ShopProof

ShopProof is a read-only CLI for one public Shopstr classified listing. It accepts a public shopstr.market/listing/<naddr> URL or kind-30402 naddr, queries four fixed audited relays, verifies event signatures, checks bounded NIP-99 metadata, and observes the latest-1,000 Shopstr index window and canonical listing page.

It never asks for or loads an nsec, wallet, payment, order, private message, buyer identity, real name, email, address, or private repository. Relay hints embedded in an naddr are reported only as a count and are never contacted.

Usage

Requires Node.js 20 or newer.

npm ci
node cli.mjs 'https://shopstr.market/listing/naddr1...'

Exit codes:

• 0: a valid exact-coordinate event was assessed (healthy or needs_attention);
• 1: no valid event was found on the bounded relay set (unverified);
• 2: invalid input or an audit setup failure.

Output boundary

The JSON report includes the public listing coordinate, selected public event id, bounded metadata summary, per-relay observation, and Shopstr index/page observations. It deliberately omits event content, raw tags, profiles, orders, messages, and all private data.

healthy means only that the reviewed event has a valid signature plus a title and numeric price. It does not establish seller identity, product quality, legality, availability, payment, delivery, or safety. not_found_in_recent_1000 is not a claim that Shopstr never indexed the event.

Verification

npm test
npm run check

The tests cover untrusted embedded relay hints, valid signatures, missing-price evidence, relay partial failure, fixed HTTP destinations, no-event degradation, private-content omission, and pre-network input rejection.

Optional fixed-scope report

The free CLI is sufficient for self-service. A separate 15,000-sat service runs the same bounded audit for one public listing, adds a short Markdown interpretation, and includes one recheck. It requires only a GitHub username and public Shopstr listing URL. Exact scope and privacy boundaries are in SERVICE-TERMS.md. No order or payment is implied by using this repository.

Standards and implementation boundary

• NIP-99: https://github.com/nostr-protocol/nips/blob/master/99.md
• Shopstr supported NIPs: https://github.com/shopstr-eng/shopstr
• Shopstr terms: https://shopstr.market/terms

The implementation is independent and uses the public NIP-99 event contract. It does not copy Shopstr's GPL source. nostr-tools 2.25.0 is distributed under the Unlicense.