@flow-industries/id 0.22.1 → 0.23.0

package/dist/sdk/client/create-flow.js

@@ -2,9 +2,8 @@ import { DEFAULT_SESSION_PATH, isLocalHostname, resolveIdHost, } from "../id-hos
 import { isExpiring } from "../token-expiry";
 import { createDialogHost } from "./dialog-host";
 import { idb } from "./idb";
-import { METHODS } from "./methods";
 import { createRoomsApi } from "./rooms";
-import { credentialToAddress, restoreCredential, runLogin, runLogout, } from "./session";
+import { credentialToAddress, runLogout } from "./session";
 import { createStore, initialFlowState } from "./store";
 /**
  * Runs `fn` while holding a cross-tab lock (Web Locks API — origin-scoped by
@@ -73,7 +72,7 @@ export function createFlow(options = {}) {
     if (currentFlow)
         return currentFlow;
     const host = resolveIdHost(options.host);
-    const dialogUrl = `${host}/dialog/`;
+    const dialogUrl = `${host}/dialog/?v=2`;
     const sessionPath = options.sessionPath ?? DEFAULT_SESSION_PATH;
     const rpId = options.rpId ??
         (isLocalHostname(window.location.hostname) ? "localhost" : undefined);
@@ -111,7 +110,13 @@ export function createFlow(options = {}) {
      * rotation response is authoritative for signing state; the JWT hot path
      * knows neither, and overwriting would erase state restored from IDB.
      */
+    let additionalSubject = null;
     function commitSession(session) {
+        const previous = store.getSnapshot().user?.id;
+        if (previous && previous !== session.user.id) {
+            store.setState({ credential: null, address: null });
+            void idb.delete("flow.activeCredential");
+        }
         const next = {
             user: session.user,
             jwt: session.jwt,
@@ -121,6 +126,18 @@ export function createFlow(options = {}) {
             next.address = session.address ?? null;
         }
         store.setState(next);
+        if (additionalSubject !== session.user.id &&
+            options.additionalAudiences?.length) {
+            additionalSubject = session.user.id;
+            void Promise.all(options.additionalAudiences.map(mintAudience))
+                .then((sessions) => {
+                if (store.getSnapshot().user?.id !== session.user.id)
+                    return;
+                const minted = sessions.filter((session) => session !== null);
+                options.onAdditionalSessions?.(minted);
+            })
+                .catch(() => { });
+        }
         // A guest carries a null credential; never persist that — the IDB store is
         // reserved for a real passkey credential and writing null would erase a
         // previously stored one.
@@ -128,6 +145,41 @@ export function createFlow(options = {}) {
             void idb.set("flow.activeCredential", session.credential);
         }
     }
+    async function recoverAccessKey(state, loginCompletion) {
+        const completionKey = "flow.pendingAccessKey.completion";
+        if (loginCompletion)
+            await idb.set(completionKey, {
+                ...loginCompletion,
+                expires: Date.now() + 600_000,
+            });
+        const completion = loginCompletion ??
+            (await idb.get(completionKey));
+        if (completion && completion.userId === state.user.id) {
+            const key = `flow.pendingAccessKey.${completion.loginId}`;
+            const pending = await idb.get(key);
+            if (pending && pending.expires > Date.now() && completion.webauthn) {
+                const fresh = await fetch(`${sessionPath}?refresh=1`);
+                if (!fresh.ok)
+                    throw new Error("Could not restore signing state");
+                // SAFETY: the app session handler returns the SDK protocol response.
+                const resolved = (await fresh.json());
+                if (resolved.state?.user.id === completion.userId &&
+                    resolved.state.credential &&
+                    resolved.state.address) {
+                    commitSession(resolved.state);
+                    const { finalizeAccessKey } = await import("./access-key");
+                    await finalizeAccessKey({
+                        address: resolved.state.address,
+                        credential: resolved.state.credential,
+                        webauthn: completion.webauthn,
+                        preparation: pending.preparation,
+                    });
+                    await idb.delete(key);
+                    await idb.delete(completionKey);
+                }
+            }
+        }
+    }
     /**
      * Resolves a fresh session from the app's own session route. The refresh
      * token lives in an HttpOnly cookie only that route's server can read, so
@@ -144,10 +196,11 @@ export function createFlow(options = {}) {
             if (!res.ok)
                 return false;
             // SAFETY: the app's own /flow/session route answers this shape.
-            const { state } = (await res.json());
+            const { state, loginCompletion } = (await res.json());
             if (!state)
                 return false;
             commitSession(state);
+            await recoverAccessKey(state, loginCompletion).catch(() => { });
             return true;
         }
         catch {
@@ -179,49 +232,6 @@ export function createFlow(options = {}) {
             return null;
         }
     }
-    /**
-     * One-time delivery of any additional-audience sessions a mint returned
-     * (AUTH-39). Handed straight to the consumer's callback and dropped — the
-     * SDK retains nothing; the consumer forwards each to its audience's own
-     * origin (the embed bootstrap) to be sealed HttpOnly there.
-     */
-    function deliverAdditionalSessions(sessions) {
-        if (!sessions?.length || !options.onAdditionalSessions)
-            return;
-        try {
-            options.onAdditionalSessions(sessions);
-        }
-        catch (err) {
-            console.warn("Flow ID: onAdditionalSessions handler threw", err);
-        }
-    }
-    /**
-     * One-time handoff of a freshly minted session (dialog login or guest
-     * mint) to the app's server, which verifies the JWT against the issuer's
-     * JWKS and sets the HttpOnly cookies — the refresh token is never stored
-     * where page JavaScript could read it back. Best-effort: without a
-     * reachable session route the in-memory session still works, it just
-     * can't survive a reload.
-     */
-    async function installSession(refreshToken, jwt) {
-        if (!refreshToken || !jwt)
-            return;
-        try {
-            const res = await fetch(sessionPath, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ refreshToken, jwt }),
-            });
-            if (!res.ok) {
-                console.warn(`Flow ID: session route ${sessionPath} answered ${res.status}; ` +
-                    "the session will not survive a reload");
-            }
-        }
-        catch {
-            console.warn(`Flow ID: no session route at ${sessionPath}; ` +
-                "the session will not survive a reload");
-        }
-    }
     // Every session-route call — boot, ensureGuest, and getToken — funnels
     // through this one lock so concurrent tabs don't fan out parallel
     // rotations. The server dedupes and the auth server's grace window absorbs
@@ -291,22 +301,18 @@ export function createFlow(options = {}) {
                 if (await doRefresh())
                     return true;
                 try {
-                    const result = await getDialog().requestSilent(METHODS.guest, options.additionalAudiences?.length
-                        ? [{ additionalAudiences: options.additionalAudiences }]
-                        : []);
-                    if (!result.user)
-                        return false;
-                    store.setState({
-                        user: result.user,
-                        jwt: result.jwt,
-                        // Only a guest has no credential. The server's idempotency path can
-                        // return a full session here; in that case keep any credential/
-                        // address already in state rather than stripping signing.
-                        credential: result.user.isGuest ? null : undefined,
-                        address: result.user.isGuest ? null : undefined,
+                    const response = await fetch(sessionPath, {
+                        method: "POST",
+                        headers: { "Content-Type": "application/json" },
+                        body: JSON.stringify({ action: "guest" }),
                     });
-                    await installSession(result.refreshToken, result.jwt);
-                    deliverAdditionalSessions(result.additionalSessions);
+                    if (!response.ok)
+                        return false;
+                    // SAFETY: the app session handler returns the SDK protocol response.
+                    const result = (await response.json());
+                    if (!result.state)
+                        return false;
+                    commitSession(result.state);
                     return true;
                 }
                 catch {
@@ -319,24 +325,26 @@ export function createFlow(options = {}) {
         return guestInFlight;
     }
     void (async () => {
-        await restoreCredential(store);
-        // A fresh hydrated JWT means the server already refreshed this request —
-        // running doRefresh() here would rotate a second time for nothing.
-        const hydrated = store.getSnapshot().jwt;
-        if (hydrated && !isExpiring(hydrated))
-            return;
+        void idb.pruneExpired("flow.pendingAccessKey.").catch(() => { });
         if (options.autoRestore !== false) {
-            const restored = await doRefresh();
-            // ensureGuest re-checks (refresh-first) under a cross-tab lock before
-            // minting, so calling it after a failed refresh can't fork a visitor into
-            // duplicate guests across tabs — the extra refresh is the dedup.
-            if (!restored && options.autoGuest)
+            const restored = await refreshViaSession();
+            if (restored) {
+                const response = await fetch(`${sessionPath}?refresh=1`);
+                if (response.ok) {
+                    // SAFETY: the app session handler returns the SDK protocol response.
+                    const result = (await response.json());
+                    if (result.state)
+                        commitSession(result.state);
+                    else
+                        await runLogout(store);
+                }
+            }
+            else if (options.autoGuest)
                 await ensureGuest();
         }
-        else if (options.autoGuest) {
+        else if (options.autoGuest)
             await ensureGuest();
-        }
-    })();
+    })().catch(() => { });
     function buildSigningContext() {
         return {
             getState: () => store.getSnapshot(),
@@ -346,107 +354,108 @@ export function createFlow(options = {}) {
             strict: accessKeyOptions?.strict ? accessKeyOptions.strict : undefined,
         };
     }
-    /**
-     * Opens the dialog iframe and runs the interactive sign-in or sign-up flow.
-     * Resolves with the resulting Session once the user completes authentication;
-     * rejects if the user cancels or the dialog fails.
-     *
-     * If access keys are enabled, this also derives an ephemeral P256 key pair
-     * locally and signs a KeyAuthorization with the passkey during the same
-     * WebAuthn ceremony — so future signing calls can use the access key without
-     * prompting for a passkey tap each time. The KeyAuthorization is finalized
-     * (persisted to IDB) only after the dialog confirms login succeeded.
-     */
+    /** Starts top-level authentication; successful navigation never resolves in this document. */
     async function login(loginOpts = {}) {
-        const dialogHost = getDialog();
-        dialogHost.captureFocus();
-        let accessKeyModule;
-        let accessKeyPrep;
-        let extraCapabilities;
+        if (window.top !== window) {
+            throw new Error("Open sign-in from the containing app.");
+        }
+        let preparation;
         if (accessKeyOptions) {
             const chain = getChain();
-            if (!chain) {
-                throw new Error("accessKey requires chains to be configured");
-            }
-            accessKeyModule = await import("./access-key");
-            accessKeyPrep = await accessKeyModule.prepareAccessKey(accessKeyOptions, chain.id);
-            extraCapabilities = { accessKeyHash: accessKeyPrep.accessKeyHash };
-        }
-        // When the current session is a guest, forward its access token so a
-        // sign-up upgrades that guest in place even where the guest cookie is
-        // unreadable (the iOS top-level sign-up popup). Mint via getToken() rather
-        // than reading store.jwt directly: the cached JWT can be up to an hour stale
-        // on a long-idle tab, and an expired token fails server verification — the
-        // guest would then be registered as a fresh account instead of upgraded.
-        // An app that never becomes a guest forwards nothing.
-        if (store.getSnapshot().user?.isGuest) {
-            const guestToken = await getToken();
-            if (guestToken) {
-                extraCapabilities = { ...(extraCapabilities ?? {}), guestToken };
-            }
+            if (!chain)
+                throw new Error("accessKey requires a configured chain");
+            const { prepareAccessKey } = await import("./access-key");
+            preparation = await prepareAccessKey(accessKeyOptions, chain.id);
         }
-        if (options.additionalAudiences?.length) {
-            extraCapabilities = {
-                ...(extraCapabilities ?? {}),
-                additionalAudiences: options.additionalAudiences,
-            };
-        }
-        const { session, webauthn, refreshToken, additionalSessions } = await runLogin({
-            dialog: dialogHost,
-            store,
-            options: loginOpts,
-            extraCapabilities: extraCapabilities ? extraCapabilities : undefined,
+        const response = await fetch(sessionPath, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                action: "login",
+                accessKeyHash: preparation?.accessKeyHash,
+                signUp: loginOpts.signUp,
+                returnTo: loginOpts.returnTo ??
+                    `${window.location.pathname}${window.location.search}${window.location.hash}`,
+            }),
         });
-        await installSession(refreshToken, session.jwt);
-        deliverAdditionalSessions(additionalSessions);
-        // webauthn implies a passkey ceremony ran, but the types allow an
-        // email-only session — finalize only with a real credential/address.
-        if (accessKeyModule &&
-            accessKeyPrep &&
-            webauthn &&
-            session.credential &&
-            session.address) {
-            await accessKeyModule.finalizeAccessKey({
-                address: session.address,
-                credential: session.credential,
-                webauthn,
-                preparation: accessKeyPrep,
+        if (!response.ok)
+            throw new Error("Could not start sign-in. Reload and try again.");
+        // SAFETY: the app session handler returns the SDK protocol response.
+        const result = (await response.json());
+        if (preparation)
+            await idb.set(`flow.pendingAccessKey.${result.loginId}`, {
+                preparation,
+                expires: Date.now() + 600_000,
             });
-        }
-        // The dialog owns closing in every interactive path: sign-in sends "close"
-        // immediately after responding, sign-up after its brief "Welcome" screen.
-        // Closing here would preempt the welcome screen, and — since the gate can
-        // only see the caller's intent, not the flow the user actually completed —
-        // it fired even when a flow.login() user navigated to sign-up. So don't
-        // close from the connector; let the dialog decide.
-        return session;
+        window.location.assign(result.authorizeUrl);
+        return new Promise((_resolve, reject) => {
+            window.setTimeout(() => reject(new Error("Sign-in navigation did not finish. Try again.")), 30_000);
+        });
+    }
+    function openAccount() {
+        const tab = window.open("about:blank", "_blank");
+        if (!tab)
+            return false;
+        tab.opener = null;
+        tab.document.title = "Opening Flow ID";
+        tab.document.body.textContent = "Opening your Flow ID account…";
+        void fetch(sessionPath, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ action: "account" }),
+        })
+            .then(async (response) => {
+            if (!response.ok)
+                throw new Error("Account unavailable");
+            // SAFETY: the app session handler returns the SDK protocol response.
+            const result = (await response.json());
+            tab.location.replace(result.accountUrl);
+        })
+            .catch(() => {
+            tab.document.title = "Open Flow ID";
+            tab.document.body.textContent =
+                "Your app account could not be opened securely. Return to the app and try again, or open Flow ID and check the signed-in account before making changes. ";
+            const link = tab.document.createElement("a");
+            link.href = `${host}/account`;
+            link.textContent = "Open Flow ID";
+            link.rel = "noreferrer";
+            tab.document.body.appendChild(link);
+        });
+        return true;
     }
-    /**
-     * Performs a full sign-out: tells the id.flow.industries dialog to
-     * invalidate its cookie session (so other Flow apps can't silently restore
-     * it), tells the app's session route to revoke the refresh lineage and
-     * clear the HttpOnly cookies, then clears local credential and access-key
-     * state and resets the in-memory store.
-     *
-     * Both server-side steps are best-effort — if a network call fails (e.g.,
-     * offline) we still clear local state so the UI reflects "signed out". The
-     * cookies and tokens eventually expire on their own.
-     */
     async function logout() {
-        // Both server-side sign-outs are independent and best-effort — if either
-        // fails (offline?) local state still clears so the UI reads "signed out".
-        await Promise.allSettled([
-            getDialog().requestSilent(METHODS.signOut, []),
-            fetch(sessionPath, { method: "DELETE" }),
-        ]);
+        const response = await fetch(sessionPath, { method: "DELETE" });
+        if (!response.ok)
+            throw new Error("Could not sign out. Try again.");
         await runLogout(store);
-        dialog?.close();
-        // An autoGuest app is never truly "signed out" — it always wants at least a
-        // guest session. Re-mint one so the UI (e.g. the profile widget pill) keeps
-        // working after logout instead of vanishing until the next page load.
+        additionalSubject = null;
         if (options.autoGuest)
             await ensureGuest();
     }
+    let focusRefresh = null;
+    const refreshOnFocus = () => {
+        if (document.visibilityState === "hidden" || focusRefresh)
+            return;
+        focusRefresh = withOriginLock("flow.id.refresh", async () => {
+            const response = await fetch(`${sessionPath}?refresh=1`, {
+                headers: { Accept: "application/json" },
+            });
+            if (!response.ok)
+                return;
+            // SAFETY: the app session handler returns the SDK protocol response.
+            const result = (await response.json());
+            if (result.state)
+                commitSession(result.state);
+            else
+                await runLogout(store);
+        })
+            .catch(() => { })
+            .finally(() => {
+            focusRefresh = null;
+        });
+    };
+    window.addEventListener("focus", refreshOnFocus);
+    document.addEventListener("visibilitychange", refreshOnFocus);
     const flow = {
         get user() {
             return store.getSnapshot().user;
@@ -467,8 +476,9 @@ export function createFlow(options = {}) {
             return store.getSnapshot().user?.isGuest === true;
         },
         login,
+        openAccount,
         logout,
-        restore: refreshJwt,
+        restore: refreshViaSession,
         ensureGuest,
         refreshJwt,
         getToken,

package/dist/sdk/client/flow-widget.js

@@ -47,7 +47,7 @@ export function createFlowWidget(options) {
     const hostOrigin = new URL(host).origin;
     let theme = options.theme ?? "light dark";
     const route = WIDGET_ROUTE[options.widget];
-    const frame = makeIframe(`${host}${route}`, WIDGET_TITLE[options.widget]);
+    const frame = makeIframe(`${host}${route}?v=2`, WIDGET_TITLE[options.widget]);
     frame.style.background = "transparent";
     const container = options.container ?? document.body;
     // Appended before bridging: `contentWindow` is null until the frame is in the

package/dist/sdk/client/idb.d.ts

@@ -1,4 +1,5 @@
 export declare const idb: {
+    pruneExpired(prefix: string): Promise<void>;
     get<T = unknown>(key: string): Promise<T | undefined>;
     set<T>(key: string, value: T): Promise<void>;
     delete(key: string): Promise<void>;

package/dist/sdk/client/idb.js

@@ -1,3 +1,5 @@
+import { z } from "zod";
+const expiringEntrySchema = z.object({ expires: z.number().optional() });
 let defaultGetStoreFunc;
 function createStore(dbName, storeName) {
     let dbp;
@@ -38,6 +40,28 @@ function promisify(request) {
     });
 }
 export const idb = {
+    pruneExpired(prefix) {
+        if (!defaultGetStoreFunc)
+            defaultGetStoreFunc = createStore("flow-id", "keyval");
+        return defaultGetStoreFunc("readwrite", (store) => {
+            const request = store.openCursor();
+            request.onsuccess = () => {
+                const cursor = request.result;
+                if (!cursor)
+                    return;
+                const key = z.string().safeParse(cursor.key);
+                if (key.success && key.data.startsWith(prefix)) {
+                    const entry = expiringEntrySchema.safeParse(cursor.value);
+                    if (!entry.success ||
+                        !entry.data.expires ||
+                        entry.data.expires <= Date.now())
+                        cursor.delete();
+                }
+                cursor.continue();
+            };
+            return promisify(store.transaction);
+        });
+    },
     get(key) {
         if (!defaultGetStoreFunc)
             defaultGetStoreFunc = createStore("flow-id", "keyval");

package/dist/sdk/client/open-profile.js

@@ -30,7 +30,7 @@ function createViewer(options) {
         setOverlayFocus(frame, ready && visible);
     }
     function mount(username) {
-        const el = makeIframe(`${host}/dialog/`, "Flow ID profile");
+        const el = makeIframe(`${host}/dialog/?v=2`, "Flow ID profile");
         el.dataset.flowProfileView = "";
         el.inert = true;
         Object.assign(el.style, OVERLAY_STYLE, { pointerEvents: "none" });
@@ -179,6 +179,14 @@ export function openProfile(username, options = {}) {
         return false;
     if (!("document" in globalThis))
         return false;
+    const current = options.flow ?? getFlow();
+    if (current?.user?.username === username) {
+        closeProfile();
+        const opened = current.openAccount();
+        if (opened)
+            queueMicrotask(() => options.onClose?.());
+        return opened;
+    }
     const live = viewer ?? createViewer(options);
     viewer = live;
     if (options.theme)

package/dist/sdk/client/profile-button.d.ts

@@ -1,15 +1,3 @@
 import type { MountProfileOptions, ProfileButtonHandle } from "../types";
-/**
- * Mounts the universal Flow ID "profile button" — a persistent inline iframe
- * showing the signed-in user's avatar + username (the collapsed pill). Clicking
- * it opens the profile dialog in a SEPARATE fullscreen overlay iframe, so the
- * pill stays in place behind the dialog's dimmed backdrop rather than morphing
- * into it. Both iframes ride the dialog SPA at `${host}/dialog/` (routes
- * `/dialog/profile-pill` and `/dialog/profile`) so the chrome matches the auth
- * dialog and the widget is first-party to Flow ID (reads `/api/me`, uploads
- * avatars with the cookie session).
- *
- * Resolves the Flow singleton automatically (createFlow() must have run), so
- * callers don't thread the instance through. No-op under SSR.
- */
+/** Mount a native account button that opens Flow ID in a normal browser tab. */
 export declare function createProfileButton(options: MountProfileOptions): ProfileButtonHandle;