@orangecheck/sdk 1.9.0 → 1.11.0

package/dist/index.js

@@ -2,31 +2,10 @@
 
 var base = require('@scure/base');
 var buffer = require('buffer');
-var bip322Js = require('bip322-js');
-var bitcoinMessage = require('bitcoinjs-message');
+var bip322 = require('@orangecheck/bip322');
 var secp256k1_js = require('@noble/curves/secp256k1.js');
 var sha2_js = require('@noble/hashes/sha2.js');
 
-function _interopNamespace(e) {
-  if (e && e.__esModule) return e;
-  var n = Object.create(null);
-  if (e) {
-    Object.keys(e).forEach(function (k) {
-      if (k !== 'default') {
-        var d = Object.getOwnPropertyDescriptor(e, k);
-        Object.defineProperty(n, k, d.get ? d : {
-          enumerable: true,
-          get: function () { return e[k]; }
-        });
-      }
-    });
-  }
-  n.default = e;
-  return Object.freeze(n);
-}
-
-var bitcoinMessage__namespace = /*#__PURE__*/_interopNamespace(bitcoinMessage);
-
 // src/canonical.ts
 function toLowerHex(bytes) {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
@@ -883,87 +862,79 @@ async function verifySignature({
   sig,
   scheme
 }) {
-  try {
-    const detectedScheme = scheme || detectSignatureScheme(addr, sig);
+  const detectedScheme = scheme || detectSignatureScheme(addr, sig);
+  log4.debug(
+    { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
+    "Verifying signature"
+  );
+  if (detectedScheme === "bip322") {
+    const sigBase64 = toBase64Maybe(sig);
     log4.debug(
-      { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
-      "Verifying signature"
+      { sigBase64: sigBase64.substring(0, 50) + "..." },
+      "Signature converted to base64"
     );
-    if (detectedScheme === "bip322") {
-      const sigBase64 = toBase64Maybe(sig);
-      log4.debug(
-        { sigBase64: sigBase64.substring(0, 50) + "..." },
-        "Signature converted to base64"
-      );
-      log4.debug(
-        {
-          msgFull: msg,
-          msgLines: msg.split("\n").length,
-          msgFirstLine: msg.split("\n")[0],
-          msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
-        },
-        "Message being verified"
-      );
-      const ok = bip322Js.Verifier.verifySignature(addr, msg, sigBase64);
-      log4.info({ addr, ok }, "BIP-322 verification result");
-      if (!ok) {
-        const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
-        if (isSegWit && sigBase64.length === 88) {
-          log4.warn(
-            { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
-            "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
-          );
-        } else {
-          log4.error(
-            {
-              addr,
-              sigLength: sigBase64.length,
-              msgLength: msg.length,
-              msgPreview: msg.substring(0, 200)
-            },
-            "BIP-322 verification failed - signature does not match message"
-          );
-        }
-      }
-      return ok ? "sig_ok_bip322" : "sig_invalid";
-    }
-    if (detectedScheme === "legacy") {
-      const sigBase64 = toBase64Maybe(sig);
-      if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
-        log4.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
-        return "sig_unsupported_script";
-      }
-      log4.debug(
-        {
-          addr,
-          sigBase64: sigBase64.substring(0, 50) + "...",
-          msgPreview: msg.substring(0, 100) + "...",
-          msgLength: msg.length
-        },
-        "Verifying legacy signature"
-      );
-      const ok = bitcoinMessage__namespace.verify(msg, addr, sigBase64);
-      log4.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
-      if (!ok) {
+    log4.debug(
+      {
+        msgFull: msg,
+        msgLines: msg.split("\n").length,
+        msgFirstLine: msg.split("\n")[0],
+        msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
+      },
+      "Message being verified"
+    );
+    const ok = bip322.verifySignature(addr, msg, sigBase64);
+    log4.info({ addr, ok }, "BIP-322 verification result");
+    if (!ok) {
+      const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+      if (isSegWit && sigBase64.length === 88) {
+        log4.warn(
+          { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
+          "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
+        );
+      } else {
         log4.error(
           {
             addr,
-            msgFirstLine: msg.split("\n")[0],
-            sigFormat: sigBase64.substring(0, 10)
+            sigLength: sigBase64.length,
+            msgLength: msg.length,
+            msgPreview: msg.substring(0, 200)
           },
-          "Legacy signature verification failed - check message format and signature"
+          "BIP-322 verification failed - signature does not match message"
         );
       }
-      return ok ? "sig_ok_legacy" : "sig_invalid";
     }
-    return "invalid_scheme";
-  } catch (err) {
-    log4.error(
-      { addr, error: err instanceof Error ? err.message : String(err) },
-      "Signature verification error"
+    return ok ? "sig_ok_bip322" : "sig_invalid";
+  }
+  if (detectedScheme === "legacy") {
+    const sigBase64 = toBase64Maybe(sig);
+    if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
+      log4.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
+      return "sig_unsupported_script";
+    }
+    log4.debug(
+      {
+        addr,
+        sigBase64: sigBase64.substring(0, 50) + "...",
+        msgPreview: msg.substring(0, 100) + "...",
+        msgLength: msg.length
+      },
+      "Verifying legacy signature"
     );
-    return "sig_invalid";
+    const ok = bip322.verifySignature(addr, msg, sigBase64);
+    log4.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
+    if (!ok) {
+      log4.error(
+        {
+          addr,
+          msgFirstLine: msg.split("\n")[0],
+          sigFormat: sigBase64.substring(0, 10)
+        },
+        "Legacy signature verification failed - check message format and signature"
+      );
+    }
+    return ok ? "sig_ok_legacy" : "sig_invalid";
   }
+  return "invalid_scheme";
 }
 function parseCanonicalMessage(msg) {
   const lines = msg.split("\n").map((l) => l.trim());
@@ -1094,7 +1065,7 @@ function computeMetrics(utxos, bondAmount) {
   const days_unspent = Math.max(0, Math.floor((Date.now() / 1e3 - oldestTime) / (24 * 60 * 60)));
   return { sats_bonded, days_unspent, confirmed_balance };
 }
-async function verify2(input, opts = {}) {
+async function verify(input, opts = {}) {
   const codes = [];
   let network = "mainnet";
   try {
@@ -1249,7 +1220,7 @@ async function check(params) {
     return { ok: false, sats: 0, days: 0, score: 0, reasons: ["not_found"] };
   }
   const shared = identity ? await backsOtherIdentity(env, identity, relays) : false;
-  const outcome = await verify2(
+  const outcome = await verify(
     {
       addr: env.address,
       msg: env.message,
@@ -1437,21 +1408,17 @@ async function verifyChallenge(opts) {
     return { ok: false, reason: "purpose_mismatch" };
   }
   const scheme = opts.scheme ?? "bip322";
-  let sigValid = false;
-  try {
-    if (scheme === "bip322") {
-      const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? buffer.Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
-      sigValid = bip322Js.Verifier.verifySignature(address, opts.message, sigBase64);
-    } else if (scheme === "legacy") {
-      if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
-        return { ok: false, reason: "sig_unsupported_scheme" };
-      }
-      sigValid = bitcoinMessage__namespace.verify(opts.message, address, opts.signature);
-    } else {
+  let sigValid;
+  if (scheme === "bip322") {
+    const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? buffer.Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
+    sigValid = bip322.verifySignature(address, opts.message, sigBase64);
+  } else if (scheme === "legacy") {
+    if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
       return { ok: false, reason: "sig_unsupported_scheme" };
     }
-  } catch {
-    sigValid = false;
+    sigValid = bip322.verifySignature(address, opts.message, opts.signature);
+  } else {
+    return { ok: false, reason: "sig_unsupported_scheme" };
   }
   if (!sigValid) return { ok: false, reason: "sig_invalid" };
   return {
@@ -1617,11 +1584,14 @@ function isValidDomain(domain) {
   const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
   return domainPattern.test(cleanDomain);
 }
-function isDnsIdentityVerified(attestationId, _domain, cachedContent) {
-  if (!cachedContent) {
+function isDnsIdentityVerified(attestationId, domain, cachedContent) {
+  if (!cachedContent || !cachedContent.includes(attestationId)) {
     return false;
   }
-  return cachedContent.includes(attestationId);
+  const named = /^Domain:\s*(\S+)\s*$/im.exec(cachedContent);
+  if (!named) return true;
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "").toLowerCase();
+  return named[1].toLowerCase() === cleanDomain;
 }
 
 // src/identity/github.ts
@@ -1765,8 +1735,10 @@ This gist proves that I control both:
 Learn more about OrangeCheck: https://ochk.io
 `;
 }
-function isGitHubIdentityVerified(attestationId, _username, cachedGists) {
+function isGitHubIdentityVerified(attestationId, username, cachedGists) {
+  const login = username.replace(/^@/, "").toLowerCase();
   return cachedGists.some((gist) => {
+    if (gist.owner?.login?.toLowerCase() !== login) return false;
     if (gist.description?.includes(attestationId)) {
       return true;
     }
@@ -1865,6 +1837,9 @@ async function queryNostrEvents(options) {
   return events;
 }
 async function verifyNostrEventSignature(event) {
+  return nostrEventSignatureValid(event);
+}
+function nostrEventSignatureValid(event) {
   try {
     if (!event.id || !event.sig || !event.pubkey || typeof event.id !== "string" || typeof event.sig !== "string" || typeof event.pubkey !== "string" || event.sig.length !== 128 || !HEX_64_RE2.test(event.id) || !HEX_64_RE2.test(event.pubkey)) {
       return false;
@@ -1951,7 +1926,7 @@ The verification will search Nostr relays for your note and confirm you control
 function isNostrIdentityVerified(attestationId, npub, cachedEvents) {
   const pubkeyHex = npubToHex(npub);
   return cachedEvents.some(
-    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId)
+    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId) && nostrEventSignatureValid(event)
   );
 }
 
@@ -2299,7 +2274,7 @@ exports.queryRecent = queryRecent;
 exports.requiresManualVerification = requiresManualVerification;
 exports.signNostrEvent = signNostrEvent;
 exports.supportsAutomaticVerification = supportsAutomaticVerification;
-exports.verify = verify2;
+exports.verify = verify;
 exports.verifyAllIdentities = verifyAllIdentities;
 exports.verifyAttestationById = verifyAttestationById;
 exports.verifyChallenge = verifyChallenge;