signet-protocol 1.11.1 → 1.11.3

package/docs/signet-in-5-minutes.md

@@ -0,0 +1,181 @@
+# Signet in 5 Minutes
+
+Signet is an open-source, decentralised identity verification protocol for Nostr. It lets users prove claims
+about who they are — human, professional, adult, organisation — without exposing personal data. Verification
+is anchored to professional bodies (law societies, medical boards, notary commissions) rather than any central
+authority. Trust accumulates as a continuous Signet Score (0–200, where 100 represents the current government standard) assembled from weighted signals, and is expressed as a tier badge any Nostr client can display.
+
+
+## How Trust Flows
+
+```
+  Person
+    |
+    | signs a kind 31000 self-declaration (`type: credential`)
+    v
+  Tier 1 — Self-declared
+    |
+    | three or more peers sign kind 31000 vouches (`type: vouch`)
+    v
+  Tier 2 — Web-of-trust
+    |
+    | licensed professional issues kind 31000 credential (`type: credential`)
+    | with zero-knowledge age proof and document nullifier
+    v
+  Tier 3 — Professionally verified (adult)
+    |
+    | same ceremony, scope extended to child supervision
+    v
+  Tier 4 — Professionally verified (adult + child)
+    |
+    v
+  Trust signals accumulated (professional verif, vouches, account age, identity bridges)
+    |
+    v
+  Signet Score computed (0-200, where 100 = government standard)
+    |
+    v
+  Badge displayed by client  e.g. "Verified (Tier 3) — Signet Score 106"
+```
+
+
+## The Four Tiers
+
+| Tier | Name                        | Who issues                              | What it proves                                      | Score contribution |
+|------|-----------------------------|-----------------------------------------|-----------------------------------------------------|--------------------|
+| 1    | Self-declared               | Subject themselves                      | "I exist and I own this key"                        | —                  |
+| 2    | Web-of-trust                | Peers (kind 31000, `type: vouch`)              | Enough known people can vouch for this identity     | +2–8 per vouch     |
+| 3    | Professionally verified     | Licensed professional (kind 31000, `type: credential`)      | Government document seen; adult age confirmed       | +40               |
+| 4    | Professional + child safety | Licensed professional (kind 31000, `type: credential`)      | Tier 3 plus authorisation to interact with minors   | +40               |
+
+Tier 2 requires at least 3 vouches from Tier 2+ peers (configurable per community via kind 30078 (NIP-78) policy).
+Tiers 3 and 4 are issued in a two-credential ceremony: one Natural Person credential (carries document
+nullifier and Merkle root) and one anonymous Persona credential (carries age range only, no identifying data).
+
+
+## Three Implementation Levels
+
+### Level 1 — Display badges (a weekend)
+
+Read kind 31000 (`type: credential` and `type: vouch`) from relays, call `computeBadge`, show a label.
+No cryptography required beyond Schnorr signature verification (optional).
+
+### Level 2 — Issue vouches (a few days)
+
+Add kind 31000 (`type: vouch`) vouch issuance. Requires Schnorr signing, relay write access, and basic
+kind 30078 (NIP-78) policy parsing so your client respects community verification thresholds.
+
+### Level 3 — Full protocol (weeks)
+
+Issue professional credentials, manage verifier lifecycle (kind 31000 types: verifier, challenge, revocation), build
+guardian delegation (kind 31000, `type: delegation`), support credential chains (supersedes / superseded-by),
+and integrate the voting extension (kinds 30482–30484). The voting extension is specified in `spec/voting.md` and implemented in the separate `nostr-anon-vote` package, not in `signet-protocol`; this package ships only the linkable ring signature primitives it builds on (`lsagSign`, `lsagVerify`, `computeKeyImage`).
+
+
+## How Verification Works (Tier 3 / 4)
+
+```
+  Subject                 Verifier
+    |                        |
+    |--- presents document -->|
+    |                        |
+    |        Verifier computes nullifier:
+    |        SHA-256(docType || country || docNumber || salt)
+    |        (prevents duplicate identity; document never stored)
+    |                        |
+    |        Verifier builds Merkle tree:
+    |        leaves = verified attributes (name, DOB, address, ...)
+    |        only root is published on-chain
+    |                        |
+    |        Verifier creates zero-knowledge age range proof
+    |        (proves "subject is 18+" without revealing birth date)
+    |                        |
+    |        Two credentials signed and published:
+    |          kind 31000 Natural Person  (nullifier + Merkle root, type: credential)
+    |          kind 31000 Persona         (age range only, anonymous, type: credential)
+    |                        |
+    v                        v
+               Both events published to Nostr relays
+```
+
+Professional verifiers are themselves credentialed (kind 31000, `type: verifier`) and require cross-verification
+by two other licensed professionals before becoming active. A challenge / revocation mechanism
+(kind 31000 types: `challenge` and `revocation`) allows the community to remove a fraudulent verifier.
+
+
+## Event Kinds Reference
+
+| Kind  | Type tag          | Purpose                                            |
+|-------|-------------------|----------------------------------------------------|
+| 31000 | `credential`      | Verification credential for any tier               |
+| 31000 | `vouch`           | Peer attestation (Tier 2 building block)           |
+| 30078 | —                 | Policy: community verification requirements (NIP-78) |
+| 31000 | `verifier`        | Professional verifier credential                   |
+| 31000 | `challenge`       | Report a suspected fraudulent verifier             |
+| 31000 | `revocation`      | Remove a verifier after threshold confirmations    |
+| 31000 | `identity-bridge` | Link two keypairs via ring signature               |
+| 31000 | `delegation`      | Guardian / agent delegation with scoped permission |
+| 30482 | —                 | Voting extension: define an election               |
+| 30483 | —                 | Voting extension: cast an anonymous ballot         |
+| 30484 | —                 | Voting extension: publish tallied result           |
+
+Kinds 30482–30484 are specified in `spec/voting.md` and implemented in the separate `nostr-anon-vote` package, not in `signet-protocol`.
+
+
+## Integrating at Level 1
+
+Install the library:
+
+```
+npm install signet-protocol
+```
+
+Fetch events from a relay, then call `computeBadge`:
+
+```typescript
+import { computeBadge, buildBadgeFilters, fetchFromRelay, meetsMinimumTier } from 'signet-protocol';
+import type { NostrEvent } from 'signet-protocol';
+
+// 1. Build relay filters for one or more pubkeys
+const pubkeys = ['<hex-pubkey>'];
+const filters = buildBadgeFilters(pubkeys);
+// filters = [{ kinds: [31000], '#d': ['credential:<hex-pubkey>', 'vouch:<hex-pubkey>'] }]
+
+// 2. Fetch events from your relay (fetchFromRelay is the package's own client; any Nostr client works)
+const events: NostrEvent[] = await fetchFromRelay('wss://relay.example.com', filters);
+
+// 3. Compute the badge
+const badge = await computeBadge(pubkeys[0], events, { verifySignatures: true });
+
+// badge.displayLabel  => "Verified (Tier 3)"
+// badge.score         => 106 (illustrative; see the score note below)
+// badge.tier          => 3
+// badge.vouchCount    => 5
+
+// 4. Gate a feature on minimum tier
+if (meetsMinimumTier(badge, 2)) {
+  // allow posting in a verified-only community
+}
+```
+
+`computeBadge` accepts any mix of kind 31000 (`type: credential` and `type: vouch`) events. It handles expiry, deduplication
+(one vouch counted per voucher pubkey), and optional Schnorr signature verification. The result is
+a plain object — no rendering assumptions are made.
+
+- `verifySignatures` defaults to `false`. `computeBadge(pubkey, events)` with no options checks no signatures, so keep `{ verifySignatures: true }` unless the events were already verified. `fetchFromRelay` drops events with an invalid signature or id by default; events from any other source are not checked for you.
+- `badge.score` is on the 0–200 Signet IQ scale but is a Level 1 approximation of `computeTrustScore(...).score`: it ignores account age and identity bridges and applies no per-type caps (1 professional verification, 3 in-person vouches, 5 online vouches). Use `computeTrustScore` for the full score.
+- `computeBadge` checks who issued a Tier 3 or Tier 4 credential only when you pass `isTrustedIssuer`, and `buildBadgeFilters` does not fetch verifier or revocation events. Without the option, any key can sign an event that carries `tier: 3` and it will count. To require an activated, unrevoked verifier, fetch the verifier credentials, their vouches and revocations yourself, decide which issuers pass with `checkCrossVerification(...).activated` and `isVerifierRevoked(...)`, and pass `{ isTrustedIssuer: (pk) => accepted.has(pk) }` to `computeBadge` (see `llms.txt`).
+
+The `buildBadgeFilters` helper returns a standard Nostr REQ filter array ready for use with any
+relay client library.
+
+
+## Further Reading
+
+- Full protocol specification: `spec/protocol.md`
+- Voting extension: `spec/voting.md`
+- Level 1 badge library: `src/badge.ts`
+- Signet Score details: `src/trust-score.ts`
+- Full working example: `examples/full-flow.ts`
+- Jurisdiction-specific examples: `examples/jurisdictions/`
+- "Signet me" peer verification: `examples/signet-me.ts`

package/examples/full-flow.ts

@@ -0,0 +1,260 @@
+// Signet Protocol — Full Flow Example
+// Demonstrates all 4 tiers, Signet IQ, policy enforcement, and verifier lifecycle
+
+import {
+  generateKeyPair,
+  // Credentials
+  createSelfDeclaredCredential,
+  createPeerVouchedCredential,
+  createProfessionalCredential,
+  createChildSafetyCredential,
+  verifyCredential,
+  parseCredential,
+  // Vouches
+  createVouch,
+  hasEnoughVouches,
+  // Signet IQ
+  computeTrustScore,
+  formatTrustDisplay,
+  // Policies
+  createPolicy,
+  PolicyChecker,
+  // Verifiers
+  createVerifierCredential,
+  checkCrossVerification,
+  isVerifierRevoked,
+  // Challenges
+  createChallenge,
+  createRevocation,
+  // Merkle
+  MerkleTree,
+  verifySelectiveDisclosure,
+} from '../src/index.js';
+
+async function main() {
+  console.log('=== Signet Protocol — Full Flow Demo ===\n');
+
+  // --- 1. Generate identities ---
+  const alice = generateKeyPair();    // Regular user
+  const bob = generateKeyPair();      // Regular user
+  const carol = generateKeyPair();    // Regular user
+  const dave = generateKeyPair();     // Regular user
+  const emma = generateKeyPair();     // Parent
+  const lawyer = generateKeyPair();   // Professional verifier (solicitor)
+  const doctor = generateKeyPair();   // Professional verifier (doctor)
+  const notary = generateKeyPair();   // Professional verifier (notary)
+  const operator = generateKeyPair(); // Community operator
+
+  console.log('--- Tier 1: Self-Declared ---');
+  const aliceSelfCred = await createSelfDeclaredCredential(alice.privateKey);
+  const verification = await verifyCredential(aliceSelfCred);
+  console.log(`Alice self-declares: sig=${verification.signatureValid}, valid=${verification.structureValid}`);
+  console.log(`  Tier: ${parseCredential(aliceSelfCred)!.tier}, Type: ${parseCredential(aliceSelfCred)!.type}\n`);
+
+  // --- 2. Web-of-Trust Vouching (Tier 2) ---
+  console.log('--- Tier 2: Web-of-Trust ---');
+
+  // Bob, Carol, Dave vouch for Alice (met at a Bitcoin meetup)
+  const vouches = await Promise.all([
+    createVouch(bob.privateKey, {
+      subjectPubkey: alice.publicKey,
+      method: 'in-person',
+      context: 'bitcoin-meetup-london',
+      voucherTier: 2,
+      voucherScore: 60,
+    }),
+    createVouch(carol.privateKey, {
+      subjectPubkey: alice.publicKey,
+      method: 'in-person',
+      context: 'bitcoin-meetup-london',
+      voucherTier: 2,
+      voucherScore: 55,
+    }),
+    createVouch(dave.privateKey, {
+      subjectPubkey: alice.publicKey,
+      method: 'online',
+      voucherTier: 2,
+      voucherScore: 45,
+    }),
+  ]);
+
+  const enough = hasEnoughVouches(vouches, alice.publicKey);
+  console.log(`Alice has enough vouches for Tier 2: ${enough}`); // true (3 vouches, threshold = 3)
+
+  // Issue Tier 2 credential
+  const aliceTier2 = await createPeerVouchedCredential(operator.privateKey, alice.publicKey);
+  console.log(`Alice promoted to Tier 2: ${parseCredential(aliceTier2)!.tier}\n`);
+
+  // --- 3. Professional Verifier Setup ---
+  console.log('--- Verifier Registration ---');
+
+  const lawyerCred = await createVerifierCredential(lawyer.privateKey, {
+    profession: 'solicitor',
+    jurisdiction: 'UK',
+    licenceHash: 'sha256_of_sra_number_12345',
+    professionalBody: 'Law Society of England and Wales',
+    statement: 'Available for Signet identity verification in London',
+  });
+
+  const doctorCred = await createVerifierCredential(doctor.privateKey, {
+    profession: 'doctor',
+    jurisdiction: 'UK',
+    licenceHash: 'sha256_of_gmc_number_67890',
+    professionalBody: 'General Medical Council',
+  });
+
+  const notaryCred = await createVerifierCredential(notary.privateKey, {
+    profession: 'notary',
+    jurisdiction: 'UK',
+    licenceHash: 'sha256_of_notary_commission_11111',
+    professionalBody: 'Notaries Society',
+  });
+
+  // Cross-verify: doctor and notary both vouch for the lawyer (2 different professions)
+  const crossVouches = await Promise.all([
+    createVouch(doctor.privateKey, {
+      subjectPubkey: lawyer.publicKey,
+      method: 'in-person',
+      voucherTier: 3,
+      voucherScore: 90,
+    }),
+    createVouch(notary.privateKey, {
+      subjectPubkey: lawyer.publicKey,
+      method: 'in-person',
+      voucherTier: 3,
+      voucherScore: 85,
+    }),
+  ]);
+
+  const lawyerActivation = checkCrossVerification(
+    lawyer.publicKey,
+    crossVouches,
+    [lawyerCred, doctorCred, notaryCred]
+  );
+  console.log(`Lawyer activated: ${lawyerActivation.activated}`);
+  console.log(`  Vouches: ${lawyerActivation.vouchCount}, Professions: ${lawyerActivation.professions.join(', ')}\n`);
+
+  // --- 4. Professional Verification (Tier 3) ---
+  console.log('--- Tier 3: Professional Verification ---');
+
+  const aliceTier3 = await createProfessionalCredential(lawyer.privateKey, alice.publicKey, {
+    profession: 'solicitor',
+    jurisdiction: 'UK',
+    proofBlob: '(ZKP proof would go here)',
+  });
+
+  const tier3Result = await verifyCredential(aliceTier3);
+  console.log(`Alice Tier 3: sig=${tier3Result.signatureValid}, valid=${tier3Result.structureValid}`);
+  console.log(`  Parsed: tier=${parseCredential(aliceTier3)!.tier}, profession=${parseCredential(aliceTier3)!.profession}\n`);
+
+  // --- 5. Child Safety (Tier 4) ---
+  console.log('--- Tier 4: Child Safety ---');
+
+  const emmaTier4 = await createChildSafetyCredential(lawyer.privateKey, emma.publicKey, {
+    profession: 'solicitor',
+    jurisdiction: 'UK',
+    ageRange: '8-12',
+    proofBlob: '(Bulletproof range proof would go here)',
+  });
+
+  const tier4Result = await verifyCredential(emmaTier4);
+  const parsed4 = parseCredential(emmaTier4)!;
+  console.log(`Emma Tier 4: sig=${tier4Result.signatureValid}, valid=${tier4Result.structureValid}`);
+  console.log(`  Scope: ${parsed4.scope}, Age range: ${parsed4.ageRange}\n`);
+
+  // --- 6. Signet IQ ---
+  console.log('--- Signet IQ ---');
+
+  const oneYearAgo = Math.floor(Date.now() / 1000) - 365 * 24 * 60 * 60;
+  const aliceScore = computeTrustScore(
+    alice.publicKey,
+    [aliceSelfCred, aliceTier2, aliceTier3],
+    vouches,
+    oneYearAgo
+  );
+
+  console.log(formatTrustDisplay(aliceScore));
+  console.log();
+
+  // --- 7. Selective Disclosure (Merkle) ---
+  console.log('--- Selective Disclosure ---');
+
+  const tree = new MerkleTree({
+    tier: '3',
+    type: 'professional',
+    scope: 'adult',
+    profession: 'solicitor',
+    jurisdiction: 'UK',
+    method: 'in-person-id',
+    subject: alice.publicKey,
+  });
+
+  // Alice only reveals tier and jurisdiction
+  const disclosure = tree.disclose(['tier', 'jurisdiction']);
+  console.log(`Merkle root: ${tree.getRoot().slice(0, 16)}...`);
+  console.log(`Revealed: ${JSON.stringify(disclosure.revealedAttributes)}`);
+  console.log(`Disclosure valid: ${verifySelectiveDisclosure(disclosure)}\n`);
+
+  // --- 8. Community Policy ---
+  console.log('--- Policy Enforcement ---');
+
+  const policyEvent = await createPolicy(operator.privateKey, {
+    communityId: 'safe-kids-learning',
+    adultMinTier: 3,
+    childMinTier: 4,
+    enforcement: 'both',
+    minScore: 50,
+    modMinTier: 3,
+    verifierBond: 100000,
+    revocationThreshold: 5,
+    description: 'Maximum safety space for children',
+  });
+
+  const checker = new PolicyChecker(policyEvent);
+
+  console.log(`Alice (Tier 3, score ${aliceScore.score}) as adult: ${checker.checkAdult(3, aliceScore.score).allowed}`);
+  console.log(`Emma (Tier 4, score 60) as child account: ${checker.checkChild(4, 60).allowed}`);
+  console.log(`Bob (Tier 2, score 40) as adult: ${checker.checkAdult(2, 40).allowed}`);
+
+  const bobResult = checker.checkAdult(2, 40);
+  if (!bobResult.allowed) {
+    console.log(`  Reason: ${bobResult.reason}`);
+  }
+  console.log();
+
+  // --- 9. Challenge & Revocation ---
+  console.log('--- Challenge & Revocation ---');
+
+  const rogue = generateKeyPair();
+  const rogueCred = await createVerifierCredential(rogue.privateKey, {
+    profession: 'solicitor',
+    jurisdiction: 'UK',
+    licenceHash: 'fake_licence',
+    professionalBody: 'Law Society',
+  });
+
+  const challenge = await createChallenge(alice.privateKey, {
+    verifierPubkey: rogue.publicKey,
+    reason: 'registry-mismatch',
+    evidenceType: 'registry-screenshot',
+    reporterTier: 3,
+    evidence: 'SRA lookup: licence number not found in registry',
+  });
+  console.log(`Challenge filed against rogue verifier`);
+
+  const revocation = await createRevocation(operator.privateKey, {
+    verifierPubkey: rogue.publicKey,
+    challengeEventId: challenge.id,
+    confirmations: 7,
+    bondAction: 'slashed',
+    scope: 'full',
+    effectiveAt: Math.floor(Date.now() / 1000),
+    summary: 'Licence number confirmed fake via SRA registry check',
+  });
+  console.log(`Revocation issued: ${isVerifierRevoked(rogue.publicKey, [revocation])}`);
+  console.log();
+
+  console.log('=== Demo Complete ===');
+}
+
+main().catch(console.error);

package/examples/jurisdictions/brazil-lawyer.ts

@@ -0,0 +1,186 @@
+// Signet Protocol — Brazilian Lawyer Example
+// Demonstrates identity verification under LGPD (Lei Geral de Protecao de Dados)
+// Jurisdiction: Brazil (BR)
+// Profession: Lawyer regulated by the OAB (Ordem dos Advogados do Brasil)
+// Features: LGPD compliance, digital credential support, child protection under Art. 14
+
+import {
+  generateKeyPair,
+  getJurisdiction,
+  getProfessionalBodies,
+  createProfessionalCredential,
+  createChildSafetyCredential,
+  verifyCredential,
+  parseCredential,
+  checkCredentialCompliance,
+  checkChildCompliance,
+  getConsentRequirements,
+  getRetentionGuidance,
+  setLanguage,
+  t,
+  getTierDescription,
+  formatLocalizedTrustScore,
+  computeTrustScore,
+} from '../../src/index.js';
+
+async function main() {
+  console.log('=== Protocolo Signet — Verificacao de Advogado Brasileiro ===\n');
+
+  // Set language to Portuguese
+  setLanguage('pt');
+
+  // --- 1. Jurisdiction and OAB lookup ---
+  const br = getJurisdiction('BR');
+  if (!br) throw new Error('BR jurisdiction not found');
+
+  console.log(`Jurisdicao: ${br.name} (${br.nameLocal})`);
+  console.log(`Sistema juridico: ${br.legalSystem}`);
+  console.log(`Protecao de dados: ${br.dataProtection.name} - ${br.dataProtection.fullName}`);
+  console.log(`Autoridade supervisora: ${br.dataProtection.supervisoryAuthority}`);
+  if (br.dataProtection.notes) {
+    console.log(`Nota: ${br.dataProtection.notes}`);
+  }
+  console.log();
+
+  // Look up the OAB — notably, it issues digital credentials via ICP-Brasil
+  const legalBodies = getProfessionalBodies('BR', 'legal');
+  console.log('Entidades profissionais juridicas no Brasil:');
+  for (const body of legalBodies) {
+    console.log(`  - ${body.name}`);
+    if (body.nameEn) console.log(`    (${body.nameEn})`);
+    console.log(`    Website: ${body.website}`);
+    console.log(`    Registro publico: ${body.hasPublicRegister}`);
+    if (body.registerUrl) {
+      console.log(`    URL do registro: ${body.registerUrl}`);
+    }
+    // OAB issues digital certificates via ICP-Brasil PKI
+    console.log(`    Credenciais digitais: ${body.issuesDigitalCredentials}`);
+    if (body.notes) {
+      console.log(`    Nota: ${body.notes}`);
+    }
+  }
+  console.log();
+
+  // --- 2. Generate identities ---
+  const advogado = generateKeyPair();   // The verifying lawyer (advogado)
+  const subject = generateKeyPair();    // Person being verified
+  const parent = generateKeyPair();     // Parent (for child credential)
+
+  // --- 3. Create Tier 3 credential (Portuguese output) ---
+  console.log(`--- ${t('tier_3')}: ${t('credential_professional')} ---`);
+  console.log(getTierDescription(3));
+  console.log();
+
+  const credential = await createProfessionalCredential(
+    advogado.privateKey,
+    subject.publicKey,
+    {
+      profession: 'lawyer',
+      jurisdiction: 'BR',
+    }
+  );
+
+  const verification = await verifyCredential(credential);
+  const parsed = parseCredential(credential)!;
+
+  console.log(`${t('credential_professional')}: ${t('status_valid')}`);
+  console.log(`  ${t('msg_signature_valid')}`);
+  console.log(`  Tier: ${parsed.tier}, Profissao: ${parsed.profession}`);
+  console.log(`  Jurisdicao: ${parsed.jurisdiction}`);
+  console.log();
+
+  // --- 4. LGPD compliance check ---
+  // Brazil's LGPD is modelled on the GDPR and requires explicit consent.
+  // ICP-Brasil provides the PKI infrastructure for digital signatures.
+  console.log('--- Verificacao de conformidade LGPD ---');
+  const compliance = checkCredentialCompliance(credential, 'BR');
+  console.log(`Em conformidade: ${compliance.compliant}`);
+
+  for (const issue of compliance.issues) {
+    const prefix = issue.severity === 'error' ? '[ERRO]'
+      : issue.severity === 'warning' ? '[AVISO]'
+      : '[INFO]';
+    console.log(`  ${prefix} ${issue.message}`);
+    console.log(`    Regulamento: ${issue.regulation}`);
+    if (issue.remediation) {
+      console.log(`    Acao: ${issue.remediation}`);
+    }
+  }
+  console.log();
+
+  // --- 5. LGPD consent requirements ---
+  // LGPD treats biometric data as sensitive personal data requiring specific legal basis.
+  console.log('--- Requisitos de consentimento ---');
+  const consent = getConsentRequirements('BR');
+  console.log(`Consentimento explicito: ${consent.requiresExplicitConsent}`);
+  console.log(`Idade de consentimento digital: ${consent.consentAge}`);
+  console.log(`Categorias de dados: ${consent.dataCategories.join(', ')}`);
+  if (consent.specialCategories.length > 0) {
+    console.log(`Categorias especiais: ${consent.specialCategories.join(', ')}`);
+  }
+  if (consent.notes) {
+    console.log(`Nota: ${consent.notes}`);
+  }
+  console.log();
+
+  // --- 6. Child protection under LGPD Art. 14 ---
+  // LGPD Art. 14 provides specific rules for processing children's data.
+  // Brazil's digital consent age is 12 (one of the lowest globally).
+  // The ECA (Estatuto da Crianca e do Adolescente) provides additional protections.
+  console.log('--- Protecao infantil — LGPD Art. 14 + ECA ---');
+
+  const childCredential = await createChildSafetyCredential(
+    advogado.privateKey,
+    parent.publicKey,
+    {
+      profession: 'lawyer',
+      jurisdiction: 'BR',
+      ageRange: '8-12',
+    }
+  );
+
+  const childVerification = await verifyCredential(childCredential);
+  const childParsed = parseCredential(childCredential)!;
+
+  console.log(`${t('credential_professional_child')}: ${t('status_valid')}`);
+  console.log(`  Escopo: ${childParsed.scope}, Faixa etaria: ${childParsed.ageRange}`);
+  console.log(`  Assinatura valida: ${childVerification.signatureValid}`);
+  console.log();
+
+  // Check child compliance for a 10-year-old
+  console.log('--- Conformidade infantil (idade 10, BR) ---');
+  const childCompliance = checkChildCompliance(10, 'BR');
+  console.log(`Em conformidade: ${childCompliance.compliant}`);
+  console.log(`Idade minima de consentimento: ${childCompliance.minConsentAge}`);
+  console.log(`Maioridade: ${childCompliance.ageOfMajority}`);
+  console.log(`Consentimento parental necessario: ${childCompliance.requiresParentalConsent}`);
+
+  for (const issue of childCompliance.issues) {
+    const prefix = issue.severity === 'error' ? '[ERRO]'
+      : issue.severity === 'warning' ? '[AVISO]'
+      : '[INFO]';
+    console.log(`  ${prefix} ${issue.message}`);
+  }
+  console.log();
+
+  // --- 7. Data retention ---
+  console.log('--- Retencao de dados ---');
+  const retention = getRetentionGuidance('BR');
+  console.log(`Orientacao: ${retention.guidance}`);
+  console.log(`Regulamento: ${retention.regulation}`);
+  console.log();
+
+  // --- 8. Signet IQ (Portuguese output) ---
+  console.log(`--- ${t('msg_signet_iq')} ---`);
+  const trustScore = computeTrustScore(
+    subject.publicKey,
+    [credential],
+    [],
+    Math.floor(Date.now() / 1000) - 2 * 365 * 24 * 60 * 60
+  );
+  console.log(formatLocalizedTrustScore(trustScore.score));
+
+  console.log('\n=== Exemplo de Advogado Brasileiro Concluido ===');
+}
+
+main().catch(console.error);