@openkey/sdk 0.10.1 → 0.11.0

package/dist/index.mjs

@@ -141,8 +141,9 @@ var NostrFrame = class {
   }
 };
 var OpenKeyNostr = class {
-  constructor(host) {
+  constructor(host, passkeysSupported = true) {
     this.host = host;
+    this.passkeysSupported = passkeysSupported;
   }
   /**
    * Get-or-create the user's OpenKey-custodied Nostr identity. Always shows
@@ -185,7 +186,8 @@ var OpenKeyNostr = class {
   }
   widgetUrl() {
     const origin = encodeURIComponent(window.location.origin);
-    return `${this.host}/widget/embed/nostr/approve?origin=${origin}`;
+    const passkeysFlag = this.passkeysSupported ? "" : "&passkeys=false";
+    return `${this.host}/widget/embed/nostr/approve?origin=${origin}${passkeysFlag}`;
   }
   run(url, request, onData) {
     return new Promise((resolve, reject) => {
@@ -229,6 +231,9 @@ var OpenKeyNostr = class {
 };
 
 // src/index.ts
+function passkeysQueryFlag(passkeysSupported) {
+  return passkeysSupported ? "" : "&passkeys=false";
+}
 var DEFAULT_HOST = "https://openkey.so";
 var POPUP_WIDTH = 400;
 var POPUP_HEIGHT = 600;
@@ -548,18 +553,18 @@ var OpenKey = class {
   oauthHost;
   appName;
   mode;
+  passkeysSupported;
   config;
   popup = null;
   lastAuth = null;
   discoveredProviders = [];
-  sessionToken = null;
   /** Cancels widget flows that could outlive a sign-out on this instance. */
   activeFlowCancellations = /* @__PURE__ */ new Set();
   /**
    * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
    * fully separate from the Ethereum flows above: it never reuses
-   * `lastAuth`/`sessionToken`, and its widget messages never carry a
-   * sessionToken - the OpenKey session and any signing grants stay inside
+   * `lastAuth`, and its widget messages never carry a session token -
+   * the OpenKey session and any signing grants stay inside
    * the OpenKey-origin iframe for the whole lifetime of this client.
    */
   nostr;
@@ -569,7 +574,8 @@ var OpenKey = class {
     this.oauthHost = config.oauthHost || this.deriveOAuthHost(this.host);
     this.appName = config.appName || window.location.hostname;
     this.mode = config.mode ?? "iframe";
-    this.nostr = new OpenKeyNostr(this.host);
+    this.passkeysSupported = config.passkeysSupported ?? true;
+    this.nostr = new OpenKeyNostr(this.host, this.passkeysSupported);
     if (typeof window !== "undefined") {
       this.discoveredProviders = [];
       window.addEventListener("eip6963:announceProvider", (event) => {
@@ -641,25 +647,22 @@ var OpenKey = class {
   /**
    * Signs the active OpenKey account out through the OpenKey-owned widget.
    *
-   * The SDK passes its Better Auth bearer through the OpenKey-owned widget
-   * protocol so applications do not have to implement revocation themselves.
-   * Local SDK session state is cleared before opening the widget, including
-   * when remote revocation is unavailable.
+   * The OpenKey-owned widget revokes the OpenKey session it holds itself;
+   * the SDK never holds an OpenKey session token. Local SDK state is cleared
+   * before opening the widget, including when remote revocation is
+   * unavailable.
    */
   async signOut(opts) {
     const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
-    const sessionToken = this.sessionToken || void 0;
     const mode = this.resolveMode(opts?.mode) === "redirect" ? "popup" : opts?.mode;
     this.cancelActiveFlows();
     this.lastAuth = null;
-    this.sessionToken = null;
     const acknowledgement = await this.openFlow(
       "sign-out",
       {
         type: "openkey:sign-out:request",
         requestId,
-        protocolVersion: 1,
-        sessionToken
+        protocolVersion: 1
       },
       mode
     );
@@ -669,22 +672,26 @@ var OpenKey = class {
     return acknowledgement;
   }
   /**
-   * Better-auth session token relayed during connect(), or null if the
-   * flow did not provide one. Use as a bearer token for API calls made
-   * on the user's behalf (e.g. TinyCloud auto-sign bootstrap signing).
+   * Always null. OpenKey no longer gives its session token to the embedding
+   * page (TC-688): the token unlocked OpenKey's key and account APIs, not
+   * just the requesting app's flows.
+   *
+   * @deprecated Kept so existing callers compile. Third-party server-side
+   * signing uses an OAuth access token from the OpenKey OAuth flow.
    */
   getSessionToken() {
-    return this.sessionToken;
+    return null;
   }
   /**
-   * Endpoint + bearer token for a TinyCloud auto-sign signing strategy.
-   * The endpoint is on the OpenKey API host and only signs requests the
-   * server-side bootstrap allowlist permits.
+   * Endpoint for a TinyCloud auto-sign signing strategy. `token` is always
+   * null; see {@link OpenKey.getSessionToken}.
+   *
+   * @deprecated The endpoint accepts an OAuth access token as its bearer.
    */
   tinycloudSigningOptions() {
     return {
       endpoint: `${this.oauthHost}/api/delegate/sign`,
-      token: this.sessionToken
+      token: null
     };
   }
   /**
@@ -769,8 +776,7 @@ var OpenKey = class {
         // context. The envelope is display-only; the widget transport
         // validates and size-bounds it before use and NEVER treats it as
         // verified unless the server actually origin-binds a manifest.
-        presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0
+        presentation: request.presentation
       },
       opts?.mode
     );
@@ -847,7 +853,6 @@ var OpenKey = class {
         // bounded at the transport, never treated as verified without
         // server-side origin-binding.
         presentation: request.presentation,
-        sessionToken: this.sessionToken || void 0,
         // Sol MAJOR-3 (continuation): tell the widget to hand us back
         // the previewApproval instead of asking OpenKey to sign
         // server-side with a managed key. The widget will still render
@@ -1001,15 +1006,13 @@ var OpenKey = class {
     return this.openFlow("sign", {
       type: "openkey:sign:request",
       message: request.message,
-      keyId: request.keyId,
-      sessionToken: this.sessionToken || void 0
+      keyId: request.keyId
     }, mode);
   }
   signTypedDataWithOpenKey(request, mode) {
     return this.openFlow("sign-typed-data", {
       type: "openkey:signTypedData:request",
-      data: request,
-      sessionToken: this.sessionToken || void 0
+      data: request
     }, mode);
   }
   toHex(str) {
@@ -1219,17 +1222,18 @@ var OpenKey = class {
     const mode = this.resolveMode(modeOverride);
     const origin = encodeURIComponent(window.location.origin);
     const eoaFlag = action === "connect" && this.hasDetectedEoa() ? "&hasEoa=true" : "";
+    const passkeysFlag = passkeysQueryFlag(this.passkeysSupported);
     if (mode === "popup") {
-      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}`;
+      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}${passkeysFlag}`;
       return new Promise((resolve, reject) => this.openPopup(action, url2, message, resolve, reject));
     }
     if (mode === "redirect") {
-      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}`;
+      const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}${passkeysFlag}`;
       window.location.href = url2;
       return new Promise(() => {
       });
     }
-    const url = `${this.host}/widget/embed/${action}?origin=${origin}${eoaFlag}`;
+    const url = `${this.host}/widget/embed/${action}?origin=${origin}${eoaFlag}${passkeysFlag}`;
     return this.openIframeModal(url, action, message, origin);
   }
   openIframeModal(url, action, message, origin) {
@@ -1295,7 +1299,6 @@ var OpenKey = class {
               cleanup();
               if (data.success) {
                 if (data.type === "openkey:auth:response") {
-                  if (data.sessionToken) this.sessionToken = data.sessionToken;
                   resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
                 } else if (data.type === "openkey:link-wallet:response") {
                   resolve({ address: data.address, keyId: data.keyId });
@@ -1336,7 +1339,7 @@ var OpenKey = class {
         cleanup();
         console.warn("OpenKey: iframe blocked by CSP, falling back to popup. Add frame-src https://openkey.so to your CSP.");
         showToast();
-        const popupUrl = `${this.host}/widget/${action}?origin=${origin}`;
+        const popupUrl = `${this.host}/widget/${action}?origin=${origin}${passkeysQueryFlag(this.passkeysSupported)}`;
         this.openPopup(action, popupUrl, message, (val) => settle(() => resolve(val)), (err) => settle(() => reject(err)));
       }, IFRAME_READY_TIMEOUT);
       const overallTimeout = setTimeout(() => {
@@ -1518,7 +1521,6 @@ var OpenKey = class {
           popup.close();
           if (data.success) {
             if (data.type === "openkey:auth:response") {
-              if (data.sessionToken) this.sessionToken = data.sessionToken;
               resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
             } else if (data.type === "openkey:link-wallet:response") {
               resolve({ address: data.address, keyId: data.keyId });
@@ -1641,6 +1643,7 @@ export {
   OpenKeyProvider,
   index_default as default,
   getOpenKey,
+  passkeysQueryFlag,
   resolveAuthorizeTinyCloudRouting,
   shouldRouteAuthorizeTinyCloudExternal,
   validateIframeResize