@openkey/sdk 0.10.1 → 0.11.0

package/dist/index.d.mts

@@ -27,7 +27,8 @@ interface NostrError {
  */
 declare class OpenKeyNostr {
     private host;
-    constructor(host: string);
+    private passkeysSupported;
+    constructor(host: string, passkeysSupported?: boolean);
     /**
      * Get-or-create the user's OpenKey-custodied Nostr identity. Always shows
      * a visible consent card (identity creation, or - when `relayUrl` is
@@ -67,7 +68,19 @@ interface OpenKeyConfig {
     mode?: OpenKeyMode;
     /** App-provided wallet provider for external key signing */
     externalProvider?: EIP1193Provider;
+    /**
+     * Whether the client can use passkeys (WebAuthn). Default: true. Pass
+     * false from clients where WebAuthn does not work (for example an
+     * ad-hoc-signed desktop webview); the OpenKey UI then offers only email
+     * and social sign-in.
+     */
+    passkeysSupported?: boolean;
 }
+/**
+ * Query suffix telling the OpenKey widget that passkeys are unavailable.
+ * Empty when passkeys are supported, so default URLs are unchanged.
+ */
+declare function passkeysQueryFlag(passkeysSupported: boolean): string;
 interface SignMessageRequest {
     message: string;
     keyId?: string;
@@ -325,18 +338,18 @@ declare class OpenKey {
     private oauthHost;
     private appName;
     private mode;
+    private passkeysSupported;
     private config;
     private popup;
     private lastAuth;
     private discoveredProviders;
-    private sessionToken;
     /** Cancels widget flows that could outlive a sign-out on this instance. */
     private activeFlowCancellations;
     /**
      * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
      * fully separate from the Ethereum flows above: it never reuses
-     * `lastAuth`/`sessionToken`, and its widget messages never carry a
-     * sessionToken - the OpenKey session and any signing grants stay inside
+     * `lastAuth`, and its widget messages never carry a session token -
+     * the OpenKey session and any signing grants stay inside
      * the OpenKey-origin iframe for the whole lifetime of this client.
      */
     readonly nostr: OpenKeyNostr;
@@ -371,24 +384,28 @@ declare class OpenKey {
     /**
      * Signs the active OpenKey account out through the OpenKey-owned widget.
      *
-     * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-     * protocol so applications do not have to implement revocation themselves.
-     * Local SDK session state is cleared before opening the widget, including
-     * when remote revocation is unavailable.
+     * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+     * the SDK never holds an OpenKey session token. Local SDK state is cleared
+     * before opening the widget, including when remote revocation is
+     * unavailable.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;
     }): Promise<SignOutAcknowledgement>;
     /**
-     * Better-auth session token relayed during connect(), or null if the
-     * flow did not provide one. Use as a bearer token for API calls made
-     * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+     * Always null. OpenKey no longer gives its session token to the embedding
+     * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+     * just the requesting app's flows.
+     *
+     * @deprecated Kept so existing callers compile. Third-party server-side
+     * signing uses an OAuth access token from the OpenKey OAuth flow.
      */
     getSessionToken(): string | null;
     /**
-     * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-     * The endpoint is on the OpenKey API host and only signs requests the
-     * server-side bootstrap allowlist permits.
+     * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+     * null; see {@link OpenKey.getSessionToken}.
+     *
+     * @deprecated The endpoint accepts an OAuth access token as its bearer.
      */
     tinycloudSigningOptions(): {
         endpoint: string;
@@ -551,4 +568,4 @@ declare class OpenKeyProvider implements EIP1193Provider {
 
 declare function getOpenKey(config?: OpenKeyConfig): OpenKey;
 
-export { type AuthResult, type AuthorizeTinyCloudRouting, type CapabilityPresentationEnvelopeV1, type EIP1193Provider, KeyIdTypeMismatchError, type NostrError, type NostrIdentity, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, type OpenKeyError, type OpenKeyMode, OpenKeyNostr, OpenKeyProvider, type SignMessageRequest, type SignOutAcknowledgement, type SignResult, type SignTypedDataRequest, type SignedNostrEvent, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type UnsignedNostrEvent, OpenKey as default, getOpenKey, resolveAuthorizeTinyCloudRouting, shouldRouteAuthorizeTinyCloudExternal, validateIframeResize };
+export { type AuthResult, type AuthorizeTinyCloudRouting, type CapabilityPresentationEnvelopeV1, type EIP1193Provider, KeyIdTypeMismatchError, type NostrError, type NostrIdentity, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, type OpenKeyError, type OpenKeyMode, OpenKeyNostr, OpenKeyProvider, type SignMessageRequest, type SignOutAcknowledgement, type SignResult, type SignTypedDataRequest, type SignedNostrEvent, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type UnsignedNostrEvent, OpenKey as default, getOpenKey, passkeysQueryFlag, resolveAuthorizeTinyCloudRouting, shouldRouteAuthorizeTinyCloudExternal, validateIframeResize };

package/dist/index.d.ts

@@ -27,7 +27,8 @@ interface NostrError {
  */
 declare class OpenKeyNostr {
     private host;
-    constructor(host: string);
+    private passkeysSupported;
+    constructor(host: string, passkeysSupported?: boolean);
     /**
      * Get-or-create the user's OpenKey-custodied Nostr identity. Always shows
      * a visible consent card (identity creation, or - when `relayUrl` is
@@ -67,7 +68,19 @@ interface OpenKeyConfig {
     mode?: OpenKeyMode;
     /** App-provided wallet provider for external key signing */
     externalProvider?: EIP1193Provider;
+    /**
+     * Whether the client can use passkeys (WebAuthn). Default: true. Pass
+     * false from clients where WebAuthn does not work (for example an
+     * ad-hoc-signed desktop webview); the OpenKey UI then offers only email
+     * and social sign-in.
+     */
+    passkeysSupported?: boolean;
 }
+/**
+ * Query suffix telling the OpenKey widget that passkeys are unavailable.
+ * Empty when passkeys are supported, so default URLs are unchanged.
+ */
+declare function passkeysQueryFlag(passkeysSupported: boolean): string;
 interface SignMessageRequest {
     message: string;
     keyId?: string;
@@ -325,18 +338,18 @@ declare class OpenKey {
     private oauthHost;
     private appName;
     private mode;
+    private passkeysSupported;
     private config;
     private popup;
     private lastAuth;
     private discoveredProviders;
-    private sessionToken;
     /** Cancels widget flows that could outlive a sign-out on this instance. */
     private activeFlowCancellations;
     /**
      * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
      * fully separate from the Ethereum flows above: it never reuses
-     * `lastAuth`/`sessionToken`, and its widget messages never carry a
-     * sessionToken - the OpenKey session and any signing grants stay inside
+     * `lastAuth`, and its widget messages never carry a session token -
+     * the OpenKey session and any signing grants stay inside
      * the OpenKey-origin iframe for the whole lifetime of this client.
      */
     readonly nostr: OpenKeyNostr;
@@ -371,24 +384,28 @@ declare class OpenKey {
     /**
      * Signs the active OpenKey account out through the OpenKey-owned widget.
      *
-     * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-     * protocol so applications do not have to implement revocation themselves.
-     * Local SDK session state is cleared before opening the widget, including
-     * when remote revocation is unavailable.
+     * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+     * the SDK never holds an OpenKey session token. Local SDK state is cleared
+     * before opening the widget, including when remote revocation is
+     * unavailable.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;
     }): Promise<SignOutAcknowledgement>;
     /**
-     * Better-auth session token relayed during connect(), or null if the
-     * flow did not provide one. Use as a bearer token for API calls made
-     * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+     * Always null. OpenKey no longer gives its session token to the embedding
+     * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+     * just the requesting app's flows.
+     *
+     * @deprecated Kept so existing callers compile. Third-party server-side
+     * signing uses an OAuth access token from the OpenKey OAuth flow.
      */
     getSessionToken(): string | null;
     /**
-     * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-     * The endpoint is on the OpenKey API host and only signs requests the
-     * server-side bootstrap allowlist permits.
+     * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+     * null; see {@link OpenKey.getSessionToken}.
+     *
+     * @deprecated The endpoint accepts an OAuth access token as its bearer.
      */
     tinycloudSigningOptions(): {
         endpoint: string;
@@ -551,4 +568,4 @@ declare class OpenKeyProvider implements EIP1193Provider {
 
 declare function getOpenKey(config?: OpenKeyConfig): OpenKey;
 
-export { type AuthResult, type AuthorizeTinyCloudRouting, type CapabilityPresentationEnvelopeV1, type EIP1193Provider, KeyIdTypeMismatchError, type NostrError, type NostrIdentity, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, type OpenKeyError, type OpenKeyMode, OpenKeyNostr, OpenKeyProvider, type SignMessageRequest, type SignOutAcknowledgement, type SignResult, type SignTypedDataRequest, type SignedNostrEvent, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type UnsignedNostrEvent, OpenKey as default, getOpenKey, resolveAuthorizeTinyCloudRouting, shouldRouteAuthorizeTinyCloudExternal, validateIframeResize };
+export { type AuthResult, type AuthorizeTinyCloudRouting, type CapabilityPresentationEnvelopeV1, type EIP1193Provider, KeyIdTypeMismatchError, type NostrError, type NostrIdentity, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, type OpenKeyError, type OpenKeyMode, OpenKeyNostr, OpenKeyProvider, type SignMessageRequest, type SignOutAcknowledgement, type SignResult, type SignTypedDataRequest, type SignedNostrEvent, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type UnsignedNostrEvent, OpenKey as default, getOpenKey, passkeysQueryFlag, resolveAuthorizeTinyCloudRouting, shouldRouteAuthorizeTinyCloudExternal, validateIframeResize };

package/dist/index.js

@@ -26,6 +26,7 @@ __export(index_exports, {
   OpenKeyProvider: () => OpenKeyProvider,
   default: () => index_default,
   getOpenKey: () => getOpenKey,
+  passkeysQueryFlag: () => passkeysQueryFlag,
   resolveAuthorizeTinyCloudRouting: () => resolveAuthorizeTinyCloudRouting,
   shouldRouteAuthorizeTinyCloudExternal: () => shouldRouteAuthorizeTinyCloudExternal,
   validateIframeResize: () => validateIframeResize
@@ -175,8 +176,9 @@ var NostrFrame = class {
   }
 };
 var OpenKeyNostr = class {
-  constructor(host) {
+  constructor(host, passkeysSupported = true) {
     this.host = host;
+    this.passkeysSupported = passkeysSupported;
   }
   /**
    * Get-or-create the user's OpenKey-custodied Nostr identity. Always shows
@@ -219,7 +221,8 @@ var OpenKeyNostr = class {
   }
   widgetUrl() {
     const origin = encodeURIComponent(window.location.origin);
-    return `${this.host}/widget/embed/nostr/approve?origin=${origin}`;
+    const passkeysFlag = this.passkeysSupported ? "" : "&passkeys=false";
+    return `${this.host}/widget/embed/nostr/approve?origin=${origin}${passkeysFlag}`;
   }
   run(url, request, onData) {
     return new Promise((resolve, reject) => {
@@ -263,6 +266,9 @@ var OpenKeyNostr = class {
 };
 
 // src/index.ts
+function passkeysQueryFlag(passkeysSupported) {
+  return passkeysSupported ? "" : "&passkeys=false";
+}
 var DEFAULT_HOST = "https://openkey.so";
 var POPUP_WIDTH = 400;
 var POPUP_HEIGHT = 600;
@@ -582,18 +588,18 @@ var OpenKey = class {
   oauthHost;
   appName;
   mode;
+  passkeysSupported;
   config;
   popup = null;
   lastAuth = null;
   discoveredProviders = [];
-  sessionToken = null;
   /** Cancels widget flows that could outlive a sign-out on this instance. */
   activeFlowCancellations = /* @__PURE__ */ new Set();
   /**
    * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
    * fully separate from the Ethereum flows above: it never reuses
-   * `lastAuth`/`sessionToken`, and its widget messages never carry a
-   * sessionToken - the OpenKey session and any signing grants stay inside
+   * `lastAuth`, and its widget messages never carry a session token -
+   * the OpenKey session and any signing grants stay inside
    * the OpenKey-origin iframe for the whole lifetime of this client.
    */
   nostr;
@@ -603,7 +609,8 @@ var OpenKey = class {
     this.oauthHost = config.oauthHost || this.deriveOAuthHost(this.host);
     this.appName = config.appName || window.location.hostname;
     this.mode = config.mode ?? "iframe";
-    this.nostr = new OpenKeyNostr(this.host);
+    this.passkeysSupported = config.passkeysSupported ?? true;
+    this.nostr = new OpenKeyNostr(this.host, this.passkeysSupported);
     if (typeof window !== "undefined") {
       this.discoveredProviders = [];
       window.addEventListener("eip6963:announceProvider", (event) => {
@@ -675,25 +682,22 @@ var OpenKey = class {
   /**
    * Signs the active OpenKey account out through the OpenKey-owned widget.
    *
-   * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-   * protocol so applications do not have to implement revocation themselves.
-   * Local SDK session state is cleared before opening the widget, including
-   * when remote revocation is unavailable.
+   * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+   * the SDK never holds an OpenKey session token. Local SDK state is cleared
+   * before opening the widget, including when remote revocation is
+   * unavailable.
    */
   async signOut(opts) {
     const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
-    const sessionToken = this.sessionToken || void 0;
     const mode = this.resolveMode(opts?.mode) === "redirect" ? "popup" : opts?.mode;
     this.cancelActiveFlows();
     this.lastAuth = null;
-    this.sessionToken = null;
     const acknowledgement = await this.openFlow(
       "sign-out",
       {
         type: "openkey:sign-out:request",
         requestId,
-        protocolVersion: 1,
-        sessionToken
+        protocolVersion: 1
       },
       mode
     );
@@ -703,22 +707,26 @@ var OpenKey = class {
     return acknowledgement;
   }
   /**
-   * Better-auth session token relayed during connect(), or null if the
-   * flow did not provide one. Use as a bearer token for API calls made
-   * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+   * Always null. OpenKey no longer gives its session token to the embedding
+   * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+   * just the requesting app's flows.
+   *
+   * @deprecated Kept so existing callers compile. Third-party server-side
+   * signing uses an OAuth access token from the OpenKey OAuth flow.
    */
   getSessionToken() {
-    return this.sessionToken;
+    return null;
   }
   /**
-   * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-   * The endpoint is on the OpenKey API host and only signs requests the
-   * server-side bootstrap allowlist permits.
+   * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+   * null; see {@link OpenKey.getSessionToken}.
+   *
+   * @deprecated The endpoint accepts an OAuth access token as its bearer.
    */
   tinycloudSigningOptions() {
     return {
       endpoint: `${this.oauthHost}/api/delegate/sign`,
-      token: this.sessionToken
+      token: null
     };
   }
   /**
@@ -803,8 +811,7 @@ var OpenKey = class {
         // context. The envelope is display-only; the widget transport
         // validates and size-bounds it before use and NEVER treats it as
         // verified unless the server actually origin-binds a manifest.
-        presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0
+        presentation: request.presentation
       },
       opts?.mode
     );
@@ -881,7 +888,6 @@ var OpenKey = class {
         // bounded at the transport, never treated as verified without
         // server-side origin-binding.
         presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0,
         // Sol MAJOR-3 (continuation): tell the widget to hand us back
         // the previewApproval instead of asking OpenKey to sign
         // server-side with a managed key. The widget will still render
@@ -1035,15 +1041,13 @@ var OpenKey = class {
     return this.openFlow("sign", {
       type: "openkey:sign:request",
       message: request.message,
-      keyId: request.keyId,
-      sessionToken: this.sessionToken || void 0
+      keyId: request.keyId
     }, mode);
   }
   signTypedDataWithOpenKey(request, mode) {
     return this.openFlow("sign-typed-data", {
       type: "openkey:signTypedData:request",
-      data: request,
-      sessionToken: this.sessionToken || void 0
+      data: request
     }, mode);
   }
   toHex(str) {
@@ -1253,17 +1257,18 @@ var OpenKey = class {
     const mode = this.resolveMode(modeOverride);
     const origin = encodeURIComponent(window.location.origin);
     const eoaFlag = action === "connect" && this.hasDetectedEoa() ? "&hasEoa=true" : "";
+    const passkeysFlag = passkeysQueryFlag(this.passkeysSupported);
     if (mode === "popup") {
-      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}`;
+      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}${passkeysFlag}`;
       return new Promise((resolve, reject) => this.openPopup(action, url2, message, resolve, reject));
     }
     if (mode === "redirect") {
-      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}`;
+      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}${passkeysFlag}`;
       window.location.href = url2;
       return new Promise(() => {
       });
     }
-    const url = `${this.host}/widget/embed/${action}?origin=${origin}${eoaFlag}`;
+    const url = `${this.host}/widget/embed/${action}?origin=${origin}${eoaFlag}${passkeysFlag}`;
     return this.openIframeModal(url, action, message, origin);
   }
   openIframeModal(url, action, message, origin) {
@@ -1329,7 +1334,6 @@ var OpenKey = class {
               cleanup();
               if (data.success) {
                 if (data.type === "openkey:auth:response") {
-                  if (data.sessionToken) this.sessionToken = data.sessionToken;
                   resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
                 } else if (data.type === "openkey:link-wallet:response") {
                   resolve({ address: data.address, keyId: data.keyId });
@@ -1370,7 +1374,7 @@ var OpenKey = class {
         cleanup();
         console.warn("OpenKey: iframe blocked by CSP, falling back to popup. Add frame-src https://openkey.so to your CSP.");
         showToast();
-        const popupUrl = `${this.host}/widget/${action}?origin=${origin}`;
+        const popupUrl = `${this.host}/widget/${action}?origin=${origin}${passkeysQueryFlag(this.passkeysSupported)}`;
         this.openPopup(action, popupUrl, message, (val) => settle(() => resolve(val)), (err) => settle(() => reject(err)));
       }, IFRAME_READY_TIMEOUT);
       const overallTimeout = setTimeout(() => {
@@ -1552,7 +1556,6 @@ var OpenKey = class {
           popup.close();
           if (data.success) {
             if (data.type === "openkey:auth:response") {
-              if (data.sessionToken) this.sessionToken = data.sessionToken;
               resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
             } else if (data.type === "openkey:link-wallet:response") {
               resolve({ address: data.address, keyId: data.keyId });
@@ -1675,6 +1678,7 @@ function getOpenKey(config) {
   OpenKeyNostr,
   OpenKeyProvider,
   getOpenKey,
+  passkeysQueryFlag,
   resolveAuthorizeTinyCloudRouting,
   shouldRouteAuthorizeTinyCloudExternal,
   validateIframeResize