@fork-api/chat-sdk 0.1.172 → 0.1.174

package/dist/index.d.cts

@@ -15,6 +15,11 @@ interface Fork {
     summary?: string;
     /** Rough estimate in minutes for how long the agent will take. Set after the Haiku title call resolves. */
     estimateMinutes?: number;
+    /** True when this user authored the fork and hasn't seen its one-shot
+     *  reveal animation yet (server-tracked via forks.reveal_seen_at, once
+     *  ever across tabs/devices). Set client-side on live SSE completion;
+     *  DirectForkSlot plays the reveal and records it via POST /forks/reveals. */
+    revealPending?: boolean;
     createdAt: string;
     completedAt?: string;
     error?: string;
@@ -58,24 +63,32 @@ interface ForkProviderBase {
     shared?: ForkSharedRegistry;
 }
 /**
- * User identity — provide EITHER userId OR authUrl:
+ * User identity — provide EITHER userId (optionally with userHash) OR authUrl:
  *
- * - `userId`: Client-asserted, no server verification (dev/testing only).
+ * - `userId` alone: Client-asserted, no server verification (dev/testing only).
+ * - `userId` + `userHash`: Host-brokered verified identity. Your backend
+ *   computes userHash = HMAC-SHA256(sk_fork_key, userId) and your app passes
+ *   both as props. Fork never touches cookies or Web Storage for identity, so
+ *   this is the required mode for embedded/iframe contexts where third-party
+ *   cookies are blocked (e.g. app-store review environments).
  * - `authUrl`: URL on your backend that returns `{ userId, userHash }`.
  *   The SDK calls this on mount (same-origin, cookies sent automatically).
- *   Your backend computes: userHash = HMAC-SHA256(sk_fork_key, userId).
- *   This provides verified per-user fork isolation.
- *   If the verified user is also a Fork tenant operator (their email matches
- *   a fork_users row with a user_roles entry on this tenant), the SDK
- *   transparently enters admin mode and acts as their mapped end-user — set
- *   the mapping in Fork's Team Settings → End user.
+ *   Relies on the host's cookie session, so it does not work where the host
+ *   page's cookies are third-party — prefer the userHash prop mode there.
+ *
+ * In either verified mode, if the user is also a Fork tenant operator (their
+ * email matches a fork_users row with a user_roles entry on this tenant), the
+ * SDK transparently enters admin mode and acts as their mapped end-user — set
+ * the mapping in Fork's Team Settings → End user.
  */
 type ForkProviderProps = ForkProviderBase & ({
     userId: string;
+    userHash?: string;
     authUrl?: never;
 } | {
     authUrl: string;
     userId?: never;
+    userHash?: never;
 });
 interface ForkBoundaryRegistration {
     id: string;
@@ -730,6 +743,8 @@ interface ManifestEntry {
     legacyBundleUrl: string | null;
     buildId: string | null;
     updatedAt: string;
+    /** Author-only, once-ever reveal-animation flag (server-tracked). */
+    revealPending?: boolean;
 }
 interface ManifestModuleEntry {
     forkId: string;

package/dist/index.d.ts

@@ -15,6 +15,11 @@ interface Fork {
     summary?: string;
     /** Rough estimate in minutes for how long the agent will take. Set after the Haiku title call resolves. */
     estimateMinutes?: number;
+    /** True when this user authored the fork and hasn't seen its one-shot
+     *  reveal animation yet (server-tracked via forks.reveal_seen_at, once
+     *  ever across tabs/devices). Set client-side on live SSE completion;
+     *  DirectForkSlot plays the reveal and records it via POST /forks/reveals. */
+    revealPending?: boolean;
     createdAt: string;
     completedAt?: string;
     error?: string;
@@ -58,24 +63,32 @@ interface ForkProviderBase {
     shared?: ForkSharedRegistry;
 }
 /**
- * User identity — provide EITHER userId OR authUrl:
+ * User identity — provide EITHER userId (optionally with userHash) OR authUrl:
  *
- * - `userId`: Client-asserted, no server verification (dev/testing only).
+ * - `userId` alone: Client-asserted, no server verification (dev/testing only).
+ * - `userId` + `userHash`: Host-brokered verified identity. Your backend
+ *   computes userHash = HMAC-SHA256(sk_fork_key, userId) and your app passes
+ *   both as props. Fork never touches cookies or Web Storage for identity, so
+ *   this is the required mode for embedded/iframe contexts where third-party
+ *   cookies are blocked (e.g. app-store review environments).
  * - `authUrl`: URL on your backend that returns `{ userId, userHash }`.
  *   The SDK calls this on mount (same-origin, cookies sent automatically).
- *   Your backend computes: userHash = HMAC-SHA256(sk_fork_key, userId).
- *   This provides verified per-user fork isolation.
- *   If the verified user is also a Fork tenant operator (their email matches
- *   a fork_users row with a user_roles entry on this tenant), the SDK
- *   transparently enters admin mode and acts as their mapped end-user — set
- *   the mapping in Fork's Team Settings → End user.
+ *   Relies on the host's cookie session, so it does not work where the host
+ *   page's cookies are third-party — prefer the userHash prop mode there.
+ *
+ * In either verified mode, if the user is also a Fork tenant operator (their
+ * email matches a fork_users row with a user_roles entry on this tenant), the
+ * SDK transparently enters admin mode and acts as their mapped end-user — set
+ * the mapping in Fork's Team Settings → End user.
  */
 type ForkProviderProps = ForkProviderBase & ({
     userId: string;
+    userHash?: string;
     authUrl?: never;
 } | {
     authUrl: string;
     userId?: never;
+    userHash?: never;
 });
 interface ForkBoundaryRegistration {
     id: string;
@@ -730,6 +743,8 @@ interface ManifestEntry {
     legacyBundleUrl: string | null;
     buildId: string | null;
     updatedAt: string;
+    /** Author-only, once-ever reveal-animation flag (server-tracked). */
+    revealPending?: boolean;
 }
 interface ManifestModuleEntry {
     forkId: string;