@flow-industries/id 0.2.0

package/README.md

@@ -0,0 +1,255 @@
+# Flow ID
+
+Passkey-first identity for Flow applications. One passkey bound to `id.flow.industries`, usable across all Flow apps, with optional Tempo chain support.
+
+**npm:** [`@flow-industries/id`](https://www.npmjs.com/package/@flow-industries/id)
+
+## Installation
+
+```bash
+bun add @flow-industries/id wagmi viem @tanstack/react-query
+```
+
+## Integration
+
+### Option 1: Wagmi connector
+
+Best for apps that use wagmi/viem and want standard React hooks (`useAccount`, `useConnect`, `useSendTransaction`).
+
+**Set up the config:**
+
+```ts
+// config.ts
+import { createConfig, http, createStorage, webSocket } from "wagmi"
+import { tempoModerato } from "viem/chains"
+import { withFeePayer } from "viem/tempo"
+import { flow } from "@flow-industries/id"
+
+const alphaUsd = "0x20c0000000000000000000000000000000000001"
+
+export const config = createConfig({
+  chains: [tempoModerato.extend({ feeToken: alphaUsd })],
+  connectors: [
+    flow({
+      host: "https://id.flow.industries/dialog",
+      rpId: "id.flow.industries",
+      accessKey: true, // enables in-page tx signing without passkey prompts
+    }),
+  ],
+  storage: createStorage({ storage: localStorage }),
+  transports: {
+    [tempoModerato.id]: withFeePayer(
+      webSocket(),          // regular transactions
+      http("/fee-payer"),   // sponsored transactions
+    ),
+  },
+})
+```
+
+**Wrap your app:**
+
+```tsx
+// main.tsx
+import { WagmiProvider } from "wagmi"
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
+import { config } from "./config"
+
+const queryClient = new QueryClient()
+
+createRoot(document.getElementById("root")!).render(
+  <WagmiProvider config={config}>
+    <QueryClientProvider client={queryClient}>
+      <App />
+    </QueryClientProvider>
+  </WagmiProvider>
+)
+```
+
+**Authentication:**
+
+```tsx
+import { useAccount, useConnect, useConnectors, useDisconnect } from "wagmi"
+
+function Auth() {
+  const { connect, isPending, error } = useConnect()
+  const [connector] = useConnectors()
+  const account = useAccount()
+  const { disconnect } = useDisconnect()
+
+  if (account.isConnected) {
+    return (
+      <div>
+        <p>Connected: {account.address}</p>
+        <button onClick={() => disconnect()}>Sign out</button>
+      </div>
+    )
+  }
+
+  return (
+    <div>
+      {/* Sign up — opens dialog with username + passkey creation */}
+      <button onClick={() => connect({
+        connector,
+        capabilities: { type: "sign-up" },
+      } as any)}>
+        Sign up
+      </button>
+
+      {/* Sign in — passkey prompt, no dialog UI */}
+      <button onClick={() => connect({
+        connector,
+        capabilities: { type: "sign-in" },
+      } as any)}>
+        Sign in
+      </button>
+
+      {/* Welcome screen — opens dialog, user chooses */}
+      <button onClick={() => connect({ connector })}>
+        Sign in with Flow
+      </button>
+
+      {error && <p>{error.message}</p>}
+    </div>
+  )
+}
+```
+
+**Transactions (Tempo):**
+
+```tsx
+import { Hooks } from "wagmi/tempo"
+import { Value } from "ox"
+
+const alphaUsd = "0x20c0000000000000000000000000000000000001"
+
+function Transfer() {
+  const transfer = Hooks.token.useTransferSync()
+
+  return (
+    <button onClick={() => transfer.mutate({
+      to: "0x...",
+      token: alphaUsd,
+      amount: Value.from("10", 6),
+    })}>
+      Send 10 AlphaUSD
+    </button>
+  )
+}
+```
+
+With `accessKey: true`, transactions sign with an in-page access key — no passkey prompt per transaction. The access key is provisioned automatically during sign-up/sign-in.
+
+**Sponsored transactions:**
+
+```tsx
+transfer.mutate({
+  to: "0x...",
+  token: alphaUsd,
+  amount: Value.from("10", 6),
+  feePayer: true, // routes through fee payer relay
+})
+```
+
+### Option 2: Direct dialog host
+
+Best for apps that don't use wagmi, or want full control over the dialog lifecycle.
+
+```ts
+import { createDialogHost } from "@flow-industries/id"
+
+const dialog = createDialogHost({
+  host: "https://id.flow.industries/dialog",
+})
+```
+
+**Sign up:**
+
+```ts
+const result = await dialog.request("wallet_connect", [
+  { capabilities: { createAccount: true } },
+])
+// result: { user: { id, username }, credential: { id, publicKey } }
+```
+
+**Sign in:**
+
+```ts
+const result = await dialog.request("wallet_connect", [
+  { capabilities: { signIn: true } },
+])
+// result: { user: { id, username }, credential: { id, publicKey } }
+```
+
+**Welcome screen** (user chooses sign up or sign in):
+
+```ts
+const result = await dialog.request("wallet_connect", [
+  { capabilities: {} },
+])
+```
+
+**Check session:**
+
+```ts
+const res = await fetch("https://id.flow.industries/api/me", {
+  credentials: "include",
+})
+const { session } = await res.json()
+```
+
+## How it works
+
+1. Your app opens the Flow ID dialog (iframe at `id.flow.industries`)
+2. The dialog handles passkey creation/authentication + username onboarding
+3. A session cookie is set on `id.flow.industries`
+4. The credential (id + publicKey) is returned to your app
+5. For Tempo chain apps: an access key is provisioned for in-page transaction signing
+
+The passkey is bound to `id.flow.industries` via WebAuthn's rpId, so the same passkey works across all Flow apps (`flow.game`, `flow.talk`, etc.) through the shared dialog.
+
+## API
+
+### `flow(options)`
+
+Creates a wagmi connector.
+
+| Option | Type | Description |
+|---|---|---|
+| `host` | `string` | Dialog URL (e.g. `https://id.flow.industries/dialog`) |
+| `rpId` | `string?` | WebAuthn relying party ID (e.g. `id.flow.industries`) |
+| `accessKey` | `boolean \| { expiry?: number; strict?: boolean }` | Enable Tempo access key for in-page signing. Default expiry: 24h. |
+
+### `createDialogHost(options)`
+
+Creates a direct dialog interface.
+
+| Option | Type | Description |
+|---|---|---|
+| `host` | `string` | Dialog URL |
+| `container` | `HTMLElement?` | DOM element to attach iframe to (default: `document.body`) |
+
+Returns: `{ open, close, destroy, request, messenger }`
+
+## Server endpoints
+
+| Endpoint | Description |
+|---|---|
+| `GET /api/config` | Returns `{ rpId, rpName }` |
+| `GET /api/me` | Current session/user |
+| `POST /fee-payer` | Tempo fee sponsorship relay |
+| `GET /keys/challenge` | Generate WebAuthn challenge |
+| `GET /keys/:credentialId` | Get stored public key |
+| `POST /keys/:credentialId` | Store public key |
+| `POST /api/auth/passkey/register` | Create user + passkey + session |
+| `POST /api/auth/passkey/challenge` | Generate sign-in challenge |
+| `POST /api/auth/passkey/verify` | Verify passkey + create session |
+
+## Development
+
+```bash
+bun install
+bun run db:push    # create/update database tables
+bun run dev        # starts server (:3000) + dialog (:5175) + playground (:5176)
+```
+
+Playground at `http://localhost:5176` — has Wagmi and Direct integration demos with Tempo testnet support (faucet, transfers, fee sponsorship).

package/dist/sdk/chains.d.ts

@@ -0,0 +1,2 @@
+export { tempo, tempoModerato } from "viem/chains";
+export { withFeePayer } from "viem/tempo";

package/dist/sdk/chains.js

@@ -0,0 +1,2 @@
+export { tempo, tempoModerato } from "viem/chains";
+export { withFeePayer } from "viem/tempo";

package/dist/sdk/client/access-key.d.ts

@@ -0,0 +1,37 @@
+import { Account } from "viem/tempo";
+import type { AccessKeyPreparation, Address as Hex, FinalizeAccessKeyParams, FlowCredential, ResolvedAccessKeyOptions, StoredAccessKey } from "../types";
+/**
+ * Step 1 of access-key creation — runs BEFORE the dialog opens.
+ *
+ * Generates an ephemeral P256 key pair (lives in non-extractable WebCrypto)
+ * and builds an unsigned KeyAuthorization that grants this key permission to
+ * sign on behalf of the root account until `expiry`. Returns the key pair
+ * plus a signing payload (`accessKeyHash`) that gets passed into the dialog
+ * so the same WebAuthn ceremony that signs the user in also signs the
+ * authorization — saving a second tap.
+ *
+ * Pairs with `finalizeAccessKey()` after the dialog returns the WebAuthn
+ * signature.
+ */
+export declare function prepareAccessKey(options: ResolvedAccessKeyOptions, chainId: number): Promise<AccessKeyPreparation>;
+/**
+ * Step 2 — runs AFTER the dialog returns the WebAuthn signature.
+ *
+ * Wraps the passkey signature in a SignatureEnvelope, attaches it to the
+ * unsigned KeyAuthorization from `prepareAccessKey`, and persists the
+ * complete (now-signed) access key in IndexedDB keyed by wallet address.
+ * Subsequent signing calls load this and use the access key directly,
+ * bypassing the passkey UI.
+ */
+export declare function finalizeAccessKey(params: FinalizeAccessKeyParams): Promise<void>;
+export declare function loadAccessKey(address: Hex): Promise<StoredAccessKey | undefined>;
+export declare function isExpired(stored: StoredAccessKey): boolean;
+export declare function clearAccessKey(address: Hex): Promise<void>;
+/**
+ * Constructs a viem/tempo Account that signs with the access key but
+ * authorizes against the root passkey credential. The runtime layer uses
+ * this to mint transactions without invoking WebAuthn — the `access` field
+ * carries the passkey-signed authorization that proves the access key is
+ * allowed to act for the address.
+ */
+export declare function buildAccessKeyAccount(stored: StoredAccessKey, rootCredential: FlowCredential, rpId?: string): ReturnType<typeof Account.fromWebCryptoP256>;

package/dist/sdk/client/access-key.js

@@ -0,0 +1,97 @@
+import { Account, WebCryptoP256 } from "viem/tempo";
+import { KeyAuthorization, SignatureEnvelope } from "ox/tempo";
+import * as Address from "ox/Address";
+import * as PublicKey from "ox/PublicKey";
+import { idb } from "./idb";
+/**
+ * Step 1 of access-key creation — runs BEFORE the dialog opens.
+ *
+ * Generates an ephemeral P256 key pair (lives in non-extractable WebCrypto)
+ * and builds an unsigned KeyAuthorization that grants this key permission to
+ * sign on behalf of the root account until `expiry`. Returns the key pair
+ * plus a signing payload (`accessKeyHash`) that gets passed into the dialog
+ * so the same WebAuthn ceremony that signs the user in also signs the
+ * authorization — saving a second tap.
+ *
+ * Pairs with `finalizeAccessKey()` after the dialog returns the WebAuthn
+ * signature.
+ */
+export async function prepareAccessKey(options, chainId) {
+    const keyPair = await WebCryptoP256.createKeyPair();
+    const accessKeyAddress = Address.fromPublicKey(keyPair.publicKey);
+    const keyAuthUnsigned = KeyAuthorization.from({
+        address: accessKeyAddress,
+        chainId: BigInt(chainId),
+        expiry: options.expiry,
+        type: "p256",
+    });
+    const accessKeyHash = KeyAuthorization.getSignPayload(keyAuthUnsigned);
+    return { keyPair, keyAuthUnsigned, accessKeyHash };
+}
+/**
+ * Step 2 — runs AFTER the dialog returns the WebAuthn signature.
+ *
+ * Wraps the passkey signature in a SignatureEnvelope, attaches it to the
+ * unsigned KeyAuthorization from `prepareAccessKey`, and persists the
+ * complete (now-signed) access key in IndexedDB keyed by wallet address.
+ * Subsequent signing calls load this and use the access key directly,
+ * bypassing the passkey UI.
+ */
+export async function finalizeAccessKey(params) {
+    const { address, credential, webauthn, preparation } = params;
+    const signatureEnvelope = SignatureEnvelope.from({
+        metadata: {
+            authenticatorData: webauthn.metadata.authenticatorData,
+            clientDataJSON: webauthn.metadata.clientDataJSON,
+            challengeIndex: webauthn.metadata.challengeIndex,
+            typeIndex: webauthn.metadata.typeIndex,
+        },
+        signature: {
+            r: BigInt(webauthn.signature.r),
+            s: BigInt(webauthn.signature.s),
+        },
+        publicKey: PublicKey.from(`0x${credential.publicKey.replace(/^0x/, "")}`),
+        type: "webAuthn",
+    });
+    const keyAuthorization = KeyAuthorization.from({
+        ...preparation.keyAuthUnsigned,
+        signature: signatureEnvelope,
+    });
+    const stored = {
+        privateKey: preparation.keyPair.privateKey,
+        publicKey: preparation.keyPair.publicKey,
+        keyAuthorization,
+    };
+    await idb.set(accessKeyStorageKey(address), stored);
+}
+export async function loadAccessKey(address) {
+    return idb.get(accessKeyStorageKey(address));
+}
+export function isExpired(stored) {
+    const auth = stored.keyAuthorization;
+    if (!auth?.expiry)
+        return false;
+    return auth.expiry < Date.now() / 1000;
+}
+export async function clearAccessKey(address) {
+    await idb.delete(accessKeyStorageKey(address));
+}
+/**
+ * Constructs a viem/tempo Account that signs with the access key but
+ * authorizes against the root passkey credential. The runtime layer uses
+ * this to mint transactions without invoking WebAuthn — the `access` field
+ * carries the passkey-signed authorization that proves the access key is
+ * allowed to act for the address.
+ */
+export function buildAccessKeyAccount(stored, rootCredential, rpId) {
+    const rootAccount = Account.fromWebAuthnP256(rootCredential, {
+        ...(rpId ? { rpId } : {}),
+    });
+    return Account.fromWebCryptoP256({
+        privateKey: stored.privateKey,
+        publicKey: stored.publicKey,
+    }, { access: rootAccount });
+}
+function accessKeyStorageKey(address) {
+    return `accessKey:${address.toLowerCase()}`;
+}

package/dist/sdk/client/create-flow.d.ts

@@ -0,0 +1,41 @@
+import type { CreateFlowOptions, Flow } from "../types";
+import { credentialToAddress } from "./session";
+/**
+ * Creates the Flow SDK instance — the primary entry point for consumer apps.
+ *
+ * The instance owns:
+ *  - A reactive store for `{ user, jwt, credential, address }`
+ *  - A lazily-constructed dialog host (iframe to `id.flow.industries`)
+ *  - Bound methods for login/logout/restore and signing
+ *
+ * On construction it kicks off two async tasks: rehydrating the credential
+ * from IndexedDB (so signing works even before the JWT is refreshed) and,
+ * unless `autoRestore: false`, attempting a silent JWT refresh through the
+ * hidden dialog iframe. Both run in the background; consumers can subscribe
+ * to state changes via `flow.subscribe`.
+ *
+ * Most signing methods dynamically import their implementation modules so
+ * apps that only use identity (no chain ops) don't pay for the viem/tempo
+ * bundle.
+ */
+export declare function createFlow(options?: CreateFlowOptions): Flow;
+/**
+ * Returns the current Flow singleton, or `null` if `createFlow()` hasn't
+ * been called yet. The singleton is set automatically by `createFlow()` —
+ * this is the fallback that lets `flowConnector()`, `<FlowIdProvider>`,
+ * and the React hooks "just work" without consumers having to thread the
+ * Flow instance through every integration point.
+ */
+export declare function getFlow(): Flow | null;
+/**
+ * Returns the current Flow singleton or throws if uninitialized. Use when
+ * you need the instance and `createFlow()` was definitely supposed to have
+ * been called by now (e.g., inside a React hook).
+ */
+export declare function requireFlow(): Flow;
+/**
+ * Clears the singleton. Intended for tests; production code shouldn't
+ * call this.
+ */
+export declare function resetFlow(): void;
+export { credentialToAddress };

package/dist/sdk/client/create-flow.js

@@ -0,0 +1,259 @@
+import { createDialogHost } from "./dialog-host";
+import { idb } from "./idb";
+import { METHODS } from "./methods";
+import { credentialToAddress, restoreCredential, runLogin, runLogout, } from "./session";
+import { createStore, initialFlowState } from "./store";
+const DEFAULT_HOST = "https://id.flow.industries";
+/**
+ * Normalizes user-supplied access-key configuration into a fully-resolved
+ * shape. Accepts `true` for defaults, a partial options object, or omitted
+ * (returns undefined to disable access keys entirely).
+ *
+ * Default expiry is 24h from now (Unix seconds), `strict: false` so the SDK
+ * silently falls back to the root passkey if the access key is missing or
+ * expired rather than erroring.
+ */
+function resolveAccessKey(input) {
+    if (!input)
+        return undefined;
+    const expiry = Math.floor((Date.now() + 24 * 60 * 60 * 1000) / 1000);
+    if (input === true)
+        return { expiry, strict: false };
+    return {
+        expiry: input.expiry ?? expiry,
+        strict: input.strict ?? false,
+    };
+}
+/**
+ * Creates the Flow SDK instance — the primary entry point for consumer apps.
+ *
+ * The instance owns:
+ *  - A reactive store for `{ user, jwt, credential, address }`
+ *  - A lazily-constructed dialog host (iframe to `id.flow.industries`)
+ *  - Bound methods for login/logout/restore and signing
+ *
+ * On construction it kicks off two async tasks: rehydrating the credential
+ * from IndexedDB (so signing works even before the JWT is refreshed) and,
+ * unless `autoRestore: false`, attempting a silent JWT refresh through the
+ * hidden dialog iframe. Both run in the background; consumers can subscribe
+ * to state changes via `flow.subscribe`.
+ *
+ * Most signing methods dynamically import their implementation modules so
+ * apps that only use identity (no chain ops) don't pay for the viem/tempo
+ * bundle.
+ */
+export function createFlow(options = {}) {
+    const host = (options.host ?? DEFAULT_HOST).replace(/\/+$/, "");
+    const dialogUrl = `${host}/dialog/`;
+    const chains = options.chains ?? [];
+    const getChain = (chainId) => {
+        if (chainId == null)
+            return chains[0];
+        return chains.find((c) => c.id === chainId);
+    };
+    const transports = {};
+    const getTransport = (chainId) => {
+        return transports[chainId];
+    };
+    const accessKeyOptions = resolveAccessKey(options.accessKey);
+    const store = createStore({ ...initialFlowState });
+    let dialog = null;
+    const getDialog = () => {
+        if (!dialog)
+            dialog = createDialogHost({ host: dialogUrl });
+        return dialog;
+    };
+    /**
+     * Mints a fresh JWT from the user's existing cookie session via the hidden
+     * dialog iframe. The iframe is first-party to id.flow.industries so the
+     * `flow_id.session_token` cookie is sent automatically — this is the only
+     * way to read the session from a third-party app (browsers block reading
+     * cross-origin cookies).
+     *
+     * Returns true if a session was found and state was populated, false if the
+     * user has no active session (in which case the caller should fall back to
+     * `flow.login()`). Never throws — restore failures are treated as "no session".
+     */
+    async function restore() {
+        const dialogHost = getDialog();
+        try {
+            const result = await dialogHost.requestSilent(METHODS.restore, []);
+            store.setState({
+                user: result.user,
+                jwt: result.jwt,
+                credential: result.credential,
+                address: result.address,
+            });
+            await idb.set("flow.activeCredential", result.credential);
+            await idb.set("flow.lastActiveCredential", result.credential);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    // refreshJwt is semantically the same as restore — both mint a fresh JWT
+    // from the cookie session. We expose two names because consumers reach for
+    // one or the other based on intent (page-load vs near-expiry).
+    const refreshJwt = restore;
+    void (async () => {
+        await restoreCredential(store);
+        if (options.autoRestore !== false) {
+            await restore();
+        }
+    })();
+    function buildSigningContext() {
+        return {
+            getState: () => store.getSnapshot(),
+            getChain,
+            getTransport,
+            ...(options.rpId ? { rpId: options.rpId } : {}),
+            ...(accessKeyOptions?.strict ? { strict: accessKeyOptions.strict } : {}),
+        };
+    }
+    /**
+     * Opens the dialog iframe and runs the interactive sign-in or sign-up flow.
+     * Resolves with the resulting Session once the user completes authentication;
+     * rejects if the user cancels or the dialog fails.
+     *
+     * If access keys are enabled, this also derives an ephemeral P256 key pair
+     * locally and signs a KeyAuthorization with the passkey during the same
+     * WebAuthn ceremony — so future signing calls can use the access key without
+     * prompting for a passkey tap each time. The KeyAuthorization is finalized
+     * (persisted to IDB) only after the dialog confirms login succeeded.
+     */
+    async function login(loginOpts = {}) {
+        const dialogHost = getDialog();
+        let accessKeyModule;
+        let accessKeyPrep;
+        let extraCapabilities;
+        if (accessKeyOptions) {
+            const chain = getChain();
+            if (!chain) {
+                throw new Error("accessKey requires chains to be configured");
+            }
+            accessKeyModule = await import("./access-key");
+            accessKeyPrep = await accessKeyModule.prepareAccessKey(accessKeyOptions, chain.id);
+            extraCapabilities = { accessKeyHash: accessKeyPrep.accessKeyHash };
+        }
+        const { session, webauthn } = await runLogin({
+            dialog: dialogHost,
+            store,
+            options: loginOpts,
+            ...(extraCapabilities ? { extraCapabilities } : {}),
+        });
+        if (accessKeyModule && accessKeyPrep && webauthn) {
+            await accessKeyModule.finalizeAccessKey({
+                address: session.address,
+                credential: session.credential,
+                webauthn,
+                preparation: accessKeyPrep,
+            });
+        }
+        dialogHost.close();
+        return session;
+    }
+    /**
+     * Performs a full sign-out: tells the server to invalidate the cookie session
+     * (so other Flow apps can't silently restore it), clears local credential and
+     * access-key state, and resets the in-memory store.
+     *
+     * Server-side sign-out is best-effort — if the network call fails (e.g.,
+     * offline) we still clear local state so the UI reflects "signed out". The
+     * cookie will eventually expire on its own.
+     */
+    async function logout() {
+        const dialogHost = getDialog();
+        try {
+            await dialogHost.requestSilent(METHODS.signOut, []);
+        }
+        catch {
+            // Server-side sign-out failed (offline?) — still clear local state.
+        }
+        await runLogout(store);
+        dialog?.close();
+    }
+    const flow = {
+        get user() {
+            return store.getSnapshot().user;
+        },
+        get jwt() {
+            return store.getSnapshot().jwt;
+        },
+        get credential() {
+            return store.getSnapshot().credential;
+        },
+        get address() {
+            return store.getSnapshot().address;
+        },
+        get isAuthenticated() {
+            return store.getSnapshot().user !== null;
+        },
+        login,
+        logout,
+        restore,
+        refreshJwt,
+        signMessage: async (args) => {
+            const mod = await import("./signing");
+            return mod.signMessage(buildSigningContext(), args);
+        },
+        signTypedData: async (args) => {
+            const mod = await import("./signing");
+            return mod.signTypedData(buildSigningContext(), args);
+        },
+        sendTransaction: async (args) => {
+            const mod = await import("./signing");
+            return mod.sendTransaction(buildSigningContext(), args);
+        },
+        sendCalls: async (args) => {
+            const mod = await import("./signing");
+            return mod.sendCalls(buildSigningContext(), args);
+        },
+        walletClient: async (args) => {
+            const mod = await import("./signing");
+            return mod.buildWalletClient(buildSigningContext(), args?.chainId);
+        },
+        subscribe: store.subscribe,
+        getState: store.getSnapshot,
+        get dialog() {
+            return getDialog();
+        },
+    };
+    if (currentFlow && currentFlow !== flow) {
+        console.warn("[flow] createFlow() called more than once — replacing the previous singleton. " +
+            "Pass `flow` explicitly to wagmi/React if you need multiple instances.");
+    }
+    currentFlow = flow;
+    return flow;
+}
+let currentFlow = null;
+/**
+ * Returns the current Flow singleton, or `null` if `createFlow()` hasn't
+ * been called yet. The singleton is set automatically by `createFlow()` —
+ * this is the fallback that lets `flowConnector()`, `<FlowIdProvider>`,
+ * and the React hooks "just work" without consumers having to thread the
+ * Flow instance through every integration point.
+ */
+export function getFlow() {
+    return currentFlow;
+}
+/**
+ * Returns the current Flow singleton or throws if uninitialized. Use when
+ * you need the instance and `createFlow()` was definitely supposed to have
+ * been called by now (e.g., inside a React hook).
+ */
+export function requireFlow() {
+    if (!currentFlow) {
+        throw new Error("Flow has not been initialized. Call createFlow() before using this API, " +
+            "or pass an explicit Flow instance.");
+    }
+    return currentFlow;
+}
+/**
+ * Clears the singleton. Intended for tests; production code shouldn't
+ * call this.
+ */
+export function resetFlow() {
+    currentFlow = null;
+}
+export { credentialToAddress };