@orangecheck/me-client 0.19.0 → 0.21.0

package/dist/index.mjs

@@ -618,7 +618,7 @@ var DEFAULT_DISABLED = {
   site_pays: { kind: "fixed_sats", sats: 100 },
   user_share_pct: 0.65
 };
-function fromTemplate(useCase, identity) {
+function fromTemplate(useCase, identity2) {
   const template = ARCHETYPES_BY_ID[useCase];
   if (!template) {
     throw new Error(
@@ -632,9 +632,9 @@ function fromTemplate(useCase, identity) {
     events[sub] = template.events[sub] ?? DEFAULT_DISABLED;
   }
   return {
-    project_key: identity.project_key,
-    domain: identity.domain,
-    display_name: identity.display_name,
+    project_key: identity2.project_key,
+    domain: identity2.domain,
+    display_name: identity2.display_name,
     updated_at: (/* @__PURE__ */ new Date()).toISOString(),
     events
   };
@@ -1116,6 +1116,219 @@ async function scopes(verb, options) {
 }
 var family = { scopes };
 
+// src/identity.ts
+var DEFAULT_ISSUER2 = "https://me.ochk.io";
+var DEFAULT_TTL_MS2 = 60 * 60 * 1e3;
+var ENVELOPE_JWKS_PATH = "/.well-known/oc-envelope-jwks.json";
+var jwksCache2 = /* @__PURE__ */ new Map();
+var inflight2 = /* @__PURE__ */ new Map();
+async function fetchEnvelopeJwks(issuer, ttlMs) {
+  const cached = jwksCache2.get(issuer);
+  if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;
+  const existing = inflight2.get(issuer);
+  if (existing) return existing;
+  const p = (async () => {
+    try {
+      const url = `${issuer.replace(/\/$/, "")}${ENVELOPE_JWKS_PATH}`;
+      const res = await fetch(url, { headers: { Accept: "application/json" } });
+      if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);
+      const json = await res.json();
+      if (!json || !Array.isArray(json.keys)) {
+        throw new Error(`envelope JWKS at ${url} did not return {keys:[\u2026]}`);
+      }
+      const keys = {};
+      for (const k of json.keys) {
+        if (typeof k.kid !== "string") continue;
+        try {
+          keys[k.kid] = await importJWK(k, "EdDSA");
+        } catch {
+        }
+      }
+      const entry = { keys, fetchedAt: Date.now() };
+      jwksCache2.set(issuer, entry);
+      return entry;
+    } catch (err) {
+      const stale = jwksCache2.get(issuer);
+      if (stale) return stale;
+      throw err;
+    }
+  })().finally(() => {
+    inflight2.delete(issuer);
+  });
+  inflight2.set(issuer, p);
+  return p;
+}
+function hexToBytes2(hex) {
+  if (typeof hex !== "string") return null;
+  const s = hex.trim();
+  if (s.length === 0 || s.length % 2 !== 0) return null;
+  const out = new Uint8Array(s.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(b)) return null;
+    out[i] = b;
+  }
+  return out;
+}
+function base64ToBytes(b64) {
+  try {
+    const bin = typeof atob === "function" ? atob(b64) : Buffer.from(b64, "base64").toString("binary");
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+function bytesToHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+async function sha256(bytes) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) {
+    throw new Error("crypto.subtle unavailable \xB7 need Node 20+ / modern browser / Edge runtime");
+  }
+  const buf = await subtle.digest("SHA-256", bytes);
+  return new Uint8Array(buf);
+}
+function toArrayBuffer2(view) {
+  const buf = new ArrayBuffer(view.byteLength);
+  new Uint8Array(buf).set(view);
+  return buf;
+}
+async function verifyEd255192(key, sig, msg) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) return false;
+  try {
+    return await subtle.verify(
+      "Ed25519",
+      key,
+      toArrayBuffer2(sig),
+      toArrayBuffer2(msg)
+    );
+  } catch {
+    return false;
+  }
+}
+async function verifyActivityAttestation(bundle, options = {}) {
+  const checks = [];
+  const shapeOk = !!bundle && typeof bundle === "object" && typeof bundle.sig === "string" && typeof bundle.kid === "string" && typeof bundle.canonical_b64 === "string" && !!bundle.attestation && typeof bundle.attestation.id === "string" && typeof bundle.attestation.expires_at === "string";
+  checks.push({
+    ok: shapeOk,
+    label: "bundle shape \xB7 sig / kid / canonical_b64 / attestation"
+  });
+  if (!shapeOk) {
+    return { ok: false, reason: "bundle shape invalid", checks };
+  }
+  const a = bundle.attestation;
+  const canonical = base64ToBytes(bundle.canonical_b64);
+  checks.push({
+    ok: canonical !== null,
+    label: "canonical_b64 decodes",
+    detail: canonical ? `${canonical.length} bytes` : "invalid base64"
+  });
+  if (!canonical) return { ok: false, reason: "canonical_b64 invalid base64", checks, attestation: a };
+  const digest = await sha256(canonical);
+  const computedId = bytesToHex(digest);
+  const idOk = computedId === a.id;
+  checks.push({
+    ok: idOk,
+    label: "sha256(canonical_bytes) === id",
+    detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`
+  });
+  if (!idOk) return { ok: false, reason: "id does not match canonical-bytes hash", checks, attestation: a };
+  let key = null;
+  if (options.jwk) {
+    if (options.jwk.kid !== bundle.kid) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`
+      });
+      return { ok: false, reason: "kid mismatch with provided jwk", checks, attestation: a };
+    }
+    try {
+      key = await importJWK(options.jwk, "EdDSA");
+      checks.push({ ok: true, label: "JWK with matching kid present", detail: `kid ${bundle.kid} (provided)` });
+    } catch (err) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `provided jwk failed import: ${err.message}`
+      });
+      return { ok: false, reason: "provided jwk failed import", checks, attestation: a };
+    }
+  } else {
+    const issuer = options.issuer ?? DEFAULT_ISSUER2;
+    const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS2;
+    try {
+      let entry = await fetchEnvelopeJwks(issuer, ttl);
+      key = entry.keys[bundle.kid] ?? null;
+      if (!key) {
+        jwksCache2.delete(issuer);
+        entry = await fetchEnvelopeJwks(issuer, ttl);
+        key = entry.keys[bundle.kid] ?? null;
+      }
+      checks.push({
+        ok: !!key,
+        label: "JWK with matching kid present",
+        detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`
+      });
+      if (!key) {
+        return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };
+      }
+    } catch (err) {
+      checks.push({
+        ok: false,
+        label: "JWK with matching kid present",
+        detail: `envelope JWKS unavailable: ${err.message}`
+      });
+      return {
+        ok: false,
+        reason: `envelope JWKS unavailable: ${err.message}`,
+        checks,
+        attestation: a
+      };
+    }
+  }
+  const sigBytes = hexToBytes2(bundle.sig);
+  if (!sigBytes) {
+    checks.push({
+      ok: false,
+      label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
+      detail: "malformed sig (expected hex)"
+    });
+    return { ok: false, reason: "malformed sig", checks, attestation: a };
+  }
+  const sigOk = await verifyEd255192(key, sigBytes, canonical);
+  checks.push({
+    ok: sigOk,
+    label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
+    detail: sigOk ? "signature valid" : "signature does not match"
+  });
+  if (!sigOk) return { ok: false, reason: "signature does not match", checks, attestation: a };
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const expiresMs = Date.parse(a.expires_at);
+  const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();
+  checks.push({
+    ok: freshOk,
+    label: "now < attestation.expires_at",
+    detail: freshOk ? `expires ${new Date(expiresMs).toISOString()}` : "attestation has expired"
+  });
+  if (!freshOk) return { ok: false, reason: "attestation has expired", checks, attestation: a };
+  return { ok: true, attestation: a, checks };
+}
+async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER2) {
+  jwksCache2.delete(issuer);
+  await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS2);
+}
+var identity = {
+  verifyActivityAttestation,
+  refreshEnvelopeJwks
+};
+
 // src/subtypes.ts
 var EVENT_SUBTYPES = {
   // ── Class A · durable state transitions ──
@@ -1240,8 +1453,18 @@ var ALL_EVENT_SUBTYPES = [
 ];
 
 // src/index.ts
-var oc = { session, payment, event, config, webhook, federations, scope, family };
+var oc = {
+  session,
+  payment,
+  event,
+  config,
+  webhook,
+  federations,
+  scope,
+  family,
+  identity
+};
 
-export { ALL_EVENT_SUBTYPES, ARCHETYPE_TEMPLATES, EVENT_SUBTYPES, MIN_INTEGRATOR_PRICE_SATS, MeClientError, OcSignInButton, PLATFORM_FEE_POLICY, clearBearerToken, computeFees, config, fromTemplate as configFromTemplate, event, family, federations, getArchetypeTemplate, getBearerToken, getOrigin, oc, onTelemetry, parseTrustAttestationCount, payment, scope, session, setBearerToken, setOrigin, subtypesForClass, validateIntegratorConfig, webhook, withRateLimitRetry };
+export { ALL_EVENT_SUBTYPES, ARCHETYPE_TEMPLATES, EVENT_SUBTYPES, MIN_INTEGRATOR_PRICE_SATS, MeClientError, OcSignInButton, PLATFORM_FEE_POLICY, clearBearerToken, computeFees, config, fromTemplate as configFromTemplate, event, family, federations, getArchetypeTemplate, getBearerToken, getOrigin, identity, oc, onTelemetry, parseTrustAttestationCount, payment, refreshEnvelopeJwks, scope, session, setBearerToken, setOrigin, subtypesForClass, validateIntegratorConfig, verifyActivityAttestation, webhook, withRateLimitRetry };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map