@flow-industries/id 0.23.1 → 0.23.2

package/README.md

@@ -53,7 +53,7 @@ app path; read the new session after navigation instead of continuing after
 
 `ProfileButton` and `flow.openAccount()` open `/account` in a normal new tab.
 The source app stays loaded and refreshes its session on refocus. Sign-in and
-own-account management no longer use an embedded dialog. See the
+own-account management no longer use an embedded dialog. The remaining dialog supports signing, public profiles, and widgets. SDK `ConnectResponse` remains a deprecated type alias for source compatibility; sign-in itself returns through the first-party callback. See the
 [integration guide](docs/integration-guide.md) for server wiring and migration.
 
 ## Public profile overlays

package/dist/sdk/client/create-flow.js

@@ -72,7 +72,7 @@ export function createFlow(options = {}) {
     if (currentFlow)
         return currentFlow;
     const host = resolveIdHost(options.host);
-    const dialogUrl = `${host}/dialog/?v=2`;
+    const dialogUrl = `${host}/dialog/`;
     const sessionPath = options.sessionPath ?? DEFAULT_SESSION_PATH;
     const rpId = options.rpId ??
         (isLocalHostname(window.location.hostname) ? "localhost" : undefined);

package/dist/sdk/client/dialog-host.d.ts

@@ -1,19 +1,7 @@
 import type { CreateDialogHostOptions, DialogHost } from "../types";
 /**
- * Creates a host that owns the dialog iframe (or popup) and exposes an RPC
- * channel into the Flow auth dialog at `id.flow.industries`.
- *
- * The iframe is mounted lazily on first use, kept hidden until `open()` is
- * called, and reused across requests so a single passkey-bound iframe handles
- * login, signing, and silent restore. The iframe is required (not just
- * `fetch`) because it's first-party to id.flow.industries and is the only way
- * to read the cross-origin cookie session in third-party-cookie-blocking
- * browsers (Safari, Firefox).
- *
- * Returned methods:
- *  - `request()` — open the dialog UI and dispatch an RPC (interactive flows)
- *  - `requestSilent()` — dispatch without showing the dialog (silent restore)
- *  - `open()`/`close()` — manual visibility control
- *  - `destroy()` — tear down the iframe and abort pending requests
+ * Creates the retained signing dialog host. Its iframe mounts lazily and is
+ * reused across signing requests. Authentication uses the first-party session
+ * handler and top-level authorization page independently.
  */
 export declare function createDialogHost(options: CreateDialogHostOptions): DialogHost;

package/dist/sdk/client/dialog-host.js

@@ -16,21 +16,9 @@ const VISIBLE_STYLE = {
     background: "transparent",
 };
 /**
- * Creates a host that owns the dialog iframe (or popup) and exposes an RPC
- * channel into the Flow auth dialog at `id.flow.industries`.
- *
- * The iframe is mounted lazily on first use, kept hidden until `open()` is
- * called, and reused across requests so a single passkey-bound iframe handles
- * login, signing, and silent restore. The iframe is required (not just
- * `fetch`) because it's first-party to id.flow.industries and is the only way
- * to read the cross-origin cookie session in third-party-cookie-blocking
- * browsers (Safari, Firefox).
- *
- * Returned methods:
- *  - `request()` — open the dialog UI and dispatch an RPC (interactive flows)
- *  - `requestSilent()` — dispatch without showing the dialog (silent restore)
- *  - `open()`/`close()` — manual visibility control
- *  - `destroy()` — tear down the iframe and abort pending requests
+ * Creates the retained signing dialog host. Its iframe mounts lazily and is
+ * reused across signing requests. Authentication uses the first-party session
+ * handler and top-level authorization page independently.
  */
 export function createDialogHost(options) {
     const { host, container = document.body } = options;
@@ -187,17 +175,15 @@ export function createDialogHost(options) {
             });
         });
     }
-    /** Opens the dialog UI and dispatches an interactive RPC (login, sign, etc.). */
+    /** Opens the dialog UI and dispatches a signing RPC. */
     async function request(method, params) {
         ensureFrame();
         open();
         return dispatchRequest(method, params);
     }
     /**
-     * Dispatches an RPC without showing the dialog UI. Used for signInHeadless flows
-     * (silent restore, refresh, sign-out) where the dialog route runs invisibly
-     * and resolves immediately. The iframe is still mounted so postMessage
-     * works, but its `display` stays `none`.
+     * @deprecated Use request() for signing. Retained for callers that manage
+     * visibility manually; this does not support background authentication.
      */
     async function requestSilent(method, params) {
         ensureFrame();

package/dist/sdk/client/flow-widget.js

@@ -47,7 +47,7 @@ export function createFlowWidget(options) {
     const hostOrigin = new URL(host).origin;
     let theme = options.theme ?? "light dark";
     const route = WIDGET_ROUTE[options.widget];
-    const frame = makeIframe(`${host}${route}?v=2`, WIDGET_TITLE[options.widget]);
+    const frame = makeIframe(`${host}${route}`, WIDGET_TITLE[options.widget]);
     frame.style.background = "transparent";
     const container = options.container ?? document.body;
     // Appended before bridging: `contentWindow` is null until the frame is in the

package/dist/sdk/client/methods.d.ts

@@ -1,9 +1,6 @@
 export declare const METHODS: {
-    readonly connect: "wallet_connect";
     readonly signMessage: "personal_sign";
     readonly signTypedData: "eth_signTypedData";
     readonly sendTransaction: "eth_sendTransaction";
     readonly sendCalls: "wallet_sendCalls";
-    readonly guest: "wallet_guest";
-    readonly signOut: "wallet_signout";
 };

package/dist/sdk/client/methods.js

@@ -1,9 +1,6 @@
 export const METHODS = {
-    connect: "wallet_connect",
     signMessage: "personal_sign",
     signTypedData: "eth_signTypedData",
     sendTransaction: "eth_sendTransaction",
     sendCalls: "wallet_sendCalls",
-    guest: "wallet_guest",
-    signOut: "wallet_signout",
 };

package/dist/sdk/client/open-profile.js

@@ -30,7 +30,7 @@ function createViewer(options) {
         setOverlayFocus(frame, ready && visible);
     }
     function mount(username) {
-        const el = makeIframe(`${host}/dialog/?v=2`, "Flow ID profile");
+        const el = makeIframe(`${host}/dialog/`, "Flow ID profile");
         el.dataset.flowProfileView = "";
         el.inert = true;
         Object.assign(el.style, OVERLAY_STYLE, { pointerEvents: "none" });
@@ -43,10 +43,6 @@ function createViewer(options) {
             targetOrigin: hostOrigin,
         });
         bridge = opened;
-        // The dialog SPA has no deep-link history fallback, so the frame loads at
-        // `/dialog/` and `init` asks it to land on the profile. Sending the route
-        // here rather than as a follow-up message keeps the sign-in root from ever
-        // mounting, even for the frame it takes to navigate away from it.
         sendBridgeNotification(opened, "__internal", {
             type: "init",
             mode: "iframe",
@@ -63,21 +59,7 @@ function createViewer(options) {
             .catch(() => { });
         opened.on("close", () => close());
         opened.on("__internal", (payload) => {
-            // A viewer looking at their own profile can reach the account view from
-            // here, which offers the same sign-in and sign-out the pill's dialog
-            // does. Those run on the host — it owns the session — so dropping them
-            // would leave the buttons doing nothing at all.
-            if (payload.type === "profile-login") {
-                close();
-                void flow
-                    .login(payload.mode === "signup" ? { signUp: true } : { signIn: true })
-                    .catch(() => { });
-            }
-            else if (payload.type === "profile-logout") {
-                close();
-                void flow.logout().catch(() => { });
-            }
-            else if (payload.type === "profile-token-request") {
+            if (payload.type === "profile-token-request") {
                 void answerTokenRequest(opened, flow, payload.id);
             }
         });

package/dist/sdk/client/session.d.ts

@@ -13,7 +13,7 @@ export declare function restoreCredential(store: Store<FlowState>): Promise<void
  * Clears local-only auth state: active credential in IDB, the access key for
  * the current address (if any), and the in-memory store. Does NOT touch the
  * server cookie session — the caller (createFlow.logout) handles that
- * separately via `wallet_signout`.
+ * separately through the first-party session handler.
  */
 export declare function runLogout(store: Store<FlowState>): Promise<void>;
 /**

package/dist/sdk/client/session.js

@@ -24,7 +24,7 @@ export async function restoreCredential(store) {
  * Clears local-only auth state: active credential in IDB, the access key for
  * the current address (if any), and the in-memory store. Does NOT touch the
  * server cookie session — the caller (createFlow.logout) handles that
- * separately via `wallet_signout`.
+ * separately through the first-party session handler.
  */
 export async function runLogout(store) {
     const state = store.getSnapshot();

package/dist/sdk/types/index.d.ts

@@ -11,8 +11,8 @@ export { GAME_LIFECYCLE_EVENT_NAMES } from "./game";
 export type { AccountProfileData } from "./landing";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";
 export type { OtpVerificationFailure, OtpVerificationResult, VerificationAdapter, } from "./otp";
-export type { Call, ConnectCapabilities, ConnectRequest, ConnectResponse, GuestRequest, GuestResponse, MethodName, MethodParams, MethodResult, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignOutRequest, SignOutResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
-export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export type { Call, ConnectCapabilities, ConnectResponse, MethodName, MethodParams, MethodResult, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
+export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
 export type { ReportOperation, ReportRequest, ReportResponse, ReportsApi, ReportTransport, } from "./reports";
 export type { CreateRoomEventInput, RoomEventArchive, RoomEventAttendance, RoomEventFrequency, RoomEventInstance, RoomEventInterest, RoomEventInterestState, RoomEventList, RoomEventOccurrence, RoomEventRecurrence, RoomEventRoomRef, RoomEventRun, RoomEventSeries, RoomEventStatus, SetInterestInput, UpdateRoomEventInput, } from "./room-events";
 export type { CreateRoomInput, GlobalRole, ModerationSubject, MyRooms, PlayerPositionReport, RoleChangeVerdict, RoomCapabilities, RoomCapability, RoomChannel, RoomDetail, RoomList, RoomMemberEntry, RoomMembers, RoomOccupancy, RoomOwner, RoomPlayerPosition, RoomPresenceEntry, RoomPresenceSnapshot, RoomRestrictionKind, RoomRole, RoomSummary, RoomSurfaceSettings, RoomsApi, RoomVisibility, StaffEntry, UpdateRoomInput, VerifyRoomContext, Viewer, VoiceDecisionReason, VoiceDecisionSubject, VoiceRoomDecision, } from "./rooms";

package/dist/sdk/types/index.js

@@ -1,3 +1,3 @@
 export { BODY_REGIONS, COSMETIC_MATERIALS } from "./cosmetics";
 export { GAME_LIFECYCLE_EVENT_NAMES } from "./game";
-export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";

package/dist/sdk/types/messenger.d.ts

@@ -100,11 +100,6 @@ export type Schema = [
             type: "profile-token";
             id: string;
             token: string | null;
-        } | {
-            type: "profile-login";
-            mode: "signin" | "signup";
-        } | {
-            type: "profile-logout";
         } | {
             type: "dialog-shown";
         } | {

package/dist/sdk/types/protocol.d.ts

@@ -1,18 +1,16 @@
 import type { RawRecord, RawValue } from "../json";
 import type { AdditionalSession, FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { Address } from "./sdk";
-export type MethodName = "wallet_connect" | "personal_sign" | "eth_signTypedData" | "eth_sendTransaction" | "wallet_sendCalls" | "wallet_guest" | "wallet_signout";
+export type MethodName = "personal_sign" | "eth_signTypedData" | "eth_sendTransaction" | "wallet_sendCalls";
 export type ConnectCapabilities = {
     createAccount?: boolean;
     signIn?: boolean;
     accessKeyHash?: string;
+    /** @deprecated Sign-in always uses the dedicated top-level page. */
     signInHeadless?: boolean;
     credentialId?: string;
     /**
-     * The current guest's access JWT, forwarded so a sign-up upgrades that guest
-     * in place even where the guest cookie is unreadable (the iOS top-level
-     * sign-up popup). The server verifies it before letting it stand in for the
-     * cookie session; see the register endpoint.
+     * @deprecated Guest proof is managed by the first-party session handler.
      */
     guestToken?: string;
     /**
@@ -22,9 +20,7 @@ export type ConnectCapabilities = {
      */
     additionalAudiences?: readonly string[];
 };
-export type ConnectRequest = [{
-    capabilities?: ConnectCapabilities;
-}];
+/** @deprecated Login navigates; use SessionRouteResponse for completed sessions. */
 export type ConnectResponse = {
     jwt: string;
     /** First-party rotating refresh token; the SDK persists it in the app origin. */
@@ -83,43 +79,17 @@ export type RestoreResponse = {
     credential: FlowCredential | null;
     address: Address | null;
 };
-export type GuestRequest = [] | [{
-    additionalAudiences?: readonly string[];
-}];
-/**
- * A guest has no passkey and no derivable wallet address yet, so `credential`
- * and `address` are always null — the shape mirrors RestoreResponse so the SDK
- * can commit either to the same store fields.
- */
-export type GuestResponse = {
-    jwt: string;
-    refreshToken: string;
-    user: FlowUser;
-    credential: null;
-    address: null;
-    additionalSessions?: AdditionalSession[];
-};
-export type SignOutRequest = [];
-export type SignOutResponse = {
-    ok: true;
-};
 export type MethodParams = {
-    wallet_connect: ConnectRequest;
     personal_sign: SignMessageRequest;
     eth_signTypedData: SignTypedDataRequest;
     eth_sendTransaction: SendTransactionRequest;
     wallet_sendCalls: SendCallsRequest;
-    wallet_guest: GuestRequest;
-    wallet_signout: SignOutRequest;
 };
 export type MethodResult = {
-    wallet_connect: ConnectResponse;
     personal_sign: SignMessageResponse;
     eth_signTypedData: SignTypedDataResponse;
     eth_sendTransaction: SendTransactionResponse;
     wallet_sendCalls: SendCallsResponse;
-    wallet_guest: GuestResponse;
-    wallet_signout: SignOutResponse;
 };
 export type RpcRequest = {
     id: string | number;
@@ -143,12 +113,6 @@ export type SendCallsParams = {
     chainId?: string;
     capabilities?: RawRecord;
 };
-/**
- * Unwraps the connect capabilities from a wallet_connect RPC request (they ride
- * as the first param), or undefined. Several dialog surfaces read them (mode,
- * accessKeyHash, guestToken), so the cast lives here rather than being repeated.
- */
-export declare function getConnectCapabilities(request: RpcRequest | undefined): ConnectCapabilities | undefined;
 export declare function isPersonalSignParams(params: readonly unknown[] | undefined): params is readonly [string, string];
 export declare function isSendTransactionParams(params: readonly unknown[] | undefined): params is readonly [SendTransactionParams];
 export declare function isSendCallsParams(params: readonly unknown[] | undefined): params is readonly [SendCallsParams];

package/dist/sdk/types/protocol.js

@@ -1,15 +1,3 @@
-/**
- * Unwraps the connect capabilities from a wallet_connect RPC request (they ride
- * as the first param), or undefined. Several dialog surfaces read them (mode,
- * accessKeyHash, guestToken), so the cast lives here rather than being repeated.
- */
-export function getConnectCapabilities(request) {
-    const first = request?.params?.[0];
-    const found = Object.entries(Object(first)).find(([k]) => k === "capabilities")?.[1];
-    /* SAFETY: the field is read off this app's own wallet_connect params, whose capabilities
-       block is defined by ConnectCapabilities; a missing one answers undefined. */
-    return found;
-}
 export function isPersonalSignParams(params) {
     if (!params || params.length < 2)
         return false;

package/dist/sdk/types/sdk.d.ts

@@ -90,8 +90,8 @@ export type CreateFlowOptions = {
      */
     initialState?: FlowSessionState | null;
     /**
-     * Extra audiences every dialog mint (login, guest) requests refresh tokens
-     * for, on top of the app's own (AUTH-39). Only audiences the auth server
+     * Extra audiences to receive sessions after the app session is installed.
+     * Only audiences the auth server
      * explicitly allowlists for this origin succeed — anything else fails the
      * mint. The minted sessions are delivered once via `onAdditionalSessions`
      * and never stored; the app forwards each to its own origin (e.g. the
@@ -229,7 +229,7 @@ export type ProfileButtonHandle = {
 export type OpenProfileOptions = {
     /**
      * Called once when the overlay closes, including its close button, backdrop,
-     * Escape, closeProfile(), or a sign-in/sign-out handoff. Runs after the
+     * Escape, closeProfile(), or an own-account tab handoff. Runs after the
      * overlay stops accepting input, without waiting for the exit animation.
      * The latest successful open replaces this callback; omitting it clears the
      * previous callback. Rejected opens and repeated closes do not notify.
@@ -314,6 +314,7 @@ export type DialogHost = {
     close: () => void;
     destroy: () => void;
     request: <T = unknown>(method: string, params?: readonly unknown[]) => Promise<T>;
+    /** @deprecated Manual signing-dialog visibility only; authentication redirects. */
     requestSilent: <T = unknown>(method: string, params?: readonly unknown[]) => Promise<T>;
     messenger: import("./messenger").Messenger;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.23.1",
+  "version": "0.23.2",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -66,10 +66,9 @@
   "scripts": {
     "dev": "./dev.sh",
     "build:dialog": "bunx vite build",
-    "build:legacy-dialog": "bunx vite build --config vite.legacy.config.ts",
     "build:playground": "bunx vite build --config vite.playground.config.ts",
     "build:landing": "bunx vite build --config vite.landing.config.ts",
-    "build": "bun run build:legacy-dialog && bunx vite build && bunx vite build --config vite.playground.config.ts && bunx vite build --config vite.landing.config.ts",
+    "build": "bunx vite build && bunx vite build --config vite.playground.config.ts && bunx vite build --config vite.landing.config.ts",
     "build:sdk": "tsc --project tsconfig.sdk.json",
     "prepublishOnly": "bun run build:sdk",
     "start": "bun run src/index.ts",
@@ -85,7 +84,7 @@
     "test:sdk-package": "bash scripts/test-sdk-package.sh",
     "format": "biome format --write",
     "check": "biome check --write",
-    "typecheck": "tsr generate && (cd src/legacy-dialog && bunx tsr generate) && tsc --noEmit && tsc -p tsconfig.legacy.json --noEmit",
+    "typecheck": "tsr generate && tsc --noEmit",
     "contracts:generate": "bun scripts/generate-contracts.ts",
     "contracts:check": "bun scripts/generate-contracts.ts --check && bun scripts/check-contract-compatibility.ts",
     "db:check": "bun scripts/db-check.ts",