@moon-x/node-sdk 0.1.0 → 0.2.0

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { AccessTokenClaims, IdentityTokenClaims, VerifiedSession } from '@moon-x/core/types';
-export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, VerifiedSession } from '@moon-x/core/types';
+import { AccessTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
+export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
 
 interface AuthOptions {
     baseUrl: string;
@@ -24,6 +24,16 @@ declare class Auth {
      * success; throws a typed `MoonXError` subclass on any failure.
      */
     verifyIdentityToken(token: string): Promise<IdentityTokenClaims>;
+    /**
+     * Verify a presence token. Enforces `tt === "presence"` so an access
+     * or identity token cannot be replayed as a step-up proof. Returns
+     * the claims (sub, cid, aud, iat, exp) on success.
+     *
+     * The token's `exp` already encodes the server's TTL window (5min
+     * default). Callers may impose a tighter window app-side by checking
+     * `iat` against their own clock for especially sensitive ops.
+     */
+    verifyPresenceToken(token: string): Promise<PresenceTokenClaims>;
     /**
      * Verify both tokens (identity optional). Cross-checks that the
      * identity token's subject matches the access token's subject so a

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { AccessTokenClaims, IdentityTokenClaims, VerifiedSession } from '@moon-x/core/types';
-export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, VerifiedSession } from '@moon-x/core/types';
+import { AccessTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
+export { AccessTokenClaims, BaseTokenClaims, IdentityTokenClaims, PresenceTokenClaims, VerifiedSession } from '@moon-x/core/types';
 
 interface AuthOptions {
     baseUrl: string;
@@ -24,6 +24,16 @@ declare class Auth {
      * success; throws a typed `MoonXError` subclass on any failure.
      */
     verifyIdentityToken(token: string): Promise<IdentityTokenClaims>;
+    /**
+     * Verify a presence token. Enforces `tt === "presence"` so an access
+     * or identity token cannot be replayed as a step-up proof. Returns
+     * the claims (sub, cid, aud, iat, exp) on success.
+     *
+     * The token's `exp` already encodes the server's TTL window (5min
+     * default). Callers may impose a tighter window app-side by checking
+     * `iat` against their own clock for especially sensitive ops.
+     */
+    verifyPresenceToken(token: string): Promise<PresenceTokenClaims>;
     /**
      * Verify both tokens (identity optional). Cross-checks that the
      * identity token's subject matches the access token's subject so a

package/dist/index.js

@@ -324,10 +324,32 @@ async function verifyWithSig(token, ctx) {
 }
 async function verifyAccessToken(token, ctx) {
   const claims = await verify(token, ctx);
+  if (claims.tt !== "access") {
+    throw new InvalidTokenError(
+      `expected access token, got tt=${String(claims.tt ?? "(missing)")}`
+    );
+  }
   return claims;
 }
 async function verifyIdentityToken(token, ctx) {
   const claims = await verify(token, ctx);
+  if (claims.tt !== "identity") {
+    throw new InvalidTokenError(
+      `expected identity token, got tt=${String(claims.tt ?? "(missing)")}`
+    );
+  }
+  return claims;
+}
+async function verifyPresenceToken(token, ctx) {
+  const claims = await verify(token, ctx);
+  if (claims.tt !== "presence") {
+    throw new InvalidTokenError(
+      `expected tt=presence, got ${String(claims.tt ?? "(missing)")}`
+    );
+  }
+  if (typeof claims.cid !== "string" || claims.cid.length === 0) {
+    throw new InvalidTokenError("presence token missing cid claim");
+  }
   return claims;
 }
 async function verifySession(args, ctx) {
@@ -408,6 +430,23 @@ var Auth = class {
       jwks: this.jwks
     });
   }
+  /**
+   * Verify a presence token. Enforces `tt === "presence"` so an access
+   * or identity token cannot be replayed as a step-up proof. Returns
+   * the claims (sub, cid, aud, iat, exp) on success.
+   *
+   * The token's `exp` already encodes the server's TTL window (5min
+   * default). Callers may impose a tighter window app-side by checking
+   * `iat` against their own clock for especially sensitive ops.
+   */
+  async verifyPresenceToken(token) {
+    const pinnedAppId = await this.resolver.resolve();
+    return verifyPresenceToken(token, {
+      pinnedAppId,
+      expectedIssuer: this.expectedIssuer,
+      jwks: this.jwks
+    });
+  }
   /**
    * Verify both tokens (identity optional). Cross-checks that the
    * identity token's subject matches the access token's subject so a

package/dist/index.mjs

@@ -286,10 +286,32 @@ async function verifyWithSig(token, ctx) {
 }
 async function verifyAccessToken(token, ctx) {
   const claims = await verify(token, ctx);
+  if (claims.tt !== "access") {
+    throw new InvalidTokenError(
+      `expected access token, got tt=${String(claims.tt ?? "(missing)")}`
+    );
+  }
   return claims;
 }
 async function verifyIdentityToken(token, ctx) {
   const claims = await verify(token, ctx);
+  if (claims.tt !== "identity") {
+    throw new InvalidTokenError(
+      `expected identity token, got tt=${String(claims.tt ?? "(missing)")}`
+    );
+  }
+  return claims;
+}
+async function verifyPresenceToken(token, ctx) {
+  const claims = await verify(token, ctx);
+  if (claims.tt !== "presence") {
+    throw new InvalidTokenError(
+      `expected tt=presence, got ${String(claims.tt ?? "(missing)")}`
+    );
+  }
+  if (typeof claims.cid !== "string" || claims.cid.length === 0) {
+    throw new InvalidTokenError("presence token missing cid claim");
+  }
   return claims;
 }
 async function verifySession(args, ctx) {
@@ -370,6 +392,23 @@ var Auth = class {
       jwks: this.jwks
     });
   }
+  /**
+   * Verify a presence token. Enforces `tt === "presence"` so an access
+   * or identity token cannot be replayed as a step-up proof. Returns
+   * the claims (sub, cid, aud, iat, exp) on success.
+   *
+   * The token's `exp` already encodes the server's TTL window (5min
+   * default). Callers may impose a tighter window app-side by checking
+   * `iat` against their own clock for especially sensitive ops.
+   */
+  async verifyPresenceToken(token) {
+    const pinnedAppId = await this.resolver.resolve();
+    return verifyPresenceToken(token, {
+      pinnedAppId,
+      expectedIssuer: this.expectedIssuer,
+      jwks: this.jwks
+    });
+  }
   /**
    * Verify both tokens (identity optional). Cross-checks that the
    * identity token's subject matches the access token's subject so a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moon-x/node-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "MoonX server-side SDK for Node.js. Verify MoonX-issued access + identity tokens with zero runtime dependencies.",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,12 +25,12 @@
     "wallet",
     "sdk"
   ],
-  "license": "MIT",
+  "license": "UNLICENSED",
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@moon-x/core": "0.2.0"
+    "@moon-x/core": "0.3.0"
   },
   "devDependencies": {
     "tsup": "8.5.1",