@orangecheck/auth-client 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 OrangeCheck
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,97 @@
+# `@orangecheck/auth-client`
+
+**React bindings for the cross-subdomain oc_session.**
+
+Drop a provider near your app root, then consume the signed-in identity
+from any subdomain in the `.ochk.io` ecosystem via hooks or a prebuilt
+sign-in button.
+
+Pairs with [`@orangecheck/auth-core`](../auth-core) on the server side.
+
+## Install
+
+```bash
+yarn add @orangecheck/auth-client @orangecheck/auth-core
+```
+
+## Mount the provider
+
+```tsx
+// app root (e.g. pages/_app.tsx)
+import { OcSessionProvider } from '@orangecheck/auth-client';
+
+export default function App({ Component, pageProps }) {
+    return (
+        <OcSessionProvider
+            config={{
+                authOrigin: 'https://ochk.io', // the subdomain that owns sign-in
+            }}
+        >
+            <Component {...pageProps} />
+        </OcSessionProvider>
+    );
+}
+```
+
+The provider hits `GET /api/auth/me` (same origin) to load the current
+session. Your app is responsible for implementing that endpoint using
+`@orangecheck/auth-core`'s `verifySessionToken()`.
+
+## Read the session
+
+```tsx
+import { useOcSession } from '@orangecheck/auth-client';
+
+function Header() {
+    const { status, account, signOut } = useOcSession();
+
+    if (status === 'loading') return null;
+    if (status === 'anonymous') return <a href="/signin">sign in</a>;
+
+    return (
+        <>
+            <span>{account!.address}</span>
+            <button onClick={() => signOut()}>sign out</button>
+        </>
+    );
+}
+```
+
+## Drop-in components
+
+```tsx
+import { OcSignInButton, OcAccountPill } from '@orangecheck/auth-client';
+
+// Shows a sign-in link when anonymous, nothing when signed in.
+<OcSignInButton className="font-mono text-xs uppercase" />
+
+// Shows the signed-in address pill; nothing when anonymous.
+<OcAccountPill dashboardUrl="https://attest.ochk.io/dashboard" />
+```
+
+Both components use CSS classes from the caller — no enforced styling,
+so they work with Tailwind, vanilla CSS, or whatever.
+
+## API
+
+```ts
+OcSessionProvider({ children, config?, defaultReturnTo? })
+
+useOcSession(): {
+    status: 'loading' | 'authenticated' | 'anonymous' | 'error';
+    account: OcAccount | null;
+    error: Error | null;
+    refresh(): Promise<void>;
+    signOut(): Promise<void>;
+    signInUrl: string;
+}
+
+useOptionalOcSession(): OcSessionState | null   // no-throw variant
+
+<OcSignInButton label? eager? ...anchorProps />
+<OcAccountPill dashboardUrl? render? ...divProps />
+```
+
+## License
+
+MIT.

package/dist/index.d.mts

@@ -0,0 +1,50 @@
+import * as React from 'react';
+
+interface OcAccount {
+    accountId: string;
+    address: string;
+    displayName?: string | null;
+    nostrNpub?: string | null;
+}
+type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';
+interface OcSessionState {
+    status: OcSessionStatus;
+    account: OcAccount | null;
+    error: Error | null;
+    refresh: () => Promise<void>;
+    signOut: () => Promise<void>;
+    signInUrl: string;
+}
+interface OcAuthConfig {
+    authOrigin?: string;
+    signInPath?: string;
+    mePath?: string;
+    logoutPath?: string;
+}
+declare const DEFAULT_CONFIG: Required<OcAuthConfig>;
+declare function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
+
+interface OcSessionProviderProps {
+    children: React.ReactNode;
+    config?: OcAuthConfig;
+    defaultReturnTo?: string;
+}
+declare function OcSessionProvider({ children, config, defaultReturnTo, }: OcSessionProviderProps): React.ReactElement;
+declare function useOcSession(): OcSessionState;
+declare function useOptionalOcSession(): OcSessionState | null;
+
+interface OcSignInButtonProps extends React.AnchorHTMLAttributes<HTMLAnchorElement> {
+    label?: string;
+    eager?: boolean;
+}
+declare function OcSignInButton({ label, eager, className, ...rest }: OcSignInButtonProps): React.ReactElement | null;
+interface OcAccountPillProps extends React.HTMLAttributes<HTMLDivElement> {
+    dashboardUrl?: string;
+    render?: (account: {
+        address: string;
+        displayName?: string | null;
+    }) => React.ReactNode;
+}
+declare function OcAccountPill({ dashboardUrl, render, className, ...rest }: OcAccountPillProps): React.ReactElement | null;
+
+export { DEFAULT_CONFIG, type OcAccount, OcAccountPill, type OcAccountPillProps, type OcAuthConfig, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignInButton, type OcSignInButtonProps, buildSignInUrl, useOcSession, useOptionalOcSession };

package/dist/index.d.ts

@@ -0,0 +1,50 @@
+import * as React from 'react';
+
+interface OcAccount {
+    accountId: string;
+    address: string;
+    displayName?: string | null;
+    nostrNpub?: string | null;
+}
+type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';
+interface OcSessionState {
+    status: OcSessionStatus;
+    account: OcAccount | null;
+    error: Error | null;
+    refresh: () => Promise<void>;
+    signOut: () => Promise<void>;
+    signInUrl: string;
+}
+interface OcAuthConfig {
+    authOrigin?: string;
+    signInPath?: string;
+    mePath?: string;
+    logoutPath?: string;
+}
+declare const DEFAULT_CONFIG: Required<OcAuthConfig>;
+declare function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
+
+interface OcSessionProviderProps {
+    children: React.ReactNode;
+    config?: OcAuthConfig;
+    defaultReturnTo?: string;
+}
+declare function OcSessionProvider({ children, config, defaultReturnTo, }: OcSessionProviderProps): React.ReactElement;
+declare function useOcSession(): OcSessionState;
+declare function useOptionalOcSession(): OcSessionState | null;
+
+interface OcSignInButtonProps extends React.AnchorHTMLAttributes<HTMLAnchorElement> {
+    label?: string;
+    eager?: boolean;
+}
+declare function OcSignInButton({ label, eager, className, ...rest }: OcSignInButtonProps): React.ReactElement | null;
+interface OcAccountPillProps extends React.HTMLAttributes<HTMLDivElement> {
+    dashboardUrl?: string;
+    render?: (account: {
+        address: string;
+        displayName?: string | null;
+    }) => React.ReactNode;
+}
+declare function OcAccountPill({ dashboardUrl, render, className, ...rest }: OcAccountPillProps): React.ReactElement | null;
+
+export { DEFAULT_CONFIG, type OcAccount, OcAccountPill, type OcAccountPillProps, type OcAuthConfig, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignInButton, type OcSignInButtonProps, buildSignInUrl, useOcSession, useOptionalOcSession };

package/dist/index.js

@@ -0,0 +1,209 @@
+'use strict';
+
+var React = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
+
+// src/provider.tsx
+
+// src/types.ts
+var DEFAULT_CONFIG = {
+  authOrigin: "https://ochk.io",
+  signInPath: "/signin",
+  mePath: "/api/auth/me",
+  logoutPath: "/api/auth/logout"
+};
+function resolveConfig(cfg) {
+  return { ...DEFAULT_CONFIG, ...cfg ?? {} };
+}
+function buildSignInUrl(cfg, returnTo) {
+  const base = `${cfg.authOrigin}${cfg.signInPath}`;
+  if (!returnTo) return base;
+  const u = new URL(base);
+  u.searchParams.set("return_to", returnTo);
+  return u.toString();
+}
+var SessionContext = React__namespace.createContext(null);
+function normalizeAccount(raw) {
+  if (!raw) return null;
+  const address = raw.btc_address ?? raw.address;
+  const accountId = raw.id ?? raw.account_id ?? raw.accountId;
+  if (!address || !accountId) return null;
+  return {
+    accountId,
+    address,
+    displayName: raw.display_name ?? raw.displayName ?? null,
+    nostrNpub: raw.nostr_npub ?? raw.nostrNpub ?? null
+  };
+}
+function OcSessionProvider({
+  children,
+  config,
+  defaultReturnTo
+}) {
+  const cfg = React__namespace.useMemo(() => resolveConfig(config), [config]);
+  const [account, setAccount] = React__namespace.useState(null);
+  const [status, setStatus] = React__namespace.useState("loading");
+  const [error, setError] = React__namespace.useState(null);
+  const refresh = React__namespace.useCallback(async () => {
+    if (typeof window === "undefined") return;
+    try {
+      const res = await fetch(cfg.mePath, {
+        method: "GET",
+        credentials: "include",
+        headers: { Accept: "application/json" }
+      });
+      if (res.status === 401) {
+        setAccount(null);
+        setStatus("anonymous");
+        setError(null);
+        return;
+      }
+      if (!res.ok) {
+        setStatus("error");
+        setError(new Error(`me endpoint returned ${res.status}`));
+        return;
+      }
+      const body = await res.json();
+      const acct = normalizeAccount(body.account);
+      setAccount(acct);
+      setStatus(acct ? "authenticated" : "anonymous");
+      setError(null);
+    } catch (err) {
+      setStatus("error");
+      setError(err instanceof Error ? err : new Error(String(err)));
+    }
+  }, [cfg.mePath]);
+  React__namespace.useEffect(() => {
+    void refresh();
+  }, [refresh]);
+  const signOut = React__namespace.useCallback(async () => {
+    try {
+      await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
+        method: "POST",
+        credentials: "include"
+      });
+    } catch {
+    }
+    setAccount(null);
+    setStatus("anonymous");
+  }, [cfg.authOrigin, cfg.logoutPath]);
+  const value = React__namespace.useMemo(() => {
+    const returnTo = defaultReturnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
+    return {
+      status,
+      account,
+      error,
+      refresh,
+      signOut,
+      signInUrl: buildSignInUrl(cfg, returnTo)
+    };
+  }, [status, account, error, refresh, signOut, cfg, defaultReturnTo]);
+  return /* @__PURE__ */ jsxRuntime.jsx(SessionContext.Provider, { value, children });
+}
+function useOcSession() {
+  const ctx = React__namespace.useContext(SessionContext);
+  if (!ctx) {
+    throw new Error(
+      "[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>"
+    );
+  }
+  return ctx;
+}
+function useOptionalOcSession() {
+  return React__namespace.useContext(SessionContext);
+}
+function shortenAddress(addr) {
+  if (addr.length <= 12) return addr;
+  return `${addr.slice(0, 6)}\u2026${addr.slice(-4)}`;
+}
+function OcSignInButton({
+  label = "sign in with bitcoin",
+  eager = false,
+  className,
+  ...rest
+}) {
+  const { status, signInUrl } = useOcSession();
+  if (status === "authenticated") return null;
+  if (!eager && status === "loading") return null;
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    "a",
+    {
+      ...rest,
+      href: signInUrl,
+      className,
+      "data-oc-sign-in-button": "",
+      children: label
+    }
+  );
+}
+function OcAccountPill({
+  dashboardUrl,
+  render,
+  className,
+  ...rest
+}) {
+  const { status, account, signOut } = useOcSession();
+  if (status !== "authenticated" || !account) return null;
+  const label = render ? render({ address: account.address, displayName: account.displayName }) : account.displayName ?? shortenAddress(account.address);
+  return /* @__PURE__ */ jsxRuntime.jsxs(
+    "div",
+    {
+      ...rest,
+      className,
+      "data-oc-account-pill": "",
+      style: { display: "inline-flex", alignItems: "center", gap: "0.5rem", ...rest.style ?? {} },
+      children: [
+        dashboardUrl ? /* @__PURE__ */ jsxRuntime.jsx("a", { href: dashboardUrl, children: label }) : /* @__PURE__ */ jsxRuntime.jsx("span", { children: label }),
+        /* @__PURE__ */ jsxRuntime.jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => {
+              void signOut();
+            },
+            "aria-label": "Sign out",
+            style: {
+              background: "none",
+              border: "none",
+              cursor: "pointer",
+              color: "inherit",
+              font: "inherit",
+              padding: 0
+            },
+            children: "sign out"
+          }
+        )
+      ]
+    }
+  );
+}
+
+exports.DEFAULT_CONFIG = DEFAULT_CONFIG;
+exports.OcAccountPill = OcAccountPill;
+exports.OcSessionProvider = OcSessionProvider;
+exports.OcSignInButton = OcSignInButton;
+exports.buildSignInUrl = buildSignInUrl;
+exports.useOcSession = useOcSession;
+exports.useOptionalOcSession = useOptionalOcSession;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/provider.tsx","../src/components.tsx"],"names":["React","jsx","jsxs"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDO,IAAM,cAAA,GAAyC;AAAA,EAClD,UAAA,EAAY,iBAAA;AAAA,EACZ,UAAA,EAAY,SAAA;AAAA,EACZ,MAAA,EAAQ,cAAA;AAAA,EACR,UAAA,EAAY;AAChB;AAEO,SAAS,cAAc,GAAA,EAAuD;AACjF,EAAA,OAAO,EAAE,GAAG,cAAA,EAAgB,GAAI,GAAA,IAAO,EAAC,EAAG;AAC/C;AAEO,SAAS,cAAA,CAAe,KAA6B,QAAA,EAA2B;AACnF,EAAA,MAAM,OAAO,CAAA,EAAG,GAAA,CAAI,UAAU,CAAA,EAAG,IAAI,UAAU,CAAA,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AACtB,EAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,IAAI,CAAA;AACtB,EAAA,CAAA,CAAE,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AACxC,EAAA,OAAO,EAAE,QAAA,EAAS;AACtB;ACvDA,IAAM,cAAA,GAAuBA,+BAAqC,IAAI,CAAA;AAgBtE,SAAS,iBAAiB,GAAA,EAA8C;AACpE,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,OAAA;AACvC,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,EAAA,IAAM,GAAA,CAAI,cAAc,GAAA,CAAI,SAAA;AAClD,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,EAAW,OAAO,IAAA;AACnC,EAAA,OAAO;AAAA,IACH,SAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,EAAa,GAAA,CAAI,YAAA,IAAgB,GAAA,CAAI,WAAA,IAAe,IAAA;AAAA,IACpD,SAAA,EAAW,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,SAAA,IAAa;AAAA,GAClD;AACJ;AAgBO,SAAS,iBAAA,CAAkB;AAAA,EAC9B,QAAA;AAAA,EACA,MAAA;AAAA,EACA;AACJ,CAAA,EAA+C;AAC3C,EAAA,MAAM,GAAA,GAAYA,yBAAQ,MAAM,aAAA,CAAc,MAAM,CAAA,EAAG,CAAC,MAAM,CAAC,CAAA;AAC/D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAUA,0BAA2B,IAAI,CAAA;AACnE,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAUA,0BAAmC,SAAS,CAAA;AAC9E,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAUA,0BAAuB,IAAI,CAAA;AAE3D,EAAA,MAAM,OAAA,GAAgBA,6BAAY,YAAY;AAC1C,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa,SAAA;AAAA,QACb,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,OACzC,CAAA;AACD,MAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,QAAA,UAAA,CAAW,IAAI,CAAA;AACf,QAAA,SAAA,CAAU,WAAW,CAAA;AACrB,QAAA,QAAA,CAAS,IAAI,CAAA;AACb,QAAA;AAAA,MACJ;AACA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,QAAA,SAAA,CAAU,OAAO,CAAA;AACjB,QAAA,QAAA,CAAS,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,GAAA,CAAI,MAAM,EAAE,CAAC,CAAA;AACxD,QAAA;AAAA,MACJ;AACA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,IAAA,CAAK,OAAO,CAAA;AAC1C,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,SAAA,CAAU,IAAA,GAAO,kBAAkB,WAAW,CAAA;AAC9C,MAAA,QAAA,CAAS,IAAI,CAAA;AAAA,IACjB,SAAS,GAAA,EAAK;AACV,MAAA,SAAA,CAAU,OAAO,CAAA;AACjB,MAAA,QAAA,CAAS,GAAA,YAAe,QAAQ,GAAA,GAAM,IAAI,MAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,IAChE;AAAA,EACJ,CAAA,EAAG,CAAC,GAAA,CAAI,MAAM,CAAC,CAAA;AAEf,EAAMA,2BAAU,MAAM;AAClB,IAAA,KAAK,OAAA,EAAQ;AAAA,EACjB,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AAEZ,EAAA,MAAM,OAAA,GAAgBA,6BAAY,YAAY;AAC1C,IAAA,IAAI;AACA,MAAA,MAAM,MAAM,CAAA,EAAG,GAAA,CAAI,UAAU,CAAA,EAAG,GAAA,CAAI,UAAU,CAAA,CAAA,EAAI;AAAA,QAC9C,MAAA,EAAQ,MAAA;AAAA,QACR,WAAA,EAAa;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,CAAA,MAAQ;AAAA,IAGR;AACA,IAAA,UAAA,CAAW,IAAI,CAAA;AACf,IAAA,SAAA,CAAU,WAAW,CAAA;AAAA,EACzB,GAAG,CAAC,GAAA,CAAI,UAAA,EAAY,GAAA,CAAI,UAAU,CAAC,CAAA;AAEnC,EAAA,MAAM,KAAA,GAAcA,yBAAwB,MAAM;AAC9C,IAAA,MAAM,WACF,eAAA,KAAoB,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,MAAA,CAAA;AAC/E,IAAA,OAAO;AAAA,MACH,MAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,OAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,cAAA,CAAe,GAAA,EAAK,QAAQ;AAAA,KAC3C;AAAA,EACJ,CAAA,EAAG,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,OAAA,EAAS,OAAA,EAAS,GAAA,EAAK,eAAe,CAAC,CAAA;AAEnE,EAAA,uBAAOC,cAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,OAAe,QAAA,EAAS,CAAA;AAC5D;AAMO,SAAS,YAAA,GAA+B;AAC3C,EAAA,MAAM,GAAA,GAAYD,4BAAW,cAAc,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACN;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,GAAA;AACX;AAOO,SAAS,oBAAA,GAA8C;AAC1D,EAAA,OAAaA,4BAAW,cAAc,CAAA;AAC1C;ACjJA,SAAS,eAAe,IAAA,EAAsB;AAC1C,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,EAAA,EAAI,OAAO,IAAA;AAC9B,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,MAAA,EAAI,IAAA,CAAK,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAChD;AAmBO,SAAS,cAAA,CAAe;AAAA,EAC3B,KAAA,GAAQ,sBAAA;AAAA,EACR,KAAA,GAAQ,KAAA;AAAA,EACR,SAAA;AAAA,EACA,GAAG;AACP,CAAA,EAAmD;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAU,GAAI,YAAA,EAAa;AAC3C,EAAA,IAAI,MAAA,KAAW,iBAAiB,OAAO,IAAA;AACvC,EAAA,IAAI,CAAC,KAAA,IAAS,MAAA,KAAW,SAAA,EAAW,OAAO,IAAA;AAE3C,EAAA,uBACIC,cAAAA;AAAA,IAAC,GAAA;AAAA,IAAA;AAAA,MACI,GAAG,IAAA;AAAA,MACJ,IAAA,EAAM,SAAA;AAAA,MACN,SAAA;AAAA,MACA,wBAAA,EAAuB,EAAA;AAAA,MAEtB,QAAA,EAAA;AAAA;AAAA,GACL;AAER;AAeO,SAAS,aAAA,CAAc;AAAA,EAC1B,YAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,GAAG;AACP,CAAA,EAAkD;AAC9C,EAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAS,OAAA,KAAY,YAAA,EAAa;AAElD,EAAA,IAAI,MAAA,KAAW,eAAA,IAAmB,CAAC,OAAA,EAAS,OAAO,IAAA;AAEnD,EAAA,MAAM,QAAQ,MAAA,GACR,MAAA,CAAO,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAS,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAa,CAAA,GACpE,OAAA,CAAQ,WAAA,IAAe,cAAA,CAAe,QAAQ,OAAO,CAAA;AAE5D,EAAA,uBACIC,eAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACI,GAAG,IAAA;AAAA,MACJ,SAAA;AAAA,MACA,sBAAA,EAAqB,EAAA;AAAA,MACrB,KAAA,EAAO,EAAE,OAAA,EAAS,aAAA,EAAe,UAAA,EAAY,QAAA,EAAU,GAAA,EAAK,QAAA,EAAU,GAAI,IAAA,CAAK,KAAA,IAAS,EAAC,EAAG;AAAA,MAE3F,QAAA,EAAA;AAAA,QAAA,YAAA,mBACGD,cAAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAM,YAAA,EAAe,iBAAM,CAAA,mBAE9BA,cAAAA,CAAC,MAAA,EAAA,EAAM,QAAA,EAAA,KAAA,EAAM,CAAA;AAAA,wBAEjBA,cAAAA;AAAA,UAAC,QAAA;AAAA,UAAA;AAAA,YACG,IAAA,EAAK,QAAA;AAAA,YACL,SAAS,MAAM;AACX,cAAA,KAAK,OAAA,EAAQ;AAAA,YACjB,CAAA;AAAA,YACA,YAAA,EAAW,UAAA;AAAA,YACX,KAAA,EAAO;AAAA,cACH,UAAA,EAAY,MAAA;AAAA,cACZ,MAAA,EAAQ,MAAA;AAAA,cACR,MAAA,EAAQ,SAAA;AAAA,cACR,KAAA,EAAO,SAAA;AAAA,cACP,IAAA,EAAM,SAAA;AAAA,cACN,OAAA,EAAS;AAAA,aACb;AAAA,YACH,QAAA,EAAA;AAAA;AAAA;AAED;AAAA;AAAA,GACJ;AAER","file":"index.js","sourcesContent":["export interface OcAccount {\n    accountId: string;\n    address: string;\n    displayName?: string | null;\n    nostrNpub?: string | null;\n}\n\nexport type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';\n\nexport interface OcSessionState {\n    status: OcSessionStatus;\n    account: OcAccount | null;\n    /** `null` while loading; an `Error` instance when `status === 'error'`. */\n    error: Error | null;\n    /** Re-fetch the session. Useful after sign-in/sign-out happens elsewhere. */\n    refresh: () => Promise<void>;\n    /** Trigger a sign-out. Resolves once the cookie has been cleared. */\n    signOut: () => Promise<void>;\n    /** URL to navigate to for sign-in on the auth host. */\n    signInUrl: string;\n}\n\nexport interface OcAuthConfig {\n    /**\n     * Origin of the auth host — the subdomain that runs the sign-in UI,\n     * issues session cookies, and exposes `/api/auth/me` + `/api/auth/logout`.\n     *\n     * Defaults to `https://ochk.io`. Override in preview/dev.\n     */\n    authOrigin?: string;\n    /**\n     * Path on the auth host that accepts `?return_to=<url>` and drives the\n     * BIP-322 sign-in flow. Defaults to `/signin`.\n     */\n    signInPath?: string;\n    /**\n     * Local path (same origin as the current app) that exposes the\n     * crypto-verified session. If your app ships one at `/api/auth/me`,\n     * leave as default. Returns 200 `{ account }` or 401.\n     */\n    mePath?: string;\n    /**\n     * Path on the auth host to hit to clear the session cookie.\n     * Defaults to `/api/auth/logout`. Called with `credentials: 'include'`\n     * so the `.ochk.io` cookie is sent along.\n     */\n    logoutPath?: string;\n}\n\nexport const DEFAULT_CONFIG: Required<OcAuthConfig> = {\n    authOrigin: 'https://ochk.io',\n    signInPath: '/signin',\n    mePath: '/api/auth/me',\n    logoutPath: '/api/auth/logout',\n};\n\nexport function resolveConfig(cfg: OcAuthConfig | undefined): Required<OcAuthConfig> {\n    return { ...DEFAULT_CONFIG, ...(cfg ?? {}) };\n}\n\nexport function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string {\n    const base = `${cfg.authOrigin}${cfg.signInPath}`;\n    if (!returnTo) return base;\n    const u = new URL(base);\n    u.searchParams.set('return_to', returnTo);\n    return u.toString();\n}\n","import * as React from 'react';\n\nimport {\n    buildSignInUrl,\n    DEFAULT_CONFIG,\n    resolveConfig,\n    type OcAccount,\n    type OcAuthConfig,\n    type OcSessionState,\n} from './types';\n\nconst SessionContext = React.createContext<OcSessionState | null>(null);\n\ninterface MeResponse {\n    account?: {\n        id?: string;\n        account_id?: string;\n        accountId?: string;\n        btc_address?: string;\n        address?: string;\n        display_name?: string | null;\n        displayName?: string | null;\n        nostr_npub?: string | null;\n        nostrNpub?: string | null;\n    };\n}\n\nfunction normalizeAccount(raw: MeResponse['account']): OcAccount | null {\n    if (!raw) return null;\n    const address = raw.btc_address ?? raw.address;\n    const accountId = raw.id ?? raw.account_id ?? raw.accountId;\n    if (!address || !accountId) return null;\n    return {\n        accountId,\n        address,\n        displayName: raw.display_name ?? raw.displayName ?? null,\n        nostrNpub: raw.nostr_npub ?? raw.nostrNpub ?? null,\n    };\n}\n\nexport interface OcSessionProviderProps {\n    children: React.ReactNode;\n    config?: OcAuthConfig;\n    /**\n     * Optional return URL passed to the sign-in page. Defaults to the\n     * current `window.location.href` at click-time.\n     */\n    defaultReturnTo?: string;\n}\n\n/**\n * Top-level provider that exposes the cross-subdomain oc_session to every\n * component below it. Mount once, near the root of your tree.\n */\nexport function OcSessionProvider({\n    children,\n    config,\n    defaultReturnTo,\n}: OcSessionProviderProps): React.ReactElement {\n    const cfg = React.useMemo(() => resolveConfig(config), [config]);\n    const [account, setAccount] = React.useState<OcAccount | null>(null);\n    const [status, setStatus] = React.useState<OcSessionState['status']>('loading');\n    const [error, setError] = React.useState<Error | null>(null);\n\n    const refresh = React.useCallback(async () => {\n        if (typeof window === 'undefined') return;\n        try {\n            const res = await fetch(cfg.mePath, {\n                method: 'GET',\n                credentials: 'include',\n                headers: { Accept: 'application/json' },\n            });\n            if (res.status === 401) {\n                setAccount(null);\n                setStatus('anonymous');\n                setError(null);\n                return;\n            }\n            if (!res.ok) {\n                setStatus('error');\n                setError(new Error(`me endpoint returned ${res.status}`));\n                return;\n            }\n            const body = (await res.json()) as MeResponse;\n            const acct = normalizeAccount(body.account);\n            setAccount(acct);\n            setStatus(acct ? 'authenticated' : 'anonymous');\n            setError(null);\n        } catch (err) {\n            setStatus('error');\n            setError(err instanceof Error ? err : new Error(String(err)));\n        }\n    }, [cfg.mePath]);\n\n    React.useEffect(() => {\n        void refresh();\n    }, [refresh]);\n\n    const signOut = React.useCallback(async () => {\n        try {\n            await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {\n                method: 'POST',\n                credentials: 'include',\n            });\n        } catch {\n            // fall through — we still clear local state so the UI reflects\n            // the user's intent even if the server round-trip fails.\n        }\n        setAccount(null);\n        setStatus('anonymous');\n    }, [cfg.authOrigin, cfg.logoutPath]);\n\n    const value = React.useMemo<OcSessionState>(() => {\n        const returnTo =\n            defaultReturnTo ?? (typeof window !== 'undefined' ? window.location.href : undefined);\n        return {\n            status,\n            account,\n            error,\n            refresh,\n            signOut,\n            signInUrl: buildSignInUrl(cfg, returnTo),\n        };\n    }, [status, account, error, refresh, signOut, cfg, defaultReturnTo]);\n\n    return <SessionContext.Provider value={value}>{children}</SessionContext.Provider>;\n}\n\n/**\n * Access the current cross-subdomain oc_session. Must be called inside\n * an `<OcSessionProvider>`.\n */\nexport function useOcSession(): OcSessionState {\n    const ctx = React.useContext(SessionContext);\n    if (!ctx) {\n        throw new Error(\n            '[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>'\n        );\n    }\n    return ctx;\n}\n\n/**\n * Non-throwing variant — returns `null` if called outside a provider.\n * Useful for libraries that want to read the session *if it exists* but\n * shouldn't crash on apps that haven't opted in.\n */\nexport function useOptionalOcSession(): OcSessionState | null {\n    return React.useContext(SessionContext);\n}\n\nexport { DEFAULT_CONFIG };\n","import * as React from 'react';\n\nimport { useOcSession } from './provider';\n\nfunction shortenAddress(addr: string): string {\n    if (addr.length <= 12) return addr;\n    return `${addr.slice(0, 6)}…${addr.slice(-4)}`;\n}\n\nexport interface OcSignInButtonProps extends React.AnchorHTMLAttributes<HTMLAnchorElement> {\n    /** Label shown when no user is signed in. Defaults to `sign in with bitcoin`. */\n    label?: string;\n    /**\n     * When `true`, render an `<a>` even while the session is loading, to\n     * avoid layout shift. Defaults to `false` (renders nothing while loading).\n     */\n    eager?: boolean;\n}\n\n/**\n * Drop-in sign-in button. Renders an anchor that deep-links to the auth\n * host's sign-in page with the current URL as `?return_to=…`.\n *\n * When the user is already authenticated it renders nothing — wrap it in\n * a conditional or use `<OcAccountPill>` as the signed-in affordance.\n */\nexport function OcSignInButton({\n    label = 'sign in with bitcoin',\n    eager = false,\n    className,\n    ...rest\n}: OcSignInButtonProps): React.ReactElement | null {\n    const { status, signInUrl } = useOcSession();\n    if (status === 'authenticated') return null;\n    if (!eager && status === 'loading') return null;\n\n    return (\n        <a\n            {...rest}\n            href={signInUrl}\n            className={className}\n            data-oc-sign-in-button=\"\"\n        >\n            {label}\n        </a>\n    );\n}\n\nexport interface OcAccountPillProps extends React.HTMLAttributes<HTMLDivElement> {\n    /** URL to link the address to. Defaults to the auth origin's `/dashboard`. */\n    dashboardUrl?: string;\n    /** Override the display text. Defaults to the shortened address. */\n    render?: (account: { address: string; displayName?: string | null }) => React.ReactNode;\n}\n\n/**\n * Shows the signed-in user as a short pill: `bc1q…abcd  sign out`.\n *\n * Renders nothing while loading or when no user is signed in — pair with\n * `<OcSignInButton>` for the anonymous case.\n */\nexport function OcAccountPill({\n    dashboardUrl,\n    render,\n    className,\n    ...rest\n}: OcAccountPillProps): React.ReactElement | null {\n    const { status, account, signOut } = useOcSession();\n\n    if (status !== 'authenticated' || !account) return null;\n\n    const label = render\n        ? render({ address: account.address, displayName: account.displayName })\n        : (account.displayName ?? shortenAddress(account.address));\n\n    return (\n        <div\n            {...rest}\n            className={className}\n            data-oc-account-pill=\"\"\n            style={{ display: 'inline-flex', alignItems: 'center', gap: '0.5rem', ...(rest.style ?? {}) }}\n        >\n            {dashboardUrl ? (\n                <a href={dashboardUrl}>{label}</a>\n            ) : (\n                <span>{label}</span>\n            )}\n            <button\n                type=\"button\"\n                onClick={() => {\n                    void signOut();\n                }}\n                aria-label=\"Sign out\"\n                style={{\n                    background: 'none',\n                    border: 'none',\n                    cursor: 'pointer',\n                    color: 'inherit',\n                    font: 'inherit',\n                    padding: 0,\n                }}\n            >\n                sign out\n            </button>\n        </div>\n    );\n}\n"]}

package/dist/index.mjs

@@ -0,0 +1,181 @@
+import * as React from 'react';
+import { jsx, jsxs } from 'react/jsx-runtime';
+
+// src/provider.tsx
+
+// src/types.ts
+var DEFAULT_CONFIG = {
+  authOrigin: "https://ochk.io",
+  signInPath: "/signin",
+  mePath: "/api/auth/me",
+  logoutPath: "/api/auth/logout"
+};
+function resolveConfig(cfg) {
+  return { ...DEFAULT_CONFIG, ...cfg ?? {} };
+}
+function buildSignInUrl(cfg, returnTo) {
+  const base = `${cfg.authOrigin}${cfg.signInPath}`;
+  if (!returnTo) return base;
+  const u = new URL(base);
+  u.searchParams.set("return_to", returnTo);
+  return u.toString();
+}
+var SessionContext = React.createContext(null);
+function normalizeAccount(raw) {
+  if (!raw) return null;
+  const address = raw.btc_address ?? raw.address;
+  const accountId = raw.id ?? raw.account_id ?? raw.accountId;
+  if (!address || !accountId) return null;
+  return {
+    accountId,
+    address,
+    displayName: raw.display_name ?? raw.displayName ?? null,
+    nostrNpub: raw.nostr_npub ?? raw.nostrNpub ?? null
+  };
+}
+function OcSessionProvider({
+  children,
+  config,
+  defaultReturnTo
+}) {
+  const cfg = React.useMemo(() => resolveConfig(config), [config]);
+  const [account, setAccount] = React.useState(null);
+  const [status, setStatus] = React.useState("loading");
+  const [error, setError] = React.useState(null);
+  const refresh = React.useCallback(async () => {
+    if (typeof window === "undefined") return;
+    try {
+      const res = await fetch(cfg.mePath, {
+        method: "GET",
+        credentials: "include",
+        headers: { Accept: "application/json" }
+      });
+      if (res.status === 401) {
+        setAccount(null);
+        setStatus("anonymous");
+        setError(null);
+        return;
+      }
+      if (!res.ok) {
+        setStatus("error");
+        setError(new Error(`me endpoint returned ${res.status}`));
+        return;
+      }
+      const body = await res.json();
+      const acct = normalizeAccount(body.account);
+      setAccount(acct);
+      setStatus(acct ? "authenticated" : "anonymous");
+      setError(null);
+    } catch (err) {
+      setStatus("error");
+      setError(err instanceof Error ? err : new Error(String(err)));
+    }
+  }, [cfg.mePath]);
+  React.useEffect(() => {
+    void refresh();
+  }, [refresh]);
+  const signOut = React.useCallback(async () => {
+    try {
+      await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
+        method: "POST",
+        credentials: "include"
+      });
+    } catch {
+    }
+    setAccount(null);
+    setStatus("anonymous");
+  }, [cfg.authOrigin, cfg.logoutPath]);
+  const value = React.useMemo(() => {
+    const returnTo = defaultReturnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
+    return {
+      status,
+      account,
+      error,
+      refresh,
+      signOut,
+      signInUrl: buildSignInUrl(cfg, returnTo)
+    };
+  }, [status, account, error, refresh, signOut, cfg, defaultReturnTo]);
+  return /* @__PURE__ */ jsx(SessionContext.Provider, { value, children });
+}
+function useOcSession() {
+  const ctx = React.useContext(SessionContext);
+  if (!ctx) {
+    throw new Error(
+      "[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>"
+    );
+  }
+  return ctx;
+}
+function useOptionalOcSession() {
+  return React.useContext(SessionContext);
+}
+function shortenAddress(addr) {
+  if (addr.length <= 12) return addr;
+  return `${addr.slice(0, 6)}\u2026${addr.slice(-4)}`;
+}
+function OcSignInButton({
+  label = "sign in with bitcoin",
+  eager = false,
+  className,
+  ...rest
+}) {
+  const { status, signInUrl } = useOcSession();
+  if (status === "authenticated") return null;
+  if (!eager && status === "loading") return null;
+  return /* @__PURE__ */ jsx(
+    "a",
+    {
+      ...rest,
+      href: signInUrl,
+      className,
+      "data-oc-sign-in-button": "",
+      children: label
+    }
+  );
+}
+function OcAccountPill({
+  dashboardUrl,
+  render,
+  className,
+  ...rest
+}) {
+  const { status, account, signOut } = useOcSession();
+  if (status !== "authenticated" || !account) return null;
+  const label = render ? render({ address: account.address, displayName: account.displayName }) : account.displayName ?? shortenAddress(account.address);
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      ...rest,
+      className,
+      "data-oc-account-pill": "",
+      style: { display: "inline-flex", alignItems: "center", gap: "0.5rem", ...rest.style ?? {} },
+      children: [
+        dashboardUrl ? /* @__PURE__ */ jsx("a", { href: dashboardUrl, children: label }) : /* @__PURE__ */ jsx("span", { children: label }),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => {
+              void signOut();
+            },
+            "aria-label": "Sign out",
+            style: {
+              background: "none",
+              border: "none",
+              cursor: "pointer",
+              color: "inherit",
+              font: "inherit",
+              padding: 0
+            },
+            children: "sign out"
+          }
+        )
+      ]
+    }
+  );
+}
+
+export { DEFAULT_CONFIG, OcAccountPill, OcSessionProvider, OcSignInButton, buildSignInUrl, useOcSession, useOptionalOcSession };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/provider.tsx","../src/components.tsx"],"names":["jsx"],"mappings":";;;;;;AAiDO,IAAM,cAAA,GAAyC;AAAA,EAClD,UAAA,EAAY,iBAAA;AAAA,EACZ,UAAA,EAAY,SAAA;AAAA,EACZ,MAAA,EAAQ,cAAA;AAAA,EACR,UAAA,EAAY;AAChB;AAEO,SAAS,cAAc,GAAA,EAAuD;AACjF,EAAA,OAAO,EAAE,GAAG,cAAA,EAAgB,GAAI,GAAA,IAAO,EAAC,EAAG;AAC/C;AAEO,SAAS,cAAA,CAAe,KAA6B,QAAA,EAA2B;AACnF,EAAA,MAAM,OAAO,CAAA,EAAG,GAAA,CAAI,UAAU,CAAA,EAAG,IAAI,UAAU,CAAA,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AACtB,EAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,IAAI,CAAA;AACtB,EAAA,CAAA,CAAE,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AACxC,EAAA,OAAO,EAAE,QAAA,EAAS;AACtB;ACvDA,IAAM,cAAA,GAAuB,oBAAqC,IAAI,CAAA;AAgBtE,SAAS,iBAAiB,GAAA,EAA8C;AACpE,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,WAAA,IAAe,GAAA,CAAI,OAAA;AACvC,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,EAAA,IAAM,GAAA,CAAI,cAAc,GAAA,CAAI,SAAA;AAClD,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,SAAA,EAAW,OAAO,IAAA;AACnC,EAAA,OAAO;AAAA,IACH,SAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,EAAa,GAAA,CAAI,YAAA,IAAgB,GAAA,CAAI,WAAA,IAAe,IAAA;AAAA,IACpD,SAAA,EAAW,GAAA,CAAI,UAAA,IAAc,GAAA,CAAI,SAAA,IAAa;AAAA,GAClD;AACJ;AAgBO,SAAS,iBAAA,CAAkB;AAAA,EAC9B,QAAA;AAAA,EACA,MAAA;AAAA,EACA;AACJ,CAAA,EAA+C;AAC3C,EAAA,MAAM,GAAA,GAAY,cAAQ,MAAM,aAAA,CAAc,MAAM,CAAA,EAAG,CAAC,MAAM,CAAC,CAAA;AAC/D,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAU,eAA2B,IAAI,CAAA;AACnE,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAU,eAAmC,SAAS,CAAA;AAC9E,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAU,eAAuB,IAAI,CAAA;AAE3D,EAAA,MAAM,OAAA,GAAgB,kBAAY,YAAY;AAC1C,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACnC,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,CAAI,MAAA,EAAQ;AAAA,QAChC,MAAA,EAAQ,KAAA;AAAA,QACR,WAAA,EAAa,SAAA;AAAA,QACb,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,OACzC,CAAA;AACD,MAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,QAAA,UAAA,CAAW,IAAI,CAAA;AACf,QAAA,SAAA,CAAU,WAAW,CAAA;AACrB,QAAA,QAAA,CAAS,IAAI,CAAA;AACb,QAAA;AAAA,MACJ;AACA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,QAAA,SAAA,CAAU,OAAO,CAAA;AACjB,QAAA,QAAA,CAAS,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,GAAA,CAAI,MAAM,EAAE,CAAC,CAAA;AACxD,QAAA;AAAA,MACJ;AACA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,IAAA,CAAK,OAAO,CAAA;AAC1C,MAAA,UAAA,CAAW,IAAI,CAAA;AACf,MAAA,SAAA,CAAU,IAAA,GAAO,kBAAkB,WAAW,CAAA;AAC9C,MAAA,QAAA,CAAS,IAAI,CAAA;AAAA,IACjB,SAAS,GAAA,EAAK;AACV,MAAA,SAAA,CAAU,OAAO,CAAA;AACjB,MAAA,QAAA,CAAS,GAAA,YAAe,QAAQ,GAAA,GAAM,IAAI,MAAM,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,IAChE;AAAA,EACJ,CAAA,EAAG,CAAC,GAAA,CAAI,MAAM,CAAC,CAAA;AAEf,EAAM,gBAAU,MAAM;AAClB,IAAA,KAAK,OAAA,EAAQ;AAAA,EACjB,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AAEZ,EAAA,MAAM,OAAA,GAAgB,kBAAY,YAAY;AAC1C,IAAA,IAAI;AACA,MAAA,MAAM,MAAM,CAAA,EAAG,GAAA,CAAI,UAAU,CAAA,EAAG,GAAA,CAAI,UAAU,CAAA,CAAA,EAAI;AAAA,QAC9C,MAAA,EAAQ,MAAA;AAAA,QACR,WAAA,EAAa;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,CAAA,MAAQ;AAAA,IAGR;AACA,IAAA,UAAA,CAAW,IAAI,CAAA;AACf,IAAA,SAAA,CAAU,WAAW,CAAA;AAAA,EACzB,GAAG,CAAC,GAAA,CAAI,UAAA,EAAY,GAAA,CAAI,UAAU,CAAC,CAAA;AAEnC,EAAA,MAAM,KAAA,GAAc,cAAwB,MAAM;AAC9C,IAAA,MAAM,WACF,eAAA,KAAoB,OAAO,WAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,MAAA,CAAA;AAC/E,IAAA,OAAO;AAAA,MACH,MAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,OAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,cAAA,CAAe,GAAA,EAAK,QAAQ;AAAA,KAC3C;AAAA,EACJ,CAAA,EAAG,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAO,OAAA,EAAS,OAAA,EAAS,GAAA,EAAK,eAAe,CAAC,CAAA;AAEnE,EAAA,uBAAO,GAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,OAAe,QAAA,EAAS,CAAA;AAC5D;AAMO,SAAS,YAAA,GAA+B;AAC3C,EAAA,MAAM,GAAA,GAAY,iBAAW,cAAc,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACN;AAAA,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,GAAA;AACX;AAOO,SAAS,oBAAA,GAA8C;AAC1D,EAAA,OAAa,iBAAW,cAAc,CAAA;AAC1C;ACjJA,SAAS,eAAe,IAAA,EAAsB;AAC1C,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,EAAA,EAAI,OAAO,IAAA;AAC9B,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,MAAA,EAAI,IAAA,CAAK,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAChD;AAmBO,SAAS,cAAA,CAAe;AAAA,EAC3B,KAAA,GAAQ,sBAAA;AAAA,EACR,KAAA,GAAQ,KAAA;AAAA,EACR,SAAA;AAAA,EACA,GAAG;AACP,CAAA,EAAmD;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAU,GAAI,YAAA,EAAa;AAC3C,EAAA,IAAI,MAAA,KAAW,iBAAiB,OAAO,IAAA;AACvC,EAAA,IAAI,CAAC,KAAA,IAAS,MAAA,KAAW,SAAA,EAAW,OAAO,IAAA;AAE3C,EAAA,uBACIA,GAAAA;AAAA,IAAC,GAAA;AAAA,IAAA;AAAA,MACI,GAAG,IAAA;AAAA,MACJ,IAAA,EAAM,SAAA;AAAA,MACN,SAAA;AAAA,MACA,wBAAA,EAAuB,EAAA;AAAA,MAEtB,QAAA,EAAA;AAAA;AAAA,GACL;AAER;AAeO,SAAS,aAAA,CAAc;AAAA,EAC1B,YAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,GAAG;AACP,CAAA,EAAkD;AAC9C,EAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAS,OAAA,KAAY,YAAA,EAAa;AAElD,EAAA,IAAI,MAAA,KAAW,eAAA,IAAmB,CAAC,OAAA,EAAS,OAAO,IAAA;AAEnD,EAAA,MAAM,QAAQ,MAAA,GACR,MAAA,CAAO,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAS,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAa,CAAA,GACpE,OAAA,CAAQ,WAAA,IAAe,cAAA,CAAe,QAAQ,OAAO,CAAA;AAE5D,EAAA,uBACI,IAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACI,GAAG,IAAA;AAAA,MACJ,SAAA;AAAA,MACA,sBAAA,EAAqB,EAAA;AAAA,MACrB,KAAA,EAAO,EAAE,OAAA,EAAS,aAAA,EAAe,UAAA,EAAY,QAAA,EAAU,GAAA,EAAK,QAAA,EAAU,GAAI,IAAA,CAAK,KAAA,IAAS,EAAC,EAAG;AAAA,MAE3F,QAAA,EAAA;AAAA,QAAA,YAAA,mBACGA,GAAAA,CAAC,GAAA,EAAA,EAAE,IAAA,EAAM,YAAA,EAAe,iBAAM,CAAA,mBAE9BA,GAAAA,CAAC,MAAA,EAAA,EAAM,QAAA,EAAA,KAAA,EAAM,CAAA;AAAA,wBAEjBA,GAAAA;AAAA,UAAC,QAAA;AAAA,UAAA;AAAA,YACG,IAAA,EAAK,QAAA;AAAA,YACL,SAAS,MAAM;AACX,cAAA,KAAK,OAAA,EAAQ;AAAA,YACjB,CAAA;AAAA,YACA,YAAA,EAAW,UAAA;AAAA,YACX,KAAA,EAAO;AAAA,cACH,UAAA,EAAY,MAAA;AAAA,cACZ,MAAA,EAAQ,MAAA;AAAA,cACR,MAAA,EAAQ,SAAA;AAAA,cACR,KAAA,EAAO,SAAA;AAAA,cACP,IAAA,EAAM,SAAA;AAAA,cACN,OAAA,EAAS;AAAA,aACb;AAAA,YACH,QAAA,EAAA;AAAA;AAAA;AAED;AAAA;AAAA,GACJ;AAER","file":"index.mjs","sourcesContent":["export interface OcAccount {\n    accountId: string;\n    address: string;\n    displayName?: string | null;\n    nostrNpub?: string | null;\n}\n\nexport type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';\n\nexport interface OcSessionState {\n    status: OcSessionStatus;\n    account: OcAccount | null;\n    /** `null` while loading; an `Error` instance when `status === 'error'`. */\n    error: Error | null;\n    /** Re-fetch the session. Useful after sign-in/sign-out happens elsewhere. */\n    refresh: () => Promise<void>;\n    /** Trigger a sign-out. Resolves once the cookie has been cleared. */\n    signOut: () => Promise<void>;\n    /** URL to navigate to for sign-in on the auth host. */\n    signInUrl: string;\n}\n\nexport interface OcAuthConfig {\n    /**\n     * Origin of the auth host — the subdomain that runs the sign-in UI,\n     * issues session cookies, and exposes `/api/auth/me` + `/api/auth/logout`.\n     *\n     * Defaults to `https://ochk.io`. Override in preview/dev.\n     */\n    authOrigin?: string;\n    /**\n     * Path on the auth host that accepts `?return_to=<url>` and drives the\n     * BIP-322 sign-in flow. Defaults to `/signin`.\n     */\n    signInPath?: string;\n    /**\n     * Local path (same origin as the current app) that exposes the\n     * crypto-verified session. If your app ships one at `/api/auth/me`,\n     * leave as default. Returns 200 `{ account }` or 401.\n     */\n    mePath?: string;\n    /**\n     * Path on the auth host to hit to clear the session cookie.\n     * Defaults to `/api/auth/logout`. Called with `credentials: 'include'`\n     * so the `.ochk.io` cookie is sent along.\n     */\n    logoutPath?: string;\n}\n\nexport const DEFAULT_CONFIG: Required<OcAuthConfig> = {\n    authOrigin: 'https://ochk.io',\n    signInPath: '/signin',\n    mePath: '/api/auth/me',\n    logoutPath: '/api/auth/logout',\n};\n\nexport function resolveConfig(cfg: OcAuthConfig | undefined): Required<OcAuthConfig> {\n    return { ...DEFAULT_CONFIG, ...(cfg ?? {}) };\n}\n\nexport function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string {\n    const base = `${cfg.authOrigin}${cfg.signInPath}`;\n    if (!returnTo) return base;\n    const u = new URL(base);\n    u.searchParams.set('return_to', returnTo);\n    return u.toString();\n}\n","import * as React from 'react';\n\nimport {\n    buildSignInUrl,\n    DEFAULT_CONFIG,\n    resolveConfig,\n    type OcAccount,\n    type OcAuthConfig,\n    type OcSessionState,\n} from './types';\n\nconst SessionContext = React.createContext<OcSessionState | null>(null);\n\ninterface MeResponse {\n    account?: {\n        id?: string;\n        account_id?: string;\n        accountId?: string;\n        btc_address?: string;\n        address?: string;\n        display_name?: string | null;\n        displayName?: string | null;\n        nostr_npub?: string | null;\n        nostrNpub?: string | null;\n    };\n}\n\nfunction normalizeAccount(raw: MeResponse['account']): OcAccount | null {\n    if (!raw) return null;\n    const address = raw.btc_address ?? raw.address;\n    const accountId = raw.id ?? raw.account_id ?? raw.accountId;\n    if (!address || !accountId) return null;\n    return {\n        accountId,\n        address,\n        displayName: raw.display_name ?? raw.displayName ?? null,\n        nostrNpub: raw.nostr_npub ?? raw.nostrNpub ?? null,\n    };\n}\n\nexport interface OcSessionProviderProps {\n    children: React.ReactNode;\n    config?: OcAuthConfig;\n    /**\n     * Optional return URL passed to the sign-in page. Defaults to the\n     * current `window.location.href` at click-time.\n     */\n    defaultReturnTo?: string;\n}\n\n/**\n * Top-level provider that exposes the cross-subdomain oc_session to every\n * component below it. Mount once, near the root of your tree.\n */\nexport function OcSessionProvider({\n    children,\n    config,\n    defaultReturnTo,\n}: OcSessionProviderProps): React.ReactElement {\n    const cfg = React.useMemo(() => resolveConfig(config), [config]);\n    const [account, setAccount] = React.useState<OcAccount | null>(null);\n    const [status, setStatus] = React.useState<OcSessionState['status']>('loading');\n    const [error, setError] = React.useState<Error | null>(null);\n\n    const refresh = React.useCallback(async () => {\n        if (typeof window === 'undefined') return;\n        try {\n            const res = await fetch(cfg.mePath, {\n                method: 'GET',\n                credentials: 'include',\n                headers: { Accept: 'application/json' },\n            });\n            if (res.status === 401) {\n                setAccount(null);\n                setStatus('anonymous');\n                setError(null);\n                return;\n            }\n            if (!res.ok) {\n                setStatus('error');\n                setError(new Error(`me endpoint returned ${res.status}`));\n                return;\n            }\n            const body = (await res.json()) as MeResponse;\n            const acct = normalizeAccount(body.account);\n            setAccount(acct);\n            setStatus(acct ? 'authenticated' : 'anonymous');\n            setError(null);\n        } catch (err) {\n            setStatus('error');\n            setError(err instanceof Error ? err : new Error(String(err)));\n        }\n    }, [cfg.mePath]);\n\n    React.useEffect(() => {\n        void refresh();\n    }, [refresh]);\n\n    const signOut = React.useCallback(async () => {\n        try {\n            await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {\n                method: 'POST',\n                credentials: 'include',\n            });\n        } catch {\n            // fall through — we still clear local state so the UI reflects\n            // the user's intent even if the server round-trip fails.\n        }\n        setAccount(null);\n        setStatus('anonymous');\n    }, [cfg.authOrigin, cfg.logoutPath]);\n\n    const value = React.useMemo<OcSessionState>(() => {\n        const returnTo =\n            defaultReturnTo ?? (typeof window !== 'undefined' ? window.location.href : undefined);\n        return {\n            status,\n            account,\n            error,\n            refresh,\n            signOut,\n            signInUrl: buildSignInUrl(cfg, returnTo),\n        };\n    }, [status, account, error, refresh, signOut, cfg, defaultReturnTo]);\n\n    return <SessionContext.Provider value={value}>{children}</SessionContext.Provider>;\n}\n\n/**\n * Access the current cross-subdomain oc_session. Must be called inside\n * an `<OcSessionProvider>`.\n */\nexport function useOcSession(): OcSessionState {\n    const ctx = React.useContext(SessionContext);\n    if (!ctx) {\n        throw new Error(\n            '[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>'\n        );\n    }\n    return ctx;\n}\n\n/**\n * Non-throwing variant — returns `null` if called outside a provider.\n * Useful for libraries that want to read the session *if it exists* but\n * shouldn't crash on apps that haven't opted in.\n */\nexport function useOptionalOcSession(): OcSessionState | null {\n    return React.useContext(SessionContext);\n}\n\nexport { DEFAULT_CONFIG };\n","import * as React from 'react';\n\nimport { useOcSession } from './provider';\n\nfunction shortenAddress(addr: string): string {\n    if (addr.length <= 12) return addr;\n    return `${addr.slice(0, 6)}…${addr.slice(-4)}`;\n}\n\nexport interface OcSignInButtonProps extends React.AnchorHTMLAttributes<HTMLAnchorElement> {\n    /** Label shown when no user is signed in. Defaults to `sign in with bitcoin`. */\n    label?: string;\n    /**\n     * When `true`, render an `<a>` even while the session is loading, to\n     * avoid layout shift. Defaults to `false` (renders nothing while loading).\n     */\n    eager?: boolean;\n}\n\n/**\n * Drop-in sign-in button. Renders an anchor that deep-links to the auth\n * host's sign-in page with the current URL as `?return_to=…`.\n *\n * When the user is already authenticated it renders nothing — wrap it in\n * a conditional or use `<OcAccountPill>` as the signed-in affordance.\n */\nexport function OcSignInButton({\n    label = 'sign in with bitcoin',\n    eager = false,\n    className,\n    ...rest\n}: OcSignInButtonProps): React.ReactElement | null {\n    const { status, signInUrl } = useOcSession();\n    if (status === 'authenticated') return null;\n    if (!eager && status === 'loading') return null;\n\n    return (\n        <a\n            {...rest}\n            href={signInUrl}\n            className={className}\n            data-oc-sign-in-button=\"\"\n        >\n            {label}\n        </a>\n    );\n}\n\nexport interface OcAccountPillProps extends React.HTMLAttributes<HTMLDivElement> {\n    /** URL to link the address to. Defaults to the auth origin's `/dashboard`. */\n    dashboardUrl?: string;\n    /** Override the display text. Defaults to the shortened address. */\n    render?: (account: { address: string; displayName?: string | null }) => React.ReactNode;\n}\n\n/**\n * Shows the signed-in user as a short pill: `bc1q…abcd  sign out`.\n *\n * Renders nothing while loading or when no user is signed in — pair with\n * `<OcSignInButton>` for the anonymous case.\n */\nexport function OcAccountPill({\n    dashboardUrl,\n    render,\n    className,\n    ...rest\n}: OcAccountPillProps): React.ReactElement | null {\n    const { status, account, signOut } = useOcSession();\n\n    if (status !== 'authenticated' || !account) return null;\n\n    const label = render\n        ? render({ address: account.address, displayName: account.displayName })\n        : (account.displayName ?? shortenAddress(account.address));\n\n    return (\n        <div\n            {...rest}\n            className={className}\n            data-oc-account-pill=\"\"\n            style={{ display: 'inline-flex', alignItems: 'center', gap: '0.5rem', ...(rest.style ?? {}) }}\n        >\n            {dashboardUrl ? (\n                <a href={dashboardUrl}>{label}</a>\n            ) : (\n                <span>{label}</span>\n            )}\n            <button\n                type=\"button\"\n                onClick={() => {\n                    void signOut();\n                }}\n                aria-label=\"Sign out\"\n                style={{\n                    background: 'none',\n                    border: 'none',\n                    cursor: 'pointer',\n                    color: 'inherit',\n                    font: 'inherit',\n                    padding: 0,\n                }}\n            >\n                sign out\n            </button>\n        </div>\n    );\n}\n"]}

package/package.json

@@ -0,0 +1,65 @@
+{
+    "name": "@orangecheck/auth-client",
+    "version": "0.1.0",
+    "description": "React hooks and components for the cross-subdomain oc_session. Drop-in sign-in button, account pill, and useOcSession() hook.",
+    "keywords": [
+        "orangecheck",
+        "bitcoin",
+        "auth",
+        "react",
+        "sso",
+        "ed25519"
+    ],
+    "author": "OrangeCheck",
+    "license": "MIT",
+    "homepage": "https://ochk.io",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/orangecheck/oc-packages.git",
+        "directory": "auth-client"
+    },
+    "bugs": {
+        "url": "https://github.com/orangecheck/oc-packages/issues"
+    },
+    "main": "./dist/index.js",
+    "module": "./dist/index.mjs",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.mjs",
+            "require": "./dist/index.js"
+        }
+    },
+    "files": [
+        "dist",
+        "README.md",
+        "LICENSE"
+    ],
+    "scripts": {
+        "build": "tsup",
+        "dev": "tsup --watch",
+        "test": "vitest run",
+        "type-check": "tsc --noEmit",
+        "clean": "rm -rf dist",
+        "prepublishOnly": "npm run clean && npm run build"
+    },
+    "peerDependencies": {
+        "@orangecheck/auth-core": "^0.1.0",
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0"
+    },
+    "devDependencies": {
+        "@orangecheck/auth-core": "^0.1.0",
+        "@testing-library/react": "^16.3.2",
+        "@types/node": "^22.0.0",
+        "@types/react": "^18.3.12",
+        "@types/react-dom": "^18.3.1",
+        "jsdom": "^29.0.2",
+        "react": "^18.3.1",
+        "react-dom": "^18.3.1",
+        "tsup": "^8.3.5",
+        "typescript": "^5.6.3",
+        "vitest": "^3.0.0"
+    }
+}