@orangecheck/me-client 0.32.2 → 0.32.4

package/README.md

@@ -1,6 +1,6 @@
 # @orangecheck/me-client
 
-> **Full reference:** [docs.ochk.io/sdk/me-client](https://docs.ochk.io/sdk/me-client) — auto-generated from the TypeScript source on every release.
+> **Full reference:** [ochk.io/docs/sdk/me-client](https://ochk.io/docs/sdk/me-client) — auto-generated from the TypeScript source on every release.
 > Hand-written prose below is the high-level overview; the docs site is the source of truth for every export, type, and signature.
 
 
@@ -153,7 +153,7 @@ const unsubscribe = onTelemetry((event) => {
 });
 ```
 
-See [me.ochk.io/integrate](https://me.ochk.io/integrate) for the full price-band table, the "what you do not pay for" panel, and the live SDK reference.
+See [ochk.app/pricing](https://ochk.app/pricing) for what each kind of event pays and what you never pay for, and [ochk.io/docs/me/sdk](https://ochk.io/docs/me/sdk) for the full SDK reference.
 
 ## Types
 
@@ -170,7 +170,7 @@ import type {
 } from '@orangecheck/me-client';
 ```
 
-The canonical source of truth lives at [oc-me-web/src/lib/events/types.ts](https://github.com/orangecheck/oc-me-web/blob/main/src/lib/events/types.ts). This package mirrors that shape — any change there ships here in the next minor.
+These mirror what the me.ochk.io API accepts and returns. A change to the API ships here in the next minor.
 
 ## Server-side verification
 

package/dist/{identity-1VYMOhzV.d.mts → identity-6pjtyKYh.d.mts}

@@ -13,7 +13,7 @@ interface ActivityAttestation {
     expires_at: string;
 }
 interface ActivityAttestationBundle {
-    attestation: ActivityAttestation;
+    attestation?: ActivityAttestation;
     sig: string;
     kid: string;
     canonical_b64: string;

package/dist/{identity-1VYMOhzV.d.ts → identity-6pjtyKYh.d.ts}

@@ -13,7 +13,7 @@ interface ActivityAttestation {
     expires_at: string;
 }
 interface ActivityAttestationBundle {
-    attestation: ActivityAttestation;
+    attestation?: ActivityAttestation;
     sig: string;
     kid: string;
     canonical_b64: string;

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-1VYMOhzV.mjs';
-export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-1VYMOhzV.mjs';
+import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-6pjtyKYh.mjs';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-6pjtyKYh.mjs';
 import { B as BillableEvent, E as EventKey, I as IntegratorPriceConfig, T as TelemetryEvent, S as SignInOptions, a as Session, P as PaymentAuthorizeOptions, b as PaymentResult, V as ValidationResult, f as fromTemplate, g as getArchetypeTemplate, A as ArchetypeTemplate, F as Federation } from './integrator-C-enR55c.mjs';
 export { c as ALL_EVENT_SUBTYPES, d as ARCHETYPE_TEMPLATES, e as AgentClassOverride, h as AttestTier, C as ClassASubtype, i as ClassBSubtype, j as ClassCSubtype, k as ComputedFees, D as DropCadence, l as DropClosedWebhookPayload, m as DropResponseBlock, n as DropScheduleSummary, o as EVENT_SUBTYPES, p as EventClass, q as EventSubtype, r as EventSubtypeMetadata, s as FederationStatus, t as IntegratorArchetype, u as IntegratorEventConfig, M as MAX_DROP_WINDOW_DAYS, v as MIN_INTEGRATOR_PRICE_SATS, w as PLATFORM_FEE_POLICY, x as SessionPolicy, y as SigningMethod, z as SiteFeeShape, G as SystemWebhookPayload, W as WebhookHeaders, H as WebhookPayload, J as computeFees, K as subtypesForClass, L as validateIntegratorConfig } from './integrator-C-enR55c.mjs';
 

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-1VYMOhzV.js';
-export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-1VYMOhzV.js';
+import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-6pjtyKYh.js';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-6pjtyKYh.js';
 import { B as BillableEvent, E as EventKey, I as IntegratorPriceConfig, T as TelemetryEvent, S as SignInOptions, a as Session, P as PaymentAuthorizeOptions, b as PaymentResult, V as ValidationResult, f as fromTemplate, g as getArchetypeTemplate, A as ArchetypeTemplate, F as Federation } from './integrator-C-enR55c.js';
 export { c as ALL_EVENT_SUBTYPES, d as ARCHETYPE_TEMPLATES, e as AgentClassOverride, h as AttestTier, C as ClassASubtype, i as ClassBSubtype, j as ClassCSubtype, k as ComputedFees, D as DropCadence, l as DropClosedWebhookPayload, m as DropResponseBlock, n as DropScheduleSummary, o as EVENT_SUBTYPES, p as EventClass, q as EventSubtype, r as EventSubtypeMetadata, s as FederationStatus, t as IntegratorArchetype, u as IntegratorEventConfig, M as MAX_DROP_WINDOW_DAYS, v as MIN_INTEGRATOR_PRICE_SATS, w as PLATFORM_FEE_POLICY, x as SessionPolicy, y as SigningMethod, z as SiteFeeShape, G as SystemWebhookPayload, W as WebhookHeaders, H as WebhookPayload, J as computeFees, K as subtypesForClass, L as validateIntegratorConfig } from './integrator-C-enR55c.js';
 

package/dist/index.js

@@ -1037,6 +1037,7 @@ async function defaultLive() {
 var federations = { list, live, get, defaultLive };
 
 // src/scope.ts
+var CONSENT_ORIGIN = "https://ochk.app";
 var VALID_SCOPES = [
   "bitcoin_address",
   "email",
@@ -1092,7 +1093,7 @@ function request(scopes2, options) {
   if (typeof window === "undefined") {
     throw new Error("oc.scope.request: must be called in a browser environment");
   }
-  const origin2 = options.origin ?? getOrigin();
+  const origin2 = options.origin ?? CONSENT_ORIGIN;
   const url = new URL("/me/scope-grant", origin2);
   url.searchParams.set("project_key", options.project_key);
   url.searchParams.set("scopes", scopes2.join(","));
@@ -1234,33 +1235,85 @@ async function verifyEd255192(key, sig, msg) {
     return false;
   }
 }
+var SIGNED_FIELDS = [
+  "v",
+  "kind",
+  "did_oc",
+  "event_count",
+  "human_event_count",
+  "lifetime_sats",
+  "distinct_integrator_count",
+  "oldest_event_at",
+  "active_days",
+  "computed_at",
+  "expires_at"
+];
+var COUNTS = [
+  "event_count",
+  "human_event_count",
+  "lifetime_sats",
+  "distinct_integrator_count",
+  "active_days"
+];
+function readSignedAttestation(canonical, id) {
+  const text = new TextDecoder().decode(canonical);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const o = parsed;
+  if (o.v !== 1 || o.kind !== "oc-me-activity" || typeof o.did_oc !== "string") return null;
+  const countsOk = COUNTS.every((k) => {
+    const n = o[k];
+    return typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+  });
+  if (!countsOk) return null;
+  if (o.oldest_event_at !== null && typeof o.oldest_event_at !== "string") return null;
+  if (typeof o.computed_at !== "string" || typeof o.expires_at !== "string") return null;
+  const ordered = Object.fromEntries(SIGNED_FIELDS.map((k) => [k, o[k]]));
+  if (JSON.stringify(ordered) !== text) return null;
+  return { id, ...ordered };
+}
+function sameAttestation(copy, signed) {
+  const c = copy;
+  const v = signed;
+  return ["id", ...SIGNED_FIELDS].every((k) => c[k] === v[k]);
+}
 async function verifyActivityAttestation(bundle, options = {}) {
   const checks = [];
-  const shapeOk = !!bundle && typeof bundle === "object" && typeof bundle.sig === "string" && typeof bundle.kid === "string" && typeof bundle.canonical_b64 === "string" && !!bundle.attestation && typeof bundle.attestation.id === "string" && typeof bundle.attestation.expires_at === "string";
+  const shapeOk = !!bundle && typeof bundle === "object" && typeof bundle.sig === "string" && typeof bundle.kid === "string" && typeof bundle.canonical_b64 === "string" && (bundle.attestation === void 0 || !!bundle.attestation && typeof bundle.attestation === "object");
   checks.push({
     ok: shapeOk,
-    label: "bundle shape \xB7 sig / kid / canonical_b64 / attestation"
+    label: "bundle shape \xB7 sig / kid / canonical_b64"
   });
   if (!shapeOk) {
     return { ok: false, reason: "bundle shape invalid", checks };
   }
-  const a = bundle.attestation;
   const canonical = base64ToBytes(bundle.canonical_b64);
   checks.push({
     ok: canonical !== null,
     label: "canonical_b64 decodes",
     detail: canonical ? `${canonical.length} bytes` : "invalid base64"
   });
-  if (!canonical) return { ok: false, reason: "canonical_b64 invalid base64", checks, attestation: a };
-  const digest = await sha256(canonical);
-  const computedId = bytesToHex(digest);
-  const idOk = computedId === a.id;
+  if (!canonical) return { ok: false, reason: "canonical_b64 invalid base64", checks };
+  const computedId = bytesToHex(await sha256(canonical));
+  const signed = readSignedAttestation(canonical, computedId);
+  checks.push({
+    ok: signed !== null,
+    label: "canonical_bytes are an oc-me-activity attestation in canonical form"
+  });
+  if (!signed) return { ok: false, reason: "canonical bytes are not an activity attestation", checks };
+  const copy = bundle.attestation;
+  const copyOk = copy === void 0 || sameAttestation(copy, signed);
   checks.push({
-    ok: idOk,
-    label: "sha256(canonical_bytes) === id",
-    detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`
+    ok: copyOk,
+    label: "attestation === the signed bytes, id = sha256(canonical_bytes)",
+    detail: copyOk ? computedId : "the readable copy differs from what was signed"
   });
-  if (!idOk) return { ok: false, reason: "id does not match canonical-bytes hash", checks, attestation: a };
+  if (!copyOk) return { ok: false, reason: "attestation does not match the signed bytes", checks };
   let key = null;
   if (options.jwk) {
     if (options.jwk.kid !== bundle.kid) {
@@ -1269,7 +1322,7 @@ async function verifyActivityAttestation(bundle, options = {}) {
         label: "JWK with matching kid present",
         detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`
       });
-      return { ok: false, reason: "kid mismatch with provided jwk", checks, attestation: a };
+      return { ok: false, reason: "kid mismatch with provided jwk", checks };
     }
     try {
       key = await importJWK(options.jwk, "EdDSA");
@@ -1280,7 +1333,7 @@ async function verifyActivityAttestation(bundle, options = {}) {
         label: "JWK with matching kid present",
         detail: `provided jwk failed import: ${err.message}`
       });
-      return { ok: false, reason: "provided jwk failed import", checks, attestation: a };
+      return { ok: false, reason: "provided jwk failed import", checks };
     }
   } else {
     const issuer = options.issuer ?? DEFAULT_ISSUER2;
@@ -1299,7 +1352,7 @@ async function verifyActivityAttestation(bundle, options = {}) {
         detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`
       });
       if (!key) {
-        return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };
+        return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks };
       }
     } catch (err) {
       checks.push({
@@ -1310,8 +1363,7 @@ async function verifyActivityAttestation(bundle, options = {}) {
       return {
         ok: false,
         reason: `envelope JWKS unavailable: ${err.message}`,
-        checks,
-        attestation: a
+        checks
       };
     }
   }
@@ -1322,7 +1374,7 @@ async function verifyActivityAttestation(bundle, options = {}) {
       label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
       detail: "malformed sig (expected hex)"
     });
-    return { ok: false, reason: "malformed sig", checks, attestation: a };
+    return { ok: false, reason: "malformed sig", checks };
   }
   const sigOk = await verifyEd255192(key, sigBytes, canonical);
   checks.push({
@@ -1330,17 +1382,17 @@ async function verifyActivityAttestation(bundle, options = {}) {
     label: "ed25519.verify(sig, canonical_bytes, jwk.public)",
     detail: sigOk ? "signature valid" : "signature does not match"
   });
-  if (!sigOk) return { ok: false, reason: "signature does not match", checks, attestation: a };
+  if (!sigOk) return { ok: false, reason: "signature does not match", checks };
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const expiresMs = Date.parse(a.expires_at);
+  const expiresMs = Date.parse(signed.expires_at);
   const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();
   checks.push({
     ok: freshOk,
     label: "now < attestation.expires_at",
     detail: freshOk ? `expires ${new Date(expiresMs).toISOString()}` : "attestation has expired"
   });
-  if (!freshOk) return { ok: false, reason: "attestation has expired", checks, attestation: a };
-  return { ok: true, attestation: a, checks };
+  if (!freshOk) return { ok: false, reason: "attestation has expired", checks };
+  return { ok: true, attestation: signed, checks };
 }
 async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER2) {
   jwksCache2.delete(issuer);