@orangecheck/sdk 1.16.1 → 1.17.0

package/README.md

@@ -307,6 +307,7 @@ Full type definitions ship with the package.
 - **No custody.** The SDK never touches user funds. It signs messages, it doesn't spend coins.
 - **No telemetry.** The SDK makes network calls only to public Bitcoin explorers (mempool.space, blockstream.info) and Nostr relays you pass in. No OrangeCheck server is in the path for `verify()`.
 - **Offline-verifiable.** Given `(addr, msg, sig)`, anyone — including you, sitting on an island with a Raspberry Pi — can verify.
+- **Unknown options throw.** `check()` and `verify()` refuse a key they do not read, so a misspelt `minSats` or `expectedAud` is never ignored.
 
 ---
 

package/dist/attestation.js

@@ -217,11 +217,15 @@ function parseCanonicalMessage(msg) {
     "ack"
   ]);
   const extensions = {};
+  const keys = /* @__PURE__ */ new Set();
+  const repeated = [];
   for (const line of lines) {
     const idx = line.indexOf(":");
     if (idx === -1) continue;
     const key = line.slice(0, idx).trim().toLowerCase();
     const val = line.slice(idx + 1).trim();
+    if (keys.has(key)) repeated.push(key);
+    keys.add(key);
     if (!coreKeys.has(key) && val) extensions[key] = val;
   }
   const network = extensions["network"] || "mainnet";
@@ -230,6 +234,7 @@ function parseCanonicalMessage(msg) {
   return {
     core: { address, identities, issued_at },
     expires,
+    repeated,
     network,
     extensions,
     bond: bond !== void 0 && !isNaN(bond) && bond > 0 ? bond : void 0
@@ -371,188 +376,98 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
   log2.info({ successCount: success.length, failedCount: failed.length }, "Publishing complete");
   return { success, failed };
 }
-async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
+var PAGE_LIMIT = 500;
+var MAX_PAGES = 4;
+async function querySubject(filter, relays, label) {
   const events = [];
-  log2.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
-  const queryPromises = relays.map(async (relayUrl) => {
-    let ws = null;
-    try {
-      ws = new WebSocket(relayUrl);
-      const wsRef = ws;
-      await new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => {
-          wsRef.close();
-          reject(new Error("Query timeout"));
-        }, budgetFor(deadlineAt));
-        const cleanup = () => {
-          clearTimeout(timeout);
-          wsRef.close();
-        };
-        wsRef.onopen = () => {
-          const subscriptionId = `ochk_${Date.now()}`;
-          wsRef.send(
-            JSON.stringify([
-              "REQ",
-              subscriptionId,
-              {
-                kinds: [30078],
-                "#d": [attestationId],
-                limit: 1
+  await Promise.allSettled(
+    relays.map(async (relayUrl) => {
+      let ws = null;
+      try {
+        ws = new WebSocket(relayUrl);
+        const wsRef = ws;
+        await new Promise((resolve, reject) => {
+          const timeout = setTimeout(() => {
+            wsRef.close();
+            reject(new Error("Query timeout"));
+          }, budgetFor(deadlineAt));
+          const seen = /* @__PURE__ */ new Set();
+          let page = 0;
+          let inPage = 0;
+          let newInPage = 0;
+          let oldest = Infinity;
+          const ask = () => {
+            page++;
+            inPage = 0;
+            newInPage = 0;
+            const until = Number.isFinite(oldest) ? { until: oldest } : {};
+            wsRef.send(
+              JSON.stringify([
+                "REQ",
+                `ochk_${label}_${Date.now()}_${page}`,
+                { ...filter, ...until, limit: PAGE_LIMIT }
+              ])
+            );
+          };
+          wsRef.onopen = ask;
+          wsRef.onmessage = (msg) => {
+            try {
+              const data = JSON.parse(msg.data);
+              if (data[0] === "EVENT") {
+                const event = data[2];
+                const key = event.id ?? JSON.stringify(event);
+                inPage++;
+                if (!seen.has(key)) {
+                  seen.add(key);
+                  newInPage++;
+                  events.push(event);
+                }
+                if (typeof event.created_at === "number") {
+                  oldest = Math.min(oldest, event.created_at);
+                }
+              } else if (data[0] === "EOSE") {
+                wsRef.send(JSON.stringify(["CLOSE", data[1]]));
+                if (inPage >= PAGE_LIMIT && newInPage > 0 && page < MAX_PAGES) {
+                  ask();
+                } else {
+                  clearTimeout(timeout);
+                  wsRef.close();
+                  resolve();
+                }
               }
-            ])
-          );
-        };
-        wsRef.onmessage = (msg) => {
-          try {
-            const data = JSON.parse(msg.data);
-            if (data[0] === "EVENT") {
-              events.push(data[2]);
-            } else if (data[0] === "EOSE") {
-              cleanup();
-              resolve();
+            } catch (err) {
+              log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
             }
-          } catch (err) {
-            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
-          }
-        };
-        wsRef.onerror = (err) => {
-          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
-          cleanup();
-          reject(err);
-        };
-        wsRef.onclose = () => {
-          clearTimeout(timeout);
-        };
-      });
-    } catch (err) {
-      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
-    } finally {
-      if (ws && ws.readyState !== WebSocket.CLOSED) {
-        ws.close();
+          };
+          wsRef.onerror = (err) => {
+            clearTimeout(timeout);
+            log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+            reject(err);
+          };
+        });
+      } catch (err) {
+        log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
+      } finally {
+        if (ws && ws.readyState !== WebSocket.CLOSED) ws.close();
       }
-    }
-  });
-  await Promise.allSettled(queryPromises);
-  log2.info({ eventCount: events.length }, "Query complete");
+    })
+  );
+  log2.info({ label, eventCount: events.length }, "Query complete");
   return events;
 }
+async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
+  log2.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
+  return querySubject({ kinds: [30078], "#d": [attestationId] }, relays, "id");
+}
 async function queryByAddress(address, relays = DEFAULT_RELAYS) {
-  const events = [];
   log2.info({ address, relayCount: relays.length }, "Querying relays for address");
-  const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
-  const queryPromises = relays.map(async (relayUrl) => {
-    try {
-      const ws = new WebSocket(relayUrl);
-      await new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => {
-          ws.close();
-          reject(new Error("Query timeout"));
-        }, budgetFor(deadlineAt));
-        ws.onopen = () => {
-          const subscriptionId = `ochk_addr_${Date.now()}`;
-          ws.send(
-            JSON.stringify([
-              "REQ",
-              subscriptionId,
-              {
-                kinds: [30078],
-                // `#t`, NOT `#address`: NIP-12 relays index
-                // single-letter tags only, so `#address`
-                // matched nothing on any relay and this
-                // function returned empty for every real
-                // attestation. attest.ochk.io's verifier has
-                // queried `#t` since the same fix landed
-                // there; this is the back-port.
-                "#t": [address],
-                limit: 50
-              }
-            ])
-          );
-        };
-        ws.onmessage = (msg) => {
-          try {
-            const data = JSON.parse(msg.data);
-            if (data[0] === "EVENT") {
-              events.push(data[2]);
-            } else if (data[0] === "EOSE") {
-              clearTimeout(timeout);
-              ws.close();
-              resolve();
-            }
-          } catch (err) {
-            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
-          }
-        };
-        ws.onerror = (err) => {
-          clearTimeout(timeout);
-          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
-          reject(err);
-        };
-      });
-    } catch (err) {
-      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
-    }
-  });
-  await Promise.allSettled(queryPromises);
-  log2.info({ eventCount: events.length }, "Query complete");
-  return events;
+  return querySubject({ kinds: [30078], "#t": [address] }, relays, "addr");
 }
 async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
-  const events = [];
-  const identityTag = `${protocol}:${identifier}`;
-  const identityTags = protocol === "nostr" ? nostrIdentifierForms(identifier).map((f) => `nostr:${f}`) : [identityTag];
+  const identityTags = protocol === "nostr" ? nostrIdentifierForms(identifier).map((f) => `nostr:${f}`) : [`${protocol}:${identifier}`];
   log2.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
-  const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
-  const queryPromises = relays.map(async (relayUrl) => {
-    try {
-      const ws = new WebSocket(relayUrl);
-      await new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => {
-          ws.close();
-          reject(new Error("Query timeout"));
-        }, budgetFor(deadlineAt));
-        ws.onopen = () => {
-          const subscriptionId = `ochk_identity_${Date.now()}`;
-          ws.send(
-            JSON.stringify([
-              "REQ",
-              subscriptionId,
-              {
-                kinds: [30078],
-                "#i": identityTags,
-                limit: 10
-              }
-            ])
-          );
-        };
-        ws.onmessage = (msg) => {
-          try {
-            const data = JSON.parse(msg.data);
-            if (data[0] === "EVENT") {
-              events.push(data[2]);
-            } else if (data[0] === "EOSE") {
-              clearTimeout(timeout);
-              ws.close();
-              resolve();
-            }
-          } catch (err) {
-            log2.error({ relay: relayUrl, error: err }, "Failed to parse event");
-          }
-        };
-        ws.onerror = (err) => {
-          clearTimeout(timeout);
-          log2.error({ relay: relayUrl, error: err }, "WebSocket error during query");
-          reject(err);
-        };
-      });
-    } catch (err) {
-      log2.error({ relay: relayUrl, error: err }, "Failed to query relay");
-    }
-  });
-  await Promise.allSettled(queryPromises);
-  log2.info({ eventCount: events.length }, "Query complete");
-  return events;
+  return querySubject({ kinds: [30078], "#i": identityTags }, relays, "identity");
 }
 async function verifyAttestationEnvelope(envelope) {
   try {
@@ -579,6 +494,7 @@ function signedEnvelope(envelope) {
     return null;
   }
   if (!parsed.core.address || rfc3339Ms(parsed.core.issued_at) === null) return null;
+  if (parsed.repeated.length > 0) return null;
   const { expires_at: _copy, ...rest } = envelope;
   return {
     ...rest,