@flow-industries/id 0.23.0 → 0.23.2

package/README.md

@@ -53,7 +53,7 @@ app path; read the new session after navigation instead of continuing after
 
 `ProfileButton` and `flow.openAccount()` open `/account` in a normal new tab.
 The source app stays loaded and refreshes its session on refocus. Sign-in and
-own-account management no longer use an embedded dialog. See the
+own-account management no longer use an embedded dialog. The remaining dialog supports signing, public profiles, and widgets. SDK `ConnectResponse` remains a deprecated type alias for source compatibility; sign-in itself returns through the first-party callback. See the
 [integration guide](docs/integration-guide.md) for server wiring and migration.
 
 ## Public profile overlays
@@ -143,3 +143,5 @@ The current OpenAPI artifact describes the service report boundary. The remainin
 account, room management, study, settings, session and passkey HTTP operations
 still need complete request/response descriptions and generated client coverage
 before the full HTTP contract work is complete.
+
+Server deployments may set `FLOW_ID_API_URL` to a trusted internal HTTP(S) origin for API and JWKS requests, or pass `apiUrl` to server session/verification helpers. `issuerUrl` remains the public JWT issuer and browser navigation origin. The transport URL must contain no credentials, path, query, or fragment.

package/dist/sdk/browser-session-route.d.ts

@@ -4,5 +4,5 @@ export declare function startBrowserSession(request: Request, audience: string,
     returnTo?: string;
     signUp?: boolean;
     accessKeyHash?: string;
-}): Promise<Response>;
-export declare function finishBrowserSession(request: Request, audience: string, issuerUrl: string): Promise<Response>;
+}, apiUrl?: string): Promise<Response>;
+export declare function finishBrowserSession(request: Request, audience: string, issuerUrl: string, apiUrl?: string): Promise<Response>;

package/dist/sdk/browser-session-route.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { browserSigningSchema } from "./browser-contract";
 import { clearCookieString, cookieNamesFor, parseCookieHeader, serializeCookie, } from "./cookies";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 import { claimsToUser, sessionCookies } from "./session-core";
 import { verifyFlowJWT } from "./verify";
 const opaquePattern = /^[A-Za-z0-9_-]{43}$/;
@@ -60,7 +61,7 @@ export function safeReturnTo(value, audience, sessionPath = "/flow/session") {
         return null;
     }
 }
-export async function startBrowserSession(request, audience, issuerUrl, body) {
+export async function startBrowserSession(request, audience, issuerUrl, body, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
     const cookies = parseCookieHeader(request.headers.get("Cookie"));
     const refresh = cookies[cookieNamesFor(audience).refresh];
     const headers = new Headers({ "Content-Type": "application/json" });
@@ -74,7 +75,7 @@ export async function startBrowserSession(request, audience, issuerUrl, body) {
     if (body.action === "account") {
         if (!refresh)
             return reply({ error: "signed_out" }, 401);
-        const response = await fetch(`${issuerUrl}/api/auth/browser/account-handoff`, { method: "POST", headers, body: JSON.stringify({ audience }) });
+        const response = await fetchIssuerApi(`${apiUrl}/api/auth/browser/account-handoff`, { method: "POST", headers, body: JSON.stringify({ audience }) });
         if (!response.ok)
             return reply({ error: "account_unavailable" }, response.status);
         const { handoff } = z
@@ -88,7 +89,7 @@ export async function startBrowserSession(request, audience, issuerUrl, body) {
     const state = secret();
     const verifier = secret();
     const callback = `${audience}${new URL(request.url).pathname}`;
-    const response = await fetch(`${issuerUrl}/api/auth/browser/transaction`, {
+    const response = await fetchIssuerApi(`${apiUrl}/api/auth/browser/transaction`, {
         method: "POST",
         headers,
         body: JSON.stringify({
@@ -121,7 +122,7 @@ export async function startBrowserSession(request, audience, issuerUrl, body) {
         }),
     ]);
 }
-export async function finishBrowserSession(request, audience, issuerUrl) {
+export async function finishBrowserSession(request, audience, issuerUrl, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
     const url = new URL(request.url);
     const state = url.searchParams.get("flow_state") ?? "";
     if (!opaquePattern.test(state))
@@ -154,7 +155,7 @@ export async function finishBrowserSession(request, audience, issuerUrl) {
     if (!opaquePattern.test(code))
         return reply({ error: "invalid_login_code" }, 400);
     try {
-        const result = await fetch(`${issuerUrl}/api/auth/browser/token`, {
+        const result = await fetchIssuerApi(`${apiUrl}/api/auth/browser/token`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({
@@ -170,7 +171,11 @@ export async function finishBrowserSession(request, audience, issuerUrl) {
                 message: "Return to your app and start sign-in again.",
             }, 400, [clear]);
         const session = exchangeSchema.parse(await result.json());
-        const claims = await verifyFlowJWT(session.jwt, { audience, issuerUrl });
+        const claims = await verifyFlowJWT(session.jwt, {
+            audience,
+            issuerUrl,
+            apiUrl,
+        });
         if (!claimsToUser(claims).id)
             throw new Error("Invalid session");
         for (const value of sessionCookies(audience, session.jwt, session.refreshToken))

package/dist/sdk/client/create-flow.js

@@ -72,7 +72,7 @@ export function createFlow(options = {}) {
     if (currentFlow)
         return currentFlow;
     const host = resolveIdHost(options.host);
-    const dialogUrl = `${host}/dialog/?v=2`;
+    const dialogUrl = `${host}/dialog/`;
     const sessionPath = options.sessionPath ?? DEFAULT_SESSION_PATH;
     const rpId = options.rpId ??
         (isLocalHostname(window.location.hostname) ? "localhost" : undefined);

package/dist/sdk/client/dialog-host.d.ts

@@ -1,19 +1,7 @@
 import type { CreateDialogHostOptions, DialogHost } from "../types";
 /**
- * Creates a host that owns the dialog iframe (or popup) and exposes an RPC
- * channel into the Flow auth dialog at `id.flow.industries`.
- *
- * The iframe is mounted lazily on first use, kept hidden until `open()` is
- * called, and reused across requests so a single passkey-bound iframe handles
- * login, signing, and silent restore. The iframe is required (not just
- * `fetch`) because it's first-party to id.flow.industries and is the only way
- * to read the cross-origin cookie session in third-party-cookie-blocking
- * browsers (Safari, Firefox).
- *
- * Returned methods:
- *  - `request()` — open the dialog UI and dispatch an RPC (interactive flows)
- *  - `requestSilent()` — dispatch without showing the dialog (silent restore)
- *  - `open()`/`close()` — manual visibility control
- *  - `destroy()` — tear down the iframe and abort pending requests
+ * Creates the retained signing dialog host. Its iframe mounts lazily and is
+ * reused across signing requests. Authentication uses the first-party session
+ * handler and top-level authorization page independently.
  */
 export declare function createDialogHost(options: CreateDialogHostOptions): DialogHost;

package/dist/sdk/client/dialog-host.js

@@ -16,21 +16,9 @@ const VISIBLE_STYLE = {
     background: "transparent",
 };
 /**
- * Creates a host that owns the dialog iframe (or popup) and exposes an RPC
- * channel into the Flow auth dialog at `id.flow.industries`.
- *
- * The iframe is mounted lazily on first use, kept hidden until `open()` is
- * called, and reused across requests so a single passkey-bound iframe handles
- * login, signing, and silent restore. The iframe is required (not just
- * `fetch`) because it's first-party to id.flow.industries and is the only way
- * to read the cross-origin cookie session in third-party-cookie-blocking
- * browsers (Safari, Firefox).
- *
- * Returned methods:
- *  - `request()` — open the dialog UI and dispatch an RPC (interactive flows)
- *  - `requestSilent()` — dispatch without showing the dialog (silent restore)
- *  - `open()`/`close()` — manual visibility control
- *  - `destroy()` — tear down the iframe and abort pending requests
+ * Creates the retained signing dialog host. Its iframe mounts lazily and is
+ * reused across signing requests. Authentication uses the first-party session
+ * handler and top-level authorization page independently.
  */
 export function createDialogHost(options) {
     const { host, container = document.body } = options;
@@ -187,17 +175,15 @@ export function createDialogHost(options) {
             });
         });
     }
-    /** Opens the dialog UI and dispatches an interactive RPC (login, sign, etc.). */
+    /** Opens the dialog UI and dispatches a signing RPC. */
     async function request(method, params) {
         ensureFrame();
         open();
         return dispatchRequest(method, params);
     }
     /**
-     * Dispatches an RPC without showing the dialog UI. Used for signInHeadless flows
-     * (silent restore, refresh, sign-out) where the dialog route runs invisibly
-     * and resolves immediately. The iframe is still mounted so postMessage
-     * works, but its `display` stays `none`.
+     * @deprecated Use request() for signing. Retained for callers that manage
+     * visibility manually; this does not support background authentication.
      */
     async function requestSilent(method, params) {
         ensureFrame();

package/dist/sdk/client/flow-widget.js

@@ -47,7 +47,7 @@ export function createFlowWidget(options) {
     const hostOrigin = new URL(host).origin;
     let theme = options.theme ?? "light dark";
     const route = WIDGET_ROUTE[options.widget];
-    const frame = makeIframe(`${host}${route}?v=2`, WIDGET_TITLE[options.widget]);
+    const frame = makeIframe(`${host}${route}`, WIDGET_TITLE[options.widget]);
     frame.style.background = "transparent";
     const container = options.container ?? document.body;
     // Appended before bridging: `contentWindow` is null until the frame is in the

package/dist/sdk/client/methods.d.ts

@@ -1,9 +1,6 @@
 export declare const METHODS: {
-    readonly connect: "wallet_connect";
     readonly signMessage: "personal_sign";
     readonly signTypedData: "eth_signTypedData";
     readonly sendTransaction: "eth_sendTransaction";
     readonly sendCalls: "wallet_sendCalls";
-    readonly guest: "wallet_guest";
-    readonly signOut: "wallet_signout";
 };

package/dist/sdk/client/methods.js

@@ -1,9 +1,6 @@
 export const METHODS = {
-    connect: "wallet_connect",
     signMessage: "personal_sign",
     signTypedData: "eth_signTypedData",
     sendTransaction: "eth_sendTransaction",
     sendCalls: "wallet_sendCalls",
-    guest: "wallet_guest",
-    signOut: "wallet_signout",
 };

package/dist/sdk/client/open-profile.js

@@ -30,7 +30,7 @@ function createViewer(options) {
         setOverlayFocus(frame, ready && visible);
     }
     function mount(username) {
-        const el = makeIframe(`${host}/dialog/?v=2`, "Flow ID profile");
+        const el = makeIframe(`${host}/dialog/`, "Flow ID profile");
         el.dataset.flowProfileView = "";
         el.inert = true;
         Object.assign(el.style, OVERLAY_STYLE, { pointerEvents: "none" });
@@ -43,10 +43,6 @@ function createViewer(options) {
             targetOrigin: hostOrigin,
         });
         bridge = opened;
-        // The dialog SPA has no deep-link history fallback, so the frame loads at
-        // `/dialog/` and `init` asks it to land on the profile. Sending the route
-        // here rather than as a follow-up message keeps the sign-in root from ever
-        // mounting, even for the frame it takes to navigate away from it.
         sendBridgeNotification(opened, "__internal", {
             type: "init",
             mode: "iframe",
@@ -63,21 +59,7 @@ function createViewer(options) {
             .catch(() => { });
         opened.on("close", () => close());
         opened.on("__internal", (payload) => {
-            // A viewer looking at their own profile can reach the account view from
-            // here, which offers the same sign-in and sign-out the pill's dialog
-            // does. Those run on the host — it owns the session — so dropping them
-            // would leave the buttons doing nothing at all.
-            if (payload.type === "profile-login") {
-                close();
-                void flow
-                    .login(payload.mode === "signup" ? { signUp: true } : { signIn: true })
-                    .catch(() => { });
-            }
-            else if (payload.type === "profile-logout") {
-                close();
-                void flow.logout().catch(() => { });
-            }
-            else if (payload.type === "profile-token-request") {
+            if (payload.type === "profile-token-request") {
                 void answerTokenRequest(opened, flow, payload.id);
             }
         });

package/dist/sdk/client/session.d.ts

@@ -13,7 +13,7 @@ export declare function restoreCredential(store: Store<FlowState>): Promise<void
  * Clears local-only auth state: active credential in IDB, the access key for
  * the current address (if any), and the in-memory store. Does NOT touch the
  * server cookie session — the caller (createFlow.logout) handles that
- * separately via `wallet_signout`.
+ * separately through the first-party session handler.
  */
 export declare function runLogout(store: Store<FlowState>): Promise<void>;
 /**

package/dist/sdk/client/session.js

@@ -24,7 +24,7 @@ export async function restoreCredential(store) {
  * Clears local-only auth state: active credential in IDB, the access key for
  * the current address (if any), and the in-memory store. Does NOT touch the
  * server cookie session — the caller (createFlow.logout) handles that
- * separately via `wallet_signout`.
+ * separately through the first-party session handler.
  */
 export async function runLogout(store) {
     const state = store.getSnapshot();

package/dist/sdk/issuer-api.d.ts

@@ -0,0 +1,3 @@
+/** Resolve a trusted server transport without changing the public JWT issuer. */
+export declare function resolveIssuerApiUrl(issuerUrl: string, override?: string): string;
+export declare function fetchIssuerApi(url: string, init?: RequestInit): Promise<Response>;

package/dist/sdk/issuer-api.js

@@ -0,0 +1,28 @@
+/** Resolve a trusted server transport without changing the public JWT issuer. */
+export function resolveIssuerApiUrl(issuerUrl, override) {
+    const configured = override ??
+        (globalThis.process !== undefined
+            ? process.env.FLOW_ID_API_URL
+            : undefined);
+    const url = new URL(configured ?? issuerUrl);
+    if (!["http:", "https:"].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname !== "/") {
+        throw new Error("Flow ID API URL must be an HTTP(S) origin without credentials, path, query, or fragment");
+    }
+    return url.origin;
+}
+export async function fetchIssuerApi(url, init) {
+    const response = await fetch(url, { ...init, redirect: "error" });
+    if (!response.ok) {
+        console.warn("Flow ID API request failed", {
+            path: new URL(url).pathname,
+            status: response.status,
+            contentType: response.headers.get("content-type")?.split(";")[0] ?? null,
+        });
+    }
+    return response;
+}

package/dist/sdk/server.js

@@ -1,10 +1,11 @@
 import { resolveIdHost } from "./id-host";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 import { resolveSessionCore } from "./session-core";
 export { createSessionHandler, handleSessionRequest } from "./session-route";
 export { verifyFlowJWT } from "./verify";
-async function fetchProfile(issuerUrl, jwt, audience) {
+async function fetchProfile(apiUrl, jwt, audience) {
     try {
-        const res = await fetch(`${issuerUrl}/api/session/verify`, {
+        const res = await fetchIssuerApi(`${apiUrl}/api/session/verify`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ token: jwt, audience }),
@@ -29,12 +30,13 @@ async function fetchProfile(issuerUrl, jwt, audience) {
  */
 export async function resolveSession(cookieHeader, opts) {
     const issuerUrl = resolveIdHost(opts.issuerUrl, opts.audience);
-    const { session, claims, setCookies } = await resolveSessionCore(cookieHeader, opts.audience, issuerUrl);
+    const apiUrl = resolveIssuerApiUrl(issuerUrl, opts.apiUrl);
+    const { session, claims, setCookies } = await resolveSessionCore(cookieHeader, opts.audience, issuerUrl, apiUrl);
     const state = session
         ? { user: session.user, jwt: session.jwt, address: session.address ?? null }
         : null;
     const profile = state && opts.profile
-        ? await fetchProfile(issuerUrl, state.jwt, opts.audience)
+        ? await fetchProfile(apiUrl, state.jwt, opts.audience)
         : undefined;
     return {
         state,

package/dist/sdk/session-core.d.ts

@@ -27,7 +27,7 @@ export type ResolvedSessionCore = {
  * happened) but resolves signed-out rather than trusting it. Returns "dead"
  * for a definitive rejection and null for a transient network failure.
  */
-export declare function refreshSessionCore(issuerUrl: string, audience: string, refreshToken: string): Promise<ResolvedSessionCore | "dead" | null>;
+export declare function refreshSessionCore(issuerUrl: string, audience: string, refreshToken: string, apiUrl?: string): Promise<ResolvedSessionCore | "dead" | null>;
 /**
  * Resolves a session from a request's Cookie header.
  *
@@ -41,4 +41,4 @@ export declare function refreshSessionCore(issuerUrl: string, audience: string,
  *     network failure leaves the cookies alone so a later request can retry.
  *  3. Neither cookie → signed-out `session: null`.
  */
-export declare function resolveSessionCore(cookieHeader: string | null | undefined, audience: string, issuerUrl: string): Promise<ResolvedSessionCore>;
+export declare function resolveSessionCore(cookieHeader: string | null | undefined, audience: string, issuerUrl: string, apiUrl?: string): Promise<ResolvedSessionCore>;

package/dist/sdk/session-core.js

@@ -5,6 +5,7 @@ import { errField } from "./driver-error";
  * `session-route.ts` compose it into the public entry points.
  */
 import { clearCookieString, cookieNamesFor, JWT_COOKIE_MAX_AGE_S, parseCookieHeader, REFRESH_COOKIE_MAX_AGE_S, serializeCookie, } from "./cookies";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 import { isExpiring } from "./token-expiry";
 import { verifyFlowJWT } from "./verify";
 export function claimsToUser(claims) {
@@ -16,9 +17,9 @@ export function claimsToUser(claims) {
         isGuest: claims.guest !== false,
     };
 }
-async function refreshSession(issuerUrl, token) {
+async function refreshSession(token, apiUrl) {
     try {
-        const res = await fetch(`${issuerUrl}/api/session/refresh`, {
+        const res = await fetchIssuerApi(`${apiUrl}/api/session/refresh`, {
             method: "POST",
             headers: { Authorization: `Bearer ${token}` },
         });
@@ -42,11 +43,11 @@ async function refreshSession(issuerUrl, token) {
 // other machines).
 const REFRESH_RESULT_TTL_MS = 30_000;
 const refreshInFlight = new Map();
-function refreshOnce(issuerUrl, token) {
-    const key = `${issuerUrl}\n${token}`;
+function refreshOnce(issuerUrl, token, apiUrl) {
+    const key = `${issuerUrl}\n${apiUrl}\n${token}`;
     let flight = refreshInFlight.get(key);
     if (!flight) {
-        flight = refreshSession(issuerUrl, token);
+        flight = refreshSession(token, apiUrl);
         refreshInFlight.set(key, flight);
         void flight.finally(() => {
             const timer = setTimeout(() => refreshInFlight.delete(key), REFRESH_RESULT_TTL_MS);
@@ -100,14 +101,14 @@ export function clearingCookies(audience) {
  * happened) but resolves signed-out rather than trusting it. Returns "dead"
  * for a definitive rejection and null for a transient network failure.
  */
-export async function refreshSessionCore(issuerUrl, audience, refreshToken) {
-    const result = await refreshOnce(issuerUrl, refreshToken);
+export async function refreshSessionCore(issuerUrl, audience, refreshToken, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
+    const result = await refreshOnce(issuerUrl, refreshToken, apiUrl);
     if (result === "dead" || !result)
         return result;
     const successorCookies = sessionCookies(audience, result.jwt, result.refreshToken);
     let claims;
     try {
-        claims = await verifyFlowJWT(result.jwt, { audience, issuerUrl });
+        claims = await verifyFlowJWT(result.jwt, { audience, issuerUrl, apiUrl });
     }
     catch (err) {
         if (isJwtVerificationFailure(err)) {
@@ -143,13 +144,13 @@ export async function refreshSessionCore(issuerUrl, audience, refreshToken) {
  *     network failure leaves the cookies alone so a later request can retry.
  *  3. Neither cookie → signed-out `session: null`.
  */
-export async function resolveSessionCore(cookieHeader, audience, issuerUrl) {
+export async function resolveSessionCore(cookieHeader, audience, issuerUrl, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
     const names = cookieNamesFor(audience);
     const cookies = parseCookieHeader(cookieHeader);
     const jwt = cookies[names.jwt];
     if (jwt && !isExpiring(jwt)) {
         try {
-            const claims = await verifyFlowJWT(jwt, { audience, issuerUrl });
+            const claims = await verifyFlowJWT(jwt, { audience, issuerUrl, apiUrl });
             return {
                 session: { user: claimsToUser(claims), jwt },
                 claims,
@@ -165,7 +166,7 @@ export async function resolveSessionCore(cookieHeader, audience, issuerUrl) {
     const refreshToken = cookies[names.refresh];
     if (!refreshToken)
         return { session: null, claims: null, setCookies: [] };
-    const refreshed = await refreshSessionCore(issuerUrl, audience, refreshToken);
+    const refreshed = await refreshSessionCore(issuerUrl, audience, refreshToken, apiUrl);
     if (refreshed === "dead") {
         return {
             session: null,

package/dist/sdk/session-route.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { browserCompletionSchema } from "./browser-contract";
 import { finishBrowserSession, startBrowserSession, } from "./browser-session-route";
 import { clearCookieString } from "./cookies";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 /**
  * The first-party session route every consumer app serves from its own
  * origin — the only path between a browser and the refresh token. The
@@ -82,9 +83,10 @@ function isCrossSite(request, audience) {
 export async function handleSessionRequest(request, opts = {}) {
     const audience = opts.audience ?? defaultAudience(new URL(request.url).origin);
     const issuerUrl = resolveIdHost(opts.issuerUrl, audience);
+    const apiUrl = resolveIssuerApiUrl(issuerUrl, opts.apiUrl);
     const callback = new URL(request.url);
     if (request.method === "GET" && callback.searchParams.has("flow_state")) {
-        return finishBrowserSession(request, audience, issuerUrl);
+        return finishBrowserSession(request, audience, issuerUrl, apiUrl);
     }
     if (isCrossSite(request, audience)) {
         return json({ state: null }, 403);
@@ -95,14 +97,14 @@ export async function handleSessionRequest(request, opts = {}) {
                 const token = parseCookieHeader(request.headers.get("Cookie"))[cookieNamesFor(audience).refresh];
                 if (!token)
                     return json({ state: null }, 200);
-                const result = await refreshSessionCore(issuerUrl, audience, token);
+                const result = await refreshSessionCore(issuerUrl, audience, token, apiUrl);
                 if (result === "dead")
                     return json({ state: null }, 200, clearingCookies(audience));
                 if (!result)
                     return json({ state: null }, 502);
                 return json({ state: result.session }, 200, result.setCookies);
             }
-            const { session, setCookies } = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl);
+            const { session, setCookies } = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl, apiUrl);
             const completionName = `${cookieNamesFor(audience).refresh}.completion`;
             const raw = parseCookieHeader(request.headers.get("Cookie"))[completionName];
             let loginCompletion;
@@ -129,14 +131,14 @@ export async function handleSessionRequest(request, opts = {}) {
                     return await startBrowserSession(request, audience, issuerUrl, {
                         ...body,
                         action: body.action,
-                    });
+                    }, apiUrl);
                 }
                 catch {
                     return json({ state: null }, 502);
                 }
             }
             if (body?.action === "guest") {
-                const existing = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl);
+                const existing = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl, apiUrl);
                 if (existing.session)
                     return json({ state: existing.session }, 200, existing.setCookies);
                 const previousRefresh = parseCookieHeader(request.headers.get("Cookie"))[cookieNamesFor(audience).refresh];
@@ -153,7 +155,7 @@ export async function handleSessionRequest(request, opts = {}) {
                         if (value)
                             headers.set(name, value);
                     }
-                    const result = await fetch(`${issuerUrl}/api/auth/passkey/guest`, {
+                    const result = await fetchIssuerApi(`${apiUrl}/api/auth/passkey/guest`, {
                         method: "POST",
                         headers,
                         body: JSON.stringify({ audience }),
@@ -162,7 +164,11 @@ export async function handleSessionRequest(request, opts = {}) {
                         return json({ state: null }, result.status);
                     // SAFETY: the configured issuer returns this session token pair, verified below.
                     const data = (await result.json());
-                    const claims = await verifyFlowJWT(data.jwt, { audience, issuerUrl });
+                    const claims = await verifyFlowJWT(data.jwt, {
+                        audience,
+                        issuerUrl,
+                        apiUrl,
+                    });
                     return json({
                         state: {
                             user: claimsToUser(claims),
@@ -188,7 +194,7 @@ export async function handleSessionRequest(request, opts = {}) {
                 let additionalSessions = [];
                 if (token && audiences.length > 0) {
                     try {
-                        const res = await fetch(`${issuerUrl}/api/session/additional`, {
+                        const res = await fetchIssuerApi(`${apiUrl}/api/session/additional`, {
                             method: "POST",
                             headers: {
                                 "Content-Type": "application/json",
@@ -216,7 +222,11 @@ export async function handleSessionRequest(request, opts = {}) {
             // for another app from being installed here; a failed install must not
             // clear cookies that may hold a live session.
             try {
-                const claims = await verifyFlowJWT(jwt, { audience, issuerUrl });
+                const claims = await verifyFlowJWT(jwt, {
+                    audience,
+                    issuerUrl,
+                    apiUrl,
+                });
                 return json({ state: { user: claimsToUser(claims), jwt } }, 200, sessionCookies(audience, jwt, refreshToken));
             }
             catch (err) {
@@ -230,7 +240,7 @@ export async function handleSessionRequest(request, opts = {}) {
             // an unreachable issuer just leaves the lineage to expire on its own.
             if (token) {
                 try {
-                    const response = await fetch(`${issuerUrl}/api/session/revoke`, {
+                    const response = await fetchIssuerApi(`${apiUrl}/api/session/revoke`, {
                         method: "POST",
                         headers: { Authorization: `Bearer ${token}` },
                     });

package/dist/sdk/types/auth.d.ts

@@ -99,6 +99,8 @@ export type PasskeyPluginOptions = {
 export type VerifyOptions = {
     audience: string;
     issuerUrl?: string;
+    /** Trusted server API origin; defaults to FLOW_ID_API_URL, then the public issuer. */
+    apiUrl?: string;
 };
 /**
  * One entry in the signed-in user's session list (`GET /api/account/sessions`).

package/dist/sdk/types/index.d.ts

@@ -11,8 +11,8 @@ export { GAME_LIFECYCLE_EVENT_NAMES } from "./game";
 export type { AccountProfileData } from "./landing";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";
 export type { OtpVerificationFailure, OtpVerificationResult, VerificationAdapter, } from "./otp";
-export type { Call, ConnectCapabilities, ConnectRequest, ConnectResponse, GuestRequest, GuestResponse, MethodName, MethodParams, MethodResult, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignOutRequest, SignOutResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
-export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export type { Call, ConnectCapabilities, ConnectResponse, MethodName, MethodParams, MethodResult, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
+export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
 export type { ReportOperation, ReportRequest, ReportResponse, ReportsApi, ReportTransport, } from "./reports";
 export type { CreateRoomEventInput, RoomEventArchive, RoomEventAttendance, RoomEventFrequency, RoomEventInstance, RoomEventInterest, RoomEventInterestState, RoomEventList, RoomEventOccurrence, RoomEventRecurrence, RoomEventRoomRef, RoomEventRun, RoomEventSeries, RoomEventStatus, SetInterestInput, UpdateRoomEventInput, } from "./room-events";
 export type { CreateRoomInput, GlobalRole, ModerationSubject, MyRooms, PlayerPositionReport, RoleChangeVerdict, RoomCapabilities, RoomCapability, RoomChannel, RoomDetail, RoomList, RoomMemberEntry, RoomMembers, RoomOccupancy, RoomOwner, RoomPlayerPosition, RoomPresenceEntry, RoomPresenceSnapshot, RoomRestrictionKind, RoomRole, RoomSummary, RoomSurfaceSettings, RoomsApi, RoomVisibility, StaffEntry, UpdateRoomInput, VerifyRoomContext, Viewer, VoiceDecisionReason, VoiceDecisionSubject, VoiceRoomDecision, } from "./rooms";

package/dist/sdk/types/index.js

@@ -1,3 +1,3 @@
 export { BODY_REGIONS, COSMETIC_MATERIALS } from "./cosmetics";
 export { GAME_LIFECYCLE_EVENT_NAMES } from "./game";
-export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";

package/dist/sdk/types/messenger.d.ts

@@ -100,11 +100,6 @@ export type Schema = [
             type: "profile-token";
             id: string;
             token: string | null;
-        } | {
-            type: "profile-login";
-            mode: "signin" | "signup";
-        } | {
-            type: "profile-logout";
         } | {
             type: "dialog-shown";
         } | {

package/dist/sdk/types/protocol.d.ts

@@ -1,18 +1,16 @@
 import type { RawRecord, RawValue } from "../json";
 import type { AdditionalSession, FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { Address } from "./sdk";
-export type MethodName = "wallet_connect" | "personal_sign" | "eth_signTypedData" | "eth_sendTransaction" | "wallet_sendCalls" | "wallet_guest" | "wallet_signout";
+export type MethodName = "personal_sign" | "eth_signTypedData" | "eth_sendTransaction" | "wallet_sendCalls";
 export type ConnectCapabilities = {
     createAccount?: boolean;
     signIn?: boolean;
     accessKeyHash?: string;
+    /** @deprecated Sign-in always uses the dedicated top-level page. */
     signInHeadless?: boolean;
     credentialId?: string;
     /**
-     * The current guest's access JWT, forwarded so a sign-up upgrades that guest
-     * in place even where the guest cookie is unreadable (the iOS top-level
-     * sign-up popup). The server verifies it before letting it stand in for the
-     * cookie session; see the register endpoint.
+     * @deprecated Guest proof is managed by the first-party session handler.
      */
     guestToken?: string;
     /**
@@ -22,9 +20,7 @@ export type ConnectCapabilities = {
      */
     additionalAudiences?: readonly string[];
 };
-export type ConnectRequest = [{
-    capabilities?: ConnectCapabilities;
-}];
+/** @deprecated Login navigates; use SessionRouteResponse for completed sessions. */
 export type ConnectResponse = {
     jwt: string;
     /** First-party rotating refresh token; the SDK persists it in the app origin. */
@@ -83,43 +79,17 @@ export type RestoreResponse = {
     credential: FlowCredential | null;
     address: Address | null;
 };
-export type GuestRequest = [] | [{
-    additionalAudiences?: readonly string[];
-}];
-/**
- * A guest has no passkey and no derivable wallet address yet, so `credential`
- * and `address` are always null — the shape mirrors RestoreResponse so the SDK
- * can commit either to the same store fields.
- */
-export type GuestResponse = {
-    jwt: string;
-    refreshToken: string;
-    user: FlowUser;
-    credential: null;
-    address: null;
-    additionalSessions?: AdditionalSession[];
-};
-export type SignOutRequest = [];
-export type SignOutResponse = {
-    ok: true;
-};
 export type MethodParams = {
-    wallet_connect: ConnectRequest;
     personal_sign: SignMessageRequest;
     eth_signTypedData: SignTypedDataRequest;
     eth_sendTransaction: SendTransactionRequest;
     wallet_sendCalls: SendCallsRequest;
-    wallet_guest: GuestRequest;
-    wallet_signout: SignOutRequest;
 };
 export type MethodResult = {
-    wallet_connect: ConnectResponse;
     personal_sign: SignMessageResponse;
     eth_signTypedData: SignTypedDataResponse;
     eth_sendTransaction: SendTransactionResponse;
     wallet_sendCalls: SendCallsResponse;
-    wallet_guest: GuestResponse;
-    wallet_signout: SignOutResponse;
 };
 export type RpcRequest = {
     id: string | number;
@@ -143,12 +113,6 @@ export type SendCallsParams = {
     chainId?: string;
     capabilities?: RawRecord;
 };
-/**
- * Unwraps the connect capabilities from a wallet_connect RPC request (they ride
- * as the first param), or undefined. Several dialog surfaces read them (mode,
- * accessKeyHash, guestToken), so the cast lives here rather than being repeated.
- */
-export declare function getConnectCapabilities(request: RpcRequest | undefined): ConnectCapabilities | undefined;
 export declare function isPersonalSignParams(params: readonly unknown[] | undefined): params is readonly [string, string];
 export declare function isSendTransactionParams(params: readonly unknown[] | undefined): params is readonly [SendTransactionParams];
 export declare function isSendCallsParams(params: readonly unknown[] | undefined): params is readonly [SendCallsParams];

package/dist/sdk/types/protocol.js

@@ -1,15 +1,3 @@
-/**
- * Unwraps the connect capabilities from a wallet_connect RPC request (they ride
- * as the first param), or undefined. Several dialog surfaces read them (mode,
- * accessKeyHash, guestToken), so the cast lives here rather than being repeated.
- */
-export function getConnectCapabilities(request) {
-    const first = request?.params?.[0];
-    const found = Object.entries(Object(first)).find(([k]) => k === "capabilities")?.[1];
-    /* SAFETY: the field is read off this app's own wallet_connect params, whose capabilities
-       block is defined by ConnectCapabilities; a missing one answers undefined. */
-    return found;
-}
 export function isPersonalSignParams(params) {
     if (!params || params.length < 2)
         return false;

package/dist/sdk/types/sdk.d.ts

@@ -90,8 +90,8 @@ export type CreateFlowOptions = {
      */
     initialState?: FlowSessionState | null;
     /**
-     * Extra audiences every dialog mint (login, guest) requests refresh tokens
-     * for, on top of the app's own (AUTH-39). Only audiences the auth server
+     * Extra audiences to receive sessions after the app session is installed.
+     * Only audiences the auth server
      * explicitly allowlists for this origin succeed — anything else fails the
      * mint. The minted sessions are delivered once via `onAdditionalSessions`
      * and never stored; the app forwards each to its own origin (e.g. the
@@ -229,7 +229,7 @@ export type ProfileButtonHandle = {
 export type OpenProfileOptions = {
     /**
      * Called once when the overlay closes, including its close button, backdrop,
-     * Escape, closeProfile(), or a sign-in/sign-out handoff. Runs after the
+     * Escape, closeProfile(), or an own-account tab handoff. Runs after the
      * overlay stops accepting input, without waiting for the exit animation.
      * The latest successful open replaces this callback; omitting it clears the
      * previous callback. Rejected opens and repeated closes do not notify.
@@ -314,6 +314,7 @@ export type DialogHost = {
     close: () => void;
     destroy: () => void;
     request: <T = unknown>(method: string, params?: readonly unknown[]) => Promise<T>;
+    /** @deprecated Manual signing-dialog visibility only; authentication redirects. */
     requestSilent: <T = unknown>(method: string, params?: readonly unknown[]) => Promise<T>;
     messenger: import("./messenger").Messenger;
 };

package/dist/sdk/types/server.d.ts

@@ -6,6 +6,8 @@ export type ResolveSessionOptions = {
     audience: string;
     /** Flow ID origin; defaults to `https://id.flow.industries`. */
     issuerUrl?: string;
+    /** Trusted server API origin; defaults to FLOW_ID_API_URL, then the public issuer. */
+    apiUrl?: string;
     /**
      * Also fetch the public profile (avatar, tier, level) for a resolved
      * session via `/api/session/verify` — one extra round-trip; off by default.
@@ -36,6 +38,8 @@ export type SessionRouteOptions = {
     audience?: string;
     /** Flow ID origin; defaults per `defaultIdHost` (`FLOW_ID_HOST` on servers). */
     issuerUrl?: string;
+    /** Trusted server API origin; defaults to FLOW_ID_API_URL, then the public issuer. */
+    apiUrl?: string;
     /** Route path for `createSessionHandler`'s own path check. */
     path?: string;
 };

package/dist/sdk/verify.js

@@ -1,4 +1,5 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
 const jwksCache = new Map();
 const DEFAULT_ISSUER_URL = "https://id.flow.industries";
 /**
@@ -22,10 +23,14 @@ const DEFAULT_ISSUER_URL = "https://id.flow.industries";
  */
 export async function verifyFlowJWT(token, opts) {
     const issuerUrl = opts.issuerUrl ?? DEFAULT_ISSUER_URL;
-    let jwks = jwksCache.get(issuerUrl);
+    const apiUrl = resolveIssuerApiUrl(issuerUrl, opts.apiUrl);
+    const cacheKey = `${issuerUrl}\n${apiUrl}`;
+    let jwks = jwksCache.get(cacheKey);
     if (!jwks) {
-        jwks = createRemoteJWKSet(new URL(`${issuerUrl}/api/auth/jwks`));
-        jwksCache.set(issuerUrl, jwks);
+        jwks = createRemoteJWKSet(new URL(`${apiUrl}/api/auth/jwks`), {
+            [customFetch]: fetchIssuerApi,
+        });
+        jwksCache.set(cacheKey, jwks);
     }
     const { payload } = await jwtVerify(token, jwks, {
         issuer: issuerUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.23.0",
+  "version": "0.23.2",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -66,10 +66,9 @@
   "scripts": {
     "dev": "./dev.sh",
     "build:dialog": "bunx vite build",
-    "build:legacy-dialog": "bunx vite build --config vite.legacy.config.ts",
     "build:playground": "bunx vite build --config vite.playground.config.ts",
     "build:landing": "bunx vite build --config vite.landing.config.ts",
-    "build": "bun run build:legacy-dialog && bunx vite build && bunx vite build --config vite.playground.config.ts && bunx vite build --config vite.landing.config.ts",
+    "build": "bunx vite build && bunx vite build --config vite.playground.config.ts && bunx vite build --config vite.landing.config.ts",
     "build:sdk": "tsc --project tsconfig.sdk.json",
     "prepublishOnly": "bun run build:sdk",
     "start": "bun run src/index.ts",
@@ -85,7 +84,7 @@
     "test:sdk-package": "bash scripts/test-sdk-package.sh",
     "format": "biome format --write",
     "check": "biome check --write",
-    "typecheck": "tsr generate && (cd src/legacy-dialog && bunx tsr generate) && tsc --noEmit && tsc -p tsconfig.legacy.json --noEmit",
+    "typecheck": "tsr generate && tsc --noEmit",
     "contracts:generate": "bun scripts/generate-contracts.ts",
     "contracts:check": "bun scripts/generate-contracts.ts --check && bun scripts/check-contract-compatibility.ts",
     "db:check": "bun scripts/db-check.ts",