@openkey/sdk 0.10.0 → 0.10.2

package/dist/index.d.mts

@@ -211,12 +211,23 @@ interface CapabilityPresentationEnvelopeV1 {
 /**
  * Sol final continuation contract requirement 5: pure validation of an
  * incoming iframe resize message envelope. Exported so unit tests can
- * exercise every rejection branch — wrong requestId, wrong version, no
- * active request, malformed height — without booting the browser
- * runtime that `IframeModal` requires.
+ * exercise every rejection branch — wrong requestId, wrong version,
+ * malformed height — without booting the browser runtime that
+ * `IframeModal` requires.
  *
- * Returns the sanitized height when acceptable, or `null` when the
- * message must be dropped.
+ * Two modes, chosen by the modal's bound correlation:
+ * - Versioned request bound (`requestId` AND `protocolVersion` set): the
+ *   resize MUST carry that exact pair.
+ * - No versioned request (both null — `connect`, `signMessage`, and the
+ *   other unversioned flows): the widget sends a plain
+ *   `{ type, height }`. It is accepted only when it carries no
+ *   `requestId`. The caller has already checked that the message came
+ *   from this modal's iframe (`event.source`) on the OpenKey origin
+ *   (TC-647).
+ * A half-bound correlation (only one of the two set) drops everything.
+ *
+ * Returns the height clamped to 85% of the viewport when acceptable, or
+ * `null` when the message must be dropped.
  */
 declare function validateIframeResize(incoming: unknown, expected: {
     requestId: string | null;
@@ -318,14 +329,13 @@ declare class OpenKey {
     private popup;
     private lastAuth;
     private discoveredProviders;
-    private sessionToken;
     /** Cancels widget flows that could outlive a sign-out on this instance. */
     private activeFlowCancellations;
     /**
      * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
      * fully separate from the Ethereum flows above: it never reuses
-     * `lastAuth`/`sessionToken`, and its widget messages never carry a
-     * sessionToken - the OpenKey session and any signing grants stay inside
+     * `lastAuth`, and its widget messages never carry a session token -
+     * the OpenKey session and any signing grants stay inside
      * the OpenKey-origin iframe for the whole lifetime of this client.
      */
     readonly nostr: OpenKeyNostr;
@@ -360,24 +370,28 @@ declare class OpenKey {
     /**
      * Signs the active OpenKey account out through the OpenKey-owned widget.
      *
-     * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-     * protocol so applications do not have to implement revocation themselves.
-     * Local SDK session state is cleared before opening the widget, including
-     * when remote revocation is unavailable.
+     * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+     * the SDK never holds an OpenKey session token. Local SDK state is cleared
+     * before opening the widget, including when remote revocation is
+     * unavailable.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;
     }): Promise<SignOutAcknowledgement>;
     /**
-     * Better-auth session token relayed during connect(), or null if the
-     * flow did not provide one. Use as a bearer token for API calls made
-     * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+     * Always null. OpenKey no longer gives its session token to the embedding
+     * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+     * just the requesting app's flows.
+     *
+     * @deprecated Kept so existing callers compile. Third-party server-side
+     * signing uses an OAuth access token from the OpenKey OAuth flow.
      */
     getSessionToken(): string | null;
     /**
-     * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-     * The endpoint is on the OpenKey API host and only signs requests the
-     * server-side bootstrap allowlist permits.
+     * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+     * null; see {@link OpenKey.getSessionToken}.
+     *
+     * @deprecated The endpoint accepts an OAuth access token as its bearer.
      */
     tinycloudSigningOptions(): {
         endpoint: string;

package/dist/index.d.ts

@@ -211,12 +211,23 @@ interface CapabilityPresentationEnvelopeV1 {
 /**
  * Sol final continuation contract requirement 5: pure validation of an
  * incoming iframe resize message envelope. Exported so unit tests can
- * exercise every rejection branch — wrong requestId, wrong version, no
- * active request, malformed height — without booting the browser
- * runtime that `IframeModal` requires.
+ * exercise every rejection branch — wrong requestId, wrong version,
+ * malformed height — without booting the browser runtime that
+ * `IframeModal` requires.
  *
- * Returns the sanitized height when acceptable, or `null` when the
- * message must be dropped.
+ * Two modes, chosen by the modal's bound correlation:
+ * - Versioned request bound (`requestId` AND `protocolVersion` set): the
+ *   resize MUST carry that exact pair.
+ * - No versioned request (both null — `connect`, `signMessage`, and the
+ *   other unversioned flows): the widget sends a plain
+ *   `{ type, height }`. It is accepted only when it carries no
+ *   `requestId`. The caller has already checked that the message came
+ *   from this modal's iframe (`event.source`) on the OpenKey origin
+ *   (TC-647).
+ * A half-bound correlation (only one of the two set) drops everything.
+ *
+ * Returns the height clamped to 85% of the viewport when acceptable, or
+ * `null` when the message must be dropped.
  */
 declare function validateIframeResize(incoming: unknown, expected: {
     requestId: string | null;
@@ -318,14 +329,13 @@ declare class OpenKey {
     private popup;
     private lastAuth;
     private discoveredProviders;
-    private sessionToken;
     /** Cancels widget flows that could outlive a sign-out on this instance. */
     private activeFlowCancellations;
     /**
      * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
      * fully separate from the Ethereum flows above: it never reuses
-     * `lastAuth`/`sessionToken`, and its widget messages never carry a
-     * sessionToken - the OpenKey session and any signing grants stay inside
+     * `lastAuth`, and its widget messages never carry a session token -
+     * the OpenKey session and any signing grants stay inside
      * the OpenKey-origin iframe for the whole lifetime of this client.
      */
     readonly nostr: OpenKeyNostr;
@@ -360,24 +370,28 @@ declare class OpenKey {
     /**
      * Signs the active OpenKey account out through the OpenKey-owned widget.
      *
-     * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-     * protocol so applications do not have to implement revocation themselves.
-     * Local SDK session state is cleared before opening the widget, including
-     * when remote revocation is unavailable.
+     * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+     * the SDK never holds an OpenKey session token. Local SDK state is cleared
+     * before opening the widget, including when remote revocation is
+     * unavailable.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;
     }): Promise<SignOutAcknowledgement>;
     /**
-     * Better-auth session token relayed during connect(), or null if the
-     * flow did not provide one. Use as a bearer token for API calls made
-     * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+     * Always null. OpenKey no longer gives its session token to the embedding
+     * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+     * just the requesting app's flows.
+     *
+     * @deprecated Kept so existing callers compile. Third-party server-side
+     * signing uses an OAuth access token from the OpenKey OAuth flow.
      */
     getSessionToken(): string | null;
     /**
-     * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-     * The endpoint is on the OpenKey API host and only signs requests the
-     * server-side bootstrap allowlist permits.
+     * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+     * null; see {@link OpenKey.getSessionToken}.
+     *
+     * @deprecated The endpoint accepts an OAuth access token as its bearer.
      */
     tinycloudSigningOptions(): {
         endpoint: string;

package/dist/index.js

@@ -273,12 +273,16 @@ function validateIframeResize(incoming, expected) {
   if (!incoming || typeof incoming !== "object") return null;
   const data = incoming;
   if (data.type !== "openkey:resize") return null;
-  if (expected.requestId === null || expected.protocolVersion === null) return null;
-  if (typeof data.protocolVersion !== "number" || data.protocolVersion !== expected.protocolVersion) {
-    return null;
-  }
-  if (typeof data.requestId !== "string" || data.requestId !== expected.requestId) {
-    return null;
+  if (expected.requestId === null && expected.protocolVersion === null) {
+    if (data.requestId !== void 0) return null;
+  } else {
+    if (expected.requestId === null || expected.protocolVersion === null) return null;
+    if (typeof data.protocolVersion !== "number" || data.protocolVersion !== expected.protocolVersion) {
+      return null;
+    }
+    if (typeof data.requestId !== "string" || data.requestId !== expected.requestId) {
+      return null;
+    }
   }
   if (typeof data.height !== "number" || !Number.isFinite(data.height) || data.height <= 0) {
     return null;
@@ -354,11 +358,11 @@ var IframeModal = class {
   onMessage;
   messageHandler;
   host;
-  // Sol final continuation contract requirement 5: iframe resize traffic
-  // MUST correlate to the active request's requestId AND protocolVersion.
-  // Set by `setExpectedCorrelation` after the outer flow decides which
-  // request this modal is bound to. When both are null, resize messages
-  // are dropped (no active request → no resize authority).
+  // Sol final continuation contract requirement 5: when the modal carries a
+  // versioned request, iframe resize traffic MUST correlate to its
+  // requestId AND protocolVersion. Set by `setExpectedCorrelation` as soon
+  // as the modal is created. When both are null the flow is unversioned and
+  // only uncorrelated resizes from this iframe are accepted (TC-647).
   expectedRequestId = null;
   expectedProtocolVersion = null;
   constructor(opts) {
@@ -440,10 +444,11 @@ var IframeModal = class {
    * request correlation so subsequent resize (and future correlated)
    * messages can be verified against `requestId` + `protocolVersion`.
    *
-   * The outer flow calls this immediately BEFORE posting the sign
-   * request into the iframe, so a resize that arrives synchronously
-   * after ready is correlated correctly. Passing `null` for either
-   * argument disables correlation (resize is dropped).
+   * The outer flow calls this right after creating the modal for a
+   * versioned request, before the iframe can send anything, so no
+   * uncorrelated resize is ever accepted for that request. Passing `null`
+   * for both arguments means the flow is unversioned; passing `null` for
+   * only one drops every resize.
    */
   setExpectedCorrelation(requestId, protocolVersion) {
     this.expectedRequestId = requestId;
@@ -581,14 +586,13 @@ var OpenKey = class {
   popup = null;
   lastAuth = null;
   discoveredProviders = [];
-  sessionToken = null;
   /** Cancels widget flows that could outlive a sign-out on this instance. */
   activeFlowCancellations = /* @__PURE__ */ new Set();
   /**
    * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
    * fully separate from the Ethereum flows above: it never reuses
-   * `lastAuth`/`sessionToken`, and its widget messages never carry a
-   * sessionToken - the OpenKey session and any signing grants stay inside
+   * `lastAuth`, and its widget messages never carry a session token -
+   * the OpenKey session and any signing grants stay inside
    * the OpenKey-origin iframe for the whole lifetime of this client.
    */
   nostr;
@@ -670,25 +674,22 @@ var OpenKey = class {
   /**
    * Signs the active OpenKey account out through the OpenKey-owned widget.
    *
-   * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-   * protocol so applications do not have to implement revocation themselves.
-   * Local SDK session state is cleared before opening the widget, including
-   * when remote revocation is unavailable.
+   * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+   * the SDK never holds an OpenKey session token. Local SDK state is cleared
+   * before opening the widget, including when remote revocation is
+   * unavailable.
    */
   async signOut(opts) {
     const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
-    const sessionToken = this.sessionToken || void 0;
     const mode = this.resolveMode(opts?.mode) === "redirect" ? "popup" : opts?.mode;
     this.cancelActiveFlows();
     this.lastAuth = null;
-    this.sessionToken = null;
     const acknowledgement = await this.openFlow(
       "sign-out",
       {
         type: "openkey:sign-out:request",
         requestId,
-        protocolVersion: 1,
-        sessionToken
+        protocolVersion: 1
       },
       mode
     );
@@ -698,22 +699,26 @@ var OpenKey = class {
     return acknowledgement;
   }
   /**
-   * Better-auth session token relayed during connect(), or null if the
-   * flow did not provide one. Use as a bearer token for API calls made
-   * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+   * Always null. OpenKey no longer gives its session token to the embedding
+   * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+   * just the requesting app's flows.
+   *
+   * @deprecated Kept so existing callers compile. Third-party server-side
+   * signing uses an OAuth access token from the OpenKey OAuth flow.
    */
   getSessionToken() {
-    return this.sessionToken;
+    return null;
   }
   /**
-   * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-   * The endpoint is on the OpenKey API host and only signs requests the
-   * server-side bootstrap allowlist permits.
+   * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+   * null; see {@link OpenKey.getSessionToken}.
+   *
+   * @deprecated The endpoint accepts an OAuth access token as its bearer.
    */
   tinycloudSigningOptions() {
     return {
       endpoint: `${this.oauthHost}/api/delegate/sign`,
-      token: this.sessionToken
+      token: null
     };
   }
   /**
@@ -798,8 +803,7 @@ var OpenKey = class {
         // context. The envelope is display-only; the widget transport
         // validates and size-bounds it before use and NEVER treats it as
         // verified unless the server actually origin-binds a manifest.
-        presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0
+        presentation: request.presentation
       },
       opts?.mode
     );
@@ -876,7 +880,6 @@ var OpenKey = class {
         // bounded at the transport, never treated as verified without
         // server-side origin-binding.
         presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0,
         // Sol MAJOR-3 (continuation): tell the widget to hand us back
         // the previewApproval instead of asking OpenKey to sign
         // server-side with a managed key. The widget will still render
@@ -1030,15 +1033,13 @@ var OpenKey = class {
     return this.openFlow("sign", {
       type: "openkey:sign:request",
       message: request.message,
-      keyId: request.keyId,
-      sessionToken: this.sessionToken || void 0
+      keyId: request.keyId
     }, mode);
   }
   signTypedDataWithOpenKey(request, mode) {
     return this.openFlow("sign-typed-data", {
       type: "openkey:signTypedData:request",
-      data: request,
-      sessionToken: this.sessionToken || void 0
+      data: request
     }, mode);
   }
   toHex(str) {
@@ -1294,12 +1295,6 @@ var OpenKey = class {
         onMessage: (data) => {
           if (data.type === "openkey:ready") {
             readyReceived = true;
-            if (isVersionedRequest && modal) {
-              modal.setExpectedCorrelation(
-                outgoingRequestId,
-                outgoingProtocolVersion
-              );
-            }
             modal?.postMessage(message);
             return;
           }
@@ -1330,7 +1325,6 @@ var OpenKey = class {
               cleanup();
               if (data.success) {
                 if (data.type === "openkey:auth:response") {
-                  if (data.sessionToken) this.sessionToken = data.sessionToken;
                   resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
                 } else if (data.type === "openkey:link-wallet:response") {
                   resolve({ address: data.address, keyId: data.keyId });
@@ -1360,6 +1354,12 @@ var OpenKey = class {
           }
         }
       });
+      if (isVersionedRequest) {
+        modal.setExpectedCorrelation(
+          outgoingRequestId,
+          outgoingProtocolVersion
+        );
+      }
       const readyTimeout = setTimeout(() => {
         if (readyReceived || settled) return;
         cleanup();
@@ -1547,7 +1547,6 @@ var OpenKey = class {
           popup.close();
           if (data.success) {
             if (data.type === "openkey:auth:response") {
-              if (data.sessionToken) this.sessionToken = data.sessionToken;
               resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
             } else if (data.type === "openkey:link-wallet:response") {
               resolve({ address: data.address, keyId: data.keyId });