@flow-industries/id 0.3.1 → 0.6.0

package/dist/sdk/dialog/remote/Messenger.d.ts

@@ -1,6 +1,5 @@
 import type { Bridge, BridgeParameters, FromWindowOptions, Messenger } from "../../types";
-export type { Bridge, BridgeParameters, FromWindowOptions, Messenger, Payload, QueuedRequest, ReadyOptions, Schema, Topic, WithReady, } from "../../types";
-export type { MessageResponse as Response } from "../../types";
+export type { Bridge, BridgeParameters, FromWindowOptions, MessageResponse as Response, Messenger, Payload, QueuedRequest, ReadyOptions, Schema, Topic, WithReady, } from "../../types";
 export declare function from(messenger: Messenger): Messenger;
 /**
  * Wraps a Window in the Messenger interface. Reads come from

package/dist/sdk/dialog/remote/Messenger.js

@@ -38,7 +38,7 @@ export function from(messenger) {
  * isolation that prevents arbitrary pages from injecting messages.
  */
 export function fromWindow(w, options = {}) {
-    const { targetOrigin } = options;
+    const { targetOrigin, source } = options;
     const listeners = new Map();
     return from({
         destroy() {
@@ -54,6 +54,8 @@ export function fromWindow(w, options = {}) {
                     return;
                 if (targetOrigin && event.origin !== targetOrigin)
                     return;
+                if (source && event.source !== source)
+                    return;
                 listener(event.data.payload, event);
             }
             w.addEventListener("message", handler);

package/dist/sdk/react/hooks.d.ts

@@ -18,16 +18,20 @@ export declare function useFlowState(): FlowState;
 /**
  * Convenience hook that returns the most commonly needed identity data and
  * actions in one go: user/jwt/address plus `login`, `logout`, `restore`,
- * and `refreshJwt`. The `isAuthenticated` boolean is derived from `user`
- * being set so it tracks reactive state.
+ * `refreshJwt`, and `getToken`. The `isAuthenticated` boolean is derived from
+ * `user` being set so it tracks reactive state; `isGuest` is true while the
+ * user is a guest — gate sensitive actions on `!isGuest`, not `isAuthenticated`.
  */
 export declare function useFlowId(): {
     user: import("../types").FlowUser | null;
     jwt: string | null;
     address: `0x${string}` | null;
     isAuthenticated: boolean;
+    isGuest: boolean;
     login: (options?: import("../types").LoginOptions) => Promise<import("../types").Session>;
     logout: () => Promise<void>;
     restore: () => Promise<boolean>;
+    ensureGuest: () => Promise<boolean>;
     refreshJwt: () => Promise<boolean>;
+    getToken: () => Promise<string | null>;
 };

package/dist/sdk/react/hooks.js

@@ -32,8 +32,9 @@ export function useFlowState() {
 /**
  * Convenience hook that returns the most commonly needed identity data and
  * actions in one go: user/jwt/address plus `login`, `logout`, `restore`,
- * and `refreshJwt`. The `isAuthenticated` boolean is derived from `user`
- * being set so it tracks reactive state.
+ * `refreshJwt`, and `getToken`. The `isAuthenticated` boolean is derived from
+ * `user` being set so it tracks reactive state; `isGuest` is true while the
+ * user is a guest — gate sensitive actions on `!isGuest`, not `isAuthenticated`.
  */
 export function useFlowId() {
     const flow = useFlow();
@@ -43,9 +44,12 @@ export function useFlowId() {
         jwt: state.jwt,
         address: state.address,
         isAuthenticated: state.user !== null,
+        isGuest: state.user?.isGuest ?? false,
         login: flow.login,
         logout: flow.logout,
         restore: flow.restore,
+        ensureGuest: flow.ensureGuest,
         refreshJwt: flow.refreshJwt,
+        getToken: flow.getToken,
     };
 }

package/dist/sdk/react/index.d.ts

@@ -1,3 +1,4 @@
-export { FlowIdProvider } from "./provider";
+export type { FlowIdProviderProps, ProfileButtonProps } from "../types";
 export { useFlow, useFlowId, useFlowState } from "./hooks";
-export type { FlowIdProviderProps } from "../types";
+export { ProfileButton } from "./profile-button";
+export { FlowIdProvider } from "./provider";

package/dist/sdk/react/index.js

@@ -1,2 +1,3 @@
-export { FlowIdProvider } from "./provider";
 export { useFlow, useFlowId, useFlowState } from "./hooks";
+export { ProfileButton } from "./profile-button";
+export { FlowIdProvider } from "./provider";

package/dist/sdk/react/profile-button.d.ts

@@ -0,0 +1,9 @@
+import type { ProfileButtonProps } from "../types";
+/**
+ * Drops the universal Flow ID profile button into a React tree. Renders a host
+ * element (style it via `className` for placement/padding — e.g. top-right) that
+ * the pill iframe mounts into; the iframe itself is sized to its content and
+ * expands to the profile dialog on click. Resolves the Flow instance from a
+ * `<FlowIdProvider>` or the createFlow() singleton.
+ */
+export declare function ProfileButton({ className, host, theme }: ProfileButtonProps): import("react/jsx-runtime").JSX.Element;

package/dist/sdk/react/profile-button.js

@@ -0,0 +1,28 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useRef } from "react";
+import { createProfileButton } from "../client/profile-button";
+import { useFlow } from "./hooks";
+/**
+ * Drops the universal Flow ID profile button into a React tree. Renders a host
+ * element (style it via `className` for placement/padding — e.g. top-right) that
+ * the pill iframe mounts into; the iframe itself is sized to its content and
+ * expands to the profile dialog on click. Resolves the Flow instance from a
+ * `<FlowIdProvider>` or the createFlow() singleton.
+ */
+export function ProfileButton({ className, host, theme }) {
+    const flow = useFlow();
+    const ref = useRef(null);
+    useEffect(() => {
+        const container = ref.current;
+        if (!container)
+            return;
+        const handle = createProfileButton({
+            container,
+            flow,
+            ...(host ? { host } : {}),
+            ...(theme ? { theme } : {}),
+        });
+        return () => handle.destroy();
+    }, [flow, host, theme]);
+    return _jsx("div", { ref: ref, className: className });
+}

package/dist/sdk/react/provider.js

@@ -11,5 +11,5 @@ export const FlowContext = createContext(null);
  * the dependency explicit at a particular boundary.
  */
 export function FlowIdProvider({ flow, children }) {
-    return _jsx(FlowContext.Provider, { value: flow ?? null, children: children });
+    return (_jsx(FlowContext.Provider, { value: flow ?? null, children: children }));
 }

package/dist/sdk/types/auth.d.ts

@@ -2,6 +2,13 @@ import type { JWTPayload } from "jose";
 export type FlowUser = {
     id: string;
     username: string;
+    /**
+     * True only for guest accounts (no passkey/email yet). Optional so the many
+     * `{ id, username }` producers stay valid; readers treat `undefined`/`false`
+     * as "not a guest". Sensitive actions should gate on `!isGuest` (or the JWT
+     * `guest` claim), never on session presence alone.
+     */
+    isGuest?: boolean;
 };
 export type FlowCredential = {
     id: string;
@@ -42,4 +49,10 @@ export type VerifyOptions = {
 export type VerifiedFlowJWT = JWTPayload & {
     sub: string;
     username?: string;
+    /**
+     * Present and `true` only on guest tokens. A relying party gating sensitive
+     * actions MUST treat a MISSING claim as `guest === true` (fail-safe), so a
+     * future token-format change can never silently grant full privileges.
+     */
+    guest?: boolean;
 };

package/dist/sdk/types/dialog.d.ts

@@ -37,6 +37,27 @@ export type DialogCustomLabels = {
     switchAccount?: string;
     signUpLink?: string;
 };
+/**
+ * The profile fields the widget renders, read from `/api/me` (the cookie
+ * session's `session.user`). `image`/`createdAt` are not on the SDK's
+ * `FlowUser`, so they only come from this authenticated fetch.
+ */
+export type ProfileData = {
+    username: string;
+    image?: string | null;
+    createdAt?: string;
+    isGuest?: boolean;
+};
+/**
+ * Identity the embedding host pushes into the widget over postMessage. Lets the
+ * pill render the username immediately (and reactively on login/logout) without
+ * waiting on `/api/me` — the fast path that also works where third-party cookies
+ * are blocked (Safari/Firefox).
+ */
+export type ProfileIdentity = {
+    username: string;
+    isGuest: boolean;
+};
 export type DialogState = {
     mode: string;
     display: "floating" | "drawer" | "full";
@@ -50,6 +71,7 @@ export type DialogState = {
         username?: string;
         email?: string;
     }>;
+    shown: boolean;
     customFeatures?: DialogCustomFeatures;
     customLabels?: DialogCustomLabels;
 };

package/dist/sdk/types/events.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Structured auth-observability events. Emitted server-side to the dedicated
+ * OpenObserve `auth_events` stream (and mirrored to stdout). The field names
+ * here are the contract every dashboard/alert query depends on — changing one
+ * is a breaking change to the dashboard.
+ */
+export type AuthOutcome = "success" | "failure" | "info";
+export type AuthMode = "sign-up" | "sign-in";
+/** Client-only funnel steps reported via the `/api/events` beacon. */
+export type FunnelStep = "mode_selected" | "email_entered" | "ceremony_started" | "done_shown";
+export type AuthEventName = "auth.username.checked" | "auth.signup.succeeded" | "auth.signup.failed" | "auth.otp.sent" | "auth.otp.verified" | "auth.otp.failed" | "auth.email.verify.sent" | "auth.email.verify.succeeded" | "auth.email.verify.failed" | "auth.email.changed" | "auth.avatar.upload.succeeded" | "auth.avatar.upload.failed" | "auth.challenge.issued" | "auth.signin.succeeded" | "auth.signin.failed" | "auth.restore.succeeded" | "auth.restore.failed" | "auth.restore.no_session" | "auth.jwt.verified" | "auth.jwt.rejected" | "auth.signout" | "auth.audience.rejected" | "auth.guest.created" | "auth.guest.restored" | "auth.guest.upgraded" | "auth.guest.failed" | "auth.funnel.mode_selected" | "auth.funnel.email_entered" | "auth.funnel.ceremony_started" | "auth.funnel.done_shown";
+export type AuthErrorCode = "username_taken" | "credential_taken" | "email_taken" | "email_not_verified" | "no_email" | "image_upload_forbidden" | "image_upload_rate_limited" | "invalid_image_type" | "image_too_large" | "image_upload_failed" | "otp_invalid" | "otp_expired" | "otp_attempts_exceeded" | "otp_resend_cooldown" | "otp_resend_limit" | "otp_global_limit" | "otp_send_failed" | "challenge_expired" | "unknown_credential" | "invalid_assertion_type" | "invalid_assertion_origin" | "user_verification_required" | "invalid_signature" | "user_not_found" | "missing_audience" | "audience_not_allowed" | "audience_mismatch" | "no_session" | "no_passkey" | "guest_rate_limited" | "guest_global_limit" | "guest_username_exhausted" | "already_upgraded" | "malformed_token" | "unknown_key" | "verification_failed" | "internal_error";
+/** One flat record per event = one row in the `auth_events` stream. */
+export interface AuthEventRecord {
+    service: "auth";
+    env: string;
+    event: AuthEventName;
+    outcome: AuthOutcome;
+    app: string | null;
+    audience: string | null;
+    userId: string | null;
+    username: string | null;
+    address: string | null;
+    credentialId: string | null;
+    funnelId: string | null;
+    mode: AuthMode | null;
+    step: FunnelStep | null;
+    errorCode: AuthErrorCode | null;
+    ip: string | null;
+    country: string | null;
+    userAgent: string | null;
+    durationMs: number | null;
+    traceId: string | null;
+}
+/** Body accepted by `POST /api/events` from the dialog. */
+export interface BeaconBody {
+    step: FunnelStep;
+    funnelId: string;
+    mode?: AuthMode | null;
+}

package/dist/sdk/types/events.js

@@ -0,0 +1,6 @@
+/**
+ * Structured auth-observability events. Emitted server-side to the dedicated
+ * OpenObserve `auth_events` stream (and mirrored to stdout). The field names
+ * here are the contract every dashboard/alert query depends on — changing one
+ * is a breaking change to the dashboard.
+ */

package/dist/sdk/types/index.d.ts

@@ -1,7 +1,8 @@
 export type { AuthConfig, AuthResponse, AuthResponseWithWebAuthn, FlowCredential, FlowUser, PasskeyPluginOptions, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
-export type { AccessKeyOptions, AccessKeyPreparation, Address, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowIdProviderProps, FlowConnectorParameters, FlowState, Listener, LoginOptions, PrepareArgsWithAuth, PrepareTransactionRequestPhase, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, RunLoginParams, RunLoginResult, SendCallsArgs, SendTransactionArgs, Session, SignMessageArgs, SignTypedDataArgs, SigningContext, StoredAccessKey, Store, WagmiConnectCapabilities, WagmiConnectParams, } from "./sdk";
-export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
-export type { Call, ConnectCapabilities, ConnectRequest, ConnectResponse, MethodName, MethodParams, MethodResult, RestoreRequest, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignOutRequest, SignOutResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
+export type { BoundaryError, DialogCustomFeatures, DialogCustomLabels, DialogError, DialogReferrer, DialogState, ProfileData, ProfileIdentity, } from "./dialog";
+export type { AuthErrorCode, AuthEventName, AuthEventRecord, AuthMode, AuthOutcome, BeaconBody, FunnelStep, } from "./events";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";
-export type { BoundaryError, DialogCustomFeatures, DialogCustomLabels, DialogError, DialogReferrer, DialogState, } from "./dialog";
+export type { Call, ConnectCapabilities, ConnectRequest, ConnectResponse, GuestRequest, GuestResponse, MethodName, MethodParams, MethodResult, RestoreRequest, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignOutRequest, SignOutResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
+export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export type { AccessKeyOptions, AccessKeyPreparation, Address, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowConnectorParameters, FlowIdProviderProps, FlowState, Listener, LoginOptions, MountProfileOptions, PrepareArgsWithAuth, PrepareTransactionRequestPhase, ProfileButtonHandle, ProfileButtonProps, ProfilePosition, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, RunLoginParams, RunLoginResult, SendCallsArgs, SendTransactionArgs, Session, SigningContext, SignMessageArgs, SignTypedDataArgs, Store, StoredAccessKey, WagmiConnectCapabilities, WagmiConnectParams, } from "./sdk";
 export type { CoinAsset, IdentifiedTx, TxApprove, TxConvert, TxSend, TxSwap, } from "./tx";

package/dist/sdk/types/messenger.d.ts

@@ -65,6 +65,7 @@ export type Schema = [
             };
             features?: Record<string, boolean>;
             labels?: Record<string, string>;
+            route?: string;
         } | {
             type: "switch";
             mode: "iframe" | "popup" | "popup-standalone" | "page";
@@ -77,6 +78,27 @@ export type Schema = [
             theme: {
                 colorScheme?: string;
             };
+        } | {
+            type: "profile-resize";
+            width: number;
+            height: number;
+        } | {
+            type: "profile-expand";
+        } | {
+            type: "profile-identity";
+            identity: {
+                username: string;
+                isGuest: boolean;
+            } | null;
+        } | {
+            type: "profile-login";
+            mode: "signin" | "signup";
+        } | {
+            type: "profile-logout";
+        } | {
+            type: "dialog-shown";
+        } | {
+            type: "dialog-hidden";
         };
         response: undefined;
     }
@@ -106,6 +128,14 @@ export type Bridge = WithReady & {
 };
 export type FromWindowOptions = {
     targetOrigin?: string;
+    /**
+     * When set, inbound messages are only accepted from this exact window
+     * (`event.source`). Required when more than one same-origin iframe posts to
+     * the same host window (e.g. the auth dialog and the profile widget) —
+     * origin filtering alone can't tell same-origin frames apart, so without this
+     * one frame's `ready` handshake would resolve the other bridge's gate.
+     */
+    source?: MessageEventSource | null;
 };
 export type BridgeParameters = {
     from: Messenger;

package/dist/sdk/types/protocol.d.ts

@@ -1,6 +1,6 @@
 import type { FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { Address } from "./sdk";
-export type MethodName = "wallet_connect" | "personal_sign" | "eth_signTypedData" | "eth_sendTransaction" | "wallet_sendCalls" | "wallet_restore" | "wallet_signout";
+export type MethodName = "wallet_connect" | "personal_sign" | "eth_signTypedData" | "eth_sendTransaction" | "wallet_sendCalls" | "wallet_restore" | "wallet_guest" | "wallet_signout";
 export type ConnectCapabilities = {
     createAccount?: boolean;
     signIn?: boolean;
@@ -65,6 +65,18 @@ export type RestoreResponse = {
     credential: FlowCredential;
     address: Address;
 };
+export type GuestRequest = [];
+/**
+ * A guest has no passkey and no derivable wallet address yet, so `credential`
+ * and `address` are always null — the shape mirrors RestoreResponse so the SDK
+ * can commit either to the same store fields.
+ */
+export type GuestResponse = {
+    jwt: string;
+    user: FlowUser;
+    credential: null;
+    address: null;
+};
 export type SignOutRequest = [];
 export type SignOutResponse = {
     ok: true;
@@ -76,6 +88,7 @@ export type MethodParams = {
     eth_sendTransaction: SendTransactionRequest;
     wallet_sendCalls: SendCallsRequest;
     wallet_restore: RestoreRequest;
+    wallet_guest: GuestRequest;
     wallet_signout: SignOutRequest;
 };
 export type MethodResult = {
@@ -85,6 +98,7 @@ export type MethodResult = {
     eth_sendTransaction: SendTransactionResponse;
     wallet_sendCalls: SendCallsResponse;
     wallet_restore: RestoreResponse;
+    wallet_guest: GuestResponse;
     wallet_signout: SignOutResponse;
 };
 export type RpcRequest = {

package/dist/sdk/types/sdk.d.ts

@@ -1,6 +1,6 @@
+import type { ReactNode } from "react";
 import type { Chain, Hex, PrepareTransactionRequestParameters, SendTransactionParameters, SignTypedDataParameters, Transport, WalletClient } from "viem";
 import type { SendCallsParameters } from "viem/actions";
-import type { ReactNode } from "react";
 import type { FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { ConnectCapabilities, ConnectResponse } from "./protocol";
 export type Address = `0x${string}`;
@@ -63,6 +63,13 @@ export type CreateFlowOptions = {
      * if the user has a valid Flow cookie session, state populates without UI.
      */
     autoRestore?: boolean;
+    /**
+     * If true, every visitor without an existing session is silently given a
+     * persistent guest account on startup (no UI, no passkey). Off by default —
+     * the consumer app opts in. Signing up later upgrades the guest in place, so
+     * data keyed on the Flow user id survives. See `ensureGuest`.
+     */
+    autoGuest?: boolean;
 };
 export type FlowState = {
     user: FlowUser | null;
@@ -122,6 +129,36 @@ export type DialogOpenOptions = {
         icon?: string;
     };
 };
+/** Anchor for an auto-created (host-less) profile widget container. */
+export type ProfilePosition = "top-right" | "top-left" | "bottom-right" | "bottom-left";
+export type MountProfileOptions = {
+    /**
+     * Element to mount the pill iframe into. When omitted, a fixed-position
+     * container is created and anchored via `position` — the path of least
+     * resistance for non-DOM hosts (the Godot canvas overlay).
+     */
+    container?: HTMLElement;
+    /** Anchor used only when `container` is omitted. Defaults to "top-right". */
+    position?: ProfilePosition;
+    /** CSS padding for the auto-created container. Defaults to a responsive inset. */
+    padding?: string;
+    /**
+     * The Flow ID origin serving the widget (e.g. https://id.flow.industries).
+     * Defaults to the resolved Flow instance's `host`, then the SDK default.
+     */
+    host?: string;
+    /**
+     * Color scheme for the widget chrome. Set this to match the host (the dark
+     * game UI passes "dark"). Defaults to "light dark" (follows the OS).
+     */
+    theme?: "light" | "dark" | "light dark";
+    /** Explicit Flow instance. Defaults to the createFlow() singleton. */
+    flow?: Flow;
+};
+export type ProfileButtonHandle = {
+    /** Tears down the iframe, listeners, and any auto-created container. */
+    destroy: () => void;
+};
 export type DialogHost = {
     open: (options?: DialogOpenOptions) => void;
     close: () => void;
@@ -136,10 +173,29 @@ export type Flow = {
     readonly credential: FlowState["credential"];
     readonly address: Address | null;
     readonly isAuthenticated: boolean;
+    /**
+     * True when the current session is a guest (authenticated but not yet a full
+     * account). `isAuthenticated` is also true for guests — gate sensitive
+     * actions on `!isGuest`, not on `isAuthenticated`.
+     */
+    readonly isGuest: boolean;
     login(options?: LoginOptions): Promise<Session>;
     logout(): Promise<void>;
     restore(): Promise<boolean>;
+    /**
+     * Ensures a session exists: restores an existing one, otherwise silently
+     * creates a persistent guest account. Idempotent and single-flight; resolves
+     * true if a session (guest or full) is now active, false if creation failed.
+     * Called automatically on startup when `autoGuest` is set.
+     */
+    ensureGuest(): Promise<boolean>;
     refreshJwt(): Promise<boolean>;
+    /**
+     * Returns a currently-valid JWT, silently refreshing from the cookie session
+     * if the cached token is expired or near expiry; null if there is no session.
+     * Prefer this over reading `jwt` directly when calling a backend.
+     */
+    getToken(): Promise<string | null>;
     signMessage(args: SignMessageArgs): Promise<Hex>;
     signTypedData(args: SignTypedDataArgs): Promise<Hex>;
     sendTransaction(args: SendTransactionArgs): Promise<Hex>;
@@ -152,6 +208,13 @@ export type Flow = {
     subscribe(listener: Listener<FlowState>): () => void;
     getState(): FlowState;
     dialog: DialogHost;
+    /**
+     * The resolved Flow ID origin this instance talks to (no trailing slash),
+     * e.g. `https://id.flow.industries`. Exposed so widgets like the profile
+     * button build their iframe URL from the single host configured on createFlow
+     * instead of re-resolving it.
+     */
+    readonly host: string;
 };
 export type FlowConnectorParameters = Omit<CreateFlowOptions, "chains" | "transports"> & {
     /**
@@ -176,6 +239,14 @@ export type FlowIdProviderProps = {
     flow?: Flow;
     children: ReactNode;
 };
+export type ProfileButtonProps = {
+    /** Class applied to the host element the pill iframe mounts into. */
+    className?: string;
+    /** Override the Flow ID origin; defaults to the resolved Flow's `host`. */
+    host?: string;
+    /** Color scheme for the widget chrome; defaults to "light dark" (the OS). */
+    theme?: "light" | "dark" | "light dark";
+};
 export type RunLoginParams = {
     dialog: DialogHost;
     store: Store<FlowState>;

package/dist/sdk/verify.d.ts

@@ -11,5 +11,12 @@ export type { VerifiedFlowJWT, VerifyOptions } from "./types";
  *
  * `audience` MUST match the calling app's origin — this is what prevents
  * a token issued for `flow.talk` from being replayed against `flow.game`.
+ *
+ * Every Flow token carries an explicit boolean `guest` claim (`true` for guest
+ * sessions with no passkey yet, `false` for full accounts). When gating
+ * sensitive actions, require `payload.guest === false`; treat anything else —
+ * `true`, or a MISSING claim (not a Flow token, or a future format change) — as
+ * guest and deny. This fail-safe means a dropped or renamed claim can never
+ * silently grant a guest full privileges.
  */
 export declare function verifyFlowJWT(token: string, opts: VerifyOptions): Promise<VerifiedFlowJWT>;

package/dist/sdk/verify.js

@@ -12,6 +12,13 @@ const DEFAULT_ISSUER_URL = "https://id.flow.industries";
  *
  * `audience` MUST match the calling app's origin — this is what prevents
  * a token issued for `flow.talk` from being replayed against `flow.game`.
+ *
+ * Every Flow token carries an explicit boolean `guest` claim (`true` for guest
+ * sessions with no passkey yet, `false` for full accounts). When gating
+ * sensitive actions, require `payload.guest === false`; treat anything else —
+ * `true`, or a MISSING claim (not a Flow token, or a future format change) — as
+ * guest and deny. This fail-safe means a dropped or renamed claim can never
+ * silently grant a guest full privileges.
  */
 export async function verifyFlowJWT(token, opts) {
     const issuerUrl = opts.issuerUrl ?? DEFAULT_ISSUER_URL;

package/dist/sdk/wagmi/index.js

@@ -8,7 +8,8 @@ function loginOptionsFromCapabilities(capabilities) {
     return {
         ...(signUp ? { signUp: true } : {}),
         ...(!signUp && signIn ? { signIn: true } : {}),
-        ...(!signUp && (capabilities?.signInHeadless || capabilities?.type === "sign-in")
+        ...(!signUp &&
+            (capabilities?.signInHeadless || capabilities?.type === "sign-in")
             ? { signInHeadless: true }
             : {}),
     };
@@ -137,8 +138,12 @@ export function flowConnector(parameters = {}) {
                 return f.walletClient({ ...(chainId ? { chainId } : {}) });
             },
             async getProvider({ chainId } = {}) {
-                const client = await this.getClient({ ...(chainId ? { chainId } : {}) });
-                return { request: client.request };
+                const client = await this.getClient({
+                    ...(chainId ? { chainId } : {}),
+                });
+                return {
+                    request: client.request,
+                };
             },
             onAccountsChanged() { },
             onChainChanged(chain) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.3.1",
+  "version": "0.6.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",
@@ -46,10 +46,16 @@
     "build:sdk": "tsc --project tsconfig.sdk.json",
     "prepublishOnly": "bun run build:sdk",
     "start": "bun run src/index.ts",
+    "email:dev": "email dev --dir src/emails --port 3010",
     "db:generate": "bunx @better-auth/cli generate",
-    "db:migrate": "bunx drizzle-kit generate && bunx drizzle-kit migrate",
+    "db:migrate:gen": "bunx drizzle-kit generate",
+    "db:migrate": "bunx drizzle-kit migrate",
     "db:push": "bunx drizzle-kit push",
-    "db:studio": "bunx drizzle-kit studio"
+    "db:studio": "bunx drizzle-kit studio",
+    "lint": "biome check",
+    "format": "biome format --write",
+    "check": "biome check --write",
+    "typecheck": "tsr generate && tsc --noEmit"
   },
   "peerDependencies": {
     "viem": ">=2.47.10",
@@ -67,21 +73,39 @@
   },
   "devDependencies": {
     "@better-auth/cli": "^1.4.17",
+    "@biomejs/biome": "2.4.12",
+    "@flow-industries/lint": "0.1.0",
+    "@react-email/ui": "^6.6.0",
     "@tailwindcss/vite": "^4.1.18",
     "@tanstack/react-router-devtools": "^1.160.0",
+    "@tanstack/router-cli": "^1.167.17",
     "@tanstack/router-plugin": "^1.160.0",
     "@types/bun": "latest",
     "@types/react": "^19.2.13",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.1.3",
     "drizzle-kit": "^0.31.8",
+    "pino-pretty": "^13.1.3",
+    "react-email": "^6.6.0",
     "tailwindcss": "^4.1.18",
     "tw-animate-css": "^1.4.0",
     "typescript": "^5",
     "vite": "^7.3.1"
   },
   "dependencies": {
-    "@flow-industries/ui": "^0.15.2",
+    "@aws-sdk/client-s3": "^3.1073.0",
+    "@flow-industries/ui": "^0.15.3",
+    "@hono/otel": "^1.1.2",
+    "@openobserve/browser-logs": "^0.3.1",
+    "@openobserve/browser-rum": "^0.3.1",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
+    "@opentelemetry/resources": "^2.7.1",
+    "@opentelemetry/sdk-trace-base": "^2.7.1",
+    "@opentelemetry/sdk-trace-node": "^2.7.1",
+    "@opentelemetry/semantic-conventions": "^1.41.1",
+    "@react-email/components": "^1.0.12",
+    "@react-email/render": "^2.0.8",
     "@tanstack/query-sync-storage-persister": "^5.90.22",
     "@tanstack/react-query": "^5.90.20",
     "@tanstack/react-query-persist-client": "^5.90.22",
@@ -93,10 +117,12 @@
     "jose": "^6.1.3",
     "lucide-react": "^0.563.0",
     "motion": "^12.33.0",
+    "pino": "^10.3.1",
     "postgres": "^3.4.8",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "react-intersection-observer": "^10.0.2",
+    "sharp": "^0.35.2",
     "tempo.ts": "^0.14.2",
     "viem": "2.47.10",
     "wagmi": "^3.4.2",