did-beta-bch 2.0.1 → 3.1.0

package/dist/bip47.js

@@ -0,0 +1,171 @@
+/**
+ * BIP47 v1 reusable payment code helpers.
+ * Notification transactions and scanning are wallet-specific and out of scope.
+ */
+import { secp256k1, hash160, encodeCashAddress, deriveHdPublicNodeChild, deriveHdPrivateNodeChild, deriveHdPrivateNodeFromBip39Mnemonic, deriveHdPath, deriveHdPublicNode, } from "@bitauth/libauth";
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+// BIP47 payment code: [0x47][0x01][0x00][pubkey 33][chaincode 32][reserved 13][checksum 4] = 85 bytes
+const PC_VERSION = 0x47;
+const PC_TOTAL_BYTES = 85;
+const PC_PAYLOAD_BYTES = 80;
+function base58Encode(bytes) {
+    let n = 0n;
+    for (const b of bytes)
+        n = n * 256n + BigInt(b);
+    let result = "";
+    while (n > 0n) {
+        result = BASE58_ALPHABET[Number(n % 58n)] + result;
+        n /= 58n;
+    }
+    for (const b of bytes) {
+        if (b !== 0)
+            break;
+        result = "1" + result;
+    }
+    return result;
+}
+function base58Decode(s) {
+    let n = 0n;
+    for (const c of s) {
+        const d = BASE58_ALPHABET.indexOf(c);
+        if (d < 0)
+            throw new Error(`Invalid Base58 character: ${c}`);
+        n = n * 58n + BigInt(d);
+    }
+    const hex = n.toString(16).padStart(PC_TOTAL_BYTES * 2, "0");
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i++)
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    let leading = 0;
+    for (const c of s) {
+        if (c === "1")
+            leading++;
+        else
+            break;
+    }
+    const result = new Uint8Array(leading + bytes.length);
+    result.set(bytes, leading);
+    return result;
+}
+async function sha256Once(data) {
+    if (typeof crypto !== "undefined" && crypto.subtle)
+        return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const nc = await Function('return import("crypto")')();
+    return nc.createHash("sha256").update(data).digest();
+}
+async function paymentCodeChecksum(versionAndPayload) {
+    return (await sha256Once(await sha256Once(versionAndPayload))).slice(0, 4);
+}
+/**
+ * Encode a BIP47 v1 payment code from a public key and chain code.
+ */
+export async function encodePaymentCode(publicKey, chainCode) {
+    if (publicKey.length !== 33)
+        throw new Error("publicKey must be 33 bytes");
+    if (chainCode.length !== 32)
+        throw new Error("chainCode must be 32 bytes");
+    const full = new Uint8Array(PC_TOTAL_BYTES);
+    full[0] = PC_VERSION;
+    full[1] = 0x01; // payload version
+    full[2] = 0x00; // feature bits
+    full.set(publicKey, 3);
+    full.set(chainCode, 36);
+    // bytes 69-80 are reserved zeros
+    full.set(await paymentCodeChecksum(full.slice(0, PC_PAYLOAD_BYTES + 1)), PC_PAYLOAD_BYTES + 1);
+    return base58Encode(full);
+}
+/**
+ * Decode a BIP47 v1 Base58Check payment code string.
+ */
+export function parsePaymentCode(paymentCode) {
+    const decoded = base58Decode(paymentCode);
+    if (decoded.length !== PC_TOTAL_BYTES)
+        throw new Error(`Invalid payment code length: ${decoded.length}`);
+    if (decoded[0] !== PC_VERSION)
+        throw new Error(`Unsupported payment code version: 0x${decoded[0].toString(16)}`);
+    const payload = decoded.slice(1, 1 + PC_PAYLOAD_BYTES);
+    if (payload[0] !== 0x01)
+        throw new Error(`Unsupported payment code payload version: ${payload[0]}`);
+    return {
+        publicKey: payload.slice(2, 35),
+        chainCode: payload.slice(35, 67),
+    };
+}
+/**
+ * Derive a BIP47 payment code from a mnemonic (m/47'/0'/<account>').
+ */
+export async function derivePaymentCode(mnemonic, account = 0) {
+    const root = await deriveHdPrivateNodeFromBip39Mnemonic(mnemonic);
+    const node = deriveHdPath(root, `m/47'/0'/${account}'`);
+    if (typeof node === "string")
+        throw new Error(`BIP47 derivation failed: ${node}`);
+    const publicKey = secp256k1.derivePublicKeyCompressed(node.privateKey);
+    if (typeof publicKey === "string")
+        throw new Error(`Public key derivation failed: ${publicKey}`);
+    return { publicKey, chainCode: node.chainCode, encoded: await encodePaymentCode(publicKey, node.chainCode) };
+}
+/**
+ * Derive the nth P2PKH CashAddr payment address for sending to a recipient.
+ *
+ * @param senderScanPrivkey - sender's M/47'/0'/0'/0 private key (32 bytes)
+ * @param recipientNode     - recipient's BIP47 HD public node (M/47'/0'/0')
+ * @param index             - address index (0-based)
+ * @param prefix            - CashAddr prefix, defaults to "bitcoincash"
+ */
+export async function derivePaymentAddress(senderScanPrivkey, recipientNode, index, prefix = "bitcoincash") {
+    if (index < 0 || !Number.isSafeInteger(index))
+        throw new Error("Index must be a non-negative integer");
+    const childNode = deriveHdPublicNodeChild(recipientNode, index);
+    if (typeof childNode === "string")
+        throw new Error(`HD derivation failed: ${childNode}`);
+    const sharedPoint = secp256k1.mulTweakPublicKeyCompressed(childNode.publicKey, senderScanPrivkey);
+    if (typeof sharedPoint === "string")
+        throw new Error(`ECDH failed: ${sharedPoint}`);
+    const s = await sha256Once(sharedPoint.slice(1));
+    const paymentPubkey = secp256k1.addTweakPublicKeyCompressed(childNode.publicKey, s);
+    if (typeof paymentPubkey === "string")
+        throw new Error(`Pubkey tweak failed: ${paymentPubkey}`);
+    const result = encodeCashAddress({ prefix, type: "p2pkh", payload: hash160(paymentPubkey) });
+    return typeof result === "string" ? result : result.address;
+}
+/**
+ * Derive the nth payment private key for a receiver to spend funds sent via BIP47.
+ *
+ * Per BIP47 spec: s = SHA256(b[i] * A)  where A = sender's scan pubkey (M/47'/0'/0'/0)
+ *                 b' = b[i] + s
+ *
+ * @param receiverAccountNode - receiver's M/47'/0'/0' private node
+ * @param senderScanPubkey    - sender's M/47'/0'/0'/0 compressed public key (33 bytes)
+ * @param index               - address index (0-based)
+ */
+export async function derivePaymentPrivkey(receiverAccountNode, senderScanPubkey, index) {
+    if (index < 0 || !Number.isSafeInteger(index))
+        throw new Error("Index must be a non-negative integer");
+    // Receiver's child private key b[i]
+    const receiverChild = deriveHdPrivateNodeChild(receiverAccountNode, index);
+    if (typeof receiverChild === "string")
+        throw new Error(`HD child derivation failed: ${receiverChild}`);
+    // s = sha256(x-coord of b[i] * A)
+    const sharedPoint = secp256k1.mulTweakPublicKeyCompressed(senderScanPubkey, receiverChild.privateKey);
+    if (typeof sharedPoint === "string")
+        throw new Error(`ECDH failed: ${sharedPoint}`);
+    const s = await sha256Once(sharedPoint.slice(1));
+    // b' = b[i] + s (mod n)
+    const tweaked = secp256k1.addTweakPrivateKey(receiverChild.privateKey, s);
+    if (typeof tweaked === "string")
+        throw new Error(`Private key tweak failed: ${tweaked}`);
+    return tweaked;
+}
+export { deriveHdPublicNode, deriveHdPath, deriveHdPrivateNodeFromBip39Mnemonic };
+/** Construct a minimal HdPublicNodeValid from a BIP47 PaymentCode for use with derivePaymentAddress/derivePaymentPrivkey. */
+export function hdPublicNodeFromPaymentCode(pc) {
+    return {
+        publicKey: pc.publicKey,
+        chainCode: pc.chainCode,
+        depth: 0,
+        childIndex: 0,
+        parentFingerprint: new Uint8Array(4),
+        parentIdentifier: new Uint8Array(20),
+    };
+}

package/dist/index.d.ts

@@ -1,10 +1,13 @@
 export { buildDisclosure, verifyDisclosure, type Disclosure, type DisclosureReveal, } from "./disclosure.js";
+export { parsePaymentCode, encodePaymentCode, derivePaymentCode, derivePaymentAddress, derivePaymentPrivkey, hdPublicNodeFromPaymentCode, type PaymentCode, type EncodedPaymentCode, } from "./bip47.js";
 export { buildAnchorTx, ANCHOR_PREFIX, type AnchorUtxo, type AnchorResult, } from "./anchor.js";
+export { verifyBchAnchorProof, BCH_MAINNET_ASERT_PARAMETERS, BCH_MAINNET_CHECKPOINT, BCH_CHIPNET_ASERT_PARAMETERS, BCH_CHIPNET_CHECKPOINT, type BchSpvCheckpoint, type BchAsertParameters, type BchAnchorProof, type BchAnchorVerificationOptions, type BchAnchorVerificationResult, } from "./anchor-verification.js";
+export { broadcastAnchorTx, fetchAnchorProof, wsTransport, ELECTRUM_MAINNET_TCP, ELECTRUM_MAINNET_WS, ELECTRUM_CHIPNET_TCP, ELECTRUM_CHIPNET_WS, type ElectrumTransport, } from "./anchor-client.js";
 export { issueCredential, issueRating, revokeCredential, resolveCredentials, scoreReputation, CREDENTIAL_KIND, type CredentialPayload, type IssuedCredential, } from "./credentials.js";
-export { PROTOCOL_ID, PROTOCOL_VERSION, BINDING_KIND, type Network, type CanonicalBinding, type IdentityBinding, type NostrEvent, buildBinding, bchSigningPayload, nostrEventTemplate, canonicalize, sha256hex, } from "./binding.js";
+export { PROTOCOL_ID, PROTOCOL_VERSION, BINDING_KIND, ROTATION_AUTH_KIND, type Network, type CanonicalBinding, type IdentityBinding, type NostrEvent, buildBinding, bchSigningPayload, nostrEventTemplate, rotationAuthorizationTemplate, verifyRotationAuthorization, canonicalize, sha256hex, } from "./binding.js";
 export { BCH_PROOF_FORMAT, normalizeBchMessageSignature, signBchMessage, type BchMessageProof, type BchMessageSigner, type BchProofTag, } from "./signing.js";
 export { publishToRelay, publishToRelays, queryRelay, queryRelays, DEFAULT_RELAYS, type RelayResult, } from "./relay.js";
-export { resolveIdentity, resolveAddress, resolveByNip05, verifyIdentity, bchChallengePayload, verifyChallengeProof, resolveIdentityChain, type VerifyResult, type VerifyStatus, type ResolvedIdentity, type BCHAnchorClaim, } from "./verify.js";
+export { resolveIdentity, resolveAddress, resolveByNip05, verifyIdentity, bchChallengePayload, nostrChallengeTemplate, verifyDualChallengeProof, NOSTR_CHALLENGE_KIND, type DualChallengeProof, verifyChallengeProof, resolveIdentityChain, type VerifyResult, type VerifyStatus, type ResolvedIdentity, type BCHAnchorClaim, bitcoinSignedMessageHash, encodeBitcoinCompactSize, encodeCompactSignatureBase64, } from "./verify.js";
 export { CashletDidError, type CashletDidErrorCode } from "./errors.js";
 export { deriveNostrKeypair, type NostrKeypair, } from "./keygen.js";
 export { buildHttpAuthEventAsync, verifyHttpAuth, type HttpAuthEventTemplate, type HttpAuthResult, } from "./nip98.js";

package/dist/index.js

@@ -1,18 +1,21 @@
 export { buildDisclosure, verifyDisclosure, } from "./disclosure.js";
+export { parsePaymentCode, encodePaymentCode, derivePaymentCode, derivePaymentAddress, derivePaymentPrivkey, hdPublicNodeFromPaymentCode, } from "./bip47.js";
 export { buildAnchorTx, ANCHOR_PREFIX, } from "./anchor.js";
+export { verifyBchAnchorProof, BCH_MAINNET_ASERT_PARAMETERS, BCH_MAINNET_CHECKPOINT, BCH_CHIPNET_ASERT_PARAMETERS, BCH_CHIPNET_CHECKPOINT, } from "./anchor-verification.js";
+export { broadcastAnchorTx, fetchAnchorProof, wsTransport, ELECTRUM_MAINNET_TCP, ELECTRUM_MAINNET_WS, ELECTRUM_CHIPNET_TCP, ELECTRUM_CHIPNET_WS, } from "./anchor-client.js";
 export { issueCredential, issueRating, revokeCredential, resolveCredentials, scoreReputation, CREDENTIAL_KIND, } from "./credentials.js";
 export { 
 // Protocol constants
-PROTOCOL_ID, PROTOCOL_VERSION, BINDING_KIND, 
+PROTOCOL_ID, PROTOCOL_VERSION, BINDING_KIND, ROTATION_AUTH_KIND, 
 // Binding construction
-buildBinding, bchSigningPayload, nostrEventTemplate, canonicalize, sha256hex, } from "./binding.js";
+buildBinding, bchSigningPayload, nostrEventTemplate, rotationAuthorizationTemplate, verifyRotationAuthorization, canonicalize, sha256hex, } from "./binding.js";
 export { BCH_PROOF_FORMAT, normalizeBchMessageSignature, signBchMessage, } from "./signing.js";
 export { 
 // Relay communication
 publishToRelay, publishToRelays, queryRelay, queryRelays, DEFAULT_RELAYS, } from "./relay.js";
 export { 
 // Verification
-resolveIdentity, resolveAddress, resolveByNip05, verifyIdentity, bchChallengePayload, verifyChallengeProof, resolveIdentityChain, } from "./verify.js";
+resolveIdentity, resolveAddress, resolveByNip05, verifyIdentity, bchChallengePayload, nostrChallengeTemplate, verifyDualChallengeProof, NOSTR_CHALLENGE_KIND, verifyChallengeProof, resolveIdentityChain, bitcoinSignedMessageHash, encodeBitcoinCompactSize, encodeCompactSignatureBase64, } from "./verify.js";
 export { CashletDidError } from "./errors.js";
 export { deriveNostrKeypair, } from "./keygen.js";
 export { buildHttpAuthEventAsync, verifyHttpAuth, } from "./nip98.js";

package/dist/verify.d.ts

@@ -1,6 +1,6 @@
 import { canonicalize, sha256hex, bchSigningPayload, type CanonicalBinding, type IdentityBinding, type NostrEvent } from "./binding.js";
 import { type BchProofTag } from "./signing.js";
-export type VerifyStatus = "verified" | "invalid_bch_sig" | "invalid_nostr_sig" | "id_mismatch" | "malformed" | "expired";
+export type VerifyStatus = "verified" | "invalid_bch_sig" | "invalid_nostr_sig" | "id_mismatch" | "invalid_rotation" | "malformed" | "expired";
 export interface VerifyResult {
     status: VerifyStatus;
     bchValid: boolean;
@@ -11,6 +11,13 @@ export interface BCHAnchorClaim {
     txid: string;
     blockHeight?: number;
 }
+export declare const NOSTR_CHALLENGE_KIND = 27235;
+export interface DualChallengeProof {
+    signature: string;
+    payload: string;
+    address: string;
+    nostrEvent: NostrEvent;
+}
 export interface ResolvedIdentity {
     npub: string;
     pubkey: string;
@@ -20,15 +27,43 @@ export interface ResolvedIdentity {
     createdAt: number;
     bchProofTag: BchProofTag;
     rawEvent: NostrEvent;
+    rotationAuthorization?: NostrEvent;
     /** Unverified metadata claimed by the event; this library does not verify chain inclusion. */
     anchorClaim?: BCHAnchorClaim;
 }
+/** Encode n as a Bitcoin CompactSize integer. */
+export declare function encodeBitcoinCompactSize(n: number): Uint8Array;
+/**
+ * Compute the double-SHA256 hash used by Bitcoin signed messages.
+ * Format: SHA256d("\x18Bitcoin Signed Message:\n" + varint(len) + message)
+ * Uses proper varint encoding — required for messages longer than 252 bytes.
+ */
+export declare function bitcoinSignedMessageHash(message: string): Uint8Array;
+/**
+ * Encode a 65-byte compact signature (recovery ID + 64-byte r||s) as Base64.
+ * Header byte = 31 + recoveryId (compressed key, recovery ID 0–3).
+ */
+export declare function encodeCompactSignatureBase64(recoveryId: number, signature: Uint8Array): string;
 /** Resolve a BCH address from an npub via Nostr relays */
 export declare function resolveIdentity(npub: string, relays?: string[]): Promise<ResolvedIdentity | null>;
 /** Verify the BCH + Nostr signatures on a resolved identity */
 export declare function verifyIdentity(resolved: ResolvedIdentity): Promise<VerifyResult>;
 /** Build the exact versioned challenge message that a BCH wallet must sign. */
 export declare function bchChallengePayload(nonce: string, audience?: string): string;
+export declare function nostrChallengeTemplate(nonce: string, audience: string, endpoint: string, issuedAt: number): {
+    kind: number;
+    created_at: number;
+    tags: string[][];
+    content: string;
+};
+export declare function verifyDualChallengeProof(proof: DualChallengeProof, expected: {
+    nonce: string;
+    audience: string;
+    endpoint: string;
+    issuedAt: number;
+    address: string;
+    pubkey: string;
+}): boolean;
 /** Verify a challenge-response proof.
  * The wallet signs the exact text produced by `bchChallengePayload`.
  * @param issuedAt - unix timestamp when the challenge was issued; if provided, rejects proofs older than 5 minutes.

package/dist/verify.js

@@ -1,12 +1,13 @@
 import { verifyEvent, nip05 } from "nostr-tools";
 import { secp256k1, hash256, encodeCashAddress, hash160 } from "@bitauth/libauth";
-import { canonicalize, sha256hex, bchSigningPayload, BINDING_KIND, PROTOCOL_ID, PROTOCOL_VERSION, } from "./binding.js";
+import { canonicalize, sha256hex, bchSigningPayload, BINDING_KIND, PROTOCOL_ID, PROTOCOL_VERSION, verifyRotationAuthorization, } from "./binding.js";
 import { queryRelays, DEFAULT_RELAYS } from "./relay.js";
 import { CashletDidError } from "./errors.js";
 import { nip19 } from "nostr-tools";
 import { BCH_PROOF_FORMAT, normalizeBchMessageSignature, } from "./signing.js";
+export const NOSTR_CHALLENGE_KIND = 27235;
 /** Encode n as a Bitcoin CompactSize integer. */
-function varint(n) {
+export function encodeBitcoinCompactSize(n) {
     if (n < 0xfd)
         return new Uint8Array([n]);
     const value = BigInt(n);
@@ -30,12 +31,28 @@ function varint(n) {
  * Format: SHA256d("\x18Bitcoin Signed Message:\n" + varint(len) + message)
  * Uses proper varint encoding — required for messages longer than 252 bytes.
  */
-function bitcoinMsgHash(message) {
+export function bitcoinSignedMessageHash(message) {
     const enc = new TextEncoder();
     const msgBytes = enc.encode(message);
     const prefix = enc.encode("\x18Bitcoin Signed Message:\n");
-    return hash256(new Uint8Array([...prefix, ...varint(msgBytes.length), ...msgBytes]));
+    return hash256(new Uint8Array([...prefix, ...encodeBitcoinCompactSize(msgBytes.length), ...msgBytes]));
 }
+/**
+ * Encode a 65-byte compact signature (recovery ID + 64-byte r||s) as Base64.
+ * Header byte = 31 + recoveryId (compressed key, recovery ID 0–3).
+ */
+export function encodeCompactSignatureBase64(recoveryId, signature) {
+    if (!Number.isInteger(recoveryId) || recoveryId < 0 || recoveryId > 3)
+        throw new RangeError("Recovery ID must be 0–3");
+    if (signature.length !== 64)
+        throw new TypeError("Signature must be 64 bytes");
+    const compact = new Uint8Array(65);
+    compact[0] = 31 + recoveryId;
+    compact.set(signature, 1);
+    return btoa(String.fromCharCode(...compact));
+}
+// Internal alias used within this file
+function bitcoinMsgHash(message) { return bitcoinSignedMessageHash(message); }
 function recoverBchAddress(signatureBase64, msgHash, expectedAddress) {
     try {
         normalizeBchMessageSignature(signatureBase64);
@@ -164,10 +181,12 @@ export async function verifyIdentity(resolved) {
         const proofTag = exactlyOne("bch-proof");
         const paymentCodeTag = optionalTag("bch-payment-code");
         const supersedesTag = optionalTag("supersedes");
+        const rotationTag = optionalTag("rotation-proof");
         const anchorTag = optionalTag("bch-anchor");
+        const rotationAuthorization = content.rotationAuthorization;
         const previousBindingId = content.previousBindingId;
         const contentKeys = Object.keys(content).sort().join(",");
-        const allowedContentKeys = ["bch", "bindingId", "createdAt", "nonce", "previousBindingId", "protocol", "version"]
+        const allowedContentKeys = ["bch", "bindingId", "createdAt", "nonce", "previousBindingId", "protocol", "rotationAuthorization", "version"]
             .filter(key => content[key] !== undefined).sort().join(",");
         const bchKeys = bch && typeof bch === "object" && !Array.isArray(bch)
             ? Object.keys(bch).sort().join(",")
@@ -197,7 +216,16 @@ export async function verifyIdentity(resolved) {
             (bch.paymentCode === undefined ? paymentCodeTag !== undefined : (!paymentCodeTag || paymentCodeTag.length !== 2 || paymentCodeTag[1] !== bch.paymentCode)) ||
             getTags("bch-payment-code").length > 1 ||
             (previousBindingId === undefined ? supersedesTag !== undefined : (!supersedesTag || supersedesTag.length !== 2 || supersedesTag[1] !== previousBindingId)) ||
+            (rotationAuthorization === undefined ? rotationTag !== undefined : (!rotationAuthorization ||
+                typeof rotationAuthorization !== "object" ||
+                !rotationTag ||
+                rotationTag.length !== 3 ||
+                rotationTag[1] !== rotationAuthorization.id ||
+                rotationTag[2] !== rotationAuthorization.pubkey ||
+                !verifyEvent(rotationAuthorization))) ||
+            (rotationAuthorization !== undefined && previousBindingId === undefined) ||
             getTags("supersedes").length > 1 ||
+            getTags("rotation-proof").length > 1 ||
             getTags("bch-anchor").length > 1 ||
             (anchorTag !== undefined && ((anchorTag.length !== 2 && anchorTag.length !== 3) ||
                 !/^[0-9a-f]{64}$/.test(anchorTag[1]) ||
@@ -232,7 +260,7 @@ export async function verifyIdentity(resolved) {
             nostr: { pubkey: rawEvent.pubkey },
             createdAt: content.createdAt,
             nonce: content.nonce,
-            purpose: "identity-binding-v2",
+            purpose: "identity-binding-v3",
             ...(previousBindingId !== undefined ? { previousBindingId } : {}),
         };
         const expectedBindingId = await sha256hex(canonicalize(partial));
@@ -263,6 +291,61 @@ export function bchChallengePayload(nonce, audience) {
         throw new TypeError("Challenge audience must be a non-empty single-line string");
     return `${PROTOCOL_ID}/challenge/v${PROTOCOL_VERSION}\n${nonce}${audience === undefined ? "" : `\n${audience}`}`;
 }
+export function nostrChallengeTemplate(nonce, audience, endpoint, issuedAt) {
+    const payload = bchChallengePayload(nonce, audience);
+    if (!Number.isSafeInteger(issuedAt) || issuedAt <= 0)
+        throw new TypeError("Challenge issue time must be a positive Unix timestamp");
+    if (typeof endpoint !== "string" || endpoint.length === 0 || /[\r\n]/.test(endpoint))
+        throw new TypeError("Challenge endpoint must be a non-empty single-line URL");
+    return {
+        kind: NOSTR_CHALLENGE_KIND,
+        created_at: issuedAt,
+        tags: [
+            ["u", endpoint],
+            ["method", "POST"],
+            ["audience", audience],
+            ["challenge", nonce],
+            ["expiration", String(issuedAt + CHALLENGE_TTL_SECS)],
+        ],
+        content: payload,
+    };
+}
+export function verifyDualChallengeProof(proof, expected) {
+    if (!proof ||
+        proof.address !== expected.address ||
+        !verifyChallengeProof(proof, expected.nonce, expected.audience, expected.issuedAt))
+        return false;
+    const event = proof.nostrEvent;
+    if (!event ||
+        event.kind !== NOSTR_CHALLENGE_KIND ||
+        event.pubkey !== expected.pubkey ||
+        event.created_at !== expected.issuedAt ||
+        event.content !== bchChallengePayload(expected.nonce, expected.audience) ||
+        !Array.isArray(event.tags))
+        return false;
+    const uniqueTag = (name) => {
+        const matches = event.tags.filter(tag => Array.isArray(tag) && tag[0] === name);
+        return matches.length === 1 ? matches[0] : undefined;
+    };
+    const endpointTag = uniqueTag("u");
+    const methodTag = uniqueTag("method");
+    const audienceTag = uniqueTag("audience");
+    const challengeTag = uniqueTag("challenge");
+    const expirationTag = uniqueTag("expiration");
+    const expectedTags = nostrChallengeTemplate(expected.nonce, expected.audience, expected.endpoint, expected.issuedAt).tags;
+    try {
+        return endpointTag?.[1] === expected.endpoint &&
+            methodTag?.[1] === "POST" &&
+            audienceTag?.[1] === expected.audience &&
+            challengeTag?.[1] === expected.nonce &&
+            expirationTag?.[1] === String(expected.issuedAt + CHALLENGE_TTL_SECS) &&
+            event.tags.length === expectedTags.length &&
+            verifyEvent(event);
+    }
+    catch {
+        return false;
+    }
+}
 /** Verify a challenge-response proof.
  * The wallet signs the exact text produced by `bchChallengePayload`.
  * @param issuedAt - unix timestamp when the challenge was issued; if provided, rejects proofs older than 5 minutes.
@@ -275,7 +358,9 @@ export function verifyChallengeProof(proof, nonce, audience, issuedAt) {
         typeof nonce !== "string")
         return false;
     if (issuedAt !== undefined &&
-        (!Number.isSafeInteger(issuedAt) || Math.floor(Date.now() / 1000) - issuedAt > CHALLENGE_TTL_SECS))
+        (!Number.isSafeInteger(issuedAt) ||
+            issuedAt > Math.floor(Date.now() / 1000) + 60 ||
+            Math.floor(Date.now() / 1000) - issuedAt > CHALLENGE_TTL_SECS))
         return false;
     let expectedPayload;
     try {
@@ -365,10 +450,53 @@ export async function resolveIdentityChain(npub, relays = DEFAULT_RELAYS) {
         }
         if (!predecessor)
             return [];
+        const predecessorBinding = canonicalBindingFromResolved(predecessor);
+        const successorBinding = canonicalBindingFromResolved(current);
+        if (!predecessorBinding || !successorBinding)
+            return [];
+        if (predecessor.pubkey !== current.pubkey) {
+            if (!current.rotationAuthorization ||
+                !verifyRotationAuthorization(current.rotationAuthorization, predecessorBinding, successorBinding))
+                return [];
+        }
+        else if (current.rotationAuthorization &&
+            !verifyRotationAuthorization(current.rotationAuthorization, predecessorBinding, successorBinding)) {
+            return [];
+        }
         current = predecessor;
     }
     return chain;
 }
+function canonicalBindingFromResolved(identity) {
+    try {
+        const content = JSON.parse(identity.rawEvent.content);
+        const bch = content.bch;
+        if (typeof content.nonce !== "string" ||
+            typeof content.createdAt !== "number" ||
+            typeof bch.address !== "string" ||
+            typeof bch.network !== "string" ||
+            !["mainnet", "testnet", "chipnet"].includes(bch.network))
+            return null;
+        return {
+            protocol: PROTOCOL_ID,
+            version: PROTOCOL_VERSION,
+            bindingId: identity.bindingId,
+            bch: {
+                address: bch.address,
+                network: bch.network,
+                ...(typeof bch.paymentCode === "string" ? { paymentCode: bch.paymentCode } : {}),
+            },
+            nostr: { pubkey: identity.pubkey },
+            createdAt: content.createdAt,
+            nonce: content.nonce,
+            purpose: "identity-binding-v3",
+            ...(typeof content.previousBindingId === "string" ? { previousBindingId: content.previousBindingId } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
 function resolvedIdentityFromEvent(event) {
     if (event.kind !== BINDING_KIND ||
         !/^[0-9a-f]{64}$/.test(event.pubkey) ||
@@ -408,6 +536,9 @@ function resolvedIdentityFromEvent(event) {
         createdAt,
         bchProofTag: bchProofTag,
         rawEvent: event,
+        ...(content.rotationAuthorization && typeof content.rotationAuthorization === "object"
+            ? { rotationAuthorization: content.rotationAuthorization }
+            : {}),
         ...(anchorTag?.[1] ? {
             anchorClaim: {
                 txid: anchorTag[1],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "did-beta-bch",
-  "version": "2.0.1",
+  "version": "3.1.0",
   "description": "Decentralised identity protocol binding BCH addresses to Nostr public keys",
   "type": "module",
   "main": "./dist/index.js",
@@ -20,8 +20,8 @@
   "scripts": {
     "build": "tsc && npm run build:demo",
     "build:demo": "esbuild demo/client.js --bundle --format=esm --platform=browser --target=es2022 --outfile=demo/bundle.js",
-    "typecheck": "tsc --noEmit",
     "test": "node --test test/cashlet-did.test.mjs",
+    "typecheck": "tsc --noEmit",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -49,4 +49,4 @@
     "esbuild": "^0.28.2",
     "typescript": "^5.4.0"
   }
-}
+}