@flow-industries/id 0.18.0 → 0.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",
@@ -47,10 +47,7 @@
     "dist/sdk"
   ],
   "scripts": {
-    "dev": "bunx vite & bunx vite --config vite.playground.config.ts & bunx vite --config vite.landing.config.ts & bun run --watch src/index.ts",
-    "dev:dialog": "bunx vite",
-    "dev:playground": "bunx vite --config vite.playground.config.ts",
-    "dev:landing": "bunx vite --config vite.landing.config.ts",
+    "dev": "./dev.sh",
     "build:dialog": "bunx vite build",
     "build:playground": "bunx vite build --config vite.playground.config.ts",
     "build:landing": "bunx vite build --config vite.landing.config.ts",
@@ -59,12 +56,12 @@
     "prepublishOnly": "bun run build:sdk",
     "start": "bun run src/index.ts",
     "worker": "bun run src/worker.ts",
-    "email:dev": "email dev --dir src/emails --port 3010",
     "db:generate": "bunx @better-auth/cli generate",
     "db:migrate:gen": "bunx drizzle-kit generate",
     "db:migrate": "bunx drizzle-kit migrate",
     "db:push": "bunx drizzle-kit push",
     "db:studio": "bunx drizzle-kit studio",
+    "usernames:refresh": "bun run scripts/generate-reserved-usernames.ts",
     "lint": "biome check",
     "test": "bun test src",
     "format": "biome format --write",
@@ -91,9 +88,9 @@
   },
   "devDependencies": {
     "@better-auth/cli": "^1.4.17",
-    "@biomejs/biome": "2.4.12",
+    "@biomejs/biome": "2.5.8",
     "@electric-sql/pglite": "^0.5.4",
-    "@flow-industries/lint": "0.1.0",
+    "@flow-industries/lint": "0.3.0",
     "@react-email/ui": "^6.6.0",
     "@tailwindcss/vite": "^4.1.18",
     "@tanstack/react-router-devtools": "^1.160.0",
@@ -104,6 +101,7 @@
     "@types/react": "^19.2.13",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.3",
+    "biome-anti-slop": "0.1.0",
     "drizzle-kit": "^0.31.8",
     "pino-pretty": "^13.1.3",
     "react-email": "^6.6.0",
@@ -112,6 +110,10 @@
     "typescript": "^5",
     "vite": "^7.3.1"
   },
+  "trustedDependencies": [
+    "esbuild",
+    "sharp"
+  ],
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1073.0",
     "@flow-industries/ui": "^0.19.0",
@@ -146,6 +148,7 @@
     "tempo.ts": "^0.14.2",
     "viem": "2.47.10",
     "wagmi": "^3.4.2",
+    "zod": "^4.3.6",
     "zustand": "^5.0.11"
   }
 }

package/dist/sdk/client/refresh-store.d.ts

@@ -1,22 +0,0 @@
-import type { RefreshCookieConfig } from "../types";
-/**
- * First-party persistence for the rotating refresh token. It lives in the
- * consumer app's OWN localStorage (origin-scoped), so it survives reloads and
- * navigations and — unlike the old id.flow.industries cookie — is never a
- * third-party cookie, so iOS ITP can't block it. Keyed by `host` so pointing
- * the SDK at a different Flow ID origin (dev vs prod) doesn't collide.
- */
-export interface RefreshStore {
-    get(): string | null;
-    set(token: string): void;
-    clear(): void;
-}
-/**
- * With a cookie config (`createFlow({ cookies: true })`) the token is
- * additionally mirrored into a first-party cookie so the app's own server can
- * refresh the session during SSR. Reads prefer the cookie: the only writer
- * that updates one side without the other is that server (Set-Cookie only),
- * and its value is always a successor of whatever localStorage still holds;
- * every client-side write hits both in the same call.
- */
-export declare function makeRefreshStore(host: string, cookie?: RefreshCookieConfig): RefreshStore;

package/dist/sdk/client/refresh-store.js

@@ -1,66 +0,0 @@
-import { clearBrowserCookie, REFRESH_COOKIE_MAX_AGE_S, readBrowserCookie, writeBrowserCookie, } from "../cookies";
-/**
- * With a cookie config (`createFlow({ cookies: true })`) the token is
- * additionally mirrored into a first-party cookie so the app's own server can
- * refresh the session during SSR. Reads prefer the cookie: the only writer
- * that updates one side without the other is that server (Set-Cookie only),
- * and its value is always a successor of whatever localStorage still holds;
- * every client-side write hits both in the same call.
- */
-export function makeRefreshStore(host, cookie) {
-    const key = `flow.id.refresh:${host}`;
-    const readLocal = () => {
-        try {
-            return localStorage.getItem(key);
-        }
-        catch {
-            return null;
-        }
-    };
-    const readCookie = () => {
-        if (!cookie || typeof document === "undefined")
-            return null;
-        return readBrowserCookie(document.cookie, cookie.name);
-    };
-    const store = {
-        get() {
-            return readCookie() ?? readLocal();
-        },
-        set(token) {
-            // Never persist a missing token: localStorage.setItem coerces undefined
-            // to the literal "undefined", which later reads back as a bogus bearer
-            // and 401s as refresh_token_invalid. Fail safe by ignoring it instead.
-            if (!token)
-                return;
-            try {
-                localStorage.setItem(key, token);
-            }
-            catch { }
-            if (cookie) {
-                writeBrowserCookie(cookie.name, token, {
-                    maxAge: REFRESH_COOKIE_MAX_AGE_S,
-                    secure: cookie.secure,
-                });
-            }
-        },
-        clear() {
-            try {
-                localStorage.removeItem(key);
-            }
-            catch { }
-            if (cookie)
-                clearBrowserCookie(cookie.name, { secure: cookie.secure });
-        },
-    };
-    // One-time reconcile so exactly one canonical value exists before the first
-    // refresh: an SSR rotation updates only the cookie, leaving localStorage one
-    // generation behind — presenting that stale token would look like reuse.
-    const fromCookie = readCookie();
-    if (fromCookie && fromCookie !== readLocal()) {
-        try {
-            localStorage.setItem(key, fromCookie);
-        }
-        catch { }
-    }
-    return store;
-}