npm - @orangecheck/sdk - Versions diffs - 1.3.0 → 1.5.0 - Mend

@orangecheck/sdk 1.3.0 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/dist/attestation.mjs CHANGED Viewed

@@ -85,16 +85,25 @@ var log = createLogger("ocp/nostr");
 var ATTESTATION_EVENT_KIND = 30078;
 var DEFAULT_RELAYS = [
   "wss://relay.damus.io",
-  "wss://relay.nostr.band",
   "wss://nos.lol",
-  "wss://relay.snort.social"
+  "wss://relay.snort.social",
+  "wss://relay.ochk.io"
 ];
+var FANOUT_DEADLINE_MS = 4e3;
+var QUERY_TIMEOUT_MS = 1e4;
+function budgetFor(deadlineAt) {
+  return Math.max(0, Math.min(QUERY_TIMEOUT_MS, deadlineAt - Date.now()));
+}
 function createAttestationEvent(envelope, pubkey) {
   const tags = [
     ["d", envelope.attestation_id],
-    // Parameterized replaceable event identifier
+    // Parameterized replaceable event identifier (indexed)
+    ["t", envelope.address],
+    // Indexed btc-address tag — query with `#t`
+    ["t", "oc-attest"],
+    // Family marker — `#t=["oc-attest"]` for cross-cut discovery
     ["address", envelope.address],
-    // Bitcoin address
+    // Diagnostic / legacy — relay won't index this
     ["scheme", envelope.scheme],
     // Signature scheme (bip322 or legacy)
     ["issued_at", envelope.issued_at]
@@ -124,8 +133,20 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
   const success = [];
   const failed = [];
   log.info({ eventId: event.id, relayCount: relays.length }, "Publishing event to relays");
+  const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const publishPromises = relays.map(async (relayUrl) => {
     let ws = null;
+    let settled = false;
+    const recordSuccess = () => {
+      if (settled) return;
+      settled = true;
+      success.push(relayUrl);
+    };
+    const recordFailure = () => {
+      if (settled) return;
+      settled = true;
+      failed.push(relayUrl);
+    };
     try {
       ws = new WebSocket(relayUrl);
       const wsRef = ws;
@@ -133,7 +154,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
         const deadline = setTimeout(() => {
           wsRef.close();
           reject(new Error("Relay publish timeout"));
-        }, 1e4);
+        }, budgetFor(deadlineAt));
         const cleanup = () => {
           clearTimeout(deadline);
           wsRef.close();
@@ -146,7 +167,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
             const data = JSON.parse(msg.data);
             if (data[0] === "OK" && data[1] === event.id) {
               if (data[2] === true) {
-                success.push(relayUrl);
+                recordSuccess();
                 cleanup();
                 resolve();
               } else {
@@ -154,7 +175,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
                   { relay: relayUrl, reason: data[3] },
                   "Relay rejected event"
                 );
-                failed.push(relayUrl);
+                recordFailure();
                 cleanup();
                 reject(new Error(data[3] || "Relay rejected event"));
               }
@@ -164,14 +185,14 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
               { relay: relayUrl, error: err },
               "Failed to parse relay response"
             );
-            failed.push(relayUrl);
+            recordFailure();
             cleanup();
             reject(err);
           }
         };
         wsRef.onerror = (err) => {
           log.error({ relay: relayUrl, error: err }, "WebSocket error");
-          failed.push(relayUrl);
+          recordFailure();
           cleanup();
           reject(err);
         };
@@ -181,9 +202,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
       });
     } catch (err) {
       log.error({ relay: relayUrl, error: err }, "Failed to publish to relay");
-      if (!failed.includes(relayUrl)) {
-        failed.push(relayUrl);
-      }
+      recordFailure();
     } finally {
       if (ws && ws.readyState !== WebSocket.CLOSED) {
         ws.close();
@@ -197,6 +216,7 @@ async function publishToRelays(event, relays = DEFAULT_RELAYS) {
 async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
   const events = [];
   log.info({ attestationId, relayCount: relays.length }, "Querying relays for attestation");
+  const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     let ws = null;
     try {
@@ -206,7 +226,7 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
         const timeout = setTimeout(() => {
           wsRef.close();
           reject(new Error("Query timeout"));
-        }, 1e4);
+        }, budgetFor(deadlineAt));
         const cleanup = () => {
           clearTimeout(timeout);
           wsRef.close();
@@ -262,6 +282,7 @@ async function queryByAttestationId(attestationId, relays = DEFAULT_RELAYS) {
 async function queryByAddress(address, relays = DEFAULT_RELAYS) {
   const events = [];
   log.info({ address, relayCount: relays.length }, "Querying relays for address");
+  const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
       const ws = new WebSocket(relayUrl);
@@ -269,7 +290,7 @@ async function queryByAddress(address, relays = DEFAULT_RELAYS) {
         const timeout = setTimeout(() => {
           ws.close();
           reject(new Error("Query timeout"));
-        }, 1e4);
+        }, budgetFor(deadlineAt));
         ws.onopen = () => {
           const subscriptionId = `ochk_addr_${Date.now()}`;
           ws.send(
@@ -278,8 +299,15 @@ async function queryByAddress(address, relays = DEFAULT_RELAYS) {
               subscriptionId,
               {
                 kinds: [30078],
-                "#address": [address],
-                limit: 10
+                // `#t`, NOT `#address`: NIP-12 relays index
+                // single-letter tags only, so `#address`
+                // matched nothing on any relay and this
+                // function returned empty for every real
+                // attestation. attest.ochk.io's verifier has
+                // queried `#t` since the same fix landed
+                // there; this is the back-port.
+                "#t": [address],
+                limit: 50
               }
             ])
           );
@@ -316,6 +344,7 @@ async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
   const events = [];
   const identityTag = `${protocol}:${identifier}`;
   log.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
+  const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
     try {
       const ws = new WebSocket(relayUrl);
@@ -323,7 +352,7 @@ async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
         const timeout = setTimeout(() => {
           ws.close();
           reject(new Error("Query timeout"));
-        }, 1e4);
+        }, budgetFor(deadlineAt));
         ws.onopen = () => {
           const subscriptionId = `ochk_identity_${Date.now()}`;
           ws.send(

package/dist/attestation.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/canonical.ts","../src/utils/logger.ts","../src/nostr.ts","../src/nostr-crypto.ts","../src/attestation.ts"],"names":["log"],"mappings":";AA8BA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CAClB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAChB;AAmLA,eAAsB,sBAAsB,OAAA,EAAkC;AAE1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAGnC,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAG7D,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AAChD;AAeA,eAAsB,yBAAA,CAClB,SACA,SAAA,EACA,MAAA,EACA,SACA,UAAA,EACA,UAAA,GAAyB,EAAC,EACE;AAC5B,EAAA,MAAM,cAAA,GAAiB,MAAM,qBAAA,CAAsB,OAAO,CAAA;AAG1D,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,KAAA,CAAM,qBAAqB,CAAA;AACzD,EAAA,MAAM,YAAY,aAAA,GAAgB,CAAC,sBAAK,IAAI,IAAA,IAAO,WAAA,EAAY;AAG/D,EAAA,MAAM,aAAa,UAAA,CAAW,OAAA;AAG9B,EAAA,MAAM,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAG1E,EAAA,MAAM,eAAA,GAAkB,UAAA,CAAW,OAAA,EAAS,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAG1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAC3C,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,YAAY,CAAC,CAAA;AACxD,EAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA;AAGtF,EAAA,MAAM,gBAAA,GAAmB,iCAAiC,cAAc,CAAA,CAAA;AAExE,EAAA,OAAO;AAAA,IACH,cAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,cAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,UAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACJ;AACJ;AC5OO,SAAS,aAAa,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAA8C;AAC7D,IAAyB,OAAO,KAAA;AAMJ,EAChC,CAAA;AAEA,EAAA,MAAM,gBAAgB,CAAC,GAAA,KAAwB,CAAA,CAAA,EAAI,SAAS,KAAK,GAAG,CAAA,CAAA;AAEpE,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,MAAM,GAAG,gBAAgB,CAAA;AAAA,QACnE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,SAAS,GAAG,gBAAgB,CAAA;AAAA,QACtE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;;;ACzFA,IAAM,GAAA,GAAM,aAAa,WAAW,CAAA;AAK7B,IAAM,sBAAA,GAAyB,KAAA;AAO/B,IAAM,cAAA,GAA2B;AAAA,EACpC,sBAAA;AAAA,EACA,wBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACJ,CAAA;AAYO,SAAS,sBAAA,CACZ,UACA,MAAA,EAC8B;AAC9B,EAAA,MAAM,IAAA,GAAmB;AAAA,IACrB,CAAC,GAAA,EAAK,QAAA,CAAS,cAAc,CAAA;AAAA;AAAA,IAC7B,CAAC,SAAA,EAAW,QAAA,CAAS,OAAO,CAAA;AAAA;AAAA,IAC5B,CAAC,QAAA,EAAU,QAAA,CAAS,MAAM,CAAA;AAAA;AAAA,IAC1B,CAAC,WAAA,EAAa,QAAA,CAAS,SAAS;AAAA;AAAA,GACpC;AAGA,EAAA,KAAA,MAAW,QAAA,IAAY,SAAS,UAAA,EAAY;AACxC,IAAA,IAAA,CAAK,IAAA,CAAK,CAAC,GAAA,EAAK,CAAA,EAAG,QAAA,CAAS,QAAQ,CAAA,CAAA,EAAI,QAAA,CAAS,UAAU,CAAA,CAAE,CAAC,CAAA;AAAA,EAClE;AAGA,EAAA,IAAI,SAAS,UAAA,EAAY;AACrB,IAAA,IAAA,CAAK,IAAA,CAAK,CAAC,SAAA,EAAW,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,EAC9C;AAGA,EAAA,IAAI,QAAA,CAAS,aAAa,MAAA,EAAQ;AAC9B,IAAA,KAAA,MAAW,KAAA,IAAS,SAAS,WAAA,EAAa;AACtC,MAAA,IAAA,CAAK,IAAA,CAAK,CAAC,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,IAC9B;AAAA,EACJ;AAGA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,QAAA,EAAU,MAAM,CAAC,CAAA;AAEhD,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,sBAAA;AAAA,IACN,IAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA,EAAY,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,QAAA,CAAS,SAAS,IAAI,GAAI,CAAA;AAAA,IAC5D;AAAA,GACJ;AACJ;AAoDA,eAAsB,eAAA,CAClB,KAAA,EACA,MAAA,GAAmB,cAAA,EAC6B;AAChD,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,OAAA,EAAS,KAAA,CAAM,IAAI,UAAA,EAAY,MAAA,CAAO,MAAA,EAAO,EAAG,4BAA4B,CAAA;AAEvF,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACnD,IAAA,IAAI,EAAA,GAAuB,IAAA;AAE3B,IAAA,IAAI;AAEA,MAAA,EAAA,GAAK,IAAI,UAAU,QAAQ,CAAA;AAC3B,MAAA,MAAM,KAAA,GAAQ,EAAA;AAEd,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAIzC,QAAA,MAAM,QAAA,GAAW,WAAW,MAAM;AAC9B,UAAA,KAAA,CAAM,KAAA,EAAM;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,uBAAuB,CAAC,CAAA;AAAA,QAC7C,GAAG,GAAM,CAAA;AAET,QAAA,MAAM,UAAU,MAAM;AAClB,UAAA,YAAA,CAAa,QAAQ,CAAA;AACrB,UAAA,KAAA,CAAM,KAAA,EAAM;AAAA,QAChB,CAAA;AAEA,QAAA,KAAA,CAAM,SAAS,MAAM;AAGjB,UAAA,KAAA,CAAM,KAAK,IAAA,CAAK,SAAA,CAAU,CAAC,OAAA,EAAS,KAAK,CAAC,CAAC,CAAA;AAAA,QAC/C,CAAA;AAEA,QAAA,KAAA,CAAM,SAAA,GAAY,CAAC,GAAA,KAAQ;AACvB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAEhC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,IAAQ,KAAK,CAAC,CAAA,KAAM,MAAM,EAAA,EAAI;AAC1C,cAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,EAAM;AAClB,gBAAA,OAAA,CAAQ,KAAK,QAAQ,CAAA;AACrB,gBAAA,OAAA,EAAQ;AACR,gBAAA,OAAA,EAAQ;AAAA,cACZ,CAAA,MAAO;AACH,gBAAA,GAAA,CAAI,IAAA;AAAA,kBACA,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAQ,IAAA,CAAK,CAAC,CAAA,EAAE;AAAA,kBACnC;AAAA,iBACJ;AACA,gBAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AACpB,gBAAA,OAAA,EAAQ;AACR,gBAAA,MAAA,CAAO,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,IAAK,sBAAsB,CAAC,CAAA;AAAA,cACvD;AAAA,YACJ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,KAAA;AAAA,cACA,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,GAAA,EAAI;AAAA,cAC9B;AAAA,aACJ;AACA,YAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AACpB,YAAA,OAAA,EAAQ;AACR,YAAA,MAAA,CAAO,GAAG,CAAA;AAAA,UACd;AAAA,QACJ,CAAA;AAEA,QAAA,KAAA,CAAM,OAAA,GAAU,CAAC,GAAA,KAAQ;AACrB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,iBAAiB,CAAA;AAC5D,UAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AACpB,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAEA,QAAA,KAAA,CAAM,UAAU,MAAM;AAGlB,UAAA,YAAA,CAAa,QAAQ,CAAA;AAAA,QACzB,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,4BAA4B,CAAA;AACvE,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC5B,QAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,MACxB;AAAA,IACJ,CAAA,SAAE;AAEE,MAAA,IAAI,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,SAAA,CAAU,MAAA,EAAQ;AAC1C,QAAA,EAAA,CAAG,KAAA,EAAM;AAAA,MACb;AAAA,IACJ;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,eAAe,CAAA;AAExC,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,YAAA,EAAc,OAAA,CAAQ,QAAQ,WAAA,EAAa,MAAA,CAAO,MAAA,EAAO,EAAG,qBAAqB,CAAA;AAE5F,EAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAC7B;AAKA,eAAsB,oBAAA,CAClB,aAAA,EACA,MAAA,GAAmB,cAAA,EACE;AACrB,EAAA,MAAM,SAAuB,EAAC;AAE9B,EAAA,GAAA,CAAI,KAAK,EAAE,aAAA,EAAe,YAAY,MAAA,CAAO,MAAA,IAAU,iCAAiC,CAAA;AAExF,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACjD,IAAA,IAAI,EAAA,GAAuB,IAAA;AAE3B,IAAA,IAAI;AACA,MAAA,EAAA,GAAK,IAAI,UAAU,QAAQ,CAAA;AAC3B,MAAA,MAAM,KAAA,GAAQ,EAAA;AAEd,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,QAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC7B,UAAA,KAAA,CAAM,KAAA,EAAM;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,QACrC,GAAG,GAAK,CAAA;AAER,QAAA,MAAM,UAAU,MAAM;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,KAAA,CAAM,KAAA,EAAM;AAAA,QAChB,CAAA;AAEA,QAAA,KAAA,CAAM,SAAS,MAAM;AAEjB,UAAA,MAAM,cAAA,GAAiB,CAAA,KAAA,EAAQ,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA;AACzC,UAAA,KAAA,CAAM,IAAA;AAAA,YACF,KAAK,SAAA,CAAU;AAAA,cACX,KAAA;AAAA,cACA,cAAA;AAAA,cACA;AAAA,gBACI,KAAA,EAAO,CAAC,KAAK,CAAA;AAAA,gBACb,IAAA,EAAM,CAAC,aAAa,CAAA;AAAA,gBACpB,KAAA,EAAO;AAAA;AACX,aACH;AAAA,WACL;AAAA,QACJ,CAAA;AAEA,QAAA,KAAA,CAAM,SAAA,GAAY,CAAC,GAAA,KAAQ;AACvB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAChC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,EAAS;AACrB,cAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,YACvB,CAAA,MAAA,IAAW,IAAA,CAAK,CAAC,CAAA,KAAM,MAAA,EAAQ;AAC3B,cAAA,OAAA,EAAQ;AACR,cAAA,OAAA,EAAQ;AAAA,YACZ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,UACtE;AAAA,QACJ,CAAA;AAEA,QAAA,KAAA,CAAM,OAAA,GAAU,CAAC,GAAA,KAAQ;AACrB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,8BAA8B,CAAA;AACzE,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAEA,QAAA,KAAA,CAAM,UAAU,MAAM;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AAAA,QACxB,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,IACtE,CAAA,SAAE;AAEE,MAAA,IAAI,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,SAAA,CAAU,MAAA,EAAQ;AAC1C,QAAA,EAAA,CAAG,KAAA,EAAM;AAAA,MACb;AAAA,IACJ;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,aAAa,CAAA;AAEtC,EAAA,GAAA,CAAI,KAAK,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,IAAU,gBAAgB,CAAA;AAExD,EAAA,OAAO,MAAA;AACX;AAKA,eAAsB,cAAA,CAClB,OAAA,EACA,MAAA,GAAmB,cAAA,EACE;AACrB,EAAA,MAAM,SAAuB,EAAC;AAE9B,EAAA,GAAA,CAAI,KAAK,EAAE,OAAA,EAAS,YAAY,MAAA,CAAO,MAAA,IAAU,6BAA6B,CAAA;AAE9E,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACjD,IAAA,IAAI;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,QAAQ,CAAA;AAEjC,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,QAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC7B,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,QACrC,GAAG,GAAK,CAAA;AAER,QAAA,EAAA,CAAG,SAAS,MAAM;AACd,UAAA,MAAM,cAAA,GAAiB,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA;AAC9C,UAAA,EAAA,CAAG,IAAA;AAAA,YACC,KAAK,SAAA,CAAU;AAAA,cACX,KAAA;AAAA,cACA,cAAA;AAAA,cACA;AAAA,gBACI,KAAA,EAAO,CAAC,KAAK,CAAA;AAAA,gBACb,UAAA,EAAY,CAAC,OAAO,CAAA;AAAA,gBACpB,KAAA,EAAO;AAAA;AACX,aACH;AAAA,WACL;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,SAAA,GAAY,CAAC,GAAA,KAAQ;AACpB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAChC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,EAAS;AACrB,cAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,YACvB,CAAA,MAAA,IAAW,IAAA,CAAK,CAAC,CAAA,KAAM,MAAA,EAAQ;AAC3B,cAAA,YAAA,CAAa,OAAO,CAAA;AACpB,cAAA,EAAA,CAAG,KAAA,EAAM;AACT,cAAA,OAAA,EAAQ;AAAA,YACZ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,UACtE;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,OAAA,GAAU,CAAC,GAAA,KAAQ;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,8BAA8B,CAAA;AACzE,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,IACtE;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,aAAa,CAAA;AAEtC,EAAA,GAAA,CAAI,KAAK,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,IAAU,gBAAgB,CAAA;AAExD,EAAA,OAAO,MAAA;AACX;AAKA,eAAsB,eAAA,CAClB,QAAA,EACA,UAAA,EACA,MAAA,GAAmB,cAAA,EACE;AACrB,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAE7C,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,QAAA,EAAU,UAAA,EAAY,YAAY,MAAA,CAAO,MAAA,IAAU,8BAA8B,CAAA;AAE5F,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACjD,IAAA,IAAI;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,QAAQ,CAAA;AAEjC,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,QAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC7B,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,QACrC,GAAG,GAAK,CAAA;AAER,QAAA,EAAA,CAAG,SAAS,MAAM;AACd,UAAA,MAAM,cAAA,GAAiB,CAAA,cAAA,EAAiB,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA;AAClD,UAAA,EAAA,CAAG,IAAA;AAAA,YACC,KAAK,SAAA,CAAU;AAAA,cACX,KAAA;AAAA,cACA,cAAA;AAAA,cACA;AAAA,gBACI,KAAA,EAAO,CAAC,KAAK,CAAA;AAAA,gBACb,IAAA,EAAM,CAAC,WAAW,CAAA;AAAA,gBAClB,KAAA,EAAO;AAAA;AACX,aACH;AAAA,WACL;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,SAAA,GAAY,CAAC,GAAA,KAAQ;AACpB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAChC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,EAAS;AACrB,cAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,YACvB,CAAA,MAAA,IAAW,IAAA,CAAK,CAAC,CAAA,KAAM,MAAA,EAAQ;AAC3B,cAAA,YAAA,CAAa,OAAO,CAAA;AACpB,cAAA,EAAA,CAAG,KAAA,EAAM;AACT,cAAA,OAAA,EAAQ;AAAA,YACZ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,UACtE;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,OAAA,GAAU,CAAC,GAAA,KAAQ;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,8BAA8B,CAAA;AACzE,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,IACtE;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,aAAa,CAAA;AAEtC,EAAA,GAAA,CAAI,KAAK,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,IAAU,gBAAgB,CAAA;AAExD,EAAA,OAAO,MAAA;AACX;AAMA,eAAsB,0BAA0B,QAAA,EAAiD;AAC7F,EAAA,IAAI;AAEA,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA;AAC5C,IAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAC7D,IAAA,MAAM,YAAY,KAAA,CAAM,IAAA,CAAK,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AACvD,IAAA,MAAM,UAAA,GAAa,SAAA,CAAU,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAEhF,IAAA,OAAO,eAAe,QAAA,CAAS,cAAA;AAAA,EACnC,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAA,CAAM,EAAE,KAAA,EAAO,GAAA,IAAO,uCAAuC,CAAA;AACjE,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAKO,SAAS,0BAA0B,KAAA,EAA+C;AACrF,EAAA,IAAI;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA;AACzC,IAAA,OAAO,QAAA;AAAA,EACX,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAA,CAAM,EAAE,OAAA,EAAS,KAAA,CAAM,IAAI,KAAA,EAAO,GAAA,IAAO,wCAAwC,CAAA;AACrF,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;;;ACrdA,IAAMA,IAAAA,GAAM,aAAa,kBAAkB,CAAA;AA+CpC,SAAS,gBAAA,GAA4B;AACxC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,OAAO,CAAC,CAAE,MAAA,CAAuD,KAAA;AACrE;AA2BA,eAAsB,eAClB,KAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,kBAAiB,EAAG;AACrB,IAAAA,IAAAA,CAAI,KAAK,gCAAgC,CAAA;AACzC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,QAAS,MAAA,CAAuD,KAAA;AAGtE,IAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,SAAA,CAAU,KAAK,CAAA;AAE/C,IAAAA,KAAI,IAAA,CAAK,EAAE,SAAS,WAAA,CAAY,EAAA,IAAM,gCAAgC,CAAA;AAEtE,IAAA,OAAO,WAAA;AAAA,EACX,SAAS,GAAA,EAAK;AACV,IAAAA,KAAI,KAAA,CAAM,EAAE,KAAA,EAAO,GAAA,IAAO,4BAA4B,CAAA;AACtD,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;;;AChGA,IAAMA,IAAAA,GAAM,aAAa,iBAAiB,CAAA;AA2DnC,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACxC,WAAA,CACI,SACgB,IAAA,EAClB;AACE,IAAA,KAAA,CAAM,OAAO,CAAA;AAFG,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGhB,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AAAA,EAChB;AACJ;AAoBA,eAAsB,kBAClB,OAAA,EAC4B;AAC5B,EAAA,MAAM,EAAE,OAAA,EAAS,SAAA,EAAW,MAAA,EAAQ,OAAA,EAAS,UAAA,GAAa,EAAC,EAAG,UAAA,GAAa,EAAC,EAAE,GAAI,OAAA;AAElF,EAAAA,IAAAA,CAAI,KAAK,EAAE,OAAA,EAAS,eAAe,UAAA,CAAW,MAAA,IAAU,sBAAsB,CAAA;AAE9E,EAAA,MAAM,WAAW,MAAM,yBAAA;AAAA,IACnB,OAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACJ;AAGA,EAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B,QAAQ,CAAA;AACxD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,gBAAA;AAAA,MACN,6CAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAEA,EAAAA,KAAI,IAAA,CAAK,EAAE,eAAe,QAAA,CAAS,cAAA,IAAkB,kCAAkC,CAAA;AAEvF,EAAA,OAAO,QAAA;AACX;AAqBA,eAAsB,mBAClB,OAAA,EACsB;AACtB,EAAA,MAAM,EAAE,QAAA,EAAU,IAAA,EAAM,MAAA,GAAS,gBAAe,GAAI,OAAA;AAEpD,EAAAA,IAAAA,CAAI,IAAA;AAAA,IACA,EAAE,aAAA,EAAe,QAAA,CAAS,cAAA,EAAgB,UAAA,EAAY,OAAO,MAAA,EAAO;AAAA,IACpE;AAAA,GACJ;AAGA,EAAA,MAAM,aAAA,GAAgB,sBAAA,CAAuB,QAAA,EAAU,IAAI,CAAA;AAM3D,EAAA,IAAI,CAAC,kBAAiB,EAAG;AACrB,IAAAA,IAAAA,CAAI,KAAK,kDAA6C,CAAA;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN;AAAA,KACJ;AAAA,EACJ;AAEA,EAAAA,IAAAA,CAAI,KAAK,4BAA4B,CAAA;AACrC,EAAA,MAAM,WAAA,GAAc,MAAM,cAAA,CAAe,aAAa,CAAA;AACtD,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,WAAA,EAAa,MAAM,CAAA;AAExD,EAAAA,IAAAA,CAAI,IAAA;AAAA,IACA;AAAA,MACI,eAAe,QAAA,CAAS,cAAA;AAAA,MACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,MAAA;AAAA,MAC7B,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,KAC/B;AAAA,IACA;AAAA,GACJ;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,eAAsB,qBAClB,OAAA,EAC8B;AAC9B,EAAA,MAAM,EAAE,aAAA,EAAe,OAAA,EAAS,QAAA,EAAU,MAAA,GAAS,gBAAe,GAAI,OAAA;AAEtE,EAAA,IAAI,SAAuB,EAAC;AAE5B,EAAA,IAAI,aAAA,EAAe;AACf,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,aAAA,IAAiB,+BAA+B,CAAA;AAC3D,IAAA,MAAA,GAAS,MAAM,oBAAA,CAAqB,aAAA,EAAe,MAAM,CAAA;AAAA,EAC7D,WAAW,OAAA,EAAS;AAChB,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,OAAA,IAAW,gCAAgC,CAAA;AACtD,IAAA,MAAA,GAAS,MAAM,cAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,EACjD,WAAW,QAAA,EAAU;AACjB,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,QAAA,IAAY,yBAAyB,CAAA;AAChD,IAAA,MAAA,GAAS,MAAM,eAAA,CAAgB,QAAA,CAAS,QAAA,EAAU,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACjF,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAGA,EAAA,MAAM,YAAmC,EAAC;AAC1C,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AACxB,IAAA,MAAM,QAAA,GAAW,0BAA0B,KAAK,CAAA;AAChD,IAAA,IAAI,QAAA,EAAU;AAEV,MAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B,QAAQ,CAAA;AACxD,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,SAAA,CAAU,KAAK,QAAQ,CAAA;AAAA,MAC3B,CAAA,MAAO;AACH,QAAAA,IAAAA,CAAI,IAAA;AAAA,UACA,EAAE,aAAA,EAAe,QAAA,CAAS,cAAA,EAAe;AAAA,UACzC;AAAA,SACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,EAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,UAAA,EAAY,MAAA,CAAO,QAAQ,UAAA,EAAY,SAAA,CAAU,MAAA,EAAO,EAAG,oBAAoB,CAAA;AAE1F,EAAA,OAAO,SAAA;AACX;AAKA,eAAsB,qBAAA,CAClB,aAAA,EACA,MAAA,GAAmB,cAAA,EACgB;AACnC,EAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,aAAA,IAAiB,6BAA6B,CAAA;AAEzD,EAAA,MAAM,YAAY,MAAM,oBAAA,CAAqB,EAAE,aAAA,EAAe,QAAQ,CAAA;AAEtE,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AACxB,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,aAAA,IAAiB,oCAAoC,CAAA;AAChE,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACtB,IAAAA,IAAAA,CAAI,IAAA;AAAA,MACA,EAAE,aAAA,EAAe,KAAA,EAAO,SAAA,CAAU,MAAA,EAAO;AAAA,MACzC;AAAA,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,SAAA,CAAU,CAAC,CAAA,IAAK,IAAA;AAC3B;AAKA,eAAsB,yBAAA,CAClB,OAAA,EACA,MAAA,GAAmB,cAAA,EACW;AAC9B,EAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,OAAA,IAAW,sCAAsC,CAAA;AAC5D,EAAA,OAAO,oBAAA,CAAqB,EAAE,OAAA,EAAS,MAAA,EAAQ,CAAA;AACnD;AAKA,eAAsB,0BAAA,CAClB,QAAA,EACA,UAAA,EACA,MAAA,GAAmB,cAAA,EACW;AAC9B,EAAAA,KAAI,IAAA,CAAK,EAAE,QAAA,EAAU,UAAA,IAAc,uCAAuC,CAAA;AAC1E,EAAA,OAAO,oBAAA,CAAqB,EAAE,QAAA,EAAU,EAAE,UAAU,UAAA,EAAW,EAAG,QAAQ,CAAA;AAC9E;AAMO,SAAS,2BAA2B,UAAA,EAAuC;AAC9E,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,CAAC,EAAA,KAAO,CAAA,EAAG,EAAA,CAAG,QAAQ,CAAA,CAAA,EAAI,EAAA,CAAG,UAAU,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAC9E;AAOO,SAAS,kBAAA,CACZ,aAAA,EACA,OAAA,GAAU,wBAAA,EACJ;AACN,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,QAAA,EAAW,aAAa,CAAA,CAAA;AAC7C;AAOO,SAAS,4BAA4B,GAAA,EAA4B;AACpE,EAAA,IAAI;AACA,IAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,GAAG,CAAA;AAErB,IAAA,MAAM,CAAA,GAAI,CAAA,CAAE,QAAA,CAAS,KAAA,CAAM,gCAAgC,CAAA;AAC3D,IAAA,IAAI,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,EAAG,WAAA,EAAY;AAEhC,IAAA,MAAM,CAAA,GAAI,CAAA,CAAE,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACjC,IAAA,IAAI,KAAK,iBAAA,CAAkB,IAAA,CAAK,CAAC,CAAA,EAAG,OAAO,EAAE,WAAA,EAAY;AACzD,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ","file":"attestation.mjs","sourcesContent":["/*\n Canonical message builder per SPEC.md §2\n \n - LF line endings, exactly one trailing LF\n * - 7 fixed core lines in strict order and wording\n * - Optional extensions appended as key: value with lexicographically sorted lowercase keys\n /\n\nimport type { AttestationEnvelope, IdentityBinding, Scheme } from './types';\n\n/\n Input for building a canonical message\n /\nexport interface CanonicalInput {\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n}\n\n/\n Extension key-value pairs for canonical message\n /\nexport type Extensions = Record<string, string \| undefined>;\n\n/\n Convert bytes to lowercase hex string\n * @param bytes - Byte array to convert\n * @returns Lowercase hex string\n /\nfunction toLowerHex(bytes: Uint8Array): string {\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n}\n\n/\n Generate a random 16-byte nonce as lowercase hex\n * Uses Web Crypto API when available, falls back to Math.random()\n * @returns 32-character lowercase hex string\n /\nexport function randomNonce16BHexLower(): string {\n const arr = new Uint8Array(16);\n\n try {\n if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {\n crypto.getRandomValues(arr);\n return toLowerHex(arr);\n }\n } catch {\n // Fall through to non-cryptographic fallback\n }\n\n // No silent Math.random fallback: a nonce is a load-bearing security\n // primitive. A deployment without `crypto.getRandomValues` MUST fix its\n // environment rather than sign with weak randomness.\n throw new Error('crypto.getRandomValues unavailable — refusing to mint a weak nonce');\n}\n\n/\n Reject characters that would break the line-oriented canonical grammar\n * or the comma-separated identities list. If any of these slipped through,\n * an attacker could smuggle a forged `address:` or extension line into the\n * signed payload: `identities: alice\\naddress: bc1qEVIL…` would parse as a\n * second address line. Catch it at the boundary, not at verification time.\n \n Also rejects a colon in the identifier so a bad actor can't turn\n * `github:alice:extra` into a different protocol binding on parse.\n /\nconst IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]$/;\nconst IDENTITY_FORBIDDEN_CHARS = /[\\r\\n,]/;\n\nfunction assertSafeIdentity({ protocol, identifier }: IdentityBinding): void {\n if (!IDENTITY_PROTOCOL_RE.test(protocol)) {\n throw new Error(\n `invalid identity protocol: ${JSON.stringify(protocol)} — must match /^[a-z][a-z0-9_-]$/`\n );\n }\n if (!identifier \|\| IDENTITY_FORBIDDEN_CHARS.test(identifier)) {\n throw new Error(\n `invalid identity identifier: ${JSON.stringify(identifier)} — must be non-empty and contain no newlines or commas`\n );\n }\n}\n\n/\n Format identities as comma-separated protocol:identifier pairs, sorted lexicographically\n * @param identities - Array of identity bindings\n * @returns Comma-separated string of protocol:identifier pairs\n /\nexport function formatIdentities(identities: IdentityBinding[] = []): string {\n if (identities.length === 0) {\n return '';\n }\n for (const id of identities) assertSafeIdentity(id);\n\n // Format as protocol:identifier and sort lexicographically\n const formatted = identities\n .map(({ protocol, identifier }) => `${protocol}:${identifier}`)\n .sort();\n\n return formatted.join(',');\n}\n\n/\n Parse identities from comma-separated protocol:identifier format\n * @param identitiesStr - Comma-separated identity string\n * @returns Array of identity bindings\n * @throws {Error} If identity format is invalid\n /\nexport function parseIdentities(identitiesStr: string): IdentityBinding[] {\n if (!identitiesStr \|\| identitiesStr.trim() === '') {\n return [];\n }\n // The identities field lives on one line of the canonical message. If it\n // contains a raw LF/CR, it's either corrupt or an attempt to smuggle a\n // fake core line into the parser. Refuse instead of trying to recover.\n if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ''))) {\n throw new Error('identities field contains forbidden characters (newline)');\n }\n\n const bindings = identitiesStr.split(',').map((binding) => {\n const colonIndex = binding.indexOf(':');\n if (colonIndex === -1) {\n throw new Error(`Invalid identity binding format: ${binding}`);\n }\n return {\n protocol: binding.substring(0, colonIndex).trim(),\n identifier: binding.substring(colonIndex + 1).trim(),\n };\n });\n\n for (const b of bindings) {\n if (!b.protocol \|\| !b.identifier) {\n throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);\n }\n assertSafeIdentity(b);\n }\n return bindings;\n}\n\n/\n Optional deterministic overrides for message building. Only intended for\n * tests / conformance vectors; production callers should let the builder\n * mint a fresh nonce + timestamp per message.\n /\nexport interface BuildOptions {\n /* 32-char lowercase hex. Default: freshly-generated cryptographic nonce. /\n nonce?: string;\n /* RFC-3339 UTC. Default: `new Date().toISOString()`. /\n issuedAt?: string;\n}\n\n/\n Build a canonical message following OrangeCheck Protocol v0 specification\n * @param input - Canonical input with address and identities\n * @param extensions - Optional extension key-value pairs\n * @param options - Optional deterministic overrides (testing only)\n * @returns Canonical message string with LF line endings\n /\nexport function buildCanonicalMessage(\n { address, identities }: CanonicalInput,\n extensions: Extensions = {},\n options: BuildOptions = {}\n): string {\n const nonce = options.nonce ?? randomNonce16BHexLower();\n if (!/^[0-9a-f]{32}$/.test(nonce)) {\n throw new Error(`invalid nonce: must be 32 lowercase hex chars`);\n }\n const issuedAt = options.issuedAt ?? new Date().toISOString();\n\n // Format identities\n const identitiesStr = formatIdentities(identities);\n\n // Core (strict wording + order per SPEC.md §2)\n const core = [\n 'orangecheck',\n `identities: ${identitiesStr}`,\n `address: ${address}`,\n 'purpose: portable reputation attestation (non-custodial)',\n `nonce: ${nonce}`,\n `issued_at: ${issuedAt}`,\n 'ack: I attest control of this address and bind it to my identities.',\n ];\n\n // Normalize and sort extensions\n const normExt: Record<string, string> = {};\n for (const [k, v] of Object.entries(extensions)) {\n if (v == null \|\| v === '') {\n continue;\n }\n const key = k.toLowerCase();\n normExt[key] = String(v);\n }\n\n const extLines = Object.keys(normExt)\n .sort()\n .map((k) => `${k}: ${normExt[k]!}`);\n\n const all = [...core, ...extLines];\n\n // Join with LF and ensure exactly one trailing LF\n return all.join('\\n') + '\\n';\n}\n\n/\n Generate attestation ID from canonical message\n \n attestation_id = SHA-256(canonical_message)\n \n @param message - Canonical message string\n * @returns Lowercase hex SHA-256 hash\n /\nexport async function generateAttestationId(message: string): Promise<string> {\n // Convert message to UTF-8 bytes\n const encoder = new TextEncoder();\n const data = encoder.encode(message);\n\n // Compute SHA-256 hash\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n return toLowerHex(new Uint8Array(hashBuffer));\n}\n\n/\n Create an attestation envelope for publishing\n \n This wraps the canonical message with metadata for Nostr publishing\n \n @param message - Canonical message\n * @param signature - BIP-322 or legacy signature\n * @param scheme - Signature scheme used\n * @param address - Bitcoin address\n * @param identities - Identity bindings\n * @param extensions - Optional extensions\n * @returns Attestation envelope ready for publishing\n /\nexport async function createAttestationEnvelope(\n message: string,\n signature: string,\n scheme: Scheme,\n address: string,\n identities: IdentityBinding[],\n extensions: Extensions = {}\n): Promise<AttestationEnvelope> {\n const attestation_id = await generateAttestationId(message);\n\n // Extract issued_at from message\n const issuedAtMatch = message.match(/issued_at: ([^\\n]+)/);\n const issued_at = issuedAtMatch?.[1] ?? new Date().toISOString();\n\n // Extract expires from extensions if present\n const expires_at = extensions.expires;\n\n // Extract relay hints from extensions if present\n const relay_hints = extensions.relay_hints?.split(',').map((r) => r.trim());\n\n // Extract publish targets from extensions if present\n const publish_targets = extensions.publish?.split(',').map((t) => t.trim());\n\n // Base64url encode the message\n const encoder = new TextEncoder();\n const messageBytes = encoder.encode(message);\n const base64 = btoa(String.fromCharCode(...messageBytes));\n const message_b64url = base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n\n // Construct verification URL\n const verification_url = `https://attest.ochk.io/attest/${attestation_id}`;\n\n return {\n attestation_id,\n scheme,\n address,\n identities,\n message,\n message_b64url,\n signature,\n issued_at,\n expires_at,\n verification_url,\n publish_targets,\n relay_hints,\n };\n}\n","/\n Simple logger for SDK\n * Can be disabled in production builds\n /\n\n/\n Log level type\n /\nexport type LogLevel = 'debug' \| 'info' \| 'warn' \| 'error' \| 'none';\n\n/\n Logger context type\n /\nexport type LogContext = Record<string, unknown>;\n\n/\n Logger interface\n /\nexport interface Logger {\n debug: (contextOrMessage: string \| LogContext, message?: string) => void;\n info: (contextOrMessage: string \| LogContext, message?: string) => void;\n warn: (contextOrMessage: string \| LogContext, message?: string) => void;\n error: (contextOrMessage: string \| LogContext, message?: string) => void;\n}\n\nlet logLevel: LogLevel = 'none';\n\n/\n Set the global log level\n * @param level - Log level to set\n /\nexport function setLogLevel(level: LogLevel): void {\n logLevel = level;\n}\n\n/\n Get the current log level\n * @returns Current log level\n /\nexport function getLogLevel(): LogLevel {\n return logLevel;\n}\n\n/\n Create a namespaced logger\n * @param namespace - Logger namespace\n * @returns Logger instance\n /\nexport function createLogger(namespace: string): Logger {\n const shouldLog = (level: Exclude<LogLevel, 'none'>): boolean => {\n if (logLevel === 'none') return false;\n\n const levels: Exclude<LogLevel, 'none'>[] = ['debug', 'info', 'warn', 'error'];\n const currentLevelIndex = levels.indexOf(logLevel as Exclude<LogLevel, 'none'>);\n const messageLevelIndex = levels.indexOf(level);\n\n return messageLevelIndex >= currentLevelIndex;\n };\n\n const formatMessage = (msg: string): string => `[${namespace}] ${msg}`;\n\n return {\n debug: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('debug')) {\n if (typeof contextOrMessage === 'string') {\n console.debug(formatMessage(contextOrMessage));\n } else {\n console.debug(formatMessage(message ?? 'Debug'), contextOrMessage);\n }\n }\n },\n info: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('info')) {\n if (typeof contextOrMessage === 'string') {\n console.info(formatMessage(contextOrMessage));\n } else {\n console.info(formatMessage(message ?? 'Info'), contextOrMessage);\n }\n }\n },\n warn: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('warn')) {\n if (typeof contextOrMessage === 'string') {\n console.warn(formatMessage(contextOrMessage));\n } else {\n console.warn(formatMessage(message ?? 'Warning'), contextOrMessage);\n }\n }\n },\n error: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('error')) {\n if (typeof contextOrMessage === 'string') {\n console.error(formatMessage(contextOrMessage));\n } else {\n console.error(formatMessage(message ?? 'Error'), contextOrMessage);\n }\n }\n },\n };\n}\n\n/\n Log verification error\n * @param protocol - Identity protocol\n * @param identifier - Identity identifier\n * @param error - Error object\n * @param context - Additional context\n /\nexport function logVerificationError(\n protocol: string,\n identifier: string,\n error: Error,\n context?: LogContext\n): void {\n const logger = createLogger('identity-verification');\n logger.error(\n {\n protocol,\n identifier,\n error: error.message,\n stack: error.stack,\n ...context,\n },\n 'Verification failed'\n );\n}\n","/\n Nostr Integration for OrangeCheck Protocol\n \n Implements NIP-78 (Application-specific data) for attestation publishing\n /\n\nimport type { AttestationEnvelope, IdentityBinding, NostrEvent } from './types';\n\nimport { createLogger } from './utils/logger';\n\nconst log = createLogger('ocp/nostr');\n\n/\n NIP-78 event kind for OrangeCheck attestations\n /\nexport const ATTESTATION_EVENT_KIND = 30078;\n\n/\n Default Nostr relays for OrangeCheck attestation publishing\n \n These are well-known, reliable relays with good uptime\n /\nexport const DEFAULT_RELAYS: string[] = [\n 'wss://relay.damus.io',\n 'wss://relay.nostr.band',\n 'wss://nos.lol',\n 'wss://relay.snort.social',\n];\n\n/\n Create a NIP-78 event for an OrangeCheck attestation\n \n Kind: 30078 (Parameterized Replaceable Event)\n * d-tag: attestation_id (makes it replaceable by attestation ID)\n \n @param envelope - Attestation envelope\n * @param pubkey - Nostr public key (hex format)\n * @returns Unsigned Nostr event\n /\nexport function createAttestationEvent(\n envelope: AttestationEnvelope,\n pubkey: string\n): Omit<NostrEvent, 'id' \| 'sig'> {\n const tags: string[][] = [\n ['d', envelope.attestation_id], // Parameterized replaceable event identifier\n ['address', envelope.address], // Bitcoin address\n ['scheme', envelope.scheme], // Signature scheme (bip322 or legacy)\n ['issued_at', envelope.issued_at], // ISO timestamp\n ];\n\n // Add identity tags\n for (const identity of envelope.identities) {\n tags.push(['i', `${identity.protocol}:${identity.identifier}`]);\n }\n\n // Add expiration if present\n if (envelope.expires_at) {\n tags.push(['expires', envelope.expires_at]);\n }\n\n // Add relay hints if present\n if (envelope.relay_hints?.length) {\n for (const relay of envelope.relay_hints) {\n tags.push(['relay', relay]);\n }\n }\n\n // Content is the full attestation envelope as JSON\n const content = JSON.stringify(envelope, null, 2);\n\n return {\n kind: ATTESTATION_EVENT_KIND,\n tags,\n content,\n created_at: Math.floor(Date.parse(envelope.issued_at) / 1000),\n pubkey,\n };\n}\n\n/\n Parse identity bindings from Nostr event tags\n \n @param event - Nostr event\n * @returns Array of identity bindings\n /\nexport function parseIdentitiesFromEvent(event: NostrEvent): IdentityBinding[] {\n const identities: IdentityBinding[] = [];\n\n for (const tag of event.tags) {\n if (tag[0] === 'i' && tag[1]) {\n const colonIndex = tag[1].indexOf(':');\n if (colonIndex !== -1) {\n identities.push({\n protocol: tag[1].substring(0, colonIndex),\n identifier: tag[1].substring(colonIndex + 1),\n });\n }\n }\n }\n\n return identities;\n}\n\n/\n Extract attestation ID from Nostr event d-tag\n \n @param event - Nostr event\n * @returns Attestation ID or undefined if not found\n /\nexport function getAttestationIdFromEvent(event: NostrEvent): string \| undefined {\n const dTag = event.tags.find((tag) => tag[0] === 'd');\n return dTag?.[1];\n}\n\n/\n Extract Bitcoin address from Nostr event tags\n \n @param event - Nostr event\n * @returns Bitcoin address or undefined if not found\n /\nexport function getAddressFromEvent(event: NostrEvent): string \| undefined {\n const addressTag = event.tags.find((tag) => tag[0] === 'address');\n return addressTag?.[1];\n}\n\n/\n Publish a Nostr event to multiple relays\n * Returns array of relay URLs that successfully accepted the event\n /\nexport async function publishToRelays(\n event: NostrEvent,\n relays: string[] = DEFAULT_RELAYS\n): Promise<{ success: string[]; failed: string[] }> {\n const success: string[] = [];\n const failed: string[] = [];\n\n log.info({ eventId: event.id, relayCount: relays.length }, 'Publishing event to relays');\n\n const publishPromises = relays.map(async (relayUrl) => {\n let ws: WebSocket \| null = null;\n\n try {\n // Connect to relay\n ws = new WebSocket(relayUrl);\n const wsRef = ws; // Capture for closures\n\n await new Promise<void>((resolve, reject) => {\n // One outer deadline covers connect + OK round-trip. The old\n // code cleared this on `onopen`, which meant a relay that\n // opened but never sent OK would hang the promise forever.\n const deadline = setTimeout(() => {\n wsRef.close();\n reject(new Error('Relay publish timeout'));\n }, 10_000);\n\n const cleanup = () => {\n clearTimeout(deadline);\n wsRef.close();\n };\n\n wsRef.onopen = () => {\n // Do NOT clear the deadline — we still need it in case\n // the relay never responds with OK.\n wsRef.send(JSON.stringify(['EVENT', event]));\n };\n\n wsRef.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n // Check for OK response\n if (data[0] === 'OK' && data[1] === event.id) {\n if (data[2] === true) {\n success.push(relayUrl);\n cleanup();\n resolve();\n } else {\n log.warn(\n { relay: relayUrl, reason: data[3] },\n 'Relay rejected event'\n );\n failed.push(relayUrl);\n cleanup();\n reject(new Error(data[3] \|\| 'Relay rejected event'));\n }\n }\n } catch (err) {\n log.error(\n { relay: relayUrl, error: err },\n 'Failed to parse relay response'\n );\n failed.push(relayUrl);\n cleanup();\n reject(err);\n }\n };\n\n wsRef.onerror = (err) => {\n log.error({ relay: relayUrl, error: err }, 'WebSocket error');\n failed.push(relayUrl);\n cleanup();\n reject(err);\n };\n\n wsRef.onclose = () => {\n // Socket closed before we resolved/rejected — counts as\n // failure. clearTimeout here is safe (cleanup handles both).\n clearTimeout(deadline);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to publish to relay');\n if (!failed.includes(relayUrl)) {\n failed.push(relayUrl);\n }\n } finally {\n // Ensure WebSocket is closed\n if (ws && ws.readyState !== WebSocket.CLOSED) {\n ws.close();\n }\n }\n });\n\n await Promise.allSettled(publishPromises);\n\n log.info({ successCount: success.length, failedCount: failed.length }, 'Publishing complete');\n\n return { success, failed };\n}\n\n/\n Query relays for attestations by attestation ID\n /\nexport async function queryByAttestationId(\n attestationId: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<NostrEvent[]> {\n const events: NostrEvent[] = [];\n\n log.info({ attestationId, relayCount: relays.length }, 'Querying relays for attestation');\n\n const queryPromises = relays.map(async (relayUrl) => {\n let ws: WebSocket \| null = null;\n\n try {\n ws = new WebSocket(relayUrl);\n const wsRef = ws; // Capture for closures\n\n await new Promise<void>((resolve, reject) => {\n const timeout = setTimeout(() => {\n wsRef.close();\n reject(new Error('Query timeout'));\n }, 10000);\n\n const cleanup = () => {\n clearTimeout(timeout);\n wsRef.close();\n };\n\n wsRef.onopen = () => {\n // Send REQ message for kind 30078 with d-tag = attestation_id\n const subscriptionId = `ochk_${Date.now()}`;\n wsRef.send(\n JSON.stringify([\n 'REQ',\n subscriptionId,\n {\n kinds: [30078],\n '#d': [attestationId],\n limit: 1,\n },\n ])\n );\n };\n\n wsRef.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n if (data[0] === 'EVENT') {\n events.push(data[2]);\n } else if (data[0] === 'EOSE') {\n cleanup();\n resolve();\n }\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to parse event');\n }\n };\n\n wsRef.onerror = (err) => {\n log.error({ relay: relayUrl, error: err }, 'WebSocket error during query');\n cleanup();\n reject(err);\n };\n\n wsRef.onclose = () => {\n clearTimeout(timeout);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to query relay');\n } finally {\n // Ensure WebSocket is closed\n if (ws && ws.readyState !== WebSocket.CLOSED) {\n ws.close();\n }\n }\n });\n\n await Promise.allSettled(queryPromises);\n\n log.info({ eventCount: events.length }, 'Query complete');\n\n return events;\n}\n\n/\n Query relays for attestations by Bitcoin address\n /\nexport async function queryByAddress(\n address: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<NostrEvent[]> {\n const events: NostrEvent[] = [];\n\n log.info({ address, relayCount: relays.length }, 'Querying relays for address');\n\n const queryPromises = relays.map(async (relayUrl) => {\n try {\n const ws = new WebSocket(relayUrl);\n\n await new Promise<void>((resolve, reject) => {\n const timeout = setTimeout(() => {\n ws.close();\n reject(new Error('Query timeout'));\n }, 10000);\n\n ws.onopen = () => {\n const subscriptionId = `ochk_addr_${Date.now()}`;\n ws.send(\n JSON.stringify([\n 'REQ',\n subscriptionId,\n {\n kinds: [30078],\n '#address': [address],\n limit: 10,\n },\n ])\n );\n };\n\n ws.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n if (data[0] === 'EVENT') {\n events.push(data[2]);\n } else if (data[0] === 'EOSE') {\n clearTimeout(timeout);\n ws.close();\n resolve();\n }\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to parse event');\n }\n };\n\n ws.onerror = (err) => {\n clearTimeout(timeout);\n log.error({ relay: relayUrl, error: err }, 'WebSocket error during query');\n reject(err);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to query relay');\n }\n });\n\n await Promise.allSettled(queryPromises);\n\n log.info({ eventCount: events.length }, 'Query complete');\n\n return events;\n}\n\n/\n Query relays for attestations by identity (any protocol)\n /\nexport async function queryByIdentity(\n protocol: string,\n identifier: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<NostrEvent[]> {\n const events: NostrEvent[] = [];\n const identityTag = `${protocol}:${identifier}`;\n\n log.info({ protocol, identifier, relayCount: relays.length }, 'Querying relays for identity');\n\n const queryPromises = relays.map(async (relayUrl) => {\n try {\n const ws = new WebSocket(relayUrl);\n\n await new Promise<void>((resolve, reject) => {\n const timeout = setTimeout(() => {\n ws.close();\n reject(new Error('Query timeout'));\n }, 10000);\n\n ws.onopen = () => {\n const subscriptionId = `ochk_identity_${Date.now()}`;\n ws.send(\n JSON.stringify([\n 'REQ',\n subscriptionId,\n {\n kinds: [30078],\n '#i': [identityTag],\n limit: 10,\n },\n ])\n );\n };\n\n ws.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n if (data[0] === 'EVENT') {\n events.push(data[2]);\n } else if (data[0] === 'EOSE') {\n clearTimeout(timeout);\n ws.close();\n resolve();\n }\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to parse event');\n }\n };\n\n ws.onerror = (err) => {\n clearTimeout(timeout);\n log.error({ relay: relayUrl, error: err }, 'WebSocket error during query');\n reject(err);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to query relay');\n }\n });\n\n await Promise.allSettled(queryPromises);\n\n log.info({ eventCount: events.length }, 'Query complete');\n\n return events;\n}\n\n/\n Verify attestation envelope integrity\n * Checks that the attestation ID matches the message hash\n /\nexport async function verifyAttestationEnvelope(envelope: AttestationEnvelope): Promise<boolean> {\n try {\n // Re-compute attestation ID from message\n const encoder = new TextEncoder();\n const data = encoder.encode(envelope.message);\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n const computedId = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');\n\n return computedId === envelope.attestation_id;\n } catch (err) {\n log.error({ error: err }, 'Failed to verify attestation envelope');\n return false;\n }\n}\n\n/\n Parse attestation envelope from Nostr event content\n /\nexport function parseAttestationFromEvent(event: NostrEvent): AttestationEnvelope \| null {\n try {\n const envelope = JSON.parse(event.content) as AttestationEnvelope;\n return envelope;\n } catch (err) {\n log.error({ eventId: event.id, error: err }, 'Failed to parse attestation from event');\n return null;\n }\n}\n","/\n Nostr Cryptographic Functions\n * Implements NIP-01 event ID computation and signature verification\n /\n\nimport type { NostrEvent } from './types';\n\nimport { createLogger } from './utils/logger';\n\ntype Nip07Window = {\n nostr?: {\n getPublicKey: () => Promise<string>;\n signEvent: (event: Omit<NostrEvent, 'id' \| 'sig'>) => Promise<NostrEvent>;\n _metadata?: { name?: string; version?: string };\n };\n};\n\nconst log = createLogger('ocp/nostr-crypto');\n\n/\n Compute Nostr event ID according to NIP-01\n * Event ID is the SHA-256 hash of the serialized event\n * Serialization: [0, pubkey, created_at, kind, tags, content]\n /\nexport async function computeNostrEventId(event: Omit<NostrEvent, 'id' \| 'sig'>): Promise<string> {\n // Serialize event according to NIP-01\n const serialized = JSON.stringify([\n 0, // Reserved for future use\n event.pubkey,\n event.created_at,\n event.kind,\n event.tags,\n event.content,\n ]);\n\n log.debug({ serialized }, 'Computing event ID');\n\n // Compute SHA-256 hash\n const encoder = new TextEncoder();\n const data = encoder.encode(serialized);\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n const hashHex = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');\n\n log.debug({ eventId: hashHex }, 'Computed event ID');\n\n return hashHex;\n}\n\n/\n Verify Nostr event ID\n * Recomputes the ID and checks if it matches\n /\nexport async function verifyNostrEventId(event: NostrEvent): Promise<boolean> {\n const computedId = await computeNostrEventId(event);\n return computedId === event.id;\n}\n\n/\n Check if NIP-07 extension is available\n * NIP-07 provides window.nostr for signing events\n /\nexport function isNip07Available(): boolean {\n if (typeof window === 'undefined') {\n return false;\n }\n\n return !!(window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n}\n\n/\n Get Nostr public key from NIP-07 extension\n * Returns null if extension not available or user denies\n /\nexport async function getNostrPublicKey(): Promise<string \| null> {\n if (!isNip07Available()) {\n log.warn('NIP-07 extension not available');\n return null;\n }\n\n try {\n const nostr = (window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n const pubkey = await nostr.getPublicKey();\n log.info({ pubkey }, 'Got Nostr public key from NIP-07');\n return pubkey;\n } catch (err) {\n log.error({ error: err }, 'Failed to get Nostr public key');\n return null;\n }\n}\n\n/\n Sign Nostr event using NIP-07 extension\n * Returns signed event with id and sig fields\n /\nexport async function signNostrEvent(\n event: Omit<NostrEvent, 'id' \| 'sig'>\n): Promise<NostrEvent \| null> {\n if (!isNip07Available()) {\n log.warn('NIP-07 extension not available');\n return null;\n }\n\n try {\n const nostr = (window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n\n // NIP-07 signEvent expects the event without id and sig\n const signedEvent = await nostr.signEvent(event);\n\n log.info({ eventId: signedEvent.id }, 'Signed Nostr event with NIP-07');\n\n return signedEvent as NostrEvent;\n } catch (err) {\n log.error({ error: err }, 'Failed to sign Nostr event');\n return null;\n }\n}\n\n// Previously this file exported `generateEphemeralKeypair()` and\n// `signEventWithEphemeralKey()` for demo purposes. Both produced non-schnorr\n// values that Nostr relays would silently reject — creating the false\n// impression that publishing had succeeded. They have been removed. All Nostr\n// signing now flows through `signNostrEvent()` / `window.nostr` (NIP-07).\n\n/\n Validate Nostr event structure\n /\nexport function validateNostrEvent(event: unknown): event is NostrEvent {\n if (typeof event !== 'object' \|\| event === null) return false;\n const e = event as Record<string, unknown>;\n\n if (typeof e.id !== 'string' \|\| (e.id as string).length !== 64) return false;\n if (typeof e.pubkey !== 'string' \|\| (e.pubkey as string).length !== 64) return false;\n if (typeof e.created_at !== 'number') return false;\n if (typeof e.kind !== 'number') return false;\n if (!Array.isArray(e.tags)) return false;\n if (typeof e.content !== 'string') return false;\n if (typeof e.sig !== 'string' \|\| (e.sig as string).length !== 128) return false;\n\n return true;\n}\n\n/\n Get NIP-07 extension info\n /\nexport function getNip07Info(): {\n available: boolean;\n name?: string;\n version?: string;\n} {\n if (!isNip07Available()) {\n return { available: false };\n }\n\n const nostr = (window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n\n return {\n available: true,\n name: nostr._metadata?.name,\n version: nostr._metadata?.version,\n };\n}\n","/\n Attestation Manager\n \n High-level API for creating, publishing, and discovering OrangeCheck attestations\n /\n\nimport type { AttestationEnvelope, IdentityBinding, NostrEvent, Scheme } from './types';\n\nimport { createAttestationEnvelope } from './canonical';\nimport {\n createAttestationEvent,\n DEFAULT_RELAYS,\n parseAttestationFromEvent,\n publishToRelays,\n queryByAddress,\n queryByAttestationId,\n queryByIdentity,\n verifyAttestationEnvelope,\n} from './nostr';\nimport { isNip07Available, signNostrEvent } from './nostr-crypto';\nimport { createLogger } from './utils/logger';\n\nconst log = createLogger('ocp/attestation');\n\n/\n Options for creating an attestation\n /\nexport interface CreateAttestationOptions {\n /* Canonical message /\n message: string;\n /* BIP-322 or legacy signature /\n signature: string;\n /* Signature scheme used /\n scheme: Scheme;\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n /* Optional extension key-value pairs /\n extensions?: Record<string, string \| undefined>;\n}\n\n/\n Options for publishing an attestation to Nostr\n /\nexport interface PublishAttestationOptions {\n /* Attestation envelope to publish /\n envelope: AttestationEnvelope;\n /* Nostr public key (npub or hex) for signing the event /\n npub: string;\n /* Optional relay URLs (defaults to DEFAULT_RELAYS) /\n relays?: string[];\n}\n\n/\n Options for discovering attestations\n /\nexport interface DiscoverAttestationOptions {\n /* Search by attestation ID /\n attestationId?: string;\n /* Search by Bitcoin address /\n address?: string;\n /* Search by identity binding /\n identity?: { protocol: string; identifier: string };\n /* Optional relay URLs to query /\n relays?: string[];\n}\n\n/\n Result of publishing an attestation\n /\nexport interface PublishResult {\n /* Relays that successfully received the event /\n success: string[];\n /* Relays that failed to receive the event /\n failed: string[];\n}\n\n/\n Custom error for attestation operations\n /\nexport class AttestationError extends Error {\n constructor(\n message: string,\n public readonly code?: string\n ) {\n super(message);\n this.name = 'AttestationError';\n }\n}\n\n/\n Create an attestation envelope from a signed message\n \n @param options - Attestation creation options\n * @returns Attestation envelope ready for publishing\n * @throws {AttestationError} If envelope integrity check fails\n \n @example\n * ```typescript\n * const envelope = await createAttestation({\n * message: canonicalMessage,\n * signature: 'AkcwRAIg...',\n * scheme: 'bip322',\n * address: 'bc1q...',\n * identities: [{ protocol: 'nostr', identifier: 'npub1...' }],\n * });\n * ```\n /\nexport async function createAttestation(\n options: CreateAttestationOptions\n): Promise<AttestationEnvelope> {\n const { message, signature, scheme, address, identities = [], extensions = {} } = options;\n\n log.info({ address, identityCount: identities.length }, 'Creating attestation');\n\n const envelope = await createAttestationEnvelope(\n message,\n signature,\n scheme,\n address,\n identities,\n extensions\n );\n\n // Verify envelope integrity\n const isValid = await verifyAttestationEnvelope(envelope);\n if (!isValid) {\n throw new AttestationError(\n 'Attestation envelope integrity check failed',\n 'INTEGRITY_CHECK_FAILED'\n );\n }\n\n log.info({ attestationId: envelope.attestation_id }, 'Attestation created successfully');\n\n return envelope;\n}\n\n/\n Publish an attestation to Nostr relays\n \n Uses NIP-07 if available, falls back to ephemeral key for demo\n \n @param options - Publishing options\n * @returns Object with successful and failed relay URLs\n * @throws {AttestationError} If signing fails\n \n @example\n * ```typescript\n * const result = await publishAttestation({\n * envelope,\n * npub: 'npub1...',\n * relays: ['wss://relay.damus.io'],\n * });\n * console.log('Published to:', result.success);\n * ```\n /\nexport async function publishAttestation(\n options: PublishAttestationOptions\n): Promise<PublishResult> {\n const { envelope, npub, relays = DEFAULT_RELAYS } = options;\n\n log.info(\n { attestationId: envelope.attestation_id, relayCount: relays.length },\n 'Publishing attestation'\n );\n\n // Create unsigned event\n const unsignedEvent = createAttestationEvent(envelope, npub);\n\n // Nostr publishing requires a valid schnorr signature. Only NIP-07\n // (window.nostr) is supported. If no signer is present we refuse to\n // publish rather than emit an invalid-sig event that every relay will\n // silently reject — which would make the caller think it had succeeded.\n if (!isNip07Available()) {\n log.warn('NIP-07 unavailable — skipping Nostr publish');\n throw new Error(\n 'nostr_signer_unavailable: install a NIP-07 extension (e.g. nos2x, Alby) to publish'\n );\n }\n\n log.info('Using NIP-07 to sign event');\n const signedEvent = await signNostrEvent(unsignedEvent);\n if (!signedEvent) {\n throw new Error('nostr_signing_failed: NIP-07 extension rejected or errored');\n }\n\n const result = await publishToRelays(signedEvent, relays);\n\n log.info(\n {\n attestationId: envelope.attestation_id,\n successCount: result.success.length,\n failedCount: result.failed.length,\n },\n 'Publishing complete'\n );\n\n return result;\n}\n\n/\n Discover attestations from Nostr relays\n /\nexport async function discoverAttestations(\n options: DiscoverAttestationOptions\n): Promise<AttestationEnvelope[]> {\n const { attestationId, address, identity, relays = DEFAULT_RELAYS } = options;\n\n let events: NostrEvent[] = [];\n\n if (attestationId) {\n log.info({ attestationId }, 'Discovering by attestation ID');\n events = await queryByAttestationId(attestationId, relays);\n } else if (address) {\n log.info({ address }, 'Discovering by Bitcoin address');\n events = await queryByAddress(address, relays);\n } else if (identity) {\n log.info({ identity }, 'Discovering by identity');\n events = await queryByIdentity(identity.protocol, identity.identifier, relays);\n } else {\n throw new Error('Must provide attestationId, address, or identity');\n }\n\n // Parse and verify envelopes\n const envelopes: AttestationEnvelope[] = [];\n for (const event of events) {\n const envelope = parseAttestationFromEvent(event);\n if (envelope) {\n // Verify envelope integrity\n const isValid = await verifyAttestationEnvelope(envelope);\n if (isValid) {\n envelopes.push(envelope);\n } else {\n log.warn(\n { attestationId: envelope.attestation_id },\n 'Skipping invalid attestation envelope'\n );\n }\n }\n }\n\n log.info({ eventCount: events.length, validCount: envelopes.length }, 'Discovery complete');\n\n return envelopes;\n}\n\n/\n Verify an attestation by fetching it from Nostr and checking integrity\n /\nexport async function verifyAttestationById(\n attestationId: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<AttestationEnvelope \| null> {\n log.info({ attestationId }, 'Verifying attestation by ID');\n\n const envelopes = await discoverAttestations({ attestationId, relays });\n\n if (envelopes.length === 0) {\n log.warn({ attestationId }, 'Attestation not found on any relay');\n return null;\n }\n\n if (envelopes.length > 1) {\n log.warn(\n { attestationId, count: envelopes.length },\n 'Multiple attestations found with same ID - using first'\n );\n }\n\n return envelopes[0] \|\| null;\n}\n\n/\n Get all attestations for a Bitcoin address\n /\nexport async function getAttestationsForAddress(\n address: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<AttestationEnvelope[]> {\n log.info({ address }, 'Getting all attestations for address');\n return discoverAttestations({ address, relays });\n}\n\n/\n Get all attestations for an identity\n /\nexport async function getAttestationsForIdentity(\n protocol: string,\n identifier: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<AttestationEnvelope[]> {\n log.info({ protocol, identifier }, 'Getting all attestations for identity');\n return discoverAttestations({ identity: { protocol, identifier }, relays });\n}\n\n/\n Format identities for display as a comma-separated `protocol:identifier` list.\n * Same wire format the canonical message uses.\n /\nexport function formatIdentitiesForDisplay(identities: IdentityBinding[]): string {\n return identities.map((id) => `${id.protocol}:${id.identifier}`).join(', ');\n}\n\n/\n Build the canonical shareable URL for an attestation. Matches the live\n * `/attest/[id]` route on attest.ochk.io. Pass a different `baseUrl` for forks /\n * self-hosted verifiers.\n /\nexport function getVerificationUrl(\n attestationId: string,\n baseUrl = 'https://attest.ochk.io'\n): string {\n return `${baseUrl}/attest/${attestationId}`;\n}\n\n/\n Reverse of `getVerificationUrl` — pull an attestation id back out of a\n * `/attest/<id>` or legacy `/verify?id=<id>` URL. Returns `null` if the URL\n * shape doesn't match.\n */\nexport function extractAttestationIdFromUrl(url: string): string \| null {\n try {\n const u = new URL(url);\n // New canonical form: /attest/<id>\n const m = u.pathname.match(/^\\/attest\\/([0-9a-f]{64})\\/?$/i);\n if (m) return m[1]!.toLowerCase();\n // Legacy form: /verify?id=<id>\n const q = u.searchParams.get('id');\n if (q && /^[0-9a-f]{64}$/i.test(q)) return q.toLowerCase();\n return null;\n } catch {\n return null;\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/canonical.ts","../src/utils/logger.ts","../src/nostr.ts","../src/nostr-crypto.ts","../src/attestation.ts"],"names":["log"],"mappings":";AA8BA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,OAAO,MAAM,IAAA,CAAK,KAAK,CAAA,CAClB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAChB;AAmLA,eAAsB,sBAAsB,OAAA,EAAkC;AAE1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAGnC,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAG7D,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AAChD;AAeA,eAAsB,yBAAA,CAClB,SACA,SAAA,EACA,MAAA,EACA,SACA,UAAA,EACA,UAAA,GAAyB,EAAC,EACE;AAC5B,EAAA,MAAM,cAAA,GAAiB,MAAM,qBAAA,CAAsB,OAAO,CAAA;AAG1D,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,KAAA,CAAM,qBAAqB,CAAA;AACzD,EAAA,MAAM,YAAY,aAAA,GAAgB,CAAC,sBAAK,IAAI,IAAA,IAAO,WAAA,EAAY;AAG/D,EAAA,MAAM,aAAa,UAAA,CAAW,OAAA;AAG9B,EAAA,MAAM,WAAA,GAAc,UAAA,CAAW,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAG1E,EAAA,MAAM,eAAA,GAAkB,UAAA,CAAW,OAAA,EAAS,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AAG1E,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AAC3C,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,YAAY,CAAC,CAAA;AACxD,EAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA;AAGtF,EAAA,MAAM,gBAAA,GAAmB,iCAAiC,cAAc,CAAA,CAAA;AAExE,EAAA,OAAO;AAAA,IACH,cAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,cAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,UAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACJ;AACJ;AC5OO,SAAS,aAAa,SAAA,EAA2B;AACpD,EAAA,MAAM,SAAA,GAAY,CAAC,KAAA,KAA8C;AAC7D,IAAyB,OAAO,KAAA;AAMJ,EAChC,CAAA;AAEA,EAAA,MAAM,gBAAgB,CAAC,GAAA,KAAwB,CAAA,CAAA,EAAI,SAAS,KAAK,GAAG,CAAA,CAAA;AAEpE,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,MAAM,GAAG,gBAAgB,CAAA;AAAA,QACnE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,IAAA,EAAM,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACrE,MAAA,IAAI,SAAA,CAAgB,CAAA,EAAG;AACnB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QAChD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,IAAA,CAAK,aAAA,CAAc,OAAA,IAAW,SAAS,GAAG,gBAAgB,CAAA;AAAA,QACtE;AAAA,MACJ;AAAA,IACJ,CAAA;AAAA,IACA,KAAA,EAAO,CAAC,gBAAA,EAAuC,OAAA,KAA2B;AACtE,MAAA,IAAI,SAAA,CAAiB,CAAA,EAAG;AACpB,QAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACtC,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,gBAAgB,CAAC,CAAA;AAAA,QACjD,CAAA,MAAO;AACH,UAAA,OAAA,CAAQ,KAAA,CAAM,aAAA,CAAc,OAAA,IAAW,OAAO,GAAG,gBAAgB,CAAA;AAAA,QACrE;AAAA,MACJ;AAAA,IACJ;AAAA,GACJ;AACJ;;;ACzFA,IAAM,GAAA,GAAM,aAAa,WAAW,CAAA;AAK7B,IAAM,sBAAA,GAAyB,KAAA;AAiB/B,IAAM,cAAA,GAA2B;AAAA,EACpC,sBAAA;AAAA,EACA,eAAA;AAAA,EACA,0BAAA;AAAA,EACA;AACJ,CAAA;AAyBO,IAAM,kBAAA,GAAqB,GAAA;AAClC,IAAM,gBAAA,GAAmB,GAAA;AAGzB,SAAS,UAAU,UAAA,EAA4B;AAC3C,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,kBAAkB,UAAA,GAAa,IAAA,CAAK,GAAA,EAAK,CAAC,CAAA;AAC1E;AAYO,SAAS,sBAAA,CACZ,UACA,MAAA,EAC8B;AAQ9B,EAAA,MAAM,IAAA,GAAmB;AAAA,IACrB,CAAC,GAAA,EAAK,QAAA,CAAS,cAAc,CAAA;AAAA;AAAA,IAC7B,CAAC,GAAA,EAAK,QAAA,CAAS,OAAO,CAAA;AAAA;AAAA,IACtB,CAAC,KAAK,WAAW,CAAA;AAAA;AAAA,IACjB,CAAC,SAAA,EAAW,QAAA,CAAS,OAAO,CAAA;AAAA;AAAA,IAC5B,CAAC,QAAA,EAAU,QAAA,CAAS,MAAM,CAAA;AAAA;AAAA,IAC1B,CAAC,WAAA,EAAa,QAAA,CAAS,SAAS;AAAA;AAAA,GACpC;AAGA,EAAA,KAAA,MAAW,QAAA,IAAY,SAAS,UAAA,EAAY;AACxC,IAAA,IAAA,CAAK,IAAA,CAAK,CAAC,GAAA,EAAK,CAAA,EAAG,QAAA,CAAS,QAAQ,CAAA,CAAA,EAAI,QAAA,CAAS,UAAU,CAAA,CAAE,CAAC,CAAA;AAAA,EAClE;AAGA,EAAA,IAAI,SAAS,UAAA,EAAY;AACrB,IAAA,IAAA,CAAK,IAAA,CAAK,CAAC,SAAA,EAAW,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,EAC9C;AAGA,EAAA,IAAI,QAAA,CAAS,aAAa,MAAA,EAAQ;AAC9B,IAAA,KAAA,MAAW,KAAA,IAAS,SAAS,WAAA,EAAa;AACtC,MAAA,IAAA,CAAK,IAAA,CAAK,CAAC,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,IAC9B;AAAA,EACJ;AAGA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,QAAA,EAAU,MAAM,CAAC,CAAA;AAEhD,EAAA,OAAO;AAAA,IACH,IAAA,EAAM,sBAAA;AAAA,IACN,IAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA,EAAY,KAAK,KAAA,CAAM,IAAA,CAAK,MAAM,QAAA,CAAS,SAAS,IAAI,GAAI,CAAA;AAAA,IAC5D;AAAA,GACJ;AACJ;AAoDA,eAAsB,eAAA,CAClB,KAAA,EACA,MAAA,GAAmB,cAAA,EAC6B;AAChD,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,OAAA,EAAS,KAAA,CAAM,IAAI,UAAA,EAAY,MAAA,CAAO,MAAA,EAAO,EAAG,4BAA4B,CAAA;AAIvF,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,kBAAA;AAEhC,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACnD,IAAA,IAAI,EAAA,GAAuB,IAAA;AAU3B,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,gBAAgB,MAAY;AAC9B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,CAAQ,KAAK,QAAQ,CAAA;AAAA,IACzB,CAAA;AACA,IAAA,MAAM,gBAAgB,MAAY;AAC9B,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AAAA,IACxB,CAAA;AAEA,IAAA,IAAI;AAEA,MAAA,EAAA,GAAK,IAAI,UAAU,QAAQ,CAAA;AAC3B,MAAA,MAAM,KAAA,GAAQ,EAAA;AAEd,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAIzC,QAAA,MAAM,QAAA,GAAW,WAAW,MAAM;AAC9B,UAAA,KAAA,CAAM,KAAA,EAAM;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,uBAAuB,CAAC,CAAA;AAAA,QAC7C,CAAA,EAAG,SAAA,CAAU,UAAU,CAAC,CAAA;AAExB,QAAA,MAAM,UAAU,MAAM;AAClB,UAAA,YAAA,CAAa,QAAQ,CAAA;AACrB,UAAA,KAAA,CAAM,KAAA,EAAM;AAAA,QAChB,CAAA;AAEA,QAAA,KAAA,CAAM,SAAS,MAAM;AAGjB,UAAA,KAAA,CAAM,KAAK,IAAA,CAAK,SAAA,CAAU,CAAC,OAAA,EAAS,KAAK,CAAC,CAAC,CAAA;AAAA,QAC/C,CAAA;AAEA,QAAA,KAAA,CAAM,SAAA,GAAY,CAAC,GAAA,KAAQ;AACvB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAEhC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,IAAQ,KAAK,CAAC,CAAA,KAAM,MAAM,EAAA,EAAI;AAC1C,cAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,IAAA,EAAM;AAClB,gBAAA,aAAA,EAAc;AACd,gBAAA,OAAA,EAAQ;AACR,gBAAA,OAAA,EAAQ;AAAA,cACZ,CAAA,MAAO;AACH,gBAAA,GAAA,CAAI,IAAA;AAAA,kBACA,EAAE,KAAA,EAAO,QAAA,EAAU,MAAA,EAAQ,IAAA,CAAK,CAAC,CAAA,EAAE;AAAA,kBACnC;AAAA,iBACJ;AACA,gBAAA,aAAA,EAAc;AACd,gBAAA,OAAA,EAAQ;AACR,gBAAA,MAAA,CAAO,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,IAAK,sBAAsB,CAAC,CAAA;AAAA,cACvD;AAAA,YACJ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,KAAA;AAAA,cACA,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,GAAA,EAAI;AAAA,cAC9B;AAAA,aACJ;AACA,YAAA,aAAA,EAAc;AACd,YAAA,OAAA,EAAQ;AACR,YAAA,MAAA,CAAO,GAAG,CAAA;AAAA,UACd;AAAA,QACJ,CAAA;AAEA,QAAA,KAAA,CAAM,OAAA,GAAU,CAAC,GAAA,KAAQ;AACrB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,iBAAiB,CAAA;AAC5D,UAAA,aAAA,EAAc;AACd,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAEA,QAAA,KAAA,CAAM,UAAU,MAAM;AAGlB,UAAA,YAAA,CAAa,QAAQ,CAAA;AAAA,QACzB,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,4BAA4B,CAAA;AACvE,MAAA,aAAA,EAAc;AAAA,IAClB,CAAA,SAAE;AAEE,MAAA,IAAI,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,SAAA,CAAU,MAAA,EAAQ;AAC1C,QAAA,EAAA,CAAG,KAAA,EAAM;AAAA,MACb;AAAA,IACJ;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,eAAe,CAAA;AAExC,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,YAAA,EAAc,OAAA,CAAQ,QAAQ,WAAA,EAAa,MAAA,CAAO,MAAA,EAAO,EAAG,qBAAqB,CAAA;AAE5F,EAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAC7B;AAKA,eAAsB,oBAAA,CAClB,aAAA,EACA,MAAA,GAAmB,cAAA,EACE;AACrB,EAAA,MAAM,SAAuB,EAAC;AAE9B,EAAA,GAAA,CAAI,KAAK,EAAE,aAAA,EAAe,YAAY,MAAA,CAAO,MAAA,IAAU,iCAAiC,CAAA;AAIxF,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,kBAAA;AAEhC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACjD,IAAA,IAAI,EAAA,GAAuB,IAAA;AAE3B,IAAA,IAAI;AACA,MAAA,EAAA,GAAK,IAAI,UAAU,QAAQ,CAAA;AAC3B,MAAA,MAAM,KAAA,GAAQ,EAAA;AAEd,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,QAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC7B,UAAA,KAAA,CAAM,KAAA,EAAM;AACZ,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,QACrC,CAAA,EAAG,SAAA,CAAU,UAAU,CAAC,CAAA;AAExB,QAAA,MAAM,UAAU,MAAM;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,KAAA,CAAM,KAAA,EAAM;AAAA,QAChB,CAAA;AAEA,QAAA,KAAA,CAAM,SAAS,MAAM;AAEjB,UAAA,MAAM,cAAA,GAAiB,CAAA,KAAA,EAAQ,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA;AACzC,UAAA,KAAA,CAAM,IAAA;AAAA,YACF,KAAK,SAAA,CAAU;AAAA,cACX,KAAA;AAAA,cACA,cAAA;AAAA,cACA;AAAA,gBACI,KAAA,EAAO,CAAC,KAAK,CAAA;AAAA,gBACb,IAAA,EAAM,CAAC,aAAa,CAAA;AAAA,gBACpB,KAAA,EAAO;AAAA;AACX,aACH;AAAA,WACL;AAAA,QACJ,CAAA;AAEA,QAAA,KAAA,CAAM,SAAA,GAAY,CAAC,GAAA,KAAQ;AACvB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAChC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,EAAS;AACrB,cAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,YACvB,CAAA,MAAA,IAAW,IAAA,CAAK,CAAC,CAAA,KAAM,MAAA,EAAQ;AAC3B,cAAA,OAAA,EAAQ;AACR,cAAA,OAAA,EAAQ;AAAA,YACZ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,UACtE;AAAA,QACJ,CAAA;AAEA,QAAA,KAAA,CAAM,OAAA,GAAU,CAAC,GAAA,KAAQ;AACrB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,8BAA8B,CAAA;AACzE,UAAA,OAAA,EAAQ;AACR,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAEA,QAAA,KAAA,CAAM,UAAU,MAAM;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AAAA,QACxB,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,IACtE,CAAA,SAAE;AAEE,MAAA,IAAI,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,SAAA,CAAU,MAAA,EAAQ;AAC1C,QAAA,EAAA,CAAG,KAAA,EAAM;AAAA,MACb;AAAA,IACJ;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,aAAa,CAAA;AAEtC,EAAA,GAAA,CAAI,KAAK,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,IAAU,gBAAgB,CAAA;AAExD,EAAA,OAAO,MAAA;AACX;AAKA,eAAsB,cAAA,CAClB,OAAA,EACA,MAAA,GAAmB,cAAA,EACE;AACrB,EAAA,MAAM,SAAuB,EAAC;AAE9B,EAAA,GAAA,CAAI,KAAK,EAAE,OAAA,EAAS,YAAY,MAAA,CAAO,MAAA,IAAU,6BAA6B,CAAA;AAI9E,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,kBAAA;AAEhC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACjD,IAAA,IAAI;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,QAAQ,CAAA;AAEjC,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,QAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC7B,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,QACrC,CAAA,EAAG,SAAA,CAAU,UAAU,CAAC,CAAA;AAExB,QAAA,EAAA,CAAG,SAAS,MAAM;AACd,UAAA,MAAM,cAAA,GAAiB,CAAA,UAAA,EAAa,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA;AAC9C,UAAA,EAAA,CAAG,IAAA;AAAA,YACC,KAAK,SAAA,CAAU;AAAA,cACX,KAAA;AAAA,cACA,cAAA;AAAA,cACA;AAAA,gBACI,KAAA,EAAO,CAAC,KAAK,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAQb,IAAA,EAAM,CAAC,OAAO,CAAA;AAAA,gBACd,KAAA,EAAO;AAAA;AACX,aACH;AAAA,WACL;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,SAAA,GAAY,CAAC,GAAA,KAAQ;AACpB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAChC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,EAAS;AACrB,cAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,YACvB,CAAA,MAAA,IAAW,IAAA,CAAK,CAAC,CAAA,KAAM,MAAA,EAAQ;AAC3B,cAAA,YAAA,CAAa,OAAO,CAAA;AACpB,cAAA,EAAA,CAAG,KAAA,EAAM;AACT,cAAA,OAAA,EAAQ;AAAA,YACZ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,UACtE;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,OAAA,GAAU,CAAC,GAAA,KAAQ;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,8BAA8B,CAAA;AACzE,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,IACtE;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,aAAa,CAAA;AAEtC,EAAA,GAAA,CAAI,KAAK,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,IAAU,gBAAgB,CAAA;AAExD,EAAA,OAAO,MAAA;AACX;AAKA,eAAsB,eAAA,CAClB,QAAA,EACA,UAAA,EACA,MAAA,GAAmB,cAAA,EACE;AACrB,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAE7C,EAAA,GAAA,CAAI,IAAA,CAAK,EAAE,QAAA,EAAU,UAAA,EAAY,YAAY,MAAA,CAAO,MAAA,IAAU,8BAA8B,CAAA;AAI5F,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,kBAAA;AAEhC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,GAAA,CAAI,OAAO,QAAA,KAAa;AACjD,IAAA,IAAI;AACA,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,QAAQ,CAAA;AAEjC,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,QAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC7B,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,QACrC,CAAA,EAAG,SAAA,CAAU,UAAU,CAAC,CAAA;AAExB,QAAA,EAAA,CAAG,SAAS,MAAM;AACd,UAAA,MAAM,cAAA,GAAiB,CAAA,cAAA,EAAiB,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA;AAClD,UAAA,EAAA,CAAG,IAAA;AAAA,YACC,KAAK,SAAA,CAAU;AAAA,cACX,KAAA;AAAA,cACA,cAAA;AAAA,cACA;AAAA,gBACI,KAAA,EAAO,CAAC,KAAK,CAAA;AAAA,gBACb,IAAA,EAAM,CAAC,WAAW,CAAA;AAAA,gBAClB,KAAA,EAAO;AAAA;AACX,aACH;AAAA,WACL;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,SAAA,GAAY,CAAC,GAAA,KAAQ;AACpB,UAAA,IAAI;AACA,YAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAA;AAChC,YAAA,IAAI,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,EAAS;AACrB,cAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,YACvB,CAAA,MAAA,IAAW,IAAA,CAAK,CAAC,CAAA,KAAM,MAAA,EAAQ;AAC3B,cAAA,YAAA,CAAa,OAAO,CAAA;AACpB,cAAA,EAAA,CAAG,KAAA,EAAM;AACT,cAAA,OAAA,EAAQ;AAAA,YACZ;AAAA,UACJ,SAAS,GAAA,EAAK;AACV,YAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,UACtE;AAAA,QACJ,CAAA;AAEA,QAAA,EAAA,CAAG,OAAA,GAAU,CAAC,GAAA,KAAQ;AAClB,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,8BAA8B,CAAA;AACzE,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACd,CAAA;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,SAAS,GAAA,EAAK;AACV,MAAA,GAAA,CAAI,MAAM,EAAE,KAAA,EAAO,UAAU,KAAA,EAAO,GAAA,IAAO,uBAAuB,CAAA;AAAA,IACtE;AAAA,EACJ,CAAC,CAAA;AAED,EAAA,MAAM,OAAA,CAAQ,WAAW,aAAa,CAAA;AAEtC,EAAA,GAAA,CAAI,KAAK,EAAE,UAAA,EAAY,MAAA,CAAO,MAAA,IAAU,gBAAgB,CAAA;AAExD,EAAA,OAAO,MAAA;AACX;AAMA,eAAsB,0BAA0B,QAAA,EAAiD;AAC7F,EAAA,IAAI;AAEA,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA;AAC5C,IAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAC7D,IAAA,MAAM,YAAY,KAAA,CAAM,IAAA,CAAK,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AACvD,IAAA,MAAM,UAAA,GAAa,SAAA,CAAU,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAEhF,IAAA,OAAO,eAAe,QAAA,CAAS,cAAA;AAAA,EACnC,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAA,CAAM,EAAE,KAAA,EAAO,GAAA,IAAO,uCAAuC,CAAA;AACjE,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAKO,SAAS,0BAA0B,KAAA,EAA+C;AACrF,EAAA,IAAI;AACA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA;AACzC,IAAA,OAAO,QAAA;AAAA,EACX,SAAS,GAAA,EAAK;AACV,IAAA,GAAA,CAAI,KAAA,CAAM,EAAE,OAAA,EAAS,KAAA,CAAM,IAAI,KAAA,EAAO,GAAA,IAAO,wCAAwC,CAAA;AACrF,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;;;AChjBA,IAAMA,IAAAA,GAAM,aAAa,kBAAkB,CAAA;AA+CpC,SAAS,gBAAA,GAA4B;AACxC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,OAAO,CAAC,CAAE,MAAA,CAAuD,KAAA;AACrE;AA2BA,eAAsB,eAClB,KAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,kBAAiB,EAAG;AACrB,IAAAA,IAAAA,CAAI,KAAK,gCAAgC,CAAA;AACzC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,QAAS,MAAA,CAAuD,KAAA;AAGtE,IAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,SAAA,CAAU,KAAK,CAAA;AAE/C,IAAAA,KAAI,IAAA,CAAK,EAAE,SAAS,WAAA,CAAY,EAAA,IAAM,gCAAgC,CAAA;AAEtE,IAAA,OAAO,WAAA;AAAA,EACX,SAAS,GAAA,EAAK;AACV,IAAAA,KAAI,KAAA,CAAM,EAAE,KAAA,EAAO,GAAA,IAAO,4BAA4B,CAAA;AACtD,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;;;AChGA,IAAMA,IAAAA,GAAM,aAAa,iBAAiB,CAAA;AA2DnC,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACxC,WAAA,CACI,SACgB,IAAA,EAClB;AACE,IAAA,KAAA,CAAM,OAAO,CAAA;AAFG,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGhB,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AAAA,EAChB;AACJ;AAoBA,eAAsB,kBAClB,OAAA,EAC4B;AAC5B,EAAA,MAAM,EAAE,OAAA,EAAS,SAAA,EAAW,MAAA,EAAQ,OAAA,EAAS,UAAA,GAAa,EAAC,EAAG,UAAA,GAAa,EAAC,EAAE,GAAI,OAAA;AAElF,EAAAA,IAAAA,CAAI,KAAK,EAAE,OAAA,EAAS,eAAe,UAAA,CAAW,MAAA,IAAU,sBAAsB,CAAA;AAE9E,EAAA,MAAM,WAAW,MAAM,yBAAA;AAAA,IACnB,OAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACJ;AAGA,EAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B,QAAQ,CAAA;AACxD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,MAAM,IAAI,gBAAA;AAAA,MACN,6CAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAEA,EAAAA,KAAI,IAAA,CAAK,EAAE,eAAe,QAAA,CAAS,cAAA,IAAkB,kCAAkC,CAAA;AAEvF,EAAA,OAAO,QAAA;AACX;AAqBA,eAAsB,mBAClB,OAAA,EACsB;AACtB,EAAA,MAAM,EAAE,QAAA,EAAU,IAAA,EAAM,MAAA,GAAS,gBAAe,GAAI,OAAA;AAEpD,EAAAA,IAAAA,CAAI,IAAA;AAAA,IACA,EAAE,aAAA,EAAe,QAAA,CAAS,cAAA,EAAgB,UAAA,EAAY,OAAO,MAAA,EAAO;AAAA,IACpE;AAAA,GACJ;AAGA,EAAA,MAAM,aAAA,GAAgB,sBAAA,CAAuB,QAAA,EAAU,IAAI,CAAA;AAM3D,EAAA,IAAI,CAAC,kBAAiB,EAAG;AACrB,IAAAA,IAAAA,CAAI,KAAK,kDAA6C,CAAA;AACtD,IAAA,MAAM,IAAI,KAAA;AAAA,MACN;AAAA,KACJ;AAAA,EACJ;AAEA,EAAAA,IAAAA,CAAI,KAAK,4BAA4B,CAAA;AACrC,EAAA,MAAM,WAAA,GAAc,MAAM,cAAA,CAAe,aAAa,CAAA;AACtD,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,WAAA,EAAa,MAAM,CAAA;AAExD,EAAAA,IAAAA,CAAI,IAAA;AAAA,IACA;AAAA,MACI,eAAe,QAAA,CAAS,cAAA;AAAA,MACxB,YAAA,EAAc,OAAO,OAAA,CAAQ,MAAA;AAAA,MAC7B,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,KAC/B;AAAA,IACA;AAAA,GACJ;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,eAAsB,qBAClB,OAAA,EAC8B;AAC9B,EAAA,MAAM,EAAE,aAAA,EAAe,OAAA,EAAS,QAAA,EAAU,MAAA,GAAS,gBAAe,GAAI,OAAA;AAEtE,EAAA,IAAI,SAAuB,EAAC;AAE5B,EAAA,IAAI,aAAA,EAAe;AACf,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,aAAA,IAAiB,+BAA+B,CAAA;AAC3D,IAAA,MAAA,GAAS,MAAM,oBAAA,CAAqB,aAAA,EAAe,MAAM,CAAA;AAAA,EAC7D,WAAW,OAAA,EAAS;AAChB,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,OAAA,IAAW,gCAAgC,CAAA;AACtD,IAAA,MAAA,GAAS,MAAM,cAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,EACjD,WAAW,QAAA,EAAU;AACjB,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,QAAA,IAAY,yBAAyB,CAAA;AAChD,IAAA,MAAA,GAAS,MAAM,eAAA,CAAgB,QAAA,CAAS,QAAA,EAAU,QAAA,CAAS,YAAY,MAAM,CAAA;AAAA,EACjF,CAAA,MAAO;AACH,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAGA,EAAA,MAAM,YAAmC,EAAC;AAC1C,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AACxB,IAAA,MAAM,QAAA,GAAW,0BAA0B,KAAK,CAAA;AAChD,IAAA,IAAI,QAAA,EAAU;AAEV,MAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B,QAAQ,CAAA;AACxD,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,SAAA,CAAU,KAAK,QAAQ,CAAA;AAAA,MAC3B,CAAA,MAAO;AACH,QAAAA,IAAAA,CAAI,IAAA;AAAA,UACA,EAAE,aAAA,EAAe,QAAA,CAAS,cAAA,EAAe;AAAA,UACzC;AAAA,SACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,EAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,UAAA,EAAY,MAAA,CAAO,QAAQ,UAAA,EAAY,SAAA,CAAU,MAAA,EAAO,EAAG,oBAAoB,CAAA;AAE1F,EAAA,OAAO,SAAA;AACX;AAKA,eAAsB,qBAAA,CAClB,aAAA,EACA,MAAA,GAAmB,cAAA,EACgB;AACnC,EAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,aAAA,IAAiB,6BAA6B,CAAA;AAEzD,EAAA,MAAM,YAAY,MAAM,oBAAA,CAAqB,EAAE,aAAA,EAAe,QAAQ,CAAA;AAEtE,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AACxB,IAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,aAAA,IAAiB,oCAAoC,CAAA;AAChE,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACtB,IAAAA,IAAAA,CAAI,IAAA;AAAA,MACA,EAAE,aAAA,EAAe,KAAA,EAAO,SAAA,CAAU,MAAA,EAAO;AAAA,MACzC;AAAA,KACJ;AAAA,EACJ;AAEA,EAAA,OAAO,SAAA,CAAU,CAAC,CAAA,IAAK,IAAA;AAC3B;AAKA,eAAsB,yBAAA,CAClB,OAAA,EACA,MAAA,GAAmB,cAAA,EACW;AAC9B,EAAAA,IAAAA,CAAI,IAAA,CAAK,EAAE,OAAA,IAAW,sCAAsC,CAAA;AAC5D,EAAA,OAAO,oBAAA,CAAqB,EAAE,OAAA,EAAS,MAAA,EAAQ,CAAA;AACnD;AAKA,eAAsB,0BAAA,CAClB,QAAA,EACA,UAAA,EACA,MAAA,GAAmB,cAAA,EACW;AAC9B,EAAAA,KAAI,IAAA,CAAK,EAAE,QAAA,EAAU,UAAA,IAAc,uCAAuC,CAAA;AAC1E,EAAA,OAAO,oBAAA,CAAqB,EAAE,QAAA,EAAU,EAAE,UAAU,UAAA,EAAW,EAAG,QAAQ,CAAA;AAC9E;AAMO,SAAS,2BAA2B,UAAA,EAAuC;AAC9E,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,CAAC,EAAA,KAAO,CAAA,EAAG,EAAA,CAAG,QAAQ,CAAA,CAAA,EAAI,EAAA,CAAG,UAAU,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAC9E;AAOO,SAAS,kBAAA,CACZ,aAAA,EACA,OAAA,GAAU,wBAAA,EACJ;AACN,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,QAAA,EAAW,aAAa,CAAA,CAAA;AAC7C;AAOO,SAAS,4BAA4B,GAAA,EAA4B;AACpE,EAAA,IAAI;AACA,IAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,GAAG,CAAA;AAErB,IAAA,MAAM,CAAA,GAAI,CAAA,CAAE,QAAA,CAAS,KAAA,CAAM,gCAAgC,CAAA;AAC3D,IAAA,IAAI,CAAA,EAAG,OAAO,CAAA,CAAE,CAAC,EAAG,WAAA,EAAY;AAEhC,IAAA,MAAM,CAAA,GAAI,CAAA,CAAE,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACjC,IAAA,IAAI,KAAK,iBAAA,CAAkB,IAAA,CAAK,CAAC,CAAA,EAAG,OAAO,EAAE,WAAA,EAAY;AACzD,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ","file":"attestation.mjs","sourcesContent":["/*\n Canonical message builder per SPEC.md §2\n \n - LF line endings, exactly one trailing LF\n * - 7 fixed core lines in strict order and wording\n * - Optional extensions appended as key: value with lexicographically sorted lowercase keys\n /\n\nimport type { AttestationEnvelope, IdentityBinding, Scheme } from './types';\n\n/\n Input for building a canonical message\n /\nexport interface CanonicalInput {\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n}\n\n/\n Extension key-value pairs for canonical message\n /\nexport type Extensions = Record<string, string \| undefined>;\n\n/\n Convert bytes to lowercase hex string\n * @param bytes - Byte array to convert\n * @returns Lowercase hex string\n /\nfunction toLowerHex(bytes: Uint8Array): string {\n return Array.from(bytes)\n .map((b) => b.toString(16).padStart(2, '0'))\n .join('');\n}\n\n/\n Generate a random 16-byte nonce as lowercase hex\n * Uses Web Crypto API when available, falls back to Math.random()\n * @returns 32-character lowercase hex string\n /\nexport function randomNonce16BHexLower(): string {\n const arr = new Uint8Array(16);\n\n try {\n if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {\n crypto.getRandomValues(arr);\n return toLowerHex(arr);\n }\n } catch {\n // Fall through to non-cryptographic fallback\n }\n\n // No silent Math.random fallback: a nonce is a load-bearing security\n // primitive. A deployment without `crypto.getRandomValues` MUST fix its\n // environment rather than sign with weak randomness.\n throw new Error('crypto.getRandomValues unavailable — refusing to mint a weak nonce');\n}\n\n/\n Reject characters that would break the line-oriented canonical grammar\n * or the comma-separated identities list. If any of these slipped through,\n * an attacker could smuggle a forged `address:` or extension line into the\n * signed payload: `identities: alice\\naddress: bc1qEVIL…` would parse as a\n * second address line. Catch it at the boundary, not at verification time.\n \n Also rejects a colon in the identifier so a bad actor can't turn\n * `github:alice:extra` into a different protocol binding on parse.\n /\nconst IDENTITY_PROTOCOL_RE = /^[a-z][a-z0-9_-]$/;\nconst IDENTITY_FORBIDDEN_CHARS = /[\\r\\n,]/;\n\nfunction assertSafeIdentity({ protocol, identifier }: IdentityBinding): void {\n if (!IDENTITY_PROTOCOL_RE.test(protocol)) {\n throw new Error(\n `invalid identity protocol: ${JSON.stringify(protocol)} — must match /^[a-z][a-z0-9_-]$/`\n );\n }\n if (!identifier \|\| IDENTITY_FORBIDDEN_CHARS.test(identifier)) {\n throw new Error(\n `invalid identity identifier: ${JSON.stringify(identifier)} — must be non-empty and contain no newlines or commas`\n );\n }\n}\n\n/\n Format identities as comma-separated protocol:identifier pairs, sorted lexicographically\n * @param identities - Array of identity bindings\n * @returns Comma-separated string of protocol:identifier pairs\n /\nexport function formatIdentities(identities: IdentityBinding[] = []): string {\n if (identities.length === 0) {\n return '';\n }\n for (const id of identities) assertSafeIdentity(id);\n\n // Format as protocol:identifier and sort lexicographically\n const formatted = identities\n .map(({ protocol, identifier }) => `${protocol}:${identifier}`)\n .sort();\n\n return formatted.join(',');\n}\n\n/\n Parse identities from comma-separated protocol:identifier format\n * @param identitiesStr - Comma-separated identity string\n * @returns Array of identity bindings\n * @throws {Error} If identity format is invalid\n /\nexport function parseIdentities(identitiesStr: string): IdentityBinding[] {\n if (!identitiesStr \|\| identitiesStr.trim() === '') {\n return [];\n }\n // The identities field lives on one line of the canonical message. If it\n // contains a raw LF/CR, it's either corrupt or an attempt to smuggle a\n // fake core line into the parser. Refuse instead of trying to recover.\n if (IDENTITY_FORBIDDEN_CHARS.test(identitiesStr.replace(/,/g, ''))) {\n throw new Error('identities field contains forbidden characters (newline)');\n }\n\n const bindings = identitiesStr.split(',').map((binding) => {\n const colonIndex = binding.indexOf(':');\n if (colonIndex === -1) {\n throw new Error(`Invalid identity binding format: ${binding}`);\n }\n return {\n protocol: binding.substring(0, colonIndex).trim(),\n identifier: binding.substring(colonIndex + 1).trim(),\n };\n });\n\n for (const b of bindings) {\n if (!b.protocol \|\| !b.identifier) {\n throw new Error(`Invalid identity binding: ${b.protocol}:${b.identifier}`);\n }\n assertSafeIdentity(b);\n }\n return bindings;\n}\n\n/\n Optional deterministic overrides for message building. Only intended for\n * tests / conformance vectors; production callers should let the builder\n * mint a fresh nonce + timestamp per message.\n /\nexport interface BuildOptions {\n /* 32-char lowercase hex. Default: freshly-generated cryptographic nonce. /\n nonce?: string;\n /* RFC-3339 UTC. Default: `new Date().toISOString()`. /\n issuedAt?: string;\n}\n\n/\n Build a canonical message following OrangeCheck Protocol v0 specification\n * @param input - Canonical input with address and identities\n * @param extensions - Optional extension key-value pairs\n * @param options - Optional deterministic overrides (testing only)\n * @returns Canonical message string with LF line endings\n /\nexport function buildCanonicalMessage(\n { address, identities }: CanonicalInput,\n extensions: Extensions = {},\n options: BuildOptions = {}\n): string {\n const nonce = options.nonce ?? randomNonce16BHexLower();\n if (!/^[0-9a-f]{32}$/.test(nonce)) {\n throw new Error(`invalid nonce: must be 32 lowercase hex chars`);\n }\n const issuedAt = options.issuedAt ?? new Date().toISOString();\n\n // Format identities\n const identitiesStr = formatIdentities(identities);\n\n // Core (strict wording + order per SPEC.md §2)\n const core = [\n 'orangecheck',\n `identities: ${identitiesStr}`,\n `address: ${address}`,\n 'purpose: portable reputation attestation (non-custodial)',\n `nonce: ${nonce}`,\n `issued_at: ${issuedAt}`,\n 'ack: I attest control of this address and bind it to my identities.',\n ];\n\n // Normalize and sort extensions\n const normExt: Record<string, string> = {};\n for (const [k, v] of Object.entries(extensions)) {\n if (v == null \|\| v === '') {\n continue;\n }\n const key = k.toLowerCase();\n normExt[key] = String(v);\n }\n\n const extLines = Object.keys(normExt)\n .sort()\n .map((k) => `${k}: ${normExt[k]!}`);\n\n const all = [...core, ...extLines];\n\n // Join with LF and ensure exactly one trailing LF\n return all.join('\\n') + '\\n';\n}\n\n/\n Generate attestation ID from canonical message\n \n attestation_id = SHA-256(canonical_message)\n \n @param message - Canonical message string\n * @returns Lowercase hex SHA-256 hash\n /\nexport async function generateAttestationId(message: string): Promise<string> {\n // Convert message to UTF-8 bytes\n const encoder = new TextEncoder();\n const data = encoder.encode(message);\n\n // Compute SHA-256 hash\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n return toLowerHex(new Uint8Array(hashBuffer));\n}\n\n/\n Create an attestation envelope for publishing\n \n This wraps the canonical message with metadata for Nostr publishing\n \n @param message - Canonical message\n * @param signature - BIP-322 or legacy signature\n * @param scheme - Signature scheme used\n * @param address - Bitcoin address\n * @param identities - Identity bindings\n * @param extensions - Optional extensions\n * @returns Attestation envelope ready for publishing\n /\nexport async function createAttestationEnvelope(\n message: string,\n signature: string,\n scheme: Scheme,\n address: string,\n identities: IdentityBinding[],\n extensions: Extensions = {}\n): Promise<AttestationEnvelope> {\n const attestation_id = await generateAttestationId(message);\n\n // Extract issued_at from message\n const issuedAtMatch = message.match(/issued_at: ([^\\n]+)/);\n const issued_at = issuedAtMatch?.[1] ?? new Date().toISOString();\n\n // Extract expires from extensions if present\n const expires_at = extensions.expires;\n\n // Extract relay hints from extensions if present\n const relay_hints = extensions.relay_hints?.split(',').map((r) => r.trim());\n\n // Extract publish targets from extensions if present\n const publish_targets = extensions.publish?.split(',').map((t) => t.trim());\n\n // Base64url encode the message\n const encoder = new TextEncoder();\n const messageBytes = encoder.encode(message);\n const base64 = btoa(String.fromCharCode(...messageBytes));\n const message_b64url = base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n\n // Construct verification URL\n const verification_url = `https://attest.ochk.io/attest/${attestation_id}`;\n\n return {\n attestation_id,\n scheme,\n address,\n identities,\n message,\n message_b64url,\n signature,\n issued_at,\n expires_at,\n verification_url,\n publish_targets,\n relay_hints,\n };\n}\n","/\n Simple logger for SDK\n * Can be disabled in production builds\n /\n\n/\n Log level type\n /\nexport type LogLevel = 'debug' \| 'info' \| 'warn' \| 'error' \| 'none';\n\n/\n Logger context type\n /\nexport type LogContext = Record<string, unknown>;\n\n/\n Logger interface\n /\nexport interface Logger {\n debug: (contextOrMessage: string \| LogContext, message?: string) => void;\n info: (contextOrMessage: string \| LogContext, message?: string) => void;\n warn: (contextOrMessage: string \| LogContext, message?: string) => void;\n error: (contextOrMessage: string \| LogContext, message?: string) => void;\n}\n\nlet logLevel: LogLevel = 'none';\n\n/\n Set the global log level\n * @param level - Log level to set\n /\nexport function setLogLevel(level: LogLevel): void {\n logLevel = level;\n}\n\n/\n Get the current log level\n * @returns Current log level\n /\nexport function getLogLevel(): LogLevel {\n return logLevel;\n}\n\n/\n Create a namespaced logger\n * @param namespace - Logger namespace\n * @returns Logger instance\n /\nexport function createLogger(namespace: string): Logger {\n const shouldLog = (level: Exclude<LogLevel, 'none'>): boolean => {\n if (logLevel === 'none') return false;\n\n const levels: Exclude<LogLevel, 'none'>[] = ['debug', 'info', 'warn', 'error'];\n const currentLevelIndex = levels.indexOf(logLevel as Exclude<LogLevel, 'none'>);\n const messageLevelIndex = levels.indexOf(level);\n\n return messageLevelIndex >= currentLevelIndex;\n };\n\n const formatMessage = (msg: string): string => `[${namespace}] ${msg}`;\n\n return {\n debug: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('debug')) {\n if (typeof contextOrMessage === 'string') {\n console.debug(formatMessage(contextOrMessage));\n } else {\n console.debug(formatMessage(message ?? 'Debug'), contextOrMessage);\n }\n }\n },\n info: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('info')) {\n if (typeof contextOrMessage === 'string') {\n console.info(formatMessage(contextOrMessage));\n } else {\n console.info(formatMessage(message ?? 'Info'), contextOrMessage);\n }\n }\n },\n warn: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('warn')) {\n if (typeof contextOrMessage === 'string') {\n console.warn(formatMessage(contextOrMessage));\n } else {\n console.warn(formatMessage(message ?? 'Warning'), contextOrMessage);\n }\n }\n },\n error: (contextOrMessage: string \| LogContext, message?: string): void => {\n if (shouldLog('error')) {\n if (typeof contextOrMessage === 'string') {\n console.error(formatMessage(contextOrMessage));\n } else {\n console.error(formatMessage(message ?? 'Error'), contextOrMessage);\n }\n }\n },\n };\n}\n\n/\n Log verification error\n * @param protocol - Identity protocol\n * @param identifier - Identity identifier\n * @param error - Error object\n * @param context - Additional context\n /\nexport function logVerificationError(\n protocol: string,\n identifier: string,\n error: Error,\n context?: LogContext\n): void {\n const logger = createLogger('identity-verification');\n logger.error(\n {\n protocol,\n identifier,\n error: error.message,\n stack: error.stack,\n ...context,\n },\n 'Verification failed'\n );\n}\n","/\n Nostr Integration for OrangeCheck Protocol\n \n Implements NIP-78 (Application-specific data) for attestation publishing\n /\n\nimport type { AttestationEnvelope, IdentityBinding, NostrEvent } from './types';\n\nimport { createLogger } from './utils/logger';\n\nconst log = createLogger('ocp/nostr');\n\n/\n NIP-78 event kind for OrangeCheck attestations\n /\nexport const ATTESTATION_EVENT_KIND = 30078;\n\n/\n Default Nostr relays for OrangeCheck attestation publishing and lookup.\n \n Well-known relays with good uptime, plus the first-party family relay.\n * `relay.ochk.io` was missing here while attest.ochk.io's verifier has always\n * read from it, so the SDK and the reference implementation were looking in\n * different places — the SDK could miss a family attestation that the hosted\n * API found. It runs a kind allowlist (30078-30087, 30110-30114) and canonical OC d-tag\n * prefixes, and is always co-published alongside the public relays, never the\n * only copy. See https://github.com/orangecheck/oc-relay-infra.\n \n Order matters only for readability; queries fan out to all of them and\n * merge. Pass your own `relays` to any query to override this entirely — the\n * protocol does not require trusting any particular relay.\n /\nexport const DEFAULT_RELAYS: string[] = [\n 'wss://relay.damus.io',\n 'wss://nos.lol',\n 'wss://relay.snort.social',\n 'wss://relay.ochk.io',\n];\n\n/\n Wall-clock budget for a whole relay fan-out, shared by every relay in it.\n \n Queries below use Promise.allSettled, so a fan-out used to take as long as\n * its SLOWEST relay — and with a dead relay in DEFAULT_RELAYS that meant the\n * per-relay 10s timeout, every single call. Measured on 1.4.0:\n \n check({ addr }) with the old defaults 10.4s\n * check({ addr }) with the dead relay out 1.0s\n \n That is not merely slow, it broke a dependent outright: @orangecheck/gate\n * races check() against a 5s lookupTimeoutMs, so a 10.4s lookup lost the race\n * every time and no address-based gate decision could ever succeed.\n \n A shared deadline fixes the class: whichever relay is dead or slow next, a\n * fan-out costs at most this. Healthy relays answer well inside it (~1s for a\n * cold WebSocket plus a query). QUERY_TIMEOUT_MS remains the per-relay ceiling.\n \n The value is deliberately BELOW @orangecheck/gate's 5s default\n * lookupTimeoutMs, so a gate decision can still resolve in the worst case\n * rather than always losing its own race. Raising this above 5000 silently\n * breaks that dependent — change both together, or don't.\n /\nexport const FANOUT_DEADLINE_MS = 4000;\nconst QUERY_TIMEOUT_MS = 10000;\n\n/* Remaining budget for a relay, given the fan-out's shared deadline. /\nfunction budgetFor(deadlineAt: number): number {\n return Math.max(0, Math.min(QUERY_TIMEOUT_MS, deadlineAt - Date.now()));\n}\n\n/\n Create a NIP-78 event for an OrangeCheck attestation\n \n Kind: 30078 (Parameterized Replaceable Event)\n * d-tag: attestation_id (makes it replaceable by attestation ID)\n \n @param envelope - Attestation envelope\n * @param pubkey - Nostr public key (hex format)\n * @returns Unsigned Nostr event\n /\nexport function createAttestationEvent(\n envelope: AttestationEnvelope,\n pubkey: string\n): Omit<NostrEvent, 'id' \| 'sig'> {\n // NIP-12 relays index SINGLE-LETTER tags only. A multi-letter tag like\n // `address` is stored verbatim and stays readable in the event, but it is\n // never indexed, so no `#address` filter can ever retrieve it. Without the\n // `t` tags below an attestation published by this SDK is invisible to\n // every by-address query on every relay — including attest.ochk.io's own\n // verifier, which queries `#t`. Keep both: `t` is what makes it findable,\n // `address` is human-readable diagnostics and is not load-bearing.\n const tags: string[][] = [\n ['d', envelope.attestation_id], // Parameterized replaceable event identifier (indexed)\n ['t', envelope.address], // Indexed btc-address tag — query with `#t`\n ['t', 'oc-attest'], // Family marker — `#t=[\"oc-attest\"]` for cross-cut discovery\n ['address', envelope.address], // Diagnostic / legacy — relay won't index this\n ['scheme', envelope.scheme], // Signature scheme (bip322 or legacy)\n ['issued_at', envelope.issued_at], // ISO timestamp\n ];\n\n // Add identity tags\n for (const identity of envelope.identities) {\n tags.push(['i', `${identity.protocol}:${identity.identifier}`]);\n }\n\n // Add expiration if present\n if (envelope.expires_at) {\n tags.push(['expires', envelope.expires_at]);\n }\n\n // Add relay hints if present\n if (envelope.relay_hints?.length) {\n for (const relay of envelope.relay_hints) {\n tags.push(['relay', relay]);\n }\n }\n\n // Content is the full attestation envelope as JSON\n const content = JSON.stringify(envelope, null, 2);\n\n return {\n kind: ATTESTATION_EVENT_KIND,\n tags,\n content,\n created_at: Math.floor(Date.parse(envelope.issued_at) / 1000),\n pubkey,\n };\n}\n\n/\n Parse identity bindings from Nostr event tags\n \n @param event - Nostr event\n * @returns Array of identity bindings\n /\nexport function parseIdentitiesFromEvent(event: NostrEvent): IdentityBinding[] {\n const identities: IdentityBinding[] = [];\n\n for (const tag of event.tags) {\n if (tag[0] === 'i' && tag[1]) {\n const colonIndex = tag[1].indexOf(':');\n if (colonIndex !== -1) {\n identities.push({\n protocol: tag[1].substring(0, colonIndex),\n identifier: tag[1].substring(colonIndex + 1),\n });\n }\n }\n }\n\n return identities;\n}\n\n/\n Extract attestation ID from Nostr event d-tag\n \n @param event - Nostr event\n * @returns Attestation ID or undefined if not found\n /\nexport function getAttestationIdFromEvent(event: NostrEvent): string \| undefined {\n const dTag = event.tags.find((tag) => tag[0] === 'd');\n return dTag?.[1];\n}\n\n/\n Extract Bitcoin address from Nostr event tags\n \n @param event - Nostr event\n * @returns Bitcoin address or undefined if not found\n /\nexport function getAddressFromEvent(event: NostrEvent): string \| undefined {\n const addressTag = event.tags.find((tag) => tag[0] === 'address');\n return addressTag?.[1];\n}\n\n/\n Publish a Nostr event to multiple relays\n * Returns array of relay URLs that successfully accepted the event\n /\nexport async function publishToRelays(\n event: NostrEvent,\n relays: string[] = DEFAULT_RELAYS\n): Promise<{ success: string[]; failed: string[] }> {\n const success: string[] = [];\n const failed: string[] = [];\n\n log.info({ eventId: event.id, relayCount: relays.length }, 'Publishing event to relays');\n\n // One shared deadline for the whole fan-out — see FANOUT_DEADLINE_MS.\n\n const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;\n\n const publishPromises = relays.map(async (relayUrl) => {\n let ws: WebSocket \| null = null;\n\n // One outcome per relay, first one wins. Without this a relay that\n // ACKs `OK true` and then emits an error or close event during\n // teardown lands in BOTH arrays, and the caller reports \"published\n // to 3 · rejected 3\" over the same three relays. The `failed.includes`\n // check this replaces only ever de-duplicated `failed` against\n // itself, so it could not catch a success/failure split.\n // attest.ochk.io's copy of this file has carried the guard for a\n // while; this is the back-port.\n let settled = false;\n const recordSuccess = (): void => {\n if (settled) return;\n settled = true;\n success.push(relayUrl);\n };\n const recordFailure = (): void => {\n if (settled) return;\n settled = true;\n failed.push(relayUrl);\n };\n\n try {\n // Connect to relay\n ws = new WebSocket(relayUrl);\n const wsRef = ws; // Capture for closures\n\n await new Promise<void>((resolve, reject) => {\n // One outer deadline covers connect + OK round-trip. The old\n // code cleared this on `onopen`, which meant a relay that\n // opened but never sent OK would hang the promise forever.\n const deadline = setTimeout(() => {\n wsRef.close();\n reject(new Error('Relay publish timeout'));\n }, budgetFor(deadlineAt));\n\n const cleanup = () => {\n clearTimeout(deadline);\n wsRef.close();\n };\n\n wsRef.onopen = () => {\n // Do NOT clear the deadline — we still need it in case\n // the relay never responds with OK.\n wsRef.send(JSON.stringify(['EVENT', event]));\n };\n\n wsRef.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n // Check for OK response\n if (data[0] === 'OK' && data[1] === event.id) {\n if (data[2] === true) {\n recordSuccess();\n cleanup();\n resolve();\n } else {\n log.warn(\n { relay: relayUrl, reason: data[3] },\n 'Relay rejected event'\n );\n recordFailure();\n cleanup();\n reject(new Error(data[3] \|\| 'Relay rejected event'));\n }\n }\n } catch (err) {\n log.error(\n { relay: relayUrl, error: err },\n 'Failed to parse relay response'\n );\n recordFailure();\n cleanup();\n reject(err);\n }\n };\n\n wsRef.onerror = (err) => {\n log.error({ relay: relayUrl, error: err }, 'WebSocket error');\n recordFailure();\n cleanup();\n reject(err);\n };\n\n wsRef.onclose = () => {\n // Socket closed before we resolved/rejected — counts as\n // failure. clearTimeout here is safe (cleanup handles both).\n clearTimeout(deadline);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to publish to relay');\n recordFailure();\n } finally {\n // Ensure WebSocket is closed\n if (ws && ws.readyState !== WebSocket.CLOSED) {\n ws.close();\n }\n }\n });\n\n await Promise.allSettled(publishPromises);\n\n log.info({ successCount: success.length, failedCount: failed.length }, 'Publishing complete');\n\n return { success, failed };\n}\n\n/\n Query relays for attestations by attestation ID\n /\nexport async function queryByAttestationId(\n attestationId: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<NostrEvent[]> {\n const events: NostrEvent[] = [];\n\n log.info({ attestationId, relayCount: relays.length }, 'Querying relays for attestation');\n\n // One shared deadline for the whole fan-out — see FANOUT_DEADLINE_MS.\n\n const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;\n\n const queryPromises = relays.map(async (relayUrl) => {\n let ws: WebSocket \| null = null;\n\n try {\n ws = new WebSocket(relayUrl);\n const wsRef = ws; // Capture for closures\n\n await new Promise<void>((resolve, reject) => {\n const timeout = setTimeout(() => {\n wsRef.close();\n reject(new Error('Query timeout'));\n }, budgetFor(deadlineAt));\n\n const cleanup = () => {\n clearTimeout(timeout);\n wsRef.close();\n };\n\n wsRef.onopen = () => {\n // Send REQ message for kind 30078 with d-tag = attestation_id\n const subscriptionId = `ochk_${Date.now()}`;\n wsRef.send(\n JSON.stringify([\n 'REQ',\n subscriptionId,\n {\n kinds: [30078],\n '#d': [attestationId],\n limit: 1,\n },\n ])\n );\n };\n\n wsRef.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n if (data[0] === 'EVENT') {\n events.push(data[2]);\n } else if (data[0] === 'EOSE') {\n cleanup();\n resolve();\n }\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to parse event');\n }\n };\n\n wsRef.onerror = (err) => {\n log.error({ relay: relayUrl, error: err }, 'WebSocket error during query');\n cleanup();\n reject(err);\n };\n\n wsRef.onclose = () => {\n clearTimeout(timeout);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to query relay');\n } finally {\n // Ensure WebSocket is closed\n if (ws && ws.readyState !== WebSocket.CLOSED) {\n ws.close();\n }\n }\n });\n\n await Promise.allSettled(queryPromises);\n\n log.info({ eventCount: events.length }, 'Query complete');\n\n return events;\n}\n\n/\n Query relays for attestations by Bitcoin address\n /\nexport async function queryByAddress(\n address: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<NostrEvent[]> {\n const events: NostrEvent[] = [];\n\n log.info({ address, relayCount: relays.length }, 'Querying relays for address');\n\n // One shared deadline for the whole fan-out — see FANOUT_DEADLINE_MS.\n\n const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;\n\n const queryPromises = relays.map(async (relayUrl) => {\n try {\n const ws = new WebSocket(relayUrl);\n\n await new Promise<void>((resolve, reject) => {\n const timeout = setTimeout(() => {\n ws.close();\n reject(new Error('Query timeout'));\n }, budgetFor(deadlineAt));\n\n ws.onopen = () => {\n const subscriptionId = `ochk_addr_${Date.now()}`;\n ws.send(\n JSON.stringify([\n 'REQ',\n subscriptionId,\n {\n kinds: [30078],\n // `#t`, NOT `#address`: NIP-12 relays index\n // single-letter tags only, so `#address`\n // matched nothing on any relay and this\n // function returned empty for every real\n // attestation. attest.ochk.io's verifier has\n // queried `#t` since the same fix landed\n // there; this is the back-port.\n '#t': [address],\n limit: 50,\n },\n ])\n );\n };\n\n ws.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n if (data[0] === 'EVENT') {\n events.push(data[2]);\n } else if (data[0] === 'EOSE') {\n clearTimeout(timeout);\n ws.close();\n resolve();\n }\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to parse event');\n }\n };\n\n ws.onerror = (err) => {\n clearTimeout(timeout);\n log.error({ relay: relayUrl, error: err }, 'WebSocket error during query');\n reject(err);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to query relay');\n }\n });\n\n await Promise.allSettled(queryPromises);\n\n log.info({ eventCount: events.length }, 'Query complete');\n\n return events;\n}\n\n/\n Query relays for attestations by identity (any protocol)\n /\nexport async function queryByIdentity(\n protocol: string,\n identifier: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<NostrEvent[]> {\n const events: NostrEvent[] = [];\n const identityTag = `${protocol}:${identifier}`;\n\n log.info({ protocol, identifier, relayCount: relays.length }, 'Querying relays for identity');\n\n // One shared deadline for the whole fan-out — see FANOUT_DEADLINE_MS.\n\n const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;\n\n const queryPromises = relays.map(async (relayUrl) => {\n try {\n const ws = new WebSocket(relayUrl);\n\n await new Promise<void>((resolve, reject) => {\n const timeout = setTimeout(() => {\n ws.close();\n reject(new Error('Query timeout'));\n }, budgetFor(deadlineAt));\n\n ws.onopen = () => {\n const subscriptionId = `ochk_identity_${Date.now()}`;\n ws.send(\n JSON.stringify([\n 'REQ',\n subscriptionId,\n {\n kinds: [30078],\n '#i': [identityTag],\n limit: 10,\n },\n ])\n );\n };\n\n ws.onmessage = (msg) => {\n try {\n const data = JSON.parse(msg.data);\n if (data[0] === 'EVENT') {\n events.push(data[2]);\n } else if (data[0] === 'EOSE') {\n clearTimeout(timeout);\n ws.close();\n resolve();\n }\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to parse event');\n }\n };\n\n ws.onerror = (err) => {\n clearTimeout(timeout);\n log.error({ relay: relayUrl, error: err }, 'WebSocket error during query');\n reject(err);\n };\n });\n } catch (err) {\n log.error({ relay: relayUrl, error: err }, 'Failed to query relay');\n }\n });\n\n await Promise.allSettled(queryPromises);\n\n log.info({ eventCount: events.length }, 'Query complete');\n\n return events;\n}\n\n/\n Verify attestation envelope integrity\n * Checks that the attestation ID matches the message hash\n /\nexport async function verifyAttestationEnvelope(envelope: AttestationEnvelope): Promise<boolean> {\n try {\n // Re-compute attestation ID from message\n const encoder = new TextEncoder();\n const data = encoder.encode(envelope.message);\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n const computedId = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');\n\n return computedId === envelope.attestation_id;\n } catch (err) {\n log.error({ error: err }, 'Failed to verify attestation envelope');\n return false;\n }\n}\n\n/\n Parse attestation envelope from Nostr event content\n /\nexport function parseAttestationFromEvent(event: NostrEvent): AttestationEnvelope \| null {\n try {\n const envelope = JSON.parse(event.content) as AttestationEnvelope;\n return envelope;\n } catch (err) {\n log.error({ eventId: event.id, error: err }, 'Failed to parse attestation from event');\n return null;\n }\n}\n","/\n Nostr Cryptographic Functions\n * Implements NIP-01 event ID computation and signature verification\n /\n\nimport type { NostrEvent } from './types';\n\nimport { createLogger } from './utils/logger';\n\ntype Nip07Window = {\n nostr?: {\n getPublicKey: () => Promise<string>;\n signEvent: (event: Omit<NostrEvent, 'id' \| 'sig'>) => Promise<NostrEvent>;\n _metadata?: { name?: string; version?: string };\n };\n};\n\nconst log = createLogger('ocp/nostr-crypto');\n\n/\n Compute Nostr event ID according to NIP-01\n * Event ID is the SHA-256 hash of the serialized event\n * Serialization: [0, pubkey, created_at, kind, tags, content]\n /\nexport async function computeNostrEventId(event: Omit<NostrEvent, 'id' \| 'sig'>): Promise<string> {\n // Serialize event according to NIP-01\n const serialized = JSON.stringify([\n 0, // Reserved for future use\n event.pubkey,\n event.created_at,\n event.kind,\n event.tags,\n event.content,\n ]);\n\n log.debug({ serialized }, 'Computing event ID');\n\n // Compute SHA-256 hash\n const encoder = new TextEncoder();\n const data = encoder.encode(serialized);\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n\n // Convert to lowercase hex\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n const hashHex = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');\n\n log.debug({ eventId: hashHex }, 'Computed event ID');\n\n return hashHex;\n}\n\n/\n Verify Nostr event ID\n * Recomputes the ID and checks if it matches\n /\nexport async function verifyNostrEventId(event: NostrEvent): Promise<boolean> {\n const computedId = await computeNostrEventId(event);\n return computedId === event.id;\n}\n\n/\n Check if NIP-07 extension is available\n * NIP-07 provides window.nostr for signing events\n /\nexport function isNip07Available(): boolean {\n if (typeof window === 'undefined') {\n return false;\n }\n\n return !!(window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n}\n\n/\n Get Nostr public key from NIP-07 extension\n * Returns null if extension not available or user denies\n /\nexport async function getNostrPublicKey(): Promise<string \| null> {\n if (!isNip07Available()) {\n log.warn('NIP-07 extension not available');\n return null;\n }\n\n try {\n const nostr = (window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n const pubkey = await nostr.getPublicKey();\n log.info({ pubkey }, 'Got Nostr public key from NIP-07');\n return pubkey;\n } catch (err) {\n log.error({ error: err }, 'Failed to get Nostr public key');\n return null;\n }\n}\n\n/\n Sign Nostr event using NIP-07 extension\n * Returns signed event with id and sig fields\n /\nexport async function signNostrEvent(\n event: Omit<NostrEvent, 'id' \| 'sig'>\n): Promise<NostrEvent \| null> {\n if (!isNip07Available()) {\n log.warn('NIP-07 extension not available');\n return null;\n }\n\n try {\n const nostr = (window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n\n // NIP-07 signEvent expects the event without id and sig\n const signedEvent = await nostr.signEvent(event);\n\n log.info({ eventId: signedEvent.id }, 'Signed Nostr event with NIP-07');\n\n return signedEvent as NostrEvent;\n } catch (err) {\n log.error({ error: err }, 'Failed to sign Nostr event');\n return null;\n }\n}\n\n// Previously this file exported `generateEphemeralKeypair()` and\n// `signEventWithEphemeralKey()` for demo purposes. Both produced non-schnorr\n// values that Nostr relays would silently reject — creating the false\n// impression that publishing had succeeded. They have been removed. All Nostr\n// signing now flows through `signNostrEvent()` / `window.nostr` (NIP-07).\n\n/\n Validate Nostr event structure\n /\nexport function validateNostrEvent(event: unknown): event is NostrEvent {\n if (typeof event !== 'object' \|\| event === null) return false;\n const e = event as Record<string, unknown>;\n\n if (typeof e.id !== 'string' \|\| (e.id as string).length !== 64) return false;\n if (typeof e.pubkey !== 'string' \|\| (e.pubkey as string).length !== 64) return false;\n if (typeof e.created_at !== 'number') return false;\n if (typeof e.kind !== 'number') return false;\n if (!Array.isArray(e.tags)) return false;\n if (typeof e.content !== 'string') return false;\n if (typeof e.sig !== 'string' \|\| (e.sig as string).length !== 128) return false;\n\n return true;\n}\n\n/\n Get NIP-07 extension info\n /\nexport function getNip07Info(): {\n available: boolean;\n name?: string;\n version?: string;\n} {\n if (!isNip07Available()) {\n return { available: false };\n }\n\n const nostr = (window as unknown as { nostr?: Nip07Window['nostr'] }).nostr!;\n\n return {\n available: true,\n name: nostr._metadata?.name,\n version: nostr._metadata?.version,\n };\n}\n","/\n Attestation Manager\n \n High-level API for creating, publishing, and discovering OrangeCheck attestations\n /\n\nimport type { AttestationEnvelope, IdentityBinding, NostrEvent, Scheme } from './types';\n\nimport { createAttestationEnvelope } from './canonical';\nimport {\n createAttestationEvent,\n DEFAULT_RELAYS,\n parseAttestationFromEvent,\n publishToRelays,\n queryByAddress,\n queryByAttestationId,\n queryByIdentity,\n verifyAttestationEnvelope,\n} from './nostr';\nimport { isNip07Available, signNostrEvent } from './nostr-crypto';\nimport { createLogger } from './utils/logger';\n\nconst log = createLogger('ocp/attestation');\n\n/\n Options for creating an attestation\n /\nexport interface CreateAttestationOptions {\n /* Canonical message /\n message: string;\n /* BIP-322 or legacy signature /\n signature: string;\n /* Signature scheme used /\n scheme: Scheme;\n /* Bitcoin address /\n address: string;\n /* Optional identity bindings /\n identities?: IdentityBinding[];\n /* Optional extension key-value pairs /\n extensions?: Record<string, string \| undefined>;\n}\n\n/\n Options for publishing an attestation to Nostr\n /\nexport interface PublishAttestationOptions {\n /* Attestation envelope to publish /\n envelope: AttestationEnvelope;\n /* Nostr public key (npub or hex) for signing the event /\n npub: string;\n /* Optional relay URLs (defaults to DEFAULT_RELAYS) /\n relays?: string[];\n}\n\n/\n Options for discovering attestations\n /\nexport interface DiscoverAttestationOptions {\n /* Search by attestation ID /\n attestationId?: string;\n /* Search by Bitcoin address /\n address?: string;\n /* Search by identity binding /\n identity?: { protocol: string; identifier: string };\n /* Optional relay URLs to query /\n relays?: string[];\n}\n\n/\n Result of publishing an attestation\n /\nexport interface PublishResult {\n /* Relays that successfully received the event /\n success: string[];\n /* Relays that failed to receive the event /\n failed: string[];\n}\n\n/\n Custom error for attestation operations\n /\nexport class AttestationError extends Error {\n constructor(\n message: string,\n public readonly code?: string\n ) {\n super(message);\n this.name = 'AttestationError';\n }\n}\n\n/\n Create an attestation envelope from a signed message\n \n @param options - Attestation creation options\n * @returns Attestation envelope ready for publishing\n * @throws {AttestationError} If envelope integrity check fails\n \n @example\n * ```typescript\n * const envelope = await createAttestation({\n * message: canonicalMessage,\n * signature: 'AkcwRAIg...',\n * scheme: 'bip322',\n * address: 'bc1q...',\n * identities: [{ protocol: 'nostr', identifier: 'npub1...' }],\n * });\n * ```\n /\nexport async function createAttestation(\n options: CreateAttestationOptions\n): Promise<AttestationEnvelope> {\n const { message, signature, scheme, address, identities = [], extensions = {} } = options;\n\n log.info({ address, identityCount: identities.length }, 'Creating attestation');\n\n const envelope = await createAttestationEnvelope(\n message,\n signature,\n scheme,\n address,\n identities,\n extensions\n );\n\n // Verify envelope integrity\n const isValid = await verifyAttestationEnvelope(envelope);\n if (!isValid) {\n throw new AttestationError(\n 'Attestation envelope integrity check failed',\n 'INTEGRITY_CHECK_FAILED'\n );\n }\n\n log.info({ attestationId: envelope.attestation_id }, 'Attestation created successfully');\n\n return envelope;\n}\n\n/\n Publish an attestation to Nostr relays\n \n Uses NIP-07 if available, falls back to ephemeral key for demo\n \n @param options - Publishing options\n * @returns Object with successful and failed relay URLs\n * @throws {AttestationError} If signing fails\n \n @example\n * ```typescript\n * const result = await publishAttestation({\n * envelope,\n * npub: 'npub1...',\n * relays: ['wss://relay.damus.io'],\n * });\n * console.log('Published to:', result.success);\n * ```\n /\nexport async function publishAttestation(\n options: PublishAttestationOptions\n): Promise<PublishResult> {\n const { envelope, npub, relays = DEFAULT_RELAYS } = options;\n\n log.info(\n { attestationId: envelope.attestation_id, relayCount: relays.length },\n 'Publishing attestation'\n );\n\n // Create unsigned event\n const unsignedEvent = createAttestationEvent(envelope, npub);\n\n // Nostr publishing requires a valid schnorr signature. Only NIP-07\n // (window.nostr) is supported. If no signer is present we refuse to\n // publish rather than emit an invalid-sig event that every relay will\n // silently reject — which would make the caller think it had succeeded.\n if (!isNip07Available()) {\n log.warn('NIP-07 unavailable — skipping Nostr publish');\n throw new Error(\n 'nostr_signer_unavailable: install a NIP-07 extension (e.g. nos2x, Alby) to publish'\n );\n }\n\n log.info('Using NIP-07 to sign event');\n const signedEvent = await signNostrEvent(unsignedEvent);\n if (!signedEvent) {\n throw new Error('nostr_signing_failed: NIP-07 extension rejected or errored');\n }\n\n const result = await publishToRelays(signedEvent, relays);\n\n log.info(\n {\n attestationId: envelope.attestation_id,\n successCount: result.success.length,\n failedCount: result.failed.length,\n },\n 'Publishing complete'\n );\n\n return result;\n}\n\n/\n Discover attestations from Nostr relays\n /\nexport async function discoverAttestations(\n options: DiscoverAttestationOptions\n): Promise<AttestationEnvelope[]> {\n const { attestationId, address, identity, relays = DEFAULT_RELAYS } = options;\n\n let events: NostrEvent[] = [];\n\n if (attestationId) {\n log.info({ attestationId }, 'Discovering by attestation ID');\n events = await queryByAttestationId(attestationId, relays);\n } else if (address) {\n log.info({ address }, 'Discovering by Bitcoin address');\n events = await queryByAddress(address, relays);\n } else if (identity) {\n log.info({ identity }, 'Discovering by identity');\n events = await queryByIdentity(identity.protocol, identity.identifier, relays);\n } else {\n throw new Error('Must provide attestationId, address, or identity');\n }\n\n // Parse and verify envelopes\n const envelopes: AttestationEnvelope[] = [];\n for (const event of events) {\n const envelope = parseAttestationFromEvent(event);\n if (envelope) {\n // Verify envelope integrity\n const isValid = await verifyAttestationEnvelope(envelope);\n if (isValid) {\n envelopes.push(envelope);\n } else {\n log.warn(\n { attestationId: envelope.attestation_id },\n 'Skipping invalid attestation envelope'\n );\n }\n }\n }\n\n log.info({ eventCount: events.length, validCount: envelopes.length }, 'Discovery complete');\n\n return envelopes;\n}\n\n/\n Verify an attestation by fetching it from Nostr and checking integrity\n /\nexport async function verifyAttestationById(\n attestationId: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<AttestationEnvelope \| null> {\n log.info({ attestationId }, 'Verifying attestation by ID');\n\n const envelopes = await discoverAttestations({ attestationId, relays });\n\n if (envelopes.length === 0) {\n log.warn({ attestationId }, 'Attestation not found on any relay');\n return null;\n }\n\n if (envelopes.length > 1) {\n log.warn(\n { attestationId, count: envelopes.length },\n 'Multiple attestations found with same ID - using first'\n );\n }\n\n return envelopes[0] \|\| null;\n}\n\n/\n Get all attestations for a Bitcoin address\n /\nexport async function getAttestationsForAddress(\n address: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<AttestationEnvelope[]> {\n log.info({ address }, 'Getting all attestations for address');\n return discoverAttestations({ address, relays });\n}\n\n/\n Get all attestations for an identity\n /\nexport async function getAttestationsForIdentity(\n protocol: string,\n identifier: string,\n relays: string[] = DEFAULT_RELAYS\n): Promise<AttestationEnvelope[]> {\n log.info({ protocol, identifier }, 'Getting all attestations for identity');\n return discoverAttestations({ identity: { protocol, identifier }, relays });\n}\n\n/\n Format identities for display as a comma-separated `protocol:identifier` list.\n * Same wire format the canonical message uses.\n /\nexport function formatIdentitiesForDisplay(identities: IdentityBinding[]): string {\n return identities.map((id) => `${id.protocol}:${id.identifier}`).join(', ');\n}\n\n/\n Build the canonical shareable URL for an attestation. Matches the live\n * `/attest/[id]` route on attest.ochk.io. Pass a different `baseUrl` for forks /\n * self-hosted verifiers.\n /\nexport function getVerificationUrl(\n attestationId: string,\n baseUrl = 'https://attest.ochk.io'\n): string {\n return `${baseUrl}/attest/${attestationId}`;\n}\n\n/\n Reverse of `getVerificationUrl` — pull an attestation id back out of a\n * `/attest/<id>` or legacy `/verify?id=<id>` URL. Returns `null` if the URL\n * shape doesn't match.\n */\nexport function extractAttestationIdFromUrl(url: string): string \| null {\n try {\n const u = new URL(url);\n // New canonical form: /attest/<id>\n const m = u.pathname.match(/^\\/attest\\/([0-9a-f]{64})\\/?$/i);\n if (m) return m[1]!.toLowerCase();\n // Legacy form: /verify?id=<id>\n const q = u.searchParams.get('id');\n if (q && /^[0-9a-f]{64}$/i.test(q)) return q.toLowerCase();\n return null;\n } catch {\n return null;\n }\n}\n"]}

package/dist/identity.js CHANGED Viewed

@@ -376,9 +376,9 @@ function getGistCreationUrl() {
 }
 var DEFAULT_RELAYS = [
   "wss://relay.damus.io",
-  "wss://relay.nostr.band",
   "wss://nos.lol",
-  "wss://relay.snort.social"
+  "wss://relay.snort.social",
+  "wss://relay.ochk.io"
 ];
 // src/identity/nostr.ts