@flow-industries/id 0.18.0 → 0.19.1

package/dist/sdk/wagmi/index.js

@@ -5,33 +5,14 @@ flowConnector.type = "flow";
 function loginOptionsFromCapabilities(capabilities) {
     const signUp = capabilities?.type === "sign-up" || capabilities?.createAccount;
     const signIn = capabilities?.type === "sign-in" || capabilities?.signIn;
+    const headless = !signUp &&
+        (capabilities?.signInHeadless || capabilities?.type === "sign-in");
     return {
-        ...(signUp ? { signUp: true } : {}),
-        ...(!signUp && signIn ? { signIn: true } : {}),
-        ...(!signUp &&
-            (capabilities?.signInHeadless || capabilities?.type === "sign-in")
-            ? { signInHeadless: true }
-            : {}),
+        signUp: signUp ? true : undefined,
+        signIn: !signUp && signIn ? true : undefined,
+        signInHeadless: headless ? true : undefined,
     };
 }
-/**
- * Wagmi connector adapter for Flow. Drop into your wagmi config with
- * `connectors: [flowConnector()]` — no arguments needed in the common case.
- *
- * Resolution order for the underlying Flow instance:
- *  1. `parameters.flow` (explicit override — useful for tests)
- *  2. The Flow singleton set by a prior `createFlow()` call
- *  3. Lazily created on first connector use (also sets the singleton)
- *
- * This means wagmi-only apps get a working Flow without ever calling
- * `createFlow`, and apps mixing wagmi + direct SDK calls automatically
- * share state because they all resolve to the same singleton.
- *
- * The `setup()` method subscribes to the Flow store and emits wagmi
- * `connect`/`disconnect` events whenever the address changes — that's how
- * wagmi state stays in sync when login/logout happens via the SDK rather
- * than through wagmi's own `connect()`.
- */
 export function flowConnector(parameters = {}) {
     let flow = parameters.flow ?? null;
     return createConnector((config) => {
@@ -64,6 +45,8 @@ export function flowConnector(parameters = {}) {
                         return;
                     lastAddress = next;
                     if (next) {
+                        /* SAFETY: wagmi types `accounts` as a readonly tuple of its own `Address` brand;
+                           `next` is the checksummed address this connector just resolved. */
                         config.emitter.emit("connect", {
                             accounts: [next],
                             chainId: config.chains[0]?.id ?? 1,
@@ -76,6 +59,7 @@ export function flowConnector(parameters = {}) {
             },
             async connect(params = {}) {
                 const f = getFlow();
+                // SAFETY: wagmi passes its own connect options; WagmiConnectParams names the subset read.
                 const connectParams = params;
                 const isReconnecting = connectParams.isReconnecting;
                 // Wagmi calls connect({ isReconnecting: true }) on mount when it
@@ -135,15 +119,18 @@ export function flowConnector(parameters = {}) {
             },
             async getClient({ chainId } = {}) {
                 const f = getFlow();
-                return f.walletClient({ ...(chainId ? { chainId } : {}) });
+                /* SAFETY: wagmi types getClient against viem's Client generic over its own chain
+                   config; the Flow wallet client implements that surface. */
+                return f.walletClient(chainId ? { chainId } : {});
             },
-            async getProvider({ chainId } = {}) {
-                const client = await this.getClient({
-                    ...(chainId ? { chainId } : {}),
-                });
-                return {
-                    request: client.request,
-                };
+            async getProvider(options = {}) {
+                const client = await this.getClient?.({ chainId: options.chainId });
+                /* SAFETY: the wallet client viem builds always carries `request`; wagmi's Client type
+                   does not name it, which is the only reason this is stated rather than inferred. */
+                const request = Object.entries(Object(client)).find(([k]) => k === "request")?.[1];
+                /* SAFETY: the wallet client viem builds always carries `request`; wagmi's Client type
+                   does not name it, which is the only reason this is read by name. */
+                return { request: request };
             },
             onAccountsChanged() { },
             onChainChanged(chain) {

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.18.0",
+  "version": "0.19.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/flow-industries/auth.git"
+  },
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",
@@ -47,10 +51,7 @@
     "dist/sdk"
   ],
   "scripts": {
-    "dev": "bunx vite & bunx vite --config vite.playground.config.ts & bunx vite --config vite.landing.config.ts & bun run --watch src/index.ts",
-    "dev:dialog": "bunx vite",
-    "dev:playground": "bunx vite --config vite.playground.config.ts",
-    "dev:landing": "bunx vite --config vite.landing.config.ts",
+    "dev": "./dev.sh",
     "build:dialog": "bunx vite build",
     "build:playground": "bunx vite build --config vite.playground.config.ts",
     "build:landing": "bunx vite build --config vite.landing.config.ts",
@@ -59,12 +60,12 @@
     "prepublishOnly": "bun run build:sdk",
     "start": "bun run src/index.ts",
     "worker": "bun run src/worker.ts",
-    "email:dev": "email dev --dir src/emails --port 3010",
     "db:generate": "bunx @better-auth/cli generate",
     "db:migrate:gen": "bunx drizzle-kit generate",
     "db:migrate": "bunx drizzle-kit migrate",
     "db:push": "bunx drizzle-kit push",
     "db:studio": "bunx drizzle-kit studio",
+    "usernames:refresh": "bun run scripts/generate-reserved-usernames.ts",
     "lint": "biome check",
     "test": "bun test src",
     "format": "biome format --write",
@@ -91,9 +92,9 @@
   },
   "devDependencies": {
     "@better-auth/cli": "^1.4.17",
-    "@biomejs/biome": "2.4.12",
+    "@biomejs/biome": "2.5.8",
     "@electric-sql/pglite": "^0.5.4",
-    "@flow-industries/lint": "0.1.0",
+    "@flow-industries/lint": "0.3.0",
     "@react-email/ui": "^6.6.0",
     "@tailwindcss/vite": "^4.1.18",
     "@tanstack/react-router-devtools": "^1.160.0",
@@ -104,6 +105,7 @@
     "@types/react": "^19.2.13",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.3",
+    "biome-anti-slop": "0.1.0",
     "drizzle-kit": "^0.31.8",
     "pino-pretty": "^13.1.3",
     "react-email": "^6.6.0",
@@ -112,6 +114,10 @@
     "typescript": "^5",
     "vite": "^7.3.1"
   },
+  "trustedDependencies": [
+    "esbuild",
+    "sharp"
+  ],
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1073.0",
     "@flow-industries/ui": "^0.19.0",
@@ -146,6 +152,7 @@
     "tempo.ts": "^0.14.2",
     "viem": "2.47.10",
     "wagmi": "^3.4.2",
+    "zod": "^4.3.6",
     "zustand": "^5.0.11"
   }
 }

package/dist/sdk/client/refresh-store.d.ts

@@ -1,22 +0,0 @@
-import type { RefreshCookieConfig } from "../types";
-/**
- * First-party persistence for the rotating refresh token. It lives in the
- * consumer app's OWN localStorage (origin-scoped), so it survives reloads and
- * navigations and — unlike the old id.flow.industries cookie — is never a
- * third-party cookie, so iOS ITP can't block it. Keyed by `host` so pointing
- * the SDK at a different Flow ID origin (dev vs prod) doesn't collide.
- */
-export interface RefreshStore {
-    get(): string | null;
-    set(token: string): void;
-    clear(): void;
-}
-/**
- * With a cookie config (`createFlow({ cookies: true })`) the token is
- * additionally mirrored into a first-party cookie so the app's own server can
- * refresh the session during SSR. Reads prefer the cookie: the only writer
- * that updates one side without the other is that server (Set-Cookie only),
- * and its value is always a successor of whatever localStorage still holds;
- * every client-side write hits both in the same call.
- */
-export declare function makeRefreshStore(host: string, cookie?: RefreshCookieConfig): RefreshStore;

package/dist/sdk/client/refresh-store.js

@@ -1,66 +0,0 @@
-import { clearBrowserCookie, REFRESH_COOKIE_MAX_AGE_S, readBrowserCookie, writeBrowserCookie, } from "../cookies";
-/**
- * With a cookie config (`createFlow({ cookies: true })`) the token is
- * additionally mirrored into a first-party cookie so the app's own server can
- * refresh the session during SSR. Reads prefer the cookie: the only writer
- * that updates one side without the other is that server (Set-Cookie only),
- * and its value is always a successor of whatever localStorage still holds;
- * every client-side write hits both in the same call.
- */
-export function makeRefreshStore(host, cookie) {
-    const key = `flow.id.refresh:${host}`;
-    const readLocal = () => {
-        try {
-            return localStorage.getItem(key);
-        }
-        catch {
-            return null;
-        }
-    };
-    const readCookie = () => {
-        if (!cookie || typeof document === "undefined")
-            return null;
-        return readBrowserCookie(document.cookie, cookie.name);
-    };
-    const store = {
-        get() {
-            return readCookie() ?? readLocal();
-        },
-        set(token) {
-            // Never persist a missing token: localStorage.setItem coerces undefined
-            // to the literal "undefined", which later reads back as a bogus bearer
-            // and 401s as refresh_token_invalid. Fail safe by ignoring it instead.
-            if (!token)
-                return;
-            try {
-                localStorage.setItem(key, token);
-            }
-            catch { }
-            if (cookie) {
-                writeBrowserCookie(cookie.name, token, {
-                    maxAge: REFRESH_COOKIE_MAX_AGE_S,
-                    secure: cookie.secure,
-                });
-            }
-        },
-        clear() {
-            try {
-                localStorage.removeItem(key);
-            }
-            catch { }
-            if (cookie)
-                clearBrowserCookie(cookie.name, { secure: cookie.secure });
-        },
-    };
-    // One-time reconcile so exactly one canonical value exists before the first
-    // refresh: an SSR rotation updates only the cookie, leaving localStorage one
-    // generation behind — presenting that stale token would look like reuse.
-    const fromCookie = readCookie();
-    if (fromCookie && fromCookie !== readLocal()) {
-        try {
-            localStorage.setItem(key, fromCookie);
-        }
-        catch { }
-    }
-    return store;
-}