@ikonai/sdk 1.3.1 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikonai/sdk",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "type": "module",
   "main": "./index.js",
   "types": "./index.d.ts",

package/utils/embedded-oauth.d.ts

@@ -0,0 +1,30 @@
+/**
+ * OAuth sign-in for an app running inside someone else's page.
+ *
+ * A framed app cannot sign in the way an unframed one does. The provider's consent screen sets
+ * X-Frame-Options and refuses to paint in a frame, and the frame's own address — a Studio preview
+ * gets a relay host and port per session — can never be an allowed return target. So the redirect
+ * runs in a popup, returns to the auth service's own origin (always allowed), and that landing
+ * hands the authorization code back here by postMessage.
+ *
+ * Both sign-in entry points route through here: the React auth context and the server-drawn
+ * `ikon.client.login` client function. They used to build the same redirect URL separately, and
+ * keeping two copies in step is exactly what failed once already.
+ */
+/**
+ * True when this document is nested in another. A cross-origin parent makes the property access
+ * itself throw, which is the embedded case too.
+ */
+export declare function isEmbedded(): boolean;
+/**
+ * Sign in through a popup and land the result on this page's URL.
+ *
+ * The code is handed over by reloading this document with `ikon_code` on it rather than by redeeming
+ * it here: that is the exact shape the unframed redirect flow already produces, so the callback
+ * consumer that reads it needs no second code path and no knowledge of how the code arrived. The
+ * reload is same-origin, so nothing frames anything it may not.
+ *
+ * Returns false when the popup could not be opened or the sign-in did not complete; the caller
+ * reports that to the person. Throws nothing — a failed sign-in is an outcome, not an exception.
+ */
+export declare function startEmbeddedOAuthSignIn(provider: string, spaceId: string): Promise<boolean>;