@orangecheck/me-client 0.19.0 → 0.20.0

package/dist/identity-1VYMOhzV.d.mts

@@ -0,0 +1,53 @@
+interface ActivityAttestation {
+    id: string;
+    v: 1;
+    kind: 'oc-me-activity';
+    did_oc: string;
+    event_count: number;
+    human_event_count: number;
+    lifetime_sats: number;
+    distinct_integrator_count: number;
+    oldest_event_at: string | null;
+    active_days: number;
+    computed_at: string;
+    expires_at: string;
+}
+interface ActivityAttestationBundle {
+    attestation: ActivityAttestation;
+    sig: string;
+    kid: string;
+    canonical_b64: string;
+}
+interface ActivityVerifyCheck {
+    ok: boolean;
+    label: string;
+    detail?: string;
+}
+interface ActivityVerifyResult {
+    ok: boolean;
+    reason?: string;
+    attestation?: ActivityAttestation;
+    checks: ActivityVerifyCheck[];
+}
+interface OcEnvelopePublicJwk {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+    kid: string;
+    alg?: 'EdDSA';
+    use?: 'sig';
+}
+interface VerifyActivityOptions {
+    issuer?: string;
+    jwk?: OcEnvelopePublicJwk;
+    jwksCacheTtlMs?: number;
+    now?: Date;
+}
+declare function verifyActivityAttestation(bundle: ActivityAttestationBundle, options?: VerifyActivityOptions): Promise<ActivityVerifyResult>;
+declare function refreshEnvelopeJwks(issuer?: string): Promise<void>;
+declare const identity: {
+    verifyActivityAttestation: typeof verifyActivityAttestation;
+    refreshEnvelopeJwks: typeof refreshEnvelopeJwks;
+};
+
+export { type ActivityAttestation as A, type VerifyActivityOptions as V, type ActivityAttestationBundle as a, type ActivityVerifyCheck as b, type ActivityVerifyResult as c, identity as i, refreshEnvelopeJwks as r, verifyActivityAttestation as v };

package/dist/identity-1VYMOhzV.d.ts

@@ -0,0 +1,53 @@
+interface ActivityAttestation {
+    id: string;
+    v: 1;
+    kind: 'oc-me-activity';
+    did_oc: string;
+    event_count: number;
+    human_event_count: number;
+    lifetime_sats: number;
+    distinct_integrator_count: number;
+    oldest_event_at: string | null;
+    active_days: number;
+    computed_at: string;
+    expires_at: string;
+}
+interface ActivityAttestationBundle {
+    attestation: ActivityAttestation;
+    sig: string;
+    kid: string;
+    canonical_b64: string;
+}
+interface ActivityVerifyCheck {
+    ok: boolean;
+    label: string;
+    detail?: string;
+}
+interface ActivityVerifyResult {
+    ok: boolean;
+    reason?: string;
+    attestation?: ActivityAttestation;
+    checks: ActivityVerifyCheck[];
+}
+interface OcEnvelopePublicJwk {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+    kid: string;
+    alg?: 'EdDSA';
+    use?: 'sig';
+}
+interface VerifyActivityOptions {
+    issuer?: string;
+    jwk?: OcEnvelopePublicJwk;
+    jwksCacheTtlMs?: number;
+    now?: Date;
+}
+declare function verifyActivityAttestation(bundle: ActivityAttestationBundle, options?: VerifyActivityOptions): Promise<ActivityVerifyResult>;
+declare function refreshEnvelopeJwks(issuer?: string): Promise<void>;
+declare const identity: {
+    verifyActivityAttestation: typeof verifyActivityAttestation;
+    refreshEnvelopeJwks: typeof refreshEnvelopeJwks;
+};
+
+export { type ActivityAttestation as A, type VerifyActivityOptions as V, type ActivityAttestationBundle as a, type ActivityVerifyCheck as b, type ActivityVerifyResult as c, identity as i, refreshEnvelopeJwks as r, verifyActivityAttestation as v };

package/dist/index.d.mts

@@ -1,3 +1,5 @@
+import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-1VYMOhzV.mjs';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-1VYMOhzV.mjs';
 import { E as EventSubtype, B as BillableEvent, I as IntegratorPriceConfig, S as SessionPolicy, a as Session, T as TelemetryEvent, b as SignInOptions, P as PaymentAuthorizeOptions, c as PaymentResult, V as ValidationResult, f as fromTemplate, g as getArchetypeTemplate, A as ArchetypeTemplate, F as Federation } from './integrator-m712Srxt.mjs';
 export { d as ALL_EVENT_SUBTYPES, e as ARCHETYPE_TEMPLATES, h as AttestTier, C as ClassASubtype, i as ClassBSubtype, j as ClassCSubtype, k as ComputedFees, l as EVENT_SUBTYPES, m as EventClass, n as EventSubtypeMetadata, o as FederationStatus, p as IntegratorArchetype, q as IntegratorEventConfig, M as MIN_INTEGRATOR_PRICE_SATS, r as PLATFORM_FEE_POLICY, s as SigningMethod, t as SiteFeeShape, W as WebhookHeaders, u as WebhookPayload, v as computeFees, w as subtypesForClass, x as validateIntegratorConfig } from './integrator-m712Srxt.mjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
@@ -245,6 +247,10 @@ declare const oc: {
     family: {
         scopes: (verb: FamilyVerb, options?: FamilyScopesOptions) => Promise<FamilyScopesResult>;
     };
+    identity: {
+        verifyActivityAttestation: typeof verifyActivityAttestation;
+        refreshEnvelopeJwks: typeof refreshEnvelopeJwks;
+    };
 };
 
-export { ArchetypeTemplate, BillableEvent, EventSubtype, type FamilyScopesOptions, type FamilyScopesResult, type FamilyVerb, Federation, type FireEventOptions, type GrantedOptions, type GrantedResult, IntegratorPriceConfig, MeClientError, type OcPublicJwk, OcSignInButton, type OcSignInButtonProps, PaymentAuthorizeOptions, PaymentResult, type RequestOptions, type Scope, Session, SessionPolicy, SignInOptions, TelemetryEvent, type TrustAttestationCount, ValidationResult, type VerifyEventResult, type VerifyOptions, type VerifyResult, type WithRateLimitRetryOptions, clearBearerToken, config, fromTemplate as configFromTemplate, event, family, federations, getArchetypeTemplate, getBearerToken, getOrigin, oc, onTelemetry, parseTrustAttestationCount, payment, scope, session, setBearerToken, setOrigin, webhook, withRateLimitRetry };
+export { ArchetypeTemplate, BillableEvent, EventSubtype, type FamilyScopesOptions, type FamilyScopesResult, type FamilyVerb, Federation, type FireEventOptions, type GrantedOptions, type GrantedResult, IntegratorPriceConfig, MeClientError, type OcPublicJwk, OcSignInButton, type OcSignInButtonProps, PaymentAuthorizeOptions, PaymentResult, type RequestOptions, type Scope, Session, SessionPolicy, SignInOptions, TelemetryEvent, type TrustAttestationCount, ValidationResult, type VerifyEventResult, type VerifyOptions, type VerifyResult, type WithRateLimitRetryOptions, clearBearerToken, config, fromTemplate as configFromTemplate, event, family, federations, getArchetypeTemplate, getBearerToken, getOrigin, oc, onTelemetry, parseTrustAttestationCount, payment, refreshEnvelopeJwks, scope, session, setBearerToken, setOrigin, verifyActivityAttestation, webhook, withRateLimitRetry };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-1VYMOhzV.js';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-1VYMOhzV.js';
 import { E as EventSubtype, B as BillableEvent, I as IntegratorPriceConfig, S as SessionPolicy, a as Session, T as TelemetryEvent, b as SignInOptions, P as PaymentAuthorizeOptions, c as PaymentResult, V as ValidationResult, f as fromTemplate, g as getArchetypeTemplate, A as ArchetypeTemplate, F as Federation } from './integrator-m712Srxt.js';
 export { d as ALL_EVENT_SUBTYPES, e as ARCHETYPE_TEMPLATES, h as AttestTier, C as ClassASubtype, i as ClassBSubtype, j as ClassCSubtype, k as ComputedFees, l as EVENT_SUBTYPES, m as EventClass, n as EventSubtypeMetadata, o as FederationStatus, p as IntegratorArchetype, q as IntegratorEventConfig, M as MIN_INTEGRATOR_PRICE_SATS, r as PLATFORM_FEE_POLICY, s as SigningMethod, t as SiteFeeShape, W as WebhookHeaders, u as WebhookPayload, v as computeFees, w as subtypesForClass, x as validateIntegratorConfig } from './integrator-m712Srxt.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
@@ -245,6 +247,10 @@ declare const oc: {
     family: {
         scopes: (verb: FamilyVerb, options?: FamilyScopesOptions) => Promise<FamilyScopesResult>;
     };
+    identity: {
+        verifyActivityAttestation: typeof verifyActivityAttestation;
+        refreshEnvelopeJwks: typeof refreshEnvelopeJwks;
+    };
 };
 
-export { ArchetypeTemplate, BillableEvent, EventSubtype, type FamilyScopesOptions, type FamilyScopesResult, type FamilyVerb, Federation, type FireEventOptions, type GrantedOptions, type GrantedResult, IntegratorPriceConfig, MeClientError, type OcPublicJwk, OcSignInButton, type OcSignInButtonProps, PaymentAuthorizeOptions, PaymentResult, type RequestOptions, type Scope, Session, SessionPolicy, SignInOptions, TelemetryEvent, type TrustAttestationCount, ValidationResult, type VerifyEventResult, type VerifyOptions, type VerifyResult, type WithRateLimitRetryOptions, clearBearerToken, config, fromTemplate as configFromTemplate, event, family, federations, getArchetypeTemplate, getBearerToken, getOrigin, oc, onTelemetry, parseTrustAttestationCount, payment, scope, session, setBearerToken, setOrigin, webhook, withRateLimitRetry };
+export { ArchetypeTemplate, BillableEvent, EventSubtype, type FamilyScopesOptions, type FamilyScopesResult, type FamilyVerb, Federation, type FireEventOptions, type GrantedOptions, type GrantedResult, IntegratorPriceConfig, MeClientError, type OcPublicJwk, OcSignInButton, type OcSignInButtonProps, PaymentAuthorizeOptions, PaymentResult, type RequestOptions, type Scope, Session, SessionPolicy, SignInOptions, TelemetryEvent, type TrustAttestationCount, ValidationResult, type VerifyEventResult, type VerifyOptions, type VerifyResult, type WithRateLimitRetryOptions, clearBearerToken, config, fromTemplate as configFromTemplate, event, family, federations, getArchetypeTemplate, getBearerToken, getOrigin, oc, onTelemetry, parseTrustAttestationCount, payment, refreshEnvelopeJwks, scope, session, setBearerToken, setOrigin, verifyActivityAttestation, webhook, withRateLimitRetry };

package/dist/index.js

@@ -640,7 +640,7 @@ var DEFAULT_DISABLED = {
   site_pays: { kind: "fixed_sats", sats: 100 },
   user_share_pct: 0.65
 };
-function fromTemplate(useCase, identity) {
+function fromTemplate(useCase, identity2) {
   const template = ARCHETYPES_BY_ID[useCase];
   if (!template) {
     throw new Error(
@@ -654,9 +654,9 @@ function fromTemplate(useCase, identity) {
     events[sub] = template.events[sub] ?? DEFAULT_DISABLED;
   }
   return {
-    project_key: identity.project_key,
-    domain: identity.domain,
-    display_name: identity.display_name,
+    project_key: identity2.project_key,
+    domain: identity2.domain,
+    display_name: identity2.display_name,
     updated_at: (/* @__PURE__ */ new Date()).toISOString(),
     events
   };
@@ -1138,6 +1138,219 @@ async function scopes(verb, options) {
 }
 var family = { scopes };
 
+// src/identity.ts
+var DEFAULT_ISSUER2 = "https://me.ochk.io";
+var DEFAULT_TTL_MS2 = 60 * 60 * 1e3;
+var ENVELOPE_JWKS_PATH = "/.well-known/oc-envelope-jwks.json";
+var jwksCache2 = /* @__PURE__ */ new Map();
+var inflight2 = /* @__PURE__ */ new Map();
+async function fetchEnvelopeJwks(issuer, ttlMs) {
+  const cached = jwksCache2.get(issuer);
+  if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;
+  const existing = inflight2.get(issuer);
+  if (existing) return existing;
+  const p = (async () => {
+    try {
+      const url = `${issuer.replace(/\/$/, "")}${ENVELOPE_JWKS_PATH}`;
+      const res = await fetch(url, { headers: { Accept: "application/json" } });
+      if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);
+      const json = await res.json();
+      if (!json || !Array.isArray(json.keys)) {
+        throw new Error(`envelope JWKS at ${url} did not return {keys:[\u2026]}`);
+      }
+      const keys = {};
+      for (const k of json.keys) {
+        if (typeof k.kid !== "string") continue;
+        try {
+          keys[k.kid] = await importJWK(k, "EdDSA");
+        } catch {
+        }
+      }
+      const entry = { keys, fetchedAt: Date.now() };
+      jwksCache2.set(issuer, entry);
+      return entry;
+    } catch (err) {
+      const stale = jwksCache2.get(issuer);
+      if (stale) return stale;
+      throw err;
+    }
+  })().finally(() => {
+    inflight2.delete(issuer);
+  });
+  inflight2.set(issuer, p);
+  return p;
+}
+function hexToBytes2(hex) {
+  if (typeof hex !== "string") return null;
+  const s = hex.trim();
+  if (s.length === 0 || s.length % 2 !== 0) return null;
+  const out = new Uint8Array(s.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(b)) return null;
+    out[i] = b;
+  }
+  return out;
+}
+function base64ToBytes(b64) {
+  try {
+    const bin = typeof atob === "function" ? atob(b64) : Buffer.from(b64, "base64").toString("binary");
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+function bytesToHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+async function sha256(bytes) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) {
+    throw new Error("crypto.subtle unavailable \xB7 need Node 20+ / modern browser / Edge runtime");
+  }
+  const buf = await subtle.digest("SHA-256", bytes);
+  return new Uint8Array(buf);
+}
+function toArrayBuffer2(view) {
+  const buf = new ArrayBuffer(view.byteLength);
+  new Uint8Array(buf).set(view);
+  return buf;
+}
+async function verifyEd255192(key, sig, msg) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) return false;
+  try {
+    return await subtle.verify(
+      "Ed25519",
+      key,
+      toArrayBuffer2(sig),
+      toArrayBuffer2(msg)
+    );
+  } catch {
+    return false;
+  }
+}
+async function verifyActivityAttestation(bundle, options = {}) {
+  const checks = [];
+  const shapeOk = !!bundle && typeof bundle === "object" && typeof bundle.sig === "string" && typeof bundle.kid === "string" && typeof bundle.canonical_b64 === "string" && !!bundle.attestation && typeof bundle.attestation.id === "string" && typeof bundle.attestation.expires_at === "string";
+  checks.push({
+    ok: shapeOk,
+    label: "bundle shape \xB7 sig / kid / canonical_b64 / attestation"
+  });
+  if (!shapeOk) {
+    return { ok: false, reason: "bundle shape invalid", checks };
+  }
+  const a = bundle.attestation;
+  const canonical = base64ToBytes(bundle.canonical_b64);
+  checks.push({
+    ok: canonical !== null,
+    label: "canonical_b64 decodes",
+    detail: canonical ? `${canonical.length} bytes` : "invalid base64"
+  });
+  if (!canonical) return { ok: false, reason: "canonical_b64 invalid base64", checks, attestation: a };
+  const digest = await sha256(canonical);
+  const computedId = bytesToHex(digest);
+  const idOk = computedId === a.id;
+  checks.push({
+    ok: idOk,
+    label: "sha256(canonical_bytes) === id",
+    detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`
+  });
+  if (!idOk) return { ok: false, reason: "id does not match canonical-bytes hash", checks, attestation: a };
+  let key = null;
+  if (options.jwk) {
+    if (options.jwk.kid !== bundle.kid) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`
+      });
+      return { ok: false, reason: "kid mismatch with provided jwk", checks, attestation: a };
+    }
+    try {
+      key = await importJWK(options.jwk, "EdDSA");
+      checks.push({ ok: true, label: "JWK with matching kid present", detail: `kid ${bundle.kid} (provided)` });
+    } catch (err) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `provided jwk failed import: ${err.message}`
+      });
+      return { ok: false, reason: "provided jwk failed import", checks, attestation: a };
+    }
+  } else {
+    const issuer = options.issuer ?? DEFAULT_ISSUER2;
+    const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS2;
+    try {
+      let entry = await fetchEnvelopeJwks(issuer, ttl);
+      key = entry.keys[bundle.kid] ?? null;
+      if (!key) {
+        jwksCache2.delete(issuer);
+        entry = await fetchEnvelopeJwks(issuer, ttl);
+        key = entry.keys[bundle.kid] ?? null;
+      }
+      checks.push({
+        ok: !!key,
+        label: "JWK with matching kid present",
+        detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`
+      });
+      if (!key) {
+        return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };
+      }
+    } catch (err) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `envelope JWKS unavailable: ${err.message}`
+      });
+      return {
+        ok: false,
+        reason: `envelope JWKS unavailable: ${err.message}`,
+        checks,
+        attestation: a
+      };
+    }
+  }
+  const sigBytes = hexToBytes2(bundle.sig);
+  if (!sigBytes) {
+    checks.push({
+      ok: false,
+      label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
+      detail: "malformed sig (expected hex)"
+    });
+    return { ok: false, reason: "malformed sig", checks, attestation: a };
+  }
+  const sigOk = await verifyEd255192(key, sigBytes, canonical);
+  checks.push({
+    ok: sigOk,
+    label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
+    detail: sigOk ? "signature valid" : "signature does not match"
+  });
+  if (!sigOk) return { ok: false, reason: "signature does not match", checks, attestation: a };
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const expiresMs = Date.parse(a.expires_at);
+  const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();
+  checks.push({
+    ok: freshOk,
+    label: "now < attestation.expires_at",
+    detail: freshOk ? `expires ${new Date(expiresMs).toISOString()}` : "attestation has expired"
+  });
+  if (!freshOk) return { ok: false, reason: "attestation has expired", checks, attestation: a };
+  return { ok: true, attestation: a, checks };
+}
+async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER2) {
+  jwksCache2.delete(issuer);
+  await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS2);
+}
+var identity = {
+  verifyActivityAttestation,
+  refreshEnvelopeJwks
+};
+
 // src/subtypes.ts
 var EVENT_SUBTYPES = {
   // ── Class A · durable state transitions ──
@@ -1262,7 +1475,17 @@ var ALL_EVENT_SUBTYPES = [
 ];
 
 // src/index.ts
-var oc = { session, payment, event, config, webhook, federations, scope, family };
+var oc = {
+  session,
+  payment,
+  event,
+  config,
+  webhook,
+  federations,
+  scope,
+  family,
+  identity
+};
 
 exports.ALL_EVENT_SUBTYPES = ALL_EVENT_SUBTYPES;
 exports.ARCHETYPE_TEMPLATES = ARCHETYPE_TEMPLATES;
@@ -1281,16 +1504,19 @@ exports.federations = federations;
 exports.getArchetypeTemplate = getArchetypeTemplate;
 exports.getBearerToken = getBearerToken;
 exports.getOrigin = getOrigin;
+exports.identity = identity;
 exports.oc = oc;
 exports.onTelemetry = onTelemetry;
 exports.parseTrustAttestationCount = parseTrustAttestationCount;
 exports.payment = payment;
+exports.refreshEnvelopeJwks = refreshEnvelopeJwks;
 exports.scope = scope;
 exports.session = session;
 exports.setBearerToken = setBearerToken;
 exports.setOrigin = setOrigin;
 exports.subtypesForClass = subtypesForClass;
 exports.validateIntegratorConfig = validateIntegratorConfig;
+exports.verifyActivityAttestation = verifyActivityAttestation;
 exports.webhook = webhook;
 exports.withRateLimitRetry = withRateLimitRetry;
 //# sourceMappingURL=index.js.map