@flow-industries/id 0.7.0 → 0.8.0

package/dist/sdk/client/create-flow.js

@@ -164,11 +164,24 @@ export function createFlow(options = {}) {
             return false;
         }
     }
-    // Rotation is cross-tab-safe: the lock serializes refreshes across tabs of the
-    // same origin, and refreshViaToken reads the token fresh from storage inside
-    // the lock, so a second tab uses the already-rotated token (never a stale one
-    // that would trip server-side reuse detection).
-    const refreshJwt = () => withGuestLock(`flow.id.refresh:${host}`, refreshViaToken);
+    // Every refresh-token POST — boot, ensureGuest, and getToken — funnels through
+    // this one lock so two callers can't present the same stored token at once.
+    // Rotation is single-use: a token replayed after it rotated looks like theft,
+    // tripping server-side reuse detection and revoking the whole lineage (which
+    // would then 401 → clear → re-guest). The lock serializes refreshes across
+    // tabs of the same origin, and the guard short-circuits a caller that arrives
+    // after a concurrent holder already minted a fresh JWT, so no one re-presents
+    // an already-rotated token. refreshViaToken re-reads the token fresh from
+    // storage inside the lock, so a genuinely-second refresh uses the rotated one.
+    async function doRefresh() {
+        return withGuestLock(`flow.id.refresh:${host}`, async () => {
+            const current = store.getSnapshot().jwt;
+            if (current && !isExpiring(current))
+                return true;
+            return refreshViaToken();
+        });
+    }
+    const refreshJwt = doRefresh;
     // Dedupe concurrent refreshes: a burst of getToken() calls that all find the
     // cached token expired should trigger one mint, not one per call.
     let refreshInFlight = null;
@@ -220,7 +233,7 @@ export function createFlow(options = {}) {
                 // existing session instead of minting a duplicate guest.
                 if (store.getSnapshot().user)
                     return true;
-                if (await refreshViaToken())
+                if (await doRefresh())
                     return true;
                 try {
                     const result = await getDialog().requestSilent(METHODS.guest, []);
@@ -249,7 +262,7 @@ export function createFlow(options = {}) {
     void (async () => {
         await restoreCredential(store);
         if (options.autoRestore !== false) {
-            const restored = await refreshViaToken();
+            const restored = await doRefresh();
             // ensureGuest re-checks (refresh-first) under a cross-tab lock before
             // minting, so calling it after a failed refresh can't fork a visitor into
             // duplicate guests across tabs — the extra refresh is the dedup.
@@ -294,6 +307,17 @@ export function createFlow(options = {}) {
             accessKeyPrep = await accessKeyModule.prepareAccessKey(accessKeyOptions, chain.id);
             extraCapabilities = { accessKeyHash: accessKeyPrep.accessKeyHash };
         }
+        // When the current session is a guest, forward its access token so a
+        // sign-up upgrades that guest in place even where the guest cookie is
+        // unreadable (the iOS top-level sign-up popup). The server verifies it
+        // before honoring it, so an app that never becomes a guest sends nothing.
+        const snapshot = store.getSnapshot();
+        if (snapshot.user?.isGuest && snapshot.jwt) {
+            extraCapabilities = {
+                ...(extraCapabilities ?? {}),
+                guestToken: snapshot.jwt,
+            };
+        }
         const { session, webauthn, refreshToken } = await runLogin({
             dialog: dialogHost,
             store,

package/dist/sdk/types/protocol.d.ts

@@ -7,6 +7,13 @@ export type ConnectCapabilities = {
     accessKeyHash?: string;
     signInHeadless?: boolean;
     credentialId?: string;
+    /**
+     * The current guest's access JWT, forwarded so a sign-up upgrades that guest
+     * in place even where the guest cookie is unreadable (the iOS top-level
+     * sign-up popup). The server verifies it before letting it stand in for the
+     * cookie session; see the register endpoint.
+     */
+    guestToken?: string;
 };
 export type ConnectRequest = [{
     capabilities?: ConnectCapabilities;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",