@orangecheck/auth-client 2.16.0 → 2.17.1

package/dist/index.d.mts

@@ -19,12 +19,25 @@ interface OcAccount {
     displayIdentity: DisplayIdentity;
 }
 type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';
+interface OcAccountSummary {
+    didOc: string;
+    displayName: string | null;
+    primaryBtc: string | null;
+    displayIdentity: DisplayIdentity;
+    lastSeenAt: string | null;
+}
+type OcSignOutScope = 'all' | 'current';
 interface OcSessionState {
     status: OcSessionStatus;
     account: OcAccount | null;
+    roster: OcAccountSummary[];
     error: Error | null;
     refresh: () => Promise<void>;
-    signOut: () => Promise<void>;
+    signOut: (opts?: {
+        scope?: OcSignOutScope;
+    }) => Promise<void>;
+    switchAccount: (didOc: string) => Promise<void>;
+    addAccountUrl: (returnTo?: string) => string;
     setDisplayIdentity: (kind: DisplayIdentityKind) => Promise<void>;
     signInUrl: string;
 }
@@ -36,6 +49,7 @@ interface OcAuthConfig {
 }
 declare const DEFAULT_CONFIG: Required<OcAuthConfig>;
 declare function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
+declare function buildAddAccountUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
 
 interface OcSessionProviderProps {
     children: React.ReactNode;
@@ -115,9 +129,10 @@ interface OcSignInProps {
         email?: boolean;
     };
     linkPrompt?: boolean;
+    add?: boolean;
     className?: string;
 }
-declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
+declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, add: addProp, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
 
 interface OcLinkedIdentity {
     id: string;
@@ -219,4 +234,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.d.ts

@@ -19,12 +19,25 @@ interface OcAccount {
     displayIdentity: DisplayIdentity;
 }
 type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';
+interface OcAccountSummary {
+    didOc: string;
+    displayName: string | null;
+    primaryBtc: string | null;
+    displayIdentity: DisplayIdentity;
+    lastSeenAt: string | null;
+}
+type OcSignOutScope = 'all' | 'current';
 interface OcSessionState {
     status: OcSessionStatus;
     account: OcAccount | null;
+    roster: OcAccountSummary[];
     error: Error | null;
     refresh: () => Promise<void>;
-    signOut: () => Promise<void>;
+    signOut: (opts?: {
+        scope?: OcSignOutScope;
+    }) => Promise<void>;
+    switchAccount: (didOc: string) => Promise<void>;
+    addAccountUrl: (returnTo?: string) => string;
     setDisplayIdentity: (kind: DisplayIdentityKind) => Promise<void>;
     signInUrl: string;
 }
@@ -36,6 +49,7 @@ interface OcAuthConfig {
 }
 declare const DEFAULT_CONFIG: Required<OcAuthConfig>;
 declare function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
+declare function buildAddAccountUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
 
 interface OcSessionProviderProps {
     children: React.ReactNode;
@@ -115,9 +129,10 @@ interface OcSignInProps {
         email?: boolean;
     };
     linkPrompt?: boolean;
+    add?: boolean;
     className?: string;
 }
-declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
+declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, add: addProp, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
 
 interface OcLinkedIdentity {
     id: string;
@@ -219,4 +234,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.js

@@ -44,6 +44,11 @@ function buildSignInUrl(cfg, returnTo) {
   u.searchParams.set("return_to", returnTo);
   return u.toString();
 }
+function buildAddAccountUrl(cfg, returnTo) {
+  const u = new URL(buildSignInUrl(cfg, returnTo));
+  u.searchParams.set("add", "1");
+  return u.toString();
+}
 var SessionContext = React3__namespace.createContext(null);
 function normalizeDisplayIdentity(raw, didOc) {
   const di = raw.display_identity ?? raw.displayIdentity;
@@ -52,6 +57,19 @@ function normalizeDisplayIdentity(raw, didOc) {
   }
   return { kind: "did", value: didOc };
 }
+function normalizeRosterEntry(raw) {
+  const didOc = raw.did_oc ?? raw.didOc;
+  if (!didOc) return null;
+  const di = raw.display_identity ?? raw.displayIdentity;
+  const displayIdentity = di && typeof di === "object" && typeof di.value === "string" && di.value.length > 0 && typeof di.kind === "string" && DISPLAY_IDENTITY_KINDS.includes(di.kind) ? { kind: di.kind, value: di.value } : { kind: "did", value: didOc };
+  return {
+    didOc,
+    displayName: raw.display_name ?? raw.displayName ?? null,
+    primaryBtc: raw.primary_btc ?? raw.primaryBtc ?? null,
+    displayIdentity,
+    lastSeenAt: raw.last_seen_at ?? raw.lastSeenAt ?? null
+  };
+}
 function normalizeAccount(raw) {
   if (!raw) return null;
   const didOc = raw.did_oc ?? raw.didOc;
@@ -77,6 +95,7 @@ function OcSessionProvider({
 }) {
   const cfg = React3__namespace.useMemo(() => resolveConfig(config), [config]);
   const [account, setAccount] = React3__namespace.useState(null);
+  const [roster, setRoster] = React3__namespace.useState([]);
   const [status, setStatus] = React3__namespace.useState("loading");
   const [error, setError] = React3__namespace.useState(null);
   const refresh = React3__namespace.useCallback(async () => {
@@ -89,6 +108,7 @@ function OcSessionProvider({
       });
       if (res.status === 401) {
         setAccount(null);
+        setRoster([]);
         setStatus("anonymous");
         setError(null);
         return;
@@ -100,7 +120,9 @@ function OcSessionProvider({
       }
       const body = await res.json();
       const acct = normalizeAccount(body.account);
+      const rosterEntries = Array.isArray(body.roster) ? body.roster.map(normalizeRosterEntry).filter((r) => r !== null) : [];
       setAccount(acct);
+      setRoster(rosterEntries);
       setStatus(acct ? "authenticated" : "anonymous");
       setError(null);
     } catch (err) {
@@ -111,23 +133,63 @@ function OcSessionProvider({
   React3__namespace.useEffect(() => {
     void refresh();
   }, [refresh]);
-  const signOut = React3__namespace.useCallback(async () => {
-    try {
-      await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
+  const signOut = React3__namespace.useCallback(
+    async (opts) => {
+      const scope = opts?.scope ?? "all";
+      try {
+        const url = new URL(`${cfg.authOrigin}${cfg.logoutPath}`);
+        if (scope === "current") url.searchParams.set("scope", "current");
+        const res = await fetch(url.toString(), {
+          method: "POST",
+          credentials: "include",
+          // `keepalive` lets the logout round-trip complete even if
+          // the caller hard-navigates away in the same tick (e.g.
+          // `<OcAccountMenu>` redirects home immediately on sign-out).
+          // Without it the in-flight request is cancelled on unload
+          // and the `.ochk.io` cookie may never get cleared.
+          keepalive: true
+        });
+        if (scope === "current" && res.ok) {
+          await refresh();
+          return;
+        }
+      } catch {
+      }
+      setAccount(null);
+      setRoster([]);
+      setStatus("anonymous");
+    },
+    [cfg.authOrigin, cfg.logoutPath, refresh]
+  );
+  const switchAccount = React3__namespace.useCallback(
+    async (didOc) => {
+      if (typeof window === "undefined") return;
+      const res = await fetch(`${cfg.authOrigin}/api/auth/switch`, {
         method: "POST",
         credentials: "include",
-        // `keepalive` lets the logout round-trip complete even if
-        // the caller hard-navigates away in the same tick (e.g.
-        // `<OcAccountMenu>` redirects home immediately on sign-out).
-        // Without it the in-flight request is cancelled on unload
-        // and the `.ochk.io` cookie may never get cleared.
-        keepalive: true
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ did_oc: didOc })
       });
-    } catch {
-    }
-    setAccount(null);
-    setStatus("anonymous");
-  }, [cfg.authOrigin, cfg.logoutPath]);
+      if (!res.ok) {
+        let reason = `http_${res.status}`;
+        try {
+          const body = await res.json();
+          if (body.reason) reason = body.reason;
+        } catch {
+        }
+        throw new Error(`[@orangecheck/auth-client] switchAccount failed: ${reason}`);
+      }
+      await refresh();
+    },
+    [cfg.authOrigin, refresh]
+  );
+  const addAccountUrl = React3__namespace.useCallback(
+    (returnTo) => {
+      const rt = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
+      return buildAddAccountUrl(cfg, rt);
+    },
+    [cfg]
+  );
   const setDisplayIdentity = React3__namespace.useCallback(
     async (kind) => {
       if (typeof window === "undefined") return;
@@ -155,13 +217,28 @@ function OcSessionProvider({
     return {
       status,
       account,
+      roster,
       error,
       refresh,
       signOut,
+      switchAccount,
+      addAccountUrl,
       setDisplayIdentity,
       signInUrl: buildSignInUrl(cfg, returnTo)
     };
-  }, [status, account, error, refresh, signOut, setDisplayIdentity, cfg, defaultReturnTo]);
+  }, [
+    status,
+    account,
+    roster,
+    error,
+    refresh,
+    signOut,
+    switchAccount,
+    addAccountUrl,
+    setDisplayIdentity,
+    cfg,
+    defaultReturnTo
+  ]);
   return /* @__PURE__ */ jsxRuntime.jsx(SessionContext.Provider, { value, children });
 }
 function useOcSession() {
@@ -1688,6 +1765,7 @@ function OcSignIn({
   onSuccess,
   resolveReturnTo,
   linkPrompt = true,
+  add: addProp,
   authOrigin = "https://ochk.io",
   initialPath = "wallet",
   paths,
@@ -1696,6 +1774,15 @@ function OcSignIn({
   const walletEnabled = paths?.wallet ?? true;
   const emailEnabled = paths?.email ?? true;
   const safeReturn = safeReturnTo(returnTo);
+  const [addMode, setAddMode] = React3__namespace.useState(Boolean(addProp));
+  React3__namespace.useEffect(() => {
+    if (typeof window === "undefined") return;
+    if (addProp !== void 0) {
+      setAddMode(Boolean(addProp));
+      return;
+    }
+    setAddMode(new URLSearchParams(window.location.search).get("add") === "1");
+  }, [addProp]);
   const [path, setPath] = React3__namespace.useState(initialPath);
   const [signedIn, setSignedIn] = React3__namespace.useState(null);
   const [linkAlso, setLinkAlso] = React3__namespace.useState(false);
@@ -1807,6 +1894,41 @@ function OcSignIn({
         children: "That sign-in didn't complete. Please try again."
       }
     ),
+    addMode && /* @__PURE__ */ jsxRuntime.jsxs(
+      "div",
+      {
+        "data-oc-signin-add-mode": "",
+        style: {
+          marginBottom: 14,
+          padding: "0.6rem 0.75rem",
+          border: "1px solid var(--primary, #f97316)",
+          borderLeftWidth: 3,
+          borderRadius: 4,
+          background: "color-mix(in srgb, var(--primary, #f97316) 8%, transparent)",
+          color: "var(--foreground, #fafafa)",
+          fontFamily: "ui-monospace, SFMono-Regular, monospace",
+          fontSize: 11,
+          lineHeight: 1.6
+        },
+        children: [
+          /* @__PURE__ */ jsxRuntime.jsx(
+            "strong",
+            {
+              style: {
+                color: "var(--primary, #f97316)",
+                letterSpacing: "0.12em",
+                textTransform: "uppercase",
+                fontSize: 10,
+                display: "block",
+                marginBottom: 3
+              },
+              children: "\xA7 adding another account"
+            }
+          ),
+          "Your current OrangeCheck account stays signed in. The new account joins your browser's roster; you can switch between them anytime from the account menu."
+        ]
+      }
+    ),
     bothEnabled && /* @__PURE__ */ jsxRuntime.jsxs(
       "div",
       {
@@ -1838,6 +1960,7 @@ function OcSignIn({
         {
           authOrigin,
           audience,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "wallet")
         }
       ),
@@ -1845,6 +1968,7 @@ function OcSignIn({
         EmailFlow,
         {
           authOrigin,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "email")
         }
       )
@@ -1992,7 +2116,7 @@ function ProviderSignIn({
     ))
   ] });
 }
-function WalletFlow({ authOrigin, audience, onSuccess }) {
+function WalletFlow({ authOrigin, audience, add, onSuccess }) {
   const [address, setAddress] = React3__namespace.useState("");
   const [error, setError] = React3__namespace.useState(null);
   const [submitting, setSubmitting] = React3__namespace.useState(false);
@@ -2040,7 +2164,12 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
           scheme: "bip322",
           expectedNonce: challenge.nonce,
           expectedAudience: audience,
-          expectedPurpose: "login"
+          expectedPurpose: "login",
+          // Multi-account add-mode · the auth host preserves
+          // the current roster_id when set, instead of minting
+          // a fresh one. Hosts that haven't deployed the
+          // multi-account migration silently ignore the field.
+          ...add ? { add: true } : {}
         })
       });
       const json = await res.json();
@@ -2091,7 +2220,7 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
     /* @__PURE__ */ jsxRuntime.jsx(Hint, { children: "Detection picks the first installed BIP-322-capable extension. Address is the one your wallet will sign for." })
   ] });
 }
-function EmailFlow({ authOrigin, onSuccess }) {
+function EmailFlow({ authOrigin, add, onSuccess }) {
   const [stage, setStage] = React3__namespace.useState("enter");
   const [email, setEmail] = React3__namespace.useState("");
   const [emailError, setEmailError] = React3__namespace.useState(null);
@@ -2142,7 +2271,13 @@ function EmailFlow({ authOrigin, onSuccess }) {
         method: "POST",
         credentials: "include",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, code, token })
+        body: JSON.stringify({
+          email,
+          code,
+          token,
+          // Multi-account add-mode · see WalletFlow.
+          ...add ? { add: true } : {}
+        })
       });
       const json = await res.json();
       if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
@@ -2643,6 +2778,7 @@ exports.OcLinkedIdentities = OcLinkedIdentities;
 exports.OcSessionProvider = OcSessionProvider;
 exports.OcSignIn = OcSignIn;
 exports.OcSignInButton = OcSignInButton;
+exports.buildAddAccountUrl = buildAddAccountUrl;
 exports.buildSignInUrl = buildSignInUrl;
 exports.fetchOcLinkedIdentities = fetchOcLinkedIdentities;
 exports.handleSudoRequired = handleSudoRequired;