did-beta-bch 1.0.0 → 1.0.2

package/dist/credentials.d.ts

@@ -9,6 +9,8 @@ export interface CredentialPayload {
     subject: string;
     type: string;
     issuedAt: number;
+    rating?: 1 | 2 | 3 | 4 | 5;
+    comment?: string;
     expiry?: number;
     claims?: Record<string, string>;
 }
@@ -25,3 +27,22 @@ export declare function issueCredential(subjectNpub: string, type: string, issue
 }>;
 /** Resolve all credentials issued to an npub */
 export declare function resolveCredentials(npub: string, relays?: string[]): Promise<IssuedCredential[]>;
+/** Issue a star rating (1–5) to an npub — usable by any wallet or app */
+export declare function issueRating(subjectNpub: string, rating: 1 | 2 | 3 | 4 | 5, issuerPrivkey: Uint8Array, opts?: {
+    comment?: string;
+    txid?: string;
+    network?: string;
+}, relays?: string[]): Promise<{
+    credential: IssuedCredential;
+    results: RelayResult[];
+}>;
+/** Revoke a credential by publishing a NIP-09 kind:5 deletion event */
+export declare function revokeCredential(eventId: string, issuerPrivkey: Uint8Array, relays?: string[]): Promise<RelayResult[]>;
+/** Compute a reputation score for an npub based on ratings and credentials */
+export declare function scoreReputation(npub: string, relays?: string[]): Promise<{
+    credentialCount: number;
+    ratingCount: number;
+    averageRating: number | null;
+    uniqueIssuers: number;
+    score: number;
+}>;

package/dist/credentials.js

@@ -49,7 +49,16 @@ export async function resolveCredentials(npub, relays = DEFAULT_RELAYS) {
         "#t": ["cashlet-did-credential"],
         limit: 50,
     });
-    return events.map(e => {
+    // Fetch revocations and filter them out
+    const revocations = await queryRelays(relays, {
+        kinds: [5],
+        authors: events.map(e => e.pubkey),
+        limit: 100,
+    });
+    const revokedIds = new Set(revocations.flatMap(e => e.tags.filter((t) => t[0] === "e").map((t) => t[1])));
+    return events
+        .filter(e => !revokedIds.has(e.id))
+        .map(e => {
         try {
             const payload = JSON.parse(e.content);
             return { id: e.id, issuer: e.pubkey, payload, rawEvent: e };
@@ -59,3 +68,71 @@ export async function resolveCredentials(npub, relays = DEFAULT_RELAYS) {
         }
     }).filter(Boolean);
 }
+/** Issue a star rating (1–5) to an npub — usable by any wallet or app */
+export async function issueRating(subjectNpub, rating, issuerPrivkey, opts = {}, relays = DEFAULT_RELAYS) {
+    const claims = {};
+    if (opts.txid)
+        claims.txid = opts.txid;
+    if (opts.network)
+        claims.network = opts.network;
+    const decoded = nip19.decode(subjectNpub);
+    if (decoded.type !== "npub")
+        throw new Error("Invalid npub");
+    const subjectPubkey = decoded.data;
+    const payload = {
+        subject: subjectPubkey,
+        type: "rating",
+        issuedAt: Math.floor(Date.now() / 1000),
+        rating,
+        ...(opts.comment ? { comment: opts.comment } : {}),
+        ...(Object.keys(claims).length ? { claims } : {}),
+    };
+    const template = {
+        kind: CREDENTIAL_KIND,
+        created_at: payload.issuedAt,
+        tags: [
+            ["p", subjectPubkey],
+            ["credential-type", "rating"],
+            ["rating", String(rating)],
+            ["t", "cashlet-did-credential"],
+        ],
+        content: JSON.stringify(payload),
+    };
+    const signed = finalizeEvent(template, issuerPrivkey);
+    const results = await publishToRelays(relays, signed);
+    const { getPublicKey } = await import("nostr-tools");
+    return {
+        credential: { id: signed.id, issuer: getPublicKey(issuerPrivkey), payload, rawEvent: signed },
+        results,
+    };
+}
+/** Revoke a credential by publishing a NIP-09 kind:5 deletion event */
+export async function revokeCredential(eventId, issuerPrivkey, relays = DEFAULT_RELAYS) {
+    const template = {
+        kind: 5,
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [["e", eventId]],
+        content: "revoked",
+    };
+    const signed = finalizeEvent(template, issuerPrivkey);
+    return publishToRelays(relays, signed);
+}
+/** Compute a reputation score for an npub based on ratings and credentials */
+export async function scoreReputation(npub, relays = DEFAULT_RELAYS) {
+    const credentials = await resolveCredentials(npub, relays);
+    const ratings = credentials.filter(c => c.payload.type === "rating" && c.payload.rating);
+    const uniqueIssuers = new Set(credentials.map(c => c.issuer)).size;
+    const averageRating = ratings.length
+        ? ratings.reduce((sum, c) => sum + (c.payload.rating ?? 0), 0) / ratings.length
+        : null;
+    // Score: avg rating (0-50) + unique issuer bonus (0-50, caps at 10 issuers)
+    const ratingScore = averageRating ? (averageRating / 5) * 50 : 0;
+    const issuerScore = Math.min(uniqueIssuers, 10) * 5;
+    return {
+        credentialCount: credentials.length,
+        ratingCount: ratings.length,
+        averageRating: averageRating ? Math.round(averageRating * 10) / 10 : null,
+        uniqueIssuers,
+        score: Math.round(ratingScore + issuerScore),
+    };
+}

package/dist/errors.d.ts

@@ -0,0 +1,5 @@
+export type CashletDidErrorCode = "NOT_FOUND" | "INVALID_SIG" | "INVALID_BINDING" | "RELAY_TIMEOUT" | "RELAY_ERROR" | "INVALID_NPub" | "CHAIN_BROKEN" | "INVALID_NIP05";
+export declare class CashletDidError extends Error {
+    readonly code: CashletDidErrorCode;
+    constructor(code: CashletDidErrorCode, message: string);
+}

package/dist/errors.js

@@ -0,0 +1,7 @@
+export class CashletDidError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "CashletDidError";
+    }
+}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { buildDisclosure, verifyDisclosure, type Disclosure, } from "./disclosure.js";
 export { buildAnchorTx, ANCHOR_PREFIX, type AnchorUtxo, type AnchorResult, } from "./anchor.js";
-export { issueCredential, resolveCredentials, CREDENTIAL_KIND, type CredentialPayload, type IssuedCredential, } from "./credentials.js";
+export { issueCredential, issueRating, revokeCredential, resolveCredentials, scoreReputation, CREDENTIAL_KIND, type CredentialPayload, type IssuedCredential, } from "./credentials.js";
 export { PROTOCOL_ID, PROTOCOL_VERSION, BINDING_KIND, type Network, type CanonicalBinding, type IdentityBinding, type NostrEvent, buildBinding, bchSigningPayload, nostrEventTemplate, canonicalize, sha256hex, } from "./binding.js";
 export { publishToRelay, publishToRelays, queryRelay, queryRelays, DEFAULT_RELAYS, type RelayResult, } from "./relay.js";
-export { resolveIdentity, resolveAddress, verifyIdentity, verifyChallengeProof, resolveIdentityChain, type VerifyResult, type VerifyStatus, type ResolvedIdentity, } from "./verify.js";
+export { resolveIdentity, resolveAddress, resolveByNip05, verifyIdentity, verifyChallengeProof, resolveIdentityChain, type VerifyResult, type VerifyStatus, type ResolvedIdentity, } from "./verify.js";
+export { CashletDidError, type CashletDidErrorCode } from "./errors.js";

package/dist/index.js

@@ -1,6 +1,6 @@
 export { buildDisclosure, verifyDisclosure, } from "./disclosure.js";
 export { buildAnchorTx, ANCHOR_PREFIX, } from "./anchor.js";
-export { issueCredential, resolveCredentials, CREDENTIAL_KIND, } from "./credentials.js";
+export { issueCredential, issueRating, revokeCredential, resolveCredentials, scoreReputation, CREDENTIAL_KIND, } from "./credentials.js";
 export { 
 // Protocol constants
 PROTOCOL_ID, PROTOCOL_VERSION, BINDING_KIND, 
@@ -11,4 +11,5 @@ export {
 publishToRelay, publishToRelays, queryRelay, queryRelays, DEFAULT_RELAYS, } from "./relay.js";
 export { 
 // Verification
-resolveIdentity, resolveAddress, verifyIdentity, verifyChallengeProof, resolveIdentityChain, } from "./verify.js";
+resolveIdentity, resolveAddress, resolveByNip05, verifyIdentity, verifyChallengeProof, resolveIdentityChain, } from "./verify.js";
+export { CashletDidError } from "./errors.js";

package/dist/verify.d.ts

@@ -35,6 +35,11 @@ export declare function verifyChallengeProof(proof: {
  * if (address) wallet.sendTo(address, amount)
  */
 export declare function resolveAddress(npub: string, relays?: string[]): Promise<string | null>;
-/** Returns full binding history for an npub, newest first */
+/** Returns full binding history for an npub, newest first, with cryptographic supersedes validation */
 export declare function resolveIdentityChain(npub: string, relays?: string[]): Promise<ResolvedIdentity[]>;
+/**
+ * Resolve a BCH address from a NIP-05 handle (e.g. "alice@cashlet.app")
+ * Chains: NIP-05 → npub → cashlet-did binding → BCH address
+ */
+export declare function resolveByNip05(handle: string, relays?: string[]): Promise<string | null>;
 export { bchSigningPayload, canonicalize, sha256hex, type CanonicalBinding, type IdentityBinding };

package/dist/verify.js

@@ -1,7 +1,8 @@
-import { verifyEvent } from "nostr-tools";
+import { verifyEvent, nip05 } from "nostr-tools";
 import { secp256k1, hash256, encodeCashAddress, hash160 } from "@bitauth/libauth";
 import { canonicalize, sha256hex, bchSigningPayload, BINDING_KIND, PROTOCOL_ID, } from "./binding.js";
 import { queryRelays, DEFAULT_RELAYS } from "./relay.js";
+import { CashletDidError } from "./errors.js";
 import { nip19 } from "nostr-tools";
 function bitcoinMsgHash(message) {
     const enc = new TextEncoder();
@@ -10,15 +11,16 @@ function bitcoinMsgHash(message) {
     const lenByte = new Uint8Array([msgBytes.length]);
     return hash256(new Uint8Array([...prefix, ...lenByte, ...msgBytes]));
 }
-function recoverBchAddress(sigHex, msgHash) {
+function recoverBchAddress(sigHex, msgHash, expectedAddress) {
     const sig = Uint8Array.from(sigHex.match(/.{2}/g).map(b => parseInt(b, 16)));
     const tryRecover = (compact, id) => {
         try {
             const pub = secp256k1.recoverPublicKeyCompressed(compact, id, msgHash);
             if (!(pub instanceof Uint8Array))
                 return null;
+            const addrPrefix = (expectedAddress?.split(":")[0] ?? "bitcoincash");
             for (const type of ["p2pkhWithTokens", "p2pkh"]) {
-                const r = encodeCashAddress({ prefix: "bitcoincash", type, payload: hash160(pub) });
+                const r = encodeCashAddress({ prefix: addrPrefix, type, payload: hash160(pub) });
                 if (r?.address)
                     return r.address;
                 if (typeof r === "string")
@@ -29,7 +31,8 @@ function recoverBchAddress(sigHex, msgHash) {
         return null;
     };
     if (sig.length === 65) {
-        const addr = tryRecover(sig.slice(1), sig[0]);
+        const recoveryId = (sig[0] & 0x03);
+        const addr = tryRecover(sig.slice(1), recoveryId);
         if (addr)
             return addr;
     }
@@ -97,7 +100,7 @@ export async function verifyIdentity(resolved) {
     }
     // 2. BCH signature recovery
     const msgHash = bitcoinMsgHash(message);
-    const recovered = recoverBchAddress(sigHex, msgHash);
+    const recovered = recoverBchAddress(sigHex, msgHash, bchAddress);
     const bchValid = recovered === bchAddress;
     // 3. Payload integrity
     if (!message.startsWith(`${PROTOCOL_ID}/bch-proof/`)) {
@@ -116,7 +119,7 @@ export function verifyChallengeProof(proof, nonce) {
     if (!proof.payload.startsWith(`${PROTOCOL_ID}/challenge`))
         return false;
     const msgHash = bitcoinMsgHash(proof.payload);
-    const recovered = recoverBchAddress(proof.signature, msgHash);
+    const recovered = recoverBchAddress(proof.signature, msgHash, proof.address);
     return recovered === proof.address;
 }
 /**
@@ -131,7 +134,7 @@ export async function resolveAddress(npub, relays = DEFAULT_RELAYS) {
     const identity = await resolveIdentity(npub, relays);
     return identity?.bchAddress ?? null;
 }
-/** Returns full binding history for an npub, newest first */
+/** Returns full binding history for an npub, newest first, with cryptographic supersedes validation */
 export async function resolveIdentityChain(npub, relays = DEFAULT_RELAYS) {
     const decoded = nip19.decode(npub);
     if (decoded.type !== "npub")
@@ -155,8 +158,40 @@ export async function resolveIdentityChain(npub, relays = DEFAULT_RELAYS) {
             createdAt = JSON.parse(event.content).createdAt ?? createdAt;
         }
         catch { /* use event ts */ }
+        // Validate supersedes tag cryptographically
+        const supersedesTag = event.tags.find(t => t[0] === "supersedes");
+        if (supersedesTag) {
+            const claimedId = supersedesTag[1];
+            // Fetch the referenced event and verify its bindingId matches
+            const [prev] = await queryRelays(relays, { ids: [claimedId], limit: 1 });
+            if (prev) {
+                try {
+                    const prevContent = JSON.parse(prev.content);
+                    const actualId = await sha256hex(canonicalize(prevContent));
+                    if (actualId !== claimedId) {
+                        throw new CashletDidError("CHAIN_BROKEN", `supersedes tag ${claimedId} does not match referenced event content hash`);
+                    }
+                }
+                catch (e) {
+                    if (e instanceof CashletDidError)
+                        throw e;
+                    // content not canonical JSON — skip validation but keep event
+                }
+            }
+        }
         results.push({ npub, pubkey, bchAddress: bchTag[1], network: bchTag[2] ?? "mainnet", bindingId: dTag[1], createdAt, bchProofTag, rawEvent: event });
     }
     return results;
 }
+/**
+ * Resolve a BCH address from a NIP-05 handle (e.g. "alice@cashlet.app")
+ * Chains: NIP-05 → npub → cashlet-did binding → BCH address
+ */
+export async function resolveByNip05(handle, relays = DEFAULT_RELAYS) {
+    const profile = await nip05.queryProfile(handle);
+    if (!profile?.pubkey)
+        throw new CashletDidError("INVALID_NIP05", `NIP-05 handle not found: ${handle}`);
+    const npub = nip19.npubEncode(profile.pubkey);
+    return resolveAddress(npub, relays);
+}
 export { bchSigningPayload, canonicalize, sha256hex };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "did-beta-bch",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Decentralised identity protocol binding BCH addresses to Nostr public keys",
   "type": "module",
   "main": "./dist/index.js",