@flow-industries/id 0.13.0 → 0.14.0

package/dist/sdk/client/create-flow.js

@@ -151,6 +151,30 @@ export function createFlow(options = {}) {
             return false;
         }
     }
+    /**
+     * Silently mints a session for an additional audience via this app's own
+     * session route (which authorizes it with the primary refresh cookie and
+     * proxies to the issuer). The consumer calls this only when its embed for
+     * `audience` reports it has no session, so nothing is minted for an audience
+     * that already holds a live cookie. Returns null when there's no primary
+     * session or the audience isn't provisioned/allowed for this app.
+     */
+    async function mintAudience(audience) {
+        try {
+            const res = await fetch(sessionPath, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ mint: [audience] }),
+            });
+            if (!res.ok)
+                return null;
+            const { additionalSessions } = (await res.json());
+            return additionalSessions?.find((s) => s.audience === audience) ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * One-time delivery of any additional-audience sessions a mint returned
      * (AUTH-39). Handed straight to the consumer's callback and dropped — the
@@ -436,6 +460,7 @@ export function createFlow(options = {}) {
         ensureGuest,
         refreshJwt,
         getToken,
+        mintAudience,
         rooms: createRoomsApi(host, getToken),
         signMessage: async (args) => {
             const mod = await import("./signing");

package/dist/sdk/client/static-flow.js

@@ -49,6 +49,7 @@ export function createStaticFlow(state, options = {}) {
         ensureGuest: () => unavailable("ensureGuest"),
         refreshJwt: async () => false,
         getToken,
+        mintAudience: async () => null,
         rooms: createRoomsApi(host, getToken),
         signMessage: () => unavailable("signMessage"),
         signTypedData: () => unavailable("signTypedData"),

package/dist/sdk/session-route.js

@@ -66,6 +66,35 @@ export async function handleSessionRequest(request, opts = {}) {
         }
         case "POST": {
             const body = (await request.json().catch(() => null));
+            // Reconcile mint: the browser asks its own server to obtain additional-
+            // audience sessions (e.g. talk.flow.game) authorized by the PRIMARY
+            // refresh cookie, for an embed that booted with no session of its own.
+            // The refresh token never touches page JS — it's read from the HttpOnly
+            // cookie here and presented to the issuer as a bearer.
+            if (Array.isArray(body?.mint)) {
+                const audiences = body.mint.filter((a) => typeof a === "string");
+                const names = cookieNamesFor(audience);
+                const token = parseCookieHeader(request.headers.get("Cookie"))[names.refresh];
+                let additionalSessions = [];
+                if (token && audiences.length > 0) {
+                    try {
+                        const res = await fetch(`${issuerUrl}/api/session/additional`, {
+                            method: "POST",
+                            headers: {
+                                "Content-Type": "application/json",
+                                Authorization: `Bearer ${token}`,
+                            },
+                            body: JSON.stringify({ audiences }),
+                        });
+                        if (res.ok) {
+                            const data = (await res.json());
+                            additionalSessions = data.additionalSessions ?? [];
+                        }
+                    }
+                    catch { }
+                }
+                return json({ state: null, additionalSessions }, 200);
+            }
             const refreshToken = body?.refreshToken;
             const jwt = body?.jwt;
             if (typeof refreshToken !== "string" ||

package/dist/sdk/types/events.d.ts

@@ -9,7 +9,7 @@ export type AuthMode = "sign-up" | "sign-in";
 /** Client-only funnel steps reported via the `/api/events` beacon. */
 export type FunnelStep = "mode_selected" | "email_entered" | "ceremony_started" | "done_shown";
 export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.refresh.succeeded" | "auth.refresh.failed" | "auth.refresh.reuse" | "auth.refresh.grace" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.audience.rejected" | "auth.audience.minted" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.done_shown";
-export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "refresh_token_invalid" | "refresh_token_expired" | "refresh_reuse_detected" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "internal_error";
+export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "refresh_token_invalid" | "refresh_token_expired" | "refresh_epoch_stale" | "refresh_reuse_detected" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "internal_error";
 /** One flat record per event = one row in the `auth_events` stream. */
 export interface AuthEventRecord {
     service: "auth";

package/dist/sdk/types/sdk.d.ts

@@ -250,6 +250,17 @@ export type Flow = {
      * Prefer this over reading `jwt` directly when calling a backend.
      */
     getToken(): Promise<string | null>;
+    /**
+     * Silently obtains a session for an ADDITIONAL audience (e.g. an in-game
+     * chat embed's `talk.flow.game`) authorized by this app's primary cookie,
+     * for the consumer to install into that audience's own origin. Returns null
+     * when there is no primary session or the audience isn't provisioned for this
+     * app. Nothing is minted unless called — a consumer calls it only when its
+     * embed reports it has no session, so an audience that already holds a live
+     * cookie is never re-minted. This is the reconcile path that heals a
+     * returning/guest user whose extra-audience cookie is missing or was retired.
+     */
+    mintAudience(audience: string): Promise<AdditionalSession | null>;
     signMessage(args: SignMessageArgs): Promise<Hex>;
     signTypedData(args: SignTypedDataArgs): Promise<Hex>;
     sendTransaction(args: SendTransactionArgs): Promise<Hex>;

package/dist/sdk/types/server.d.ts

@@ -1,4 +1,4 @@
-import type { FlowCredential, FlowUser, VerifiedFlowJWT } from "./auth";
+import type { AdditionalSession, FlowCredential, FlowUser, VerifiedFlowJWT } from "./auth";
 import type { Address, FlowSessionState } from "./sdk";
 import type { PublicProfile } from "./xp";
 export type ResolveSessionOptions = {
@@ -53,4 +53,10 @@ export type SessionRouteSession = {
 };
 export type SessionRouteResponse = {
     state: SessionRouteSession | null;
+    /**
+     * Additional-audience sessions minted by a reconcile request (POST `{ mint }`)
+     * — one per allowed audience the caller asked to provision. The consumer
+     * forwards each to its audience's own origin to be sealed HttpOnly there.
+     */
+    additionalSessions?: AdditionalSession[];
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",