAAA,CAAK;AAAA,OAC3B,CAAA;AAGD,MAAA,MAAM,EAAE,WAAA,EAAa,YAAA,EAAc,iBAAA,EAAkB,GAAI,cAAA;AAAA,QACrD,KAAA;AAAA,QACA,MAAA,CAAO,IAAA;AAAA,QACP,IAAA,CAAK;AAAA,OACT;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,KAAS,KAAA,CAAA,IAAa,MAAA,CAAO,OAAO,CAAA,EAAG;AAC9C,QAAA,IAAI,iBAAA,GAAoB,OAAO,IAAA,EAAM;AACjC,UAAA,KAAA,CAAM,KAAK,mBAAmB,CAAA;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACA;AAAA,cACI,MAAM,MAAA,CAAO,IAAA;AAAA,cACb,iBAAA;AAAA,cACA,SAAS,KAAA,CAAM;AAAA,aACnB;AAAA,YACA;AAAA,WACJ;AACA,UAAA,OAAO;AAAA,YACH,EAAA,EAAI,KAAA;AAAA,YACJ,KAAA;AAAA,YACA,OAAA;AAAA,YACA,cAAA;AAAA,YACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,WAC5B;AAAA,QACJ;AAAA,MACJ;AAGA,MAAA,IAAI,eAAe,CAAA,EAAG;AAClB,QAAA,KAAA,CAAM,KAAK,WAAW,CAAA;AAEtB,QAAA,IAAI,KAAA,CAAM,KAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,EAAG;AACxC,UAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,QAC7B;AACA,QAAA,OAAO;AAAA,UACH,EAAA,EAAI,KAAA;AAAA,UACJ,KAAA;AAAA,UACA,OAAA;AAAA,UACA,cAAA;AAAA,UACA,UAAA,EAAY,OAAO,IAAA,CAAK;AAAA,SAC5B;AAAA,MACJ,CAAA,MAAO;AACH,QAAA,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAAA,MAC/B;AAGA,MAAA,MAAM,OAAA,GAAmB;AAAA,QACrB,WAAA;AAAA,QACA,YAAA;AAAA,QACA,OAAQ,YAAA,CAAa,WAAA,EAAa,cAAc,EAAE,SAAA,EAAW,MAAM;AAAA,OACvE;AAEA,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,IAAA;AAAA,QACJ,KAAA;AAAA,QACA,OAAA;AAAA,QACA,cAAA;AAAA,QACA,UAAA,EAAY,OAAO,IAAA,CAAK,UAAA;AAAA,QACxB;AAAA,OACJ;AAAA,IACJ,SAAS,SAAA,EAAW;AAChB,MAAA,GAAA,CAAI,KAAA,CAAM,EAAE,GAAA,EAAK,SAAA,IAAa,mBAAmB,CAAA;AACjD,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AACxB,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,SAAS,cAAA,EAAe;AAAA,IACvD;AAAA,EACJ,SAAS,CAAA,EAAY;AACjB,IAAA,MAAM,MAAM,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,KAAK,cAAc,CAAA;AACvE,IAAA,IAAI,QAAQ,cAAA,EAAgB;AACxB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AAAA,IAC7B,CAAA,MAAO;AACH,MAAA,KAAA,CAAM,KAAK,aAAa,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,EACvC;AACJ","file":"verify.mjs","sourcesContent":["/*\n Canonical message builder per SPEC.md §2\n \n - LF line endings, exactly one trailing LF\n * - 7 fixed core lines in strict order and wording\n * - Optional extensions appended as key: value with lexicographically sorted lowercase keys\n /\n\nimport type { AttestationEnvelope, IdentityBinding, Scheme } from './types';\n\n/\n Input for building a canonical message\n /\nexport interface CanonicalInput {\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n}\n\n/\n Extension key-value pairs for canonical message\n /\nexport type Extensions = Record<string, string \| undefined>;\n\n/\n Convert bytes to lowercase hex string\n * @param bytes - Byte array to convert\n * @returns Lowercase hex string\n /\nfunction toLowerHex(bytes: Uint8Array): string {\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n}\n\n/\n Generate a random 16-byte nonce as lowercase hex\n * Uses Web Crypto API when available, falls back to Math.random()\n * @returns 32-character lowercase hex string\n /\nexport function randomNonce16BHexLower(): string {\n const arr = new Uint8Array(16);\n\n try {\n if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {\n crypto.getRandomValues(arr);\n return toLowerHex(arr);\n }\n } catch {\n // Fall through to non-cryptographic fallback\n }\n\n // No silent Math.random fallback: a nonce is a load-bearing security\n // primitive. A deployment without `crypto.getRandomValues` MUST fix its\n // environment rather than sign with weak randomness.\n throw new Error('crypto.getRandomValues unavailable — refusing to mint a weak nonce');\n}\n\n/\n Reject characters that would break the line-oriented canonical grammar\n * or the comma-separated identities list. If any of these slipped through,\n * an attacker could smuggle a forged `address:` or extension line into the\n * signed payload: `identities: alice\\naddress: bc1qEVIL…` would parse as a\n * second address line. Catch it at the boundary, not at verification time.\n \n Also rejects a colon in the identifier so a bad actor can't turn\n * `github:alice:extra` into a different protocol binding on parse.\n /\nconst IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]$/;\nconst IDENTITY_FORBIDDEN_CHARS = /[\\r\\n,]/;\n\nfunction assertSafeIdentity({ protocol, identifier }: IdentityBinding): void {\n if (!IDENTITY_PROTOCOL_RE.test(protocol)) {\n throw new Error(\n `invalid identity protocol: ${JSON.stringify(protocol)} — must match /^[a-z][a-z0-9_-]$/`\n );\n }\n if (!identifier \|\| IDENTITY_FORBIDDEN_CHARS.test(identifier)) {\n throw new Error(\n `invalid identity identifier: ${JSON.stringify(identifier)} — must be non-empty and contain no newlines or commas`\n );\n }\n}\n\n/\n Format identities as comma-separated protocol:identifier pairs, sorted lexicographically\n * @param identities - Array of identity bindings\n * @returns Comma-separated string of protocol:identifier pairs\n /\nexport function formatIdentities(identities: IdentityBinding[] = []): string {\n if (identities.length === 0) {\n return '';\n }\n for (const id of identities) assertSafeIdentity(id);\n\n // Format as protocol:identifier and sort lexicographically\n const formatted = identities\n .map(({ protocol, identifier }) => `${protocol}:${identifier}`)\n .sort();\n\n return formatted.join(',');\n}\n\n/\n Parse identities from comma-separated protocol:identifier format\n * @param identitiesStr - Comma-separated identity string\n * @returns Array of identity bindings\n * @throws {Error} If identity format is invalid\n /\nexport function parseIdentities(identitiesStr: string): IdentityBinding[] {\n if (!identitiesStr \|\| identitiesStr.trim() === '') {\n return [];\n }\n // The identities field lives on one line of the canonical message. If it\n // contains a raw LF/CR, it's either corrupt or an attempt to smuggle a\n // fake core line into the parser. Refuse instead of trying to recover.\n if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ''))) {\n throw new Error('identities field contains forbidden characters (newline)');\n }\n\n const bindings = identitiesStr.split(',').map((binding) => {\n const colonIndex = binding.indexOf(':');\n if (colonIndex === -1) {\n throw new Error(`Invalid identity binding format: ${binding}`);\n }\n return {\n protocol: binding.substring(0, colonIndex).trim(),\n identifier: binding.substring(colonIndex + 1).trim(),\n };\n });\n\n for (const b of bindings) {\n if (!b.protocol \|\| !b.identifier) {\n throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);\n }\n assertSafeIdentity(b);\n }\n return bindings;\n}\n\n/\n Optional deterministic overrides for message building. Only intended for\n * tests / conformance vectors; production callers should let the builder\n * mint a fresh nonce + timestamp per message.\n /\nexport interface BuildOptions {\n /* 32-char lowercase hex. Default: freshly-generated cryptographic nonce. /\n nonce?: string;\n /* RFC-3339 UTC. Default: `new Date().toISOString()`. /\n issuedAt?: string;\n}\n\n/\n Build a canonical message following OrangeCheck Protocol v0 specification\n * @param input - Canonical input with address and identities\n * @param extensions - Optional extension key-value pairs\n * @param options - Optional deterministic overrides (testing only)\n * @returns Canonical message string with LF line endings\n /\nexport function buildCanonicalMessage(\n { address, identities }: CanonicalInput,\n extensions: Extensions = {},\n options: BuildOptions = {}\n): string {\n const nonce = options.nonce ?? randomNonce16BHexLower();\n if (!/^[0-9a-f]{32}$/.test(nonce)) {\n throw new Error(`invalid nonce: must be 32 lowercase hex chars`);\n }\n const issuedAt = options.issuedAt ?? new Date().toISOString();\n\n // Format identities\n const identitiesStr = formatIdentities(identities);\n\n // Core (strict wording + order per SPEC.md §2)\n const core = [\n 'orangecheck',\n `identities: ${identitiesStr}`,\n `address: ${address}`,\n 'purpose: portable reputation attestation (non-custodial)',\n `nonce: ${nonce}`,\n `issued_at: ${issuedAt}`,\n 'ack: I attest control of this address and bind it to my identities.',\n ];\n\n // Normalize and sort extensions\n const normExt: Record<string, string> = {};\n for (const [k, v] of Object.entries(extensions)) {\n if (v == null \|\| v === '') {\n continue;\n }\n const key = k.toLowerCase();\n normExt[key] = String(v);\n }\n\n const extLines = Object.keys(normExt)\n .sort()\n .map((k) => `${k}: ${normExt[k]!}`);\n\n const all = [...core, ...extLines];\n\n // Join with LF and ensure exactly one trailing LF\n return all.join('\\n') + '\\n';\n}\n\n/\n Generate attestation ID from canonical message\n \n attestation_id = SHA-256(canonical_message)\n \n @param message - Canonical message string\n * @returns Lowercase hex SHA-256 hash\n /\nexport async function generateAttestationId(message: string): Promise<string> {\n // Convert message to UTF-8 bytes\n const encoder = new TextEncoder();\n const data = encoder.encode(message);\n\n // Compute SHA-256 hash\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n return toLowerHex(new Uint8Array(hashBuffer));\n}\n\n/\n Create an attestation envelope for publishing\n \n This wraps the canonical message with metadata for Nostr publishing\n \n @param message - Canonical message\n * @param signature - BIP-322 or legacy signature\n * @param scheme - Signature scheme used\n * @param address - Bitcoin address\n * @param identities - Identity bindings\n * @param extensions - Optional extensions\n * @returns Attestation envelope ready for publishing\n /\nexport async function createAttestationEnvelope(\n message: string,\n signature: string,\n scheme: Scheme,\n address: string,\n identities: IdentityBinding[],\n extensions: Extensions = {}\n): Promise<AttestationEnvelope> {\n const attestation_id = await generateAttestationId(message);\n\n // Extract issued_at from message\n const issuedAtMatch = message.match(/issued_at: ([^\\n]+)/);\n const issued_at = issuedAtMatch?.[1] ?? new Date().toISOString();\n\n // Extract expires from extensions if present\n const expires_at = extensions.expires;\n\n // Extract relay hints from extensions if present\n const relay_hints = extensions.relay_hints?.split(',').map((r) => r.trim());\n\n // Extract publish targets from extensions if present\n const publish_targets = extensions.publish?.split(',').map((t) => t.trim());\n\n // Base64url encode the message\n const encoder = new TextEncoder();\n const messageBytes = encoder.encode(message);\n const base64 = btoa(String.fromCharCode(...messageBytes));\n const message_b64url = base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n\n // Construct verification URL\n const verification_url = `https://attest.ochk.io/attest/${attestation_id}`;\n\n return {\n attestation_id,\n scheme,\n address,\n identities,\n message,\n message_b64url,\n signature,\n issued_at,\n expires_at,\n verification_url,\n publish_targets,\n relay_hints,\n };\n}\n","/\n OrangeCheck Scoring\n \n The protocol registers exactly one scoring algorithm: `v0`. A `tier` helper\n * is also provided for UI convenience. RPs with specialized needs compute\n * their own score against raw metrics — the protocol does not ship an\n * algorithm zoo.\n \n See: docs/oc-protocol/registry/scoring.md\n /\n\nexport type ScoringAlgorithm = 'v0' \| 'tier' \| 'none';\nexport type Tier = 'platinum' \| 'gold' \| 'silver' \| 'bronze' \| 'none';\nexport type ScoreResult = number \| Tier \| null;\n\nexport interface ScoringConfig {\n algorithm: ScoringAlgorithm;\n}\n\nfunction scoreV0(sats: number, days: number): number {\n if (sats <= 0 \|\| days <= 0) return 0;\n return Math.round(Math.log(1 + sats) (1 + days / 30) * 100) / 100;\n}\n\nfunction scoreTier(sats: number, days: number): Tier {\n if (sats >= 10_000_000 && days >= 365) return 'platinum';\n if (sats >= 1_000_000 && days >= 180) return 'gold';\n if (sats >= 100_000 && days >= 90) return 'silver';\n if (sats >= 10_000 && days >= 30) return 'bronze';\n return 'none';\n}\n\nexport function computeScore(sats: number, days: number, config: ScoringConfig): ScoreResult {\n switch (config.algorithm) {\n case 'v0':\n return scoreV0(sats, days);\n case 'tier':\n return scoreTier(sats, days);\n case 'none':\n return null;\n }\n}\n\nexport function computeAllScores(sats: number, days: number) {\n return { v0: scoreV0(sats, days), tier: scoreTier(sats, days) };\n}\n\nexport function formatScore(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (score === null \|\| algorithm === 'none') return 'N/A';\n if (algorithm === 'v0') return (score as number).toFixed(1);\n const tier = score as Tier;\n const labels: Record<Tier, string> = {\n platinum: 'Platinum',\n gold: 'Gold',\n silver: 'Silver',\n bronze: 'Bronze',\n none: '—',\n };\n return labels[tier];\n}\n\nexport function getScoreColor(score: ScoreResult, algorithm: ScoringAlgorithm): string {\n if (algorithm === 'tier') {\n const colors: Record<Tier, string> = {\n platinum: '#a855f7',\n gold: '#eab308',\n silver: '#94a3b8',\n bronze: '#f97316',\n none: '#64748b',\n };\n return colors[(score as Tier) ?? 'none'] ?? '#64748b';\n }\n const n = (score as number) ?? 0;\n if (n >= 100) return '#22c55e';\n if (n >= 50) return '#3b82f6';\n if (n >= 20) return '#eab308';\n return '#f97316';\n}\n\nexport function getTierNumber(tier: Tier): number {\n const map: Record<Tier, number> = {\n platinum: 4,\n gold: 3,\n silver: 2,\n bronze: 1,\n none: 0,\n };\n return map[tier] ?? 0;\n}\n","/*\n Simple logger for SDK\n * Can be disabled in production builds\n /\n\n/\n Log level type\n /\nexport type LogLevel = 'debug' \| 'info' \| 'warn' \| 'error' \| 'none';\n\n/\n Logger context type\n /\nexport type LogContext = Record<string, unknown>;\n\n/\n Logger interface\n /\nexport interface Logger {\n debug: (contextOrMessage: string \| LogContext, message?: string) => void;\n info: (contextOrMessage: string \| LogContext, message?: string) => void;\n warn: (contextOrMessage: string \| LogContext, message?: string) => void;\n error: (contextOrMessage: string \| LogContext, message?: string) => void;\n}\n\nlet logLevel: LogLevel = 'none';\n\n/\n Set the global log level\n * @param level - Log level to set\n /\nexport function setLogLevel(level: LogLevel): void {\n logLevel = level;\n}\n\n/\n Get the current log level\n * @returns Current log level\n /\nexport function getLogLevel(): LogLevel {\n return logLevel;\n}\n\n/\n Create a namespaced logger\n * @param namespace - Logger namespace\n * @returns Logger instance\n /\nexport function createLogger(namespace: string): Logger {\n const shouldLog = (level: Exclude<LogLevel, 'none'>): boolean => {\n if (logLevel === 'none') return false;\n\n const levels: Exclude<LogLevel, 'none'>[] = ['debug', 'info', 'warn', 'error'];\n const currentLevelIndex = levels.indexOf(logLevel as Exclude<LogLevel, 'none'>);\n const messageLevelIndex = levels.indexOf(level);\n\n return messageLevelIndex >= currentLevelIndex;\n };\n\n const formatMessage = (msg: string): string => `[${namespace}] ${msg}`;\n\n return {\n debug: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('debug')) {\n if (typeof contextOrMessage === 'string') {\n console.debug(formatMessage(contextOrMessage));\n } else {\n console.debug(formatMessage(message ?? 'Debug'), contextOrMessage);\n }\n }\n },\n info: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('info')) {\n if (typeof contextOrMessage === 'string') {\n console.info(formatMessage(contextOrMessage));\n } else {\n console.info(formatMessage(message ?? 'Info'), contextOrMessage);\n }\n }\n },\n warn: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('warn')) {\n if (typeof contextOrMessage === 'string') {\n console.warn(formatMessage(contextOrMessage));\n } else {\n console.warn(formatMessage(message ?? 'Warning'), contextOrMessage);\n }\n }\n },\n error: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('error')) {\n if (typeof contextOrMessage === 'string') {\n console.error(formatMessage(contextOrMessage));\n } else {\n console.error(formatMessage(message ?? 'Error'), contextOrMessage);\n }\n }\n },\n };\n}\n\n/\n Log verification error\n * @param protocol - Identity protocol\n * @param identifier - Identity identifier\n * @param error - Error object\n * @param context - Additional context\n /\nexport function logVerificationError(\n protocol: string,\n identifier: string,\n error: Error,\n context?: LogContext\n): void {\n const logger = createLogger('identity-verification');\n logger.error(\n {\n protocol,\n identifier,\n error: error.message,\n stack: error.stack,\n ...context,\n },\n 'Verification failed'\n );\n}\n","import type { Scheme } from '../types';\n\nimport { Buffer } from 'buffer';\n\n/* A signature as base64: hex input is converted, anything else passes through. /\nexport function toBase64Maybe(sig: string): string {\n if (/^[0-9a-fA-F]+$/.test(sig) && sig.length % 2 === 0) {\n return Buffer.from(sig, 'hex').toString('base64');\n }\n return sig;\n}\n\n/\n The scheme a signature's bytes say it is, the same rule @orangecheck/bip322\n * verifies by: 65 bytes is a BIP-137 compact signature, whatever the address,\n * and anything else is BIP-322 simple. `null` for a BIP-322 full or\n * proof-of-funds signature, which is not supported.\n /\nexport function signatureScheme(sigBase64: string): Scheme \| null {\n if (/^(ful\|pof)/.test(sigBase64)) return null;\n if (sigBase64.startsWith('smp')) return 'bip322';\n return Buffer.from(sigBase64, 'base64').length === 65 ? 'legacy' : 'bip322';\n}\n","/* How far ahead of the verifier's clock a signed issued_at may be (OC Attest SPEC §7). /\nexport const ISSUED_AHEAD_MS = 120_000;\n\nconst RFC3339 = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z\|[+-]\\d{2}:\\d{2})$/;\n\n/* An RFC 3339 date-time as epoch milliseconds, or null when it is not one. /\nexport function rfc3339Ms(value: string \| undefined): number \| null {\n if (!value \|\| !RFC3339.test(value)) return null;\n const ms = Date.parse(value);\n return Number.isNaN(ms) ? null : ms;\n}\n","/\n OrangeCheck Protocol Verification\n \n Core verification logic for BIP-322 and legacy signatures,\n * UTXO analysis, and reputation metrics computation\n /\n\nimport type { ScoringAlgorithm } from './scoring';\nimport type {\n IdentityBinding,\n Metrics,\n Network,\n Scheme,\n StatusCode,\n VerifyInput,\n VerifyOptions,\n VerifyOutcome,\n} from './types';\n\nimport { verifySignature as verifyBitcoinSignature } from '@orangecheck/bip322';\n\nimport { generateAttestationId, parseIdentities } from './canonical';\nimport { computeAllScores, computeScore } from './scoring';\nimport { createLogger } from './utils/logger';\nimport { signatureScheme, toBase64Maybe } from './utils/signature';\nimport { ISSUED_AHEAD_MS, rfc3339Ms } from './utils/time';\n\nconst log = createLogger('ocp/verify');\n\n/\n Scoring function per OCP v0 specification (SPEC.md §6)\n * Formula: score = round( ln(1 + sats_bonded) * (1 + days_unspent / 30), 2 )\n \n This produces an unbounded score that combines both sats and time.\n * Typical ranges:\n * - 10k sats, 30 days ≈ 18\n * - 100k sats, 90 days ≈ 46\n * - 1M sats, 365 days ≈ 182\n * - 100M sats, 365 days ≈ 243\n /\n/\n Export scoring functions for use in other modules\n /\nexport { computeScore, computeAllScores, type ScoringAlgorithm };\n\n/\n Input for signature verification\n /\ninterface SignatureVerifyInput {\n /* Bitcoin address /\n addr: string;\n /* Message to verify /\n msg: string;\n /* Signature (hex or base64) /\n sig: string;\n /* @deprecated Ignored: the signature's own bytes decide the scheme. /\n scheme?: Scheme;\n}\n\n/\n Verify a signature and name the scheme that verified it. The scheme comes\n * from the signature's bytes (see `signatureScheme`), never from the address\n * or a caller's hint, so a valid BIP-137 signature verifies on every address\n * it can stand for, whatever its recovery id.\n /\nasync function verifySignature({ addr, msg, sig }: SignatureVerifyInput): Promise<StatusCode> {\n const sigBase64 = toBase64Maybe(sig);\n const scheme = signatureScheme(sigBase64);\n if (!scheme) return 'sig_unsupported_script';\n\n const ok = verifyBitcoinSignature(addr, msg, sigBase64);\n log.info({ addr, ok, scheme, msgLength: msg.length }, 'Signature verification result');\n if (!ok) return 'sig_invalid';\n return scheme === 'legacy' ? 'sig_ok_legacy' : 'sig_ok_bip322';\n}\n\n/* True when `sig` is a valid signature by `addr` over `msg`; no chain lookup. /\nexport async function signatureIsValid(input: SignatureVerifyInput): Promise<boolean> {\n try {\n const code = await verifySignature(input);\n return code === 'sig_ok_bip322' \|\| code === 'sig_ok_legacy';\n } catch {\n return false;\n }\n}\n\n// Canonical message parsing per SPEC + our builder (lowercase keys, extensions)\nexport function parseCanonicalMessage(msg: string) {\n const lines = msg.split('\\n').map((l) => l.trim());\n // `.split(':', 2)[1]` truncates values containing a colon (e.g. URLs in\n // extensions, or npubs in identities). Use the first colon as the\n // separator and keep everything after it — same approach as the\n // extensions loop below.\n const getVal = (prefix: string): string \| undefined => {\n const needle = prefix + ':';\n const hit = lines.find((l) => l.toLowerCase().startsWith(needle));\n if (!hit) return undefined;\n const idx = hit.indexOf(':');\n return hit.slice(idx + 1).trim();\n };\n\n const address = getVal('address') \|\| '';\n const identitiesStr = getVal('identities') \|\| '';\n const issued_at = getVal('issued_at') \|\| '';\n // Present but empty is kept as '', so a reader can refuse it rather than skip it.\n const expires = getVal('expires');\n\n // Parse identities\n let identities: IdentityBinding[] = [];\n try {\n identities = parseIdentities(identitiesStr);\n } catch (err) {\n log.warn({ identitiesStr, error: err }, 'Failed to parse identities field');\n }\n\n // Extensions: collect all key: value pairs excluding core known keys\n const coreKeys = new Set([\n 'orangecheck',\n 'identities',\n 'address',\n 'purpose',\n 'nonce',\n 'issued_at',\n 'ack',\n ]);\n const extensions: Record<string, string> = {};\n // A key signed twice has two meanings, and readers could pick either one.\n const keys = new Set<string>();\n const repeated: string[] = [];\n for (const line of lines) {\n const idx = line.indexOf(':');\n if (idx === -1) continue;\n const key = line.slice(0, idx).trim().toLowerCase();\n const val = line.slice(idx + 1).trim();\n if (keys.has(key)) repeated.push(key);\n keys.add(key);\n if (!coreKeys.has(key) && val) extensions[key] = val;\n }\n\n const network = (extensions['network'] \|\| 'mainnet') as Network;\n\n // Parse bond extension if present (integer satoshis)\n const bondStr = extensions['bond'];\n const bond = bondStr ? parseInt(bondStr, 10) : undefined;\n\n return {\n core: { address, identities, issued_at },\n expires,\n repeated,\n network,\n extensions,\n bond: bond !== undefined && !isNaN(bond) && bond > 0 ? bond : undefined,\n };\n}\n\n/\n UTXO type from Esplora API\n /\ninterface EsploraUtxo {\n /* Transaction ID /\n txid: string;\n /* Output index /\n vout: number;\n /* Value in satoshis /\n value: number;\n /* Confirmation status /\n status: {\n /* Whether UTXO is confirmed /\n confirmed: boolean;\n /* Block height (if confirmed) /\n block_height?: number;\n /* Block timestamp (if confirmed) /\n block_time?: number;\n };\n}\n\n/\n Fetch UTXOs for an address from Esplora API\n \n Tries multiple endpoints in order with automatic fallback\n \n @param address - Bitcoin address\n * @param network - Bitcoin network\n * @param opts - Optional custom Esplora endpoints\n * @returns Array of UTXOs\n * @throws {Error} If all endpoints fail\n /\nasync function getAddressUtxos(\n address: string,\n network: Network,\n opts?: {\n esploraMainnetBase?: string;\n esploraSignetBase?: string;\n esploraTestnetBase?: string;\n }\n): Promise<EsploraUtxo[]> {\n // Define primary and fallback endpoints\n const endpoints =\n network === 'signet'\n ? [\n opts?.esploraSignetBase \|\| 'https://mempool.space/signet/api',\n 'https://blockstream.info/signet/api',\n ]\n : network === 'testnet'\n ? [\n opts?.esploraTestnetBase \|\| 'https://mempool.space/testnet/api',\n 'https://blockstream.info/testnet/api',\n ]\n : [\n opts?.esploraMainnetBase \|\| 'https://mempool.space/api',\n 'https://blockstream.info/api',\n ];\n\n let lastError: Error \| null = null;\n\n // Try each endpoint in order. Per-endpoint timeout kept tight (5s) so\n // a slow upstream doesn't stack against the next one; callers who want\n // a hard overall deadline should wrap this call with their own timeout.\n for (const base of endpoints) {\n try {\n const url = `${base}/address/${address}/utxo`;\n log.debug({ url, network }, 'Fetching UTXOs');\n\n const resp = await fetch(url, {\n method: 'GET',\n headers: { Accept: 'application/json' },\n signal: AbortSignal.timeout(5000),\n });\n\n if (!resp.ok) {\n throw new Error(`HTTP ${resp.status}`);\n }\n\n const data = await resp.json();\n\n // Validate response structure\n if (!Array.isArray(data)) {\n throw new Error('Invalid response: expected array');\n }\n\n // Validate each UTXO has required fields\n for (const utxo of data) {\n if (\n typeof utxo.value !== 'number' \|\|\n typeof utxo.status !== 'object' \|\|\n typeof utxo.status.confirmed !== 'boolean' \|\|\n typeof utxo.txid !== 'string' \|\|\n typeof utxo.vout !== 'number'\n ) {\n throw new Error('Invalid UTXO structure');\n }\n }\n\n log.info({ base, count: data.length, network }, 'UTXOs fetched successfully');\n return data as EsploraUtxo[];\n } catch (err) {\n lastError = err instanceof Error ? err : new Error(String(err));\n log.warn(\n { base, error: lastError.message, network },\n 'Esplora endpoint failed, trying next'\n );\n }\n }\n\n // All endpoints failed\n log.error({ endpoints, error: lastError?.message, network }, 'All Esplora endpoints failed');\n throw new Error(`esplora_all_failed: ${lastError?.message \|\| 'unknown'}`);\n}\n\n/\n Enhanced metrics computation per SPEC.md §5.4 and §6.1\n \n Supports bond extension with oldest-first greedy UTXO selection\n \n @param utxos - Array of UTXOs from Esplora\n * @param bondAmount - Optional bond amount (enables greedy selection)\n * @returns Computed metrics (sats_bonded, days_unspent, confirmed_balance)\n /\nfunction computeMetrics(\n utxos: EsploraUtxo[],\n bondAmount?: number,\n coverSats?: number\n): {\n /* Bonded satoshis (confirmed balance or bond amount) /\n sats_bonded: number;\n /* Days since oldest/youngest UTXO /\n days_unspent: number;\n /* Total confirmed balance /\n confirmed_balance: number;\n} {\n // Filter out unconfirmed UTXOs\n const confirmedUtxos = utxos.filter((u) => u.status.confirmed);\n if (confirmedUtxos.length === 0) {\n return { sats_bonded: 0, days_unspent: 0, confirmed_balance: 0 };\n }\n\n // Compute total confirmed balance\n const confirmed_balance = confirmedUtxos.reduce((sum, u) => sum + u.value, 0);\n\n // If bond extension is present, use oldest-first greedy algorithm\n if (bondAmount !== undefined && bondAmount > 0) {\n // Sort UTXOs by (block_height ASC, txid ASC, vout ASC) - oldest first\n const sorted = [...confirmedUtxos].sort((a, b) => {\n const heightA = a.status.block_height ?? Infinity;\n const heightB = b.status.block_height ?? Infinity;\n if (heightA !== heightB) return heightA - heightB;\n if (a.txid !== b.txid) return a.txid.localeCompare(b.txid);\n return a.vout - b.vout;\n });\n\n // Greedily select UTXOs until sum >= bond\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| 0);\n if (sum >= bondAmount) break;\n }\n\n // Age is computed from the youngest UTXO in the bonded set\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 60 * 60))\n );\n\n return {\n sats_bonded: bondAmount, // Use exactly bond amount (ignore surplus)\n days_unspent,\n confirmed_balance,\n };\n }\n\n // Default behavior (no bond extension): sum all confirmed UTXOs\n const sats_bonded = confirmed_balance;\n\n // A checker asking for an amount gets the age of the coins that make it\n // up, oldest first, not the age of whichever coin is oldest.\n if (coverSats !== undefined && coverSats > 0) {\n const sorted = [...confirmedUtxos].sort(\n (a, b) => (a.status.block_height ?? Infinity) - (b.status.block_height ?? Infinity)\n );\n let sum = 0;\n let youngestTime = 0;\n for (const utxo of sorted) {\n sum += utxo.value;\n youngestTime = Math.max(youngestTime, utxo.status.block_time \|\| Date.now() / 1000);\n if (sum >= coverSats) break;\n }\n const days_unspent = Math.max(\n 0,\n Math.floor((Date.now() / 1000 - youngestTime) / (24 * 60 * 60))\n );\n return { sats_bonded, days_unspent, confirmed_balance };\n }\n\n // Find the oldest confirmed UTXO for days_unspent\n const oldestTime = Math.min(\n ...confirmedUtxos.map((u) => u.status.block_time \|\| Date.now() / 1000)\n );\n const days_unspent = Math.max(0, Math.floor((Date.now() / 1000 - oldestTime) / (24 * 60 * 60)));\n\n return { sats_bonded, days_unspent, confirmed_balance };\n}\n\n/*\n Verify an OrangeCheck attestation\n \n This is the main verification function that:\n * 1. Validates the canonical message format\n * 2. Verifies the Bitcoin signature (BIP-322 or legacy)\n * 3. Fetches and analyzes UTXOs\n * 4. Computes reputation metrics\n \n @param input - Verification input (message, address, signature)\n * @param opts - Optional verification options (test mode, audience, esplora bases)\n * @returns Verification outcome with status codes and metrics\n \n @example\n * ```typescript\n * const result = await verify({\n * msg: canonicalMessage,\n * addr: 'bc1q...',\n * sig: 'AkcwRAIg...',\n * });\n \n if (result.ok) {\n * console.log('Score:', result.metrics?.score);\n * }\n * ```\n */\nexport async function verify(input: VerifyInput, opts: VerifyOptions = {}): Promise<VerifyOutcome> {\n const codes: StatusCode[] = [];\n let network: Network = 'mainnet';\n\n try {\n // Check if we have required fields\n if (!input.msg \|\| !input.addr \|\| !input.sig) {\n codes.push('bad_request');\n return { ok: false, codes, network };\n }\n\n // Parse canonical message with extensions\n const parsed = parseCanonicalMessage(input.msg);\n network = parsed.network \|\| 'mainnet';\n\n // Compute attestation ID\n const attestation_id = await generateAttestationId(input.msg);\n\n // One value per key (SPEC §2.2).\n if (parsed.repeated.length > 0) {\n codes.push('decode_error');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Validate address consistency\n if (parsed.core.address !== input.addr) {\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Testnet/Signet policy enforcement\n if ((network === 'testnet' \|\| network === 'signet') && !opts.testMode) {\n codes.push('network_testmode');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Optional policy checks for extensions.\n // `aud` binds the attestation to an origin. If the caller passed\n // `expectedAud`, the check must be load-bearing — a mismatch is a\n // phishing signal, not an advisory. Fail hard (spec-aligned).\n if (opts.expectedAud) {\n const aud = parsed.extensions['aud'];\n if (!aud \|\| aud !== opts.expectedAud) {\n codes.push('aud_mismatch');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // The signed issue time is an RFC 3339 time (SPEC §7.1.g) and not ahead\n // of this clock by more than the allowed skew.\n const issued = rfc3339Ms(parsed.core.issued_at);\n if (issued === null) {\n codes.push('decode_error');\n return { ok: false, codes, network, attestation_id };\n }\n if (issued > Date.now() + ISSUED_AHEAD_MS) {\n codes.push('not_yet_valid');\n return { ok: false, codes, network, attestation_id };\n }\n\n // Check message expiration. An expiry that is not an RFC 3339 time is\n // refused as expired: nothing shows it lies ahead.\n if (parsed.expires !== undefined) {\n const exp = rfc3339Ms(parsed.expires);\n if (exp === null \|\| exp < Date.now()) {\n codes.push('expired');\n return { ok: false, codes, network, attestation_id };\n }\n }\n\n // Enhanced signature verification\n const sigCode = await verifySignature({\n addr: input.addr,\n msg: input.msg,\n sig: input.sig,\n ...(input.scheme && { scheme: input.scheme }),\n });\n codes.push(sigCode);\n\n const sigOk = sigCode === 'sig_ok_bip322' \|\| sigCode === 'sig_ok_legacy';\n if (!sigOk) {\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n\n // Enhanced UTXO analysis and metrics computation\n try {\n const utxos = await getAddressUtxos(input.addr, network, {\n esploraMainnetBase: opts.esploraMainnetBase,\n esploraSignetBase: opts.esploraSignetBase,\n });\n\n // Compute metrics with bond extension support (SPEC.md §5.4)\n const { sats_bonded, days_unspent, confirmed_balance } = computeMetrics(\n utxos,\n parsed.bond,\n opts.coverSats\n );\n\n // If bond extension is present, enforce minimum balance (SPEC.md §5.4.c)\n if (parsed.bond !== undefined && parsed.bond > 0) {\n if (confirmed_balance < parsed.bond) {\n codes.push('bond_insufficient');\n log.warn(\n {\n bond: parsed.bond,\n confirmed_balance,\n address: input.addr,\n },\n 'Bond extension: insufficient balance'\n );\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n }\n }\n\n // Analyze bond status\n if (sats_bonded <= 0) {\n codes.push('bond_zero');\n // Check for pending UTXOs\n if (utxos.some((u) => !u.status.confirmed)) {\n codes.push('bond_pending');\n }\n return {\n ok: false,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n };\n } else {\n codes.push('bond_confirmed');\n }\n\n // Compute final metrics with enhanced scoring\n const metrics: Metrics = {\n sats_bonded,\n days_unspent,\n score: (computeScore(sats_bonded, days_unspent, { algorithm: 'v0' }) as number),\n };\n\n return {\n ok: true,\n codes,\n network,\n attestation_id,\n identities: parsed.core.identities,\n metrics,\n };\n } catch (utxoError) {\n log.error({ err: utxoError }, 'UTXO fetch failed');\n codes.push('bad_request');\n return { ok: false, codes, network, attestation_id };\n }\n } catch (e: unknown) {\n const msg = e instanceof Error ? e.message : String(e ?? 'decode_error');\n if (msg === 'decode_error') {\n codes.push('decode_error');\n } else {\n codes.push('bad_request');\n }\n return { ok: false, codes, network };\n }\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@orangecheck/sdk",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "OrangeCheck SDK — proof of Bitcoin stake for the open web. A sybil-resistance primitive for any app.",
   "keywords": [
     "bitcoin",