@flow-industries/id 0.22.1 → 0.23.1

package/dist/sdk/session-route.js

@@ -1,4 +1,8 @@
 import { z } from "zod";
+import { browserCompletionSchema } from "./browser-contract";
+import { finishBrowserSession, startBrowserSession, } from "./browser-session-route";
+import { clearCookieString } from "./cookies";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 /**
  * The first-party session route every consumer app serves from its own
  * origin — the only path between a browser and the refresh token. The
@@ -21,13 +25,20 @@ import { z } from "zod";
  */
 import { cookieNamesFor, parseCookieHeader } from "./cookies";
 import { DEFAULT_SESSION_PATH, defaultAudience, resolveIdHost, } from "./id-host";
-import { claimsToUser, clearingCookies, isJwtVerificationFailure, resolveSessionCore, sessionCookies, } from "./session-core";
+import { claimsToUser, clearingCookies, isJwtVerificationFailure, refreshSessionCore, resolveSessionCore, sessionCookies, } from "./session-core";
 import { verifyFlowJWT } from "./verify";
 /** The body the browser SDK posts to its own app's session route. */
 const installBodySchema = z.object({
     refreshToken: z.string().min(1).optional(),
     jwt: z.string().min(1).optional(),
     mint: z.array(z.string()).optional(),
+    action: z.enum(["login", "account", "guest"]).optional(),
+    returnTo: z.string().optional(),
+    signUp: z.boolean().optional(),
+    accessKeyHash: z
+        .string()
+        .regex(/^0x[a-fA-F0-9]{64}$/)
+        .optional(),
 });
 const additionalBodySchema = z.object({
     additionalSessions: z
@@ -72,17 +83,105 @@ function isCrossSite(request, audience) {
 export async function handleSessionRequest(request, opts = {}) {
     const audience = opts.audience ?? defaultAudience(new URL(request.url).origin);
     const issuerUrl = resolveIdHost(opts.issuerUrl, audience);
+    const apiUrl = resolveIssuerApiUrl(issuerUrl, opts.apiUrl);
+    const callback = new URL(request.url);
+    if (request.method === "GET" && callback.searchParams.has("flow_state")) {
+        return finishBrowserSession(request, audience, issuerUrl, apiUrl);
+    }
     if (isCrossSite(request, audience)) {
         return json({ state: null }, 403);
     }
     switch (request.method) {
         case "GET": {
-            const { session, setCookies } = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl);
-            return json({ state: session }, 200, setCookies);
+            if (new URL(request.url).searchParams.get("refresh") === "1") {
+                const token = parseCookieHeader(request.headers.get("Cookie"))[cookieNamesFor(audience).refresh];
+                if (!token)
+                    return json({ state: null }, 200);
+                const result = await refreshSessionCore(issuerUrl, audience, token, apiUrl);
+                if (result === "dead")
+                    return json({ state: null }, 200, clearingCookies(audience));
+                if (!result)
+                    return json({ state: null }, 502);
+                return json({ state: result.session }, 200, result.setCookies);
+            }
+            const { session, setCookies } = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl, apiUrl);
+            const completionName = `${cookieNamesFor(audience).refresh}.completion`;
+            const raw = parseCookieHeader(request.headers.get("Cookie"))[completionName];
+            let loginCompletion;
+            if (raw) {
+                setCookies.push(clearCookieString(completionName, {
+                    secure: audience.startsWith("https:"),
+                }));
+                try {
+                    const parsed = browserCompletionSchema.safeParse(JSON.parse(decodeURIComponent(atob(raw))));
+                    if (parsed.success &&
+                        parsed.data.expires > Date.now() &&
+                        parsed.data.userId === session?.user.id)
+                        loginCompletion = parsed.data;
+                }
+                catch { }
+            }
+            return json({ state: session, loginCompletion }, 200, setCookies);
         }
         case "POST": {
             const parsed = installBodySchema.safeParse(await request.json().catch(() => null));
             const body = parsed.success ? parsed.data : null;
+            if (body?.action === "login" || body?.action === "account") {
+                try {
+                    return await startBrowserSession(request, audience, issuerUrl, {
+                        ...body,
+                        action: body.action,
+                    }, apiUrl);
+                }
+                catch {
+                    return json({ state: null }, 502);
+                }
+            }
+            if (body?.action === "guest") {
+                const existing = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl, apiUrl);
+                if (existing.session)
+                    return json({ state: existing.session }, 200, existing.setCookies);
+                const previousRefresh = parseCookieHeader(request.headers.get("Cookie"))[cookieNamesFor(audience).refresh];
+                if (previousRefresh && existing.setCookies.length === 0)
+                    return json({ state: null }, 502);
+                try {
+                    const headers = new Headers({ "Content-Type": "application/json" });
+                    for (const name of [
+                        "cf-connecting-ip",
+                        "x-forwarded-for",
+                        "user-agent",
+                    ]) {
+                        const value = request.headers.get(name);
+                        if (value)
+                            headers.set(name, value);
+                    }
+                    const result = await fetchIssuerApi(`${apiUrl}/api/auth/passkey/guest`, {
+                        method: "POST",
+                        headers,
+                        body: JSON.stringify({ audience }),
+                    });
+                    if (!result.ok)
+                        return json({ state: null }, result.status);
+                    // SAFETY: the configured issuer returns this session token pair, verified below.
+                    const data = (await result.json());
+                    const claims = await verifyFlowJWT(data.jwt, {
+                        audience,
+                        issuerUrl,
+                        apiUrl,
+                    });
+                    return json({
+                        state: {
+                            user: claimsToUser(claims),
+                            jwt: data.jwt,
+                            credential: null,
+                            address: null,
+                        },
+                    }, 200, sessionCookies(audience, data.jwt, data.refreshToken));
+                }
+                catch {
+                    return json({ state: null }, 502);
+                }
+            }
             // Reconcile mint: the browser asks its own server to obtain additional-
             // audience sessions (e.g. talk.flow.game) authorized by the PRIMARY
             // refresh cookie, for an embed that booted with no session of its own.
@@ -95,7 +194,7 @@ export async function handleSessionRequest(request, opts = {}) {
                 let additionalSessions = [];
                 if (token && audiences.length > 0) {
                     try {
-                        const res = await fetch(`${issuerUrl}/api/session/additional`, {
+                        const res = await fetchIssuerApi(`${apiUrl}/api/session/additional`, {
                             method: "POST",
                             headers: {
                                 "Content-Type": "application/json",
@@ -123,7 +222,11 @@ export async function handleSessionRequest(request, opts = {}) {
             // for another app from being installed here; a failed install must not
             // clear cookies that may hold a live session.
             try {
-                const claims = await verifyFlowJWT(jwt, { audience, issuerUrl });
+                const claims = await verifyFlowJWT(jwt, {
+                    audience,
+                    issuerUrl,
+                    apiUrl,
+                });
                 return json({ state: { user: claimsToUser(claims), jwt } }, 200, sessionCookies(audience, jwt, refreshToken));
             }
             catch (err) {
@@ -137,12 +240,16 @@ export async function handleSessionRequest(request, opts = {}) {
             // an unreachable issuer just leaves the lineage to expire on its own.
             if (token) {
                 try {
-                    await fetch(`${issuerUrl}/api/session/revoke`, {
+                    const response = await fetchIssuerApi(`${apiUrl}/api/session/revoke`, {
                         method: "POST",
                         headers: { Authorization: `Bearer ${token}` },
                     });
+                    if (!response.ok)
+                        return json({ state: null }, 502);
+                }
+                catch {
+                    return json({ state: null }, 502);
                 }
-                catch { }
             }
             const headers = new Headers({ "Cache-Control": "no-store" });
             for (const cookie of clearingCookies(audience)) {

package/dist/sdk/types/auth.d.ts

@@ -99,6 +99,8 @@ export type PasskeyPluginOptions = {
 export type VerifyOptions = {
     audience: string;
     issuerUrl?: string;
+    /** Trusted server API origin; defaults to FLOW_ID_API_URL, then the public issuer. */
+    apiUrl?: string;
 };
 /**
  * One entry in the signed-in user's session list (`GET /api/account/sessions`).

package/dist/sdk/types/dialog.d.ts

@@ -1,4 +1,3 @@
-import type { RpcRequest } from "./protocol";
 /**
  * Async view state for a dialog panel — the three states every fetched
  * section renders (spinner / retry row / content), so "empty" stays
@@ -91,7 +90,6 @@ export type DialogState = {
     customLabels?: DialogCustomLabels;
 };
 export type SignUpProps = {
-    request: RpcRequest;
     rpId: string;
     accessKeyHash?: string | undefined;
     guestToken?: string | undefined;
@@ -99,7 +97,6 @@ export type SignUpProps = {
     onSignIn: () => void;
 };
 export type SignInWithEmailProps = {
-    request: RpcRequest;
     onBack: () => void;
     onHome: () => void;
 };

package/dist/sdk/types/index.d.ts

@@ -16,7 +16,7 @@ export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSend
 export type { ReportOperation, ReportRequest, ReportResponse, ReportsApi, ReportTransport, } from "./reports";
 export type { CreateRoomEventInput, RoomEventArchive, RoomEventAttendance, RoomEventFrequency, RoomEventInstance, RoomEventInterest, RoomEventInterestState, RoomEventList, RoomEventOccurrence, RoomEventRecurrence, RoomEventRoomRef, RoomEventRun, RoomEventSeries, RoomEventStatus, SetInterestInput, UpdateRoomEventInput, } from "./room-events";
 export type { CreateRoomInput, GlobalRole, ModerationSubject, MyRooms, PlayerPositionReport, RoleChangeVerdict, RoomCapabilities, RoomCapability, RoomChannel, RoomDetail, RoomList, RoomMemberEntry, RoomMembers, RoomOccupancy, RoomOwner, RoomPlayerPosition, RoomPresenceEntry, RoomPresenceSnapshot, RoomRestrictionKind, RoomRole, RoomSummary, RoomSurfaceSettings, RoomsApi, RoomVisibility, StaffEntry, UpdateRoomInput, VerifyRoomContext, Viewer, VoiceDecisionReason, VoiceDecisionSubject, VoiceRoomDecision, } from "./rooms";
-export type { AccessKeyOptions, AccessKeyPreparation, Address, ColorScheme, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowConnectorParameters, FlowCookieNames, FlowIdProviderProps, FlowSessionState, FlowState, FlowWidgetHandle, FlowWidgetName, FlowWidgetProps, Listener, LoginOptions, MountFlowWidgetOptions, MountProfileOptions, OpenProfileOptions, PrepareArgsWithAuth, PrepareTransactionRequestPhase, ProfileButtonHandle, ProfileButtonProps, ProfilePosition, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, RunLoginParams, RunLoginResult, SendCallsArgs, SendTransactionArgs, Session, SigningContext, SignMessageArgs, SignTypedDataArgs, Store, StoredAccessKey, UseOpenProfileOptions, WagmiConnectCapabilities, WagmiConnectParams, } from "./sdk";
+export type { AccessKeyOptions, AccessKeyPreparation, Address, ColorScheme, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowConnectorParameters, FlowCookieNames, FlowIdProviderProps, FlowSessionState, FlowState, FlowWidgetHandle, FlowWidgetName, FlowWidgetProps, Listener, LoginOptions, MountFlowWidgetOptions, MountProfileOptions, OpenProfileOptions, PrepareArgsWithAuth, PrepareTransactionRequestPhase, ProfileButtonHandle, ProfileButtonProps, ProfilePosition, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, SendCallsArgs, SendTransactionArgs, Session, SigningContext, SignMessageArgs, SignTypedDataArgs, Store, StoredAccessKey, UseOpenProfileOptions, WagmiConnectCapabilities, WagmiConnectParams, } from "./sdk";
 export type { GracefulShutdownCleanup, GracefulShutdownOptions, GracefulShutdownServer, GracefulShutdownSignal, ResolvedFlowSession, ResolveSessionOptions, SessionRouteOptions, SessionRouteResponse, SessionRouteSession, } from "./server";
 export type { CosmeticOffer, PaintDescriptor, SettingDescriptor, Settings, SettingsMigration, StoredSettings, SurfaceRegistry, } from "./settings";
 export type { CreateStudySubjectInput, ListStudySessionsInput, StudyCatalog, StudyCategory, StudyCategoryTotals, StudyField, StudyRange, StudySessionEntry, StudySessionPage, StudySessionsResult, StudySubject, StudySubjectCreation, StudySubjectList, StudySubjectRefusal, StudySubjectRemoval, StudySubjectRemovalResponse, StudySubjectTotals, StudySubjectUpdate, StudySummary, UpdateStudySubjectInput, } from "./study";

package/dist/sdk/types/landing.d.ts

@@ -1,5 +1,6 @@
 import type { FlowUser } from "./auth";
 export type AccountProfileData = FlowUser & {
+    bio?: string | null;
     email?: string | null;
     emailVerified?: boolean;
     subscribedToNews?: boolean;

package/dist/sdk/types/sdk.d.ts

@@ -3,7 +3,7 @@ import type { Chain, Hex, PrepareTransactionRequestParameters, SendTransactionPa
 import type { SendCallsParameters } from "viem/actions";
 import type { RawValue } from "../json";
 import type { AdditionalSession, FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
-import type { ConnectCapabilities, ConnectResponse } from "./protocol";
+import type { ConnectCapabilities } from "./protocol";
 import type { RoomsApi } from "./rooms";
 export type Address = `0x${string}`;
 /**
@@ -133,10 +133,9 @@ export type FlowCookieNames = {
     refresh: string;
 };
 export type LoginOptions = {
-    mode?: "iframe" | "popup";
+    returnTo?: string;
     signUp?: boolean;
     signIn?: boolean;
-    signInHeadless?: boolean;
 };
 export type Session = {
     user: FlowUser;
@@ -197,7 +196,7 @@ export type ColorScheme = "light" | "dark" | "light dark";
 export type ProfilePosition = "top-right" | "top-left" | "bottom-right" | "bottom-left";
 export type MountProfileOptions = {
     /**
-     * Element to mount the pill iframe into. When omitted, a fixed-position
+     * Element to mount the native account button into. When omitted, a fixed-position
      * container is created and anchored via `position` — the path of least
      * resistance for non-DOM hosts (the Godot canvas overlay).
      */
@@ -221,12 +220,10 @@ export type MountProfileOptions = {
 };
 export type ProfileButtonHandle = {
     /**
-     * Recolors the mounted pill (and its profile dialog) in place. A host with a
-     * theme toggle calls this instead of remounting: rebuilding the iframe would
-     * reload the widget and flash the pill out of the layout on every toggle.
+     * Recolors the mounted account button without remounting it.
      */
     setTheme: (theme: ColorScheme) => void;
-    /** Tears down the iframe, listeners, and any auto-created container. */
+    /** Tears down the button, listeners, and any auto-created container. */
     destroy: () => void;
 };
 export type OpenProfileOptions = {
@@ -332,7 +329,8 @@ export type Flow = {
      * actions on `!isGuest`, not on `isAuthenticated`.
      */
     readonly isGuest: boolean;
-    login(options?: LoginOptions): Promise<Session>;
+    login(options?: LoginOptions): Promise<never>;
+    openAccount(): boolean;
     logout(): Promise<void>;
     restore(): Promise<boolean>;
     /**
@@ -413,18 +411,6 @@ export type ProfileButtonProps = {
     /** Color scheme for the widget chrome; defaults to "light dark" (the OS). */
     theme?: ColorScheme;
 };
-export type RunLoginParams = {
-    dialog: DialogHost;
-    store: Store<FlowState>;
-    options?: LoginOptions;
-    extraCapabilities?: ConnectCapabilities;
-};
-export type RunLoginResult = {
-    session: Session;
-    refreshToken: string;
-    webauthn: ConnectResponse["webauthn"];
-    additionalSessions?: AdditionalSession[];
-};
 export type FinalizeAccessKeyParams = {
     address: Address;
     credential: FlowCredential;

package/dist/sdk/types/server.d.ts

@@ -6,6 +6,8 @@ export type ResolveSessionOptions = {
     audience: string;
     /** Flow ID origin; defaults to `https://id.flow.industries`. */
     issuerUrl?: string;
+    /** Trusted server API origin; defaults to FLOW_ID_API_URL, then the public issuer. */
+    apiUrl?: string;
     /**
      * Also fetch the public profile (avatar, tier, level) for a resolved
      * session via `/api/session/verify` — one extra round-trip; off by default.
@@ -36,6 +38,8 @@ export type SessionRouteOptions = {
     audience?: string;
     /** Flow ID origin; defaults per `defaultIdHost` (`FLOW_ID_HOST` on servers). */
     issuerUrl?: string;
+    /** Trusted server API origin; defaults to FLOW_ID_API_URL, then the public issuer. */
+    apiUrl?: string;
     /** Route path for `createSessionHandler`'s own path check. */
     path?: string;
 };
@@ -53,6 +57,12 @@ export type SessionRouteSession = {
 };
 export type SessionRouteResponse = {
     state: SessionRouteSession | null;
+    loginCompletion?: {
+        loginId: string;
+        userId: string;
+        expires: number;
+        webauthn?: import("./auth").WebAuthnSignature;
+    };
     /**
      * Additional-audience sessions minted by a reconcile request (POST `{ mint }`)
      * — one per allowed audience the caller asked to provision. The consumer

package/dist/sdk/verify.js

@@ -1,4 +1,5 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 const jwksCache = new Map();
 const DEFAULT_ISSUER_URL = "https://id.flow.industries";
 /**
@@ -22,10 +23,14 @@ const DEFAULT_ISSUER_URL = "https://id.flow.industries";
  */
 export async function verifyFlowJWT(token, opts) {
     const issuerUrl = opts.issuerUrl ?? DEFAULT_ISSUER_URL;
-    let jwks = jwksCache.get(issuerUrl);
+    const apiUrl = resolveIssuerApiUrl(issuerUrl, opts.apiUrl);
+    const cacheKey = `${issuerUrl}\n${apiUrl}`;
+    let jwks = jwksCache.get(cacheKey);
     if (!jwks) {
-        jwks = createRemoteJWKSet(new URL(`${issuerUrl}/api/auth/jwks`));
-        jwksCache.set(issuerUrl, jwks);
+        jwks = createRemoteJWKSet(new URL(`${apiUrl}/api/auth/jwks`), {
+            [customFetch]: fetchIssuerApi,
+        });
+        jwksCache.set(cacheKey, jwks);
     }
     const { payload } = await jwtVerify(token, jwks, {
         issuer: issuerUrl,

package/dist/sdk/wagmi/index.js

@@ -5,12 +5,9 @@ flowConnector.type = "flow";
 function loginOptionsFromCapabilities(capabilities) {
     const signUp = capabilities?.type === "sign-up" || capabilities?.createAccount;
     const signIn = capabilities?.type === "sign-in" || capabilities?.signIn;
-    const headless = !signUp &&
-        (capabilities?.signInHeadless || capabilities?.type === "sign-in");
     return {
         signUp: signUp ? true : undefined,
         signIn: !signUp && signIn ? true : undefined,
-        signInHeadless: headless ? true : undefined,
     };
 }
 export function flowConnector(parameters = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.22.1",
+  "version": "0.23.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -66,9 +66,10 @@
   "scripts": {
     "dev": "./dev.sh",
     "build:dialog": "bunx vite build",
+    "build:legacy-dialog": "bunx vite build --config vite.legacy.config.ts",
     "build:playground": "bunx vite build --config vite.playground.config.ts",
     "build:landing": "bunx vite build --config vite.landing.config.ts",
-    "build": "bunx vite build && bunx vite build --config vite.playground.config.ts && bunx vite build --config vite.landing.config.ts",
+    "build": "bun run build:legacy-dialog && bunx vite build && bunx vite build --config vite.playground.config.ts && bunx vite build --config vite.landing.config.ts",
     "build:sdk": "tsc --project tsconfig.sdk.json",
     "prepublishOnly": "bun run build:sdk",
     "start": "bun run src/index.ts",
@@ -84,7 +85,7 @@
     "test:sdk-package": "bash scripts/test-sdk-package.sh",
     "format": "biome format --write",
     "check": "biome check --write",
-    "typecheck": "tsr generate && tsc --noEmit",
+    "typecheck": "tsr generate && (cd src/legacy-dialog && bunx tsr generate) && tsc --noEmit && tsc -p tsconfig.legacy.json --noEmit",
     "contracts:generate": "bun scripts/generate-contracts.ts",
     "contracts:check": "bun scripts/generate-contracts.ts --check && bun scripts/check-contract-compatibility.ts",
     "db:check": "bun scripts/db-check.ts",