@orangecheck/me-client 0.32.4 → 0.34.0

package/README.md

@@ -41,8 +41,27 @@ import { signInWithOc } from '@orangecheck/me-client/popup';
 
 const result = await signInWithOc();
 if (result) {
-    // A token bound to your origin. Send it to your server as a Bearer.
-    await fetch('/api/me', { headers: { Authorization: `Bearer ${result.token}` } });
+    // A token bound to your origin. Hand it to your server once; it keeps it
+    // in an httpOnly cookie, out of reach of your page's scripts.
+    await fetch('/api/auth/session', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: result.token }),
+    });
+}
+```
+
+```ts
+// Server · pages/api/auth/session.ts
+import { verifyOcToken } from '@orangecheck/me-client/server';
+
+export default async function session(req, res) {
+    const token = String(req.body?.token ?? '');
+    const s = await verifyOcToken(token, { audience: 'https://your-site.example' });
+    if (!s) return res.status(401).json({ ok: false });
+    const maxAge = (s.exp ?? 0) - Math.floor(Date.now() / 1000);
+    res.setHeader('Set-Cookie', `oc_session=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`);
+    res.status(200).json({ ok: true });
 }
 ```
 
@@ -228,6 +247,10 @@ app.get('/api/me', (c) => {
 
 `getOcSession(headers)` is the framework-agnostic primitive: pass a Web `Headers` object or a plain `{ cookie, authorization }` object. Cookie auth (family `*.ochk.io`) and Bearer auth (cross-domain) are handled identically.
 
+### Sessions ended everywhere
+
+Set `OC_PROJECT_KEY` and `OC_SIGNING_SECRET` (from ochk.app/me/projects) and `getOcSession`, `withOcAuth`, `ocAuthExpress` and `ocAuthHono` refuse a session the person ended everywhere: sign out everywhere, a passkey removed, the account deleted. They read those account cutoffs from me.ochk.io once a minute, with a request signed by your secret, so a refusal lands within about two minutes. If me.ochk.io can't be reached, reads go on and writes are refused until it can. Without the two variables, a token is checked by its signature alone and stays valid until it expires.
+
 ## Browser popup signin
 
 ```tsx
@@ -236,10 +259,14 @@ import { signInWithOc } from '@orangecheck/me-client/popup';
 button.addEventListener('click', async () => {
     const result = await signInWithOc();
     if (!result) return; // user cancelled or popup blocked
-    // Cross-domain integrators only — same-origin family integrators
-    // (.ochk.io) skip this; the cookie rides automatically.
-    localStorage.setItem('oc-token', result.token);
-    location.assign('/dashboard');
+    // Your server verifies it and keeps it in an httpOnly cookie. Not
+    // localStorage: any script on the page could read it there.
+    const r = await fetch('/api/auth/session', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: result.token }),
+    });
+    if (r.ok) location.assign('/dashboard');
 });
 ```
 

package/dist/{identity-6pjtyKYh.d.mts → identity-DfxCvxuH.d.mts}

@@ -41,6 +41,7 @@ interface VerifyActivityOptions {
     issuer?: string;
     jwk?: OcEnvelopePublicJwk;
     jwksCacheTtlMs?: number;
+    jwksMaxStaleMs?: number;
     now?: Date;
 }
 declare function verifyActivityAttestation(bundle: ActivityAttestationBundle, options?: VerifyActivityOptions): Promise<ActivityVerifyResult>;

package/dist/{identity-6pjtyKYh.d.ts → identity-DfxCvxuH.d.ts}

@@ -41,6 +41,7 @@ interface VerifyActivityOptions {
     issuer?: string;
     jwk?: OcEnvelopePublicJwk;
     jwksCacheTtlMs?: number;
+    jwksMaxStaleMs?: number;
     now?: Date;
 }
 declare function verifyActivityAttestation(bundle: ActivityAttestationBundle, options?: VerifyActivityOptions): Promise<ActivityVerifyResult>;

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-6pjtyKYh.mjs';
-export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-6pjtyKYh.mjs';
+import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-DfxCvxuH.mjs';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-DfxCvxuH.mjs';
 import { B as BillableEvent, E as EventKey, I as IntegratorPriceConfig, T as TelemetryEvent, S as SignInOptions, a as Session, P as PaymentAuthorizeOptions, b as PaymentResult, V as ValidationResult, f as fromTemplate, g as getArchetypeTemplate, A as ArchetypeTemplate, F as Federation } from './integrator-C-enR55c.mjs';
 export { c as ALL_EVENT_SUBTYPES, d as ARCHETYPE_TEMPLATES, e as AgentClassOverride, h as AttestTier, C as ClassASubtype, i as ClassBSubtype, j as ClassCSubtype, k as ComputedFees, D as DropCadence, l as DropClosedWebhookPayload, m as DropResponseBlock, n as DropScheduleSummary, o as EVENT_SUBTYPES, p as EventClass, q as EventSubtype, r as EventSubtypeMetadata, s as FederationStatus, t as IntegratorArchetype, u as IntegratorEventConfig, M as MAX_DROP_WINDOW_DAYS, v as MIN_INTEGRATOR_PRICE_SATS, w as PLATFORM_FEE_POLICY, x as SessionPolicy, y as SigningMethod, z as SiteFeeShape, G as SystemWebhookPayload, W as WebhookHeaders, H as WebhookPayload, J as computeFees, K as subtypesForClass, L as validateIntegratorConfig } from './integrator-C-enR55c.mjs';
 
@@ -69,6 +69,7 @@ interface VerifyOptions {
     issuer?: string;
     jwk?: OcPublicJwk;
     jwksCacheTtlMs?: number;
+    jwksMaxStaleMs?: number;
 }
 declare function verify$1(rawBody: string | Uint8Array, sigHex: string | null | undefined, kid: string | null | undefined, options?: VerifyOptions): Promise<VerifyResult>;
 declare function fetchJwksForce(issuer?: string): Promise<void>;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-6pjtyKYh.js';
-export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-6pjtyKYh.js';
+import { v as verifyActivityAttestation, r as refreshEnvelopeJwks } from './identity-DfxCvxuH.js';
+export { A as ActivityAttestation, a as ActivityAttestationBundle, b as ActivityVerifyCheck, c as ActivityVerifyResult, V as VerifyActivityOptions, i as identity } from './identity-DfxCvxuH.js';
 import { B as BillableEvent, E as EventKey, I as IntegratorPriceConfig, T as TelemetryEvent, S as SignInOptions, a as Session, P as PaymentAuthorizeOptions, b as PaymentResult, V as ValidationResult, f as fromTemplate, g as getArchetypeTemplate, A as ArchetypeTemplate, F as Federation } from './integrator-C-enR55c.js';
 export { c as ALL_EVENT_SUBTYPES, d as ARCHETYPE_TEMPLATES, e as AgentClassOverride, h as AttestTier, C as ClassASubtype, i as ClassBSubtype, j as ClassCSubtype, k as ComputedFees, D as DropCadence, l as DropClosedWebhookPayload, m as DropResponseBlock, n as DropScheduleSummary, o as EVENT_SUBTYPES, p as EventClass, q as EventSubtype, r as EventSubtypeMetadata, s as FederationStatus, t as IntegratorArchetype, u as IntegratorEventConfig, M as MAX_DROP_WINDOW_DAYS, v as MIN_INTEGRATOR_PRICE_SATS, w as PLATFORM_FEE_POLICY, x as SessionPolicy, y as SigningMethod, z as SiteFeeShape, G as SystemWebhookPayload, W as WebhookHeaders, H as WebhookPayload, J as computeFees, K as subtypesForClass, L as validateIntegratorConfig } from './integrator-C-enR55c.js';
 
@@ -69,6 +69,7 @@ interface VerifyOptions {
     issuer?: string;
     jwk?: OcPublicJwk;
     jwksCacheTtlMs?: number;
+    jwksMaxStaleMs?: number;
 }
 declare function verify$1(rawBody: string | Uint8Array, sigHex: string | null | undefined, kid: string | null | undefined, options?: VerifyOptions): Promise<VerifyResult>;
 declare function fetchJwksForce(issuer?: string): Promise<void>;