@openkey/sdk 0.10.1 → 0.10.2

package/dist/index.d.mts

@@ -329,14 +329,13 @@ declare class OpenKey {
     private popup;
     private lastAuth;
     private discoveredProviders;
-    private sessionToken;
     /** Cancels widget flows that could outlive a sign-out on this instance. */
     private activeFlowCancellations;
     /**
      * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
      * fully separate from the Ethereum flows above: it never reuses
-     * `lastAuth`/`sessionToken`, and its widget messages never carry a
-     * sessionToken - the OpenKey session and any signing grants stay inside
+     * `lastAuth`, and its widget messages never carry a session token -
+     * the OpenKey session and any signing grants stay inside
      * the OpenKey-origin iframe for the whole lifetime of this client.
      */
     readonly nostr: OpenKeyNostr;
@@ -371,24 +370,28 @@ declare class OpenKey {
     /**
      * Signs the active OpenKey account out through the OpenKey-owned widget.
      *
-     * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-     * protocol so applications do not have to implement revocation themselves.
-     * Local SDK session state is cleared before opening the widget, including
-     * when remote revocation is unavailable.
+     * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+     * the SDK never holds an OpenKey session token. Local SDK state is cleared
+     * before opening the widget, including when remote revocation is
+     * unavailable.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;
     }): Promise<SignOutAcknowledgement>;
     /**
-     * Better-auth session token relayed during connect(), or null if the
-     * flow did not provide one. Use as a bearer token for API calls made
-     * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+     * Always null. OpenKey no longer gives its session token to the embedding
+     * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+     * just the requesting app's flows.
+     *
+     * @deprecated Kept so existing callers compile. Third-party server-side
+     * signing uses an OAuth access token from the OpenKey OAuth flow.
      */
     getSessionToken(): string | null;
     /**
-     * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-     * The endpoint is on the OpenKey API host and only signs requests the
-     * server-side bootstrap allowlist permits.
+     * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+     * null; see {@link OpenKey.getSessionToken}.
+     *
+     * @deprecated The endpoint accepts an OAuth access token as its bearer.
      */
     tinycloudSigningOptions(): {
         endpoint: string;

package/dist/index.d.ts

@@ -329,14 +329,13 @@ declare class OpenKey {
     private popup;
     private lastAuth;
     private discoveredProviders;
-    private sessionToken;
     /** Cancels widget flows that could outlive a sign-out on this instance. */
     private activeFlowCancellations;
     /**
      * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
      * fully separate from the Ethereum flows above: it never reuses
-     * `lastAuth`/`sessionToken`, and its widget messages never carry a
-     * sessionToken - the OpenKey session and any signing grants stay inside
+     * `lastAuth`, and its widget messages never carry a session token -
+     * the OpenKey session and any signing grants stay inside
      * the OpenKey-origin iframe for the whole lifetime of this client.
      */
     readonly nostr: OpenKeyNostr;
@@ -371,24 +370,28 @@ declare class OpenKey {
     /**
      * Signs the active OpenKey account out through the OpenKey-owned widget.
      *
-     * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-     * protocol so applications do not have to implement revocation themselves.
-     * Local SDK session state is cleared before opening the widget, including
-     * when remote revocation is unavailable.
+     * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+     * the SDK never holds an OpenKey session token. Local SDK state is cleared
+     * before opening the widget, including when remote revocation is
+     * unavailable.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;
     }): Promise<SignOutAcknowledgement>;
     /**
-     * Better-auth session token relayed during connect(), or null if the
-     * flow did not provide one. Use as a bearer token for API calls made
-     * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+     * Always null. OpenKey no longer gives its session token to the embedding
+     * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+     * just the requesting app's flows.
+     *
+     * @deprecated Kept so existing callers compile. Third-party server-side
+     * signing uses an OAuth access token from the OpenKey OAuth flow.
      */
     getSessionToken(): string | null;
     /**
-     * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-     * The endpoint is on the OpenKey API host and only signs requests the
-     * server-side bootstrap allowlist permits.
+     * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+     * null; see {@link OpenKey.getSessionToken}.
+     *
+     * @deprecated The endpoint accepts an OAuth access token as its bearer.
      */
     tinycloudSigningOptions(): {
         endpoint: string;

package/dist/index.js

@@ -586,14 +586,13 @@ var OpenKey = class {
   popup = null;
   lastAuth = null;
   discoveredProviders = [];
-  sessionToken = null;
   /** Cancels widget flows that could outlive a sign-out on this instance. */
   activeFlowCancellations = /* @__PURE__ */ new Set();
   /**
    * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
    * fully separate from the Ethereum flows above: it never reuses
-   * `lastAuth`/`sessionToken`, and its widget messages never carry a
-   * sessionToken - the OpenKey session and any signing grants stay inside
+   * `lastAuth`, and its widget messages never carry a session token -
+   * the OpenKey session and any signing grants stay inside
    * the OpenKey-origin iframe for the whole lifetime of this client.
    */
   nostr;
@@ -675,25 +674,22 @@ var OpenKey = class {
   /**
    * Signs the active OpenKey account out through the OpenKey-owned widget.
    *
-   * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-   * protocol so applications do not have to implement revocation themselves.
-   * Local SDK session state is cleared before opening the widget, including
-   * when remote revocation is unavailable.
+   * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+   * the SDK never holds an OpenKey session token. Local SDK state is cleared
+   * before opening the widget, including when remote revocation is
+   * unavailable.
    */
   async signOut(opts) {
     const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
-    const sessionToken = this.sessionToken || void 0;
     const mode = this.resolveMode(opts?.mode) === "redirect" ? "popup" : opts?.mode;
     this.cancelActiveFlows();
     this.lastAuth = null;
-    this.sessionToken = null;
     const acknowledgement = await this.openFlow(
       "sign-out",
       {
         type: "openkey:sign-out:request",
         requestId,
-        protocolVersion: 1,
-        sessionToken
+        protocolVersion: 1
       },
       mode
     );
@@ -703,22 +699,26 @@ var OpenKey = class {
     return acknowledgement;
   }
   /**
-   * Better-auth session token relayed during connect(), or null if the
-   * flow did not provide one. Use as a bearer token for API calls made
-   * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+   * Always null. OpenKey no longer gives its session token to the embedding
+   * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+   * just the requesting app's flows.
+   *
+   * @deprecated Kept so existing callers compile. Third-party server-side
+   * signing uses an OAuth access token from the OpenKey OAuth flow.
    */
   getSessionToken() {
-    return this.sessionToken;
+    return null;
   }
   /**
-   * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-   * The endpoint is on the OpenKey API host and only signs requests the
-   * server-side bootstrap allowlist permits.
+   * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+   * null; see {@link OpenKey.getSessionToken}.
+   *
+   * @deprecated The endpoint accepts an OAuth access token as its bearer.
    */
   tinycloudSigningOptions() {
     return {
       endpoint: `${this.oauthHost}/api/delegate/sign`,
-      token: this.sessionToken
+      token: null
     };
   }
   /**
@@ -803,8 +803,7 @@ var OpenKey = class {
         // context. The envelope is display-only; the widget transport
         // validates and size-bounds it before use and NEVER treats it as
         // verified unless the server actually origin-binds a manifest.
-        presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0
+        presentation: request.presentation
       },
       opts?.mode
     );
@@ -881,7 +880,6 @@ var OpenKey = class {
         // bounded at the transport, never treated as verified without
         // server-side origin-binding.
         presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0,
         // Sol MAJOR-3 (continuation): tell the widget to hand us back
         // the previewApproval instead of asking OpenKey to sign
         // server-side with a managed key. The widget will still render
@@ -1035,15 +1033,13 @@ var OpenKey = class {
     return this.openFlow("sign", {
       type: "openkey:sign:request",
       message: request.message,
-      keyId: request.keyId,
-      sessionToken: this.sessionToken || void 0
+      keyId: request.keyId
     }, mode);
   }
   signTypedDataWithOpenKey(request, mode) {
     return this.openFlow("sign-typed-data", {
       type: "openkey:signTypedData:request",
-      data: request,
-      sessionToken: this.sessionToken || void 0
+      data: request
     }, mode);
   }
   toHex(str) {
@@ -1329,7 +1325,6 @@ var OpenKey = class {
               cleanup();
               if (data.success) {
                 if (data.type === "openkey:auth:response") {
-                  if (data.sessionToken) this.sessionToken = data.sessionToken;
                   resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
                 } else if (data.type === "openkey:link-wallet:response") {
                   resolve({ address: data.address, keyId: data.keyId });
@@ -1552,7 +1547,6 @@ var OpenKey = class {
           popup.close();
           if (data.success) {
             if (data.type === "openkey:auth:response") {
-              if (data.sessionToken) this.sessionToken = data.sessionToken;
               resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
             } else if (data.type === "openkey:link-wallet:response") {
               resolve({ address: data.address, keyId: data.keyId });