@orangecheck/me-client 0.18.0 → 0.20.0

package/dist/popup.d.mts

@@ -1,5 +1,8 @@
 interface OcPopupAccount {
     id?: string;
+    did_oc?: string;
+    primary_btc?: string | null;
+    has_email?: boolean;
     address?: string;
     btc_address?: string;
     display_name?: string | null;

package/dist/popup.d.ts

@@ -1,5 +1,8 @@
 interface OcPopupAccount {
     id?: string;
+    did_oc?: string;
+    primary_btc?: string | null;
+    has_email?: boolean;
     address?: string;
     btc_address?: string;
     display_name?: string | null;

package/dist/popup.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";;;AAsBA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA6ClB,SAAS,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AAC3F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AAGR,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAA6B;AACzC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAE9B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IACvD;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,IAAI,CAAA;AAAA,IAC1C,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL","file":"popup.js","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (result) {\n *           localStorage.setItem('oc-session-token', result.token);\n *           location.assign('/app');\n *       }\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host. `address` is the canonical\n     *  identifier (Bitcoin address for BIP-322 users, did:email:<hash>\n     *  for email-OTP users). */\n    account: OcPopupAccount;\n    /** The session JWT. Cross-domain integrators store this and send\n     *  it as `Authorization: Bearer <token>` on subsequent calls.\n     *  Family integrators (*.ochk.io) can ignore it — the cookie set\n     *  Domain=.ochk.io rides home automatically. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, or if\n * the AbortSignal fired.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve(null);\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            // Popup blocked. Caller can detect a null result and fall\n            // back to a full-page redirect if desired.\n            resolve(null);\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupResult | null) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                // Malformed payload — treat as not-signed-in.\n                settle(null);\n                return;\n            }\n            settle({ account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle(null);\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle(null);\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the user closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle(null);\n        }, 500);\n    });\n}\n"]}
+{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";;;AAsBA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA2DlB,SAAS,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AAC3F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AAGR,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAA6B;AACzC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAE9B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IACvD;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,IAAI,CAAA;AAAA,IAC1C,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL","file":"popup.js","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (result) {\n *           localStorage.setItem('oc-session-token', result.token);\n *           location.assign('/app');\n *       }\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    /** Opaque public identity · `did:oc:<32-hex>`. Stable across linking\n     *  events. The canonical identifier post auth-refactor (Dec 2025\n     *  +). */\n    did_oc?: string;\n    /** Primary linked Bitcoin address, if the user has one and is\n     *  surfacing it (same-origin family integrators get it inline;\n     *  cross-domain integrators need the bitcoin_address scope). */\n    primary_btc?: string | null;\n    /** Whether the user has a primary email linked (plaintext stays\n     *  on auth host; only the boolean reaches integrators). */\n    has_email?: boolean;\n    /** Legacy fields kept for back-compat with pre-refactor consumers.\n     *  Prefer did_oc + primary_btc. Removed in a future major. */\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host. `did_oc` is the canonical\n     *  opaque identifier post auth-refactor (Dec 2025). Underlying\n     *  email + BTC stay private; integrators get a per-project\n     *  anonymous identifier unless they explicitly request a scope. */\n    account: OcPopupAccount;\n    /** The session JWT. Cross-domain integrators store this and send\n     *  it as `Authorization: Bearer <token>` on subsequent calls.\n     *  Family integrators (*.ochk.io) can ignore it — the cookie set\n     *  Domain=.ochk.io rides home automatically. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, or if\n * the AbortSignal fired.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve(null);\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            // Popup blocked. Caller can detect a null result and fall\n            // back to a full-page redirect if desired.\n            resolve(null);\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupResult | null) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                // Malformed payload — treat as not-signed-in.\n                settle(null);\n                return;\n            }\n            settle({ account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle(null);\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle(null);\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the user closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle(null);\n        }, 500);\n    });\n}\n"]}

package/dist/popup.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";AAsBA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA6ClB,SAAS,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AAC3F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AAGR,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAA6B;AACzC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAE9B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IACvD;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,IAAI,CAAA;AAAA,IAC1C,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL","file":"popup.mjs","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (result) {\n *           localStorage.setItem('oc-session-token', result.token);\n *           location.assign('/app');\n *       }\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host. `address` is the canonical\n     *  identifier (Bitcoin address for BIP-322 users, did:email:<hash>\n     *  for email-OTP users). */\n    account: OcPopupAccount;\n    /** The session JWT. Cross-domain integrators store this and send\n     *  it as `Authorization: Bearer <token>` on subsequent calls.\n     *  Family integrators (*.ochk.io) can ignore it — the cookie set\n     *  Domain=.ochk.io rides home automatically. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, or if\n * the AbortSignal fired.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve(null);\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            // Popup blocked. Caller can detect a null result and fall\n            // back to a full-page redirect if desired.\n            resolve(null);\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupResult | null) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                // Malformed payload — treat as not-signed-in.\n                settle(null);\n                return;\n            }\n            settle({ account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle(null);\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle(null);\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the user closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle(null);\n        }, 500);\n    });\n}\n"]}
+{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";AAsBA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA2DlB,SAAS,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AAC3F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AAGR,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAA6B;AACzC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAE9B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IACvD;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,IAAI,CAAA;AAAA,IAC1C,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL","file":"popup.mjs","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (result) {\n *           localStorage.setItem('oc-session-token', result.token);\n *           location.assign('/app');\n *       }\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    /** Opaque public identity · `did:oc:<32-hex>`. Stable across linking\n     *  events. The canonical identifier post auth-refactor (Dec 2025\n     *  +). */\n    did_oc?: string;\n    /** Primary linked Bitcoin address, if the user has one and is\n     *  surfacing it (same-origin family integrators get it inline;\n     *  cross-domain integrators need the bitcoin_address scope). */\n    primary_btc?: string | null;\n    /** Whether the user has a primary email linked (plaintext stays\n     *  on auth host; only the boolean reaches integrators). */\n    has_email?: boolean;\n    /** Legacy fields kept for back-compat with pre-refactor consumers.\n     *  Prefer did_oc + primary_btc. Removed in a future major. */\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host. `did_oc` is the canonical\n     *  opaque identifier post auth-refactor (Dec 2025). Underlying\n     *  email + BTC stay private; integrators get a per-project\n     *  anonymous identifier unless they explicitly request a scope. */\n    account: OcPopupAccount;\n    /** The session JWT. Cross-domain integrators store this and send\n     *  it as `Authorization: Bearer <token>` on subsequent calls.\n     *  Family integrators (*.ochk.io) can ignore it — the cookie set\n     *  Domain=.ochk.io rides home automatically. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, or if\n * the AbortSignal fired.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve(null);\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            // Popup blocked. Caller can detect a null result and fall\n            // back to a full-page redirect if desired.\n            resolve(null);\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupResult | null) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                // Malformed payload — treat as not-signed-in.\n                settle(null);\n                return;\n            }\n            settle({ account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle(null);\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle(null);\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the user closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle(null);\n        }, 500);\n    });\n}\n"]}

package/dist/server.d.mts

@@ -1,5 +1,6 @@
 import { VerifyOcOptions, SessionRequestHeaders, SessionPayload } from '@orangecheck/auth-core';
 export { SessionPayload, VerifyOcOptions, verifyOcToken } from '@orangecheck/auth-core';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity, r as refreshEnvelopeJwks, v as verifyActivityAttestation } from './identity-1VYMOhzV.mjs';
 
 declare function getOcSession(headers: SessionRequestHeaders | Headers, options?: VerifyOcOptions): Promise<SessionPayload | null>;
 interface NextApiRequestLike {

package/dist/server.d.ts

@@ -1,5 +1,6 @@
 import { VerifyOcOptions, SessionRequestHeaders, SessionPayload } from '@orangecheck/auth-core';
 export { SessionPayload, VerifyOcOptions, verifyOcToken } from '@orangecheck/auth-core';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity, r as refreshEnvelopeJwks, v as verifyActivityAttestation } from './identity-1VYMOhzV.js';
 
 declare function getOcSession(headers: SessionRequestHeaders | Headers, options?: VerifyOcOptions): Promise<SessionPayload | null>;
 interface NextApiRequestLike {

package/dist/server.js

@@ -2,6 +2,445 @@
 
 var authCore = require('@orangecheck/auth-core');
 
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// node_modules/jose/dist/webapi/lib/buffer_utils.js
+new TextEncoder();
+var decoder = new TextDecoder();
+
+// node_modules/jose/dist/webapi/lib/base64.js
+function decodeBase64(encoded) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(encoded);
+  }
+  const binary = atob(encoded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+// node_modules/jose/dist/webapi/util/base64url.js
+function decode(input) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
+      alphabet: "base64url"
+    });
+  }
+  let encoded = input;
+  if (encoded instanceof Uint8Array) {
+    encoded = decoder.decode(encoded);
+  }
+  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return decodeBase64(encoded);
+  } catch {
+    throw new TypeError("The input to be decoded is not correctly encoded.");
+  }
+}
+
+// node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    __publicField(this, "code", "ERR_JOSE_GENERIC");
+    this.name = this.constructor.name;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+__publicField(JOSEError, "code", "ERR_JOSE_GENERIC");
+var JOSENotSupported = class extends JOSEError {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "code", "ERR_JOSE_NOT_SUPPORTED");
+  }
+};
+__publicField(JOSENotSupported, "code", "ERR_JOSE_NOT_SUPPORTED");
+var _a, _b;
+var JWKSMultipleMatchingKeys = class extends (_b = JOSEError, _a = Symbol.asyncIterator, _b) {
+  constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message, options);
+    __publicField(this, _a);
+    __publicField(this, "code", "ERR_JWKS_MULTIPLE_MATCHING_KEYS");
+  }
+};
+__publicField(JWKSMultipleMatchingKeys, "code", "ERR_JWKS_MULTIPLE_MATCHING_KEYS");
+
+// node_modules/jose/dist/webapi/lib/type_checks.js
+var isObjectLike = (value) => typeof value === "object" && value !== null;
+function isObject(input) {
+  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  if (Object.getPrototypeOf(input) === null) {
+    return true;
+  }
+  let proto = input;
+  while (Object.getPrototypeOf(proto) !== null) {
+    proto = Object.getPrototypeOf(proto);
+  }
+  return Object.getPrototypeOf(input) === proto;
+}
+
+// node_modules/jose/dist/webapi/lib/jwk_to_key.js
+var unsupportedAlg = 'Invalid or unsupported JWK "alg" (Algorithm) Parameter value';
+function subtleMapping(jwk) {
+  let algorithm;
+  let keyUsages;
+  switch (jwk.kty) {
+    case "AKP": {
+      switch (jwk.alg) {
+        case "ML-DSA-44":
+        case "ML-DSA-65":
+        case "ML-DSA-87":
+          algorithm = { name: jwk.alg };
+          keyUsages = jwk.priv ? ["sign"] : ["verify"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "RSA": {
+      switch (jwk.alg) {
+        case "PS256":
+        case "PS384":
+        case "PS512":
+          algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RS256":
+        case "RS384":
+        case "RS512":
+          algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RSA-OAEP":
+        case "RSA-OAEP-256":
+        case "RSA-OAEP-384":
+        case "RSA-OAEP-512":
+          algorithm = {
+            name: "RSA-OAEP",
+            hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
+          };
+          keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "EC": {
+      switch (jwk.alg) {
+        case "ES256":
+        case "ES384":
+        case "ES512":
+          algorithm = {
+            name: "ECDSA",
+            namedCurve: { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[jwk.alg]
+          };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: "ECDH", namedCurve: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "OKP": {
+      switch (jwk.alg) {
+        case "Ed25519":
+        case "EdDSA":
+          algorithm = { name: "Ed25519" };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    default:
+      throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+  }
+  return { algorithm, keyUsages };
+}
+async function jwkToKey(jwk) {
+  if (!jwk.alg) {
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  }
+  const { algorithm, keyUsages } = subtleMapping(jwk);
+  const keyData = { ...jwk };
+  if (keyData.kty !== "AKP") {
+    delete keyData.alg;
+  }
+  delete keyData.use;
+  return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+}
+
+// node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk)) {
+    throw new TypeError("JWK must be an object");
+  }
+  let ext;
+  ext ?? (ext = jwk.ext);
+  switch (jwk.kty) {
+    case "oct":
+      if (typeof jwk.k !== "string" || !jwk.k) {
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      }
+      return decode(jwk.k);
+    case "RSA":
+      if ("oth" in jwk && jwk.oth !== void 0) {
+        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+      }
+      return jwkToKey({ ...jwk, alg, ext });
+    case "AKP": {
+      if (typeof jwk.alg !== "string" || !jwk.alg) {
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      }
+      if (alg !== jwk.alg) {
+        throw new TypeError("JWK alg and alg option value mismatch");
+      }
+      return jwkToKey({ ...jwk, ext });
+    }
+    case "EC":
+    case "OKP":
+      return jwkToKey({ ...jwk, alg, ext });
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+
+// src/identity.ts
+var DEFAULT_ISSUER = "https://me.ochk.io";
+var DEFAULT_TTL_MS = 60 * 60 * 1e3;
+var ENVELOPE_JWKS_PATH = "/.well-known/oc-envelope-jwks.json";
+var jwksCache = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+async function fetchEnvelopeJwks(issuer, ttlMs) {
+  const cached = jwksCache.get(issuer);
+  if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;
+  const existing = inflight.get(issuer);
+  if (existing) return existing;
+  const p = (async () => {
+    try {
+      const url = `${issuer.replace(/\/$/, "")}${ENVELOPE_JWKS_PATH}`;
+      const res = await fetch(url, { headers: { Accept: "application/json" } });
+      if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);
+      const json = await res.json();
+      if (!json || !Array.isArray(json.keys)) {
+        throw new Error(`envelope JWKS at ${url} did not return {keys:[\u2026]}`);
+      }
+      const keys = {};
+      for (const k of json.keys) {
+        if (typeof k.kid !== "string") continue;
+        try {
+          keys[k.kid] = await importJWK(k, "EdDSA");
+        } catch {
+        }
+      }
+      const entry = { keys, fetchedAt: Date.now() };
+      jwksCache.set(issuer, entry);
+      return entry;
+    } catch (err) {
+      const stale = jwksCache.get(issuer);
+      if (stale) return stale;
+      throw err;
+    }
+  })().finally(() => {
+    inflight.delete(issuer);
+  });
+  inflight.set(issuer, p);
+  return p;
+}
+function hexToBytes(hex) {
+  if (typeof hex !== "string") return null;
+  const s = hex.trim();
+  if (s.length === 0 || s.length % 2 !== 0) return null;
+  const out = new Uint8Array(s.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(b)) return null;
+    out[i] = b;
+  }
+  return out;
+}
+function base64ToBytes(b64) {
+  try {
+    const bin = typeof atob === "function" ? atob(b64) : Buffer.from(b64, "base64").toString("binary");
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+function bytesToHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+async function sha256(bytes) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) {
+    throw new Error("crypto.subtle unavailable \xB7 need Node 20+ / modern browser / Edge runtime");
+  }
+  const buf = await subtle.digest("SHA-256", bytes);
+  return new Uint8Array(buf);
+}
+function toArrayBuffer(view) {
+  const buf = new ArrayBuffer(view.byteLength);
+  new Uint8Array(buf).set(view);
+  return buf;
+}
+async function verifyEd25519(key, sig, msg) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) return false;
+  try {
+    return await subtle.verify(
+      "Ed25519",
+      key,
+      toArrayBuffer(sig),
+      toArrayBuffer(msg)
+    );
+  } catch {
+    return false;
+  }
+}
+async function verifyActivityAttestation(bundle, options = {}) {
+  const checks = [];
+  const shapeOk = !!bundle && typeof bundle === "object" && typeof bundle.sig === "string" && typeof bundle.kid === "string" && typeof bundle.canonical_b64 === "string" && !!bundle.attestation && typeof bundle.attestation.id === "string" && typeof bundle.attestation.expires_at === "string";
+  checks.push({
+    ok: shapeOk,
+    label: "bundle shape \xB7 sig / kid / canonical_b64 / attestation"
+  });
+  if (!shapeOk) {
+    return { ok: false, reason: "bundle shape invalid", checks };
+  }
+  const a = bundle.attestation;
+  const canonical = base64ToBytes(bundle.canonical_b64);
+  checks.push({
+    ok: canonical !== null,
+    label: "canonical_b64 decodes",
+    detail: canonical ? `${canonical.length} bytes` : "invalid base64"
+  });
+  if (!canonical) return { ok: false, reason: "canonical_b64 invalid base64", checks, attestation: a };
+  const digest = await sha256(canonical);
+  const computedId = bytesToHex(digest);
+  const idOk = computedId === a.id;
+  checks.push({
+    ok: idOk,
+    label: "sha256(canonical_bytes) === id",
+    detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`
+  });
+  if (!idOk) return { ok: false, reason: "id does not match canonical-bytes hash", checks, attestation: a };
+  let key = null;
+  if (options.jwk) {
+    if (options.jwk.kid !== bundle.kid) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`
+      });
+      return { ok: false, reason: "kid mismatch with provided jwk", checks, attestation: a };
+    }
+    try {
+      key = await importJWK(options.jwk, "EdDSA");
+      checks.push({ ok: true, label: "JWK with matching kid present", detail: `kid ${bundle.kid} (provided)` });
+    } catch (err) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `provided jwk failed import: ${err.message}`
+      });
+      return { ok: false, reason: "provided jwk failed import", checks, attestation: a };
+    }
+  } else {
+    const issuer = options.issuer ?? DEFAULT_ISSUER;
+    const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;
+    try {
+      let entry = await fetchEnvelopeJwks(issuer, ttl);
+      key = entry.keys[bundle.kid] ?? null;
+      if (!key) {
+        jwksCache.delete(issuer);
+        entry = await fetchEnvelopeJwks(issuer, ttl);
+        key = entry.keys[bundle.kid] ?? null;
+      }
+      checks.push({
+        ok: !!key,
+        label: "JWK with matching kid present",
+        detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`
+      });
+      if (!key) {
+        return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };
+      }
+    } catch (err) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `envelope JWKS unavailable: ${err.message}`
+      });
+      return {
+        ok: false,
+        reason: `envelope JWKS unavailable: ${err.message}`,
+        checks,
+        attestation: a
+      };
+    }
+  }
+  const sigBytes = hexToBytes(bundle.sig);
+  if (!sigBytes) {
+    checks.push({
+      ok: false,
+      label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
+      detail: "malformed sig (expected hex)"
+    });
+    return { ok: false, reason: "malformed sig", checks, attestation: a };
+  }
+  const sigOk = await verifyEd25519(key, sigBytes, canonical);
+  checks.push({
+    ok: sigOk,
+    label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
+    detail: sigOk ? "signature valid" : "signature does not match"
+  });
+  if (!sigOk) return { ok: false, reason: "signature does not match", checks, attestation: a };
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const expiresMs = Date.parse(a.expires_at);
+  const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();
+  checks.push({
+    ok: freshOk,
+    label: "now < attestation.expires_at",
+    detail: freshOk ? `expires ${new Date(expiresMs).toISOString()}` : "attestation has expired"
+  });
+  if (!freshOk) return { ok: false, reason: "attestation has expired", checks, attestation: a };
+  return { ok: true, attestation: a, checks };
+}
+async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER) {
+  jwksCache.delete(issuer);
+  await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS);
+}
+var identity = {
+  verifyActivityAttestation,
+  refreshEnvelopeJwks
+};
+
 // src/server.ts
 async function getOcSession(headers, options = {}) {
   return authCore.getOcSession(headers, options);
@@ -66,8 +505,11 @@ Object.defineProperty(exports, "verifyOcToken", {
   get: function () { return authCore.verifyOcToken; }
 });
 exports.getOcSession = getOcSession;
+exports.identity = identity;
 exports.ocAuthExpress = ocAuthExpress;
 exports.ocAuthHono = ocAuthHono;
+exports.refreshEnvelopeJwks = refreshEnvelopeJwks;
+exports.verifyActivityAttestation = verifyActivityAttestation;
 exports.withOcAuth = withOcAuth;
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map