@ikonai/sdk 1.3.7 → 1.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikonai/sdk",
-  "version": "1.3.7",
+  "version": "1.3.9",
   "type": "module",
   "main": "./index.js",
   "types": "./index.d.ts",

package/utils/embedded-oauth.d.ts

@@ -3,9 +3,13 @@
  *
  * A framed app cannot sign in the way an unframed one does. The provider's consent screen sets
  * X-Frame-Options and refuses to paint in a frame, and the frame's own address — a Studio preview
- * gets a relay host and port per session — can never be an allowed return target. So the redirect
- * runs in a popup, returns to the auth service's own origin (always allowed), and that landing
- * hands the authorization code back here by postMessage.
+ * gets a relay host and port per session — can never be an allowed return target.
+ *
+ * So the embedder is asked to run it: it owns a top-level window whose address IS an allowed
+ * target. It answers with the result, which this frame collects by message — see
+ * {@link onEmbeddedOAuthResult}. An embedder that does not answer leaves the popup below, which
+ * lands on the auth service's own origin and posts the code back; that is the only route for a host
+ * this app is merely iframed into.
  *
  * Both sign-in entry points route through here: the React auth context and the server-drawn
  * `ikon.client.login` client function. They used to build the same redirect URL separately, and

package/utils/query-params.d.ts

@@ -11,7 +11,10 @@
  * - ikon-webtransport Force WebTransport on (true); default is off. `false` is accepted for parity.
  * - ikon-debug        Enable SDK debug logging (true)
  * - ikon-lang         Override language detection (e.g., "en", "fi")
- * - ikon-server-url   External connect URL for shareable preview links
+ * - ikon-server-url   External connect URL for shareable preview links (full URL form)
+ * - ikon-connect      Compact form of the same thing: the connect token, optionally prefixed with
+ *                     "<port>~" when the Ikon server is on a different port of the SAME host as the
+ *                     page. Carries a credential — treat it like ikon-server-url
  * - ikon-audio        Force audio on (true) or off (false)
  * - ikon-video        Force video on (true) or off (false)
  * - ikon-webrtc       Force WebRTC on (true) or off (false)
@@ -28,6 +31,7 @@ export declare const IKON_PARAM_WEBTRANSPORT = "ikon-webtransport";
 export declare const IKON_PARAM_DEBUG = "ikon-debug";
 export declare const IKON_PARAM_LANG = "ikon-lang";
 export declare const IKON_PARAM_SERVER_URL = "ikon-server-url";
+export declare const IKON_PARAM_CONNECT = "ikon-connect";
 export declare const IKON_PARAM_AUDIO = "ikon-audio";
 export declare const IKON_PARAM_VIDEO = "ikon-video";
 export declare const IKON_PARAM_WEBRTC = "ikon-webrtc";
@@ -49,6 +53,17 @@ export declare function getWebTransportParam(): boolean | null;
 export declare function getDebugParam(): boolean;
 export declare function getLangParam(): string | null;
 export declare function getServerUrlParam(): string | null;
+/**
+ * The compact external connect parameter, resolved against the page's own origin.
+ *
+ * A preview's frontend is usually served by the Ikon server itself, so the link needs to carry only
+ * the token; when the frontend is on its own port of the same host it carries "<port>~" as well.
+ * Anything else — a genuinely different host — keeps using {@link IKON_PARAM_SERVER_URL}, because
+ * only a full URL can express it.
+ *
+ * Returns null when the parameter is absent, so a caller can fall back.
+ */
+export declare function getConnectParam(): string | null;
 export declare function getAudioParam(): boolean | null;
 export declare function getVideoParam(): boolean | null;
 export declare function getWebRtcParam(): boolean | null;