@orangecheck/me-client 0.35.0 → 0.36.1

package/README.md

@@ -270,7 +270,18 @@ button.addEventListener('click', async () => {
 });
 ```
 
-`signInWithOc()` MUST be called inside a user-gesture handler (browsers block `window.open` outside of gestures). Returns `{ account, token }` on success, `null` on cancel / popup block / abort. Pins both `event.origin` AND `event.source === popup` on the postMessage handler so a same-origin attacker can't settle the promise.
+`signInWithOc()` MUST be called inside a user-gesture handler (browsers block `window.open` outside of gestures). Returns `{ account, token }` on success, `null` on cancel / popup block / abort.
+
+To tell those apart, `signInWithOcOutcome()` (0.36.0 or later) resolves with a `status`:
+
+```ts
+import { signInWithOcOutcome } from '@orangecheck/me-client/popup';
+
+const outcome = await signInWithOcOutcome();
+if (outcome.status === 'blocked') showHint('Allow pop-ups for this site, then try again.');
+if (outcome.status === 'signed_in') await keepSession(outcome.token);
+// 'closed' (the person closed the window), 'aborted' (your signal), 'failed' (not a browser, or a malformed answer)
+``` Pins both `event.origin` AND `event.source === popup` on the postMessage handler so a same-origin attacker can't settle the promise.
 
 ## Custom origin
 

package/dist/popup.d.mts

@@ -20,6 +20,18 @@ interface SignInWithOcOptions {
     features?: string;
     signal?: AbortSignal;
 }
+type OcPopupOutcome = ({
+    status: 'signed_in';
+} & OcPopupResult) | {
+    status: 'blocked';
+} | {
+    status: 'closed';
+} | {
+    status: 'aborted';
+} | {
+    status: 'failed';
+};
+declare function signInWithOcOutcome(options?: SignInWithOcOptions): Promise<OcPopupOutcome>;
 declare function signInWithOc(options?: SignInWithOcOptions): Promise<OcPopupResult | null>;
 
-export { type OcPopupAccount, type OcPopupResult, type SignInWithOcOptions, signInWithOc };
+export { type OcPopupAccount, type OcPopupOutcome, type OcPopupResult, type SignInWithOcOptions, signInWithOc, signInWithOcOutcome };

package/dist/popup.d.ts

@@ -20,6 +20,18 @@ interface SignInWithOcOptions {
     features?: string;
     signal?: AbortSignal;
 }
+type OcPopupOutcome = ({
+    status: 'signed_in';
+} & OcPopupResult) | {
+    status: 'blocked';
+} | {
+    status: 'closed';
+} | {
+    status: 'aborted';
+} | {
+    status: 'failed';
+};
+declare function signInWithOcOutcome(options?: SignInWithOcOptions): Promise<OcPopupOutcome>;
 declare function signInWithOc(options?: SignInWithOcOptions): Promise<OcPopupResult | null>;
 
-export { type OcPopupAccount, type OcPopupResult, type SignInWithOcOptions, signInWithOc };
+export { type OcPopupAccount, type OcPopupOutcome, type OcPopupResult, type SignInWithOcOptions, signInWithOc, signInWithOcOutcome };

package/dist/popup.js

@@ -4,20 +4,20 @@
 var DEFAULT_POPUP_ORIGIN = "https://me.ochk.io";
 var DEFAULT_POPUP_PATH = "/popup/signin";
 var DEFAULT_FEATURES = "width=480,height=720,resizable=yes,scrollbars=yes";
-function signInWithOc(options = {}) {
+function signInWithOcOutcome(options = {}) {
   const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;
   const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;
   const features = options.features ?? DEFAULT_FEATURES;
   return new Promise((resolve) => {
     if (typeof window === "undefined") {
-      resolve(null);
+      resolve({ status: "failed" });
       return;
     }
     const url = new URL(popupPath, popupOrigin);
     url.searchParams.set("opener_origin", window.location.origin);
     const popup = window.open(url.toString(), "oc-signin", features);
     if (!popup) {
-      resolve(null);
+      resolve({ status: "blocked" });
       return;
     }
     popup.focus();
@@ -43,28 +43,33 @@ function signInWithOc(options = {}) {
       const data = event.data;
       if (!data || data.type !== "oc-signin-success") return;
       if (!data.account || !data.token) {
-        settle(null);
+        settle({ status: "failed" });
         return;
       }
-      settle({ account: data.account, token: data.token });
+      settle({ status: "signed_in", account: data.account, token: data.token });
     }
     function onAbort() {
-      settle(null);
+      settle({ status: "aborted" });
     }
     window.addEventListener("message", onMessage);
     if (options.signal) {
       if (options.signal.aborted) {
-        settle(null);
+        settle({ status: "aborted" });
         return;
       }
       options.signal.addEventListener("abort", onAbort);
     }
     const closedTimer = setInterval(() => {
-      if (popup && popup.closed) settle(null);
+      if (popup && popup.closed) settle({ status: "closed" });
     }, 500);
   });
 }
+async function signInWithOc(options = {}) {
+  const outcome = await signInWithOcOutcome(options);
+  return outcome.status === "signed_in" ? { account: outcome.account, token: outcome.token } : null;
+}
 
 exports.signInWithOc = signInWithOc;
+exports.signInWithOcOutcome = signInWithOcOutcome;
 //# sourceMappingURL=popup.js.map
 //# sourceMappingURL=popup.js.map

package/dist/popup.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";;;AA0BA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA4DlB,SAAS,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AAC3F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AAGR,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAA6B;AACzC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAE9B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IACvD;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,IAAI,CAAA;AAAA,IAC1C,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL","file":"popup.js","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (!result) return;\n *       // Your server verifies it and keeps it in an httpOnly cookie.\n *       const r = await fetch('/api/auth/session', {\n *           method: 'POST',\n *           headers: { 'Content-Type': 'application/json' },\n *           body: JSON.stringify({ token: result.token }),\n *       });\n *       if (r.ok) location.assign('/app');\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    /** Opaque public identity · `did:oc:<32-hex>`. Stable across linking\n     *  events. The canonical identifier post auth-refactor (Dec 2025\n     *  +). */\n    did_oc?: string;\n    /** Primary linked Bitcoin address, if the user has one and is\n     *  surfacing it (same-origin family integrators get it inline;\n     *  cross-domain integrators need the bitcoin_address scope). */\n    primary_btc?: string | null;\n    /** Whether the user has a primary email linked (plaintext stays\n     *  on auth host; only the boolean reaches integrators). */\n    has_email?: boolean;\n    /** Legacy fields kept for back-compat with pre-refactor consumers.\n     *  Prefer did_oc + primary_btc. Removed in a future major. */\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host, unsigned: trust only the\n     *  verified token. `did_oc` is the account's opaque identifier, the\n     *  same at every site; the email and Bitcoin address stay private\n     *  unless the user grants a scope. */\n    account: OcPopupAccount;\n    /** The session JWT, bound to your origin. Hand it once to your own\n     *  server, which verifies it and keeps it in an httpOnly cookie; never\n     *  in localStorage, where any script on the page can read it. Family\n     *  sites (*.ochk.io) can ignore it: the Domain=.ochk.io cookie rides\n     *  home on its own. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, or if\n * the AbortSignal fired.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve(null);\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            // Popup blocked. Caller can detect a null result and fall\n            // back to a full-page redirect if desired.\n            resolve(null);\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupResult | null) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                // Malformed payload — treat as not-signed-in.\n                settle(null);\n                return;\n            }\n            settle({ account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle(null);\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle(null);\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the user closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle(null);\n        }, 500);\n    });\n}\n"]}
+{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";;;AA0BA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA2ElB,SAAS,mBAAA,CAAoB,OAAA,GAA+B,EAAC,EAA4B;AAC5F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC5B,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,OAAA,CAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAC7B,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAAuB;AACnC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAC9B,QAAA,MAAA,CAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC3B,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,QAAQ,WAAA,EAAa,OAAA,EAAS,KAAK,OAAA,EAAS,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA;AAAA,IAC5E;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAAA,IAChC;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAC5B,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,SAAS,KAAA,CAAM,MAAA,SAAe,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,IAC1D,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL;AAWA,eAAsB,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AACjG,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB,OAAO,CAAA;AACjD,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,WAAA,GAAc,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAS,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,IAAA;AACjG","file":"popup.js","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (!result) return;\n *       // Your server verifies it and keeps it in an httpOnly cookie.\n *       const r = await fetch('/api/auth/session', {\n *           method: 'POST',\n *           headers: { 'Content-Type': 'application/json' },\n *           body: JSON.stringify({ token: result.token }),\n *       });\n *       if (r.ok) location.assign('/app');\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    /** Opaque public identity · `did:oc:<32-hex>`. Stable across linking\n     *  events. The canonical identifier post auth-refactor (Dec 2025\n     *  +). */\n    did_oc?: string;\n    /** Primary linked Bitcoin address, if the user has one and is\n     *  surfacing it (same-origin family integrators get it inline;\n     *  cross-domain integrators need the bitcoin_address scope). */\n    primary_btc?: string | null;\n    /** Whether the user has a primary email linked (plaintext stays\n     *  on auth host; only the boolean reaches integrators). */\n    has_email?: boolean;\n    /** Legacy fields kept for back-compat with pre-refactor consumers.\n     *  Prefer did_oc + primary_btc. Removed in a future major. */\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host, unsigned: trust only the\n     *  verified token. `did_oc` is the account's opaque identifier, the\n     *  same at every site; the email and Bitcoin address stay private\n     *  unless the user grants a scope. */\n    account: OcPopupAccount;\n    /** The session JWT, bound to your origin. Hand it once to your own\n     *  server, which verifies it and keeps it in an httpOnly cookie; never\n     *  in localStorage, where any script on the page can read it. Family\n     *  sites (*.ochk.io) can ignore it: the Domain=.ochk.io cookie rides\n     *  home on its own. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * How a sign-in popup ended:\n *   - `signed_in` · the person signed in; `account` and `token` as from signInWithOc.\n *   - `blocked`   · the browser refused to open the window. Ask the person to\n *                   allow pop-ups for your site, then try again from a click.\n *   - `closed`    · the person closed the window without signing in.\n *   - `aborted`   · your AbortSignal fired.\n *   - `failed`    · not in a browser, or the popup's answer was malformed.\n */\nexport type OcPopupOutcome =\n    | ({ status: 'signed_in' } & OcPopupResult)\n    | { status: 'blocked' }\n    | { status: 'closed' }\n    | { status: 'aborted' }\n    | { status: 'failed' };\n\n/**\n * Open the OC signin popup and resolve with how it ended (OcPopupOutcome),\n * so a blocked window and a closed one can be told apart.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOcOutcome(options: SignInWithOcOptions = {}): Promise<OcPopupOutcome> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve({ status: 'failed' });\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            resolve({ status: 'blocked' });\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupOutcome) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                settle({ status: 'failed' });\n                return;\n            }\n            settle({ status: 'signed_in', account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle({ status: 'aborted' });\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle({ status: 'aborted' });\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the person closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle({ status: 'closed' });\n        }, 500);\n    });\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, if the\n * browser blocked it, or if the AbortSignal fired. To tell those apart,\n * use signInWithOcOutcome.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport async function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const outcome = await signInWithOcOutcome(options);\n    return outcome.status === 'signed_in' ? { account: outcome.account, token: outcome.token } : null;\n}\n"]}

package/dist/popup.mjs

@@ -2,20 +2,20 @@
 var DEFAULT_POPUP_ORIGIN = "https://me.ochk.io";
 var DEFAULT_POPUP_PATH = "/popup/signin";
 var DEFAULT_FEATURES = "width=480,height=720,resizable=yes,scrollbars=yes";
-function signInWithOc(options = {}) {
+function signInWithOcOutcome(options = {}) {
   const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;
   const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;
   const features = options.features ?? DEFAULT_FEATURES;
   return new Promise((resolve) => {
     if (typeof window === "undefined") {
-      resolve(null);
+      resolve({ status: "failed" });
       return;
     }
     const url = new URL(popupPath, popupOrigin);
     url.searchParams.set("opener_origin", window.location.origin);
     const popup = window.open(url.toString(), "oc-signin", features);
     if (!popup) {
-      resolve(null);
+      resolve({ status: "blocked" });
       return;
     }
     popup.focus();
@@ -41,28 +41,32 @@ function signInWithOc(options = {}) {
       const data = event.data;
       if (!data || data.type !== "oc-signin-success") return;
       if (!data.account || !data.token) {
-        settle(null);
+        settle({ status: "failed" });
         return;
       }
-      settle({ account: data.account, token: data.token });
+      settle({ status: "signed_in", account: data.account, token: data.token });
     }
     function onAbort() {
-      settle(null);
+      settle({ status: "aborted" });
     }
     window.addEventListener("message", onMessage);
     if (options.signal) {
       if (options.signal.aborted) {
-        settle(null);
+        settle({ status: "aborted" });
         return;
       }
       options.signal.addEventListener("abort", onAbort);
     }
     const closedTimer = setInterval(() => {
-      if (popup && popup.closed) settle(null);
+      if (popup && popup.closed) settle({ status: "closed" });
     }, 500);
   });
 }
+async function signInWithOc(options = {}) {
+  const outcome = await signInWithOcOutcome(options);
+  return outcome.status === "signed_in" ? { account: outcome.account, token: outcome.token } : null;
+}
 
-export { signInWithOc };
+export { signInWithOc, signInWithOcOutcome };
 //# sourceMappingURL=popup.mjs.map
 //# sourceMappingURL=popup.mjs.map

package/dist/popup.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";AA0BA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA4DlB,SAAS,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AAC3F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AAGR,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAA6B;AACzC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAE9B,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA;AAAA,IACvD;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,IAAI,CAAA;AAAA,IACf;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,IAAI,CAAA;AACX,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,IAAI,CAAA;AAAA,IAC1C,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL","file":"popup.mjs","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (!result) return;\n *       // Your server verifies it and keeps it in an httpOnly cookie.\n *       const r = await fetch('/api/auth/session', {\n *           method: 'POST',\n *           headers: { 'Content-Type': 'application/json' },\n *           body: JSON.stringify({ token: result.token }),\n *       });\n *       if (r.ok) location.assign('/app');\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    /** Opaque public identity · `did:oc:<32-hex>`. Stable across linking\n     *  events. The canonical identifier post auth-refactor (Dec 2025\n     *  +). */\n    did_oc?: string;\n    /** Primary linked Bitcoin address, if the user has one and is\n     *  surfacing it (same-origin family integrators get it inline;\n     *  cross-domain integrators need the bitcoin_address scope). */\n    primary_btc?: string | null;\n    /** Whether the user has a primary email linked (plaintext stays\n     *  on auth host; only the boolean reaches integrators). */\n    has_email?: boolean;\n    /** Legacy fields kept for back-compat with pre-refactor consumers.\n     *  Prefer did_oc + primary_btc. Removed in a future major. */\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host, unsigned: trust only the\n     *  verified token. `did_oc` is the account's opaque identifier, the\n     *  same at every site; the email and Bitcoin address stay private\n     *  unless the user grants a scope. */\n    account: OcPopupAccount;\n    /** The session JWT, bound to your origin. Hand it once to your own\n     *  server, which verifies it and keeps it in an httpOnly cookie; never\n     *  in localStorage, where any script on the page can read it. Family\n     *  sites (*.ochk.io) can ignore it: the Domain=.ochk.io cookie rides\n     *  home on its own. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, or if\n * the AbortSignal fired.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve(null);\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            // Popup blocked. Caller can detect a null result and fall\n            // back to a full-page redirect if desired.\n            resolve(null);\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupResult | null) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                // Malformed payload — treat as not-signed-in.\n                settle(null);\n                return;\n            }\n            settle({ account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle(null);\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle(null);\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the user closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle(null);\n        }, 500);\n    });\n}\n"]}
+{"version":3,"sources":["../src/popup.ts"],"names":[],"mappings":";AA0BA,IAAM,oBAAA,GAAuB,oBAAA;AAC7B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAM,gBAAA,GAAmB,mDAAA;AA2ElB,SAAS,mBAAA,CAAoB,OAAA,GAA+B,EAAC,EAA4B;AAC5F,EAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,oBAAA;AAC3C,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AAErC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC5B,IAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,MAAA,OAAA,CAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC5B,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAA,EAAW,WAAW,CAAA;AAC1C,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAA,CAAO,SAAS,MAAM,CAAA;AAC5D,IAAA,MAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,EAAS,EAAG,aAAa,QAAQ,CAAA;AAC/D,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,OAAA,CAAQ,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAC7B,MAAA;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,KAAA,EAAM;AAEZ,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,MAAM,UAAU,MAAM;AAClB,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAC/C,MAAA,aAAA,CAAc,WAAW,CAAA;AACzB,MAAA,IAAI,QAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC3E,CAAA;AAEA,IAAA,SAAS,OAAO,KAAA,EAAuB;AACnC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI;AACA,QAAA,IAAI,KAAA,IAAS,CAAC,KAAA,CAAM,MAAA,QAAc,KAAA,EAAM;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,IACjB;AAEA,IAAA,SAAS,UAAU,KAAA,EAAqB;AAKpC,MAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,MAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC5B,MAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,MAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,IAAA,KAAS,mBAAA,EAAqB;AAChD,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,KAAA,EAAO;AAC9B,QAAA,MAAA,CAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAC3B,QAAA;AAAA,MACJ;AACA,MAAA,MAAA,CAAO,EAAE,QAAQ,WAAA,EAAa,OAAA,EAAS,KAAK,OAAA,EAAS,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA;AAAA,IAC5E;AAEA,IAAA,SAAS,OAAA,GAAU;AACf,MAAA,MAAA,CAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAAA,IAChC;AAEA,IAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAC5C,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAChB,MAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AACxB,QAAA,MAAA,CAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAC5B,QAAA;AAAA,MACJ;AACA,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,MAAM,WAAA,GAAc,YAAY,MAAM;AAClC,MAAA,IAAI,SAAS,KAAA,CAAM,MAAA,SAAe,EAAE,MAAA,EAAQ,UAAU,CAAA;AAAA,IAC1D,GAAG,GAAG,CAAA;AAAA,EACV,CAAC,CAAA;AACL;AAWA,eAAsB,YAAA,CAAa,OAAA,GAA+B,EAAC,EAAkC;AACjG,EAAA,MAAM,OAAA,GAAU,MAAM,mBAAA,CAAoB,OAAO,CAAA;AACjD,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,WAAA,GAAc,EAAE,OAAA,EAAS,QAAQ,OAAA,EAAS,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,IAAA;AACjG","file":"popup.mjs","sourcesContent":["/**\n * @orangecheck/me-client/popup\n *\n * Browser-side helper that opens the OC sign-in popup, listens for the\n * postMessage from me.ochk.io, and resolves with the verified session.\n *\n *   import { signInWithOc } from '@orangecheck/me-client/popup';\n *\n *   document.querySelector('#oc-signin')!.addEventListener('click', async () => {\n *       const result = await signInWithOc();\n *       if (!result) return;\n *       // Your server verifies it and keeps it in an httpOnly cookie.\n *       const r = await fetch('/api/auth/session', {\n *           method: 'POST',\n *           headers: { 'Content-Type': 'application/json' },\n *           body: JSON.stringify({ token: result.token }),\n *       });\n *       if (r.ok) location.assign('/app');\n *   });\n *\n * Why this lives in a separate entry point: it's browser-only (uses\n * window.open / addEventListener) and integrators that only need the\n * server-side verifier shouldn't pull popup orchestration into their\n * server bundle.\n */\n\nconst DEFAULT_POPUP_ORIGIN = 'https://me.ochk.io';\nconst DEFAULT_POPUP_PATH = '/popup/signin';\nconst DEFAULT_FEATURES = 'width=480,height=720,resizable=yes,scrollbars=yes';\n\nexport interface OcPopupAccount {\n    id?: string;\n    /** Opaque public identity · `did:oc:<32-hex>`. Stable across linking\n     *  events. The canonical identifier post auth-refactor (Dec 2025\n     *  +). */\n    did_oc?: string;\n    /** Primary linked Bitcoin address, if the user has one and is\n     *  surfacing it (same-origin family integrators get it inline;\n     *  cross-domain integrators need the bitcoin_address scope). */\n    primary_btc?: string | null;\n    /** Whether the user has a primary email linked (plaintext stays\n     *  on auth host; only the boolean reaches integrators). */\n    has_email?: boolean;\n    /** Legacy fields kept for back-compat with pre-refactor consumers.\n     *  Prefer did_oc + primary_btc. Removed in a future major. */\n    address?: string;\n    btc_address?: string;\n    display_name?: string | null;\n    nostr_npub?: string | null;\n    wallet_provisioned?: boolean;\n    email?: string;\n}\n\nexport interface OcPopupResult {\n    /** Account payload from the auth host, unsigned: trust only the\n     *  verified token. `did_oc` is the account's opaque identifier, the\n     *  same at every site; the email and Bitcoin address stay private\n     *  unless the user grants a scope. */\n    account: OcPopupAccount;\n    /** The session JWT, bound to your origin. Hand it once to your own\n     *  server, which verifies it and keeps it in an httpOnly cookie; never\n     *  in localStorage, where any script on the page can read it. Family\n     *  sites (*.ochk.io) can ignore it: the Domain=.ochk.io cookie rides\n     *  home on its own. */\n    token: string;\n}\n\nexport interface SignInWithOcOptions {\n    /** Origin of the OC popup page. Defaults to https://me.ochk.io.\n     *  Override only for staging / preview environments. */\n    popupOrigin?: string;\n    /** Path on the popup origin. Defaults to /popup/signin. */\n    popupPath?: string;\n    /** window.open features string. Defaults to a 480x720 resizable\n     *  popup with scrollbars. */\n    features?: string;\n    /** AbortSignal that cancels the wait and closes the popup. */\n    signal?: AbortSignal;\n}\n\n/**\n * How a sign-in popup ended:\n *   - `signed_in` · the person signed in; `account` and `token` as from signInWithOc.\n *   - `blocked`   · the browser refused to open the window. Ask the person to\n *                   allow pop-ups for your site, then try again from a click.\n *   - `closed`    · the person closed the window without signing in.\n *   - `aborted`   · your AbortSignal fired.\n *   - `failed`    · not in a browser, or the popup's answer was malformed.\n */\nexport type OcPopupOutcome =\n    | ({ status: 'signed_in' } & OcPopupResult)\n    | { status: 'blocked' }\n    | { status: 'closed' }\n    | { status: 'aborted' }\n    | { status: 'failed' };\n\n/**\n * Open the OC signin popup and resolve with how it ended (OcPopupOutcome),\n * so a blocked window and a closed one can be told apart.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport function signInWithOcOutcome(options: SignInWithOcOptions = {}): Promise<OcPopupOutcome> {\n    const popupOrigin = options.popupOrigin ?? DEFAULT_POPUP_ORIGIN;\n    const popupPath = options.popupPath ?? DEFAULT_POPUP_PATH;\n    const features = options.features ?? DEFAULT_FEATURES;\n\n    return new Promise((resolve) => {\n        if (typeof window === 'undefined') {\n            resolve({ status: 'failed' });\n            return;\n        }\n\n        const url = new URL(popupPath, popupOrigin);\n        url.searchParams.set('opener_origin', window.location.origin);\n        const popup = window.open(url.toString(), 'oc-signin', features);\n        if (!popup) {\n            resolve({ status: 'blocked' });\n            return;\n        }\n        popup.focus();\n\n        let settled = false;\n        const cleanup = () => {\n            window.removeEventListener('message', onMessage);\n            clearInterval(closedTimer);\n            if (options.signal) options.signal.removeEventListener('abort', onAbort);\n        };\n\n        function settle(value: OcPopupOutcome) {\n            if (settled) return;\n            settled = true;\n            cleanup();\n            try {\n                if (popup && !popup.closed) popup.close();\n            } catch {\n                /* popup may have closed itself first */\n            }\n            resolve(value);\n        }\n\n        function onMessage(event: MessageEvent) {\n            // Origin pinning is necessary but not sufficient — same-origin\n            // pages other than our popup can post the same shape. Pin both\n            // origin AND source window so only the popup we opened can\n            // settle this promise.\n            if (event.origin !== popupOrigin) return;\n            if (event.source !== popup) return;\n            const data = event.data as\n                | { type?: string; account?: OcPopupAccount; token?: string }\n                | null;\n            if (!data || data.type !== 'oc-signin-success') return;\n            if (!data.account || !data.token) {\n                settle({ status: 'failed' });\n                return;\n            }\n            settle({ status: 'signed_in', account: data.account, token: data.token });\n        }\n\n        function onAbort() {\n            settle({ status: 'aborted' });\n        }\n\n        window.addEventListener('message', onMessage);\n        if (options.signal) {\n            if (options.signal.aborted) {\n                settle({ status: 'aborted' });\n                return;\n            }\n            options.signal.addEventListener('abort', onAbort);\n        }\n\n        // Detect the person closing the popup without completing signin.\n        const closedTimer = setInterval(() => {\n            if (popup && popup.closed) settle({ status: 'closed' });\n        }, 500);\n    });\n}\n\n/**\n * Open the OC signin popup and resolve with the session result. Returns\n * `null` if the user closed the popup without completing signin, if the\n * browser blocked it, or if the AbortSignal fired. To tell those apart,\n * use signInWithOcOutcome.\n *\n * MUST be called inside a user-gesture handler (e.g. a button onClick).\n * Browsers block `window.open` outside of user gestures.\n */\nexport async function signInWithOc(options: SignInWithOcOptions = {}): Promise<OcPopupResult | null> {\n    const outcome = await signInWithOcOutcome(options);\n    return outcome.status === 'signed_in' ? { account: outcome.account, token: outcome.token } : null;\n}\n"]}

package/dist/server.d.mts

@@ -5,6 +5,7 @@ export { A as ActivityAttestation, a as ActivityAttestationBundle, b as Activity
 interface OcSessionOptions extends VerifyOcOptions {
     method?: string;
     projectKey?: string;
+    meOrigin?: string;
     revocation?: RevocationCheck | false;
 }
 declare function _resetSessionChecksForTests(): void;
@@ -34,7 +35,6 @@ interface WithOcAuthOptions extends OcSessionOptions {
         maxAgeSecs?: number;
     };
     projectKey?: string;
-    meOrigin?: string;
 }
 declare const BACK_ACCOUNT_URL = "https://ochk.app/me/account#backing";
 declare function withOcAuth<Req extends NextApiRequestLike = NextApiRequestLike, Res extends NextApiResponseLike = NextApiResponseLike>(handler: (req: WithOcSession<Req>, res: Res) => unknown, options?: WithOcAuthOptions): (req: Req, res: Res) => Promise<unknown>;

package/dist/server.d.ts

@@ -5,6 +5,7 @@ export { A as ActivityAttestation, a as ActivityAttestationBundle, b as Activity
 interface OcSessionOptions extends VerifyOcOptions {
     method?: string;
     projectKey?: string;
+    meOrigin?: string;
     revocation?: RevocationCheck | false;
 }
 declare function _resetSessionChecksForTests(): void;
@@ -34,7 +35,6 @@ interface WithOcAuthOptions extends OcSessionOptions {
         maxAgeSecs?: number;
     };
     projectKey?: string;
-    meOrigin?: string;
 }
 declare const BACK_ACCOUNT_URL = "https://ochk.app/me/account#backing";
 declare function withOcAuth<Req extends NextApiRequestLike = NextApiRequestLike, Res extends NextApiResponseLike = NextApiResponseLike>(handler: (req: WithOcSession<Req>, res: Res) => unknown, options?: WithOcAuthOptions): (req: Req, res: Res) => Promise<unknown>;

package/dist/server.js

@@ -575,11 +575,14 @@ var warnedUnchecked = false;
 function revocationFor(options) {
   if (options.revocation === false) return null;
   if (options.revocation) return options.revocation;
-  const key = options.projectKey ?? "";
+  const key = `${options.meOrigin ?? ""} ${options.projectKey ?? ""}`;
   if (!sessionChecks.has(key)) {
     sessionChecks.set(
       key,
-      authCore.integratorRevocationCheck(options.projectKey ? { projectKey: options.projectKey } : {})
+      authCore.integratorRevocationCheck({
+        ...options.projectKey ? { projectKey: options.projectKey } : {},
+        ...options.meOrigin ? { meOrigin: options.meOrigin } : {}
+      })
     );
   }
   const check = sessionChecks.get(key);
@@ -636,38 +639,49 @@ var unknownKeys = /* @__PURE__ */ new Map();
 var UNKNOWN_PROJECT = /* @__PURE__ */ Symbol("unknown_project");
 var POLICY_TTL_MS = 6e4;
 var POLICY_RETRY_MS = 1e4;
+var POLICY_MAX_STALE_MS = 6e5;
 var policies = /* @__PURE__ */ new Map();
+var isFloor = (n) => Number.isSafeInteger(n) && n >= 0;
+function readRequirement(body) {
+  const b = body;
+  if (!b || typeof b !== "object" || b.ok !== true || !("require_bond" in b)) return void 0;
+  if (b.require_bond === null) return null;
+  const r = b.require_bond;
+  if (!r || typeof r !== "object" || !isFloor(r.min_sats) || !isFloor(r.min_days)) return void 0;
+  return { minSats: r.min_sats, minDays: r.min_days };
+}
 async function projectRequirement(options) {
+  const base = (options.meOrigin ?? "https://me.ochk.io").replace(/\/$/, "");
   const key = options.projectKey;
-  const hit = policies.get(key);
+  const slot = `${base} ${key}`;
+  const hit = policies.get(slot);
   const now = Date.now();
-  if (unknownKeys.has(key) && now - unknownKeys.get(key) < POLICY_TTL_MS) return UNKNOWN_PROJECT;
+  const standing = () => hit?.at && now - hit.at < POLICY_MAX_STALE_MS ? hit.need : void 0;
+  if (unknownKeys.has(slot) && now - unknownKeys.get(slot) < POLICY_TTL_MS) return UNKNOWN_PROJECT;
   if (hit && now - hit.at < POLICY_TTL_MS) return hit.need;
-  if (hit?.failedAt && now - hit.failedAt < POLICY_RETRY_MS) return hit.at ? hit.need : void 0;
+  if (hit?.failedAt && now - hit.failedAt < POLICY_RETRY_MS) return standing();
   try {
-    const base = options.meOrigin ?? "https://me.ochk.io";
     const r = await fetch(`${base}/api/integrator/${encodeURIComponent(key)}/sign-in`, {
       signal: AbortSignal.timeout(4e3)
     });
     if (r.status === 404) {
-      if (!unknownKeys.has(key)) {
+      if (!unknownKeys.has(slot)) {
         console.error(
           `[@orangecheck/me-client] projectKey "${key}" is not a project. Copy yours from https://ochk.app/me/projects.`
         );
       }
-      unknownKeys.set(key, Date.now());
+      unknownKeys.set(slot, Date.now());
       return UNKNOWN_PROJECT;
     }
-    unknownKeys.delete(key);
+    unknownKeys.delete(slot);
     if (!r.ok) throw new Error(`HTTP ${r.status}`);
-    const j = await r.json();
-    const req = j.require_bond ?? null;
-    const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;
-    policies.set(key, { at: Date.now(), need });
+    const need = readRequirement(await r.json());
+    if (need === void 0) throw new Error("unexpected body");
+    policies.set(slot, { at: Date.now(), need });
     return need;
   } catch {
-    policies.set(key, { at: hit?.at ?? 0, need: hit?.need ?? null, failedAt: Date.now() });
-    return hit?.at ? hit.need : void 0;
+    policies.set(slot, { at: hit?.at ?? 0, need: hit?.need ?? null, failedAt: Date.now() });
+    return standing();
   }
 }
 async function bondNeed(options) {