@openkey/sdk 0.10.0 → 0.10.2

package/dist/index.mjs

@@ -239,12 +239,16 @@ function validateIframeResize(incoming, expected) {
   if (!incoming || typeof incoming !== "object") return null;
   const data = incoming;
   if (data.type !== "openkey:resize") return null;
-  if (expected.requestId === null || expected.protocolVersion === null) return null;
-  if (typeof data.protocolVersion !== "number" || data.protocolVersion !== expected.protocolVersion) {
-    return null;
-  }
-  if (typeof data.requestId !== "string" || data.requestId !== expected.requestId) {
-    return null;
+  if (expected.requestId === null && expected.protocolVersion === null) {
+    if (data.requestId !== void 0) return null;
+  } else {
+    if (expected.requestId === null || expected.protocolVersion === null) return null;
+    if (typeof data.protocolVersion !== "number" || data.protocolVersion !== expected.protocolVersion) {
+      return null;
+    }
+    if (typeof data.requestId !== "string" || data.requestId !== expected.requestId) {
+      return null;
+    }
   }
   if (typeof data.height !== "number" || !Number.isFinite(data.height) || data.height <= 0) {
     return null;
@@ -320,11 +324,11 @@ var IframeModal = class {
   onMessage;
   messageHandler;
   host;
-  // Sol final continuation contract requirement 5: iframe resize traffic
-  // MUST correlate to the active request's requestId AND protocolVersion.
-  // Set by `setExpectedCorrelation` after the outer flow decides which
-  // request this modal is bound to. When both are null, resize messages
-  // are dropped (no active request → no resize authority).
+  // Sol final continuation contract requirement 5: when the modal carries a
+  // versioned request, iframe resize traffic MUST correlate to its
+  // requestId AND protocolVersion. Set by `setExpectedCorrelation` as soon
+  // as the modal is created. When both are null the flow is unversioned and
+  // only uncorrelated resizes from this iframe are accepted (TC-647).
   expectedRequestId = null;
   expectedProtocolVersion = null;
   constructor(opts) {
@@ -406,10 +410,11 @@ var IframeModal = class {
    * request correlation so subsequent resize (and future correlated)
    * messages can be verified against `requestId` + `protocolVersion`.
    *
-   * The outer flow calls this immediately BEFORE posting the sign
-   * request into the iframe, so a resize that arrives synchronously
-   * after ready is correlated correctly. Passing `null` for either
-   * argument disables correlation (resize is dropped).
+   * The outer flow calls this right after creating the modal for a
+   * versioned request, before the iframe can send anything, so no
+   * uncorrelated resize is ever accepted for that request. Passing `null`
+   * for both arguments means the flow is unversioned; passing `null` for
+   * only one drops every resize.
    */
   setExpectedCorrelation(requestId, protocolVersion) {
     this.expectedRequestId = requestId;
@@ -547,14 +552,13 @@ var OpenKey = class {
   popup = null;
   lastAuth = null;
   discoveredProviders = [];
-  sessionToken = null;
   /** Cancels widget flows that could outlive a sign-out on this instance. */
   activeFlowCancellations = /* @__PURE__ */ new Set();
   /**
    * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
    * fully separate from the Ethereum flows above: it never reuses
-   * `lastAuth`/`sessionToken`, and its widget messages never carry a
-   * sessionToken - the OpenKey session and any signing grants stay inside
+   * `lastAuth`, and its widget messages never carry a session token -
+   * the OpenKey session and any signing grants stay inside
    * the OpenKey-origin iframe for the whole lifetime of this client.
    */
   nostr;
@@ -636,25 +640,22 @@ var OpenKey = class {
   /**
    * Signs the active OpenKey account out through the OpenKey-owned widget.
    *
-   * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-   * protocol so applications do not have to implement revocation themselves.
-   * Local SDK session state is cleared before opening the widget, including
-   * when remote revocation is unavailable.
+   * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+   * the SDK never holds an OpenKey session token. Local SDK state is cleared
+   * before opening the widget, including when remote revocation is
+   * unavailable.
    */
   async signOut(opts) {
     const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
-    const sessionToken = this.sessionToken || void 0;
     const mode = this.resolveMode(opts?.mode) === "redirect" ? "popup" : opts?.mode;
     this.cancelActiveFlows();
     this.lastAuth = null;
-    this.sessionToken = null;
     const acknowledgement = await this.openFlow(
       "sign-out",
       {
         type: "openkey:sign-out:request",
         requestId,
-        protocolVersion: 1,
-        sessionToken
+        protocolVersion: 1
       },
       mode
     );
@@ -664,22 +665,26 @@ var OpenKey = class {
     return acknowledgement;
   }
   /**
-   * Better-auth session token relayed during connect(), or null if the
-   * flow did not provide one. Use as a bearer token for API calls made
-   * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+   * Always null. OpenKey no longer gives its session token to the embedding
+   * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+   * just the requesting app's flows.
+   *
+   * @deprecated Kept so existing callers compile. Third-party server-side
+   * signing uses an OAuth access token from the OpenKey OAuth flow.
    */
   getSessionToken() {
-    return this.sessionToken;
+    return null;
   }
   /**
-   * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-   * The endpoint is on the OpenKey API host and only signs requests the
-   * server-side bootstrap allowlist permits.
+   * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+   * null; see {@link OpenKey.getSessionToken}.
+   *
+   * @deprecated The endpoint accepts an OAuth access token as its bearer.
    */
   tinycloudSigningOptions() {
     return {
       endpoint: `${this.oauthHost}/api/delegate/sign`,
-      token: this.sessionToken
+      token: null
     };
   }
   /**
@@ -764,8 +769,7 @@ var OpenKey = class {
         // context. The envelope is display-only; the widget transport
         // validates and size-bounds it before use and NEVER treats it as
         // verified unless the server actually origin-binds a manifest.
-        presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0
+        presentation: request.presentation
       },
       opts?.mode
     );
@@ -842,7 +846,6 @@ var OpenKey = class {
         // bounded at the transport, never treated as verified without
         // server-side origin-binding.
         presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0,
         // Sol MAJOR-3 (continuation): tell the widget to hand us back
         // the previewApproval instead of asking OpenKey to sign
         // server-side with a managed key. The widget will still render
@@ -996,15 +999,13 @@ var OpenKey = class {
     return this.openFlow("sign", {
       type: "openkey:sign:request",
       message: request.message,
-      keyId: request.keyId,
-      sessionToken: this.sessionToken || void 0
+      keyId: request.keyId
     }, mode);
   }
   signTypedDataWithOpenKey(request, mode) {
     return this.openFlow("sign-typed-data", {
       type: "openkey:signTypedData:request",
-      data: request,
-      sessionToken: this.sessionToken || void 0
+      data: request
     }, mode);
   }
   toHex(str) {
@@ -1260,12 +1261,6 @@ var OpenKey = class {
         onMessage: (data) => {
           if (data.type === "openkey:ready") {
             readyReceived = true;
-            if (isVersionedRequest && modal) {
-              modal.setExpectedCorrelation(
-                outgoingRequestId,
-                outgoingProtocolVersion
-              );
-            }
             modal?.postMessage(message);
             return;
           }
@@ -1296,7 +1291,6 @@ var OpenKey = class {
               cleanup();
               if (data.success) {
                 if (data.type === "openkey:auth:response") {
-                  if (data.sessionToken) this.sessionToken = data.sessionToken;
                   resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
                 } else if (data.type === "openkey:link-wallet:response") {
                   resolve({ address: data.address, keyId: data.keyId });
@@ -1326,6 +1320,12 @@ var OpenKey = class {
           }
         }
       });
+      if (isVersionedRequest) {
+        modal.setExpectedCorrelation(
+          outgoingRequestId,
+          outgoingProtocolVersion
+        );
+      }
       const readyTimeout = setTimeout(() => {
         if (readyReceived || settled) return;
         cleanup();
@@ -1513,7 +1513,6 @@ var OpenKey = class {
           popup.close();
           if (data.success) {
             if (data.type === "openkey:auth:response") {
-              if (data.sessionToken) this.sessionToken = data.sessionToken;
               resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
             } else if (data.type === "openkey:link-wallet:response") {
               resolve({ address: data.address, keyId: data.keyId });