@flow-industries/id 0.22.1 → 0.23.1

package/dist/sdk/client/profile-button.js

@@ -1,208 +1,145 @@
 import { resolveIdHost } from "../id-host";
 import { getFlow, requireFlow } from "./create-flow";
-import { answerTokenRequest, bridgeToWindow, hostIdentity, makeIframe, OVERLAY_STYLE, sendBridgeNotification, } from "./iframe-host";
-import { setOverlayFocus } from "./overlay-focus";
 const POSITION_STYLE = {
     "top-right": { top: "0", right: "0" },
     "top-left": { top: "0", left: "0" },
     "bottom-right": { bottom: "0", right: "0" },
     "bottom-left": { bottom: "0", left: "0" },
 };
-/**
- * Mounts the universal Flow ID "profile button" — a persistent inline iframe
- * showing the signed-in user's avatar + username (the collapsed pill). Clicking
- * it opens the profile dialog in a SEPARATE fullscreen overlay iframe, so the
- * pill stays in place behind the dialog's dimmed backdrop rather than morphing
- * into it. Both iframes ride the dialog SPA at `${host}/dialog/` (routes
- * `/dialog/profile-pill` and `/dialog/profile`) so the chrome matches the auth
- * dialog and the widget is first-party to Flow ID (reads `/api/me`, uploads
- * avatars with the cookie session).
- *
- * Resolves the Flow singleton automatically (createFlow() must have run), so
- * callers don't thread the instance through. No-op under SSR.
- */
+/** Mount a native account button that opens Flow ID in a normal browser tab. */
 export function createProfileButton(options) {
     if (!("document" in globalThis))
         return { setTheme() { }, destroy() { } };
     const flow = options.flow ?? getFlow() ?? requireFlow();
     const host = resolveIdHost(options.host ?? flow.host);
-    const hostOrigin = new URL(host).origin;
-    // Mutable so `setTheme` recolors over the open bridge, and so a dialog opened
-    // after a toggle is initialized with the theme the host is actually showing.
-    let theme = options.theme ?? "light dark";
-    let createdContainer = null;
-    let container = options.container ?? null;
-    if (!container) {
-        const el = document.createElement("div");
-        Object.assign(el.style, {
+    const createdContainer = options.container
+        ? null
+        : document.createElement("div");
+    const container = options.container ?? createdContainer;
+    if (!container)
+        return { setTheme() { }, destroy() { } };
+    if (createdContainer) {
+        Object.assign(createdContainer.style, {
             position: "fixed",
             zIndex: "2147483000",
-            // Never steal input from the host (e.g. the Godot canvas) — only the
-            // iframe re-enables pointer events for itself.
-            pointerEvents: "none",
             padding: options.padding ?? "1.5rem",
             ...POSITION_STYLE[options.position ?? "top-right"],
         });
-        document.body.appendChild(el);
-        createdContainer = el;
-        container = el;
-    }
-    function makeFrame(title) {
-        const frame = makeIframe(`${host}/dialog/`, title);
-        frame.dataset.flowProfile = "";
-        frame.style.display = "block";
-        return frame;
-    }
-    // A page may host several same-origin Flow iframes (this pill, this dialog,
-    // the auth login dialog). Origin filtering can't tell them apart, so each
-    // bridge is bound to its own iframe window — otherwise their `ready`/`close`
-    // handshakes would cross-fire. Identity is pinned to the host origin so the
-    // username is never broadcast with "*".
-    function makeBridge(frame, route) {
-        const bridge = bridgeToWindow(frame.contentWindow, {
-            targetOrigin: hostOrigin,
-        });
-        sendBridgeNotification(bridge, "__internal", {
-            type: "init",
-            mode: "iframe",
-            referrer: { title: document.title },
-            theme: { colorScheme: theme },
-            route,
-        });
-        return bridge;
-    }
-    // ----- the persistent pill (stays mounted; sizes to its own content) -----
-    const pill = makeFrame("Flow ID profile button");
-    let pillWidth = 0;
-    let pillHeight = 0;
-    function applyPillSize() {
-        Object.assign(pill.style, {
-            position: "static",
-            width: `${pillWidth}px`,
-            height: `${pillHeight}px`,
-            pointerEvents: pillWidth > 0 ? "auto" : "none",
-        });
+        document.body.appendChild(createdContainer);
     }
-    applyPillSize();
-    container.appendChild(pill);
-    const pillBridge = makeBridge(pill, "/dialog/profile-pill");
-    pillBridge.on("__internal", (payload) => {
-        if (payload.type === "profile-resize") {
-            pillWidth = payload.width;
-            pillHeight = payload.height;
-            applyPillSize();
-        }
-        else if (payload.type === "profile-expand") {
-            showDialog();
-        }
-        else if (payload.type === "profile-token-request") {
-            void answerTokenRequest(pillBridge, flow, payload.id);
-        }
+    const button = document.createElement("button");
+    button.type = "button";
+    button.dataset.flowProfile = "";
+    Object.assign(button.style, {
+        display: "flex",
+        alignItems: "center",
+        gap: "8px",
+        border: "1px solid color-mix(in srgb, currentColor 18%, transparent)",
+        borderRadius: "999px",
+        padding: "10px 16px",
+        background: "Canvas",
+        color: "CanvasText",
+        font: "inherit",
+        cursor: "pointer",
+        pointerEvents: "auto",
+        maxWidth: "240px",
+        overflow: "hidden",
+        textOverflow: "ellipsis",
+        whiteSpace: "nowrap",
     });
-    // ----- the dialog overlay (lazy; a separate fullscreen iframe layered ABOVE
-    // the pill, so the pill shows through its dimmed backdrop) -----
-    let dialog = null;
-    let dialogBridge = null;
-    function ensureDialog() {
-        if (dialog)
+    const notice = document.createElement("span");
+    notice.setAttribute("role", "status");
+    Object.assign(notice.style, {
+        display: "block",
+        font: "12px sans-serif",
+        maxWidth: "240px",
+    });
+    const avatar = document.createElement("span");
+    Object.assign(avatar.style, {
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+        width: "28px",
+        height: "28px",
+        borderRadius: "50%",
+        overflow: "hidden",
+        background: "color-mix(in srgb, currentColor 10%, transparent)",
+        flexShrink: "0",
+    });
+    const name = document.createElement("span");
+    button.append(avatar, name);
+    const fallback = document.createElement("a");
+    fallback.href = `${host}/account`;
+    fallback.target = "_blank";
+    fallback.rel = "noopener noreferrer";
+    fallback.textContent = "Open Flow ID";
+    fallback.hidden = true;
+    let lastUsername;
+    let profileRequest = null;
+    function update() {
+        const user = flow.getState().user;
+        name.textContent = user?.username ?? "Flow ID";
+        button.setAttribute("aria-label", `Open ${user?.username ?? "your"} Flow ID account in a new tab`);
+        if (user?.username === lastUsername)
             return;
-        dialog = makeFrame("Flow ID profile");
-        dialog.inert = true;
-        Object.assign(dialog.style, OVERLAY_STYLE, {
-            pointerEvents: "none",
-        });
-        document.body.appendChild(dialog);
-        dialogBridge = makeBridge(dialog, "/dialog/profile");
-        dialogBridge.on("close", () => hideDialog());
-        dialogBridge.on("__internal", (payload) => {
-            if (payload.type === "profile-login") {
-                hideDialog();
-                void flow
-                    .login(payload.mode === "signup" ? { signUp: true } : { signIn: true })
-                    .catch(() => { });
-            }
-            else if (payload.type === "profile-logout") {
-                hideDialog();
-                void flow.logout().catch(() => { });
-            }
-            else if (payload.type === "profile-token-request") {
-                if (dialogBridge)
-                    void answerTokenRequest(dialogBridge, flow, payload.id);
-            }
-        });
-        sendBridgeNotification(dialogBridge, "__internal", {
-            type: "profile-identity",
-            identity: hostIdentity(flow),
-        });
-    }
-    // The dialog owns its open/close animation entirely; the host only signals
-    // visibility and toggles hit-testing. The overlay iframe is NEVER set to
-    // display:none — that pauses the iframe's requestAnimationFrame, so motion's
-    // engine is asleep when the next open fires and the animation jumps straight
-    // to its end (instant). Keeping it always-rendered, transparent and
-    // click-through while hidden keeps every open/close animation reliable.
-    function showDialog() {
-        ensureDialog();
-        if (!dialog)
+        lastUsername = user?.username;
+        profileRequest?.abort();
+        avatar.textContent = user?.username.slice(0, 1).toUpperCase() ?? "F";
+        if (!user || user.isGuest)
             return;
-        dialog.style.pointerEvents = "auto";
-        setOverlayFocus(dialog, true);
-        sendBridgeNotification(dialogBridge, "__internal", {
-            type: "dialog-shown",
-        });
+        const controller = new AbortController();
+        profileRequest = controller;
+        void fetch(`${host}/api/users/${encodeURIComponent(user.username)}`, {
+            signal: controller.signal,
+            credentials: "omit",
+        })
+            .then(async (response) => {
+            if (!response.ok)
+                return;
+            // SAFETY: Flow ID owns the public profile endpoint and its optional image field.
+            const profile = (await response.json());
+            if (controller.signal.aborted || !profile.image)
+                return;
+            const image = document.createElement("img");
+            image.src = profile.image;
+            image.alt = "";
+            Object.assign(image.style, {
+                width: "100%",
+                height: "100%",
+                objectFit: "cover",
+            });
+            avatar.replaceChildren(image);
+        })
+            .catch(() => { });
     }
-    function hideDialog() {
-        if (!dialog)
-            return;
-        dialog.style.pointerEvents = "none";
-        setOverlayFocus(dialog, false);
-        sendBridgeNotification(dialogBridge, "__internal", {
-            type: "dialog-hidden",
-        });
+    button.addEventListener("click", () => {
+        const opened = flow.openAccount();
+        notice.textContent = opened
+            ? ""
+            : "Your browser blocked the new tab. Open Flow ID below to sign in.";
+        fallback.hidden = opened;
+    });
+    function refresh() {
+        lastUsername = undefined;
+        update();
     }
-    // ----- keep both iframes' identity in sync with the Flow session -----
-    // flow.subscribe fires on any store change (jwt/credential/address too), so
-    // skip re-sending an identical identity (e.g. on every silent JWT refresh).
-    let lastIdentityKey;
-    function pushIdentity() {
-        const identity = hostIdentity(flow);
-        const key = identity ? `${identity.username}|${identity.isGuest}` : "none";
-        if (key === lastIdentityKey)
-            return;
-        lastIdentityKey = key;
-        sendBridgeNotification(pillBridge, "__internal", {
-            type: "profile-identity",
-            identity,
-        });
-        if (dialogBridge)
-            sendBridgeNotification(dialogBridge, "__internal", {
-                type: "profile-identity",
-                identity,
-            });
+    window.addEventListener("focus", refresh);
+    function setTheme(theme) {
+        button.style.colorScheme = theme;
     }
-    pushIdentity();
-    const unsubscribe = flow.subscribe(pushIdentity);
+    setTheme(options.theme ?? "light dark");
+    container.append(button, notice, fallback);
+    update();
+    const unsubscribe = flow.subscribe(update);
     return {
-        setTheme(next) {
-            if (next === theme)
-                return;
-            theme = next;
-            sendBridgeNotification(pillBridge, "__internal", {
-                type: "set-theme",
-                theme: { colorScheme: next },
-            });
-            sendBridgeNotification(dialogBridge, "__internal", {
-                type: "set-theme",
-                theme: { colorScheme: next },
-            });
-        },
+        setTheme,
         destroy() {
-            hideDialog();
             unsubscribe();
-            pillBridge.destroy();
-            dialogBridge?.destroy();
-            pill.remove();
-            dialog?.remove();
+            profileRequest?.abort();
+            window.removeEventListener("focus", refresh);
+            fallback.remove();
+            button.remove();
+            notice.remove();
             createdContainer?.remove();
         },
     };

package/dist/sdk/client/session.d.ts

@@ -1,4 +1,4 @@
-import type { Address, FlowCredential, FlowState, RunLoginParams, RunLoginResult, Store } from "../types";
+import type { Address, FlowCredential, FlowState, Store } from "../types";
 /**
  * Reads the active credential from IndexedDB and seeds the in-memory store
  * with `{ credential, address }`. Run on every page load so signing operations
@@ -9,15 +9,6 @@ import type { Address, FlowCredential, FlowState, RunLoginParams, RunLoginResult
  * not an error.
  */
 export declare function restoreCredential(store: Store<FlowState>): Promise<void>;
-/**
- * Drives the interactive `wallet_connect` flow through the dialog and
- * commits the result to local state.
- *
- * Capabilities are intent only (signUp / signIn / signInHeadless / extras like
- * accessKeyHash). Remembering "which account did this user use last" is
- * the dialog's job — the client doesn't track or pass credentialIds.
- */
-export declare function runLogin(params: RunLoginParams): Promise<RunLoginResult>;
 /**
  * Clears local-only auth state: active credential in IDB, the access key for
  * the current address (if any), and the in-memory store. Does NOT touch the

package/dist/sdk/client/session.js

@@ -2,7 +2,6 @@ import * as OxAddress from "ox/Address";
 import * as PublicKey from "ox/PublicKey";
 import { hex0x } from "../hex";
 import { idb } from "./idb";
-import { METHODS } from "./methods";
 import { initialFlowState } from "./store";
 const CREDENTIAL_KEY = "flow.activeCredential";
 /**
@@ -21,42 +20,6 @@ export async function restoreCredential(store) {
     const address = credentialToAddress(credential);
     store.setState({ credential, address });
 }
-/**
- * Drives the interactive `wallet_connect` flow through the dialog and
- * commits the result to local state.
- *
- * Capabilities are intent only (signUp / signIn / signInHeadless / extras like
- * accessKeyHash). Remembering "which account did this user use last" is
- * the dialog's job — the client doesn't track or pass credentialIds.
- */
-export async function runLogin(params) {
-    const { dialog, store, options, extraCapabilities } = params;
-    const signUp = Boolean(options?.signUp);
-    const capabilities = {
-        createAccount: signUp ? true : undefined,
-        signIn: !signUp && options?.signIn ? true : undefined,
-        signInHeadless: !signUp && options?.signInHeadless ? true : undefined,
-        ...(extraCapabilities ?? {}),
-    };
-    /* SAFETY: the connect method's response shape, which the dialog route answers. */
-    const result = (await dialog.request(METHODS.connect, [
-        { capabilities },
-    ]));
-    const { jwt, refreshToken, user, credential, webauthn, additionalSessions } = result;
-    // An email-only login carries no credential — mirror the guest handling:
-    // nothing is persisted to IDB (reserved for a real passkey credential) and
-    // the address stays null until a passkey is added.
-    const address = credential ? credentialToAddress(credential) : null;
-    if (credential)
-        await idb.set(CREDENTIAL_KEY, credential);
-    store.setState({ user, jwt, credential, address });
-    return {
-        session: { user, jwt, credential, address },
-        refreshToken,
-        webauthn,
-        additionalSessions: additionalSessions ? additionalSessions : undefined,
-    };
-}
 /**
  * Clears local-only auth state: active credential in IDB, the access key for
  * the current address (if any), and the in-memory store. Does NOT touch the

package/dist/sdk/client/static-flow.js

@@ -44,6 +44,7 @@ export function createStaticFlow(state, options = {}) {
             return snapshot.user?.isGuest === true;
         },
         login: () => unavailable("login"),
+        openAccount: () => unavailable("openAccount"),
         logout: () => unavailable("logout"),
         restore: async () => false,
         ensureGuest: () => unavailable("ensureGuest"),

package/dist/sdk/issuer-api.d.ts

@@ -0,0 +1,3 @@
+/** Resolve a trusted server transport without changing the public JWT issuer. */
+export declare function resolveIssuerApiUrl(issuerUrl: string, override?: string): string;
+export declare function fetchIssuerApi(url: string, init?: RequestInit): Promise<Response>;

package/dist/sdk/issuer-api.js

@@ -0,0 +1,28 @@
+/** Resolve a trusted server transport without changing the public JWT issuer. */
+export function resolveIssuerApiUrl(issuerUrl, override) {
+    const configured = override ??
+        (globalThis.process !== undefined
+            ? process.env.FLOW_ID_API_URL
+            : undefined);
+    const url = new URL(configured ?? issuerUrl);
+    if (!["http:", "https:"].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname !== "/") {
+        throw new Error("Flow ID API URL must be an HTTP(S) origin without credentials, path, query, or fragment");
+    }
+    return url.origin;
+}
+export async function fetchIssuerApi(url, init) {
+    const response = await fetch(url, { ...init, redirect: "error" });
+    if (!response.ok) {
+        console.warn("Flow ID API request failed", {
+            path: new URL(url).pathname,
+            status: response.status,
+            contentType: response.headers.get("content-type")?.split(";")[0] ?? null,
+        });
+    }
+    return response;
+}

package/dist/sdk/react/hooks.d.ts

@@ -28,7 +28,7 @@ export declare function useFlowId(): {
     address: `0x${string}` | null;
     isAuthenticated: boolean;
     isGuest: boolean;
-    login: (options?: import("../types").LoginOptions) => Promise<import("../types").Session>;
+    login: (options?: import("../types").LoginOptions) => Promise<never>;
     logout: () => Promise<void>;
     restore: () => Promise<boolean>;
     ensureGuest: () => Promise<boolean>;

package/dist/sdk/react/profile-button.d.ts

@@ -1,14 +1,3 @@
 import type { ProfileButtonProps } from "../types";
-/**
- * Drops the universal Flow ID profile button into a React tree. Renders a host
- * element (style it via `className` for placement/padding — e.g. top-right) that
- * the pill iframe mounts into; the iframe itself is sized to its content and
- * expands to the profile dialog on click. Resolves the Flow instance from a
- * `<FlowIdProvider>` or the createFlow() singleton.
- *
- * A changing `theme` recolors the mounted pill over its open bridge rather than
- * remounting it: `theme` is deliberately absent from the mount effect's deps,
- * because tearing the iframe down on a light/dark toggle reloads the widget and
- * drops the pill out of the host's layout mid-toggle.
- */
+/** Mount the native account button with access to the current Flow session. */
 export declare function ProfileButton({ className, host, theme }: ProfileButtonProps): import("react/jsx-runtime").JSX.Element;

package/dist/sdk/react/profile-button.js

@@ -2,18 +2,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useRef } from "react";
 import { createProfileButton } from "../client/profile-button";
 import { useFlow } from "./hooks";
-/**
- * Drops the universal Flow ID profile button into a React tree. Renders a host
- * element (style it via `className` for placement/padding — e.g. top-right) that
- * the pill iframe mounts into; the iframe itself is sized to its content and
- * expands to the profile dialog on click. Resolves the Flow instance from a
- * `<FlowIdProvider>` or the createFlow() singleton.
- *
- * A changing `theme` recolors the mounted pill over its open bridge rather than
- * remounting it: `theme` is deliberately absent from the mount effect's deps,
- * because tearing the iframe down on a light/dark toggle reloads the widget and
- * drops the pill out of the host's layout mid-toggle.
- */
+/** Mount the native account button with access to the current Flow session. */
 export function ProfileButton({ className, host, theme }) {
     const flow = useFlow();
     const ref = useRef(null);

package/dist/sdk/server.js

@@ -1,10 +1,11 @@
 import { resolveIdHost } from "./id-host";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 import { resolveSessionCore } from "./session-core";
 export { createSessionHandler, handleSessionRequest } from "./session-route";
 export { verifyFlowJWT } from "./verify";
-async function fetchProfile(issuerUrl, jwt, audience) {
+async function fetchProfile(apiUrl, jwt, audience) {
     try {
-        const res = await fetch(`${issuerUrl}/api/session/verify`, {
+        const res = await fetchIssuerApi(`${apiUrl}/api/session/verify`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ token: jwt, audience }),
@@ -29,12 +30,13 @@ async function fetchProfile(issuerUrl, jwt, audience) {
  */
 export async function resolveSession(cookieHeader, opts) {
     const issuerUrl = resolveIdHost(opts.issuerUrl, opts.audience);
-    const { session, claims, setCookies } = await resolveSessionCore(cookieHeader, opts.audience, issuerUrl);
+    const apiUrl = resolveIssuerApiUrl(issuerUrl, opts.apiUrl);
+    const { session, claims, setCookies } = await resolveSessionCore(cookieHeader, opts.audience, issuerUrl, apiUrl);
     const state = session
         ? { user: session.user, jwt: session.jwt, address: session.address ?? null }
         : null;
     const profile = state && opts.profile
-        ? await fetchProfile(issuerUrl, state.jwt, opts.audience)
+        ? await fetchProfile(apiUrl, state.jwt, opts.audience)
         : undefined;
     return {
         state,

package/dist/sdk/session-core.d.ts

@@ -27,7 +27,7 @@ export type ResolvedSessionCore = {
  * happened) but resolves signed-out rather than trusting it. Returns "dead"
  * for a definitive rejection and null for a transient network failure.
  */
-export declare function refreshSessionCore(issuerUrl: string, audience: string, refreshToken: string): Promise<ResolvedSessionCore | "dead" | null>;
+export declare function refreshSessionCore(issuerUrl: string, audience: string, refreshToken: string, apiUrl?: string): Promise<ResolvedSessionCore | "dead" | null>;
 /**
  * Resolves a session from a request's Cookie header.
  *
@@ -41,4 +41,4 @@ export declare function refreshSessionCore(issuerUrl: string, audience: string,
  *     network failure leaves the cookies alone so a later request can retry.
  *  3. Neither cookie → signed-out `session: null`.
  */
-export declare function resolveSessionCore(cookieHeader: string | null | undefined, audience: string, issuerUrl: string): Promise<ResolvedSessionCore>;
+export declare function resolveSessionCore(cookieHeader: string | null | undefined, audience: string, issuerUrl: string, apiUrl?: string): Promise<ResolvedSessionCore>;

package/dist/sdk/session-core.js

@@ -5,6 +5,7 @@ import { errField } from "./driver-error";
  * `session-route.ts` compose it into the public entry points.
  */
 import { clearCookieString, cookieNamesFor, JWT_COOKIE_MAX_AGE_S, parseCookieHeader, REFRESH_COOKIE_MAX_AGE_S, serializeCookie, } from "./cookies";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 import { isExpiring } from "./token-expiry";
 import { verifyFlowJWT } from "./verify";
 export function claimsToUser(claims) {
@@ -16,9 +17,9 @@ export function claimsToUser(claims) {
         isGuest: claims.guest !== false,
     };
 }
-async function refreshSession(issuerUrl, token) {
+async function refreshSession(token, apiUrl) {
     try {
-        const res = await fetch(`${issuerUrl}/api/session/refresh`, {
+        const res = await fetchIssuerApi(`${apiUrl}/api/session/refresh`, {
             method: "POST",
             headers: { Authorization: `Bearer ${token}` },
         });
@@ -42,11 +43,11 @@ async function refreshSession(issuerUrl, token) {
 // other machines).
 const REFRESH_RESULT_TTL_MS = 30_000;
 const refreshInFlight = new Map();
-function refreshOnce(issuerUrl, token) {
-    const key = `${issuerUrl}\n${token}`;
+function refreshOnce(issuerUrl, token, apiUrl) {
+    const key = `${issuerUrl}\n${apiUrl}\n${token}`;
     let flight = refreshInFlight.get(key);
     if (!flight) {
-        flight = refreshSession(issuerUrl, token);
+        flight = refreshSession(token, apiUrl);
         refreshInFlight.set(key, flight);
         void flight.finally(() => {
             const timer = setTimeout(() => refreshInFlight.delete(key), REFRESH_RESULT_TTL_MS);
@@ -100,14 +101,14 @@ export function clearingCookies(audience) {
  * happened) but resolves signed-out rather than trusting it. Returns "dead"
  * for a definitive rejection and null for a transient network failure.
  */
-export async function refreshSessionCore(issuerUrl, audience, refreshToken) {
-    const result = await refreshOnce(issuerUrl, refreshToken);
+export async function refreshSessionCore(issuerUrl, audience, refreshToken, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
+    const result = await refreshOnce(issuerUrl, refreshToken, apiUrl);
     if (result === "dead" || !result)
         return result;
     const successorCookies = sessionCookies(audience, result.jwt, result.refreshToken);
     let claims;
     try {
-        claims = await verifyFlowJWT(result.jwt, { audience, issuerUrl });
+        claims = await verifyFlowJWT(result.jwt, { audience, issuerUrl, apiUrl });
     }
     catch (err) {
         if (isJwtVerificationFailure(err)) {
@@ -143,13 +144,13 @@ export async function refreshSessionCore(issuerUrl, audience, refreshToken) {
  *     network failure leaves the cookies alone so a later request can retry.
  *  3. Neither cookie → signed-out `session: null`.
  */
-export async function resolveSessionCore(cookieHeader, audience, issuerUrl) {
+export async function resolveSessionCore(cookieHeader, audience, issuerUrl, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
     const names = cookieNamesFor(audience);
     const cookies = parseCookieHeader(cookieHeader);
     const jwt = cookies[names.jwt];
     if (jwt && !isExpiring(jwt)) {
         try {
-            const claims = await verifyFlowJWT(jwt, { audience, issuerUrl });
+            const claims = await verifyFlowJWT(jwt, { audience, issuerUrl, apiUrl });
             return {
                 session: { user: claimsToUser(claims), jwt },
                 claims,
@@ -165,7 +166,7 @@ export async function resolveSessionCore(cookieHeader, audience, issuerUrl) {
     const refreshToken = cookies[names.refresh];
     if (!refreshToken)
         return { session: null, claims: null, setCookies: [] };
-    const refreshed = await refreshSessionCore(issuerUrl, audience, refreshToken);
+    const refreshed = await refreshSessionCore(issuerUrl, audience, refreshToken, apiUrl);
     if (refreshed === "dead") {
         return {
             session: null,