@orangecheck/me-client 0.5.0 → 0.7.0

package/dist/index.mjs

@@ -1,24 +1,38 @@
 import * as React from 'react';
 import { jsxs, jsx } from 'react/jsx-runtime';
-export { OcSessionProvider, useOcSession, useOptionalOcSession } from '@orangecheck/auth-client';
-import { ed25519 } from '@noble/curves/ed25519';
-import { sha256 } from '@noble/hashes/sha256';
 
-// src/SignInButton.tsx
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
 // src/transport.ts
 var origin = "https://me.ochk.io";
+var bearerToken = null;
 function setOrigin(url) {
   origin = url.replace(/\/$/, "");
 }
 function getOrigin() {
   return origin;
 }
+function setBearerToken(token) {
+  bearerToken = token && token.length > 0 ? token : null;
+}
+function getBearerToken() {
+  return bearerToken;
+}
+function clearBearerToken() {
+  bearerToken = null;
+}
 async function api(path, opts = {}) {
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json"
+  };
+  if (bearerToken) headers["authorization"] = `Bearer ${bearerToken}`;
   const res = await fetch(`${origin}${path}`, {
     method: opts.method ?? "GET",
     credentials: "include",
-    headers: { "content-type": "application/json", accept: "application/json" },
+    headers,
     body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
     signal: opts.signal
   });
@@ -75,8 +89,7 @@ async function create(opts) {
     body: {
       scope: opts.scope,
       policy,
-      return_to: opts.returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0),
-      ...opts.project_key ? { project_key: opts.project_key } : {}
+      return_to: opts.returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0)
     }
   });
 }
@@ -177,13 +190,29 @@ async function authorize(opts) {
 }
 var payment = { authorize };
 
+// src/event.ts
+async function fire(options) {
+  if (!options.project_key) {
+    throw new Error("event.fire requires project_key");
+  }
+  if (!options.subtype) {
+    throw new Error("event.fire requires subtype");
+  }
+  return api("/api/integrator/event", {
+    method: "POST",
+    body: options
+  });
+}
+var event = { fire };
+
 // src/types.ts
 var PLATFORM_FEE_POLICY = {
   /** Fraction of every gross_fee that OC retains. */
   pct: 0.2,
   /** Absolute minimum platform fee, in sats. */
   min_floor_sats: 1,
-  /** Date this policy was last ratified. Changes require an oc-me-protocol PR. */
+  /** Date this policy was last ratified. Changes require a versioned
+   *  @orangecheck/me-client release. */
   ratified: "2026-04-30"
 };
 var MIN_INTEGRATOR_PRICE_SATS = 5;
@@ -246,149 +275,353 @@ function validateIntegratorConfig(cfg) {
 }
 
 // src/config.ts
-async function get() {
-  return api("/api/developer/config", { method: "GET" });
-}
-async function update(cfg) {
-  const result = validateIntegratorConfig(cfg);
-  if (!result.ok) {
-    const summary = result.errors.map((e) => e.subtype ? `${e.subtype}: ${e.message}` : e.message).join("; ");
-    throw new Error(`IntegratorPriceConfig invalid \xB7 ${summary}`);
-  }
-  return api("/api/developer/config", {
-    method: "POST",
-    body: cfg
-  });
-}
 function validate(cfg) {
   return validateIntegratorConfig(cfg);
 }
-var config = { get, update, validate };
-var FAMILY_JWKS_URL = "https://ochk.io/.well-known/jwks.json";
-var cachedJwks = null;
-var JWKS_TTL_MS = 60 * 60 * 1e3;
-async function fetchJwks() {
-  if (cachedJwks && Date.now() - cachedJwks.fetched_at < JWKS_TTL_MS) {
-    return cachedJwks.keys;
-  }
-  const res = await fetch(FAMILY_JWKS_URL, {
-    method: "GET",
-    headers: { Accept: "application/json" }
-  });
-  if (!res.ok) {
-    throw new Error(`failed to fetch JWKS: ${res.status} ${res.statusText}`);
+var config = { validate };
+
+// node_modules/jose/dist/webapi/lib/buffer_utils.js
+new TextEncoder();
+var decoder = new TextDecoder();
+
+// node_modules/jose/dist/webapi/lib/base64.js
+function decodeBase64(encoded) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(encoded);
   }
-  const data = await res.json();
-  cachedJwks = { fetched_at: Date.now(), keys: data.keys };
-  return data.keys;
-}
-function base64urlDecode(input) {
-  const padded = input.replace(/-/g, "+").replace(/_/g, "/").padEnd(
-    Math.ceil(input.length / 4) * 4,
-    "="
-  );
-  const bin = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("binary");
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
-  return out;
-}
-function hexDecode(input) {
-  const clean = input.toLowerCase().replace(/^0x/, "");
-  if (clean.length % 2 !== 0) throw new Error("hex string has odd length");
-  const out = new Uint8Array(clean.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  const binary = atob(encoded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
   }
-  return out;
+  return bytes;
 }
-async function verify(rawBody, sigHex, kid, jwk) {
-  let key = jwk;
-  if (!key || key.kid !== kid) {
-    const keys = await fetchJwks();
-    key = keys.find((k) => k.kid === kid);
-    if (!key) {
-      return { ok: false, reason: `no JWK with kid=${kid} in published JWKS`, key_id: kid };
-    }
+
+// node_modules/jose/dist/webapi/util/base64url.js
+function decode(input) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
+      alphabet: "base64url"
+    });
   }
-  if (key.kty !== "OKP" || key.crv !== "Ed25519") {
-    return { ok: false, reason: `JWK kid=${kid} is not Ed25519`, key_id: kid };
+  let encoded = input;
+  if (encoded instanceof Uint8Array) {
+    encoded = decoder.decode(encoded);
   }
-  let pubKey;
+  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
   try {
-    pubKey = base64urlDecode(key.x);
-  } catch (err) {
-    return {
-      ok: false,
-      reason: `failed to decode JWK x: ${err.message}`,
-      key_id: kid
-    };
+    return decodeBase64(encoded);
+  } catch {
+    throw new TypeError("The input to be decoded is not correctly encoded.");
   }
-  if (pubKey.length !== 32) {
-    return {
-      ok: false,
-      reason: `Ed25519 public key must be 32 bytes; got ${pubKey.length}`,
-      key_id: kid
-    };
+}
+
+// node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    __publicField(this, "code", "ERR_JOSE_GENERIC");
+    this.name = this.constructor.name;
+    Error.captureStackTrace?.(this, this.constructor);
   }
-  let sig;
-  try {
-    sig = hexDecode(sigHex);
-  } catch (err) {
-    return {
-      ok: false,
-      reason: `failed to decode signature: ${err.message}`,
-      key_id: kid
-    };
+};
+__publicField(JOSEError, "code", "ERR_JOSE_GENERIC");
+var JOSENotSupported = class extends JOSEError {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "code", "ERR_JOSE_NOT_SUPPORTED");
   }
-  if (sig.length !== 64) {
-    return {
-      ok: false,
-      reason: `Ed25519 signature must be 64 bytes; got ${sig.length}`,
-      key_id: kid
-    };
+};
+__publicField(JOSENotSupported, "code", "ERR_JOSE_NOT_SUPPORTED");
+var _a, _b;
+var JWKSMultipleMatchingKeys = class extends (_b = JOSEError, _a = Symbol.asyncIterator, _b) {
+  constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message, options);
+    __publicField(this, _a);
+    __publicField(this, "code", "ERR_JWKS_MULTIPLE_MATCHING_KEYS");
   }
-  const bodyBytes = typeof rawBody === "string" ? new TextEncoder().encode(rawBody) : rawBody;
-  const hash = sha256(bodyBytes);
-  try {
-    const ok = ed25519.verify(sig, hash, pubKey);
-    return ok ? { ok: true, key_id: kid } : { ok: false, reason: "signature does not match", key_id: kid };
-  } catch (err) {
-    return { ok: false, reason: err.message, key_id: kid };
+};
+__publicField(JWKSMultipleMatchingKeys, "code", "ERR_JWKS_MULTIPLE_MATCHING_KEYS");
+
+// node_modules/jose/dist/webapi/lib/type_checks.js
+var isObjectLike = (value) => typeof value === "object" && value !== null;
+function isObject(input) {
+  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  if (Object.getPrototypeOf(input) === null) {
+    return true;
   }
+  let proto = input;
+  while (Object.getPrototypeOf(proto) !== null) {
+    proto = Object.getPrototypeOf(proto);
+  }
+  return Object.getPrototypeOf(input) === proto;
 }
-var webhook = { verify, fetchJwks };
 
-// src/delegation.ts
-async function issue(opts) {
-  if (!opts.agent_id) throw new Error("agent_id is required");
-  if (!opts.scope?.length) throw new Error("scope must contain at least one token");
-  if (!opts.expires_at) throw new Error("expires_at is required");
-  return api("/api/delegation/issue", {
-    method: "POST",
-    body: opts
-  });
+// node_modules/jose/dist/webapi/lib/jwk_to_key.js
+var unsupportedAlg = 'Invalid or unsupported JWK "alg" (Algorithm) Parameter value';
+function subtleMapping(jwk) {
+  let algorithm;
+  let keyUsages;
+  switch (jwk.kty) {
+    case "AKP": {
+      switch (jwk.alg) {
+        case "ML-DSA-44":
+        case "ML-DSA-65":
+        case "ML-DSA-87":
+          algorithm = { name: jwk.alg };
+          keyUsages = jwk.priv ? ["sign"] : ["verify"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "RSA": {
+      switch (jwk.alg) {
+        case "PS256":
+        case "PS384":
+        case "PS512":
+          algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RS256":
+        case "RS384":
+        case "RS512":
+          algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RSA-OAEP":
+        case "RSA-OAEP-256":
+        case "RSA-OAEP-384":
+        case "RSA-OAEP-512":
+          algorithm = {
+            name: "RSA-OAEP",
+            hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
+          };
+          keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "EC": {
+      switch (jwk.alg) {
+        case "ES256":
+        case "ES384":
+        case "ES512":
+          algorithm = {
+            name: "ECDSA",
+            namedCurve: { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[jwk.alg]
+          };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: "ECDH", namedCurve: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "OKP": {
+      switch (jwk.alg) {
+        case "Ed25519":
+        case "EdDSA":
+          algorithm = { name: "Ed25519" };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    default:
+      throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+  }
+  return { algorithm, keyUsages };
 }
-async function revoke(delegation_id) {
-  return api("/api/delegation/revoke", {
-    method: "POST",
-    body: { delegation_id }
-  });
+async function jwkToKey(jwk) {
+  if (!jwk.alg) {
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  }
+  const { algorithm, keyUsages } = subtleMapping(jwk);
+  const keyData = { ...jwk };
+  if (keyData.kty !== "AKP") {
+    delete keyData.alg;
+  }
+  delete keyData.use;
+  return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
 }
-var delegation = { issue, revoke };
 
-// src/event.ts
-async function fire(opts) {
-  const result = await api("/api/integrator/event", {
-    method: "POST",
-    body: opts
+// node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk)) {
+    throw new TypeError("JWK must be an object");
+  }
+  let ext;
+  ext ?? (ext = jwk.ext);
+  switch (jwk.kty) {
+    case "oct":
+      if (typeof jwk.k !== "string" || !jwk.k) {
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      }
+      return decode(jwk.k);
+    case "RSA":
+      if ("oth" in jwk && jwk.oth !== void 0) {
+        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+      }
+      return jwkToKey({ ...jwk, alg, ext });
+    case "AKP": {
+      if (typeof jwk.alg !== "string" || !jwk.alg) {
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      }
+      if (alg !== jwk.alg) {
+        throw new TypeError("JWK alg and alg option value mismatch");
+      }
+      return jwkToKey({ ...jwk, ext });
+    }
+    case "EC":
+    case "OKP":
+      return jwkToKey({ ...jwk, alg, ext });
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+
+// src/webhook.ts
+var DEFAULT_ISSUER = "https://ochk.io";
+var DEFAULT_TTL_MS = 60 * 60 * 1e3;
+var jwksCache = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+async function fetchJwks(issuer, ttlMs) {
+  const cached = jwksCache.get(issuer);
+  if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;
+  const existing = inflight.get(issuer);
+  if (existing) return existing;
+  const p = (async () => {
+    try {
+      const url = `${issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+      const res = await fetch(url, { headers: { Accept: "application/json" } });
+      if (!res.ok) throw new Error(`JWKS fetch ${url} returned ${res.status}`);
+      const json = await res.json();
+      if (!json || !Array.isArray(json.keys)) {
+        throw new Error(`JWKS at ${url} did not return {keys:[\u2026]}`);
+      }
+      const keys = {};
+      for (const k of json.keys) {
+        if (typeof k.kid !== "string") continue;
+        try {
+          keys[k.kid] = await importJWK(k, "EdDSA");
+        } catch {
+        }
+      }
+      const entry = { keys, fetchedAt: Date.now() };
+      jwksCache.set(issuer, entry);
+      return entry;
+    } catch (err) {
+      const stale = jwksCache.get(issuer);
+      if (stale) return stale;
+      throw err;
+    }
+  })().finally(() => {
+    inflight.delete(issuer);
   });
-  return result.event;
+  inflight.set(issuer, p);
+  return p;
 }
-var event = { fire };
+function hexToBytes(hex) {
+  if (typeof hex !== "string") return null;
+  const s = hex.trim();
+  if (s.length === 0 || s.length % 2 !== 0) return null;
+  const out = new Uint8Array(s.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(b)) return null;
+    out[i] = b;
+  }
+  return out;
+}
+function toBytes(input) {
+  if (typeof input === "string") return new TextEncoder().encode(input);
+  return input;
+}
+function toArrayBuffer(view) {
+  const buf = new ArrayBuffer(view.byteLength);
+  new Uint8Array(buf).set(view);
+  return buf;
+}
+async function verifyEd25519(key, sig, msg) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) return false;
+  try {
+    return await subtle.verify(
+      "Ed25519",
+      key,
+      toArrayBuffer(sig),
+      toArrayBuffer(msg)
+    );
+  } catch {
+    return false;
+  }
+}
+async function verify(rawBody, sigHex, kid, options = {}) {
+  if (!sigHex) return { ok: false, reason: "missing signature" };
+  if (!kid) return { ok: false, reason: "missing kid" };
+  const sig = hexToBytes(sigHex);
+  if (!sig) return { ok: false, reason: "malformed signature (expected hex)" };
+  const msg = toBytes(rawBody);
+  let key;
+  if (options.jwk) {
+    if (options.jwk.kid !== kid) {
+      return { ok: false, reason: `kid mismatch (header=${kid}, jwk=${options.jwk.kid})` };
+    }
+    try {
+      key = await importJWK(options.jwk, "EdDSA");
+    } catch {
+      return { ok: false, reason: "could not import provided jwk" };
+    }
+  } else {
+    const issuer = options.issuer ?? DEFAULT_ISSUER;
+    const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;
+    try {
+      let entry = await fetchJwks(issuer, ttl);
+      key = entry.keys[kid];
+      if (!key) {
+        jwksCache.delete(issuer);
+        entry = await fetchJwks(issuer, ttl);
+        key = entry.keys[kid];
+      }
+    } catch (err) {
+      return { ok: false, reason: `jwks unavailable: ${err.message}` };
+    }
+    if (!key) return { ok: false, reason: `kid ${kid} not in JWKS` };
+  }
+  const ok = await verifyEd25519(key, sig, msg);
+  return ok ? { ok: true } : { ok: false, reason: "signature does not match" };
+}
+async function fetchJwksForce(issuer = DEFAULT_ISSUER) {
+  jwksCache.delete(issuer);
+  await fetchJwks(issuer, DEFAULT_TTL_MS);
+}
+var webhook = { verify, fetchJwks: fetchJwksForce };
 
 // src/index.ts
-var oc = { session, payment, config, webhook, delegation, event };
+var oc = { session, payment, event, config, webhook };
 
-export { MIN_INTEGRATOR_PRICE_SATS, MeClientError, OcSignInButton, PLATFORM_FEE_POLICY, computeFees, config, delegation, event, getOrigin, oc, onTelemetry, payment, session, setOrigin, validateIntegratorConfig, webhook };
+export { MIN_INTEGRATOR_PRICE_SATS, MeClientError, OcSignInButton, PLATFORM_FEE_POLICY, clearBearerToken, computeFees, config, event, getBearerToken, getOrigin, oc, onTelemetry, payment, session, setBearerToken, setOrigin, validateIntegratorConfig, webhook };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map