@flow-industries/id 0.2.0 → 0.2.6

package/README.md

@@ -1,255 +1,33 @@
 # Flow ID
 
-Passkey-first identity for Flow applications. One passkey bound to `id.flow.industries`, usable across all Flow apps, with optional Tempo chain support.
+Passkey-first identity for Flow applications. One passkey bound to `id.flow.industries`, usable across Flow apps with audience-bound JWTs and optional Tempo signing.
 
 **npm:** [`@flow-industries/id`](https://www.npmjs.com/package/@flow-industries/id)
 
 ## Installation
 
 ```bash
-bun add @flow-industries/id wagmi viem @tanstack/react-query
-```
-
-## Integration
-
-### Option 1: Wagmi connector
-
-Best for apps that use wagmi/viem and want standard React hooks (`useAccount`, `useConnect`, `useSendTransaction`).
-
-**Set up the config:**
-
-```ts
-// config.ts
-import { createConfig, http, createStorage, webSocket } from "wagmi"
-import { tempoModerato } from "viem/chains"
-import { withFeePayer } from "viem/tempo"
-import { flow } from "@flow-industries/id"
-
-const alphaUsd = "0x20c0000000000000000000000000000000000001"
-
-export const config = createConfig({
-  chains: [tempoModerato.extend({ feeToken: alphaUsd })],
-  connectors: [
-    flow({
-      host: "https://id.flow.industries/dialog",
-      rpId: "id.flow.industries",
-      accessKey: true, // enables in-page tx signing without passkey prompts
-    }),
-  ],
-  storage: createStorage({ storage: localStorage }),
-  transports: {
-    [tempoModerato.id]: withFeePayer(
-      webSocket(),          // regular transactions
-      http("/fee-payer"),   // sponsored transactions
-    ),
-  },
-})
-```
-
-**Wrap your app:**
-
-```tsx
-// main.tsx
-import { WagmiProvider } from "wagmi"
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
-import { config } from "./config"
-
-const queryClient = new QueryClient()
-
-createRoot(document.getElementById("root")!).render(
-  <WagmiProvider config={config}>
-    <QueryClientProvider client={queryClient}>
-      <App />
-    </QueryClientProvider>
-  </WagmiProvider>
-)
-```
-
-**Authentication:**
-
-```tsx
-import { useAccount, useConnect, useConnectors, useDisconnect } from "wagmi"
-
-function Auth() {
-  const { connect, isPending, error } = useConnect()
-  const [connector] = useConnectors()
-  const account = useAccount()
-  const { disconnect } = useDisconnect()
-
-  if (account.isConnected) {
-    return (
-      <div>
-        <p>Connected: {account.address}</p>
-        <button onClick={() => disconnect()}>Sign out</button>
-      </div>
-    )
-  }
-
-  return (
-    <div>
-      {/* Sign up — opens dialog with username + passkey creation */}
-      <button onClick={() => connect({
-        connector,
-        capabilities: { type: "sign-up" },
-      } as any)}>
-        Sign up
-      </button>
-
-      {/* Sign in — passkey prompt, no dialog UI */}
-      <button onClick={() => connect({
-        connector,
-        capabilities: { type: "sign-in" },
-      } as any)}>
-        Sign in
-      </button>
-
-      {/* Welcome screen — opens dialog, user chooses */}
-      <button onClick={() => connect({ connector })}>
-        Sign in with Flow
-      </button>
-
-      {error && <p>{error.message}</p>}
-    </div>
-  )
-}
-```
-
-**Transactions (Tempo):**
-
-```tsx
-import { Hooks } from "wagmi/tempo"
-import { Value } from "ox"
-
-const alphaUsd = "0x20c0000000000000000000000000000000000001"
-
-function Transfer() {
-  const transfer = Hooks.token.useTransferSync()
-
-  return (
-    <button onClick={() => transfer.mutate({
-      to: "0x...",
-      token: alphaUsd,
-      amount: Value.from("10", 6),
-    })}>
-      Send 10 AlphaUSD
-    </button>
-  )
-}
-```
-
-With `accessKey: true`, transactions sign with an in-page access key — no passkey prompt per transaction. The access key is provisioned automatically during sign-up/sign-in.
-
-**Sponsored transactions:**
-
-```tsx
-transfer.mutate({
-  to: "0x...",
-  token: alphaUsd,
-  amount: Value.from("10", 6),
-  feePayer: true, // routes through fee payer relay
-})
-```
-
-### Option 2: Direct dialog host
-
-Best for apps that don't use wagmi, or want full control over the dialog lifecycle.
-
-```ts
-import { createDialogHost } from "@flow-industries/id"
-
-const dialog = createDialogHost({
-  host: "https://id.flow.industries/dialog",
-})
-```
-
-**Sign up:**
-
-```ts
-const result = await dialog.request("wallet_connect", [
-  { capabilities: { createAccount: true } },
-])
-// result: { user: { id, username }, credential: { id, publicKey } }
-```
-
-**Sign in:**
-
-```ts
-const result = await dialog.request("wallet_connect", [
-  { capabilities: { signIn: true } },
-])
-// result: { user: { id, username }, credential: { id, publicKey } }
-```
-
-**Welcome screen** (user chooses sign up or sign in):
-
-```ts
-const result = await dialog.request("wallet_connect", [
-  { capabilities: {} },
-])
+bun add @flow-industries/id viem
 ```
 
-**Check session:**
+For Wagmi apps:
 
-```ts
-const res = await fetch("https://id.flow.industries/api/me", {
-  credentials: "include",
-})
-const { session } = await res.json()
+```bash
+bun add @flow-industries/id wagmi viem @tanstack/react-query
 ```
 
-## How it works
-
-1. Your app opens the Flow ID dialog (iframe at `id.flow.industries`)
-2. The dialog handles passkey creation/authentication + username onboarding
-3. A session cookie is set on `id.flow.industries`
-4. The credential (id + publicKey) is returned to your app
-5. For Tempo chain apps: an access key is provisioned for in-page transaction signing
-
-The passkey is bound to `id.flow.industries` via WebAuthn's rpId, so the same passkey works across all Flow apps (`flow.game`, `flow.talk`, etc.) through the shared dialog.
-
-## API
-
-### `flow(options)`
-
-Creates a wagmi connector.
-
-| Option | Type | Description |
-|---|---|---|
-| `host` | `string` | Dialog URL (e.g. `https://id.flow.industries/dialog`) |
-| `rpId` | `string?` | WebAuthn relying party ID (e.g. `id.flow.industries`) |
-| `accessKey` | `boolean \| { expiry?: number; strict?: boolean }` | Enable Tempo access key for in-page signing. Default expiry: 24h. |
+## Documentation
 
-### `createDialogHost(options)`
+Full documentation at **[docs.flow.industries/en/auth](https://docs.flow.industries/en/auth)**.
 
-Creates a direct dialog interface.
+- [Getting started](https://docs.flow.industries/en/auth/getting-started) - install the SDK and ship a login button
+- [Concepts](https://docs.flow.industries/en/auth/concepts) - passkeys, audience-bound JWTs, sessions, and access keys
+- [SDK](https://docs.flow.industries/en/auth/sdk/create-flow) - `createFlow`, React hooks, Wagmi connector, and direct dialog control
+- [Wagmi](https://docs.flow.industries/en/auth/sdk/wagmi) - use Flow ID as a Wagmi connector
+- [Signing](https://docs.flow.industries/en/auth/signing) - messages, typed data, transactions, and batch calls
+- [JWT verify](https://docs.flow.industries/en/auth/jwt-verify) - verify Flow sessions on your backend
+- [API reference](https://docs.flow.industries/en/auth/api) and [self-hosting](https://docs.flow.industries/en/auth/self-hosting)
 
-| Option | Type | Description |
-|---|---|---|
-| `host` | `string` | Dialog URL |
-| `container` | `HTMLElement?` | DOM element to attach iframe to (default: `document.body`) |
-
-Returns: `{ open, close, destroy, request, messenger }`
-
-## Server endpoints
-
-| Endpoint | Description |
-|---|---|
-| `GET /api/config` | Returns `{ rpId, rpName }` |
-| `GET /api/me` | Current session/user |
-| `POST /fee-payer` | Tempo fee sponsorship relay |
-| `GET /keys/challenge` | Generate WebAuthn challenge |
-| `GET /keys/:credentialId` | Get stored public key |
-| `POST /keys/:credentialId` | Store public key |
-| `POST /api/auth/passkey/register` | Create user + passkey + session |
-| `POST /api/auth/passkey/challenge` | Generate sign-in challenge |
-| `POST /api/auth/passkey/verify` | Verify passkey + create session |
-
-## Development
-
-```bash
-bun install
-bun run db:push    # create/update database tables
-bun run dev        # starts server (:3000) + dialog (:5175) + playground (:5176)
-```
+## License
 
-Playground at `http://localhost:5176` — has Wagmi and Direct integration demos with Tempo testnet support (faucet, transfers, fee sponsorship).
+MIT

package/dist/sdk/client/access-key.d.ts

@@ -25,6 +25,18 @@ export declare function prepareAccessKey(options: ResolvedAccessKeyOptions, chai
  */
 export declare function finalizeAccessKey(params: FinalizeAccessKeyParams): Promise<void>;
 export declare function loadAccessKey(address: Hex): Promise<StoredAccessKey | undefined>;
+/**
+ * Atomically reads and clears the pending KeyAuthorization for an address.
+ * Called by the chain-level prepareTransactionRequest hook — first
+ * invocation returns the auth so it rides with the outbound tx, subsequent
+ * invocations return null so we don't re-attach.
+ *
+ * Removing the field from storage is what marks the access key as
+ * on-chain-registered. We don't wait for a receipt because the auth is
+ * consumed at consensus, not execution — the keychain entry persists even
+ * if the call inside the tx reverts.
+ */
+export declare function consumePendingAuthorization(address: Hex): Promise<unknown | null>;
 export declare function isExpired(stored: StoredAccessKey): boolean;
 export declare function clearAccessKey(address: Hex): Promise<void>;
 /**

package/dist/sdk/client/access-key.js

@@ -26,7 +26,7 @@ export async function prepareAccessKey(options, chainId) {
         type: "p256",
     });
     const accessKeyHash = KeyAuthorization.getSignPayload(keyAuthUnsigned);
-    return { keyPair, keyAuthUnsigned, accessKeyHash };
+    return { keyPair, keyAuthUnsigned, accessKeyHash, expiry: options.expiry };
 }
 /**
  * Step 2 — runs AFTER the dialog returns the WebAuthn signature.
@@ -60,6 +60,7 @@ export async function finalizeAccessKey(params) {
     const stored = {
         privateKey: preparation.keyPair.privateKey,
         publicKey: preparation.keyPair.publicKey,
+        expiry: preparation.expiry,
         keyAuthorization,
     };
     await idb.set(accessKeyStorageKey(address), stored);
@@ -67,11 +68,34 @@ export async function finalizeAccessKey(params) {
 export async function loadAccessKey(address) {
     return idb.get(accessKeyStorageKey(address));
 }
+/**
+ * Atomically reads and clears the pending KeyAuthorization for an address.
+ * Called by the chain-level prepareTransactionRequest hook — first
+ * invocation returns the auth so it rides with the outbound tx, subsequent
+ * invocations return null so we don't re-attach.
+ *
+ * Removing the field from storage is what marks the access key as
+ * on-chain-registered. We don't wait for a receipt because the auth is
+ * consumed at consensus, not execution — the keychain entry persists even
+ * if the call inside the tx reverts.
+ */
+export async function consumePendingAuthorization(address) {
+    const stored = await loadAccessKey(address);
+    if (!stored?.keyAuthorization)
+        return null;
+    const auth = stored.keyAuthorization;
+    await idb.set(accessKeyStorageKey(address), {
+        ...stored,
+        keyAuthorization: undefined,
+    });
+    return auth;
+}
 export function isExpired(stored) {
     const auth = stored.keyAuthorization;
-    if (!auth?.expiry)
+    const expiry = stored.expiry ?? auth?.expiry;
+    if (!expiry)
         return false;
-    return auth.expiry < Date.now() / 1000;
+    return expiry < Date.now() / 1000;
 }
 export async function clearAccessKey(address) {
     await idb.delete(accessKeyStorageKey(address));

package/dist/sdk/client/create-flow.js

@@ -43,6 +43,15 @@ function resolveAccessKey(input) {
  * bundle.
  */
 export function createFlow(options = {}) {
+    // Idempotent: subsequent calls return the existing singleton instead of
+    // replacing it. React StrictMode (effects fire twice) and HMR (module
+    // re-eval) both re-invoke createFlow with the same options — replacing
+    // would orphan the first instance's store subscriptions, dialog iframe,
+    // and IDB writes while components/hooks that captured it keep reading
+    // stale state. For genuine multi-instance scenarios (tests), call
+    // resetFlow() first or pass explicit Flow instances.
+    if (currentFlow)
+        return currentFlow;
     const host = (options.host ?? DEFAULT_HOST).replace(/\/+$/, "");
     const dialogUrl = `${host}/dialog/`;
     const chains = options.chains ?? [];
@@ -51,7 +60,7 @@ export function createFlow(options = {}) {
             return chains[0];
         return chains.find((c) => c.id === chainId);
     };
-    const transports = {};
+    const transports = options.transports ?? {};
     const getTransport = (chainId) => {
         return transports[chainId];
     };
@@ -219,10 +228,6 @@ export function createFlow(options = {}) {
             return getDialog();
         },
     };
-    if (currentFlow && currentFlow !== flow) {
-        console.warn("[flow] createFlow() called more than once — replacing the previous singleton. " +
-            "Pass `flow` explicitly to wagmi/React if you need multiple instances.");
-    }
     currentFlow = flow;
     return flow;
 }

package/dist/sdk/client/session.js

@@ -37,9 +37,12 @@ export async function restoreCredential(store) {
 export async function runLogin(params) {
     const { dialog, store, options, extraCapabilities } = params;
     const lastCredential = await idb.get(LAST_CREDENTIAL_KEY);
+    const signUp = Boolean(options?.signUp);
     const capabilities = {
-        ...(options?.signUp ? { createAccount: true } : {}),
-        ...(lastCredential && !options?.signUp
+        ...(signUp ? { createAccount: true } : {}),
+        ...(!signUp && options?.signIn ? { signIn: true } : {}),
+        ...(!signUp && options?.headless ? { headless: true } : {}),
+        ...(lastCredential && !signUp
             ? { credentialId: lastCredential.id }
             : {}),
         ...(extraCapabilities ?? {}),

package/dist/sdk/client/signing.d.ts

@@ -3,9 +3,9 @@ import type { SendCallsArgs, SendTransactionArgs, SignMessageArgs, SignTypedData
 /**
  * Constructs a viem WalletClient bound to the user's Flow account. Wraps the
  * transport in `walletNamespaceCompat` so Tempo's wallet RPC namespace is
- * available alongside the standard JSON-RPC methods. Used by every signing
- * helper below; consumers can also call this directly via `flow.walletClient()`
- * if they want to drive viem actions themselves.
+ * available alongside the standard JSON-RPC methods, and extends the chain
+ * so a freshly-provisioned access key's KeyAuthorization rides with its
+ * first outbound tx (see `withAccessKeyAuthorization`).
  */
 export declare function buildWalletClient(ctx: SigningContext, chainId?: number): Promise<WalletClient>;
 export declare function signMessage(ctx: SigningContext, args: SignMessageArgs): Promise<Hex>;

package/dist/sdk/client/signing.js

@@ -1,7 +1,7 @@
-import { createWalletClient, http, } from "viem";
+import { createWalletClient, defineChain, http, } from "viem";
 import { sendCalls as viemSendCalls, sendTransaction as viemSendTransaction, signMessage as viemSignMessage, signTypedData as viemSignTypedData, } from "viem/actions";
 import { Account, walletNamespaceCompat } from "viem/tempo";
-import { buildAccessKeyAccount, clearAccessKey, isExpired, loadAccessKey, } from "./access-key";
+import { buildAccessKeyAccount, clearAccessKey, consumePendingAuthorization, isExpired, loadAccessKey, } from "./access-key";
 function requireAuth(state) {
     if (!state.credential || !state.address) {
         throw new Error("Not authenticated — call flow.login() first");
@@ -30,12 +30,68 @@ async function resolveAccount(params) {
     }
     return buildAccessKeyAccount(stored, params.credential, params.rpId);
 }
+/**
+ * Wraps a chain so its prepareTransactionRequest pipeline pulls the pending
+ * KeyAuthorization for `address` out of IDB and merges it into the outbound
+ * tx request. This is how Tempo's keychain learns about the access key —
+ * the auth rides with the first tx and the chain registers it at consensus.
+ *
+ * Doing this at the chain level (not the wallet client) means every viem
+ * tx-sending path picks it up uniformly: wagmi's writeContract, direct
+ * sendTransaction, raw sendRawTransaction. No wallet-client-method
+ * overrides, no per-call SDK wrapper logic.
+ *
+ * Mirrors the @wagmi/core/tempo webAuthn connector pattern.
+ */
+function withAccessKeyAuthorization(chain, address) {
+    const inheritedPrepare = chain.prepareTransactionRequest;
+    const hook = async (args, { phase }) => {
+        const argsWithAuth = args;
+        // Preserve auth threaded by an earlier phase invocation; otherwise
+        // consume one from IDB. Atomic read+clear so re-runs don't
+        // re-attach an already-shipped auth.
+        const keyAuthorization = argsWithAuth.keyAuthorization ??
+            (await consumePendingAuthorization(address));
+        // Delegate to the chain's existing prepareTransactionRequest
+        // (Tempo's chainConfig adds gas adjustments based on signature type
+        // and handles expiring nonces — we'd break those without this).
+        const inheritedResult = await runInheritedPrepare(inheritedPrepare, args, phase);
+        return {
+            ...args,
+            ...inheritedResult,
+            ...(keyAuthorization ? { keyAuthorization } : {}),
+        };
+    };
+    return defineChain({
+        ...chain,
+        prepareTransactionRequest: [
+            hook,
+            {
+                runAt: [
+                    "afterFillParameters",
+                    "beforeFillParameters",
+                    "beforeFillTransaction",
+                ],
+            },
+        ],
+    });
+}
+async function runInheritedPrepare(inherited, args, phase) {
+    if (!inherited)
+        return {};
+    const [fn, options] = typeof inherited === "function" ? [inherited, undefined] : inherited;
+    if (!fn)
+        return {};
+    if (options && !options.runAt.includes(phase))
+        return {};
+    return (await fn(args, { phase })) ?? {};
+}
 /**
  * Constructs a viem WalletClient bound to the user's Flow account. Wraps the
  * transport in `walletNamespaceCompat` so Tempo's wallet RPC namespace is
- * available alongside the standard JSON-RPC methods. Used by every signing
- * helper below; consumers can also call this directly via `flow.walletClient()`
- * if they want to drive viem actions themselves.
+ * available alongside the standard JSON-RPC methods, and extends the chain
+ * so a freshly-provisioned access key's KeyAuthorization rides with its
+ * first outbound tx (see `withAccessKeyAuthorization`).
  */
 export async function buildWalletClient(ctx, chainId) {
     const { credential, address } = requireAuth(ctx.getState());
@@ -51,7 +107,7 @@ export async function buildWalletClient(ctx, chainId) {
     const transport = ctx.getTransport(chain.id) ?? http();
     return createWalletClient({
         account,
-        chain,
+        chain: withAccessKeyAuthorization(chain, address),
         transport: walletNamespaceCompat(transport, { account }),
     });
 }

package/dist/sdk/types/index.d.ts

@@ -1,5 +1,5 @@
 export type { AuthConfig, AuthResponse, AuthResponseWithWebAuthn, FlowCredential, FlowUser, PasskeyPluginOptions, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
-export type { AccessKeyOptions, AccessKeyPreparation, Address, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowIdProviderProps, FlowConnectorParameters, FlowState, Listener, LoginOptions, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, RunLoginParams, RunLoginResult, SendCallsArgs, SendTransactionArgs, Session, SignMessageArgs, SignTypedDataArgs, SigningContext, StoredAccessKey, Store, } from "./sdk";
+export type { AccessKeyOptions, AccessKeyPreparation, Address, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowIdProviderProps, FlowConnectorParameters, FlowState, Listener, LoginOptions, PrepareArgsWithAuth, PrepareTransactionRequestPhase, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, RunLoginParams, RunLoginResult, SendCallsArgs, SendTransactionArgs, Session, SignMessageArgs, SignTypedDataArgs, SigningContext, StoredAccessKey, Store, WagmiConnectCapabilities, WagmiConnectParams, } from "./sdk";
 export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
 export type { Call, ConnectCapabilities, ConnectRequest, ConnectResponse, MethodName, MethodParams, MethodResult, RestoreRequest, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignOutRequest, SignOutResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";

package/dist/sdk/types/sdk.d.ts

@@ -1,9 +1,23 @@
-import type { Chain, Hex, SendTransactionParameters, SignTypedDataParameters, Transport, WalletClient } from "viem";
+import type { Chain, Hex, PrepareTransactionRequestParameters, SendTransactionParameters, SignTypedDataParameters, Transport, WalletClient } from "viem";
 import type { SendCallsParameters } from "viem/actions";
 import type { ReactNode } from "react";
 import type { FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { ConnectCapabilities, ConnectResponse } from "./protocol";
 export type Address = `0x${string}`;
+/**
+ * Phases viem invokes a chain's `prepareTransactionRequest` hook at. Inlined
+ * here because viem doesn't export the type itself; we only need the union.
+ */
+export type PrepareTransactionRequestPhase = "beforeFillTransaction" | "beforeFillParameters" | "afterFillParameters";
+/**
+ * Tempo extends viem's `PrepareTransactionRequestParameters` with a
+ * `keyAuthorization` field that rides on the tx envelope. viem's base type
+ * doesn't know about it, so this widening lets the chain-level access-key
+ * injection hook read and write that field without opaque casts.
+ */
+export type PrepareArgsWithAuth = PrepareTransactionRequestParameters & {
+    keyAuthorization?: unknown;
+};
 export type CreateDialogHostOptions = {
     host: string;
     container?: HTMLElement;
@@ -19,7 +33,15 @@ export type ResolvedAccessKeyOptions = {
 export type StoredAccessKey = {
     privateKey: unknown;
     publicKey: unknown;
-    keyAuthorization: unknown;
+    expiry: number;
+    /**
+     * Signed KeyAuthorization granting this access key permission to act for
+     * the parent address. Present until the first tx ships it on-chain — the
+     * chain-level prepareTransactionRequest hook reads and clears it so
+     * subsequent txs run without re-attaching. Absence of this field on a
+     * stored access key means it's already on-chain-registered.
+     */
+    keyAuthorization?: unknown;
 };
 export type AccessKeyPreparation = {
     keyPair: {
@@ -28,11 +50,13 @@ export type AccessKeyPreparation = {
     };
     keyAuthUnsigned: unknown;
     accessKeyHash: string;
+    expiry: number;
 };
 export type CreateFlowOptions = {
     host?: string;
     rpId?: string;
     chains?: readonly Chain[];
+    transports?: Partial<Record<number, Transport>>;
     accessKey?: boolean | AccessKeyOptions;
     /**
      * If true (default), createFlow attempts a silent restore on startup —
@@ -49,6 +73,8 @@ export type FlowState = {
 export type LoginOptions = {
     mode?: "iframe" | "popup";
     signUp?: boolean;
+    signIn?: boolean;
+    headless?: boolean;
 };
 export type Session = {
     user: FlowUser;
@@ -127,13 +153,21 @@ export type Flow = {
     getState(): FlowState;
     dialog: DialogHost;
 };
-export type FlowConnectorParameters = Omit<CreateFlowOptions, "chains"> & {
+export type FlowConnectorParameters = Omit<CreateFlowOptions, "chains" | "transports"> & {
     /**
      * Pass an existing Flow instance so wagmi shares state with direct SDK usage.
      * If omitted, the connector creates its own internal Flow (separate state).
      */
     flow?: Flow;
 };
+export type WagmiConnectCapabilities = ConnectCapabilities & {
+    type?: "sign-up" | "sign-in";
+};
+export type WagmiConnectParams = {
+    capabilities?: WagmiConnectCapabilities;
+    chainId?: number;
+    isReconnecting?: boolean;
+};
 export type FlowIdProviderProps = {
     /**
      * Explicit Flow instance to scope to descendants. Optional — if omitted,

package/dist/sdk/wagmi/index.js

@@ -2,6 +2,17 @@ import { createConnector } from "@wagmi/core";
 import { getAddress, SwitchChainError } from "viem";
 import { createFlow, getFlow as getSingletonFlow } from "../client/create-flow";
 flowConnector.type = "flow";
+function loginOptionsFromCapabilities(capabilities) {
+    const signUp = capabilities?.type === "sign-up" || capabilities?.createAccount;
+    const signIn = capabilities?.type === "sign-in" || capabilities?.signIn;
+    return {
+        ...(signUp ? { signUp: true } : {}),
+        ...(!signUp && signIn ? { signIn: true } : {}),
+        ...(!signUp && (capabilities?.headless || capabilities?.type === "sign-in")
+            ? { headless: true }
+            : {}),
+    };
+}
 /**
  * Wagmi connector adapter for Flow. Drop into your wagmi config with
  * `connectors: [flowConnector()]` — no arguments needed in the common case.
@@ -35,6 +46,7 @@ export function flowConnector(parameters = {}) {
             flow = createFlow({
                 ...rest,
                 chains: [...config.chains],
+                transports: config.transports,
             });
             return flow;
         };
@@ -63,7 +75,8 @@ export function flowConnector(parameters = {}) {
             },
             async connect(params = {}) {
                 const f = getFlow();
-                const isReconnecting = params.isReconnecting;
+                const connectParams = params;
+                const isReconnecting = connectParams.isReconnecting;
                 // Wagmi calls connect({ isReconnecting: true }) on mount when it
                 // thinks there's a previous session. Without this branch we'd open
                 // the dialog (full sign-in) on every page load. Silent restore
@@ -77,13 +90,13 @@ export function flowConnector(parameters = {}) {
                         }
                     }
                     else {
-                        await f.login();
+                        await f.login(loginOptionsFromCapabilities(connectParams.capabilities));
                     }
                 }
                 const address = f.address;
                 if (!address)
                     throw new Error("Failed to connect");
-                const chainId = params.chainId ?? config.chains[0]?.id;
+                const chainId = connectParams.chainId ?? config.chains[0]?.id;
                 if (chainId == null) {
                     throw new Error("Flow connector requires at least one chain to be configured");
                 }

package/package.json

@@ -1,7 +1,9 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.2.0",
-  "module": "src/index.ts",
+  "version": "0.2.6",
+  "main": "./dist/sdk/client/index.js",
+  "module": "./dist/sdk/client/index.js",
+  "types": "./dist/sdk/client/index.d.ts",
   "type": "module",
   "sideEffects": false,
   "publishConfig": {
@@ -56,8 +58,12 @@
     "@wagmi/core": ">=3.0.0"
   },
   "peerDependenciesMeta": {
-    "react": { "optional": true },
-    "@wagmi/core": { "optional": true }
+    "react": {
+      "optional": true
+    },
+    "@wagmi/core": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@better-auth/cli": "^1.4.17",
@@ -75,6 +81,7 @@
     "vite": "^7.3.1"
   },
   "dependencies": {
+    "@flow-industries/id": "^0.2.5",
     "@flow-industries/ui": "^0.11.1",
     "@tanstack/query-sync-storage-persister": "^5.90.22",
     "@tanstack/react-query": "^5.90.20",