@nokinc-flur/sdk 2.2.0 → 2.3.0

package/dist/index.cjs

@@ -44,6 +44,8 @@ __export(index_exports, {
   CLAIM_DOMAIN_V2: () => CLAIM_DOMAIN_V2,
   COLLECTION_INTENT_STATUSES: () => COLLECTION_INTENT_STATUSES,
   COLLECTION_PAYMENT_STATUSES: () => COLLECTION_PAYMENT_STATUSES,
+  CONSUMER_OAC_DOMAIN: () => CONSUMER_OAC_DOMAIN,
+  CONSUMER_OAC_QR_PREFIX: () => CONSUMER_OAC_QR_PREFIX,
   CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS: () => CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS,
   CONSUMER_PAYMENT_REQUEST_DOMAIN: () => CONSUMER_PAYMENT_REQUEST_DOMAIN,
   CONSUMER_SETTLEMENT_DOMAIN: () => CONSUMER_SETTLEMENT_DOMAIN,
@@ -82,6 +84,8 @@ __export(index_exports, {
   IdentityArtifactSchema: () => IdentityArtifactSchema,
   IngestFundingResultSchema: () => IngestFundingResultSchema,
   IssueAccountOacInputSchema: () => IssueAccountOacInputSchema,
+  IssuerTrustBundleSchema: () => IssuerTrustBundleSchema,
+  IssuerTrustKeySchema: () => IssuerTrustKeySchema,
   LedgerJournalEntryArtifactSchema: () => LedgerJournalEntryArtifactSchema,
   ListPayoutDestinationsResultSchema: () => ListPayoutDestinationsResultSchema,
   MEMBERSHIP_ROLES: () => MEMBERSHIP_ROLES,
@@ -185,6 +189,7 @@ __export(index_exports, {
   computeConsumerClaimEncounterId: () => computeConsumerClaimEncounterId,
   computeEncounterId: () => computeEncounterId,
   constantTimeEqual: () => constantTimeEqual,
+  consumerOacSigningPayload: () => consumerOacSigningPayload,
   consumerPaymentRequestSigningBytes: () => consumerPaymentRequestSigningBytes,
   consumerPaymentRequestSigningPayload: () => consumerPaymentRequestSigningPayload,
   consumerSettlementSigningPayload: () => consumerSettlementSigningPayload,
@@ -217,11 +222,13 @@ __export(index_exports, {
   decodeOfflineSmsSettleToken: () => decodeOfflineSmsSettleToken,
   decodePayCardArtifact: () => decodePayCardArtifact,
   decodePaymentRequestQR: () => decodePaymentRequestQR,
+  decodeUnverifiedConsumerOacQR: () => decodeUnverifiedConsumerOacQR,
   decodeUnverifiedConsumerSettlementReceiptQR: () => decodeUnverifiedConsumerSettlementReceiptQR,
   derToRawP256Signature: () => derToRawP256Signature,
   encodeArtifactUri: () => encodeArtifactUri,
   encodeAuthorizationQR: () => encodeAuthorizationQR,
   encodeBase45: () => encodeBase45,
+  encodeConsumerOacQR: () => encodeConsumerOacQR,
   encodeConsumerSettlementReceiptQR: () => encodeConsumerSettlementReceiptQR,
   encodeNQR: () => encodeNQR,
   encodeOfflineClaimSmsMessage: () => encodeOfflineClaimSmsMessage,
@@ -234,6 +241,7 @@ __export(index_exports, {
   generateStaticQR: () => generateStaticQR,
   init: () => init,
   inspectPayCardFreshness: () => inspectPayCardFreshness,
+  isConsumerOacQR: () => isConsumerOacQR,
   isConsumerPaymentRequestExpired: () => isConsumerPaymentRequestExpired,
   isHardenedArtifactType: () => isHardenedArtifactType,
   isKnownArtifactType: () => isKnownArtifactType,
@@ -264,6 +272,7 @@ __export(index_exports, {
   verifyConsumerSettlement: () => verifyConsumerSettlement,
   verifyConsumerSettlementReceiptQR: () => verifyConsumerSettlementReceiptQR,
   verifyOAC: () => verifyOAC,
+  verifyOacOffline: () => verifyOacOffline,
   verifyOfflineSmsSettleToken: () => verifyOfflineSmsSettleToken,
   verifyPass: () => verifyPass,
   verifyPayCardArtifact: () => verifyPayCardArtifact,
@@ -3238,7 +3247,17 @@ var Base64Std3 = import_zod13.z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/);
 var ClaimNonce = import_zod13.z.string().min(8).max(128).refine((value) => !value.includes("|"), {
   message: "nonce must not contain |"
 });
-var ACCOUNT_FUNDED_OAC_MAX_TTL_MS = 1e3 * 60 * 60 * 24 * 7;
+var ACCOUNT_FUNDED_OAC_MAX_TTL_MS = 1e3 * 60 * 60 * 24;
+var IssuerTrustKeySchema = import_zod13.z.object({
+  issuerId: import_zod13.z.string().min(1).max(128),
+  alg: import_zod13.z.literal("p256"),
+  publicKeySpkiB64: Base64Std3.min(64).max(4096),
+  notBeforeMs: import_zod13.z.number().int().nonnegative().optional(),
+  notAfterMs: import_zod13.z.number().int().positive().optional()
+});
+var IssuerTrustBundleSchema = import_zod13.z.object({
+  keys: import_zod13.z.array(IssuerTrustKeySchema).min(1)
+});
 var CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS = 1e3 * 60 * 60 * 24;
 var AttestationSecurityLevelSchema = import_zod13.z.enum([
   "STRONGBOX",
@@ -3292,13 +3311,28 @@ var ConsumerOACSchema = import_zod13.z.object({
   alg: import_zod13.z.literal("p256"),
   /** P-256 SubjectPublicKeyInfo DER, base64. */
   devicePubkeySpkiB64: Base64Std3.min(64).max(4096),
-  perTxCapKobo: import_zod13.z.number().int().positive(),
-  cumulativeCapKobo: import_zod13.z.number().int().positive(),
+  /**
+   * Per-transaction / cumulative offline spend ceilings. Zero is valid and
+   * denotes an identity-only OAC: the credential proves who the holder is and
+   * binds their device key for offline-verifiable first contact, but carries
+   * no offline spend authority (every claim against it routes to REVIEW).
+   * Issued to zero-balance wallets so they can still be paid offline.
+   */
+  perTxCapKobo: import_zod13.z.number().int().nonnegative(),
+  cumulativeCapKobo: import_zod13.z.number().int().nonnegative(),
   currency: import_zod13.z.string().length(3),
   validFromMs: import_zod13.z.number().int().nonnegative(),
   validUntilMs: import_zod13.z.number().int().nonnegative(),
   counterSeed: import_zod13.z.number().int().nonnegative(),
-  issuedAtMs: import_zod13.z.number().int().nonnegative()
+  issuedAtMs: import_zod13.z.number().int().nonnegative(),
+  /**
+   * Issuer-attested identity folded into the OAC so a single signed
+   * credential serves both Tier B offline-verifiable identity and offline
+   * spend authority. Verified offline against a pinned issuer key; the
+   * backend remains authoritative at settlement.
+   */
+  phoneE164: import_zod13.z.string().regex(/^\+[1-9]\d{7,14}$/),
+  displayName: import_zod13.z.string().min(1).max(64)
 });
 var SignedConsumerOACSchema = import_zod13.z.object({
   oac: ConsumerOACSchema,
@@ -3466,6 +3500,12 @@ function createMeOfflineClient(opts) {
       `/v1/me/offline/settlements/${encodeURIComponent(idOrKey)}`,
       void 0,
       (raw) => ConsumerSettlementSchema.parse(raw)
+    ),
+    getIssuerKeys: () => call(
+      "GET",
+      "/v1/issuer/keys",
+      void 0,
+      (raw) => IssuerTrustBundleSchema.parse(raw)
     )
   };
 }
@@ -3826,13 +3866,101 @@ function base64UrlDecodeUtf8(input) {
   throw new Error("base64 decoder unavailable");
 }
 
+// src/me-offline/oac.ts
+var CONSUMER_OAC_DOMAIN = "flur:consumer-offline:v1:oac";
+function consumerOacSigningPayload(oac) {
+  return { domain: CONSUMER_OAC_DOMAIN, ...oac };
+}
+function verifyOacOffline(signed, trustedKeys, options = {}) {
+  const parsed = SignedConsumerOACSchema.safeParse(signed);
+  if (!parsed.success) return { ok: false, reason: "malformed" };
+  const oacParsed = ConsumerOACSchema.safeParse(parsed.data.oac);
+  if (!oacParsed.success) return { ok: false, reason: "malformed" };
+  const oac = oacParsed.data;
+  const nowMs = options.nowMs ?? Date.now();
+  const pinned = trustedKeys.filter(
+    (k) => k.issuerId === oac.issuerId && (k.notBeforeMs === void 0 || nowMs >= k.notBeforeMs) && (k.notAfterMs === void 0 || nowMs <= k.notAfterMs)
+  );
+  if (pinned.length === 0) return { ok: false, reason: "untrusted_issuer" };
+  const signingBytes = canonicalJSONBytes(consumerOacSigningPayload(oac));
+  const signatureOk = pinned.some(
+    (k) => verifyIssuerP256(signingBytes, parsed.data.issuerSig, k.publicKeySpkiB64)
+  );
+  if (!signatureOk) return { ok: false, reason: "signature_invalid" };
+  if (oac.validUntilMs - oac.validFromMs > ACCOUNT_FUNDED_OAC_MAX_TTL_MS) {
+    return { ok: false, reason: "window_too_long" };
+  }
+  if (nowMs < oac.validFromMs) return { ok: false, reason: "not_yet_valid" };
+  if (nowMs >= oac.validUntilMs) return { ok: false, reason: "expired" };
+  return {
+    ok: true,
+    oac,
+    identity: {
+      oacId: oac.oacId,
+      issuerId: oac.issuerId,
+      userId: oac.userId,
+      phoneE164: oac.phoneE164,
+      displayName: oac.displayName,
+      devicePubkeySpkiB64: oac.devicePubkeySpkiB64
+    }
+  };
+}
+var CONSUMER_OAC_QR_PREFIX = "FLUROAC1.";
+function isConsumerOacQR(value) {
+  return value.startsWith(CONSUMER_OAC_QR_PREFIX);
+}
+function encodeConsumerOacQR(signed) {
+  const parsed = SignedConsumerOACSchema.parse(signed);
+  return `${CONSUMER_OAC_QR_PREFIX}${base64UrlEncodeUtf82(JSON.stringify(parsed))}`;
+}
+function decodeUnverifiedConsumerOacQR(value) {
+  if (!value.startsWith(CONSUMER_OAC_QR_PREFIX)) {
+    throw new Error("not a Flur consumer OAC QR");
+  }
+  const encoded = value.slice(CONSUMER_OAC_QR_PREFIX.length);
+  let raw;
+  try {
+    raw = JSON.parse(base64UrlDecodeUtf82(encoded));
+  } catch {
+    throw new Error("consumer OAC QR is malformed");
+  }
+  return SignedConsumerOACSchema.parse(raw);
+}
+function base64UrlEncodeUtf82(input) {
+  const bytes = new TextEncoder().encode(input);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  const base64 = typeof btoa === "function" ? btoa(binary) : typeof Buffer !== "undefined" ? Buffer.from(bytes).toString("base64") : void 0;
+  if (!base64) throw new Error("base64 encoder unavailable");
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecodeUtf82(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(
+    base64.length + (4 - base64.length % 4) % 4,
+    "="
+  );
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index++) {
+      bytes[index] = binary.charCodeAt(index);
+    }
+    return new TextDecoder().decode(bytes);
+  }
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(padded, "base64").toString("utf8");
+  }
+  throw new Error("base64 decoder unavailable");
+}
+
 // src/me-offline/sms.ts
 var import_nist3 = require("@noble/curves/nist");
 var OFFLINE_CLAIM_SMS_PREFIX = "FLURC1.";
 var CLAIM_TOKEN_RE = /(?:^|\s)(FLURC1\.[A-Za-z0-9_-]+={0,2})(?:\s|$)/;
 function encodeOfflineClaimSmsMessage(claim) {
   const parsed = ConsumerPaymentClaimSchema.parse(claim);
-  return `${OFFLINE_CLAIM_SMS_PREFIX}${base64UrlEncodeUtf82(
+  return `${OFFLINE_CLAIM_SMS_PREFIX}${base64UrlEncodeUtf83(
     JSON.stringify(parsed)
   )}`;
 }
@@ -3842,7 +3970,7 @@ function decodeOfflineClaimSmsMessage(message) {
   const encoded = token.slice(OFFLINE_CLAIM_SMS_PREFIX.length);
   let raw;
   try {
-    raw = JSON.parse(base64UrlDecodeUtf82(encoded));
+    raw = JSON.parse(base64UrlDecodeUtf83(encoded));
   } catch {
     throw new Error("offline claim QR token is malformed");
   }
@@ -4068,10 +4196,10 @@ function bytesToBase64Url(bytes) {
   }
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
-function base64UrlEncodeUtf82(input) {
+function base64UrlEncodeUtf83(input) {
   return bytesToBase64Url(utf8(input));
 }
-function base64UrlDecodeUtf82(input) {
+function base64UrlDecodeUtf83(input) {
   return new TextDecoder().decode(base64UrlToBytes(input));
 }
 function base64UrlToBytes(input) {
@@ -4969,6 +5097,8 @@ function buildPayCardSigningInput(input) {
   CLAIM_DOMAIN_V2,
   COLLECTION_INTENT_STATUSES,
   COLLECTION_PAYMENT_STATUSES,
+  CONSUMER_OAC_DOMAIN,
+  CONSUMER_OAC_QR_PREFIX,
   CONSUMER_OFFLINE_CLAIM_SUBMIT_GRACE_MS,
   CONSUMER_PAYMENT_REQUEST_DOMAIN,
   CONSUMER_SETTLEMENT_DOMAIN,
@@ -5007,6 +5137,8 @@ function buildPayCardSigningInput(input) {
   IdentityArtifactSchema,
   IngestFundingResultSchema,
   IssueAccountOacInputSchema,
+  IssuerTrustBundleSchema,
+  IssuerTrustKeySchema,
   LedgerJournalEntryArtifactSchema,
   ListPayoutDestinationsResultSchema,
   MEMBERSHIP_ROLES,
@@ -5110,6 +5242,7 @@ function buildPayCardSigningInput(input) {
   computeConsumerClaimEncounterId,
   computeEncounterId,
   constantTimeEqual,
+  consumerOacSigningPayload,
   consumerPaymentRequestSigningBytes,
   consumerPaymentRequestSigningPayload,
   consumerSettlementSigningPayload,
@@ -5142,11 +5275,13 @@ function buildPayCardSigningInput(input) {
   decodeOfflineSmsSettleToken,
   decodePayCardArtifact,
   decodePaymentRequestQR,
+  decodeUnverifiedConsumerOacQR,
   decodeUnverifiedConsumerSettlementReceiptQR,
   derToRawP256Signature,
   encodeArtifactUri,
   encodeAuthorizationQR,
   encodeBase45,
+  encodeConsumerOacQR,
   encodeConsumerSettlementReceiptQR,
   encodeNQR,
   encodeOfflineClaimSmsMessage,
@@ -5159,6 +5294,7 @@ function buildPayCardSigningInput(input) {
   generateStaticQR,
   init,
   inspectPayCardFreshness,
+  isConsumerOacQR,
   isConsumerPaymentRequestExpired,
   isHardenedArtifactType,
   isKnownArtifactType,
@@ -5189,6 +5325,7 @@ function buildPayCardSigningInput(input) {
   verifyConsumerSettlement,
   verifyConsumerSettlementReceiptQR,
   verifyOAC,
+  verifyOacOffline,
   verifyOfflineSmsSettleToken,
   verifyPass,
   verifyPayCardArtifact,