@ikonai/sdk 1.3.4 → 1.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikonai/sdk",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "type": "module",
   "main": "./index.js",
   "types": "./index.d.ts",

package/utils/embedded-oauth.d.ts

@@ -14,6 +14,14 @@
 /** What the frame asks its embedder for, and what the embedder answers to claim the request. */
 export declare const EMBEDDER_SIGN_IN_REQUEST = "ikon-oauth-embedder-request";
 export declare const EMBEDDER_SIGN_IN_ACCEPTED = "ikon-oauth-embedder-accepted";
+/** What a frame sends to collect a sign-in the embedder completed for it, and the answer it gets. */
+export declare const EMBEDDER_RESULT_CLAIM = "ikon-oauth-embedder-claim";
+export declare const EMBEDDER_RESULT = "ikon-oauth-embedder-result";
+export interface EmbeddedOAuthResult {
+    code: string;
+    provider: string;
+    codeVerifier: string | null;
+}
 /**
  * Carries the verifier back to the frame on its own URL, beside the code.
  *
@@ -34,9 +42,11 @@ export declare function isEmbedded(): boolean;
  * Asks the embedder first, because a host that is cross-origin isolated severs any popup this frame
  * opens. Falls back to the popup for a host that is not.
  *
- * The window is opened BEFORE either path is chosen, while the click is still what the browser sees:
- * asking the embedder awaits, and a popup opened after that has lost the gesture and is taken for a
- * pop-under. An embedder that claims the request gets it closed again immediately.
+ * The popup is opened only once the embedder has declined, never speculatively. Opening it up front
+ * left a blank window stranded on screen in exactly the case the embedder path handles: a severed
+ * `window.open` returns null, so there is no handle left to close the window it nonetheless opened.
+ * The gesture survives the wait — {@link EMBEDDER_ACK_TIMEOUT_MS} is bounded well inside the
+ * browser's transient-activation window, so the popup is still attributable to the click.
  *
  * The code is handed over by reloading this document with `ikon_code` on it rather than by redeeming
  * it here: that is the exact shape the unframed redirect flow already produces, so the callback
@@ -47,6 +57,23 @@ export declare function isEmbedded(): boolean;
  * to the person. Throws nothing — a failed sign-in is an outcome, not an exception.
  */
 export declare function startEmbeddedOAuthSignIn(provider: string, spaceId: string): Promise<boolean>;
+/**
+ * Collect a sign-in the embedder ran on this frame's behalf, and hand it to `deliver`.
+ *
+ * The result travels as a message rather than on this frame's address, because an address can be
+ * given to any number of documents. An embedder that reassigns the frame's src while the preview
+ * settles hands the same single-use code to each of them, and every redemption after the first
+ * fails against a code the first already spent — which reports a sign-in as broken to whichever
+ * document is left on screen, moments after it actually succeeded. A message has one recipient, and
+ * the embedder drops its copy as it answers, so the code cannot be presented twice.
+ *
+ * The claim is sent on mount rather than waited for: an embedder holding nothing simply never
+ * answers, and the app resolves its session exactly as it would unembedded instead of pausing every
+ * framed boot on a timeout.
+ *
+ * Returns a function that stops listening.
+ */
+export declare function onEmbeddedOAuthResult(spaceId: string, deliver: (result: EmbeddedOAuthResult) => void): () => void;
 /**
  * Take a verifier off this document's URL and put it back where the exchange looks for it.
  *