@tinycloud/web-sdk 3.9.0-beta.8 → 3.9.0-beta.9

package/dist/modules/tcw.d.ts

@@ -212,6 +212,8 @@ export declare class TinyCloudWeb {
     private signOutCount;
     /** The signer set with `setRuntimePermissionSigner`, with the session it was set for. */
     private runtimeSigner?;
+    /** Set when this instance's session was established through the configured OpenKey client; bound to that session like `runtimeSigner`. */
+    private openkeySession?;
     private signOutInFlight;
     private persistedRestoreBlocked;
     private signOutCleanupFailed;
@@ -488,6 +490,19 @@ export declare class TinyCloudWeb {
      * `requestPermissions` calls this; sign-in and session setup never do.
      */
     private runtimeMessageSigner;
+    /**
+     * Whether the OpenKey client may sign a runtime grant: always, unless there is POSITIVE evidence that it is not connected. It may sign when
+     * this instance's session was established through it (and is still the live session), or when its in-memory `lastAuth` is set (`connect()` ran
+     * on this client, for example because the app connected it after a restore), or when it exposes no `lastAuth` at all (a client shape this SDK
+     * does not know: today's behaviour, fail open). `lastAuth` is read here because nothing public says it: `@openkey/sdk` 0.12.2 declares
+     * `lastAuth = null`, sets it in `connect()` and clears it in `signOut()`; 0.9.0 declares it and sets it in `connect()` but has no `signOut`.
+     * `getSessionToken()` always answers null in 0.12.2 and `isConnected()` reads the OpenKey cookie, which can be true when `connect()` never ran
+     * on this page. web-sdk documents `@openkey/sdk` >= 0.12.2, so 0.12.2 is the lowest version this was checked against. The clean fix is
+     * `signMessage()` rejecting when not connected, in `@openkey/sdk`. Trade-off: an app that connects through a DIFFERENT OpenKey instance than
+     * `config.openkey.client`, or restores after an authorize-only sign-in, must call `openkey.connect()` on the configured client or
+     * `setRuntimePermissionSigner`.
+     */
+    private openkeyClientMaySign;
     /**
      * Sets the signer for runtime permission grants (`requestPermissions`, and the panel's "allow" buttons), or clears
      * it with no argument. For apps whose sign-in is not the SDK's OpenKey flow, for example a restored session whose

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/web-sdk",
-  "version": "3.9.0-beta.8",
+  "version": "3.9.0-beta.9",
   "description": "A set of tools and utilities to help you build your app with TinyCloud.",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",