@flow-industries/id 0.8.0 → 0.9.0

package/dist/sdk/client/create-flow.js

@@ -2,6 +2,7 @@ import { createDialogHost } from "./dialog-host";
 import { idb } from "./idb";
 import { METHODS } from "./methods";
 import { makeRefreshStore } from "./refresh-store";
+import { createRoomsApi } from "./rooms";
 import { credentialToAddress, restoreCredential, runLogin, runLogout, } from "./session";
 import { createStore, initialFlowState } from "./store";
 const DEFAULT_HOST = "https://id.flow.industries";
@@ -309,14 +310,16 @@ export function createFlow(options = {}) {
         }
         // When the current session is a guest, forward its access token so a
         // sign-up upgrades that guest in place even where the guest cookie is
-        // unreadable (the iOS top-level sign-up popup). The server verifies it
-        // before honoring it, so an app that never becomes a guest sends nothing.
-        const snapshot = store.getSnapshot();
-        if (snapshot.user?.isGuest && snapshot.jwt) {
-            extraCapabilities = {
-                ...(extraCapabilities ?? {}),
-                guestToken: snapshot.jwt,
-            };
+        // unreadable (the iOS top-level sign-up popup). Mint via getToken() rather
+        // than reading store.jwt directly: the cached JWT can be up to an hour stale
+        // on a long-idle tab, and an expired token fails server verification — the
+        // guest would then be registered as a fresh account instead of upgraded.
+        // An app that never becomes a guest forwards nothing.
+        if (store.getSnapshot().user?.isGuest) {
+            const guestToken = await getToken();
+            if (guestToken) {
+                extraCapabilities = { ...(extraCapabilities ?? {}), guestToken };
+            }
         }
         const { session, webauthn, refreshToken } = await runLogin({
             dialog: dialogHost,
@@ -392,6 +395,7 @@ export function createFlow(options = {}) {
         ensureGuest,
         refreshJwt,
         getToken,
+        rooms: createRoomsApi(host, getToken),
         signMessage: async (args) => {
             const mod = await import("./signing");
             return mod.signMessage(buildSigningContext(), args);

package/dist/sdk/client/dialog-host.js

@@ -1,4 +1,3 @@
-import * as Messenger from "../dialog/remote/Messenger";
 import { bridgeToWindow, makeIframe } from "./iframe-host";
 const HIDDEN_STYLE = {
     position: "fixed",

package/dist/sdk/client/index.d.ts

@@ -3,3 +3,4 @@ export { createFlow, getFlow, requireFlow, resetFlow } from "./create-flow";
 export { createDialogHost } from "./dialog-host";
 export { METHODS } from "./methods";
 export { createProfileButton } from "./profile-button";
+export { createRoomsApi, RoomsRequestError } from "./rooms";

package/dist/sdk/client/index.js

@@ -2,3 +2,4 @@ export { createFlow, getFlow, requireFlow, resetFlow } from "./create-flow";
 export { createDialogHost } from "./dialog-host";
 export { METHODS } from "./methods";
 export { createProfileButton } from "./profile-button";
+export { createRoomsApi, RoomsRequestError } from "./rooms";

package/dist/sdk/client/profile-button.js

@@ -1,4 +1,3 @@
-import * as Messenger from "../dialog/remote/Messenger";
 import { getFlow, requireFlow } from "./create-flow";
 import { bridgeToWindow, makeIframe } from "./iframe-host";
 const DEFAULT_HOST = "https://id.flow.industries";

package/dist/sdk/client/refresh-store.js

@@ -10,6 +10,11 @@ export function makeRefreshStore(host) {
             }
         },
         set(token) {
+            // Never persist a missing token: localStorage.setItem coerces undefined
+            // to the literal "undefined", which later reads back as a bogus bearer
+            // and 401s as refresh_token_invalid. Fail safe by ignoring it instead.
+            if (!token)
+                return;
             try {
                 localStorage.setItem(key, token);
             }

package/dist/sdk/client/rooms.d.ts

@@ -0,0 +1,14 @@
+import type { RoomsApi } from "../types";
+/** Thrown on any non-2xx rooms response; `reason` carries the machine-readable
+ * cause when the API provides one (e.g. "banned", "private"). */
+export declare class RoomsRequestError extends Error {
+    readonly status: number;
+    readonly reason?: string | undefined;
+    constructor(status: number, message: string, reason?: string | undefined);
+}
+/**
+ * Thin typed client for the room registry, bound to a host and the Flow
+ * token supplier. Public reads work signed-out; mutations attach the caller's
+ * bearer and fail fast with a 401-shaped error when no session exists.
+ */
+export declare function createRoomsApi(host: string, getToken: () => Promise<string | null>): RoomsApi;

package/dist/sdk/client/rooms.js

@@ -0,0 +1,86 @@
+/** Thrown on any non-2xx rooms response; `reason` carries the machine-readable
+ * cause when the API provides one (e.g. "banned", "private"). */
+export class RoomsRequestError extends Error {
+    status;
+    reason;
+    constructor(status, message, reason) {
+        super(message);
+        this.status = status;
+        this.reason = reason;
+        this.name = "RoomsRequestError";
+    }
+}
+/**
+ * Thin typed client for the room registry, bound to a host and the Flow
+ * token supplier. Public reads work signed-out; mutations attach the caller's
+ * bearer and fail fast with a 401-shaped error when no session exists.
+ */
+export function createRoomsApi(host, getToken) {
+    async function request(path, options = {}) {
+        const headers = {};
+        const token = await getToken();
+        if (token)
+            headers.Authorization = `Bearer ${token}`;
+        else if (options.authRequired) {
+            throw new RoomsRequestError(401, "Sign in first");
+        }
+        if (options.body !== undefined)
+            headers["Content-Type"] = "application/json";
+        const res = await fetch(`${host}/api/rooms${path}`, {
+            method: options.method ?? "GET",
+            headers,
+            body: options.body !== undefined ? JSON.stringify(options.body) : undefined,
+        });
+        const payload = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            throw new RoomsRequestError(res.status, typeof payload.error === "string"
+                ? payload.error
+                : `Rooms request failed (${res.status})`, typeof payload.reason === "string" ? payload.reason : undefined);
+        }
+        return payload;
+    }
+    const slugPath = (slug) => `/${encodeURIComponent(slug)}`;
+    const act = (slug, action, body) => request(`${slugPath(slug)}/${action}`, {
+        method: "POST",
+        body,
+        authRequired: true,
+    }).then(() => undefined);
+    return {
+        list(options) {
+            const params = new URLSearchParams();
+            if (options?.cursor)
+                params.set("cursor", options.cursor);
+            if (options?.limit)
+                params.set("limit", String(options.limit));
+            const query = params.size ? `?${params}` : "";
+            return request(query);
+        },
+        get: (slug) => request(slugPath(slug)),
+        mine: () => request("/mine", { authRequired: true }),
+        create: (input) => request("", {
+            method: "POST",
+            body: input,
+            authRequired: true,
+        }),
+        update: (slug, patch) => request(`${slugPath(slug)}/update`, {
+            method: "POST",
+            body: patch,
+            authRequired: true,
+        }),
+        remove: (slug) => act(slug, "delete", {}),
+        join: (slug) => act(slug, "join", {}),
+        leave: (slug) => act(slug, "leave", {}),
+        members: (slug) => request(`${slugPath(slug)}/members`, { authRequired: true }),
+        presence: (slug) => request(`${slugPath(slug)}/presence`),
+        settings: (slug, surface) => request(`${slugPath(slug)}/settings/${encodeURIComponent(surface)}`),
+        saveSettings: (slug, surface, settings) => request(`${slugPath(slug)}/settings/${encodeURIComponent(surface)}`, { method: "POST", body: { settings }, authRequired: true }),
+        transfer: (slug, userId) => act(slug, "transfer", { userId }),
+        claim: (slug) => act(slug, "claim", {}),
+        setRole: (slug, userId, role) => act(slug, "role", { userId, role }),
+        kick: (slug, userId) => act(slug, "kick", { userId }),
+        ban: (slug, userId, options) => act(slug, "ban", { userId, ...options }),
+        unban: (slug, userId) => act(slug, "unban", { userId }),
+        mute: (slug, userId, options) => act(slug, "mute", { userId, ...options }),
+        unmute: (slug, userId) => act(slug, "unmute", { userId }),
+    };
+}

package/dist/sdk/react/hooks.d.ts

@@ -1,4 +1,4 @@
-import type { Flow, FlowState } from "../types";
+import type { Flow, FlowState, RoomDetail, RoomPresenceSnapshot, RoomSummary } from "../types";
 /**
  * Returns the Flow instance to use. Resolution order:
  *  1. The instance from a `<FlowIdProvider>` ancestor (if any)
@@ -35,3 +35,28 @@ export declare function useFlowId(): {
     refreshJwt: () => Promise<boolean>;
     getToken: () => Promise<string | null>;
 };
+/**
+ * Fetches the public room list once (call `reload` to refresh). Pagination
+ * stays manual: pass the returned `nextCursor` back through `flow.rooms.list`.
+ */
+export declare function useRooms(): {
+    rooms: RoomSummary[];
+    nextCursor: string | null;
+    loading: boolean;
+    error: Error | null;
+    reload: () => void;
+};
+/**
+ * Fetches one room's detail, and optionally polls its live presence when
+ * `presencePollMs` is set (polling until the presence store grows a push
+ * channel). Re-fetches when the slug changes; call `reload` to refresh.
+ */
+export declare function useRoom(slug: string, options?: {
+    presencePollMs?: number;
+}): {
+    room: RoomDetail | null;
+    presence: RoomPresenceSnapshot | null;
+    loading: boolean;
+    error: Error | null;
+    reload: () => void;
+};

package/dist/sdk/react/hooks.js

@@ -1,6 +1,7 @@
-import { useContext, useSyncExternalStore } from "react";
+import { useCallback, useContext, useEffect, useState, useSyncExternalStore, } from "react";
 import { getFlow as getSingletonFlow } from "../client/create-flow";
 import { FlowContext } from "./provider";
+const asError = (e) => e instanceof Error ? e : new Error(String(e));
 /**
  * Returns the Flow instance to use. Resolution order:
  *  1. The instance from a `<FlowIdProvider>` ancestor (if any)
@@ -53,3 +54,79 @@ export function useFlowId() {
         getToken: flow.getToken,
     };
 }
+/**
+ * Fetches the public room list once (call `reload` to refresh). Pagination
+ * stays manual: pass the returned `nextCursor` back through `flow.rooms.list`.
+ */
+export function useRooms() {
+    const flow = useFlow();
+    const [result, setResult] = useState(null);
+    const [error, setError] = useState(null);
+    const load = useCallback(() => {
+        flow.rooms
+            .list()
+            .then((list) => {
+            setResult(list);
+            setError(null);
+        })
+            .catch((err) => setError(asError(err)));
+    }, [flow]);
+    useEffect(load, [load]);
+    return {
+        rooms: result?.rooms ?? [],
+        nextCursor: result?.nextCursor ?? null,
+        loading: result === null && error === null,
+        error,
+        reload: load,
+    };
+}
+/**
+ * Fetches one room's detail, and optionally polls its live presence when
+ * `presencePollMs` is set (polling until the presence store grows a push
+ * channel). Re-fetches when the slug changes; call `reload` to refresh.
+ */
+export function useRoom(slug, options) {
+    const flow = useFlow();
+    const pollMs = options?.presencePollMs ?? 0;
+    const [room, setRoom] = useState(null);
+    const [presence, setPresence] = useState(null);
+    const [error, setError] = useState(null);
+    const loadRoom = useCallback(() => {
+        flow.rooms
+            .get(slug)
+            .then((detail) => {
+            setRoom(detail);
+            setError(null);
+        })
+            .catch((err) => setError(asError(err)));
+    }, [flow, slug]);
+    const loadPresence = useCallback(() => {
+        flow.rooms
+            .presence(slug)
+            .then(setPresence)
+            .catch(() => { });
+    }, [flow, slug]);
+    useEffect(() => {
+        setRoom(null);
+        setError(null);
+        loadRoom();
+    }, [loadRoom]);
+    useEffect(() => {
+        loadPresence();
+        if (pollMs <= 0)
+            return;
+        const timer = setInterval(loadPresence, pollMs);
+        return () => clearInterval(timer);
+    }, [loadPresence, pollMs]);
+    const reload = useCallback(() => {
+        loadRoom();
+        loadPresence();
+    }, [loadRoom, loadPresence]);
+    return {
+        room,
+        presence,
+        loading: room === null && error === null,
+        error,
+        reload,
+    };
+}

package/dist/sdk/react/index.d.ts

@@ -1,4 +1,4 @@
 export type { FlowIdProviderProps, ProfileButtonProps } from "../types";
-export { useFlow, useFlowId, useFlowState } from "./hooks";
+export { useFlow, useFlowId, useFlowState, useRoom, useRooms } from "./hooks";
 export { ProfileButton } from "./profile-button";
 export { FlowIdProvider } from "./provider";

package/dist/sdk/react/index.js

@@ -1,3 +1,3 @@
-export { useFlow, useFlowId, useFlowState } from "./hooks";
+export { useFlow, useFlowId, useFlowState, useRoom, useRooms } from "./hooks";
 export { ProfileButton } from "./profile-button";
 export { FlowIdProvider } from "./provider";

package/dist/sdk/types/index.d.ts

@@ -3,7 +3,8 @@ export type { BoundaryError, DialogCustomFeatures, DialogCustomLabels, DialogErr
 export type { AuthErrorCode, AuthEventName, AuthEventRecord, AuthMode, AuthOutcome, BeaconBody, FunnelStep, } from "./events";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";
 export type { Call, ConnectCapabilities, ConnectRequest, ConnectResponse, GuestRequest, GuestResponse, MethodName, MethodParams, MethodResult, RestoreResponse, RpcRequest, SendCallsParams, SendCallsRequest, SendCallsResponse, SendTransactionParams, SendTransactionRequest, SendTransactionResponse, SignMessageRequest, SignMessageResponse, SignOutRequest, SignOutResponse, SignTypedDataRequest, SignTypedDataResponse, TransactionArgs, TypedData, TypedDataDomain, TypedDataField, } from "./protocol";
-export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export type { CreateRoomInput, MyRooms, RoomChannel, RoomDetail, RoomList, RoomMemberEntry, RoomMembers, RoomOccupancy, RoomOwner, RoomPresenceEntry, RoomPresenceSnapshot, RoomRestrictionKind, RoomRole, RoomSummary, RoomSurfaceSettings, RoomsApi, RoomVisibility, UpdateRoomInput, VerifyRoomContext, } from "./rooms";
 export type { AccessKeyOptions, AccessKeyPreparation, Address, CreateDialogHostOptions, CreateFlowOptions, DialogHost, DialogOpenOptions, FinalizeAccessKeyParams, Flow, FlowConnectorParameters, FlowIdProviderProps, FlowState, Listener, LoginOptions, MountProfileOptions, PrepareArgsWithAuth, PrepareTransactionRequestPhase, ProfileButtonHandle, ProfileButtonProps, ProfilePosition, ResolveAccountParams, ResolvedAccessKeyOptions, RootCredential, RunLoginParams, RunLoginResult, SendCallsArgs, SendTransactionArgs, Session, SigningContext, SignMessageArgs, SignTypedDataArgs, Store, StoredAccessKey, WagmiConnectCapabilities, WagmiConnectParams, } from "./sdk";
 export type { CoinAsset, IdentifiedTx, TxApprove, TxConvert, TxSend, TxSwap, } from "./tx";
 export type { ActionDayContext, ActionEventKind, ActionSessionState, ActiveActionResponse, LevelProgress, PublicProfile, XpGrantResult, XpRecentGrant, XpSummary, } from "./xp";

package/dist/sdk/types/index.js

@@ -1 +1 @@
-export { isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";
+export { getConnectCapabilities, isPersonalSignParams, isSendCallsParams, isSendTransactionParams, } from "./protocol";

package/dist/sdk/types/protocol.d.ts

@@ -131,6 +131,12 @@ export type SendCallsParams = {
     chainId?: string;
     capabilities?: Record<string, unknown>;
 };
+/**
+ * Unwraps the connect capabilities from a wallet_connect RPC request (they ride
+ * as the first param), or undefined. Several dialog surfaces read them (mode,
+ * accessKeyHash, guestToken), so the cast lives here rather than being repeated.
+ */
+export declare function getConnectCapabilities(request: RpcRequest | undefined): ConnectCapabilities | undefined;
 export declare function isPersonalSignParams(params: readonly unknown[] | undefined): params is readonly [string, string];
 export declare function isSendTransactionParams(params: readonly unknown[] | undefined): params is readonly [SendTransactionParams];
 export declare function isSendCallsParams(params: readonly unknown[] | undefined): params is readonly [SendCallsParams];

package/dist/sdk/types/protocol.js

@@ -1,3 +1,11 @@
+/**
+ * Unwraps the connect capabilities from a wallet_connect RPC request (they ride
+ * as the first param), or undefined. Several dialog surfaces read them (mode,
+ * accessKeyHash, guestToken), so the cast lives here rather than being repeated.
+ */
+export function getConnectCapabilities(request) {
+    return request?.params?.[0]?.capabilities;
+}
 export function isPersonalSignParams(params) {
     if (!params || params.length < 2)
         return false;

package/dist/sdk/types/rooms.d.ts

@@ -0,0 +1,129 @@
+/** Room registry types shared by the server routes and the client SDK. */
+export type RoomVisibility = "public" | "unlisted" | "private";
+/**
+ * Owner is not a member-row role: `room.ownerId` is the single authority.
+ * Member rows carry moderator|member.
+ */
+export type RoomRole = "owner" | "moderator" | "member";
+export type RoomChannel = "game" | "voice" | "text";
+export type RoomRestrictionKind = "ban" | "mute";
+export interface RoomOwner {
+    id: string;
+    username: string;
+}
+/** Live occupant counts per channel, staleness-filtered at read time. */
+export interface RoomOccupancy {
+    game: number;
+    voice: number;
+    text: number;
+}
+export interface RoomSummary {
+    id: string;
+    slug: string;
+    displayName: string;
+    description: string | null;
+    owner: RoomOwner | null;
+    visibility: RoomVisibility;
+    isSystem: boolean;
+    occupancy: RoomOccupancy;
+    createdAt: string;
+}
+export interface RoomDetail extends RoomSummary {
+    /** The caller's role in this room, when the request carried a valid bearer. */
+    viewerRole: RoomRole | null;
+    memberCount: number;
+}
+export interface RoomMemberEntry {
+    userId: string;
+    username: string;
+    role: RoomRole;
+    joinedAt: string;
+}
+export interface RoomMembers {
+    owner: RoomOwner | null;
+    members: RoomMemberEntry[];
+}
+export interface CreateRoomInput {
+    slug: string;
+    displayName?: string;
+    description?: string;
+    visibility?: RoomVisibility;
+}
+export interface UpdateRoomInput {
+    slug?: string;
+    displayName?: string;
+    description?: string;
+    visibility?: RoomVisibility;
+}
+export interface MyRooms {
+    owned: RoomSummary[];
+    member: RoomSummary[];
+}
+export interface RoomList {
+    rooms: RoomSummary[];
+    nextCursor: string | null;
+}
+export interface RoomPresenceEntry {
+    userId: string;
+    username: string;
+    joinedAt: string;
+}
+export interface RoomPresenceSnapshot {
+    roomId: string;
+    slug: string;
+    channels: Record<RoomChannel, RoomPresenceEntry[]>;
+}
+/**
+ * Room admission context returned by POST /api/session/verify when the caller
+ * passes a `room` slug: whether the verified subject may enter, and with which
+ * role and per-room game settings. `settings` is delivered only through this
+ * server-to-server path — surface blobs may hold secret-ish values.
+ */
+export interface VerifyRoomContext {
+    ok: boolean;
+    reason?: "not_found" | "banned" | "private_not_member";
+    id: string | null;
+    slug: string;
+    visibility: RoomVisibility | null;
+    role: RoomRole | null;
+    muted: boolean;
+    settings: Record<string, number | boolean | string>;
+}
+export interface RoomSurfaceSettings {
+    surface: string;
+    version: number;
+    settings: Record<string, number | boolean | string>;
+}
+/** The room-registry client exposed as `flow.rooms`. Public reads work
+ * signed-out; everything else attaches the caller's bearer token. */
+export interface RoomsApi {
+    list(options?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<RoomList>;
+    get(slug: string): Promise<RoomDetail>;
+    mine(): Promise<MyRooms>;
+    create(input: CreateRoomInput): Promise<RoomDetail>;
+    update(slug: string, patch: UpdateRoomInput): Promise<RoomDetail>;
+    remove(slug: string): Promise<void>;
+    join(slug: string): Promise<void>;
+    leave(slug: string): Promise<void>;
+    members(slug: string): Promise<RoomMembers>;
+    presence(slug: string): Promise<RoomPresenceSnapshot>;
+    settings(slug: string, surface: string): Promise<RoomSurfaceSettings>;
+    saveSettings(slug: string, surface: string, settings: Record<string, unknown>): Promise<RoomSurfaceSettings>;
+    transfer(slug: string, userId: string): Promise<void>;
+    claim(slug: string): Promise<void>;
+    setRole(slug: string, userId: string, role: "moderator" | "member"): Promise<void>;
+    kick(slug: string, userId: string): Promise<void>;
+    ban(slug: string, userId: string, options?: {
+        reason?: string;
+        expiresInSeconds?: number;
+    }): Promise<void>;
+    unban(slug: string, userId: string): Promise<void>;
+    mute(slug: string, userId: string, options?: {
+        reason?: string;
+        expiresInSeconds?: number;
+    }): Promise<void>;
+    unmute(slug: string, userId: string): Promise<void>;
+}

package/dist/sdk/types/rooms.js

@@ -0,0 +1 @@
+/** Room registry types shared by the server routes and the client SDK. */

package/dist/sdk/types/sdk.d.ts

@@ -3,6 +3,7 @@ import type { Chain, Hex, PrepareTransactionRequestParameters, SendTransactionPa
 import type { SendCallsParameters } from "viem/actions";
 import type { FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { ConnectCapabilities, ConnectResponse } from "./protocol";
+import type { RoomsApi } from "./rooms";
 export type Address = `0x${string}`;
 /**
  * Phases viem invokes a chain's `prepareTransactionRequest` hook at. Inlined
@@ -205,6 +206,8 @@ export type Flow = {
     walletClient(args?: {
         chainId?: number;
     }): Promise<WalletClient>;
+    /** Typed client for the room registry (browse, membership, settings, moderation). */
+    rooms: RoomsApi;
     subscribe(listener: Listener<FlowState>): () => void;
     getState(): FlowState;
     dialog: DialogHost;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "main": "./dist/sdk/client/index.js",
   "module": "./dist/sdk/client/index.js",
   "types": "./dist/sdk/client/index.d.ts",