@nevermined-io/ui-widgets-server 0.5.7 → 0.5.9

package/README.md

@@ -1,8 +1,8 @@
 # @nevermined-io/ui-widgets-server
 
-Server-side helper for the Nevermined UI Widgets. Mints short-lived **init tokens** that the browser SDK ([`@nevermined-io/ui-widgets`](https://www.npmjs.com/package/@nevermined-io/ui-widgets)) exchanges for an authenticated widget session.
+Server-side helper for the Nevermined UI Widgets. Mints a **widget session** by calling the Nevermined API with your widget key secret and returns the session the browser SDK ([`@nevermined-io/ui-widgets`](https://www.npmjs.com/package/@nevermined-io/ui-widgets)) consumes directly.
 
-This package is intended to run **only on your backend**. It signs JWTs with your widget key secret, which must never be exposed to the browser.
+This package is intended to run **only on your backend**. It transmits your widget key `rawSecret` server-to-server; the secret must never be exposed to the browser.
 
 ## Install
 
@@ -12,32 +12,33 @@ npm install @nevermined-io/ui-widgets-server
 pnpm add @nevermined-io/ui-widgets-server
 ```
 
-Requires Node 18+ (uses Web Crypto via [`jose`](https://www.npmjs.com/package/jose)).
+Requires Node 18+ (uses the global `fetch`).
 
 ## Quick start
 
-In your organization's backend, create an endpoint that returns a fresh init token for the currently logged-in user:
+In your organization's backend, create an endpoint that returns a fresh widget session for the currently logged-in user:
 
 ```ts
 import express from 'express'
-import { createInitToken } from '@nevermined-io/ui-widgets-server'
+import { createWidgetSession } from '@nevermined-io/ui-widgets-server'
 
 const app = express()
 
-app.get('/api/widget-init-token', async (req, res) => {
+app.get('/api/widget-session', async (req, res) => {
   // Authenticate the request your normal way and resolve the user's email.
   // The email is the canonical Nevermined identity — a user that later logs
   // into nevermined.dev directly with the same email is resolved to the
   // same Privy user, the same wallet, and the same widget profile.
   const email = req.user.email
 
-  const initToken = await createInitToken({
+  const session = await createWidgetSession({
     email,
     orgId: process.env.NVM_ORG_ID!,
-    secretKey: process.env.NVM_WIDGET_KEY_SECRET!, // never expose to the browser
+    rawSecret: process.env.NVM_WIDGET_KEY_SECRET!, // never expose to the browser
+    apiBaseUrl: 'https://api.sandbox.nevermined.app',
   })
 
-  res.json({ initToken })
+  res.json(session)
 })
 ```
 
@@ -46,50 +47,51 @@ Then, in the browser:
 ```ts
 import { NeverminedWidgets } from '@nevermined-io/ui-widgets'
 
-const { initToken } = await fetch('/api/widget-init-token').then(r => r.json())
+const session = await fetch('/api/widget-session').then((r) => r.json())
 
 const nvm = await NeverminedWidgets.initialize({
-  initToken,
+  session,
   environment: 'sandbox',
 })
 ```
 
 ## API
 
-### `createInitToken(options): Promise<string>`
+### `createWidgetSession(options): Promise<WidgetSession>`
 
-Returns a signed JWT (HS256) that the browser SDK passes to `POST /api/v1/widgets/session`. The token's audience is `nvm:widgets` and it carries the user's email (`email`, the canonical Nevermined identity) and organization id (`orgId`) as claims.
+POSTs `{ orgId, email, rawSecret }` to `${apiBaseUrl}/api/v1/widgets/session` and returns the session response. Forward the result verbatim to the browser SDK.
 
 #### Options
 
-| Field        | Type     | Required | Default | Description |
-| ------------ | -------- | -------- | ------- | ----------- |
-| `email`      | `string` | yes      | —       | The end user's email. Becomes the JWT `email` claim and the canonical Nevermined identity — a user that logs into nevermined.dev directly with the same email is resolved to the same Privy user, wallet, and profile. |
-| `orgId`      | `string` | yes      | —       | Your Nevermined organization id. |
-| `secretKey`  | `string` | yes      | —       | The widget key secret (`wk_...`) issued in the Nevermined dashboard. **Server-side only.** |
-| `expiresIn`  | `string` | no       | `'5m'`  | JWT lifetime — any [`jose`-compatible](https://github.com/panva/jose) duration string. The default is intentionally short: the browser exchanges the token immediately for a long-lived session. |
+| Field        | Type           | Required | Description                                                                                                                                                                                                                 |
+| ------------ | -------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `email`      | `string`       | yes      | The end user's email — the canonical Nevermined identity. A user that logs into nevermined.dev directly with the same email is resolved to the same Privy user, wallet, and profile. Trimmed and lowercased before sending. |
+| `orgId`      | `string`       | yes      | Your Nevermined organization id.                                                                                                                                                                                            |
+| `rawSecret`  | `string`       | yes      | The widget key secret (`wk_...`) issued in the Nevermined dashboard. **Server-side only.** F-055: the API stores only its SHA-256 hash.                                                                                     |
+| `apiBaseUrl` | `string`       | yes      | Nevermined API base URL — e.g. `https://api.sandbox.nevermined.app`. The helper appends `/api/v1/widgets/session`.                                                                                                          |
+| `fetch`      | `typeof fetch` | no       | Override the global `fetch` (useful in tests).                                                                                                                                                                              |
 
-#### Token shape
+#### Response shape
 
 ```ts
-interface InitTokenPayload {
-  sub: string     // mirrors `email` (legacy claim, kept for compatibility)
-  email: string   // canonical Nevermined identity
-  orgId: string
-  aud: 'nvm:widgets'
-  iat: number
-  exp: number
+interface WidgetSession {
+  sessionToken: string
+  userId: string
+  userWallet: string
+  apiKeyHash: string
+  expiresAt: string // ISO timestamp
 }
 ```
 
-#### Breaking change vs `< 0.5.0`
+#### Breaking change vs `< 0.6.0`
 
-The `userId` parameter was renamed to `email` and is now required to be a real email address. The widget session API resolves the Privy user via `getByEmailAddress` and only falls back to creating a new user if no match exists; an arbitrary `userId` no longer maps to a deterministic Privy user. Update your backend integration to forward the user's email to `createInitToken` instead of an internal id.
+- `createInitToken` has been removed. F-055 (#1468): the iframe-bound init JWT model required the API to store widget secrets in a reversible form. Hashed storage replaces that with a server-to-server credential exchange: the integrator backend calls the Nevermined API directly with `rawSecret` and forwards the session to the iframe.
+- The new helper is `createWidgetSession`. The `secretKey` option is renamed `rawSecret`; an `apiBaseUrl` option is now required. The return value is the full `WidgetSession` object, not a JWT string.
+- The browser SDK now accepts the session object directly via `NeverminedWidgets.initialize({ session, environment })`; the iframe no longer exchanges a token at startup.
 
 ## Security notes
 
-- Treat `secretKey` like a database password: never inline it in client code, commit it, or send it through an unencrypted channel. If it leaks, rotate the widget key in the dashboard immediately.
-- Issue a new init token per session — they are short-lived by design. Do not cache them across users.
+- Treat `rawSecret` like a database password: never inline it in client code, commit it, or send it through an unencrypted channel. If it leaks, rotate the widget key in the dashboard immediately.
 - Pair this with `allowedOrigins` on the widget key so even a leaked secret can't mint sessions for arbitrary origins.
 
 ## License

package/dist/create-widget-session.d.ts

@@ -0,0 +1,12 @@
+import type { CreateWidgetSessionOptions, WidgetSession } from './types.js';
+/**
+ * Server-side helper that mints a widget session on the integrator's backend
+ * and returns the response. Forward the result verbatim to the browser SDK
+ * as `NeverminedWidgets.initialize({ session, environment })`.
+ *
+ * F-055 (#1468): the widget key `rawSecret` is the only credential the API
+ * accepts. It is hashed (SHA-256) at rest and constant-time compared on each
+ * call. It must remain on the backend — never expose it to the browser.
+ */
+export declare function createWidgetSession(options: CreateWidgetSessionOptions): Promise<WidgetSession>;
+//# sourceMappingURL=create-widget-session.d.ts.map

package/dist/create-widget-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-widget-session.d.ts","sourceRoot":"","sources":["../src/create-widget-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAgB3E;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,aAAa,CAAC,CA6CxB"}

package/dist/create-widget-session.js

@@ -0,0 +1,57 @@
+import { normalizeEmail } from './normalize-email.js';
+const SESSION_ENDPOINT = '/api/v1/widgets/session';
+function isWidgetSession(value) {
+    if (typeof value !== 'object' || value === null) return false;
+    const v = value;
+    return typeof v.sessionToken === 'string' && typeof v.userId === 'string' && typeof v.userWallet === 'string' && typeof v.apiKeyHash === 'string' && typeof v.expiresAt === 'string';
+}
+/**
+ * Server-side helper that mints a widget session on the integrator's backend
+ * and returns the response. Forward the result verbatim to the browser SDK
+ * as `NeverminedWidgets.initialize({ session, environment })`.
+ *
+ * F-055 (#1468): the widget key `rawSecret` is the only credential the API
+ * accepts. It is hashed (SHA-256) at rest and constant-time compared on each
+ * call. It must remain on the backend — never expose it to the browser.
+ */ export async function createWidgetSession(options) {
+    const { rawSecret, orgId, apiBaseUrl } = options;
+    if (!rawSecret?.trim()) throw new Error('rawSecret is required');
+    if (!orgId?.trim()) throw new Error('orgId is required');
+    if (!apiBaseUrl?.trim()) throw new Error('apiBaseUrl is required');
+    const normalizedEmail = normalizeEmail(options.email);
+    const fetchImpl = options.fetch ?? fetch;
+    const url = `${apiBaseUrl.replace(/\/$/, '')}${SESSION_ENDPOINT}`;
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json'
+            },
+            body: JSON.stringify({
+                orgId,
+                email: normalizedEmail,
+                rawSecret
+            })
+        });
+    } catch (cause) {
+        throw new Error(`Widget session request to ${url} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    if (!response.ok) {
+        const body = await response.text().catch(()=>'');
+        throw new Error(`Widget session request to ${url} failed with status ${response.status}: ${body}`);
+    }
+    let payload;
+    try {
+        payload = await response.json();
+    } catch (cause) {
+        throw new Error(`Widget session response from ${url} was not valid JSON: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    if (!isWidgetSession(payload)) {
+        throw new Error(`Widget session response from ${url} is missing required fields`);
+    }
+    return payload;
+}
+
+//# sourceMappingURL=create-widget-session.js.map

package/dist/create-widget-session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/create-widget-session.ts"],"sourcesContent":["import { normalizeEmail } from './normalize-email.js'\nimport type { CreateWidgetSessionOptions, WidgetSession } from './types.js'\n\nconst SESSION_ENDPOINT = '/api/v1/widgets/session'\n\nfunction isWidgetSession(value: unknown): value is WidgetSession {\n  if (typeof value !== 'object' || value === null) return false\n  const v = value as Record<string, unknown>\n  return (\n    typeof v.sessionToken === 'string' &&\n    typeof v.userId === 'string' &&\n    typeof v.userWallet === 'string' &&\n    typeof v.apiKeyHash === 'string' &&\n    typeof v.expiresAt === 'string'\n  )\n}\n\n/**\n * Server-side helper that mints a widget session on the integrator's backend\n * and returns the response. Forward the result verbatim to the browser SDK\n * as `NeverminedWidgets.initialize({ session, environment })`.\n *\n * F-055 (#1468): the widget key `rawSecret` is the only credential the API\n * accepts. It is hashed (SHA-256) at rest and constant-time compared on each\n * call. It must remain on the backend — never expose it to the browser.\n */\nexport async function createWidgetSession(\n  options: CreateWidgetSessionOptions,\n): Promise<WidgetSession> {\n  const { rawSecret, orgId, apiBaseUrl } = options\n\n  if (!rawSecret?.trim()) throw new Error('rawSecret is required')\n  if (!orgId?.trim()) throw new Error('orgId is required')\n  if (!apiBaseUrl?.trim()) throw new Error('apiBaseUrl is required')\n\n  const normalizedEmail = normalizeEmail(options.email)\n  const fetchImpl = options.fetch ?? fetch\n  const url = `${apiBaseUrl.replace(/\\/$/, '')}${SESSION_ENDPOINT}`\n\n  let response: Response\n  try {\n    response = await fetchImpl(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },\n      body: JSON.stringify({ orgId, email: normalizedEmail, rawSecret }),\n    })\n  } catch (cause) {\n    throw new Error(\n      `Widget session request to ${url} failed: ${cause instanceof Error ? cause.message : String(cause)}`,\n    )\n  }\n\n  if (!response.ok) {\n    const body = await response.text().catch(() => '')\n    throw new Error(\n      `Widget session request to ${url} failed with status ${response.status}: ${body}`,\n    )\n  }\n\n  let payload: unknown\n  try {\n    payload = await response.json()\n  } catch (cause) {\n    throw new Error(\n      `Widget session response from ${url} was not valid JSON: ${cause instanceof Error ? cause.message : String(cause)}`,\n    )\n  }\n\n  if (!isWidgetSession(payload)) {\n    throw new Error(`Widget session response from ${url} is missing required fields`)\n  }\n\n  return payload\n}\n"],"names":["normalizeEmail","SESSION_ENDPOINT","isWidgetSession","value","v","sessionToken","userId","userWallet","apiKeyHash","expiresAt","createWidgetSession","options","rawSecret","orgId","apiBaseUrl","trim","Error","normalizedEmail","email","fetchImpl","fetch","url","replace","response","method","headers","Accept","body","JSON","stringify","cause","message","String","ok","text","catch","status","payload","json"],"mappings":"AAAA,SAASA,cAAc,QAAQ,uBAAsB;AAGrD,MAAMC,mBAAmB;AAEzB,SAASC,gBAAgBC,KAAc;IACrC,IAAI,OAAOA,UAAU,YAAYA,UAAU,MAAM,OAAO;IACxD,MAAMC,IAAID;IACV,OACE,OAAOC,EAAEC,YAAY,KAAK,YAC1B,OAAOD,EAAEE,MAAM,KAAK,YACpB,OAAOF,EAAEG,UAAU,KAAK,YACxB,OAAOH,EAAEI,UAAU,KAAK,YACxB,OAAOJ,EAAEK,SAAS,KAAK;AAE3B;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,oBACpBC,OAAmC;IAEnC,MAAM,EAAEC,SAAS,EAAEC,KAAK,EAAEC,UAAU,EAAE,GAAGH;IAEzC,IAAI,CAACC,WAAWG,QAAQ,MAAM,IAAIC,MAAM;IACxC,IAAI,CAACH,OAAOE,QAAQ,MAAM,IAAIC,MAAM;IACpC,IAAI,CAACF,YAAYC,QAAQ,MAAM,IAAIC,MAAM;IAEzC,MAAMC,kBAAkBjB,eAAeW,QAAQO,KAAK;IACpD,MAAMC,YAAYR,QAAQS,KAAK,IAAIA;IACnC,MAAMC,MAAM,GAAGP,WAAWQ,OAAO,CAAC,OAAO,MAAMrB,kBAAkB;IAEjE,IAAIsB;IACJ,IAAI;QACFA,WAAW,MAAMJ,UAAUE,KAAK;YAC9BG,QAAQ;YACRC,SAAS;gBAAE,gBAAgB;gBAAoBC,QAAQ;YAAmB;YAC1EC,MAAMC,KAAKC,SAAS,CAAC;gBAAEhB;gBAAOK,OAAOD;gBAAiBL;YAAU;QAClE;IACF,EAAE,OAAOkB,OAAO;QACd,MAAM,IAAId,MACR,CAAC,0BAA0B,EAAEK,IAAI,SAAS,EAAES,iBAAiBd,QAAQc,MAAMC,OAAO,GAAGC,OAAOF,QAAQ;IAExG;IAEA,IAAI,CAACP,SAASU,EAAE,EAAE;QAChB,MAAMN,OAAO,MAAMJ,SAASW,IAAI,GAAGC,KAAK,CAAC,IAAM;QAC/C,MAAM,IAAInB,MACR,CAAC,0BAA0B,EAAEK,IAAI,oBAAoB,EAAEE,SAASa,MAAM,CAAC,EAAE,EAAET,MAAM;IAErF;IAEA,IAAIU;IACJ,IAAI;QACFA,UAAU,MAAMd,SAASe,IAAI;IAC/B,EAAE,OAAOR,OAAO;QACd,MAAM,IAAId,MACR,CAAC,6BAA6B,EAAEK,IAAI,qBAAqB,EAAES,iBAAiBd,QAAQc,MAAMC,OAAO,GAAGC,OAAOF,QAAQ;IAEvH;IAEA,IAAI,CAAC5B,gBAAgBmC,UAAU;QAC7B,MAAM,IAAIrB,MAAM,CAAC,6BAA6B,EAAEK,IAAI,2BAA2B,CAAC;IAClF;IAEA,OAAOgB;AACT"}

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { createInitToken } from './create-init-token.js';
-export type { CreateInitTokenOptions, InitTokenPayload } from './types.js';
+export { createWidgetSession } from './create-widget-session.js';
+export type { CreateWidgetSessionOptions, WidgetSession } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,YAAY,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,3 +1,3 @@
-export { createInitToken } from './create-init-token.js';
+export { createWidgetSession } from './create-widget-session.js';
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { createInitToken } from './create-init-token.js'\nexport type { CreateInitTokenOptions, InitTokenPayload } from './types.js'\n"],"names":["createInitToken"],"mappings":"AAAA,SAASA,eAAe,QAAQ,yBAAwB"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { createWidgetSession } from './create-widget-session.js'\nexport type { CreateWidgetSessionOptions, WidgetSession } from './types.js'\n"],"names":["createWidgetSession"],"mappings":"AAAA,SAASA,mBAAmB,QAAQ,6BAA4B"}

package/dist/types.d.ts

@@ -1,32 +1,41 @@
-export interface CreateInitTokenOptions {
+export interface CreateWidgetSessionOptions {
     /**
      * The end user's email — the canonical Nevermined identity (#1520). The
      * widget session API uses this to resolve or provision the Privy user.
      *
      * Validated and normalized at the SDK boundary: trimmed, lowercased, capped
      * at 254 chars (RFC 5321), and matched against a basic format regex. The
-     * normalized value is what ends up in the JWT — callers should not rely on
+     * normalized value is what the API receives — callers should not rely on
      * case being preserved.
      */
     email: string;
+    /** Nevermined organization id (from the dashboard). */
     orgId: string;
-    secretKey: string;
-    expiresIn?: string;
-}
-export interface InitTokenPayload {
     /**
-     * Mirrors `email` so the widget session API's non-empty existence check on
-     * `sub` passes without a parallel API change. Do NOT read `sub` for identity
-     * downstream — read `email` instead. This claim will be dropped once the
-     * API stops reading `sub` (follow-up to #1520).
-     *
-     * @deprecated Read `email` instead. Kept temporarily for API compatibility.
+     * F-055: raw widget key secret (`wk_...`) issued in the dashboard. The
+     * Nevermined API stores only its SHA-256 hash; the plaintext value must
+     * stay on the integrator's backend and **never** travel through a browser.
      */
-    sub: string;
-    email: string;
-    orgId: string;
-    aud: string;
-    iat: number;
-    exp: number;
+    rawSecret: string;
+    /**
+     * Nevermined API base URL — e.g. `https://api.sandbox.nevermined.app`. The
+     * SDK appends `/api/v1/widgets/session` itself. Required so the helper
+     * works from arbitrary backends without an env coupling.
+     */
+    apiBaseUrl: string;
+    /**
+     * Optional fetch override — useful in tests or in environments that ship
+     * their own HTTP client. Defaults to the global `fetch`.
+     */
+    fetch?: typeof fetch;
+}
+export interface WidgetSession {
+    /** Widget session JWT — forward to the browser SDK as `session.sessionToken`. */
+    sessionToken: string;
+    userId: string;
+    userWallet: string;
+    apiKeyHash: string;
+    /** ISO timestamp at which the session token expires. */
+    expiresAt: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["export interface CreateInitTokenOptions {\n  /**\n   * The end user's email — the canonical Nevermined identity (#1520). The\n   * widget session API uses this to resolve or provision the Privy user.\n   *\n   * Validated and normalized at the SDK boundary: trimmed, lowercased, capped\n   * at 254 chars (RFC 5321), and matched against a basic format regex. The\n   * normalized value is what ends up in the JWT — callers should not rely on\n   * case being preserved.\n   */\n  email: string\n  orgId: string\n  secretKey: string\n  expiresIn?: string // default '5m'\n}\n\nexport interface InitTokenPayload {\n  /**\n   * Mirrors `email` so the widget session API's non-empty existence check on\n   * `sub` passes without a parallel API change. Do NOT read `sub` for identity\n   * downstream — read `email` instead. This claim will be dropped once the\n   * API stops reading `sub` (follow-up to #1520).\n   *\n   * @deprecated Read `email` instead. Kept temporarily for API compatibility.\n   */\n  sub: string\n  email: string\n  orgId: string\n  aud: string // 'nvm:widgets'\n  iat: number\n  exp: number\n}\n"],"names":[],"mappings":"AAgBA,WAeC"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["export interface CreateWidgetSessionOptions {\n  /**\n   * The end user's email — the canonical Nevermined identity (#1520). The\n   * widget session API uses this to resolve or provision the Privy user.\n   *\n   * Validated and normalized at the SDK boundary: trimmed, lowercased, capped\n   * at 254 chars (RFC 5321), and matched against a basic format regex. The\n   * normalized value is what the API receives — callers should not rely on\n   * case being preserved.\n   */\n  email: string\n  /** Nevermined organization id (from the dashboard). */\n  orgId: string\n  /**\n   * F-055: raw widget key secret (`wk_...`) issued in the dashboard. The\n   * Nevermined API stores only its SHA-256 hash; the plaintext value must\n   * stay on the integrator's backend and **never** travel through a browser.\n   */\n  rawSecret: string\n  /**\n   * Nevermined API base URL — e.g. `https://api.sandbox.nevermined.app`. The\n   * SDK appends `/api/v1/widgets/session` itself. Required so the helper\n   * works from arbitrary backends without an env coupling.\n   */\n  apiBaseUrl: string\n  /**\n   * Optional fetch override — useful in tests or in environments that ship\n   * their own HTTP client. Defaults to the global `fetch`.\n   */\n  fetch?: typeof fetch\n}\n\nexport interface WidgetSession {\n  /** Widget session JWT — forward to the browser SDK as `session.sessionToken`. */\n  sessionToken: string\n  userId: string\n  userWallet: string\n  apiKeyHash: string\n  /** ISO timestamp at which the session token expires. */\n  expiresAt: string\n}\n"],"names":[],"mappings":"AAgCA,WAQC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nevermined-io/ui-widgets-server",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -17,9 +17,7 @@
     "dist",
     "!**/*.tsbuildinfo"
   ],
-  "dependencies": {
-    "jose": "4.15.9"
-  },
+  "dependencies": {},
   "nx": {
     "targets": {
       "build": {

package/dist/create-init-token.d.ts

@@ -1,3 +0,0 @@
-import type { CreateInitTokenOptions } from './types.js';
-export declare function createInitToken(options: CreateInitTokenOptions): Promise<string>;
-//# sourceMappingURL=create-init-token.d.ts.map

package/dist/create-init-token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"create-init-token.d.ts","sourceRoot":"","sources":["../src/create-init-token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAKxD,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBtF"}

package/dist/create-init-token.js

@@ -1,22 +0,0 @@
-import { SignJWT } from 'jose';
-import { normalizeEmail } from './normalize-email.js';
-const WIDGET_AUDIENCE = 'nvm:widgets';
-const DEFAULT_EXPIRES_IN = '5m';
-export async function createInitToken(options) {
-    const { email, orgId, secretKey, expiresIn = DEFAULT_EXPIRES_IN } = options;
-    if (!secretKey?.trim()) throw new Error('secretKey is required');
-    if (!orgId?.trim()) throw new Error('orgId is required');
-    const normalizedEmail = normalizeEmail(email);
-    const secret = new TextEncoder().encode(secretKey);
-    // `sub` is set to the email so the API's existence check on the claim
-    // continues to pass without a parallel API change. The downstream
-    // identity resolution uses the explicit `email` claim, not `sub`.
-    return new SignJWT({
-        orgId,
-        email: normalizedEmail
-    }).setProtectedHeader({
-        alg: 'HS256'
-    }).setSubject(normalizedEmail).setAudience(WIDGET_AUDIENCE).setIssuedAt().setExpirationTime(expiresIn).sign(secret);
-}
-
-//# sourceMappingURL=create-init-token.js.map

package/dist/create-init-token.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/create-init-token.ts"],"sourcesContent":["import { SignJWT } from 'jose'\nimport { normalizeEmail } from './normalize-email.js'\nimport type { CreateInitTokenOptions } from './types.js'\n\nconst WIDGET_AUDIENCE = 'nvm:widgets'\nconst DEFAULT_EXPIRES_IN = '5m'\n\nexport async function createInitToken(options: CreateInitTokenOptions): Promise<string> {\n  const { email, orgId, secretKey, expiresIn = DEFAULT_EXPIRES_IN } = options\n\n  if (!secretKey?.trim()) throw new Error('secretKey is required')\n  if (!orgId?.trim()) throw new Error('orgId is required')\n\n  const normalizedEmail = normalizeEmail(email)\n\n  const secret = new TextEncoder().encode(secretKey)\n\n  // `sub` is set to the email so the API's existence check on the claim\n  // continues to pass without a parallel API change. The downstream\n  // identity resolution uses the explicit `email` claim, not `sub`.\n  return new SignJWT({ orgId, email: normalizedEmail })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setSubject(normalizedEmail)\n    .setAudience(WIDGET_AUDIENCE)\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n"],"names":["SignJWT","normalizeEmail","WIDGET_AUDIENCE","DEFAULT_EXPIRES_IN","createInitToken","options","email","orgId","secretKey","expiresIn","trim","Error","normalizedEmail","secret","TextEncoder","encode","setProtectedHeader","alg","setSubject","setAudience","setIssuedAt","setExpirationTime","sign"],"mappings":"AAAA,SAASA,OAAO,QAAQ,OAAM;AAC9B,SAASC,cAAc,QAAQ,uBAAsB;AAGrD,MAAMC,kBAAkB;AACxB,MAAMC,qBAAqB;AAE3B,OAAO,eAAeC,gBAAgBC,OAA+B;IACnE,MAAM,EAAEC,KAAK,EAAEC,KAAK,EAAEC,SAAS,EAAEC,YAAYN,kBAAkB,EAAE,GAAGE;IAEpE,IAAI,CAACG,WAAWE,QAAQ,MAAM,IAAIC,MAAM;IACxC,IAAI,CAACJ,OAAOG,QAAQ,MAAM,IAAIC,MAAM;IAEpC,MAAMC,kBAAkBX,eAAeK;IAEvC,MAAMO,SAAS,IAAIC,cAAcC,MAAM,CAACP;IAExC,sEAAsE;IACtE,kEAAkE;IAClE,kEAAkE;IAClE,OAAO,IAAIR,QAAQ;QAAEO;QAAOD,OAAOM;IAAgB,GAChDI,kBAAkB,CAAC;QAAEC,KAAK;IAAQ,GAClCC,UAAU,CAACN,iBACXO,WAAW,CAACjB,iBACZkB,WAAW,GACXC,iBAAiB,CAACZ,WAClBa,IAAI,CAACT;AACV"}