@orangecheck/auth-client 2.7.0 → 2.9.0

package/dist/index.d.mts

@@ -125,12 +125,6 @@ interface OcLinkedIdentitiesProps {
     onChange?: () => void;
 }
 declare function OcLinkedIdentities({ authOrigin, className, onChange, }: OcLinkedIdentitiesProps): React.ReactElement;
-interface OcIdentityBondProps {
-    didOc: string;
-    btc: string;
-    className?: string;
-}
-declare function OcIdentityBond({ didOc, btc, className, }: OcIdentityBondProps): React.ReactElement;
 
 interface WebAuthnCredentialPublic {
     id: string;
@@ -214,4 +208,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcIdentityBond, type OcIdentityBondProps, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.d.ts

@@ -125,12 +125,6 @@ interface OcLinkedIdentitiesProps {
     onChange?: () => void;
 }
 declare function OcLinkedIdentities({ authOrigin, className, onChange, }: OcLinkedIdentitiesProps): React.ReactElement;
-interface OcIdentityBondProps {
-    didOc: string;
-    btc: string;
-    className?: string;
-}
-declare function OcIdentityBond({ didOc, btc, className, }: OcIdentityBondProps): React.ReactElement;
 
 interface WebAuthnCredentialPublic {
     id: string;
@@ -214,4 +208,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcIdentityBond, type OcIdentityBondProps, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.js

@@ -890,7 +890,7 @@ function OcLinkedIdentities({
         onCancel: () => setShowBtcLink(false)
       }
     ),
-    hasBtc && resp.did_oc && /* @__PURE__ */ jsxRuntime.jsx(OcIdentityBond, { didOc: resp.did_oc, btc: btcRows.find((i) => !!i.value).value })
+    hasBtc && /* @__PURE__ */ jsxRuntime.jsx(AttestationLink, {})
   ] });
 }
 function IdentityGroup({
@@ -1069,6 +1069,65 @@ function ConsolidationPanel({ entries }) {
     )) })
   ] });
 }
+function AttestationLink() {
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle(), "data-oc-li-attest": "", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 portable attestation" }),
+    /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: "Make your identity links portable: publish a standard OrangeCheck attestation \u2014 one Bitcoin-wallet signature (BIP-322) binding your address to your handles (Nostr, GitHub, \u2026). It is published to Nostr and verifies with zero trust in OrangeCheck, so it outlives any single service." }),
+    /* @__PURE__ */ jsxRuntime.jsx(
+      "a",
+      {
+        href: "https://attest.ochk.io/create",
+        target: "_blank",
+        rel: "noreferrer",
+        style: { ...primaryChipStyle, textDecoration: "none", display: "inline-block" },
+        "data-oc-li-attest-link": "",
+        children: "open the attestation builder \u2197"
+      }
+    )
+  ] });
+}
+function LinkPromptStep({
+  method,
+  didOc,
+  authOrigin,
+  onResolved
+}) {
+  const [stage, setStage] = React3__namespace.useState("offer");
+  if (stage === "linking") {
+    return method === "btc" ? /* @__PURE__ */ jsxRuntime.jsx(
+      BtcLinkForm,
+      {
+        authOrigin,
+        didOc,
+        onDone: onResolved,
+        onCancel: () => setStage("offer")
+      }
+    ) : /* @__PURE__ */ jsxRuntime.jsx(
+      EmailLinkForm,
+      {
+        authOrigin,
+        onDone: onResolved,
+        onCancel: () => setStage("offer")
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs("div", { style: panelStyle("accent"), "data-oc-linkprompt": method, children: [
+    /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { tone: "success", children: "\xA7 signed in" }),
+    /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: method === "btc" ? "You're in. Link a Bitcoin address now \u2014 a second way to sign in, and it unlocks your on-chain footprint. You prove it with one wallet signature, right here \u2014 no separate trip to your account page." : "You're in. Add your email now \u2014 a backup way to sign in if you ever lose your wallet. You prove it with a one-time code, right here \u2014 no separate trip to your account page." }),
+    /* @__PURE__ */ jsxRuntime.jsxs(FormButtons, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => setStage("linking"),
+          style: primaryBtnStyle(false),
+          children: method === "btc" ? "link a Bitcoin address" : "link an email"
+        }
+      ),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", onClick: onResolved, style: ghostBtnStyle(false), children: "skip" })
+    ] })
+  ] });
+}
 function EmailLinkForm({
   authOrigin,
   onDone,
@@ -1375,185 +1434,6 @@ function TransferConfirm({
     ] })
   ] });
 }
-function OcIdentityBond({
-  didOc,
-  btc,
-  className
-}) {
-  const [stage, setStage] = React3__namespace.useState("idle");
-  const [message, setMessage] = React3__namespace.useState("");
-  const [err, setErr] = React3__namespace.useState(null);
-  const [result, setResult] = React3__namespace.useState(null);
-  function nip07() {
-    if (typeof window === "undefined") return null;
-    const w = window;
-    return w.nostr ?? null;
-  }
-  async function begin() {
-    setErr(null);
-    const nostr = nip07();
-    if (!nostr) {
-      setErr(
-        "no Nostr signer found \xB7 install a NIP-07 extension (Alby, nos2x) to counter-sign the bond"
-      );
-      return;
-    }
-    try {
-      const sdk = await loadSdk();
-      const pubkeyHex = (await nostr.getPublicKey()).toLowerCase();
-      const npub = sdk.xOnlyHexToNpub(pubkeyHex);
-      const msg = sdk.buildBindingMessage({
-        principal: didOc,
-        btc,
-        nostr: npub,
-        nonce: randomNonceHex(),
-        issued_at: (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z")
-      });
-      setMessage(msg);
-      setStage("sign-btc");
-    } catch (e) {
-      setErr(e instanceof Error ? e.message : "could not start the bond ceremony");
-    }
-  }
-  async function afterBtcSign(btcSignature) {
-    setErr(null);
-    setStage("sign-nostr");
-    try {
-      const nostr = nip07();
-      if (!nostr) throw new Error("Nostr extension went away \xB7 retry");
-      const sdk = await loadSdk();
-      const pubkeyHex = (await nostr.getPublicKey()).toLowerCase();
-      const template = sdk.buildBindingEventTemplate({
-        message,
-        btcSignature,
-        nostrPubkeyHex: pubkeyHex,
-        btc
-      });
-      const signedEvent = await nostr.signEvent(template);
-      const envelope = sdk.assembleBindingEnvelope({
-        message,
-        btcSignature,
-        btcScheme: "bip322",
-        nostrEvent: signedEvent
-      });
-      const check = sdk.verifyBinding(envelope);
-      if (!check.valid) {
-        throw new Error(`assembled bond failed local verification (${check.status})`);
-      }
-      setStage("publishing");
-      const { publishEvent } = await loadNostrCore();
-      const results = await publishEvent(signedEvent);
-      const ok = results.filter((r) => r.ok).length;
-      if (ok === 0) {
-        throw new Error("no relay accepted the bond \xB7 check your connection and retry");
-      }
-      setResult({
-        bindingId: check.valid ? check.binding_id : sdk.bindingId(message),
-        relays: ok,
-        relaysTotal: results.length
-      });
-      setStage("done");
-    } catch (e) {
-      setErr(e instanceof Error ? e.message : "bond publish failed");
-      setStage("sign-btc");
-    }
-  }
-  return /* @__PURE__ */ jsxRuntime.jsxs("div", { className, style: panelStyle("accent"), "data-oc-identity-bond": "", children: [
-    /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { children: "\xA7 identity bond \xB7 publish to nostr" }),
-    stage === "idle" && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
-      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
-        "Publish a ",
-        /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Binding Attestation" }),
-        " \u2014 a Bitcoin-signed, Nostr-signed proof that this address and your Nostr key are one identity. It lives on Nostr, verifies with zero trust in OrangeCheck, and means your identity survives even if OC's database does not. Two signatures: your Bitcoin wallet, then your Nostr extension."
-      ] }),
-      /* @__PURE__ */ jsxRuntime.jsx(FormButtons, { children: /* @__PURE__ */ jsxRuntime.jsx(
-        "button",
-        {
-          type: "button",
-          onClick: () => void begin(),
-          style: primaryBtnStyle(false),
-          children: "create & publish bond"
-        }
-      ) })
-    ] }),
-    stage === "sign-btc" && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
-      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
-        "Step 1 of 2 \u2014 sign the binding message with the Bitcoin wallet that controls ",
-        /* @__PURE__ */ jsxRuntime.jsx("span", { style: { fontFamily: MONO, wordBreak: "break-all" }, children: btc }),
-        "."
-      ] }),
-      /* @__PURE__ */ jsxRuntime.jsx(
-        LazyWalletButton,
-        {
-          address: btc,
-          message,
-          showManual: true,
-          layout: "list",
-          heading: null,
-          onSigned: (sig) => void afterBtcSign(sig),
-          onError: (e) => setErr(e?.message ?? "wallet rejected the signature")
-        }
-      )
-    ] }),
-    (stage === "sign-nostr" || stage === "publishing") && /* @__PURE__ */ jsxRuntime.jsx("p", { style: bodyStyle, children: stage === "sign-nostr" ? "Step 2 of 2 \u2014 approve the signature in your Nostr extension\u2026" : "Publishing the bond to Nostr\u2026" }),
-    stage === "done" && result && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
-      /* @__PURE__ */ jsxRuntime.jsx(SectionLabel, { tone: "success", children: "\xA7 bond published" }),
-      /* @__PURE__ */ jsxRuntime.jsxs("p", { style: bodyStyle, children: [
-        "Your identity bond is live on ",
-        result.relays,
-        "/",
-        result.relaysTotal,
-        " ",
-        "relay",
-        result.relays === 1 ? "" : "s",
-        ". Anyone can now verify the BTC \u21C4 Nostr binding offline."
-      ] }),
-      /* @__PURE__ */ jsxRuntime.jsxs(
-        "div",
-        {
-          style: {
-            fontFamily: MONO,
-            fontSize: 11,
-            color: V.muted,
-            wordBreak: "break-all"
-          },
-          children: [
-            "binding_id: ",
-            result.bindingId
-          ]
-        }
-      )
-    ] }),
-    err && /* @__PURE__ */ jsxRuntime.jsx(ErrorLine, { children: err })
-  ] });
-}
-function randomNonceHex() {
-  const b = new Uint8Array(16);
-  if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-    crypto.getRandomValues(b);
-  } else {
-    for (let i = 0; i < 16; i++) b[i] = Math.floor(Math.random() * 256);
-  }
-  let out = "";
-  for (const x of b) out += x.toString(16).padStart(2, "0");
-  return out;
-}
-async function loadSdk() {
-  try {
-    return await import('@orangecheck/sdk');
-  } catch {
-    throw new Error("@orangecheck/sdk not installed \xB7 add it to your site to publish bonds");
-  }
-}
-async function loadNostrCore() {
-  try {
-    return await import('@orangecheck/nostr-core');
-  } catch {
-    throw new Error(
-      "@orangecheck/nostr-core not installed \xB7 add it to your site to publish bonds"
-    );
-  }
-}
 function LazyWalletButton(props) {
   const [Comp, setComp] = React3__namespace.useState(null);
   const [failed, setFailed] = React3__namespace.useState(false);
@@ -1756,7 +1636,7 @@ function OcSignIn({
   returnTo,
   onSuccess,
   resolveReturnTo,
-  linkPrompt,
+  linkPrompt = true,
   authOrigin = "https://ochk.io",
   initialPath = "wallet",
   paths,
@@ -1781,18 +1661,34 @@ function OcSignIn({
     [resolveReturnTo, safeReturn]
   );
   const handleSuccess = React3__namespace.useCallback(
-    async (account, token) => {
-      if (onSuccess) {
-        onSuccess(account, token);
+    async (account, token, via) => {
+      const proceed = () => {
+        if (onSuccess) onSuccess(account, token);
+        else void navigate(account);
+      };
+      if (!linkPrompt) {
+        proceed();
         return;
       }
-      if (linkPrompt) {
-        setSignedIn(account);
-        return;
+      try {
+        const meRes = await fetch(`${authOrigin}/api/auth/me`, {
+          credentials: "include",
+          headers: { Accept: "application/json" }
+        });
+        const me = meRes.ok ? await meRes.json() : null;
+        const acct = me?.account;
+        const didOc = acct?.did_oc;
+        const complementary = via === "email" ? "btc" : "email";
+        const alreadyLinked = complementary === "btc" ? Boolean(acct?.primary_btc) : Boolean(acct?.has_email);
+        if (didOc && !alreadyLinked) {
+          setSignedIn({ method: complementary, didOc, proceed });
+          return;
+        }
+      } catch {
       }
-      await navigate(account);
+      proceed();
     },
-    [onSuccess, linkPrompt, navigate]
+    [onSuccess, linkPrompt, navigate, authOrigin]
   );
   if (!walletEnabled && !emailEnabled) {
     return /* @__PURE__ */ jsxRuntime.jsxs(
@@ -1823,8 +1719,10 @@ function OcSignIn({
     return /* @__PURE__ */ jsxRuntime.jsx("div", { className, "data-oc-signin": "", children: /* @__PURE__ */ jsxRuntime.jsx(
       LinkPromptStep,
       {
+        method: signedIn.method,
+        didOc: signedIn.didOc,
         authOrigin,
-        onContinue: () => void navigate(signedIn)
+        onResolved: signedIn.proceed
       }
     ) });
   }
@@ -1863,32 +1761,19 @@ function OcSignIn({
         {
           authOrigin,
           audience,
-          onSuccess: handleSuccess
+          onSuccess: (a, t) => void handleSuccess(a, t, "wallet")
         }
       ),
-      showEmail && /* @__PURE__ */ jsxRuntime.jsx(EmailFlow, { authOrigin, onSuccess: handleSuccess })
+      showEmail && /* @__PURE__ */ jsxRuntime.jsx(
+        EmailFlow,
+        {
+          authOrigin,
+          onSuccess: (a, t) => void handleSuccess(a, t, "email")
+        }
+      )
     ] })
   ] });
 }
-function LinkPromptStep({
-  authOrigin,
-  onContinue
-}) {
-  return /* @__PURE__ */ jsxRuntime.jsxs("div", { "data-oc-signin-linkprompt": "", children: [
-    /* @__PURE__ */ jsxRuntime.jsx(FlowHeader, { label: "\xA7 signed in \xB7 add a backup", children: "You're in. Linking a second way to sign in \u2014 your email or your Bitcoin wallet \u2014 is also your recovery path: lose one, the other still gets you in. Optional; skip with continue." }),
-    /* @__PURE__ */ jsxRuntime.jsx(OcLinkedIdentities, { authOrigin }),
-    /* @__PURE__ */ jsxRuntime.jsx(
-      "button",
-      {
-        type: "button",
-        onClick: onContinue,
-        style: submitStyle(false),
-        "data-oc-signin-continue": "",
-        children: "continue \u2192"
-      }
-    )
-  ] });
-}
 function SigninTab({
   active,
   onClick,
@@ -2552,7 +2437,6 @@ exports.DEFAULT_CONFIG = DEFAULT_CONFIG;
 exports.OcAccountChip = OcAccountChip;
 exports.OcAccountPill = OcAccountPill;
 exports.OcAddressInput = OcAddressInput;
-exports.OcIdentityBond = OcIdentityBond;
 exports.OcLinkedIdentities = OcLinkedIdentities;
 exports.OcSessionProvider = OcSessionProvider;
 exports.OcSignIn = OcSignIn;