@orangecheck/me-client 0.6.0 → 0.8.0

package/dist/index.mjs

@@ -1,21 +1,38 @@
 import * as React from 'react';
 import { jsxs, jsx } from 'react/jsx-runtime';
 
-// src/SignInButton.tsx
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
 // src/transport.ts
 var origin = "https://me.ochk.io";
+var bearerToken = null;
 function setOrigin(url) {
   origin = url.replace(/\/$/, "");
 }
 function getOrigin() {
   return origin;
 }
+function setBearerToken(token) {
+  bearerToken = token && token.length > 0 ? token : null;
+}
+function getBearerToken() {
+  return bearerToken;
+}
+function clearBearerToken() {
+  bearerToken = null;
+}
 async function api(path, opts = {}) {
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json"
+  };
+  if (bearerToken) headers["authorization"] = `Bearer ${bearerToken}`;
   const res = await fetch(`${origin}${path}`, {
     method: opts.method ?? "GET",
     credentials: "include",
-    headers: { "content-type": "application/json", accept: "application/json" },
+    headers,
     body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
     signal: opts.signal
   });
@@ -108,9 +125,9 @@ function OcSignInButton({
     "button",
     {
       type: "button",
-      onClick: async (event) => {
-        onClick?.(event);
-        if (event.defaultPrevented) return;
+      onClick: async (event2) => {
+        onClick?.(event2);
+        if (event2.defaultPrevented) return;
         setPending(true);
         try {
           const result = await session.create({ scope, sessionPolicy, returnTo });
@@ -173,6 +190,21 @@ async function authorize(opts) {
 }
 var payment = { authorize };
 
+// src/event.ts
+async function fire(options) {
+  if (!options.project_key) {
+    throw new Error("event.fire requires project_key");
+  }
+  if (!options.subtype) {
+    throw new Error("event.fire requires subtype");
+  }
+  return api("/api/integrator/event", {
+    method: "POST",
+    body: options
+  });
+}
+var event = { fire };
+
 // src/types.ts
 var PLATFORM_FEE_POLICY = {
   /** Fraction of every gross_fee that OC retains. */
@@ -242,9 +274,373 @@ function validateIntegratorConfig(cfg) {
   return { ok: errors.length === 0, errors };
 }
 
+// src/config.ts
+function validate(cfg) {
+  return validateIntegratorConfig(cfg);
+}
+var config = { validate };
+
+// node_modules/jose/dist/webapi/lib/buffer_utils.js
+new TextEncoder();
+var decoder = new TextDecoder();
+
+// node_modules/jose/dist/webapi/lib/base64.js
+function decodeBase64(encoded) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(encoded);
+  }
+  const binary = atob(encoded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+// node_modules/jose/dist/webapi/util/base64url.js
+function decode(input) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
+      alphabet: "base64url"
+    });
+  }
+  let encoded = input;
+  if (encoded instanceof Uint8Array) {
+    encoded = decoder.decode(encoded);
+  }
+  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return decodeBase64(encoded);
+  } catch {
+    throw new TypeError("The input to be decoded is not correctly encoded.");
+  }
+}
+
+// node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    __publicField(this, "code", "ERR_JOSE_GENERIC");
+    this.name = this.constructor.name;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+__publicField(JOSEError, "code", "ERR_JOSE_GENERIC");
+var JOSENotSupported = class extends JOSEError {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "code", "ERR_JOSE_NOT_SUPPORTED");
+  }
+};
+__publicField(JOSENotSupported, "code", "ERR_JOSE_NOT_SUPPORTED");
+var _a, _b;
+var JWKSMultipleMatchingKeys = class extends (_b = JOSEError, _a = Symbol.asyncIterator, _b) {
+  constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message, options);
+    __publicField(this, _a);
+    __publicField(this, "code", "ERR_JWKS_MULTIPLE_MATCHING_KEYS");
+  }
+};
+__publicField(JWKSMultipleMatchingKeys, "code", "ERR_JWKS_MULTIPLE_MATCHING_KEYS");
+
+// node_modules/jose/dist/webapi/lib/type_checks.js
+var isObjectLike = (value) => typeof value === "object" && value !== null;
+function isObject(input) {
+  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  if (Object.getPrototypeOf(input) === null) {
+    return true;
+  }
+  let proto = input;
+  while (Object.getPrototypeOf(proto) !== null) {
+    proto = Object.getPrototypeOf(proto);
+  }
+  return Object.getPrototypeOf(input) === proto;
+}
+
+// node_modules/jose/dist/webapi/lib/jwk_to_key.js
+var unsupportedAlg = 'Invalid or unsupported JWK "alg" (Algorithm) Parameter value';
+function subtleMapping(jwk) {
+  let algorithm;
+  let keyUsages;
+  switch (jwk.kty) {
+    case "AKP": {
+      switch (jwk.alg) {
+        case "ML-DSA-44":
+        case "ML-DSA-65":
+        case "ML-DSA-87":
+          algorithm = { name: jwk.alg };
+          keyUsages = jwk.priv ? ["sign"] : ["verify"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "RSA": {
+      switch (jwk.alg) {
+        case "PS256":
+        case "PS384":
+        case "PS512":
+          algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RS256":
+        case "RS384":
+        case "RS512":
+          algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${jwk.alg.slice(-3)}` };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "RSA-OAEP":
+        case "RSA-OAEP-256":
+        case "RSA-OAEP-384":
+        case "RSA-OAEP-512":
+          algorithm = {
+            name: "RSA-OAEP",
+            hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
+          };
+          keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "EC": {
+      switch (jwk.alg) {
+        case "ES256":
+        case "ES384":
+        case "ES512":
+          algorithm = {
+            name: "ECDSA",
+            namedCurve: { ES256: "P-256", ES384: "P-384", ES512: "P-521" }[jwk.alg]
+          };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: "ECDH", namedCurve: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    case "OKP": {
+      switch (jwk.alg) {
+        case "Ed25519":
+        case "EdDSA":
+          algorithm = { name: "Ed25519" };
+          keyUsages = jwk.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          algorithm = { name: jwk.crv };
+          keyUsages = jwk.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new JOSENotSupported(unsupportedAlg);
+      }
+      break;
+    }
+    default:
+      throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+  }
+  return { algorithm, keyUsages };
+}
+async function jwkToKey(jwk) {
+  if (!jwk.alg) {
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  }
+  const { algorithm, keyUsages } = subtleMapping(jwk);
+  const keyData = { ...jwk };
+  if (keyData.kty !== "AKP") {
+    delete keyData.alg;
+  }
+  delete keyData.use;
+  return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+}
+
+// node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk)) {
+    throw new TypeError("JWK must be an object");
+  }
+  let ext;
+  ext ?? (ext = jwk.ext);
+  switch (jwk.kty) {
+    case "oct":
+      if (typeof jwk.k !== "string" || !jwk.k) {
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      }
+      return decode(jwk.k);
+    case "RSA":
+      if ("oth" in jwk && jwk.oth !== void 0) {
+        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+      }
+      return jwkToKey({ ...jwk, alg, ext });
+    case "AKP": {
+      if (typeof jwk.alg !== "string" || !jwk.alg) {
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      }
+      if (alg !== jwk.alg) {
+        throw new TypeError("JWK alg and alg option value mismatch");
+      }
+      return jwkToKey({ ...jwk, ext });
+    }
+    case "EC":
+    case "OKP":
+      return jwkToKey({ ...jwk, alg, ext });
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+
+// src/webhook.ts
+var DEFAULT_ISSUER = "https://ochk.io";
+var DEFAULT_TTL_MS = 60 * 60 * 1e3;
+var jwksCache = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+async function fetchJwks(issuer, ttlMs) {
+  const cached = jwksCache.get(issuer);
+  if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;
+  const existing = inflight.get(issuer);
+  if (existing) return existing;
+  const p = (async () => {
+    try {
+      const url = `${issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+      const res = await fetch(url, { headers: { Accept: "application/json" } });
+      if (!res.ok) throw new Error(`JWKS fetch ${url} returned ${res.status}`);
+      const json = await res.json();
+      if (!json || !Array.isArray(json.keys)) {
+        throw new Error(`JWKS at ${url} did not return {keys:[\u2026]}`);
+      }
+      const keys = {};
+      for (const k of json.keys) {
+        if (typeof k.kid !== "string") continue;
+        try {
+          keys[k.kid] = await importJWK(k, "EdDSA");
+        } catch {
+        }
+      }
+      const entry = { keys, fetchedAt: Date.now() };
+      jwksCache.set(issuer, entry);
+      return entry;
+    } catch (err) {
+      const stale = jwksCache.get(issuer);
+      if (stale) return stale;
+      throw err;
+    }
+  })().finally(() => {
+    inflight.delete(issuer);
+  });
+  inflight.set(issuer, p);
+  return p;
+}
+function hexToBytes(hex) {
+  if (typeof hex !== "string") return null;
+  const s = hex.trim();
+  if (s.length === 0 || s.length % 2 !== 0) return null;
+  const out = new Uint8Array(s.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(b)) return null;
+    out[i] = b;
+  }
+  return out;
+}
+function toBytes(input) {
+  if (typeof input === "string") return new TextEncoder().encode(input);
+  return input;
+}
+function toArrayBuffer(view) {
+  const buf = new ArrayBuffer(view.byteLength);
+  new Uint8Array(buf).set(view);
+  return buf;
+}
+async function verifyEd25519(key, sig, msg) {
+  const subtle = typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle ? globalThis.crypto.subtle : null;
+  if (!subtle) return false;
+  try {
+    return await subtle.verify(
+      "Ed25519",
+      key,
+      toArrayBuffer(sig),
+      toArrayBuffer(msg)
+    );
+  } catch {
+    return false;
+  }
+}
+async function verify(rawBody, sigHex, kid, options = {}) {
+  if (!sigHex) return { ok: false, reason: "missing signature" };
+  if (!kid) return { ok: false, reason: "missing kid" };
+  const sig = hexToBytes(sigHex);
+  if (!sig) return { ok: false, reason: "malformed signature (expected hex)" };
+  const msg = toBytes(rawBody);
+  let key;
+  if (options.jwk) {
+    if (options.jwk.kid !== kid) {
+      return { ok: false, reason: `kid mismatch (header=${kid}, jwk=${options.jwk.kid})` };
+    }
+    try {
+      key = await importJWK(options.jwk, "EdDSA");
+    } catch {
+      return { ok: false, reason: "could not import provided jwk" };
+    }
+  } else {
+    const issuer = options.issuer ?? DEFAULT_ISSUER;
+    const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;
+    try {
+      let entry = await fetchJwks(issuer, ttl);
+      key = entry.keys[kid];
+      if (!key) {
+        jwksCache.delete(issuer);
+        entry = await fetchJwks(issuer, ttl);
+        key = entry.keys[kid];
+      }
+    } catch (err) {
+      return { ok: false, reason: `jwks unavailable: ${err.message}` };
+    }
+    if (!key) return { ok: false, reason: `kid ${kid} not in JWKS` };
+  }
+  const ok = await verifyEd25519(key, sig, msg);
+  return ok ? { ok: true } : { ok: false, reason: "signature does not match" };
+}
+async function fetchJwksForce(issuer = DEFAULT_ISSUER) {
+  jwksCache.delete(issuer);
+  await fetchJwks(issuer, DEFAULT_TTL_MS);
+}
+var webhook = { verify, fetchJwks: fetchJwksForce };
+
+// src/federations.ts
+async function list() {
+  const res = await api("/api/federations");
+  return res.federations ?? [];
+}
+async function live() {
+  const all = await list();
+  return all.filter((f) => f.status === "live" && typeof f.invite === "string" && f.invite.length > 0);
+}
+async function get(slug) {
+  const all = await list();
+  return all.find((f) => f.slug === slug) ?? null;
+}
+async function defaultLive() {
+  const all = await live();
+  return all[0] ?? null;
+}
+var federations = { list, live, get, defaultLive };
+
 // src/index.ts
-var oc = { session, payment };
+var oc = { session, payment, event, config, webhook, federations };
 
-export { MIN_INTEGRATOR_PRICE_SATS, MeClientError, OcSignInButton, PLATFORM_FEE_POLICY, computeFees, getOrigin, oc, onTelemetry, payment, session, setOrigin, validateIntegratorConfig };
+export { MIN_INTEGRATOR_PRICE_SATS, MeClientError, OcSignInButton, PLATFORM_FEE_POLICY, clearBearerToken, computeFees, config, event, federations, getBearerToken, getOrigin, oc, onTelemetry, payment, session, setBearerToken, setOrigin, validateIntegratorConfig, webhook };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map