@orangecheck/sdk 1.9.0 → 1.11.0

package/dist/index.mjs

@@ -1,7 +1,6 @@
 import { bech32 } from '@scure/base';
 import { Buffer } from 'buffer';
-import { Verifier } from 'bip322-js';
-import * as bitcoinMessage from 'bitcoinjs-message';
+import { verifySignature as verifySignature$1 } from '@orangecheck/bip322';
 import { schnorr } from '@noble/curves/secp256k1.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 
@@ -861,87 +860,79 @@ async function verifySignature({
   sig,
   scheme
 }) {
-  try {
-    const detectedScheme = scheme || detectSignatureScheme(addr, sig);
+  const detectedScheme = scheme || detectSignatureScheme(addr, sig);
+  log4.debug(
+    { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
+    "Verifying signature"
+  );
+  if (detectedScheme === "bip322") {
+    const sigBase64 = toBase64Maybe(sig);
     log4.debug(
-      { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
-      "Verifying signature"
+      { sigBase64: sigBase64.substring(0, 50) + "..." },
+      "Signature converted to base64"
     );
-    if (detectedScheme === "bip322") {
-      const sigBase64 = toBase64Maybe(sig);
-      log4.debug(
-        { sigBase64: sigBase64.substring(0, 50) + "..." },
-        "Signature converted to base64"
-      );
-      log4.debug(
-        {
-          msgFull: msg,
-          msgLines: msg.split("\n").length,
-          msgFirstLine: msg.split("\n")[0],
-          msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
-        },
-        "Message being verified"
-      );
-      const ok = Verifier.verifySignature(addr, msg, sigBase64);
-      log4.info({ addr, ok }, "BIP-322 verification result");
-      if (!ok) {
-        const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
-        if (isSegWit && sigBase64.length === 88) {
-          log4.warn(
-            { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
-            "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
-          );
-        } else {
-          log4.error(
-            {
-              addr,
-              sigLength: sigBase64.length,
-              msgLength: msg.length,
-              msgPreview: msg.substring(0, 200)
-            },
-            "BIP-322 verification failed - signature does not match message"
-          );
-        }
-      }
-      return ok ? "sig_ok_bip322" : "sig_invalid";
-    }
-    if (detectedScheme === "legacy") {
-      const sigBase64 = toBase64Maybe(sig);
-      if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
-        log4.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
-        return "sig_unsupported_script";
-      }
-      log4.debug(
-        {
-          addr,
-          sigBase64: sigBase64.substring(0, 50) + "...",
-          msgPreview: msg.substring(0, 100) + "...",
-          msgLength: msg.length
-        },
-        "Verifying legacy signature"
-      );
-      const ok = bitcoinMessage.verify(msg, addr, sigBase64);
-      log4.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
-      if (!ok) {
+    log4.debug(
+      {
+        msgFull: msg,
+        msgLines: msg.split("\n").length,
+        msgFirstLine: msg.split("\n")[0],
+        msgLastLine: msg.split("\n")[msg.split("\n").length - 1]
+      },
+      "Message being verified"
+    );
+    const ok = verifySignature$1(addr, msg, sigBase64);
+    log4.info({ addr, ok }, "BIP-322 verification result");
+    if (!ok) {
+      const isSegWit = addr.startsWith("bc1") || addr.startsWith("tb1");
+      if (isSegWit && sigBase64.length === 88) {
+        log4.warn(
+          { addr, wallet: "possibly Electrum", sigLength: sigBase64.length },
+          "BIP-322 verification failed - likely Electrum wallet (does not support BIP-322 for SegWit)"
+        );
+      } else {
         log4.error(
           {
             addr,
-            msgFirstLine: msg.split("\n")[0],
-            sigFormat: sigBase64.substring(0, 10)
+            sigLength: sigBase64.length,
+            msgLength: msg.length,
+            msgPreview: msg.substring(0, 200)
           },
-          "Legacy signature verification failed - check message format and signature"
+          "BIP-322 verification failed - signature does not match message"
         );
       }
-      return ok ? "sig_ok_legacy" : "sig_invalid";
     }
-    return "invalid_scheme";
-  } catch (err) {
-    log4.error(
-      { addr, error: err instanceof Error ? err.message : String(err) },
-      "Signature verification error"
+    return ok ? "sig_ok_bip322" : "sig_invalid";
+  }
+  if (detectedScheme === "legacy") {
+    const sigBase64 = toBase64Maybe(sig);
+    if (!addr.startsWith("1") && !addr.startsWith("m") && !addr.startsWith("n")) {
+      log4.warn({ addr }, "Legacy signature attempted on non-P2PKH address");
+      return "sig_unsupported_script";
+    }
+    log4.debug(
+      {
+        addr,
+        sigBase64: sigBase64.substring(0, 50) + "...",
+        msgPreview: msg.substring(0, 100) + "...",
+        msgLength: msg.length
+      },
+      "Verifying legacy signature"
     );
-    return "sig_invalid";
+    const ok = verifySignature$1(addr, msg, sigBase64);
+    log4.info({ addr, ok, sigBase64Length: sigBase64.length }, "Legacy verification result");
+    if (!ok) {
+      log4.error(
+        {
+          addr,
+          msgFirstLine: msg.split("\n")[0],
+          sigFormat: sigBase64.substring(0, 10)
+        },
+        "Legacy signature verification failed - check message format and signature"
+      );
+    }
+    return ok ? "sig_ok_legacy" : "sig_invalid";
   }
+  return "invalid_scheme";
 }
 function parseCanonicalMessage(msg) {
   const lines = msg.split("\n").map((l) => l.trim());
@@ -1072,7 +1063,7 @@ function computeMetrics(utxos, bondAmount) {
   const days_unspent = Math.max(0, Math.floor((Date.now() / 1e3 - oldestTime) / (24 * 60 * 60)));
   return { sats_bonded, days_unspent, confirmed_balance };
 }
-async function verify2(input, opts = {}) {
+async function verify(input, opts = {}) {
   const codes = [];
   let network = "mainnet";
   try {
@@ -1227,7 +1218,7 @@ async function check(params) {
     return { ok: false, sats: 0, days: 0, score: 0, reasons: ["not_found"] };
   }
   const shared = identity ? await backsOtherIdentity(env, identity, relays) : false;
-  const outcome = await verify2(
+  const outcome = await verify(
     {
       addr: env.address,
       msg: env.message,
@@ -1415,21 +1406,17 @@ async function verifyChallenge(opts) {
     return { ok: false, reason: "purpose_mismatch" };
   }
   const scheme = opts.scheme ?? "bip322";
-  let sigValid = false;
-  try {
-    if (scheme === "bip322") {
-      const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
-      sigValid = Verifier.verifySignature(address, opts.message, sigBase64);
-    } else if (scheme === "legacy") {
-      if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
-        return { ok: false, reason: "sig_unsupported_scheme" };
-      }
-      sigValid = bitcoinMessage.verify(opts.message, address, opts.signature);
-    } else {
+  let sigValid;
+  if (scheme === "bip322") {
+    const sigBase64 = /^[0-9a-fA-F]+$/.test(opts.signature) && opts.signature.length % 2 === 0 ? Buffer.from(opts.signature, "hex").toString("base64") : opts.signature;
+    sigValid = verifySignature$1(address, opts.message, sigBase64);
+  } else if (scheme === "legacy") {
+    if (!/^[1m][a-km-zA-HJ-NP-Z1-9]{25,34}$/.test(address)) {
       return { ok: false, reason: "sig_unsupported_scheme" };
     }
-  } catch {
-    sigValid = false;
+    sigValid = verifySignature$1(address, opts.message, opts.signature);
+  } else {
+    return { ok: false, reason: "sig_unsupported_scheme" };
   }
   if (!sigValid) return { ok: false, reason: "sig_invalid" };
   return {
@@ -1595,11 +1582,14 @@ function isValidDomain(domain) {
   const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
   return domainPattern.test(cleanDomain);
 }
-function isDnsIdentityVerified(attestationId, _domain, cachedContent) {
-  if (!cachedContent) {
+function isDnsIdentityVerified(attestationId, domain, cachedContent) {
+  if (!cachedContent || !cachedContent.includes(attestationId)) {
     return false;
   }
-  return cachedContent.includes(attestationId);
+  const named = /^Domain:\s*(\S+)\s*$/im.exec(cachedContent);
+  if (!named) return true;
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "").toLowerCase();
+  return named[1].toLowerCase() === cleanDomain;
 }
 
 // src/identity/github.ts
@@ -1743,8 +1733,10 @@ This gist proves that I control both:
 Learn more about OrangeCheck: https://ochk.io
 `;
 }
-function isGitHubIdentityVerified(attestationId, _username, cachedGists) {
+function isGitHubIdentityVerified(attestationId, username, cachedGists) {
+  const login = username.replace(/^@/, "").toLowerCase();
   return cachedGists.some((gist) => {
+    if (gist.owner?.login?.toLowerCase() !== login) return false;
     if (gist.description?.includes(attestationId)) {
       return true;
     }
@@ -1843,6 +1835,9 @@ async function queryNostrEvents(options) {
   return events;
 }
 async function verifyNostrEventSignature(event) {
+  return nostrEventSignatureValid(event);
+}
+function nostrEventSignatureValid(event) {
   try {
     if (!event.id || !event.sig || !event.pubkey || typeof event.id !== "string" || typeof event.sig !== "string" || typeof event.pubkey !== "string" || event.sig.length !== 128 || !HEX_64_RE2.test(event.id) || !HEX_64_RE2.test(event.pubkey)) {
       return false;
@@ -1929,7 +1924,7 @@ The verification will search Nostr relays for your note and confirm you control
 function isNostrIdentityVerified(attestationId, npub, cachedEvents) {
   const pubkeyHex = npubToHex(npub);
   return cachedEvents.some(
-    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId)
+    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId) && nostrEventSignatureValid(event)
   );
 }
 
@@ -2223,6 +2218,6 @@ var STATUS_META = {
   }
 };
 
-export { DEFAULT_RELAYS, FANOUT_DEADLINE_MS, STATUS_META, buildCanonicalMessage, check, computeAllScores, computeScore, createAttestation, createAttestationEnvelope, createAttestationEvent, discoverAttestations, extractAttestationIdFromUrl, formatIdentities, formatIdentitiesForDisplay, generateAttestationId, generateGistTemplate, generateTweetText, generateWellKnownContent, getAttestationsForAddress, getAttestationsForIdentity, getDnsVerificationInstructions, getGistCreationUrl, getGitHubVerificationInstructions, getManualVerificationInstructions, getNip07Info, getNostrPublicKey, getNostrVerificationInstructions, getTweetUrl, getTwitterComposeUrl, getTwitterVerificationInstructions, getVerificationInstructions, getVerificationSummary, getVerificationUrl, getWellKnownUrl, isDnsIdentityVerified, isGitHubIdentityVerified, isNip07Available, isNostrIdentityVerified, isValidDomain, isValidTweetUrl, issueChallenge, nostrIdentifierForms, nostrPubkeyToHex, parseAttestationFromEvent, parseIdentities, publishAttestation, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, requiresManualVerification, signNostrEvent, supportsAutomaticVerification, verify2 as verify, verifyAllIdentities, verifyAttestationById, verifyChallenge, verifyDnsIdentity, verifyGitHubIdentity, verifyIdentity, verifyNostrIdentity, verifyTwitterIdentity };
+export { DEFAULT_RELAYS, FANOUT_DEADLINE_MS, STATUS_META, buildCanonicalMessage, check, computeAllScores, computeScore, createAttestation, createAttestationEnvelope, createAttestationEvent, discoverAttestations, extractAttestationIdFromUrl, formatIdentities, formatIdentitiesForDisplay, generateAttestationId, generateGistTemplate, generateTweetText, generateWellKnownContent, getAttestationsForAddress, getAttestationsForIdentity, getDnsVerificationInstructions, getGistCreationUrl, getGitHubVerificationInstructions, getManualVerificationInstructions, getNip07Info, getNostrPublicKey, getNostrVerificationInstructions, getTweetUrl, getTwitterComposeUrl, getTwitterVerificationInstructions, getVerificationInstructions, getVerificationSummary, getVerificationUrl, getWellKnownUrl, isDnsIdentityVerified, isGitHubIdentityVerified, isNip07Available, isNostrIdentityVerified, isValidDomain, isValidTweetUrl, issueChallenge, nostrIdentifierForms, nostrPubkeyToHex, parseAttestationFromEvent, parseIdentities, publishAttestation, publishToRelays, queryByAddress, queryByAttestationId, queryByIdentity, queryRecent, requiresManualVerification, signNostrEvent, supportsAutomaticVerification, verify, verifyAllIdentities, verifyAttestationById, verifyChallenge, verifyDnsIdentity, verifyGitHubIdentity, verifyIdentity, verifyNostrIdentity, verifyTwitterIdentity };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map