@flow-industries/id 0.12.0 → 0.13.0

package/dist/sdk/client/create-flow.js

@@ -151,6 +151,22 @@ export function createFlow(options = {}) {
             return false;
         }
     }
+    /**
+     * One-time delivery of any additional-audience sessions a mint returned
+     * (AUTH-39). Handed straight to the consumer's callback and dropped — the
+     * SDK retains nothing; the consumer forwards each to its audience's own
+     * origin (the embed bootstrap) to be sealed HttpOnly there.
+     */
+    function deliverAdditionalSessions(sessions) {
+        if (!sessions?.length || !options.onAdditionalSessions)
+            return;
+        try {
+            options.onAdditionalSessions(sessions);
+        }
+        catch (err) {
+            console.warn("Flow ID: onAdditionalSessions handler threw", err);
+        }
+    }
     /**
      * One-time handoff of a freshly minted session (dialog login or guest
      * mint) to the app's server, which verifies the JWT against the issuer's
@@ -247,7 +263,9 @@ export function createFlow(options = {}) {
                 if (await doRefresh())
                     return true;
                 try {
-                    const result = await getDialog().requestSilent(METHODS.guest, []);
+                    const result = await getDialog().requestSilent(METHODS.guest, options.additionalAudiences?.length
+                        ? [{ additionalAudiences: options.additionalAudiences }]
+                        : []);
                     if (!result.user)
                         return false;
                     store.setState({
@@ -259,6 +277,7 @@ export function createFlow(options = {}) {
                         ...(result.user.isGuest ? { credential: null, address: null } : {}),
                     });
                     await installSession(result.refreshToken, result.jwt);
+                    deliverAdditionalSessions(result.additionalSessions);
                     return true;
                 }
                 catch {
@@ -336,13 +355,20 @@ export function createFlow(options = {}) {
                 extraCapabilities = { ...(extraCapabilities ?? {}), guestToken };
             }
         }
-        const { session, webauthn, refreshToken } = await runLogin({
+        if (options.additionalAudiences?.length) {
+            extraCapabilities = {
+                ...(extraCapabilities ?? {}),
+                additionalAudiences: options.additionalAudiences,
+            };
+        }
+        const { session, webauthn, refreshToken, additionalSessions } = await runLogin({
             dialog: dialogHost,
             store,
             options: loginOpts,
             ...(extraCapabilities ? { extraCapabilities } : {}),
         });
         await installSession(refreshToken, session.jwt);
+        deliverAdditionalSessions(additionalSessions);
         if (accessKeyModule && accessKeyPrep && webauthn) {
             await accessKeyModule.finalizeAccessKey({
                 address: session.address,

package/dist/sdk/client/index.d.ts

@@ -1,5 +1,5 @@
 export { defaultIdHost, isLocalHostname } from "../id-host";
-export type { AccessKeyOptions, Address, ConnectCapabilities, ConnectResponse, CreateFlowOptions, DialogHost, Flow, FlowCredential, FlowSessionState, FlowState, FlowUser, LoginOptions, MethodName, MountProfileOptions, ProfileButtonHandle, ProfilePosition, Session, } from "../types";
+export type { AccessKeyOptions, AdditionalSession, Address, ConnectCapabilities, ConnectResponse, CreateFlowOptions, DialogHost, Flow, FlowCredential, FlowSessionState, FlowState, FlowUser, LoginOptions, MethodName, MountProfileOptions, ProfileButtonHandle, ProfilePosition, Session, } from "../types";
 export { createFlow, getFlow, requireFlow, resetFlow } from "./create-flow";
 export { createDialogHost } from "./dialog-host";
 export { METHODS } from "./methods";

package/dist/sdk/client/session.js

@@ -40,7 +40,7 @@ export async function runLogin(params) {
     const result = (await dialog.request(METHODS.connect, [
         { capabilities },
     ]));
-    const { jwt, refreshToken, user, credential, webauthn } = result;
+    const { jwt, refreshToken, user, credential, webauthn, additionalSessions } = result;
     const address = credentialToAddress(credential);
     await idb.set(CREDENTIAL_KEY, credential);
     store.setState({ user, jwt, credential, address });
@@ -48,6 +48,7 @@ export async function runLogin(params) {
         session: { user, jwt, credential, address },
         refreshToken,
         webauthn,
+        ...(additionalSessions ? { additionalSessions } : {}),
     };
 }
 /**

package/dist/sdk/start/index.d.ts

@@ -21,7 +21,7 @@
  * into the server bundle there; everything it does lives here.
  */
 import { type ReactNode } from "react";
-import type { FlowSessionState } from "../types";
+import type { AdditionalSession, FlowSessionState } from "../types";
 /**
  * The `beforeLoad` body: during SSR resolve the session server-side (via the
  * app's `getFlowSession` server fn, which appends rotated Set-Cookie values);
@@ -37,6 +37,10 @@ export type FlowRootProps = {
     autoGuest?: boolean;
     /** Override the Flow ID origin; defaults per `defaultIdHost`. */
     host?: string;
+    /** Extra audiences every mint requests (see `CreateFlowOptions`). */
+    additionalAudiences?: readonly string[];
+    /** One-time delivery of the extra sessions (see `CreateFlowOptions`). */
+    onAdditionalSessions?: (sessions: AdditionalSession[]) => void;
     children: ReactNode;
 };
 /**
@@ -45,4 +49,4 @@ export type FlowRootProps = {
  * matches the SSR HTML and no bootstrap refresh runs while the hydrated JWT
  * is fresh.
  */
-export declare function FlowRoot({ session, autoGuest, host, children, }: FlowRootProps): import("react/jsx-runtime").JSX.Element;
+export declare function FlowRoot({ session, autoGuest, host, additionalAudiences, onAdditionalSessions, children, }: FlowRootProps): import("react/jsx-runtime").JSX.Element;

package/dist/sdk/start/index.js

@@ -44,9 +44,15 @@ export async function flowSessionContext(getSession) {
  * matches the SSR HTML and no bootstrap refresh runs while the hydrated JWT
  * is fresh.
  */
-export function FlowRoot({ session, autoGuest, host, children, }) {
+export function FlowRoot({ session, autoGuest, host, additionalAudiences, onAdditionalSessions, children, }) {
     const flow = useMemo(() => typeof window === "undefined"
         ? createStaticFlow(session, { host })
-        : createFlow({ initialState: session, autoGuest, host }), [session, autoGuest, host]);
+        : createFlow({
+            initialState: session,
+            autoGuest,
+            host,
+            additionalAudiences,
+            onAdditionalSessions,
+        }), [session, autoGuest, host, additionalAudiences, onAdditionalSessions]);
     return _jsx(FlowIdProvider, { flow: flow, children: children });
 }

package/dist/sdk/types/auth.d.ts

@@ -14,11 +14,24 @@ export type FlowCredential = {
     id: string;
     publicKey: string;
 };
+/**
+ * A session minted for one of the ADDITIONAL audiences a login requested
+ * (AUTH-39): its own refresh-token lineage and access JWT, both bound to
+ * `audience`. Installed once into that origin's own HttpOnly cookies via its
+ * `/flow/session` route (the embed bootstrap) — never held by page JS beyond
+ * the one-time handoff.
+ */
+export type AdditionalSession = {
+    audience: string;
+    jwt: string;
+    refreshToken: string;
+};
 export type AuthResponse = {
     jwt: string;
     refreshToken: string;
     user: FlowUser;
     credential: FlowCredential;
+    additionalSessions?: AdditionalSession[];
 };
 export type AuthConfig = {
     rpId: string;

package/dist/sdk/types/events.d.ts

@@ -8,7 +8,7 @@ export type AuthOutcome = "success" | "failure" | "info";
 export type AuthMode = "sign-up" | "sign-in";
 /** Client-only funnel steps reported via the `/api/events` beacon. */
 export type FunnelStep = "mode_selected" | "email_entered" | "ceremony_started" | "done_shown";
-export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.refresh.succeeded" | "auth.refresh.failed" | "auth.refresh.reuse" | "auth.refresh.grace" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.audience.rejected" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.done_shown";
+export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.refresh.succeeded" | "auth.refresh.failed" | "auth.refresh.reuse" | "auth.refresh.grace" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.audience.rejected" | "auth.audience.minted" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.done_shown";
 export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "refresh_token_invalid" | "refresh_token_expired" | "refresh_reuse_detected" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "internal_error";
 /** One flat record per event = one row in the `auth_events` stream. */
 export interface AuthEventRecord {

package/dist/sdk/types/index.d.ts

@@ -1,4 +1,4 @@
-export type { AuthConfig, AuthResponse, AuthResponseWithWebAuthn, FlowCredential, FlowUser, PasskeyPluginOptions, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
+export type { AdditionalSession, AuthConfig, AuthResponse, AuthResponseWithWebAuthn, FlowCredential, FlowUser, PasskeyPluginOptions, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
 export type { BoundaryError, DialogCustomFeatures, DialogCustomLabels, DialogError, DialogReferrer, DialogState, ProfileData, ProfileIdentity, } from "./dialog";
 export type { AuthErrorCode, AuthEventName, AuthEventRecord, AuthMode, AuthOutcome, BeaconBody, FunnelStep, } from "./events";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";

package/dist/sdk/types/protocol.d.ts

@@ -1,4 +1,4 @@
-import type { FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
+import type { AdditionalSession, FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { Address } from "./sdk";
 export type MethodName = "wallet_connect" | "personal_sign" | "eth_signTypedData" | "eth_sendTransaction" | "wallet_sendCalls" | "wallet_guest" | "wallet_signout";
 export type ConnectCapabilities = {
@@ -14,6 +14,12 @@ export type ConnectCapabilities = {
      * cookie session; see the register endpoint.
      */
     guestToken?: string;
+    /**
+     * Extra audiences to mint refresh tokens for in the same login (AUTH-39).
+     * The server refuses any entry outside its explicit origin -> audiences
+     * allowlist; allowed entries come back as `additionalSessions`.
+     */
+    additionalAudiences?: readonly string[];
 };
 export type ConnectRequest = [{
     capabilities?: ConnectCapabilities;
@@ -25,6 +31,7 @@ export type ConnectResponse = {
     user: FlowUser;
     credential: FlowCredential;
     webauthn?: WebAuthnSignature;
+    additionalSessions?: AdditionalSession[];
 };
 export type SignMessageRequest = [message: string, address: string];
 export type SignMessageResponse = `0x${string}`;
@@ -74,7 +81,9 @@ export type RestoreResponse = {
     credential: FlowCredential | null;
     address: Address | null;
 };
-export type GuestRequest = [];
+export type GuestRequest = [] | [{
+    additionalAudiences?: readonly string[];
+}];
 /**
  * A guest has no passkey and no derivable wallet address yet, so `credential`
  * and `address` are always null — the shape mirrors RestoreResponse so the SDK
@@ -86,6 +95,7 @@ export type GuestResponse = {
     user: FlowUser;
     credential: null;
     address: null;
+    additionalSessions?: AdditionalSession[];
 };
 export type SignOutRequest = [];
 export type SignOutResponse = {

package/dist/sdk/types/sdk.d.ts

@@ -1,7 +1,7 @@
 import type { ReactNode } from "react";
 import type { Chain, Hex, PrepareTransactionRequestParameters, SendTransactionParameters, SignTypedDataParameters, Transport, WalletClient } from "viem";
 import type { SendCallsParameters } from "viem/actions";
-import type { FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
+import type { AdditionalSession, FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { ConnectCapabilities, ConnectResponse } from "./protocol";
 import type { RoomsApi } from "./rooms";
 export type Address = `0x${string}`;
@@ -88,6 +88,22 @@ export type CreateFlowOptions = {
      * bootstrap.
      */
     initialState?: FlowSessionState | null;
+    /**
+     * Extra audiences every dialog mint (login, guest) requests refresh tokens
+     * for, on top of the app's own (AUTH-39). Only audiences the auth server
+     * explicitly allowlists for this origin succeed — anything else fails the
+     * mint. The minted sessions are delivered once via `onAdditionalSessions`
+     * and never stored; the app forwards each to its own origin (e.g. the
+     * same-site chat embed's `/flow/session`) to be sealed HttpOnly.
+     */
+    additionalAudiences?: readonly string[];
+    /**
+     * One-time delivery of the additional-audience sessions minted at login or
+     * guest creation. Fired after the app's own session installs; the receiver
+     * must hand each session to its audience's origin (the embed bootstrap) and
+     * drop it — nothing here is retained by the SDK.
+     */
+    onAdditionalSessions?: (sessions: AdditionalSession[]) => void;
 };
 export type FlowState = {
     user: FlowUser | null;
@@ -297,6 +313,7 @@ export type RunLoginResult = {
     session: Session;
     refreshToken: string;
     webauthn: ConnectResponse["webauthn"];
+    additionalSessions?: AdditionalSession[];
 };
 export type FinalizeAccessKeyParams = {
     address: Address;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",