@orangecheck/sdk 1.17.0 → 1.18.0

package/dist/index.mjs

@@ -68,6 +68,11 @@ function parseIdentities(identitiesStr) {
   }
   return bindings;
 }
+function readBondExtension(value) {
+  if (!/^[0-9]+$/.test(value)) return null;
+  const n = Number(value);
+  return Number.isSafeInteger(n) ? n : null;
+}
 function buildCanonicalMessage({ address, identities }, extensions = {}, options = {}) {
   const nonce = options.nonce ?? randomNonce16BHexLower();
   if (!/^[0-9a-f]{32}$/.test(nonce)) {
@@ -90,6 +95,9 @@ function buildCanonicalMessage({ address, identities }, extensions = {}, options
       continue;
     }
     const key = k.toLowerCase();
+    if (key === "bond" && readBondExtension(String(v)) === null) {
+      throw new Error(`invalid bond: ${String(v)} is not a whole number of sats up to 2^53 - 1`);
+    }
     normExt[key] = String(v);
   }
   const extLines = Object.keys(normExt).sort().map((k) => `${k}: ${normExt[k]}`);
@@ -102,10 +110,15 @@ async function generateAttestationId(message) {
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
   return toLowerHex(new Uint8Array(hashBuffer));
 }
+function readMessageValue(message, key) {
+  const needle = key + ":";
+  const hit = message.split("\n").map((l) => l.trim()).find((l) => l.toLowerCase().startsWith(needle));
+  if (!hit) return void 0;
+  return hit.slice(hit.indexOf(":") + 1).trim();
+}
 async function createAttestationEnvelope(message, signature, scheme, address, identities, extensions = {}) {
   const attestation_id = await generateAttestationId(message);
-  const issuedAtMatch = message.match(/issued_at: ([^\n]+)/);
-  const issued_at = issuedAtMatch?.[1] ?? (/* @__PURE__ */ new Date()).toISOString();
+  const issued_at = readMessageValue(message, "issued_at") ?? (/* @__PURE__ */ new Date()).toISOString();
   const expires_at = extensions.expires;
   const relay_hints = extensions.relay_hints?.split(",").map((r) => r.trim());
   const publish_targets = extensions.publish?.split(",").map((t) => t.trim());
@@ -317,13 +330,7 @@ async function signatureIsValid(input) {
 }
 function parseCanonicalMessage(msg) {
   const lines = msg.split("\n").map((l) => l.trim());
-  const getVal = (prefix) => {
-    const needle = prefix + ":";
-    const hit = lines.find((l) => l.toLowerCase().startsWith(needle));
-    if (!hit) return void 0;
-    const idx = hit.indexOf(":");
-    return hit.slice(idx + 1).trim();
-  };
+  const getVal = (key) => readMessageValue(msg, key);
   const address = getVal("address") || "";
   const identitiesStr = getVal("identities") || "";
   const issued_at = getVal("issued_at") || "";
@@ -357,14 +364,15 @@ function parseCanonicalMessage(msg) {
   }
   const network = extensions["network"] || "mainnet";
   const bondStr = extensions["bond"];
-  const bond = bondStr ? parseInt(bondStr, 10) : void 0;
+  const bond = bondStr ? readBondExtension(bondStr) : void 0;
   return {
     core: { address, identities, issued_at },
     expires,
     repeated,
     network,
     extensions,
-    bond: bond !== void 0 && !isNaN(bond) && bond > 0 ? bond : void 0
+    bond: bond !== void 0 && bond !== null && bond > 0 ? bond : void 0,
+    bondMalformed: bond === null
   };
 }
 async function getAddressUtxos(address, network, opts) {
@@ -533,6 +541,16 @@ async function verify(input, opts = {}) {
         identities: parsed.core.identities
       };
     }
+    if (parsed.bondMalformed) {
+      codes.push("bond_malformed");
+      return {
+        ok: false,
+        codes,
+        network,
+        attestation_id,
+        identities: parsed.core.identities
+      };
+    }
     try {
       const utxos = await getAddressUtxos(input.addr, network, {
         esploraMainnetBase: opts.esploraMainnetBase,
@@ -2317,6 +2335,11 @@ var STATUS_META = {
     detail: "The confirmed balance is less than the declared bond amount. The bond extension requires the address to hold at least the specified amount in confirmed UTXOs.",
     severity: "error"
   },
+  bond_malformed: {
+    label: "Bond amount not readable",
+    detail: "The signed bond line is not a whole number of sats written in plain digits, so the attestation does not say how much it bonds.",
+    severity: "error"
+  },
   aud_mismatch: {
     label: "Audience mismatch",
     detail: "The message was signed for a different audience than expected. This may be intentional or indicate the signature is being used in the wrong context.",
@@ -2359,6 +2382,6 @@ var STATUS_META = {
   }
 };
 
-export { BOND_DAYS_FLOORS, BOND_MAX_WINDOW_SECONDS, BOND_MIN_CONFIRMATIONS, BOND_SATS_FLOORS, DEFAULT_RELAYS, FANOUT_DEADLINE_MS, STATUS_META, bondFloors, bondId, bondNullifier, buildBondMessage, buildCanonicalMessage, check, checkBondCoin, computeAllScores, computeScore, createAttestation, createAttestationEnvelope, createAttestationEvent, discoverAttestations, esploraSource, extractAttestationIdFromUrl, formatIdentities, formatIdentitiesForDisplay, generateAttestationId, generateGistTemplate, generateTweetText, generateWellKnownContent, getAttestationsForAddress, getAttestationsForIdentity, getDnsVerificationInstructions, getGistCreationUrl, getGitHubVerificationInstructions, getManualVerificationInstructions, getNip07Info, getNostrPublicKey, getNostrVerificationInstructions, getTweetUrl, getTwitterComposeUrl, getTwitterVerificationInstructions, getVerificationInstructions, getVerificationSummary, getVerificationUrl, getWellKnownUrl, isDnsIdentityVerified, isGitHubIdentityVerified, isNip07Available, isNostrIdentityVerified, isValidDomain, isValidTweetUrl, issueBondMessage, issueChallenge, nostrIdentifierForms, nostrPubkeyToHex, parseAttestationFromEvent, parseBondMessage, parseIdentities, publishAttestation, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, requiresManualVerification, signNostrEvent, signatureIsValid, signedEnvelope, supportsAutomaticVerification, verify, verifyAllIdentities, verifyAttestationById, verifyBond, verifyBondSignature, verifyChallenge, verifyDnsIdentity, verifyGitHubIdentity, verifyIdentity, verifyNostrIdentity, verifyTwitterIdentity };
+export { BOND_DAYS_FLOORS, BOND_MAX_WINDOW_SECONDS, BOND_MIN_CONFIRMATIONS, BOND_SATS_FLOORS, DEFAULT_RELAYS, FANOUT_DEADLINE_MS, STATUS_META, bondFloors, bondId, bondNullifier, buildBondMessage, buildCanonicalMessage, check, checkBondCoin, computeAllScores, computeScore, createAttestation, createAttestationEnvelope, createAttestationEvent, discoverAttestations, esploraSource, extractAttestationIdFromUrl, formatIdentities, formatIdentitiesForDisplay, generateAttestationId, generateGistTemplate, generateTweetText, generateWellKnownContent, getAttestationsForAddress, getAttestationsForIdentity, getDnsVerificationInstructions, getGistCreationUrl, getGitHubVerificationInstructions, getManualVerificationInstructions, getNip07Info, getNostrPublicKey, getNostrVerificationInstructions, getTweetUrl, getTwitterComposeUrl, getTwitterVerificationInstructions, getVerificationInstructions, getVerificationSummary, getVerificationUrl, getWellKnownUrl, isDnsIdentityVerified, isGitHubIdentityVerified, isNip07Available, isNostrIdentityVerified, isValidDomain, isValidTweetUrl, issueBondMessage, issueChallenge, nostrIdentifierForms, nostrPubkeyToHex, parseAttestationFromEvent, parseBondMessage, parseIdentities, publishAttestation, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, readBondExtension, requiresManualVerification, signNostrEvent, signatureIsValid, signedEnvelope, supportsAutomaticVerification, verify, verifyAllIdentities, verifyAttestationById, verifyBond, verifyBondSignature, verifyChallenge, verifyDnsIdentity, verifyGitHubIdentity, verifyIdentity, verifyNostrIdentity, verifyTwitterIdentity };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map