@flow-industries/id 0.14.0 → 0.16.0

package/dist/sdk/client/create-flow.js

@@ -393,7 +393,13 @@ export function createFlow(options = {}) {
         });
         await installSession(refreshToken, session.jwt);
         deliverAdditionalSessions(additionalSessions);
-        if (accessKeyModule && accessKeyPrep && webauthn) {
+        // webauthn implies a passkey ceremony ran, but the types allow an
+        // email-only session — finalize only with a real credential/address.
+        if (accessKeyModule &&
+            accessKeyPrep &&
+            webauthn &&
+            session.credential &&
+            session.address) {
             await accessKeyModule.finalizeAccessKey({
                 address: session.address,
                 credential: session.credential,

package/dist/sdk/client/profile-button.js

@@ -81,6 +81,13 @@ export function createProfileButton(options) {
             ? { username: user.username, isGuest: user.isGuest === true }
             : null;
     }
+    // The widget's only credential. `getToken` refreshes a token that is missing
+    // or near expiry, so a widget open on a page left idle past the 1h access-
+    // token lifetime still gets a live one instead of a 401.
+    async function answerTokenRequest(bridge, id) {
+        const token = await flow.getToken().catch(() => null);
+        void bridge.send("__internal", { type: "profile-token", id, token });
+    }
     // ----- the persistent pill (stays mounted; sizes to its own content) -----
     const pill = makeFrame();
     let pillWidth = 0;
@@ -105,6 +112,9 @@ export function createProfileButton(options) {
         else if (payload.type === "profile-expand") {
             showDialog();
         }
+        else if (payload.type === "profile-token-request") {
+            void answerTokenRequest(pillBridge, payload.id);
+        }
     });
     // ----- the dialog overlay (lazy; a separate fullscreen iframe layered ABOVE
     // the pill, so the pill shows through its dimmed backdrop) -----
@@ -131,6 +141,10 @@ export function createProfileButton(options) {
                 hideDialog();
                 void flow.logout().catch(() => { });
             }
+            else if (payload.type === "profile-token-request") {
+                if (dialogBridge)
+                    void answerTokenRequest(dialogBridge, payload.id);
+            }
         });
         void dialogBridge.send("__internal", {
             type: "profile-identity",

package/dist/sdk/client/session.js

@@ -41,8 +41,12 @@ export async function runLogin(params) {
         { capabilities },
     ]));
     const { jwt, refreshToken, user, credential, webauthn, additionalSessions } = result;
-    const address = credentialToAddress(credential);
-    await idb.set(CREDENTIAL_KEY, credential);
+    // An email-only login carries no credential — mirror the guest handling:
+    // nothing is persisted to IDB (reserved for a real passkey credential) and
+    // the address stays null until a passkey is added.
+    const address = credential ? credentialToAddress(credential) : null;
+    if (credential)
+        await idb.set(CREDENTIAL_KEY, credential);
     store.setState({ user, jwt, credential, address });
     return {
         session: { user, jwt, credential, address },

package/dist/sdk/client/signing.js

@@ -4,6 +4,11 @@ import { Account, walletNamespaceCompat } from "viem/tempo";
 import { buildAccessKeyAccount, clearAccessKey, consumePendingAuthorization, isExpired, loadAccessKey, } from "./access-key";
 function requireAuth(state) {
     if (!state.credential || !state.address) {
+        // An email-only or guest session is authenticated but has no passkey to
+        // sign with — distinguish that from being signed out entirely.
+        if (state.user) {
+            throw new Error("This session has no passkey — add one to your account to sign");
+        }
         throw new Error("Not authenticated — call flow.login() first");
     }
     return { credential: state.credential, address: state.address };

package/dist/sdk/types/auth.d.ts

@@ -1,4 +1,5 @@
 import type { JWTPayload } from "jose";
+import type { AuthEventName } from "./events";
 export type FlowUser = {
     id: string;
     username: string;
@@ -14,6 +15,17 @@ export type FlowCredential = {
     id: string;
     publicKey: string;
 };
+/** The better-auth session user with Flow's additional fields — the one
+ * shape routes cast `session.user` to instead of ad-hoc inline casts. */
+export interface SessionUser {
+    id: string;
+    email?: string | null;
+    emailVerified?: boolean;
+    username?: string | null;
+    isGuest?: boolean;
+    role?: string | null;
+    image?: string | null;
+}
 /**
  * A session minted for one of the ADDITIONAL audiences a login requested
  * (AUTH-39): its own refresh-token lineage and access JWT, both bound to
@@ -30,7 +42,8 @@ export type AuthResponse = {
     jwt: string;
     refreshToken: string;
     user: FlowUser;
-    credential: FlowCredential;
+    /** Null for an email-only session (no passkey on the account yet). */
+    credential: FlowCredential | null;
     additionalSessions?: AdditionalSession[];
 };
 export type AuthConfig = {
@@ -60,6 +73,56 @@ export type VerifyOptions = {
     audience: string;
     issuerUrl?: string;
 };
+/**
+ * One entry in the signed-in user's session list (`GET /api/account/sessions`).
+ * An entry is either a cookie session (with the activity of its linked app
+ * refresh lineages folded in) or an app-only refresh lineage whose cookie
+ * session no longer exists. `id` is an opaque revocation handle — never a
+ * token, and never another user's row.
+ */
+export type AccountSession = {
+    id: string;
+    /** The app origin the session was opened for; null on a pre-audience row. */
+    audience: string | null;
+    /** Coarse "Browser · OS" from the sign-in user agent; null when unknown. */
+    device: string | null;
+    createdAt: string;
+    /** Latest activity across the cookie session and its app refresh lineages. */
+    lastSeenAt: string;
+    expiresAt: string;
+    /** True for the session serving this request. */
+    isCurrent: boolean;
+};
+export type AccountSessionsResponse = {
+    sessions: AccountSession[];
+};
+/** Result of `DELETE /api/account/sessions/:id`. */
+export type RevokeSessionResponse = {
+    revoked: true;
+    /** True when the caller revoked the session serving the request itself. */
+    wasCurrent: boolean;
+};
+/** Result of `POST /api/account/sessions/revoke-all`. */
+export type RevokeAllSessionsResponse = {
+    revokedSessions: number;
+    revokedLineages: number;
+};
+/**
+ * One entry of the user-facing security feed
+ * (`GET /api/account/security-events`). Country and coarse device only —
+ * the stored ip and raw user agent never leave the server.
+ */
+export type SecurityActivityEntry = {
+    id: string;
+    event: AuthEventName;
+    audience: string | null;
+    country: string | null;
+    device: string | null;
+    createdAt: string;
+};
+export type SecurityActivityResponse = {
+    events: SecurityActivityEntry[];
+};
 export type VerifiedFlowJWT = JWTPayload & {
     sub: string;
     username?: string;

package/dist/sdk/types/dialog.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Async view state for a dialog panel — the three states every fetched
+ * section renders (spinner / retry row / content), so "empty" stays
+ * distinguishable from "not loaded yet".
+ */
+export type Loadable<T> = {
+    status: "loading";
+} | {
+    status: "error";
+} | {
+    status: "ready";
+    data: T;
+};
 export type DialogReferrer = {
     icon?: string | {
         light: string;

package/dist/sdk/types/events.d.ts

@@ -4,12 +4,13 @@
  * here are the contract every dashboard/alert query depends on — changing one
  * is a breaking change to the dashboard.
  */
+import type { GlobalRole } from "./rooms";
 export type AuthOutcome = "success" | "failure" | "info";
 export type AuthMode = "sign-up" | "sign-in";
 /** Client-only funnel steps reported via the `/api/events` beacon. */
-export type FunnelStep = "mode_selected" | "email_entered" | "ceremony_started" | "done_shown";
-export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.refresh.succeeded" | "auth.refresh.failed" | "auth.refresh.reuse" | "auth.refresh.grace" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.audience.rejected" | "auth.audience.minted" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.done_shown";
-export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "refresh_token_invalid" | "refresh_token_expired" | "refresh_epoch_stale" | "refresh_reuse_detected" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "internal_error";
+export type FunnelStep = "mode_selected" | "email_entered" | "ceremony_started" | "ceremony_failed" | "done_shown";
+export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.passkey.added" | "auth.passkey.add_failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.refresh.succeeded" | "auth.refresh.failed" | "auth.refresh.reuse" | "auth.refresh.grace" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.session.revoked" | "auth.session.revoked_all" | "auth.audience.rejected" | "auth.audience.minted" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.role.granted" | "auth.role.revoked" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.ceremony_failed" | "auth.funnel.done_shown";
+export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "refresh_token_invalid" | "refresh_token_expired" | "refresh_epoch_stale" | "refresh_user_epoch_stale" | "refresh_reuse_detected" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "guest_session" | "passkey_exists" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "webauthn_not_allowed" | "webauthn_security" | "webauthn_invalid_state" | "webauthn_not_supported" | "webauthn_constraint" | "webauthn_aborted" | "webauthn_unknown" | "internal_error";
 /** One flat record per event = one row in the `auth_events` stream. */
 export interface AuthEventRecord {
     service: "auth";
@@ -26,6 +27,11 @@ export interface AuthEventRecord {
     mode: AuthMode | null;
     step: FunnelStep | null;
     errorCode: AuthErrorCode | null;
+    /** Role-audit fields: who changed whose global role, from what, to what.
+     * `userId`/`username` carry the target. */
+    actorId: string | null;
+    roleFrom: GlobalRole | null;
+    roleTo: GlobalRole | null;
     ip: string | null;
     country: string | null;
     userAgent: string | null;

package/dist/sdk/types/index.d.ts

@@ -1,10 +1,10 @@
-export type { AdditionalSession, AuthConfig, AuthResponse, AuthResponseWithWebAuthn, FlowCredential, FlowUser, PasskeyPluginOptions, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
-export type { BoundaryError, DialogCustomFeatures, DialogCustomLabels, DialogError, DialogReferrer, DialogState, ProfileData, ProfileIdentity, } from "./dialog";
+export type { AccountSession, AccountSessionsResponse, AdditionalSession, AuthConfig, AuthResponse, AuthResponseWithWebAuthn, FlowCredential, FlowUser, PasskeyPluginOptions, RevokeAllSessionsResponse, RevokeSessionResponse, SecurityActivityEntry, SecurityActivityResponse, SessionUser, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
+export type { BoundaryError, DialogCustomFeatures, DialogCustomLabels, DialogError, DialogReferrer, DialogState, Loadable, ProfileData, ProfileIdentity, } from "./dialog";
 export type { AuthErrorCode, AuthEventName, AuthEventRecord, AuthMode, AuthOutcome, BeaconBody, FunnelStep, } from "./events";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";
 export type { Call, ConnectCapabilities, ConnectRequest, ConnectResponse, GuestRequest, GuestResponse, MethodName, MethodParams, MethodResult, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignOutRequest, SignOutResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
 export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
-export type { CreateRoomInput, MyRooms, RoomChannel, RoomDetail, RoomList, RoomMemberEntry, RoomMembers, RoomOccupancy, RoomOwner, RoomPresenceEntry, RoomPresenceSnapshot, RoomRestrictionKind, RoomRole, RoomSummary, RoomSurfaceSettings, RoomsApi, RoomVisibility, UpdateRoomInput, VerifyRoomContext, } from "./rooms";
+export type { CreateRoomInput, GlobalRole, ModerationSubject, MyRooms, RoleChangeVerdict, RoomChannel, RoomDetail, RoomList, RoomMemberEntry, RoomMembers, RoomOccupancy, RoomOwner, RoomPresenceEntry, RoomPresenceSnapshot, RoomRestrictionKind, RoomRole, RoomSummary, RoomSurfaceSettings, RoomsApi, RoomVisibility, StaffEntry, UpdateRoomInput, VerifyRoomContext, } from "./rooms";
 export type { AccessKeyOptions, AccessKeyPreparation, Address, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowConnectorParameters, FlowCookieNames, FlowIdProviderProps, FlowSessionState, FlowState, Listener, LoginOptions, MountProfileOptions, PrepareArgsWithAuth, PrepareTransactionRequestPhase, ProfileButtonHandle, ProfileButtonProps, ProfilePosition, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, RunLoginParams, RunLoginResult, SendCallsArgs, SendTransactionArgs, Session, SigningContext, SignMessageArgs, SignTypedDataArgs, Store, StoredAccessKey, WagmiConnectCapabilities, WagmiConnectParams, } from "./sdk";
 export type { ResolvedFlowSession, ResolveSessionOptions, SessionRouteOptions, SessionRouteResponse, SessionRouteSession, } from "./server";
 export type { CoinAsset, IdentifiedTx, TxApprove, TxConvert, TxSend, TxSwap, } from "./tx";

package/dist/sdk/types/messenger.d.ts

@@ -90,6 +90,13 @@ export type Schema = [
                 username: string;
                 isGuest: boolean;
             } | null;
+        } | {
+            type: "profile-token-request";
+            id: string;
+        } | {
+            type: "profile-token";
+            id: string;
+            token: string | null;
         } | {
             type: "profile-login";
             mode: "signin" | "signup";

package/dist/sdk/types/protocol.d.ts

@@ -29,7 +29,8 @@ export type ConnectResponse = {
     /** First-party rotating refresh token; the SDK persists it in the app origin. */
     refreshToken: string;
     user: FlowUser;
-    credential: FlowCredential;
+    /** Null when the user registered or signed in with email only (no passkey). */
+    credential: FlowCredential | null;
     webauthn?: WebAuthnSignature;
     additionalSessions?: AdditionalSession[];
 };

package/dist/sdk/types/rooms.d.ts

@@ -5,6 +5,34 @@ export type RoomVisibility = "public" | "unlisted" | "private";
  * Member rows carry moderator|member.
  */
 export type RoomRole = "owner" | "moderator" | "member";
+/**
+ * Global permission tier held on the user row, composing over room roles: an
+ * admin holds owner-power in any room, a platform moderator holds mod-power
+ * anywhere. Read from the DB at enforcement time — never a JWT claim — so a
+ * demotion is instant.
+ */
+export type GlobalRole = "user" | "moderator" | "admin";
+/** What the moderation lattice ranks: a subject's global tier plus their
+ * room-axis role (`owner` from `room.ownerId`, else the member row). */
+export interface ModerationSubject {
+    globalRole: GlobalRole;
+    roomRole: RoomRole | null;
+}
+/** One row of `GET /api/admin/staff` — a user holding a non-`user` tier. */
+export interface StaffEntry {
+    userId: string;
+    username: string;
+    role: GlobalRole;
+}
+/** Outcome of a global-role change request: refused with a reason, or
+ * allowed with the audit event it is (`null` for a no-op). */
+export type RoleChangeVerdict = {
+    allowed: true;
+    event: "auth.role.granted" | "auth.role.revoked" | null;
+} | {
+    allowed: false;
+    reason: "self_target" | "guest_target";
+};
 export type RoomChannel = "game" | "voice" | "text";
 export type RoomRestrictionKind = "ban" | "mute";
 export interface RoomOwner {

package/dist/sdk/types/sdk.d.ts

@@ -140,8 +140,12 @@ export type LoginOptions = {
 export type Session = {
     user: FlowUser;
     jwt: string;
-    credential: FlowCredential;
-    address: Address;
+    /**
+     * Null for an email-only session (registered or signed in without a
+     * passkey). Signing requires a credential — gate wallet UI on its presence.
+     */
+    credential: FlowCredential | null;
+    address: Address | null;
 };
 export type RootCredential = {
     credential: FlowCredential;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",
@@ -91,6 +91,7 @@
   "devDependencies": {
     "@better-auth/cli": "^1.4.17",
     "@biomejs/biome": "2.4.12",
+    "@electric-sql/pglite": "^0.5.4",
     "@flow-industries/lint": "0.1.0",
     "@react-email/ui": "^6.6.0",
     "@tailwindcss/vite": "^4.1.18",
@@ -112,7 +113,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1073.0",
-    "@flow-industries/ui": "^0.15.3",
+    "@flow-industries/ui": "^0.19.0",
     "@hono/otel": "^1.1.2",
     "@openobserve/browser-logs": "^0.3.1",
     "@openobserve/browser-rum": "^0.3.1",