@dogeos/dogeos-sdk 4.0.0-beta.9 → 4.0.1

package/README.md

@@ -17,13 +17,9 @@ The npm package is built with deployment-owned public service destinations. The
 - `DOGEOS_EMBEDDED_WALLET_STAGE`
 - `DOGEOS_SDK_AUTH_SERVICE_ORIGINS` (comma-separated gateway/service origins)
 
-The build fails when any required value is missing or invalid. These values are compiled into the published SDK and are not consumer provider options. The reference demo supplies only its normal `WalletConnectProvider` configuration; it cannot replace SDK service destinations or provider credentials.
+The build fails when any required value is missing or invalid. These values are compiled into the published SDK and are not consumer provider options.
 
-The SDK directory is a library-only package. The private reference consumer,
-its Vite entrypoint and application tests live in
-[`apps/sdk-demo`](../../apps/sdk-demo/README.md). Use `pnpm watch:demo` from the
-repository root for the supported SDK-and-app development loop; the app still
-resolves this package through its public `dist` export.
+The SDK directory is a library-only package. Consumers resolve it through its public `dist` export.
 
 ## Installation
 
@@ -167,7 +163,7 @@ export function SignMessageButton() {
 
 ### 5. Sign In with Wallet (SIW)
 
-Use the `signInWithWallet` method to sign in with wallet and obtain an authentication token:
+`signInWithWallet` constructs a message and returns its signature. It does not create a server session or return an authentication token. For EVM wallets it constructs an ERC-4361 (SIWE) message using the connected address and decimal chain ID. Supply your server-issued nonce and issuedAt, together with the expected domain and URI, so your server can reconstruct and verify the challenge. The helper preserves nonce and URI, normalizes issuedAt to ISO UTC, and signs the constructed bytes unchanged. A supplied address or chain ID must match the connected wallet. If your server already returns the complete message, use `signMessage({ message })` to sign those exact bytes instead.
 
 ```tsx
 // SignInButton.tsx
@@ -179,7 +175,9 @@ export function SignInButton() {
 
   const handleSignIn = async () => {
     try {
-      const proof = await signInWithWallet();
+      // Your server creates and retains these SIWE fields, including nonce and issuedAt.
+      const challenge = await fetchSignInChallenge(address);
+      const proof = await signInWithWallet(challenge);
       // Send the short-lived proof directly to your backend. Never log it or persist it in localStorage.
       await sendProofToBackend(proof);
     } catch (error) {
@@ -195,6 +193,8 @@ export function SignInButton() {
 }
 ```
 
+`fetchSignInChallenge` and `sendProofToBackend` above are application callbacks, not SDK endpoints. The server must verify the signature and expected challenge fields before creating a session. Version 4.0.1 corrects the EVM helper's previously nonstandard message format; custom verifiers that reconstructed the old text must adopt the SIWE format. No legacy-format fallback is performed.
+
 ## Configuration
 
 `WalletConnectProvider` accepts a `config` prop to customize the SDK's behavior.
@@ -299,11 +299,12 @@ export function App() {
 }
 ```
 
-Provider credentials, browser delivery, session reconciliation, and service
-destinations are SDK-owned. Consumer applications select the enabled login
-controls and provide their registered DogeOS client ID. A successful SDK login
-continues to the associated embedded wallet automatically; returning wallet
-connections are restored by the provider without consumer session plumbing.
+Provider OAuth client IDs and credentials are owned by the DogeOS authentication
+authority for each environment. Consumer applications select the enabled login
+controls and provide only their registered DogeOS client ID. A successful SDK
+login continues to the associated embedded wallet automatically; returning
+wallet connections are restored by the provider without consumer session
+plumbing.
 
 ### Configure Theme