@terminal3/t3n-sdk 0.5.1 → 0.7.0

package/dist/src/client/actions.d.ts

@@ -15,3 +15,8 @@ export declare function createHandshakeAction(): Uint8Array;
  * @param authInput - The authentication input (Ethereum or OIDC)
  */
 export declare function createAuthAction(authInput: AuthInput): Uint8Array;
+/**
+ * Create the OIDC SubmitToken action for the second step of nonce-bound auth.
+ * @param idToken - The id_token JWT obtained from the OIDC provider with the nonce
+ */
+export declare function createOidcSubmitTokenAction(idToken: string): Uint8Array;

package/dist/src/client/t3n-client.d.ts

@@ -25,9 +25,27 @@ export declare class T3nClient {
      */
     handshake(): Promise<HandshakeResult>;
     /**
-     * Authenticate with the T3n node
+     * Authenticate with the T3n node.
+     *
+     * For OIDC, this runs a two-step nonce-bound flow:
+     * 1. Sends `InitOidcAuth` to server → receives session-binding nonce.
+     * 2. Calls `getIdToken(nonce)` callback so the app can include the
+     *    nonce in the Google authorization URL.
+     * 3. Sends `SubmitIdToken` with the nonce-bearing token → receives DID.
      */
     authenticate(authInput: AuthInput): Promise<Did>;
+    /**
+     * OIDC two-step authentication with session-binding nonce.
+     *
+     * Bypasses the WASM client state machine and makes two encrypted
+     * RPC calls directly:
+     * 1. `InitOidcAuth { provider }` → server generates nonce → returns
+     *    `ProvideNonce { nonce }`.
+     * 2. App calls `getIdToken(nonce)` to obtain a nonce-bound `id_token`.
+     * 3. `SubmitIdToken { id_token }` → server verifies token + nonce →
+     *    returns `Finish { did }`.
+     */
+    private authenticateOidc;
     /**
      * Execute an action on the T3n node
      */

package/dist/src/types/auth.d.ts

@@ -16,11 +16,16 @@ export interface EthereumSigner {
     signMessage(message: Uint8Array): Promise<Uint8Array>;
 }
 /**
- * OIDC credentials interface
+ * OIDC credentials interface.
+ *
+ * The TEE generates a session-binding nonce that must be included in
+ * the Google authorization URL (`&nonce=…`). The `getIdToken` callback
+ * receives this nonce and must return the `id_token` JWT obtained
+ * from the OIDC provider with the nonce baked into its claims.
  */
 export interface OidcCredentials {
     provider: string;
-    idToken: string;
+    getIdToken: (nonce: string) => Promise<string>;
 }
 /**
  * Base authentication input with method discriminator

package/dist/wasm/generated/interfaces/component-session-server-auth.d.ts

@@ -1,9 +1,10 @@
 /** @module Interface component:session/server-auth@0.1.0 **/
-export function next(state: State | undefined, action: HostToGuest): NewState;
+export function next(state: State | undefined, action: HostToGuest, policy: SiwePolicy): NewState;
 export function finish(state: State): Did;
 export type GuestToHost = Uint8Array;
 export type State = Uint8Array;
 export type HostToGuest = Uint8Array;
+export type SiwePolicy = Uint8Array;
 export type Did = Uint8Array;
 export type Error = Uint8Array;
 export interface NewState {