@flow-industries/id 0.14.0 → 0.15.0

package/dist/sdk/client/create-flow.js

@@ -393,7 +393,13 @@ export function createFlow(options = {}) {
         });
         await installSession(refreshToken, session.jwt);
         deliverAdditionalSessions(additionalSessions);
-        if (accessKeyModule && accessKeyPrep && webauthn) {
+        // webauthn implies a passkey ceremony ran, but the types allow an
+        // email-only session — finalize only with a real credential/address.
+        if (accessKeyModule &&
+            accessKeyPrep &&
+            webauthn &&
+            session.credential &&
+            session.address) {
             await accessKeyModule.finalizeAccessKey({
                 address: session.address,
                 credential: session.credential,

package/dist/sdk/client/session.js

@@ -41,8 +41,12 @@ export async function runLogin(params) {
         { capabilities },
     ]));
     const { jwt, refreshToken, user, credential, webauthn, additionalSessions } = result;
-    const address = credentialToAddress(credential);
-    await idb.set(CREDENTIAL_KEY, credential);
+    // An email-only login carries no credential — mirror the guest handling:
+    // nothing is persisted to IDB (reserved for a real passkey credential) and
+    // the address stays null until a passkey is added.
+    const address = credential ? credentialToAddress(credential) : null;
+    if (credential)
+        await idb.set(CREDENTIAL_KEY, credential);
     store.setState({ user, jwt, credential, address });
     return {
         session: { user, jwt, credential, address },

package/dist/sdk/client/signing.js

@@ -4,6 +4,11 @@ import { Account, walletNamespaceCompat } from "viem/tempo";
 import { buildAccessKeyAccount, clearAccessKey, consumePendingAuthorization, isExpired, loadAccessKey, } from "./access-key";
 function requireAuth(state) {
     if (!state.credential || !state.address) {
+        // An email-only or guest session is authenticated but has no passkey to
+        // sign with — distinguish that from being signed out entirely.
+        if (state.user) {
+            throw new Error("This session has no passkey — add one to your account to sign");
+        }
         throw new Error("Not authenticated — call flow.login() first");
     }
     return { credential: state.credential, address: state.address };

package/dist/sdk/types/auth.d.ts

@@ -30,7 +30,8 @@ export type AuthResponse = {
     jwt: string;
     refreshToken: string;
     user: FlowUser;
-    credential: FlowCredential;
+    /** Null for an email-only session (no passkey on the account yet). */
+    credential: FlowCredential | null;
     additionalSessions?: AdditionalSession[];
 };
 export type AuthConfig = {

package/dist/sdk/types/events.d.ts

@@ -7,9 +7,9 @@
 export type AuthOutcome = "success" | "failure" | "info";
 export type AuthMode = "sign-up" | "sign-in";
 /** Client-only funnel steps reported via the `/api/events` beacon. */
-export type FunnelStep = "mode_selected" | "email_entered" | "ceremony_started" | "done_shown";
-export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.refresh.succeeded" | "auth.refresh.failed" | "auth.refresh.reuse" | "auth.refresh.grace" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.audience.rejected" | "auth.audience.minted" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.done_shown";
-export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "refresh_token_invalid" | "refresh_token_expired" | "refresh_epoch_stale" | "refresh_reuse_detected" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "internal_error";
+export type FunnelStep = "mode_selected" | "email_entered" | "ceremony_started" | "ceremony_failed" | "done_shown";
+export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.passkey.added" | "auth.passkey.add_failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.refresh.succeeded" | "auth.refresh.failed" | "auth.refresh.reuse" | "auth.refresh.grace" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.audience.rejected" | "auth.audience.minted" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.ceremony_failed" | "auth.funnel.done_shown";
+export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "refresh_token_invalid" | "refresh_token_expired" | "refresh_epoch_stale" | "refresh_reuse_detected" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "guest_session" | "passkey_exists" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "webauthn_not_allowed" | "webauthn_security" | "webauthn_invalid_state" | "webauthn_not_supported" | "webauthn_constraint" | "webauthn_aborted" | "webauthn_unknown" | "internal_error";
 /** One flat record per event = one row in the `auth_events` stream. */
 export interface AuthEventRecord {
     service: "auth";

package/dist/sdk/types/protocol.d.ts

@@ -29,7 +29,8 @@ export type ConnectResponse = {
     /** First-party rotating refresh token; the SDK persists it in the app origin. */
     refreshToken: string;
     user: FlowUser;
-    credential: FlowCredential;
+    /** Null when the user registered or signed in with email only (no passkey). */
+    credential: FlowCredential | null;
     webauthn?: WebAuthnSignature;
     additionalSessions?: AdditionalSession[];
 };

package/dist/sdk/types/sdk.d.ts

@@ -140,8 +140,12 @@ export type LoginOptions = {
 export type Session = {
     user: FlowUser;
     jwt: string;
-    credential: FlowCredential;
-    address: Address;
+    /**
+     * Null for an email-only session (registered or signed in without a
+     * passkey). Signing requires a credential — gate wallet UI on its presence.
+     */
+    credential: FlowCredential | null;
+    address: Address | null;
 };
 export type RootCredential = {
     credential: FlowCredential;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",