@orangecheck/me-client 0.5.0 → 0.7.0

package/dist/server.js

@@ -0,0 +1,73 @@
+'use strict';
+
+var authCore = require('@orangecheck/auth-core');
+
+// src/server.ts
+async function getOcSession(headers, options = {}) {
+  return authCore.getOcSession(headers, options);
+}
+function withOcAuth(handler, options = {}) {
+  const wrapped = async (req, res) => {
+    res.setHeader("Cache-Control", "no-store, private");
+    res.setHeader("Vary", "Cookie, Authorization");
+    const session = await getOcSession(
+      {
+        cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
+        authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
+      },
+      options
+    );
+    req.ocSession = session;
+    if (options.required && !session) {
+      return res.status(401).json({ ok: false, reason: "unauthenticated" });
+    }
+    return handler(req, res);
+  };
+  return wrapped;
+}
+function ocAuthExpress(options = {}) {
+  return async (req, res, next) => {
+    try {
+      res.setHeader("Cache-Control", "no-store, private");
+      res.setHeader("Vary", "Cookie, Authorization");
+      const session = await getOcSession(
+        {
+          cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
+          authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
+        },
+        options
+      );
+      req.ocSession = session;
+      if (options.required && !session) {
+        res.status(401).json({ ok: false, reason: "unauthenticated" });
+        return;
+      }
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+function ocAuthHono(options = {}) {
+  return async (c, next) => {
+    c.header("Cache-Control", "no-store, private");
+    c.header("Vary", "Cookie, Authorization");
+    const session = await getOcSession(c.req.raw.headers, options);
+    c.set("ocSession", session);
+    if (options.required && !session) {
+      return c.json({ ok: false, reason: "unauthenticated" }, 401);
+    }
+    await next();
+  };
+}
+
+Object.defineProperty(exports, "verifyOcToken", {
+  enumerable: true,
+  get: function () { return authCore.verifyOcToken; }
+});
+exports.getOcSession = getOcSession;
+exports.ocAuthExpress = ocAuthExpress;
+exports.ocAuthHono = ocAuthHono;
+exports.withOcAuth = withOcAuth;
+//# sourceMappingURL=server.js.map
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts"],"names":["getOcSessionCore"],"mappings":";;;;;AA+CA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,OAAOA,qBAAA,CAAiB,SAAS,OAAO,CAAA;AAC5C;AAuCO,SAAS,UAAA,CACZ,OAAA,EACA,OAAA,GAA6B,EAAC,EAC7B;AACD,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,EAAyB,GAAA,KAA6B;AACzE,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,EAAS;AAC9B,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAmB,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,OAAO,OAAA;AACX;AAkCO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,EAAS;AAC9B,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAmB,CAAA;AAC7D,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,EAAS;AAC9B,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,iBAAA,IAAqB,GAAG,CAAA;AAAA,IAC/D;AACA,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.js","sourcesContent":["/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n *   import { withOcAuth, getOcSession, verifyOcToken } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and caches it\n * in-process. Integrators write code; we handle the crypto.\n *\n * Three layers, smallest to thickest:\n *\n *   verifyOcToken(token)       → SessionPayload | null\n *   getOcSession(headers)      → SessionPayload | null   (cookie OR Bearer)\n *   withOcAuth(handler)        → Next.js Pages adapter that injects\n *                                req.ocSession on the request object\n *   ocAuthExpress(opts?)       → Express / Connect middleware\n *   ocAuthHono(opts?)          → Hono middleware\n *\n * All thin wrappers around `getOcSession`. Bring your own framework.\n */\n\nimport {\n    getOcSession as getOcSessionCore,\n    verifyOcToken,\n    type SessionPayload,\n    type VerifyOcOptions,\n    type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { verifyOcToken };\nexport type { SessionPayload, VerifyOcOptions };\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n *   - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n *   - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n *     Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n    headers: SessionRequestHeaders | Headers,\n    options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n    return getOcSessionCore(headers, options);\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n    headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n    ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n    status(code: number): NextApiResponseLike;\n    json(body: unknown): unknown;\n    setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype NextApiHandlerLike = (req: NextApiRequestLike, res: NextApiResponseLike) => unknown | Promise<unknown>;\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n    /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n     *  before the wrapped handler runs. Default: false — handler runs and\n     *  receives `req.ocSession === null`, useful when the route serves both\n     *  signed-in and anonymous users. */\n    required?: boolean;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n *   // pages/api/me/profile.ts\n *   import { withOcAuth } from '@orangecheck/me-client/server';\n *\n *   export default withOcAuth(async (req, res) => {\n *     if (!req.ocSession) return res.status(401).json({ ok: false });\n *     res.status(200).json({ account: { address: req.ocSession.addr } });\n *   }, { required: true });\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<T extends NextApiHandlerLike>(\n    handler: T,\n    options: WithOcAuthOptions = {}\n): T {\n    const wrapped = async (req: NextApiRequestLike, res: NextApiResponseLike) => {\n        res.setHeader('Cache-Control', 'no-store, private');\n        res.setHeader('Vary', 'Cookie, Authorization');\n        const session = await getOcSession(\n            {\n                cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n                authorization:\n                    typeof req.headers.authorization === 'string'\n                        ? req.headers.authorization\n                        : null,\n            },\n            options\n        );\n        req.ocSession = session;\n        if (options.required && !session) {\n            return res.status(401).json({ ok: false, reason: 'unauthenticated' });\n        }\n        return handler(req, res);\n    };\n    return wrapped as unknown as T;\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\ninterface ExpressRequestLike {\n    headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n    ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n    status(code: number): ExpressResponseLike;\n    json(body: unknown): unknown;\n    setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n *   import express from 'express';\n *   import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n *   const app = express();\n *   app.use(ocAuthExpress());\n *\n *   app.get('/api/profile', (req, res) => {\n *     if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n *     res.json({ address: req.ocSession.addr });\n *   });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n    return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n        try {\n            res.setHeader('Cache-Control', 'no-store, private');\n            res.setHeader('Vary', 'Cookie, Authorization');\n            const session = await getOcSession(\n                {\n                    cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n                    authorization:\n                        typeof req.headers.authorization === 'string'\n                            ? req.headers.authorization\n                            : null,\n                },\n                options\n            );\n            req.ocSession = session;\n            if (options.required && !session) {\n                res.status(401).json({ ok: false, reason: 'unauthenticated' });\n                return;\n            }\n            next();\n        } catch (err) {\n            next(err);\n        }\n    };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n    req: { raw: { headers: Headers } };\n    set(key: string, value: unknown): void;\n    json(body: unknown, status?: number): unknown;\n    header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n *   import { Hono } from 'hono';\n *   import { ocAuthHono } from '@orangecheck/me-client/server';\n *\n *   const app = new Hono();\n *   app.use('*', ocAuthHono());\n *\n *   app.get('/api/profile', (c) => {\n *     const session = c.get('ocSession');\n *     if (!session) return c.json({ error: 'sign in' }, 401);\n *     return c.json({ address: session.addr });\n *   });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n    return async (c: HonoContextLike, next: HonoNextLike) => {\n        c.header('Cache-Control', 'no-store, private');\n        c.header('Vary', 'Cookie, Authorization');\n        const session = await getOcSession(c.req.raw.headers, options);\n        c.set('ocSession', session);\n        if (options.required && !session) {\n            return c.json({ ok: false, reason: 'unauthenticated' }, 401);\n        }\n        await next();\n    };\n}\n"]}

package/dist/server.mjs

@@ -0,0 +1,65 @@
+import { getOcSession as getOcSession$1 } from '@orangecheck/auth-core';
+export { verifyOcToken } from '@orangecheck/auth-core';
+
+// src/server.ts
+async function getOcSession(headers, options = {}) {
+  return getOcSession$1(headers, options);
+}
+function withOcAuth(handler, options = {}) {
+  const wrapped = async (req, res) => {
+    res.setHeader("Cache-Control", "no-store, private");
+    res.setHeader("Vary", "Cookie, Authorization");
+    const session = await getOcSession(
+      {
+        cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
+        authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
+      },
+      options
+    );
+    req.ocSession = session;
+    if (options.required && !session) {
+      return res.status(401).json({ ok: false, reason: "unauthenticated" });
+    }
+    return handler(req, res);
+  };
+  return wrapped;
+}
+function ocAuthExpress(options = {}) {
+  return async (req, res, next) => {
+    try {
+      res.setHeader("Cache-Control", "no-store, private");
+      res.setHeader("Vary", "Cookie, Authorization");
+      const session = await getOcSession(
+        {
+          cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
+          authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
+        },
+        options
+      );
+      req.ocSession = session;
+      if (options.required && !session) {
+        res.status(401).json({ ok: false, reason: "unauthenticated" });
+        return;
+      }
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+function ocAuthHono(options = {}) {
+  return async (c, next) => {
+    c.header("Cache-Control", "no-store, private");
+    c.header("Vary", "Cookie, Authorization");
+    const session = await getOcSession(c.req.raw.headers, options);
+    c.set("ocSession", session);
+    if (options.required && !session) {
+      return c.json({ ok: false, reason: "unauthenticated" }, 401);
+    }
+    await next();
+  };
+}
+
+export { getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };
+//# sourceMappingURL=server.mjs.map
+//# sourceMappingURL=server.mjs.map

package/dist/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts"],"names":["getOcSessionCore"],"mappings":";;;;AA+CA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,OAAOA,cAAA,CAAiB,SAAS,OAAO,CAAA;AAC5C;AAuCO,SAAS,UAAA,CACZ,OAAA,EACA,OAAA,GAA6B,EAAC,EAC7B;AACD,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,EAAyB,GAAA,KAA6B;AACzE,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,EAAS;AAC9B,MAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAmB,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,OAAO,OAAA;AACX;AAkCO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,EAAS;AAC9B,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAmB,CAAA;AAC7D,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,OAAA,EAAS;AAC9B,MAAA,OAAO,CAAA,CAAE,KAAK,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,iBAAA,IAAqB,GAAG,CAAA;AAAA,IAC/D;AACA,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.mjs","sourcesContent":["/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n *   import { withOcAuth, getOcSession, verifyOcToken } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and caches it\n * in-process. Integrators write code; we handle the crypto.\n *\n * Three layers, smallest to thickest:\n *\n *   verifyOcToken(token)       → SessionPayload | null\n *   getOcSession(headers)      → SessionPayload | null   (cookie OR Bearer)\n *   withOcAuth(handler)        → Next.js Pages adapter that injects\n *                                req.ocSession on the request object\n *   ocAuthExpress(opts?)       → Express / Connect middleware\n *   ocAuthHono(opts?)          → Hono middleware\n *\n * All thin wrappers around `getOcSession`. Bring your own framework.\n */\n\nimport {\n    getOcSession as getOcSessionCore,\n    verifyOcToken,\n    type SessionPayload,\n    type VerifyOcOptions,\n    type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { verifyOcToken };\nexport type { SessionPayload, VerifyOcOptions };\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n *   - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n *   - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n *     Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n    headers: SessionRequestHeaders | Headers,\n    options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n    return getOcSessionCore(headers, options);\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n    headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n    ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n    status(code: number): NextApiResponseLike;\n    json(body: unknown): unknown;\n    setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype NextApiHandlerLike = (req: NextApiRequestLike, res: NextApiResponseLike) => unknown | Promise<unknown>;\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n    /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n     *  before the wrapped handler runs. Default: false — handler runs and\n     *  receives `req.ocSession === null`, useful when the route serves both\n     *  signed-in and anonymous users. */\n    required?: boolean;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n *   // pages/api/me/profile.ts\n *   import { withOcAuth } from '@orangecheck/me-client/server';\n *\n *   export default withOcAuth(async (req, res) => {\n *     if (!req.ocSession) return res.status(401).json({ ok: false });\n *     res.status(200).json({ account: { address: req.ocSession.addr } });\n *   }, { required: true });\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<T extends NextApiHandlerLike>(\n    handler: T,\n    options: WithOcAuthOptions = {}\n): T {\n    const wrapped = async (req: NextApiRequestLike, res: NextApiResponseLike) => {\n        res.setHeader('Cache-Control', 'no-store, private');\n        res.setHeader('Vary', 'Cookie, Authorization');\n        const session = await getOcSession(\n            {\n                cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n                authorization:\n                    typeof req.headers.authorization === 'string'\n                        ? req.headers.authorization\n                        : null,\n            },\n            options\n        );\n        req.ocSession = session;\n        if (options.required && !session) {\n            return res.status(401).json({ ok: false, reason: 'unauthenticated' });\n        }\n        return handler(req, res);\n    };\n    return wrapped as unknown as T;\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\ninterface ExpressRequestLike {\n    headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n    ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n    status(code: number): ExpressResponseLike;\n    json(body: unknown): unknown;\n    setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n *   import express from 'express';\n *   import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n *   const app = express();\n *   app.use(ocAuthExpress());\n *\n *   app.get('/api/profile', (req, res) => {\n *     if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n *     res.json({ address: req.ocSession.addr });\n *   });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n    return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n        try {\n            res.setHeader('Cache-Control', 'no-store, private');\n            res.setHeader('Vary', 'Cookie, Authorization');\n            const session = await getOcSession(\n                {\n                    cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n                    authorization:\n                        typeof req.headers.authorization === 'string'\n                            ? req.headers.authorization\n                            : null,\n                },\n                options\n            );\n            req.ocSession = session;\n            if (options.required && !session) {\n                res.status(401).json({ ok: false, reason: 'unauthenticated' });\n                return;\n            }\n            next();\n        } catch (err) {\n            next(err);\n        }\n    };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n    req: { raw: { headers: Headers } };\n    set(key: string, value: unknown): void;\n    json(body: unknown, status?: number): unknown;\n    header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n *   import { Hono } from 'hono';\n *   import { ocAuthHono } from '@orangecheck/me-client/server';\n *\n *   const app = new Hono();\n *   app.use('*', ocAuthHono());\n *\n *   app.get('/api/profile', (c) => {\n *     const session = c.get('ocSession');\n *     if (!session) return c.json({ error: 'sign in' }, 401);\n *     return c.json({ address: session.addr });\n *   });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n    return async (c: HonoContextLike, next: HonoNextLike) => {\n        c.header('Cache-Control', 'no-store, private');\n        c.header('Vary', 'Cookie, Authorization');\n        const session = await getOcSession(c.req.raw.headers, options);\n        c.set('ocSession', session);\n        if (options.required && !session) {\n            return c.json({ ok: false, reason: 'unauthenticated' }, 401);\n        }\n        await next();\n    };\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@orangecheck/me-client",
-    "version": "0.5.0",
-    "description": "Drop-in client for me.ochk.io. Sign-in-with-OC button, useOcSession, oc.session/payment/config/delegation/webhook/event, the canonical billable-event taxonomy as types.",
+    "version": "0.7.0",
+    "description": "Drop-in client for me.ochk.io. Three entry points: React surface (OcSignInButton, useOcSession), server-side verification (withOcAuth for Next.js, ocAuthExpress, ocAuthHono — zero env vars, zero JWK handling), and a browser-only popup orchestrator (signInWithOc). Plus session lifecycle hooks, payment authorization, and the canonical billable-event taxonomy as types.",
     "keywords": [
         "orangecheck",
         "bitcoin",
@@ -30,6 +30,16 @@
             "types": "./dist/index.d.ts",
             "import": "./dist/index.mjs",
             "require": "./dist/index.js"
+        },
+        "./server": {
+            "types": "./dist/server.d.ts",
+            "import": "./dist/server.mjs",
+            "require": "./dist/server.js"
+        },
+        "./popup": {
+            "types": "./dist/popup.d.ts",
+            "import": "./dist/popup.mjs",
+            "require": "./dist/popup.js"
         }
     },
     "files": [
@@ -46,14 +56,29 @@
         "prepublishOnly": "npm run clean && npm run build"
     },
     "dependencies": {
-        "@noble/curves": "^1.6.0",
-        "@noble/hashes": "^1.5.0"
+        "@orangecheck/auth-core": "^0.3.1"
     },
     "peerDependencies": {
         "@orangecheck/auth-client": "^0.4.0",
+        "express": "^4.0.0 || ^5.0.0",
+        "hono": "^3.0.0 || ^4.0.0",
         "react": "^18.0.0 || ^19.0.0",
         "react-dom": "^18.0.0 || ^19.0.0"
     },
+    "peerDependenciesMeta": {
+        "express": {
+            "optional": true
+        },
+        "hono": {
+            "optional": true
+        },
+        "react": {
+            "optional": true
+        },
+        "react-dom": {
+            "optional": true
+        }
+    },
     "devDependencies": {
         "@orangecheck/auth-client": "^0.4.0",
         "@testing-library/react": "^16.3.2",