@flow-industries/id 0.22.0 → 0.23.0

package/dist/sdk/contracts/http.d.ts

@@ -0,0 +1,155 @@
+import { z } from "zod";
+export declare const httpOperations: {
+    readonly startAction: {
+        readonly path: "/api/actions/start";
+        readonly request: z.ZodObject<{
+            sub: z.ZodString;
+            sessionId: z.ZodString;
+            source: z.ZodString;
+            showTimer: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly eventAction: {
+        readonly path: "/api/actions/event";
+        readonly request: z.ZodObject<{
+            sessionId: z.ZodString;
+            kind: z.ZodEnum<{
+                pause: "pause";
+                resume: "resume";
+                focus_lost: "focus_lost";
+                focus_gained: "focus_gained";
+            }>;
+        }, z.core.$strip>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            recorded: z.ZodBoolean;
+        }, z.core.$strip>;
+    };
+    readonly finishAction: {
+        readonly path: "/api/actions/finish";
+        readonly request: z.ZodObject<{
+            sessionId: z.ZodString;
+        }, z.core.$strip>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            xpGranted: z.ZodNullable<z.ZodObject<{
+                granted: z.ZodBoolean;
+                amount: z.ZodNumber;
+                totalXp: z.ZodNumber;
+                flowScore: z.ZodNumber;
+                level: z.ZodNumber;
+                tier: z.ZodNumber;
+                xpIntoLevel: z.ZodNumber;
+                xpForNextLevel: z.ZodNumber;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly reportStateTime: {
+        readonly path: "/api/actions/state-time";
+        readonly request: z.ZodObject<{
+            sub: z.ZodString;
+            day: z.ZodString;
+            states: z.ZodRecord<z.ZodString, z.ZodNumber>;
+        }, z.core.$strip>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly reportXp: {
+        readonly path: "/api/xp/events";
+        readonly request: z.ZodObject<{
+            sub: z.ZodString;
+            source: z.ZodString;
+            durationSeconds: z.ZodOptional<z.ZodNumber>;
+            idempotencyKey: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        readonly response: z.ZodObject<{
+            granted: z.ZodBoolean;
+            amount: z.ZodNumber;
+            totalXp: z.ZodNumber;
+            flowScore: z.ZodNumber;
+            level: z.ZodNumber;
+            tier: z.ZodNumber;
+            xpIntoLevel: z.ZodNumber;
+            xpForNextLevel: z.ZodNumber;
+        }, z.core.$strip>;
+    };
+    readonly reportPresence: {
+        readonly path: "/api/rooms/presence/report";
+        readonly request: z.ZodObject<{
+            channel: z.ZodEnum<{
+                game: "game";
+                voice: "voice";
+                text: "text";
+            }>;
+            rooms: z.ZodArray<z.ZodObject<{
+                roomId: z.ZodString;
+                occupants: z.ZodArray<z.ZodObject<{
+                    sub: z.ZodString;
+                }, z.core.$loose>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly reportPosition: {
+        readonly path: "/api/rooms/position/report";
+        readonly request: z.ZodObject<{
+            positions: z.ZodArray<z.ZodObject<{
+                roomId: z.ZodString;
+                sub: z.ZodString;
+                x: z.ZodNumber;
+                y: z.ZodNumber;
+                z: z.ZodNumber;
+                yaw: z.ZodNumber;
+                worldId: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            stored: z.ZodNumber;
+        }, z.core.$strip>;
+    };
+};
+export declare const jwtClaimsSchema: z.ZodObject<{
+    sub: z.ZodString;
+    aud: z.ZodString;
+    iss: z.ZodString;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    guest: z.ZodBoolean;
+    username: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export declare const sessionResponseSchema: z.ZodObject<{
+    jwt: z.ZodString;
+    refreshToken: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        username: z.ZodString;
+        isGuest: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>;
+    credential: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        publicKey: z.ZodString;
+    }, z.core.$strip>>;
+    additionalSessions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        audience: z.ZodString;
+        jwt: z.ZodString;
+        refreshToken: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$loose>;
+export declare const jwksSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodObject<{
+        kid: z.ZodString;
+        kty: z.ZodLiteral<"OKP">;
+        crv: z.ZodLiteral<"Ed25519">;
+        x: z.ZodString;
+        alg: z.ZodOptional<z.ZodLiteral<"EdDSA">>;
+        use: z.ZodOptional<z.ZodLiteral<"sig">>;
+        d: z.ZodOptional<z.ZodNever>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;

package/dist/sdk/contracts/http.js

@@ -0,0 +1,91 @@
+import { z } from "zod";
+import { actionEventSchema, actionFinishSchema, actionStartSchema, positionReportSchema, presenceReportSchema, stateTimeSchema, xpEventSchema, } from "./reports";
+const okResponseSchema = z.object({ ok: z.literal(true) });
+const xpGrantResponseSchema = z.object({
+    granted: z.boolean(),
+    amount: z.number(),
+    totalXp: z.number(),
+    flowScore: z.number(),
+    level: z.number(),
+    tier: z.number(),
+    xpIntoLevel: z.number(),
+    xpForNextLevel: z.number(),
+});
+export const httpOperations = {
+    startAction: {
+        path: "/api/actions/start",
+        request: actionStartSchema,
+        response: okResponseSchema,
+    },
+    eventAction: {
+        path: "/api/actions/event",
+        request: actionEventSchema,
+        response: okResponseSchema.extend({ recorded: z.boolean() }),
+    },
+    finishAction: {
+        path: "/api/actions/finish",
+        request: actionFinishSchema,
+        response: okResponseSchema.extend({
+            xpGranted: xpGrantResponseSchema.nullable(),
+        }),
+    },
+    reportStateTime: {
+        path: "/api/actions/state-time",
+        request: stateTimeSchema,
+        response: okResponseSchema,
+    },
+    reportXp: {
+        path: "/api/xp/events",
+        request: xpEventSchema,
+        response: xpGrantResponseSchema,
+    },
+    reportPresence: {
+        path: "/api/rooms/presence/report",
+        request: presenceReportSchema,
+        response: okResponseSchema,
+    },
+    reportPosition: {
+        path: "/api/rooms/position/report",
+        request: positionReportSchema,
+        response: okResponseSchema.extend({ stored: z.number() }),
+    },
+};
+export const jwtClaimsSchema = z.looseObject({
+    sub: z.string().min(1),
+    aud: z.string().min(1),
+    iss: z.string().min(1),
+    iat: z.number().int(),
+    exp: z.number().int(),
+    guest: z.boolean(),
+    username: z.string().optional(),
+});
+export const sessionResponseSchema = z.looseObject({
+    jwt: z.string().min(1),
+    refreshToken: z.string().min(1),
+    user: z.looseObject({
+        id: z.string(),
+        username: z.string(),
+        isGuest: z.boolean().optional(),
+    }),
+    credential: z.object({ id: z.string(), publicKey: z.string() }).nullable(),
+    additionalSessions: z
+        .array(z.object({
+        audience: z.string(),
+        jwt: z.string(),
+        refreshToken: z.string(),
+    }))
+        .optional(),
+});
+export const jwksSchema = z.object({
+    keys: z
+        .array(z.object({
+        kid: z.string().min(1),
+        kty: z.literal("OKP"),
+        crv: z.literal("Ed25519"),
+        x: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+        alg: z.literal("EdDSA").optional(),
+        use: z.literal("sig").optional(),
+        d: z.never().optional(),
+    }))
+        .min(1),
+});

package/dist/sdk/contracts/reports.d.ts

@@ -0,0 +1,130 @@
+import { z } from "zod";
+/** Game server → auth: a reportable XP event. */
+export declare const xpEventSchema: z.ZodObject<{
+    sub: z.ZodString;
+    source: z.ZodString;
+    durationSeconds: z.ZodOptional<z.ZodNumber>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Talk and the game report a full snapshot of every active room they hold. */
+export declare const presenceReportSchema: z.ZodObject<{
+    channel: z.ZodEnum<{
+        game: "game";
+        voice: "voice";
+        text: "text";
+    }>;
+    rooms: z.ZodArray<z.ZodObject<{
+        roomId: z.ZodString;
+        occupants: z.ZodArray<z.ZodObject<{
+            sub: z.ZodString;
+        }, z.core.$loose>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** The game server checkpoints each tracked player's last grounded footing. */
+export declare const positionReportSchema: z.ZodObject<{
+    positions: z.ZodArray<z.ZodObject<{
+        roomId: z.ZodString;
+        sub: z.ZodString;
+        x: z.ZodNumber;
+        y: z.ZodNumber;
+        z: z.ZodNumber;
+        yaw: z.ZodNumber;
+        worldId: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const actionStartSchema: z.ZodObject<{
+    sub: z.ZodString;
+    sessionId: z.ZodString;
+    source: z.ZodString;
+    showTimer: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const actionFinishSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+}, z.core.$strip>;
+export declare const actionEventSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    kind: z.ZodEnum<{
+        pause: "pause";
+        resume: "resume";
+        focus_lost: "focus_lost";
+        focus_gained: "focus_gained";
+    }>;
+}, z.core.$strip>;
+export declare const stateTimeSchema: z.ZodObject<{
+    sub: z.ZodString;
+    day: z.ZodString;
+    states: z.ZodRecord<z.ZodString, z.ZodNumber>;
+}, z.core.$strip>;
+export declare const xpDevSchema: z.ZodObject<{
+    sub: z.ZodString;
+    op: z.ZodEnum<{
+        add: "add";
+        set_total: "set_total";
+        set_level: "set_level";
+    }>;
+    value: z.ZodNumber;
+}, z.core.$strip>;
+export declare const reportSchemas: {
+    xpEvent: z.ZodObject<{
+        sub: z.ZodString;
+        source: z.ZodString;
+        durationSeconds: z.ZodOptional<z.ZodNumber>;
+        idempotencyKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    presenceReport: z.ZodObject<{
+        channel: z.ZodEnum<{
+            game: "game";
+            voice: "voice";
+            text: "text";
+        }>;
+        rooms: z.ZodArray<z.ZodObject<{
+            roomId: z.ZodString;
+            occupants: z.ZodArray<z.ZodObject<{
+                sub: z.ZodString;
+            }, z.core.$loose>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    positionReport: z.ZodObject<{
+        positions: z.ZodArray<z.ZodObject<{
+            roomId: z.ZodString;
+            sub: z.ZodString;
+            x: z.ZodNumber;
+            y: z.ZodNumber;
+            z: z.ZodNumber;
+            yaw: z.ZodNumber;
+            worldId: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    actionStart: z.ZodObject<{
+        sub: z.ZodString;
+        sessionId: z.ZodString;
+        source: z.ZodString;
+        showTimer: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+    actionEvent: z.ZodObject<{
+        sessionId: z.ZodString;
+        kind: z.ZodEnum<{
+            pause: "pause";
+            resume: "resume";
+            focus_lost: "focus_lost";
+            focus_gained: "focus_gained";
+        }>;
+    }, z.core.$strip>;
+    actionFinish: z.ZodObject<{
+        sessionId: z.ZodString;
+    }, z.core.$strip>;
+    stateTime: z.ZodObject<{
+        sub: z.ZodString;
+        day: z.ZodString;
+        states: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    }, z.core.$strip>;
+    xpDev: z.ZodObject<{
+        sub: z.ZodString;
+        op: z.ZodEnum<{
+            add: "add";
+            set_total: "set_total";
+            set_level: "set_level";
+        }>;
+        value: z.ZodNumber;
+    }, z.core.$strip>;
+};

package/dist/sdk/contracts/reports.js

@@ -0,0 +1,67 @@
+import { z } from "zod";
+/** Game server → auth: a reportable XP event. */
+export const xpEventSchema = z.object({
+    sub: z.string(),
+    source: z.string(),
+    durationSeconds: z.number().finite().optional(),
+    idempotencyKey: z.string().optional(),
+});
+/** Talk and the game report a full snapshot of every active room they hold. */
+export const presenceReportSchema = z.object({
+    channel: z.enum(["game", "voice", "text"]),
+    rooms: z.array(z.object({
+        roomId: z.string(),
+        occupants: z.array(z.looseObject({ sub: z.string() })),
+    })),
+});
+const POSITION_VALUE_LIMIT = 1_000_000;
+const WORLD_ID_MAX_LENGTH = 64;
+const positionValue = z
+    .number()
+    .min(-POSITION_VALUE_LIMIT)
+    .max(POSITION_VALUE_LIMIT);
+/** The game server checkpoints each tracked player's last grounded footing. */
+export const positionReportSchema = z.object({
+    positions: z.array(z.object({
+        roomId: z.string(),
+        sub: z.string(),
+        x: positionValue,
+        y: positionValue,
+        z: positionValue,
+        yaw: positionValue,
+        worldId: z.string().max(WORLD_ID_MAX_LENGTH),
+    })),
+});
+export const actionStartSchema = z.object({
+    sub: z.string(),
+    sessionId: z.string(),
+    source: z.string(),
+    showTimer: z.boolean().optional(),
+});
+export const actionFinishSchema = z.object({
+    sessionId: z.string(),
+});
+export const actionEventSchema = z.object({
+    sessionId: z.string(),
+    kind: z.enum(["pause", "resume", "focus_lost", "focus_gained"]),
+});
+export const stateTimeSchema = z.object({
+    sub: z.string(),
+    day: z.string(),
+    states: z.record(z.string(), z.number()),
+});
+export const xpDevSchema = z.object({
+    sub: z.string(),
+    op: z.enum(["add", "set_total", "set_level"]),
+    value: z.number().finite(),
+});
+export const reportSchemas = {
+    xpEvent: xpEventSchema,
+    presenceReport: presenceReportSchema,
+    positionReport: positionReportSchema,
+    actionStart: actionStartSchema,
+    actionEvent: actionEventSchema,
+    actionFinish: actionFinishSchema,
+    stateTime: stateTimeSchema,
+    xpDev: xpDevSchema,
+};

package/dist/sdk/dialog/remote/Messenger.d.ts

@@ -12,6 +12,9 @@ export declare function from(messenger: Messenger): Messenger;
  * isolation that prevents arbitrary pages from injecting messages.
  */
 export declare function fromWindow(w: Window, options?: FromWindowOptions): Messenger;
+export declare class BridgeDestroyedError extends Error {
+    constructor();
+}
 /**
  * Combines two Messengers into a bidirectional bridge: `from` is read-side
  * (inbound messages), `to` is write-side (outbound). Adds a "ready"

package/dist/sdk/dialog/remote/Messenger.js

@@ -87,6 +87,12 @@ export function fromWindow(w, options = {}) {
         },
     });
 }
+export class BridgeDestroyedError extends Error {
+    constructor() {
+        super("Message bridge destroyed before the peer was ready");
+        this.name = "BridgeDestroyedError";
+    }
+}
 /**
  * Combines two Messengers into a bidirectional bridge: `from` is read-side
  * (inbound messages), `to` is write-side (outbound). Adds a "ready"
@@ -109,19 +115,19 @@ export function bridge(parameters) {
             from_.destroy();
             to.destroy();
             if (pending)
-                rejectReady();
+                rejectReady(new BridgeDestroyedError());
         },
         on(topic, listener, id) {
             return from_.on(topic, listener, id);
         },
         async send(topic, payload, targetOrigin) {
-            pending = true;
+            pending = waitForReady;
             if (waitForReady)
                 await readyPromise.finally(() => (pending = false));
             return to.send(topic, payload, targetOrigin);
         },
         async sendAsync(topic, payload, targetOrigin) {
-            pending = true;
+            pending = waitForReady;
             if (waitForReady)
                 await readyPromise.finally(() => (pending = false));
             return to.sendAsync(topic, payload, targetOrigin);

package/dist/sdk/react/hooks.d.ts

@@ -28,7 +28,7 @@ export declare function useFlowId(): {
     address: `0x${string}` | null;
     isAuthenticated: boolean;
     isGuest: boolean;
-    login: (options?: import("../types").LoginOptions) => Promise<import("../types").Session>;
+    login: (options?: import("../types").LoginOptions) => Promise<never>;
     logout: () => Promise<void>;
     restore: () => Promise<boolean>;
     ensureGuest: () => Promise<boolean>;

package/dist/sdk/react/profile-button.d.ts

@@ -1,14 +1,3 @@
 import type { ProfileButtonProps } from "../types";
-/**
- * Drops the universal Flow ID profile button into a React tree. Renders a host
- * element (style it via `className` for placement/padding — e.g. top-right) that
- * the pill iframe mounts into; the iframe itself is sized to its content and
- * expands to the profile dialog on click. Resolves the Flow instance from a
- * `<FlowIdProvider>` or the createFlow() singleton.
- *
- * A changing `theme` recolors the mounted pill over its open bridge rather than
- * remounting it: `theme` is deliberately absent from the mount effect's deps,
- * because tearing the iframe down on a light/dark toggle reloads the widget and
- * drops the pill out of the host's layout mid-toggle.
- */
+/** Mount the native account button with access to the current Flow session. */
 export declare function ProfileButton({ className, host, theme }: ProfileButtonProps): import("react/jsx-runtime").JSX.Element;

package/dist/sdk/react/profile-button.js

@@ -2,18 +2,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useRef } from "react";
 import { createProfileButton } from "../client/profile-button";
 import { useFlow } from "./hooks";
-/**
- * Drops the universal Flow ID profile button into a React tree. Renders a host
- * element (style it via `className` for placement/padding — e.g. top-right) that
- * the pill iframe mounts into; the iframe itself is sized to its content and
- * expands to the profile dialog on click. Resolves the Flow instance from a
- * `<FlowIdProvider>` or the createFlow() singleton.
- *
- * A changing `theme` recolors the mounted pill over its open bridge rather than
- * remounting it: `theme` is deliberately absent from the mount effect's deps,
- * because tearing the iframe down on a light/dark toggle reloads the widget and
- * drops the pill out of the host's layout mid-toggle.
- */
+/** Mount the native account button with access to the current Flow session. */
 export function ProfileButton({ className, host, theme }) {
     const flow = useFlow();
     const ref = useRef(null);

package/dist/sdk/session-route.js

@@ -1,4 +1,7 @@
 import { z } from "zod";
+import { browserCompletionSchema } from "./browser-contract";
+import { finishBrowserSession, startBrowserSession, } from "./browser-session-route";
+import { clearCookieString } from "./cookies";
 /**
  * The first-party session route every consumer app serves from its own
  * origin — the only path between a browser and the refresh token. The
@@ -21,13 +24,20 @@ import { z } from "zod";
  */
 import { cookieNamesFor, parseCookieHeader } from "./cookies";
 import { DEFAULT_SESSION_PATH, defaultAudience, resolveIdHost, } from "./id-host";
-import { claimsToUser, clearingCookies, isJwtVerificationFailure, resolveSessionCore, sessionCookies, } from "./session-core";
+import { claimsToUser, clearingCookies, isJwtVerificationFailure, refreshSessionCore, resolveSessionCore, sessionCookies, } from "./session-core";
 import { verifyFlowJWT } from "./verify";
 /** The body the browser SDK posts to its own app's session route. */
 const installBodySchema = z.object({
     refreshToken: z.string().min(1).optional(),
     jwt: z.string().min(1).optional(),
     mint: z.array(z.string()).optional(),
+    action: z.enum(["login", "account", "guest"]).optional(),
+    returnTo: z.string().optional(),
+    signUp: z.boolean().optional(),
+    accessKeyHash: z
+        .string()
+        .regex(/^0x[a-fA-F0-9]{64}$/)
+        .optional(),
 });
 const additionalBodySchema = z.object({
     additionalSessions: z
@@ -72,17 +82,100 @@ function isCrossSite(request, audience) {
 export async function handleSessionRequest(request, opts = {}) {
     const audience = opts.audience ?? defaultAudience(new URL(request.url).origin);
     const issuerUrl = resolveIdHost(opts.issuerUrl, audience);
+    const callback = new URL(request.url);
+    if (request.method === "GET" && callback.searchParams.has("flow_state")) {
+        return finishBrowserSession(request, audience, issuerUrl);
+    }
     if (isCrossSite(request, audience)) {
         return json({ state: null }, 403);
     }
     switch (request.method) {
         case "GET": {
+            if (new URL(request.url).searchParams.get("refresh") === "1") {
+                const token = parseCookieHeader(request.headers.get("Cookie"))[cookieNamesFor(audience).refresh];
+                if (!token)
+                    return json({ state: null }, 200);
+                const result = await refreshSessionCore(issuerUrl, audience, token);
+                if (result === "dead")
+                    return json({ state: null }, 200, clearingCookies(audience));
+                if (!result)
+                    return json({ state: null }, 502);
+                return json({ state: result.session }, 200, result.setCookies);
+            }
             const { session, setCookies } = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl);
-            return json({ state: session }, 200, setCookies);
+            const completionName = `${cookieNamesFor(audience).refresh}.completion`;
+            const raw = parseCookieHeader(request.headers.get("Cookie"))[completionName];
+            let loginCompletion;
+            if (raw) {
+                setCookies.push(clearCookieString(completionName, {
+                    secure: audience.startsWith("https:"),
+                }));
+                try {
+                    const parsed = browserCompletionSchema.safeParse(JSON.parse(decodeURIComponent(atob(raw))));
+                    if (parsed.success &&
+                        parsed.data.expires > Date.now() &&
+                        parsed.data.userId === session?.user.id)
+                        loginCompletion = parsed.data;
+                }
+                catch { }
+            }
+            return json({ state: session, loginCompletion }, 200, setCookies);
         }
         case "POST": {
             const parsed = installBodySchema.safeParse(await request.json().catch(() => null));
             const body = parsed.success ? parsed.data : null;
+            if (body?.action === "login" || body?.action === "account") {
+                try {
+                    return await startBrowserSession(request, audience, issuerUrl, {
+                        ...body,
+                        action: body.action,
+                    });
+                }
+                catch {
+                    return json({ state: null }, 502);
+                }
+            }
+            if (body?.action === "guest") {
+                const existing = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl);
+                if (existing.session)
+                    return json({ state: existing.session }, 200, existing.setCookies);
+                const previousRefresh = parseCookieHeader(request.headers.get("Cookie"))[cookieNamesFor(audience).refresh];
+                if (previousRefresh && existing.setCookies.length === 0)
+                    return json({ state: null }, 502);
+                try {
+                    const headers = new Headers({ "Content-Type": "application/json" });
+                    for (const name of [
+                        "cf-connecting-ip",
+                        "x-forwarded-for",
+                        "user-agent",
+                    ]) {
+                        const value = request.headers.get(name);
+                        if (value)
+                            headers.set(name, value);
+                    }
+                    const result = await fetch(`${issuerUrl}/api/auth/passkey/guest`, {
+                        method: "POST",
+                        headers,
+                        body: JSON.stringify({ audience }),
+                    });
+                    if (!result.ok)
+                        return json({ state: null }, result.status);
+                    // SAFETY: the configured issuer returns this session token pair, verified below.
+                    const data = (await result.json());
+                    const claims = await verifyFlowJWT(data.jwt, { audience, issuerUrl });
+                    return json({
+                        state: {
+                            user: claimsToUser(claims),
+                            jwt: data.jwt,
+                            credential: null,
+                            address: null,
+                        },
+                    }, 200, sessionCookies(audience, data.jwt, data.refreshToken));
+                }
+                catch {
+                    return json({ state: null }, 502);
+                }
+            }
             // Reconcile mint: the browser asks its own server to obtain additional-
             // audience sessions (e.g. talk.flow.game) authorized by the PRIMARY
             // refresh cookie, for an embed that booted with no session of its own.
@@ -137,12 +230,16 @@ export async function handleSessionRequest(request, opts = {}) {
             // an unreachable issuer just leaves the lineage to expire on its own.
             if (token) {
                 try {
-                    await fetch(`${issuerUrl}/api/session/revoke`, {
+                    const response = await fetch(`${issuerUrl}/api/session/revoke`, {
                         method: "POST",
                         headers: { Authorization: `Bearer ${token}` },
                     });
+                    if (!response.ok)
+                        return json({ state: null }, 502);
+                }
+                catch {
+                    return json({ state: null }, 502);
                 }
-                catch { }
             }
             const headers = new Headers({ "Cache-Control": "no-store" });
             for (const cookie of clearingCookies(audience)) {