TryMellon

Changelog

Release history for @trymellon/js. Published automatically via semantic-release on push to main.

  1. v3.7.0 New features

    B2B recovery SDK mapping

    • Added RECOVERY_USER_NOT_FOUND and RECOVERY_TICKET_LIMIT_EXCEEDED to TryMellonErrorCode union
    • Added WebhookEventType for recovery.enrollment.issued and recovery.enrollment.completed
    • Added RecoveryEnrollmentIssuedPayload and RecoveryEnrollmentCompletedPayload types
    • Exported new types from package barrel
    • Extracted BACKEND_ERROR_MAP to module-level for O(1) lookup on hot path
  2. v3.6.0 New features

    Web3 surface — SIWE + identity linking

    • Added client.siwe.{getNonce,prepareMessage,verifyAndSignIn} (preset web3 only)
    • Added client.identity.{linkEmail,verifyEmailLink,list,unlink} (preset web3 only)
    • Added preset: web3 to TryMellonConfig — narrows types at compile time
    • Added @trymellon/js/web3 sub-path for tree-shakeable web3 surface
    • Added prepareSiweMessage standalone export via sub-path
  3. v3.5.0 New features

    Action signing + DBSC session binding

    • Added client.action.sign(opts) — payloadHash SHA-256 hex, JWT 120s TTL
    • Added KP-DBSC-01 session binding via DeviceKeyVerifierImpl (ECDSA P-256)
    • Added client.getContextHash() — SHA-256 hex 64 of browser context
  4. v3.4.0 New features

    Offline JWT validation

    • Added client.session.verifyOffline(token) — WebCrypto, JWKS TTL 1h, clock skew ±30s
    • RS256 signature lock — rejects HS256 tokens
    • Flattens https://trymellon.dev/claims namespace to customClaims in SessionClaims
  5. v3.3.0 New features

    OIDC discovery + token introspection

    • Published JWKS at /.well-known/jwks.json with kid and RS256 alg
    • Added OIDC discovery at /.well-known/openid-configuration
    • Added token introspection endpoint RFC 7662 compatible
    • Added revocation push webhooks for session.revoked and credential.revoked