@asseteragmbh/wallet-connector 0.1.2 → 0.2.1

package/dist/index.js

@@ -1,6 +1,19 @@
-export { ProviderRpcError, createAsseteraWalletProvider } from './chunk-RWUB6EIS.js';
-import { isCaip2EvmChain, onboardUrl, isOnboardedMessage, isOnboardCancelledMessage } from './chunk-FRKTOKLC.js';
-export { CONNECT_PATH, MESSAGE_PREFIX, ONBOARD_PATH, PROTOCOL_VERSION, RpcErrorCode, SUPPORTED_METHODS, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSupportedMethod, onboardUrl } from './chunk-FRKTOKLC.js';
+export { ProviderRpcError, createAsseteraWalletProvider } from './chunk-YJHLKN7O.js';
+import { isCaip2EvmChain, onboardUrl, manageUrl, isOnboardedMessage, isOnboardCancelledMessage, isSecurityMessage, isResponseMessage, RpcErrorCode, PROTOCOL_VERSION, MESSAGE_PREFIX } from './chunk-H7PEM735.js';
+export { CONNECT_PATH, MANAGE_PATH, MESSAGE_PREFIX, ONBOARD_PATH, PROTOCOL_VERSION, RpcErrorCode, SIGN_IN_HINTS, SUPPORTED_METHODS, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSecurityMessage, isSignInHint, isSupportedMethod, manageUrl, onboardUrl } from './chunk-H7PEM735.js';
+
+// src/popup.ts
+var POPUP_WIDTH = 440;
+var POPUP_HEIGHT = 760;
+function defaultPopupFeatures(win) {
+  const screenX = Number.isFinite(win.screenX) ? win.screenX : 0;
+  const screenY = Number.isFinite(win.screenY) ? win.screenY : 0;
+  const outerWidth = Number.isFinite(win.outerWidth) ? win.outerWidth : POPUP_WIDTH;
+  const outerHeight = Number.isFinite(win.outerHeight) ? win.outerHeight : POPUP_HEIGHT;
+  const left = Math.max(0, Math.round(screenX + (outerWidth - POPUP_WIDTH) / 2));
+  const top = Math.max(0, Math.round(screenY + (outerHeight - POPUP_HEIGHT) / 2));
+  return `popup,width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top}`;
+}
 
 // src/onboarding.ts
 var OnboardingError = class extends Error {
@@ -12,8 +25,6 @@ var OnboardingError = class extends Error {
   }
 };
 var POPUP_NAME = "assetera-wallet-onboarding";
-var POPUP_WIDTH = 440;
-var POPUP_HEIGHT = 760;
 var CLOSE_POLL_MS = 500;
 var OVERLAY_Z_INDEX = 2147483e3;
 var DEFAULT_LABELS = {
@@ -23,15 +34,6 @@ var DEFAULT_LABELS = {
   cancel: "Cancel",
   blocked: "Your browser blocked the Assetera Wallet window. Allow pop-ups for this site and try again."
 };
-function defaultPopupFeatures(win) {
-  const screenX = Number.isFinite(win.screenX) ? win.screenX : 0;
-  const screenY = Number.isFinite(win.screenY) ? win.screenY : 0;
-  const outerWidth = Number.isFinite(win.outerWidth) ? win.outerWidth : POPUP_WIDTH;
-  const outerHeight = Number.isFinite(win.outerHeight) ? win.outerHeight : POPUP_HEIGHT;
-  const left = Math.max(0, Math.round(screenX + (outerWidth - POPUP_WIDTH) / 2));
-  const top = Math.max(0, Math.round(screenY + (outerHeight - POPUP_HEIGHT) / 2));
-  return `popup,width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top}`;
-}
 function resolveLabels(options) {
   const overrides = typeof options.overlay === "object" && options.overlay !== null ? options.overlay : {};
   const partnerName = options.partnerName;
@@ -153,7 +155,9 @@ function openAsseteraOnboarding(options) {
   const popup = targetWindow.open(
     onboardUrl(options.walletUrl, targetWindow.location.origin, {
       chain: options.chain,
-      ...options.locale === void 0 ? {} : { locale: options.locale }
+      ...options.locale === void 0 ? {} : { locale: options.locale },
+      ...options.addWallet ? { add: true } : {},
+      ...options.signIn === void 0 ? {} : { signIn: options.signIn }
     }),
     POPUP_NAME,
     options.popupFeatures ?? defaultPopupFeatures(targetWindow)
@@ -163,10 +167,13 @@ function openAsseteraOnboarding(options) {
   }
   const activePopup = popup;
   return new Promise((resolve, reject) => {
-    let settled = false;
+    let onboarded = false;
+    let finished = false;
     let closeTimer = null;
     let overlay = null;
+    const pending = /* @__PURE__ */ new Map();
     function cleanup() {
+      finished = true;
       targetWindow.removeEventListener("message", onMessage);
       if (closeTimer !== null) {
         clearInterval(closeTimer);
@@ -175,44 +182,98 @@ function openAsseteraOnboarding(options) {
       overlay?.remove();
       overlay = null;
     }
-    function settle(action) {
-      if (settled) return;
-      settled = true;
+    function failPending(error) {
+      for (const entry of pending.values()) entry.reject(error);
+      pending.clear();
+    }
+    function close() {
+      if (finished) return;
+      failPending(new OnboardingError("closed", "The Assetera Wallet window was closed."));
+      cleanup();
+      if (!activePopup.closed) activePopup.close();
+    }
+    function fail(error) {
+      if (onboarded || finished) return;
       cleanup();
-      action();
+      reject(error);
     }
     function cancel() {
+      if (onboarded) {
+        close();
+        return;
+      }
       activePopup.close();
-      settle(
-        () => reject(new OnboardingError("cancelled", "The user cancelled the Assetera Wallet onboarding."))
-      );
+      fail(new OnboardingError("cancelled", "The user cancelled the Assetera Wallet onboarding."));
+    }
+    function signMessage(message) {
+      if (finished || activePopup.closed) {
+        return Promise.reject(new OnboardingError("closed", "The Assetera Wallet window was closed."));
+      }
+      const id = globalThis.crypto.randomUUID();
+      const request = {
+        type: `${MESSAGE_PREFIX}request`,
+        v: PROTOCOL_VERSION,
+        id,
+        method: "personal_sign",
+        params: [message, address]
+      };
+      return new Promise((resolveSign, rejectSign) => {
+        pending.set(id, { resolve: resolveSign, reject: rejectSign });
+        activePopup.focus();
+        activePopup.postMessage(request, walletOrigin);
+      });
     }
+    let address;
     function onMessage(event) {
       if (event.origin !== walletOrigin) return;
       if (event.source !== activePopup) return;
       const data = event.data;
-      if (isOnboardedMessage(data)) {
-        settle(() => resolve({ address: data.address, chain: data.chain, status: data.status }));
+      if (!onboarded) {
+        if (isOnboardedMessage(data)) {
+          onboarded = true;
+          address = data.address;
+          resolve({
+            address: data.address,
+            chain: data.chain,
+            created: data.created ?? true,
+            signMessage,
+            close
+          });
+          return;
+        }
+        if (isOnboardCancelledMessage(data)) {
+          fail(new OnboardingError(cancelCode(data.reason), data.message ?? cancelMessage(data.reason)));
+        }
         return;
       }
-      if (isOnboardCancelledMessage(data)) {
-        settle(
-          () => reject(new OnboardingError(cancelCode(data.reason), data.message ?? cancelMessage(data.reason)))
-        );
+      if (isResponseMessage(data)) {
+        const entry = pending.get(data.id);
+        if (!entry) return;
+        pending.delete(data.id);
+        if ("error" in data) {
+          entry.reject(
+            new OnboardingError(
+              data.error.code === RpcErrorCode.UserRejected ? "cancelled" : "failed",
+              data.error.message
+            )
+          );
+        } else if (typeof data.result === "string" && /^0x[0-9a-fA-F]+$/.test(data.result)) {
+          entry.resolve(data.result);
+        } else {
+          entry.reject(new OnboardingError("failed", "The Assetera Wallet returned no signature."));
+        }
       }
     }
     targetWindow.addEventListener("message", onMessage);
     closeTimer = setInterval(() => {
-      if (activePopup.closed) {
-        settle(
-          () => reject(
-            new OnboardingError(
-              "closed",
-              "The Assetera Wallet window was closed before onboarding finished."
-            )
-          )
-        );
+      if (!activePopup.closed) return;
+      if (onboarded) {
+        close();
+        return;
       }
+      fail(
+        new OnboardingError("closed", "The Assetera Wallet window was closed before onboarding finished.")
+      );
     }, CLOSE_POLL_MS);
     if (overlayEnabled) {
       overlay = showOverlay(targetWindow, labels, {
@@ -223,6 +284,89 @@ function openAsseteraOnboarding(options) {
   });
 }
 
-export { OnboardingError, openAsseteraOnboarding };
+// src/manage.ts
+var ManagerError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ManagerError";
+    this.code = code;
+  }
+};
+var POPUP_NAME2 = "assetera-wallet-manage";
+var CLOSE_POLL_MS2 = 500;
+function openAsseteraWalletManager(options) {
+  const requestedWindow = options.window ?? (typeof window === "undefined" ? void 0 : window);
+  if (!requestedWindow) {
+    throw new ManagerError("invalid_options", "The Assetera Wallet manager can only run in a browser.");
+  }
+  const targetWindow = requestedWindow;
+  let walletOrigin;
+  try {
+    walletOrigin = new URL(options.walletUrl).origin;
+  } catch {
+    throw new ManagerError("invalid_options", `"${options.walletUrl}" is not a valid wallet URL.`);
+  }
+  const popup = targetWindow.open(
+    manageUrl(options.walletUrl, targetWindow.location.origin, {
+      ...options.locale === void 0 ? {} : { locale: options.locale },
+      ...options.signIn === void 0 ? {} : { signIn: options.signIn }
+    }),
+    POPUP_NAME2,
+    options.popupFeatures ?? defaultPopupFeatures(targetWindow)
+  );
+  if (!popup) {
+    throw new ManagerError(
+      "popup_blocked",
+      "Your browser blocked the Assetera Wallet window. Allow pop-ups for this site and try again."
+    );
+  }
+  const activePopup = popup;
+  let finished = false;
+  let lastSecurity;
+  let closeTimer = null;
+  let resolveClosed;
+  const closed = new Promise((resolve) => {
+    resolveClosed = resolve;
+  });
+  function cleanup() {
+    if (finished) return;
+    finished = true;
+    targetWindow.removeEventListener("message", onMessage);
+    if (closeTimer !== null) {
+      clearInterval(closeTimer);
+      closeTimer = null;
+    }
+    resolveClosed();
+  }
+  function close() {
+    cleanup();
+    if (!activePopup.closed) activePopup.close();
+  }
+  function onMessage(event) {
+    if (event.origin !== walletOrigin) return;
+    if (event.source !== activePopup) return;
+    const data = event.data;
+    if (!isSecurityMessage(data)) return;
+    const status = {
+      protection: data.data.protection,
+      passkeys: data.data.passkeys,
+      authenticatorApps: data.data.authenticatorApps
+    };
+    lastSecurity = status;
+    options.onSecurity?.(status);
+  }
+  targetWindow.addEventListener("message", onMessage);
+  closeTimer = setInterval(() => {
+    if (activePopup.closed) cleanup();
+  }, CLOSE_POLL_MS2);
+  return {
+    close,
+    closed,
+    lastSecurity: () => lastSecurity
+  };
+}
+
+export { ManagerError, OnboardingError, openAsseteraOnboarding, openAsseteraWalletManager };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/onboarding.ts"],"names":[],"mappings":";;;;;AAwBO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAChC,IAAA;AAAA,EAET,WAAA,CAAY,MAA2B,OAAA,EAAiB;AACtD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAoCA,IAAM,UAAA,GAAa,4BAAA;AACnB,IAAM,WAAA,GAAc,GAAA;AACpB,IAAM,YAAA,GAAe,GAAA;AACrB,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,eAAA,GAAkB,SAAA;AAExB,IAAM,cAAA,GAA0C;AAAA,EAC9C,KAAA,EAAO,wCAAA;AAAA,EACP,IAAA,EAAM,mHAAA;AAAA,EACN,KAAA,EAAO,wBAAA;AAAA,EACP,MAAA,EAAQ,QAAA;AAAA,EACR,OAAA,EAAS;AACX,CAAA;AAOA,SAAS,qBAAqB,GAAA,EAAqB;AACjD,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,IAAI,OAAO,CAAA,GAAI,IAAI,OAAA,GAAU,CAAA;AAC7D,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,IAAI,OAAO,CAAA,GAAI,IAAI,OAAA,GAAU,CAAA;AAC7D,EAAA,MAAM,aAAa,MAAA,CAAO,QAAA,CAAS,IAAI,UAAU,CAAA,GAAI,IAAI,UAAA,GAAa,WAAA;AACtE,EAAA,MAAM,cAAc,MAAA,CAAO,QAAA,CAAS,IAAI,WAAW,CAAA,GAAI,IAAI,WAAA,GAAc,YAAA;AACzE,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,MAAM,OAAA,GAAA,CAAW,UAAA,GAAa,WAAA,IAAe,CAAC,CAAC,CAAA;AAC7E,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,MAAM,OAAA,GAAA,CAAW,WAAA,GAAc,YAAA,IAAgB,CAAC,CAAC,CAAA;AAC9E,EAAA,OAAO,eAAe,WAAW,CAAA,QAAA,EAAW,YAAY,CAAA,MAAA,EAAS,IAAI,QAAQ,GAAG,CAAA,CAAA;AAClF;AAEA,SAAS,cAAc,OAAA,EAAqD;AAC1E,EAAA,MAAM,SAAA,GACJ,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAAY,QAAQ,OAAA,KAAY,IAAA,GAAO,OAAA,CAAQ,OAAA,GAAU,EAAC;AACvF,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA;AAC5B,EAAA,MAAM,WAAA,GAAc,WAAA,GAChB,CAAA,4CAAA,EAA+C,WAAW,+EAC1D,cAAA,CAAe,IAAA;AACnB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAA,CAAU,KAAA,IAAS,cAAA,CAAe,KAAA;AAAA,IACzC,IAAA,EAAM,UAAU,IAAA,IAAQ,WAAA;AAAA,IACxB,KAAA,EAAO,SAAA,CAAU,KAAA,IAAS,cAAA,CAAe,KAAA;AAAA,IACzC,MAAA,EAAQ,SAAA,CAAU,MAAA,IAAU,cAAA,CAAe,MAAA;AAAA,IAC3C,OAAA,EAAS,SAAA,CAAU,OAAA,IAAW,cAAA,CAAe;AAAA,GAC/C;AACF;AAEA,SAAS,WAAW,MAAA,EAAgE;AAClF,EAAA,IAAI,MAAA,KAAW,QAAQ,OAAO,WAAA;AAC9B,EAAA,IAAI,MAAA,KAAW,WAAW,OAAO,SAAA;AACjC,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,cAAc,MAAA,EAAmD;AACxE,EAAA,IAAI,MAAA,KAAW,QAAQ,OAAO,oDAAA;AAC9B,EAAA,IAAI,MAAA,KAAW,WAAW,OAAO,6CAAA;AACjC,EAAA,OAAO,wCAAA;AACT;AAMA,SAAS,WAAA,CAAY,GAAA,EAAa,MAAA,EAAiC,QAAA,EAAwC;AACzG,EAAA,MAAM,MAAM,GAAA,CAAI,QAAA;AAChB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA;AACpC,EAAA,IAAA,CAAK,YAAA,CAAa,QAAQ,QAAQ,CAAA;AAClC,EAAA,IAAA,CAAK,YAAA,CAAa,cAAc,MAAM,CAAA;AACtC,EAAA,IAAA,CAAK,YAAA,CAAa,oCAAoC,EAAE,CAAA;AACxD,EAAA,IAAA,CAAK,MAAM,OAAA,GAAU;AAAA,IACnB,iBAAA;AAAA,IACA,UAAA;AAAA,IACA,eAAA;AAAA,IACA,qBAAA;AAAA,IACA,yBAAA;AAAA,IACA,eAAA;AAAA,IACA,wBAAA;AAAA,IACA,gCAAA;AAAA,IACA,YAAY,eAAe,CAAA,CAAA;AAAA,IAC3B;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA;AACpC,EAAA,IAAA,CAAK,MAAM,OAAA,GAAU;AAAA,IACnB,wBAAA;AAAA,IACA,aAAA;AAAA,IACA,kBAAA;AAAA,IACA,qBAAA;AAAA,IACA,eAAA;AAAA,IACA,qBAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,aAAA,CAAc,IAAI,CAAA;AACpC,EAAA,KAAA,CAAM,cAAc,MAAA,CAAO,KAAA;AAC3B,EAAA,KAAA,CAAM,MAAM,OAAA,GAAU,wEAAA;AAEtB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,aAAA,CAAc,GAAG,CAAA;AAClC,EAAA,IAAA,CAAK,cAAc,MAAA,CAAO,IAAA;AAC1B,EAAA,IAAA,CAAK,MAAM,OAAA,GAAU,sEAAA;AAErB,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,aAAA,CAAc,QAAQ,CAAA;AACxC,EAAA,KAAA,CAAM,IAAA,GAAO,QAAA;AACb,EAAA,KAAA,CAAM,cAAc,MAAA,CAAO,KAAA;AAC3B,EAAA,KAAA,CAAM,MAAM,OAAA,GAAU;AAAA,IACpB,oBAAA;AAAA,IACA,WAAA;AAAA,IACA,qBAAA;AAAA,IACA,qBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,KAAA,CAAM,gBAAA,CAAiB,OAAA,EAAS,QAAA,CAAS,OAAO,CAAA;AAEhD,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,aAAA,CAAc,QAAQ,CAAA;AACzC,EAAA,MAAA,CAAO,IAAA,GAAO,QAAA;AACd,EAAA,MAAA,CAAO,cAAc,MAAA,CAAO,MAAA;AAC5B,EAAA,MAAA,CAAO,MAAM,OAAA,GAAU;AAAA,IACrB,oBAAA;AAAA,IACA,WAAA;AAAA,IACA,qBAAA;AAAA,IACA,yBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,QAAA,CAAS,QAAQ,CAAA;AAElD,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA;AACvC,EAAA,OAAA,CAAQ,MAAM,OAAA,GAAU,+CAAA;AACxB,EAAA,OAAA,CAAQ,MAAA,CAAO,OAAO,MAAM,CAAA;AAE5B,EAAA,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAChC,EAAA,IAAA,CAAK,OAAO,IAAI,CAAA;AAChB,EAAA,GAAA,CAAI,IAAA,CAAK,OAAO,IAAI,CAAA;AACpB,EAAA,OAAO,IAAA;AACT;AAaO,SAAS,uBAAuB,OAAA,EAAuD;AAC5F,EAAA,MAAM,kBAAkB,OAAA,CAAQ,MAAA,KAAW,OAAO,MAAA,KAAW,cAAc,MAAA,GAAY,MAAA,CAAA;AACvF,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,eAAA,CAAgB,iBAAA,EAAmB,2DAA2D;AAAA,KACpG;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAuB,eAAA;AAC7B,EAAA,IAAI,CAAC,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnC,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,eAAA;AAAA,QACF,iBAAA;AAAA,QACA,CAAA,CAAA,EAAI,QAAQ,KAAK,CAAA,4DAAA;AAAA;AACnB,KACF;AAAA,EACF;AACA,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,IAAI,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,CAAE,MAAA;AAAA,EAC5C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,eAAA,CAAgB,iBAAA,EAAmB,CAAA,CAAA,EAAI,OAAA,CAAQ,SAAS,CAAA,4BAAA,CAA8B;AAAA,KAC5F;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AACpC,EAAA,MAAM,cAAA,GAAiB,QAAQ,OAAA,KAAY,KAAA;AAG3C,EAAA,MAAM,QAAQ,YAAA,CAAa,IAAA;AAAA,IACzB,UAAA,CAAW,OAAA,CAAQ,SAAA,EAAW,YAAA,CAAa,SAAS,MAAA,EAAQ;AAAA,MAC1D,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA;AAAO,KAClE,CAAA;AAAA,IACD,UAAA;AAAA,IACA,OAAA,CAAQ,aAAA,IAAiB,oBAAA,CAAqB,YAAY;AAAA,GAC5D;AAEA,EAAA,IAAI,CAAC,KAAA,EAAO;AAEV,IAAA,OAAO,QAAQ,MAAA,CAAO,IAAI,gBAAgB,eAAA,EAAiB,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAsB,KAAA;AAE5B,EAAA,OAAO,IAAI,OAAA,CAA0B,CAAC,OAAA,EAAS,MAAA,KAAW;AACxD,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI,UAAA,GAAoD,IAAA;AACxD,IAAA,IAAI,OAAA,GAA8B,IAAA;AAElC,IAAA,SAAS,OAAA,GAAgB;AACvB,MAAA,YAAA,CAAa,mBAAA,CAAoB,WAAW,SAAS,CAAA;AACrD,MAAA,IAAI,eAAe,IAAA,EAAM;AACvB,QAAA,aAAA,CAAc,UAAU,CAAA;AACxB,QAAA,UAAA,GAAa,IAAA;AAAA,MACf;AACA,MAAA,OAAA,EAAS,MAAA,EAAO;AAChB,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ;AAEA,IAAA,SAAS,OAAO,MAAA,EAA0B;AACxC,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAA,EAAQ;AACR,MAAA,MAAA,EAAO;AAAA,IACT;AAEA,IAAA,SAAS,MAAA,GAAe;AACtB,MAAA,WAAA,CAAY,KAAA,EAAM;AAClB,MAAA,MAAA;AAAA,QAAO,MACL,MAAA,CAAO,IAAI,eAAA,CAAgB,WAAA,EAAa,oDAAoD,CAAC;AAAA,OAC/F;AAAA,IACF;AAEA,IAAA,SAAS,UAAU,KAAA,EAA2B;AAE5C,MAAA,IAAI,KAAA,CAAM,WAAW,YAAA,EAAc;AACnC,MAAA,IAAK,KAAA,CAAM,WAAuB,WAAA,EAAa;AAC/C,MAAA,MAAM,OAAgB,KAAA,CAAM,IAAA;AAC5B,MAAA,IAAI,kBAAA,CAAmB,IAAI,CAAA,EAAG;AAC5B,QAAA,MAAA,CAAO,MAAM,OAAA,CAAQ,EAAE,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAC,CAAA;AACvF,QAAA;AAAA,MACF;AACA,MAAA,IAAI,yBAAA,CAA0B,IAAI,CAAA,EAAG;AACnC,QAAA,MAAA;AAAA,UAAO,MACL,MAAA,CAAO,IAAI,eAAA,CAAgB,WAAW,IAAA,CAAK,MAAM,CAAA,EAAG,IAAA,CAAK,OAAA,IAAW,aAAA,CAAc,IAAA,CAAK,MAAM,CAAC,CAAC;AAAA,SACjG;AAAA,MACF;AAAA,IACF;AAEA,IAAA,YAAA,CAAa,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAClD,IAAA,UAAA,GAAa,YAAY,MAAM;AAC7B,MAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,QAAA,MAAA;AAAA,UAAO,MACL,MAAA;AAAA,YACE,IAAI,eAAA;AAAA,cACF,QAAA;AAAA,cACA;AAAA;AACF;AACF,SACF;AAAA,MACF;AAAA,IACF,GAAG,aAAa,CAAA;AAEhB,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,OAAA,GAAU,WAAA,CAAY,cAAc,MAAA,EAAQ;AAAA,QAC1C,OAAA,EAAS,MAAM,WAAA,CAAY,KAAA,EAAM;AAAA,QACjC,QAAA,EAAU;AAAA,OACX,CAAA;AAAA,IACH;AAAA,EACF,CAAC,CAAA;AACH","file":"index.js","sourcesContent":["/**\n * Onboarding opener for the Assetera Wallet: the partner side of the `/onboard` wizard (AO-1274).\n *\n * A tied-agent bank site shows a \"Create an Assetera wallet\" button. On the click, this module opens the wallet\n * pop-up in onboarding mode synchronously (so the browser treats it as part of the click) and waits for the\n * wizard to post the new wallet address back. While the pop-up is open the partner page shows a dimming\n * overlay; the overlay is plain DOM (no React, no CSS files) so any partner can drop this in.\n *\n * The wallet's `/onboard` page is the pop-up side and speaks the same protocol in `./protocol`, but it uses the\n * message types and the `ONBOARD_PATH` from there, so the two sides cannot drift apart.\n */\nimport {\n  isCaip2EvmChain,\n  isOnboardCancelledMessage,\n  isOnboardedMessage,\n  onboardUrl,\n  type OnboardCancelledMessage,\n} from \"./protocol\";\n\n/** Why {@link openAsseteraOnboarding} rejected. */\nexport type OnboardingErrorCode =\n  \"popup_blocked\" | \"closed\" | \"cancelled\" | \"refused\" | \"failed\" | \"invalid_options\";\n\n/** Error thrown (well, rejected) by {@link openAsseteraOnboarding}. `code` is stable and safe to branch on. */\nexport class OnboardingError extends Error {\n  readonly code: OnboardingErrorCode;\n\n  constructor(code: OnboardingErrorCode, message: string) {\n    super(message);\n    this.name = \"OnboardingError\";\n    this.code = code;\n  }\n}\n\n/** The wallet the wizard created. */\nexport interface OnboardingResult {\n  address: `0x${string}`;\n  chain: string;\n  status: \"approved\" | \"pending\";\n}\n\n/** Text of the dimming overlay, all optional. Any key left out keeps its English default. */\nexport interface OverlayLabels {\n  title?: string;\n  body?: string;\n  focus?: string;\n  cancel?: string;\n  blocked?: string;\n}\n\n/** Options for {@link openAsseteraOnboarding}. */\nexport interface OnboardingOptions {\n  /** Base URL of the wallet origin, e.g. `https://wallet.playground.assetera.com`. */\n  walletUrl: string;\n  /** CAIP-2 chain id the new wallet should be created on, e.g. `eip155:80002`. An invalid value rejects with `invalid_options`. */\n  chain: string;\n  /** Wizard language passed as `lang`, e.g. `\"en\"` or `\"de\"`. */\n  locale?: string;\n  /** `window.open` feature string. Defaults to a centred `\"popup,width=440,height=760,left=…,top=…\"`. */\n  popupFeatures?: string;\n  /** `true` (default) shows the dimming overlay, `false` hides it, an object overrides its text. */\n  overlay?: boolean | OverlayLabels;\n  /** Only used in the overlay text, e.g. `\"Musterbank\"`. */\n  partnerName?: string;\n  /** Injectable `window` for tests; defaults to `globalThis.window`. */\n  window?: Window;\n}\n\nconst POPUP_NAME = \"assetera-wallet-onboarding\";\nconst POPUP_WIDTH = 440;\nconst POPUP_HEIGHT = 760;\nconst CLOSE_POLL_MS = 500;\nconst OVERLAY_Z_INDEX = 2147483000;\n\nconst DEFAULT_LABELS: Required<OverlayLabels> = {\n  title: \"Continue in the Assetera Wallet window\",\n  body: \"A secure Assetera Wallet window is open. Follow the steps there. This page continues by itself when you are done.\",\n  focus: \"Show the wallet window\",\n  cancel: \"Cancel\",\n  blocked: \"Your browser blocked the Assetera Wallet window. Allow pop-ups for this site and try again.\",\n};\n\ninterface OverlayHandlers {\n  onFocus: () => void;\n  onCancel: () => void;\n}\n\nfunction defaultPopupFeatures(win: Window): string {\n  const screenX = Number.isFinite(win.screenX) ? win.screenX : 0;\n  const screenY = Number.isFinite(win.screenY) ? win.screenY : 0;\n  const outerWidth = Number.isFinite(win.outerWidth) ? win.outerWidth : POPUP_WIDTH;\n  const outerHeight = Number.isFinite(win.outerHeight) ? win.outerHeight : POPUP_HEIGHT;\n  const left = Math.max(0, Math.round(screenX + (outerWidth - POPUP_WIDTH) / 2));\n  const top = Math.max(0, Math.round(screenY + (outerHeight - POPUP_HEIGHT) / 2));\n  return `popup,width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top}`;\n}\n\nfunction resolveLabels(options: OnboardingOptions): Required<OverlayLabels> {\n  const overrides: OverlayLabels =\n    typeof options.overlay === \"object\" && options.overlay !== null ? options.overlay : {};\n  const partnerName = options.partnerName;\n  const defaultBody = partnerName\n    ? `A secure Assetera Wallet window is open for ${partnerName}. Follow the steps there. This page continues by itself when you are done.`\n    : DEFAULT_LABELS.body;\n  return {\n    title: overrides.title ?? DEFAULT_LABELS.title,\n    body: overrides.body ?? defaultBody,\n    focus: overrides.focus ?? DEFAULT_LABELS.focus,\n    cancel: overrides.cancel ?? DEFAULT_LABELS.cancel,\n    blocked: overrides.blocked ?? DEFAULT_LABELS.blocked,\n  };\n}\n\nfunction cancelCode(reason: OnboardCancelledMessage[\"reason\"]): OnboardingErrorCode {\n  if (reason === \"user\") return \"cancelled\";\n  if (reason === \"refused\") return \"refused\";\n  return \"failed\";\n}\n\nfunction cancelMessage(reason: OnboardCancelledMessage[\"reason\"]): string {\n  if (reason === \"user\") return \"The user cancelled the Assetera Wallet onboarding.\";\n  if (reason === \"refused\") return \"The Assetera Wallet refused the onboarding.\";\n  return \"The Assetera Wallet onboarding failed.\";\n}\n\n/**\n * Build the dimming overlay. Text is inserted with `textContent` only and every style is inline, so the\n * overlay cannot pick up partner CSS and cannot be scripted through an injected string.\n */\nfunction showOverlay(win: Window, labels: Required<OverlayLabels>, handlers: OverlayHandlers): HTMLElement {\n  const doc = win.document;\n  const root = doc.createElement(\"div\");\n  root.setAttribute(\"role\", \"dialog\");\n  root.setAttribute(\"aria-modal\", \"true\");\n  root.setAttribute(\"data-assetera-onboarding-overlay\", \"\");\n  root.style.cssText = [\n    \"position: fixed\",\n    \"inset: 0\",\n    \"display: flex\",\n    \"align-items: center\",\n    \"justify-content: center\",\n    \"padding: 24px\",\n    \"box-sizing: border-box\",\n    \"background: rgba(15,20,30,0.6)\",\n    `z-index: ${OVERLAY_Z_INDEX}`,\n    \"font-family: system-ui, -apple-system, 'Segoe UI', Roboto, sans-serif\",\n  ].join(\"; \");\n\n  const card = doc.createElement(\"div\");\n  card.style.cssText = [\n    \"box-sizing: border-box\",\n    \"width: 100%\",\n    \"max-width: 420px\",\n    \"border-radius: 16px\",\n    \"padding: 24px\",\n    \"background: #ffffff\",\n    \"color: #101828\",\n    \"box-shadow: 0 20px 50px rgba(0, 0, 0, 0.35)\",\n  ].join(\"; \");\n\n  const title = doc.createElement(\"h2\");\n  title.textContent = labels.title;\n  title.style.cssText = \"margin: 0 0 10px; font-size: 18px; line-height: 1.3; font-weight: 600;\";\n\n  const body = doc.createElement(\"p\");\n  body.textContent = labels.body;\n  body.style.cssText = \"margin: 0 0 20px; font-size: 14px; line-height: 1.5; color: #475467;\";\n\n  const focus = doc.createElement(\"button\");\n  focus.type = \"button\";\n  focus.textContent = labels.focus;\n  focus.style.cssText = [\n    \"padding: 10px 16px\",\n    \"border: 0\",\n    \"border-radius: 10px\",\n    \"background: #101828\",\n    \"color: #ffffff\",\n    \"font: inherit\",\n    \"font-weight: 600\",\n    \"cursor: pointer\",\n  ].join(\"; \");\n  focus.addEventListener(\"click\", handlers.onFocus);\n\n  const cancel = doc.createElement(\"button\");\n  cancel.type = \"button\";\n  cancel.textContent = labels.cancel;\n  cancel.style.cssText = [\n    \"padding: 10px 16px\",\n    \"border: 0\",\n    \"border-radius: 10px\",\n    \"background: transparent\",\n    \"color: #475467\",\n    \"font: inherit\",\n    \"cursor: pointer\",\n  ].join(\"; \");\n  cancel.addEventListener(\"click\", handlers.onCancel);\n\n  const actions = doc.createElement(\"div\");\n  actions.style.cssText = \"display: flex; gap: 8px; align-items: center;\";\n  actions.append(focus, cancel);\n\n  card.append(title, body, actions);\n  root.append(card);\n  doc.body.append(root);\n  return root;\n}\n\n/**\n * Open the Assetera Wallet onboarding wizard in a pop-up and resolve with the new wallet address.\n *\n * Call this from a user click (a button handler). `window.open` runs synchronously inside the call, before any\n * `await`, so the browser allows it; if the browser blocks the pop-up the promise rejects with\n * `OnboardingError(\"popup_blocked\")` and no overlay is shown.\n *\n * The promise rejects with `OnboardingError` and one of these codes: `invalid_options` (bad chain or wallet\n * URL), `popup_blocked`, `closed` (the pop-up was closed first), `cancelled` (the user cancelled in the wizard\n * or in the overlay), `refused` (the wallet refused the onboarding) or `failed` (anything else in the wallet).\n */\nexport function openAsseteraOnboarding(options: OnboardingOptions): Promise<OnboardingResult> {\n  const requestedWindow = options.window ?? (typeof window === \"undefined\" ? undefined : window);\n  if (!requestedWindow) {\n    return Promise.reject(\n      new OnboardingError(\"invalid_options\", \"The Assetera Wallet onboarding can only run in a browser.\"),\n    );\n  }\n  // A non-optional alias so TypeScript keeps the narrowed type inside the callbacks below.\n  const targetWindow: Window = requestedWindow;\n  if (!isCaip2EvmChain(options.chain)) {\n    return Promise.reject(\n      new OnboardingError(\n        \"invalid_options\",\n        `\"${options.chain}\" is not a CAIP-2 EVM chain id (for example \"eip155:80002\").`,\n      ),\n    );\n  }\n  let walletOrigin: string;\n  try {\n    walletOrigin = new URL(options.walletUrl).origin;\n  } catch {\n    return Promise.reject(\n      new OnboardingError(\"invalid_options\", `\"${options.walletUrl}\" is not a valid wallet URL.`),\n    );\n  }\n\n  const labels = resolveLabels(options);\n  const overlayEnabled = options.overlay !== false;\n\n  // MUST stay synchronous, before the first await, so the pop-up runs inside the caller's user activation.\n  const popup = targetWindow.open(\n    onboardUrl(options.walletUrl, targetWindow.location.origin, {\n      chain: options.chain,\n      ...(options.locale === undefined ? {} : { locale: options.locale }),\n    }),\n    POPUP_NAME,\n    options.popupFeatures ?? defaultPopupFeatures(targetWindow),\n  );\n\n  if (!popup) {\n    // Nothing was opened, so there is nothing to wait for and no overlay: the partner page stays usable.\n    return Promise.reject(new OnboardingError(\"popup_blocked\", labels.blocked));\n  }\n  // A non-optional alias so TypeScript keeps the narrowed type inside the callbacks below.\n  const activePopup: Window = popup;\n\n  return new Promise<OnboardingResult>((resolve, reject) => {\n    let settled = false;\n    let closeTimer: ReturnType<typeof setInterval> | null = null;\n    let overlay: HTMLElement | null = null;\n\n    function cleanup(): void {\n      targetWindow.removeEventListener(\"message\", onMessage);\n      if (closeTimer !== null) {\n        clearInterval(closeTimer);\n        closeTimer = null;\n      }\n      overlay?.remove();\n      overlay = null;\n    }\n\n    function settle(action: () => void): void {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      action();\n    }\n\n    function cancel(): void {\n      activePopup.close();\n      settle(() =>\n        reject(new OnboardingError(\"cancelled\", \"The user cancelled the Assetera Wallet onboarding.\")),\n      );\n    }\n\n    function onMessage(event: MessageEvent): void {\n      // Trust rule: accept only the wallet origin AND the exact pop-up we opened. Ignore everything else.\n      if (event.origin !== walletOrigin) return;\n      if ((event.source as unknown) !== activePopup) return;\n      const data: unknown = event.data;\n      if (isOnboardedMessage(data)) {\n        settle(() => resolve({ address: data.address, chain: data.chain, status: data.status }));\n        return;\n      }\n      if (isOnboardCancelledMessage(data)) {\n        settle(() =>\n          reject(new OnboardingError(cancelCode(data.reason), data.message ?? cancelMessage(data.reason))),\n        );\n      }\n    }\n\n    targetWindow.addEventListener(\"message\", onMessage);\n    closeTimer = setInterval(() => {\n      if (activePopup.closed) {\n        settle(() =>\n          reject(\n            new OnboardingError(\n              \"closed\",\n              \"The Assetera Wallet window was closed before onboarding finished.\",\n            ),\n          ),\n        );\n      }\n    }, CLOSE_POLL_MS);\n\n    if (overlayEnabled) {\n      overlay = showOverlay(targetWindow, labels, {\n        onFocus: () => activePopup.focus(),\n        onCancel: cancel,\n      });\n    }\n  });\n}\n"]}
+{"version":3,"sources":["../src/popup.ts","../src/onboarding.ts","../src/manage.ts"],"names":["POPUP_NAME","CLOSE_POLL_MS"],"mappings":";;;;;AAMO,IAAM,WAAA,GAAc,GAAA;AAGpB,IAAM,YAAA,GAAe,GAAA;AAMrB,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,IAAI,OAAO,CAAA,GAAI,IAAI,OAAA,GAAU,CAAA;AAC7D,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,IAAI,OAAO,CAAA,GAAI,IAAI,OAAA,GAAU,CAAA;AAC7D,EAAA,MAAM,aAAa,MAAA,CAAO,QAAA,CAAS,IAAI,UAAU,CAAA,GAAI,IAAI,UAAA,GAAa,WAAA;AACtE,EAAA,MAAM,cAAc,MAAA,CAAO,QAAA,CAAS,IAAI,WAAW,CAAA,GAAI,IAAI,WAAA,GAAc,YAAA;AACzE,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,MAAM,OAAA,GAAA,CAAW,UAAA,GAAa,WAAA,IAAe,CAAC,CAAC,CAAA;AAC7E,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,MAAM,OAAA,GAAA,CAAW,WAAA,GAAc,YAAA,IAAgB,CAAC,CAAC,CAAA;AAC9E,EAAA,OAAO,eAAe,WAAW,CAAA,QAAA,EAAW,YAAY,CAAA,MAAA,EAAS,IAAI,QAAQ,GAAG,CAAA,CAAA;AAClF;;;ACQO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAChC,IAAA;AAAA,EAET,WAAA,CAAY,MAA2B,OAAA,EAAiB;AACtD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAsDA,IAAM,UAAA,GAAa,4BAAA;AACnB,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,eAAA,GAAkB,SAAA;AAExB,IAAM,cAAA,GAA0C;AAAA,EAC9C,KAAA,EAAO,wCAAA;AAAA,EACP,IAAA,EAAM,mHAAA;AAAA,EACN,KAAA,EAAO,wBAAA;AAAA,EACP,MAAA,EAAQ,QAAA;AAAA,EACR,OAAA,EAAS;AACX,CAAA;AAOA,SAAS,cAAc,OAAA,EAAqD;AAC1E,EAAA,MAAM,SAAA,GACJ,OAAO,OAAA,CAAQ,OAAA,KAAY,QAAA,IAAY,QAAQ,OAAA,KAAY,IAAA,GAAO,OAAA,CAAQ,OAAA,GAAU,EAAC;AACvF,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA;AAC5B,EAAA,MAAM,WAAA,GAAc,WAAA,GAChB,CAAA,4CAAA,EAA+C,WAAW,+EAC1D,cAAA,CAAe,IAAA;AACnB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAA,CAAU,KAAA,IAAS,cAAA,CAAe,KAAA;AAAA,IACzC,IAAA,EAAM,UAAU,IAAA,IAAQ,WAAA;AAAA,IACxB,KAAA,EAAO,SAAA,CAAU,KAAA,IAAS,cAAA,CAAe,KAAA;AAAA,IACzC,MAAA,EAAQ,SAAA,CAAU,MAAA,IAAU,cAAA,CAAe,MAAA;AAAA,IAC3C,OAAA,EAAS,SAAA,CAAU,OAAA,IAAW,cAAA,CAAe;AAAA,GAC/C;AACF;AAEA,SAAS,WAAW,MAAA,EAAgE;AAClF,EAAA,IAAI,MAAA,KAAW,QAAQ,OAAO,WAAA;AAC9B,EAAA,IAAI,MAAA,KAAW,WAAW,OAAO,SAAA;AACjC,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,cAAc,MAAA,EAAmD;AACxE,EAAA,IAAI,MAAA,KAAW,QAAQ,OAAO,oDAAA;AAC9B,EAAA,IAAI,MAAA,KAAW,WAAW,OAAO,6CAAA;AACjC,EAAA,OAAO,wCAAA;AACT;AAMA,SAAS,WAAA,CAAY,GAAA,EAAa,MAAA,EAAiC,QAAA,EAAwC;AACzG,EAAA,MAAM,MAAM,GAAA,CAAI,QAAA;AAChB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA;AACpC,EAAA,IAAA,CAAK,YAAA,CAAa,QAAQ,QAAQ,CAAA;AAClC,EAAA,IAAA,CAAK,YAAA,CAAa,cAAc,MAAM,CAAA;AACtC,EAAA,IAAA,CAAK,YAAA,CAAa,oCAAoC,EAAE,CAAA;AACxD,EAAA,IAAA,CAAK,MAAM,OAAA,GAAU;AAAA,IACnB,iBAAA;AAAA,IACA,UAAA;AAAA,IACA,eAAA;AAAA,IACA,qBAAA;AAAA,IACA,yBAAA;AAAA,IACA,eAAA;AAAA,IACA,wBAAA;AAAA,IACA,gCAAA;AAAA,IACA,YAAY,eAAe,CAAA,CAAA;AAAA,IAC3B;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA;AACpC,EAAA,IAAA,CAAK,MAAM,OAAA,GAAU;AAAA,IACnB,wBAAA;AAAA,IACA,aAAA;AAAA,IACA,kBAAA;AAAA,IACA,qBAAA;AAAA,IACA,eAAA;AAAA,IACA,qBAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AAEX,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,aAAA,CAAc,IAAI,CAAA;AACpC,EAAA,KAAA,CAAM,cAAc,MAAA,CAAO,KAAA;AAC3B,EAAA,KAAA,CAAM,MAAM,OAAA,GAAU,wEAAA;AAEtB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,aAAA,CAAc,GAAG,CAAA;AAClC,EAAA,IAAA,CAAK,cAAc,MAAA,CAAO,IAAA;AAC1B,EAAA,IAAA,CAAK,MAAM,OAAA,GAAU,sEAAA;AAErB,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,aAAA,CAAc,QAAQ,CAAA;AACxC,EAAA,KAAA,CAAM,IAAA,GAAO,QAAA;AACb,EAAA,KAAA,CAAM,cAAc,MAAA,CAAO,KAAA;AAC3B,EAAA,KAAA,CAAM,MAAM,OAAA,GAAU;AAAA,IACpB,oBAAA;AAAA,IACA,WAAA;AAAA,IACA,qBAAA;AAAA,IACA,qBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,KAAA,CAAM,gBAAA,CAAiB,OAAA,EAAS,QAAA,CAAS,OAAO,CAAA;AAEhD,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,aAAA,CAAc,QAAQ,CAAA;AACzC,EAAA,MAAA,CAAO,IAAA,GAAO,QAAA;AACd,EAAA,MAAA,CAAO,cAAc,MAAA,CAAO,MAAA;AAC5B,EAAA,MAAA,CAAO,MAAM,OAAA,GAAU;AAAA,IACrB,oBAAA;AAAA,IACA,WAAA;AAAA,IACA,qBAAA;AAAA,IACA,yBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,QAAA,CAAS,QAAQ,CAAA;AAElD,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,aAAA,CAAc,KAAK,CAAA;AACvC,EAAA,OAAA,CAAQ,MAAM,OAAA,GAAU,+CAAA;AACxB,EAAA,OAAA,CAAQ,MAAA,CAAO,OAAO,MAAM,CAAA;AAE5B,EAAA,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAChC,EAAA,IAAA,CAAK,OAAO,IAAI,CAAA;AAChB,EAAA,GAAA,CAAI,IAAA,CAAK,OAAO,IAAI,CAAA;AACpB,EAAA,OAAO,IAAA;AACT;AAeO,SAAS,uBAAuB,OAAA,EAAuD;AAC5F,EAAA,MAAM,kBAAkB,OAAA,CAAQ,MAAA,KAAW,OAAO,MAAA,KAAW,cAAc,MAAA,GAAY,MAAA,CAAA;AACvF,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,eAAA,CAAgB,iBAAA,EAAmB,2DAA2D;AAAA,KACpG;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAuB,eAAA;AAC7B,EAAA,IAAI,CAAC,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA,EAAG;AACnC,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,eAAA;AAAA,QACF,iBAAA;AAAA,QACA,CAAA,CAAA,EAAI,QAAQ,KAAK,CAAA,4DAAA;AAAA;AACnB,KACF;AAAA,EACF;AACA,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,IAAI,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,CAAE,MAAA;AAAA,EAC5C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,eAAA,CAAgB,iBAAA,EAAmB,CAAA,CAAA,EAAI,OAAA,CAAQ,SAAS,CAAA,4BAAA,CAA8B;AAAA,KAC5F;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AACpC,EAAA,MAAM,cAAA,GAAiB,QAAQ,OAAA,KAAY,KAAA;AAG3C,EAAA,MAAM,QAAQ,YAAA,CAAa,IAAA;AAAA,IACzB,UAAA,CAAW,OAAA,CAAQ,SAAA,EAAW,YAAA,CAAa,SAAS,MAAA,EAAQ;AAAA,MAC1D,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO;AAAA,MACjE,GAAI,OAAA,CAAQ,SAAA,GAAY,EAAE,GAAA,EAAK,IAAA,KAAS,EAAC;AAAA,MACzC,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA;AAAO,KAClE,CAAA;AAAA,IACD,UAAA;AAAA,IACA,OAAA,CAAQ,aAAA,IAAiB,oBAAA,CAAqB,YAAY;AAAA,GAC5D;AAEA,EAAA,IAAI,CAAC,KAAA,EAAO;AAEV,IAAA,OAAO,QAAQ,MAAA,CAAO,IAAI,gBAAgB,eAAA,EAAiB,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAsB,KAAA;AAE5B,EAAA,OAAO,IAAI,OAAA,CAA0B,CAAC,OAAA,EAAS,MAAA,KAAW;AAExD,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,IAAI,UAAA,GAAoD,IAAA;AACxD,IAAA,IAAI,OAAA,GAA8B,IAAA;AAClC,IAAA,MAAM,OAAA,uBAAc,GAAA,EAGlB;AAEF,IAAA,SAAS,OAAA,GAAgB;AACvB,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,YAAA,CAAa,mBAAA,CAAoB,WAAW,SAAS,CAAA;AACrD,MAAA,IAAI,eAAe,IAAA,EAAM;AACvB,QAAA,aAAA,CAAc,UAAU,CAAA;AACxB,QAAA,UAAA,GAAa,IAAA;AAAA,MACf;AACA,MAAA,OAAA,EAAS,MAAA,EAAO;AAChB,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ;AAEA,IAAA,SAAS,YAAY,KAAA,EAA8B;AACjD,MAAA,KAAA,MAAW,SAAS,OAAA,CAAQ,MAAA,EAAO,EAAG,KAAA,CAAM,OAAO,KAAK,CAAA;AACxD,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB;AAEA,IAAA,SAAS,KAAA,GAAc;AACrB,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,WAAA,CAAY,IAAI,eAAA,CAAgB,QAAA,EAAU,wCAAwC,CAAC,CAAA;AACnF,MAAA,OAAA,EAAQ;AACR,MAAA,IAAI,CAAC,WAAA,CAAY,MAAA,EAAQ,WAAA,CAAY,KAAA,EAAM;AAAA,IAC7C;AAEA,IAAA,SAAS,KAAK,KAAA,EAA8B;AAC1C,MAAA,IAAI,aAAa,QAAA,EAAU;AAC3B,MAAA,OAAA,EAAQ;AACR,MAAA,MAAA,CAAO,KAAK,CAAA;AAAA,IACd;AAEA,IAAA,SAAS,MAAA,GAAe;AACtB,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,KAAA,EAAM;AACN,QAAA;AAAA,MACF;AACA,MAAA,WAAA,CAAY,KAAA,EAAM;AAClB,MAAA,IAAA,CAAK,IAAI,eAAA,CAAgB,WAAA,EAAa,oDAAoD,CAAC,CAAA;AAAA,IAC7F;AAEA,IAAA,SAAS,YAAY,OAAA,EAAyC;AAC5D,MAAA,IAAI,QAAA,IAAY,YAAY,MAAA,EAAQ;AAClC,QAAA,OAAO,QAAQ,MAAA,CAAO,IAAI,eAAA,CAAgB,QAAA,EAAU,wCAAwC,CAAC,CAAA;AAAA,MAC/F;AACA,MAAA,MAAM,EAAA,GAAK,UAAA,CAAW,MAAA,CAAO,UAAA,EAAW;AACxC,MAAA,MAAM,OAAA,GAA0B;AAAA,QAC9B,IAAA,EAAM,GAAG,cAAc,CAAA,OAAA,CAAA;AAAA,QACvB,CAAA,EAAG,gBAAA;AAAA,QACH,EAAA;AAAA,QACA,MAAA,EAAQ,eAAA;AAAA,QACR,MAAA,EAAQ,CAAC,OAAA,EAAS,OAAwB;AAAA,OAC5C;AACA,MAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,WAAA,EAAa,UAAA,KAAe;AAC9C,QAAA,OAAA,CAAQ,IAAI,EAAA,EAAI,EAAE,SAAS,WAAA,EAAa,MAAA,EAAQ,YAAY,CAAA;AAC5D,QAAA,WAAA,CAAY,KAAA,EAAM;AAClB,QAAA,WAAA,CAAY,WAAA,CAAY,SAAS,YAAY,CAAA;AAAA,MAC/C,CAAC,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,OAAA;AAEJ,IAAA,SAAS,UAAU,KAAA,EAA2B;AAE5C,MAAA,IAAI,KAAA,CAAM,WAAW,YAAA,EAAc;AACnC,MAAA,IAAK,KAAA,CAAM,WAAuB,WAAA,EAAa;AAC/C,MAAA,MAAM,OAAgB,KAAA,CAAM,IAAA;AAC5B,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAI,kBAAA,CAAmB,IAAI,CAAA,EAAG;AAC5B,UAAA,SAAA,GAAY,IAAA;AACZ,UAAA,OAAA,GAAU,IAAA,CAAK,OAAA;AACf,UAAA,OAAA,CAAQ;AAAA,YACN,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,OAAO,IAAA,CAAK,KAAA;AAAA,YACZ,OAAA,EAAS,KAAK,OAAA,IAAW,IAAA;AAAA,YACzB,WAAA;AAAA,YACA;AAAA,WACD,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,IAAI,yBAAA,CAA0B,IAAI,CAAA,EAAG;AACnC,UAAA,IAAA,CAAK,IAAI,eAAA,CAAgB,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG,IAAA,CAAK,OAAA,IAAW,aAAA,CAAc,IAAA,CAAK,MAAM,CAAC,CAAC,CAAA;AAAA,QAC/F;AACA,QAAA;AAAA,MACF;AACA,MAAA,IAAI,iBAAA,CAAkB,IAAI,CAAA,EAAG;AAC3B,QAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA;AACjC,QAAA,IAAI,CAAC,KAAA,EAAO;AACZ,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAK,EAAE,CAAA;AACtB,QAAA,IAAI,WAAW,IAAA,EAAM;AACnB,UAAA,KAAA,CAAM,MAAA;AAAA,YACJ,IAAI,eAAA;AAAA,cACF,IAAA,CAAK,KAAA,CAAM,IAAA,KAAS,YAAA,CAAa,eAAe,WAAA,GAAc,QAAA;AAAA,cAC9D,KAAK,KAAA,CAAM;AAAA;AACb,WACF;AAAA,QACF,CAAA,MAAA,IAAW,OAAO,IAAA,CAAK,MAAA,KAAW,YAAY,kBAAA,CAAmB,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,EAAG;AAClF,UAAA,KAAA,CAAM,OAAA,CAAQ,KAAK,MAAuB,CAAA;AAAA,QAC5C,CAAA,MAAO;AACL,UAAA,KAAA,CAAM,MAAA,CAAO,IAAI,eAAA,CAAgB,QAAA,EAAU,4CAA4C,CAAC,CAAA;AAAA,QAC1F;AAAA,MACF;AAAA,IACF;AAEA,IAAA,YAAA,CAAa,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAClD,IAAA,UAAA,GAAa,YAAY,MAAM;AAC7B,MAAA,IAAI,CAAC,YAAY,MAAA,EAAQ;AACzB,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,KAAA,EAAM;AACN,QAAA;AAAA,MACF;AACA,MAAA,IAAA;AAAA,QACE,IAAI,eAAA,CAAgB,QAAA,EAAU,mEAAmE;AAAA,OACnG;AAAA,IACF,GAAG,aAAa,CAAA;AAEhB,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,OAAA,GAAU,WAAA,CAAY,cAAc,MAAA,EAAQ;AAAA,QAC1C,OAAA,EAAS,MAAM,WAAA,CAAY,KAAA,EAAM;AAAA,QACjC,QAAA,EAAU;AAAA,OACX,CAAA;AAAA,IACH;AAAA,EACF,CAAC,CAAA;AACH;;;AC9YO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,IAAA;AAAA,EAET,WAAA,CAAY,MAAwB,OAAA,EAAiB;AACnD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AA4BA,IAAMA,WAAAA,GAAa,wBAAA;AACnB,IAAMC,cAAAA,GAAgB,GAAA;AAaf,SAAS,0BAA0B,OAAA,EAA8C;AACtF,EAAA,MAAM,kBAAkB,OAAA,CAAQ,MAAA,KAAW,OAAO,MAAA,KAAW,cAAc,MAAA,GAAY,MAAA,CAAA;AACvF,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,MAAM,IAAI,YAAA,CAAa,iBAAA,EAAmB,wDAAwD,CAAA;AAAA,EACpG;AAEA,EAAA,MAAM,YAAA,GAAuB,eAAA;AAC7B,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,IAAI,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA,CAAE,MAAA;AAAA,EAC5C,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,YAAA,CAAa,iBAAA,EAAmB,CAAA,CAAA,EAAI,OAAA,CAAQ,SAAS,CAAA,4BAAA,CAA8B,CAAA;AAAA,EAC/F;AAGA,EAAA,MAAM,QAAQ,YAAA,CAAa,IAAA;AAAA,IACzB,SAAA,CAAU,OAAA,CAAQ,SAAA,EAAW,YAAA,CAAa,SAAS,MAAA,EAAQ;AAAA,MACzD,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO;AAAA,MACjE,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAC,GAAI,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA;AAAO,KAClE,CAAA;AAAA,IACDD,WAAAA;AAAA,IACA,OAAA,CAAQ,aAAA,IAAiB,oBAAA,CAAqB,YAAY;AAAA,GAC5D;AAEA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,YAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,WAAA,GAAsB,KAAA;AAE5B,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,UAAA,GAAoD,IAAA;AACxD,EAAA,IAAI,aAAA;AACJ,EAAA,MAAM,MAAA,GAAS,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC5C,IAAA,aAAA,GAAgB,OAAA;AAAA,EAClB,CAAC,CAAA;AAED,EAAA,SAAS,OAAA,GAAgB;AACvB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,YAAA,CAAa,mBAAA,CAAoB,WAAW,SAAS,CAAA;AACrD,IAAA,IAAI,eAAe,IAAA,EAAM;AACvB,MAAA,aAAA,CAAc,UAAU,CAAA;AACxB,MAAA,UAAA,GAAa,IAAA;AAAA,IACf;AACA,IAAA,aAAA,EAAc;AAAA,EAChB;AAEA,EAAA,SAAS,KAAA,GAAc;AACrB,IAAA,OAAA,EAAQ;AACR,IAAA,IAAI,CAAC,WAAA,CAAY,MAAA,EAAQ,WAAA,CAAY,KAAA,EAAM;AAAA,EAC7C;AAEA,EAAA,SAAS,UAAU,KAAA,EAA2B;AAE5C,IAAA,IAAI,KAAA,CAAM,WAAW,YAAA,EAAc;AACnC,IAAA,IAAK,KAAA,CAAM,WAAuB,WAAA,EAAa;AAC/C,IAAA,MAAM,OAAgB,KAAA,CAAM,IAAA;AAC5B,IAAA,IAAI,CAAC,iBAAA,CAAkB,IAAI,CAAA,EAAG;AAC9B,IAAA,MAAM,MAAA,GAA+B;AAAA,MACnC,UAAA,EAAY,KAAK,IAAA,CAAK,UAAA;AAAA,MACtB,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,MACpB,iBAAA,EAAmB,KAAK,IAAA,CAAK;AAAA,KAC/B;AACA,IAAA,YAAA,GAAe,MAAA;AACf,IAAA,OAAA,CAAQ,aAAa,MAAM,CAAA;AAAA,EAC7B;AAEA,EAAA,YAAA,CAAa,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAClD,EAAA,UAAA,GAAa,YAAY,MAAM;AAC7B,IAAA,IAAI,WAAA,CAAY,QAAQ,OAAA,EAAQ;AAAA,EAClC,GAAGC,cAAa,CAAA;AAEhB,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,MAAA;AAAA,IACA,cAAc,MAAM;AAAA,GACtB;AACF","file":"index.js","sourcesContent":["/**\n * Small helpers shared by the pop-up openers in this package. They are internal and are not part of the public\n * API through `index.ts`.\n */\n\n/** Default width, in pixels, of the onboarding and manage pop-ups. */\nexport const POPUP_WIDTH = 440;\n\n/** Default height, in pixels, of the onboarding and manage pop-ups. */\nexport const POPUP_HEIGHT = 760;\n\n/**\n * Build the centred `window.open` feature string for a pop-up of the default size. `win` is the opener window:\n * the pop-up is centred over it, and safe defaults are used when the browser does not expose the geometry.\n */\nexport function defaultPopupFeatures(win: Window): string {\n  const screenX = Number.isFinite(win.screenX) ? win.screenX : 0;\n  const screenY = Number.isFinite(win.screenY) ? win.screenY : 0;\n  const outerWidth = Number.isFinite(win.outerWidth) ? win.outerWidth : POPUP_WIDTH;\n  const outerHeight = Number.isFinite(win.outerHeight) ? win.outerHeight : POPUP_HEIGHT;\n  const left = Math.max(0, Math.round(screenX + (outerWidth - POPUP_WIDTH) / 2));\n  const top = Math.max(0, Math.round(screenY + (outerHeight - POPUP_HEIGHT) / 2));\n  return `popup,width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top}`;\n}\n","/**\n * Onboarding opener for the Assetera Wallet: the partner side of the `/onboard` wizard (AO-1274).\n *\n * A tied-agent bank site shows a \"Create an Assetera wallet\" button. On the click, this module opens the wallet\n * pop-up in onboarding mode synchronously (so the browser treats it as part of the click) and waits for the\n * wizard to post the new wallet address back. While the pop-up is open the partner page shows a dimming\n * overlay; the overlay is plain DOM (no React, no CSS files) so any partner can drop this in.\n *\n * The wallet's `/onboard` page is the pop-up side and speaks the same protocol in `./protocol`, but it uses the\n * message types and the `ONBOARD_PATH` from there, so the two sides cannot drift apart.\n */\nimport {\n  MESSAGE_PREFIX,\n  PROTOCOL_VERSION,\n  RpcErrorCode,\n  isCaip2EvmChain,\n  isOnboardCancelledMessage,\n  isOnboardedMessage,\n  isResponseMessage,\n  onboardUrl,\n  type OnboardCancelledMessage,\n  type RequestMessage,\n  type SignInHint,\n} from \"./protocol\";\nimport { defaultPopupFeatures } from \"./popup\";\n\n/** Why {@link openAsseteraOnboarding} rejected. */\nexport type OnboardingErrorCode =\n  \"popup_blocked\" | \"closed\" | \"cancelled\" | \"refused\" | \"failed\" | \"invalid_options\";\n\n/** Error thrown (well, rejected) by {@link openAsseteraOnboarding}. `code` is stable and safe to branch on. */\nexport class OnboardingError extends Error {\n  readonly code: OnboardingErrorCode;\n\n  constructor(code: OnboardingErrorCode, message: string) {\n    super(message);\n    this.name = \"OnboardingError\";\n    this.code = code;\n  }\n}\n\n/**\n * The client's Assetera Wallet, with the pop-up still open.\n *\n * The wallet is NOT registered with any compliance service. A regulated partner registers it itself, like any\n * other wallet: fetch a challenge for `address`, pass it to `signMessage`, send the signature to its compliance\n * service, then call `close()`. Always call `close()`: it closes the pop-up and removes the overlay.\n */\nexport interface OnboardingResult {\n  address: `0x${string}`;\n  chain: string;\n  /** `true` when the wallet was created in this run, `false` when the client's existing wallet was returned. */\n  created: boolean;\n  /**\n   * Ask the client to sign `message` (EIP-191 `personal_sign`) with this wallet in the open pop-up. Rejects with\n   * `OnboardingError(\"cancelled\")` when the client declines, `\"closed\"` when the pop-up is gone, else `\"failed\"`.\n   */\n  signMessage: (message: string) => Promise<`0x${string}`>;\n  /** Close the pop-up and remove the overlay. Safe to call more than once. */\n  close: () => void;\n}\n\n/** Text of the dimming overlay, all optional. Any key left out keeps its English default. */\nexport interface OverlayLabels {\n  title?: string;\n  body?: string;\n  focus?: string;\n  cancel?: string;\n  blocked?: string;\n}\n\n/** Options for {@link openAsseteraOnboarding}. */\nexport interface OnboardingOptions {\n  /** Base URL of the wallet origin, e.g. `https://wallet.wallet-staging.assetera.com`. */\n  walletUrl: string;\n  /** CAIP-2 chain id the new wallet should be created on, e.g. `eip155:80002`. An invalid value rejects with `invalid_options`. */\n  chain: string;\n  /** Wizard language passed as `lang`, e.g. `\"en\"` or `\"de\"`. */\n  locale?: string;\n  /** `window.open` feature string. Defaults to a centred `\"popup,width=440,height=760,left=…,top=…\"`. */\n  popupFeatures?: string;\n  /** `true` (default) shows the dimming overlay, `false` hides it, an object overrides its text. */\n  overlay?: boolean | OverlayLabels;\n  /** Only used in the overlay text, e.g. `\"Musterbank\"`. */\n  partnerName?: string;\n  /** Ask for one more wallet even when the client already has one (\"Create another Assetera Wallet\"). */\n  addWallet?: boolean;\n  /** Sign-in hint passed as `signIn`, e.g. `\"assetera-marketplace\"`. Only a hint; the wallet may ignore it. */\n  signIn?: SignInHint;\n  /** Injectable `window` for tests; defaults to `globalThis.window`. */\n  window?: Window;\n}\n\nconst POPUP_NAME = \"assetera-wallet-onboarding\";\nconst CLOSE_POLL_MS = 500;\nconst OVERLAY_Z_INDEX = 2147483000;\n\nconst DEFAULT_LABELS: Required<OverlayLabels> = {\n  title: \"Continue in the Assetera Wallet window\",\n  body: \"A secure Assetera Wallet window is open. Follow the steps there. This page continues by itself when you are done.\",\n  focus: \"Show the wallet window\",\n  cancel: \"Cancel\",\n  blocked: \"Your browser blocked the Assetera Wallet window. Allow pop-ups for this site and try again.\",\n};\n\ninterface OverlayHandlers {\n  onFocus: () => void;\n  onCancel: () => void;\n}\n\nfunction resolveLabels(options: OnboardingOptions): Required<OverlayLabels> {\n  const overrides: OverlayLabels =\n    typeof options.overlay === \"object\" && options.overlay !== null ? options.overlay : {};\n  const partnerName = options.partnerName;\n  const defaultBody = partnerName\n    ? `A secure Assetera Wallet window is open for ${partnerName}. Follow the steps there. This page continues by itself when you are done.`\n    : DEFAULT_LABELS.body;\n  return {\n    title: overrides.title ?? DEFAULT_LABELS.title,\n    body: overrides.body ?? defaultBody,\n    focus: overrides.focus ?? DEFAULT_LABELS.focus,\n    cancel: overrides.cancel ?? DEFAULT_LABELS.cancel,\n    blocked: overrides.blocked ?? DEFAULT_LABELS.blocked,\n  };\n}\n\nfunction cancelCode(reason: OnboardCancelledMessage[\"reason\"]): OnboardingErrorCode {\n  if (reason === \"user\") return \"cancelled\";\n  if (reason === \"refused\") return \"refused\";\n  return \"failed\";\n}\n\nfunction cancelMessage(reason: OnboardCancelledMessage[\"reason\"]): string {\n  if (reason === \"user\") return \"The user cancelled the Assetera Wallet onboarding.\";\n  if (reason === \"refused\") return \"The Assetera Wallet refused the onboarding.\";\n  return \"The Assetera Wallet onboarding failed.\";\n}\n\n/**\n * Build the dimming overlay. Text is inserted with `textContent` only and every style is inline, so the\n * overlay cannot pick up partner CSS and cannot be scripted through an injected string.\n */\nfunction showOverlay(win: Window, labels: Required<OverlayLabels>, handlers: OverlayHandlers): HTMLElement {\n  const doc = win.document;\n  const root = doc.createElement(\"div\");\n  root.setAttribute(\"role\", \"dialog\");\n  root.setAttribute(\"aria-modal\", \"true\");\n  root.setAttribute(\"data-assetera-onboarding-overlay\", \"\");\n  root.style.cssText = [\n    \"position: fixed\",\n    \"inset: 0\",\n    \"display: flex\",\n    \"align-items: center\",\n    \"justify-content: center\",\n    \"padding: 24px\",\n    \"box-sizing: border-box\",\n    \"background: rgba(15,20,30,0.6)\",\n    `z-index: ${OVERLAY_Z_INDEX}`,\n    \"font-family: system-ui, -apple-system, 'Segoe UI', Roboto, sans-serif\",\n  ].join(\"; \");\n\n  const card = doc.createElement(\"div\");\n  card.style.cssText = [\n    \"box-sizing: border-box\",\n    \"width: 100%\",\n    \"max-width: 420px\",\n    \"border-radius: 16px\",\n    \"padding: 24px\",\n    \"background: #ffffff\",\n    \"color: #101828\",\n    \"box-shadow: 0 20px 50px rgba(0, 0, 0, 0.35)\",\n  ].join(\"; \");\n\n  const title = doc.createElement(\"h2\");\n  title.textContent = labels.title;\n  title.style.cssText = \"margin: 0 0 10px; font-size: 18px; line-height: 1.3; font-weight: 600;\";\n\n  const body = doc.createElement(\"p\");\n  body.textContent = labels.body;\n  body.style.cssText = \"margin: 0 0 20px; font-size: 14px; line-height: 1.5; color: #475467;\";\n\n  const focus = doc.createElement(\"button\");\n  focus.type = \"button\";\n  focus.textContent = labels.focus;\n  focus.style.cssText = [\n    \"padding: 10px 16px\",\n    \"border: 0\",\n    \"border-radius: 10px\",\n    \"background: #101828\",\n    \"color: #ffffff\",\n    \"font: inherit\",\n    \"font-weight: 600\",\n    \"cursor: pointer\",\n  ].join(\"; \");\n  focus.addEventListener(\"click\", handlers.onFocus);\n\n  const cancel = doc.createElement(\"button\");\n  cancel.type = \"button\";\n  cancel.textContent = labels.cancel;\n  cancel.style.cssText = [\n    \"padding: 10px 16px\",\n    \"border: 0\",\n    \"border-radius: 10px\",\n    \"background: transparent\",\n    \"color: #475467\",\n    \"font: inherit\",\n    \"cursor: pointer\",\n  ].join(\"; \");\n  cancel.addEventListener(\"click\", handlers.onCancel);\n\n  const actions = doc.createElement(\"div\");\n  actions.style.cssText = \"display: flex; gap: 8px; align-items: center;\";\n  actions.append(focus, cancel);\n\n  card.append(title, body, actions);\n  root.append(card);\n  doc.body.append(root);\n  return root;\n}\n\n/**\n * Open the Assetera Wallet onboarding wizard in a pop-up and resolve with the client's wallet, the pop-up still\n * open so the partner can ask for the ownership signature (see {@link OnboardingResult}).\n *\n * Call this from a user click (a button handler). `window.open` runs synchronously inside the call, before any\n * `await`, so the browser allows it; if the browser blocks the pop-up the promise rejects with\n * `OnboardingError(\"popup_blocked\")` and no overlay is shown.\n *\n * The promise rejects with `OnboardingError` and one of these codes: `invalid_options` (bad chain or wallet\n * URL), `popup_blocked`, `closed` (the pop-up was closed first), `cancelled` (the user cancelled in the wizard\n * or in the overlay), `refused` (the wallet refused the onboarding) or `failed` (anything else in the wallet).\n * After it resolved, the overlay stays until `close()`; closing the pop-up by hand also removes it.\n */\nexport function openAsseteraOnboarding(options: OnboardingOptions): Promise<OnboardingResult> {\n  const requestedWindow = options.window ?? (typeof window === \"undefined\" ? undefined : window);\n  if (!requestedWindow) {\n    return Promise.reject(\n      new OnboardingError(\"invalid_options\", \"The Assetera Wallet onboarding can only run in a browser.\"),\n    );\n  }\n  // A non-optional alias so TypeScript keeps the narrowed type inside the callbacks below.\n  const targetWindow: Window = requestedWindow;\n  if (!isCaip2EvmChain(options.chain)) {\n    return Promise.reject(\n      new OnboardingError(\n        \"invalid_options\",\n        `\"${options.chain}\" is not a CAIP-2 EVM chain id (for example \"eip155:80002\").`,\n      ),\n    );\n  }\n  let walletOrigin: string;\n  try {\n    walletOrigin = new URL(options.walletUrl).origin;\n  } catch {\n    return Promise.reject(\n      new OnboardingError(\"invalid_options\", `\"${options.walletUrl}\" is not a valid wallet URL.`),\n    );\n  }\n\n  const labels = resolveLabels(options);\n  const overlayEnabled = options.overlay !== false;\n\n  // MUST stay synchronous, before the first await, so the pop-up runs inside the caller's user activation.\n  const popup = targetWindow.open(\n    onboardUrl(options.walletUrl, targetWindow.location.origin, {\n      chain: options.chain,\n      ...(options.locale === undefined ? {} : { locale: options.locale }),\n      ...(options.addWallet ? { add: true } : {}),\n      ...(options.signIn === undefined ? {} : { signIn: options.signIn }),\n    }),\n    POPUP_NAME,\n    options.popupFeatures ?? defaultPopupFeatures(targetWindow),\n  );\n\n  if (!popup) {\n    // Nothing was opened, so there is nothing to wait for and no overlay: the partner page stays usable.\n    return Promise.reject(new OnboardingError(\"popup_blocked\", labels.blocked));\n  }\n  // A non-optional alias so TypeScript keeps the narrowed type inside the callbacks below.\n  const activePopup: Window = popup;\n\n  return new Promise<OnboardingResult>((resolve, reject) => {\n    // Phase 1 waits for `onboarded`; phase 2 (after it) keeps the pop-up for signature requests until `close()`.\n    let onboarded = false;\n    let finished = false;\n    let closeTimer: ReturnType<typeof setInterval> | null = null;\n    let overlay: HTMLElement | null = null;\n    const pending = new Map<\n      string,\n      { resolve: (signature: `0x${string}`) => void; reject: (error: OnboardingError) => void }\n    >();\n\n    function cleanup(): void {\n      finished = true;\n      targetWindow.removeEventListener(\"message\", onMessage);\n      if (closeTimer !== null) {\n        clearInterval(closeTimer);\n        closeTimer = null;\n      }\n      overlay?.remove();\n      overlay = null;\n    }\n\n    function failPending(error: OnboardingError): void {\n      for (const entry of pending.values()) entry.reject(error);\n      pending.clear();\n    }\n\n    function close(): void {\n      if (finished) return;\n      failPending(new OnboardingError(\"closed\", \"The Assetera Wallet window was closed.\"));\n      cleanup();\n      if (!activePopup.closed) activePopup.close();\n    }\n\n    function fail(error: OnboardingError): void {\n      if (onboarded || finished) return;\n      cleanup();\n      reject(error);\n    }\n\n    function cancel(): void {\n      if (onboarded) {\n        close();\n        return;\n      }\n      activePopup.close();\n      fail(new OnboardingError(\"cancelled\", \"The user cancelled the Assetera Wallet onboarding.\"));\n    }\n\n    function signMessage(message: string): Promise<`0x${string}`> {\n      if (finished || activePopup.closed) {\n        return Promise.reject(new OnboardingError(\"closed\", \"The Assetera Wallet window was closed.\"));\n      }\n      const id = globalThis.crypto.randomUUID();\n      const request: RequestMessage = {\n        type: `${MESSAGE_PREFIX}request`,\n        v: PROTOCOL_VERSION,\n        id,\n        method: \"personal_sign\",\n        params: [message, address as `0x${string}`],\n      };\n      return new Promise((resolveSign, rejectSign) => {\n        pending.set(id, { resolve: resolveSign, reject: rejectSign });\n        activePopup.focus();\n        activePopup.postMessage(request, walletOrigin);\n      });\n    }\n\n    // Set with `onboarded`; `signMessage` is only handed out after that.\n    let address: `0x${string}` | undefined;\n\n    function onMessage(event: MessageEvent): void {\n      // Trust rule: accept only the wallet origin AND the exact pop-up we opened. Ignore everything else.\n      if (event.origin !== walletOrigin) return;\n      if ((event.source as unknown) !== activePopup) return;\n      const data: unknown = event.data;\n      if (!onboarded) {\n        if (isOnboardedMessage(data)) {\n          onboarded = true;\n          address = data.address;\n          resolve({\n            address: data.address,\n            chain: data.chain,\n            created: data.created ?? true,\n            signMessage,\n            close,\n          });\n          return;\n        }\n        if (isOnboardCancelledMessage(data)) {\n          fail(new OnboardingError(cancelCode(data.reason), data.message ?? cancelMessage(data.reason)));\n        }\n        return;\n      }\n      if (isResponseMessage(data)) {\n        const entry = pending.get(data.id);\n        if (!entry) return;\n        pending.delete(data.id);\n        if (\"error\" in data) {\n          entry.reject(\n            new OnboardingError(\n              data.error.code === RpcErrorCode.UserRejected ? \"cancelled\" : \"failed\",\n              data.error.message,\n            ),\n          );\n        } else if (typeof data.result === \"string\" && /^0x[0-9a-fA-F]+$/.test(data.result)) {\n          entry.resolve(data.result as `0x${string}`);\n        } else {\n          entry.reject(new OnboardingError(\"failed\", \"The Assetera Wallet returned no signature.\"));\n        }\n      }\n    }\n\n    targetWindow.addEventListener(\"message\", onMessage);\n    closeTimer = setInterval(() => {\n      if (!activePopup.closed) return;\n      if (onboarded) {\n        close();\n        return;\n      }\n      fail(\n        new OnboardingError(\"closed\", \"The Assetera Wallet window was closed before onboarding finished.\"),\n      );\n    }, CLOSE_POLL_MS);\n\n    if (overlayEnabled) {\n      overlay = showOverlay(targetWindow, labels, {\n        onFocus: () => activePopup.focus(),\n        onCancel: cancel,\n      });\n    }\n  });\n}\n","/**\n * Manage-wallet opener for the Assetera Wallet: the partner side of the `/manage` pop-up (AO-1436).\n *\n * A partner page shows a \"Manage wallet\" button. On the click this module opens the wallet pop-up on the manage\n * route synchronously (so the browser treats it as part of the click). The client sees the wallet accounts and\n * the wallet security (passkeys, authenticator app, recovery codes) and can change them. The pop-up never\n * answers `request` messages; it posts `security` messages while it is open.\n */\nimport { isSecurityMessage, manageUrl, type SignInHint, type WalletSecurityStatus } from \"./protocol\";\nimport { defaultPopupFeatures } from \"./popup\";\n\n/** Why {@link openAsseteraWalletManager} threw. */\nexport type ManagerErrorCode = \"popup_blocked\" | \"invalid_options\";\n\n/** Error thrown by {@link openAsseteraWalletManager}. `code` is stable and safe to branch on. */\nexport class ManagerError extends Error {\n  readonly code: ManagerErrorCode;\n\n  constructor(code: ManagerErrorCode, message: string) {\n    super(message);\n    this.name = \"ManagerError\";\n    this.code = code;\n  }\n}\n\n/** Options for {@link openAsseteraWalletManager}. */\nexport interface WalletManagerOptions {\n  /** Base URL of the wallet origin, e.g. `https://wallet.wallet-staging.assetera.com`. */\n  walletUrl: string;\n  /** Sign-in hint passed as `signIn`, e.g. `\"assetera-marketplace\"`. Only a hint; the wallet may ignore it. */\n  signIn?: SignInHint;\n  /** Language passed as `lang`, e.g. `\"en\"` or `\"de\"`. */\n  locale?: string;\n  /** `window.open` feature string. Defaults to a centred `\"popup,width=440,height=760,left=…,top=…\"`. */\n  popupFeatures?: string;\n  /** Called for every `security` message from the pop-up. */\n  onSecurity?: (status: WalletSecurityStatus) => void;\n  /** Injectable `window` for tests; defaults to `globalThis.window`. */\n  window?: Window;\n}\n\n/** The open manage pop-up, controlled by the partner. */\nexport interface WalletManager {\n  /** Close the pop-up and remove the listener and the close timer. Safe to call more than once. */\n  close: () => void;\n  /** Resolves when the pop-up is closed, by the partner or by the client. */\n  closed: Promise<void>;\n  /** The last security status the pop-up sent, or `undefined` when none arrived yet. */\n  lastSecurity: () => WalletSecurityStatus | undefined;\n}\n\nconst POPUP_NAME = \"assetera-wallet-manage\";\nconst CLOSE_POLL_MS = 500;\n\n/**\n * Open the manage-wallet pop-up for the Assetera Wallet and return a handle to it.\n *\n * Call this from a user click (a button handler). `window.open` runs synchronously inside the call, before any\n * `await`, so the browser allows it; when the browser blocks the pop-up this throws `ManagerError` with code\n * `popup_blocked`.\n *\n * The pop-up checks the `origin` query parameter against the wallet's partner list, posts `ready` to\n * `window.opener` and then posts `security` messages. Messages are accepted only when they come from the wallet\n * origin AND from the pop-up that was opened here. The pop-up does not answer `request` messages.\n */\nexport function openAsseteraWalletManager(options: WalletManagerOptions): WalletManager {\n  const requestedWindow = options.window ?? (typeof window === \"undefined\" ? undefined : window);\n  if (!requestedWindow) {\n    throw new ManagerError(\"invalid_options\", \"The Assetera Wallet manager can only run in a browser.\");\n  }\n  // A non-optional alias so TypeScript keeps the narrowed type inside the callbacks below.\n  const targetWindow: Window = requestedWindow;\n  let walletOrigin: string;\n  try {\n    walletOrigin = new URL(options.walletUrl).origin;\n  } catch {\n    throw new ManagerError(\"invalid_options\", `\"${options.walletUrl}\" is not a valid wallet URL.`);\n  }\n\n  // MUST stay synchronous, before any await, so the pop-up runs inside the caller's user activation.\n  const popup = targetWindow.open(\n    manageUrl(options.walletUrl, targetWindow.location.origin, {\n      ...(options.locale === undefined ? {} : { locale: options.locale }),\n      ...(options.signIn === undefined ? {} : { signIn: options.signIn }),\n    }),\n    POPUP_NAME,\n    options.popupFeatures ?? defaultPopupFeatures(targetWindow),\n  );\n\n  if (!popup) {\n    throw new ManagerError(\n      \"popup_blocked\",\n      \"Your browser blocked the Assetera Wallet window. Allow pop-ups for this site and try again.\",\n    );\n  }\n  // A non-optional alias so TypeScript keeps the narrowed type inside the callbacks below.\n  const activePopup: Window = popup;\n\n  let finished = false;\n  let lastSecurity: WalletSecurityStatus | undefined;\n  let closeTimer: ReturnType<typeof setInterval> | null = null;\n  let resolveClosed!: () => void;\n  const closed = new Promise<void>((resolve) => {\n    resolveClosed = resolve;\n  });\n\n  function cleanup(): void {\n    if (finished) return;\n    finished = true;\n    targetWindow.removeEventListener(\"message\", onMessage);\n    if (closeTimer !== null) {\n      clearInterval(closeTimer);\n      closeTimer = null;\n    }\n    resolveClosed();\n  }\n\n  function close(): void {\n    cleanup();\n    if (!activePopup.closed) activePopup.close();\n  }\n\n  function onMessage(event: MessageEvent): void {\n    // Trust rule: accept only the wallet origin AND the exact pop-up we opened. Ignore everything else.\n    if (event.origin !== walletOrigin) return;\n    if ((event.source as unknown) !== activePopup) return;\n    const data: unknown = event.data;\n    if (!isSecurityMessage(data)) return;\n    const status: WalletSecurityStatus = {\n      protection: data.data.protection,\n      passkeys: data.data.passkeys,\n      authenticatorApps: data.data.authenticatorApps,\n    };\n    lastSecurity = status;\n    options.onSecurity?.(status);\n  }\n\n  targetWindow.addEventListener(\"message\", onMessage);\n  closeTimer = setInterval(() => {\n    if (activePopup.closed) cleanup();\n  }, CLOSE_POLL_MS);\n\n  return {\n    close,\n    closed,\n    lastSecurity: () => lastSecurity,\n  };\n}\n"]}

package/dist/protocol.cjs

@@ -4,6 +4,11 @@
 var PROTOCOL_VERSION = 1;
 var CONNECT_PATH = "/connect";
 var ONBOARD_PATH = "/onboard";
+var MANAGE_PATH = "/manage";
+var SIGN_IN_HINTS = ["assetera-marketplace"];
+function isSignInHint(value) {
+  return SIGN_IN_HINTS.includes(value);
+}
 var MESSAGE_PREFIX = "assetera-wallet:";
 var SUPPORTED_METHODS = [
   "eth_requestAccounts",
@@ -48,6 +53,21 @@ function isResponseMessage(value) {
 function isEventMessage(value) {
   return hasType(value, "event") && (value.event === "accountsChanged" || value.event === "chainChanged" || value.event === "disconnect");
 }
+var WALLET_PROTECTIONS = [
+  "unknown",
+  "add-factor",
+  "save-codes",
+  "create-codes",
+  "protected"
+];
+function isCount(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function isSecurityMessage(value) {
+  if (!hasType(value, "security")) return false;
+  const data = value.data;
+  return isRecord(data) && typeof data.protection === "string" && WALLET_PROTECTIONS.includes(data.protection) && isCount(data.passkeys) && isCount(data.authenticatorApps);
+}
 function isRequestMessage(value) {
   return hasType(value, "request") && typeof value.id === "string" && typeof value.method === "string";
 }
@@ -56,7 +76,8 @@ function isDisconnectMessage(value) {
 }
 var EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 function isOnboardedMessage(value) {
-  return hasType(value, "onboarded") && typeof value.address === "string" && EVM_ADDRESS_RE.test(value.address) && typeof value.chain === "string" && (value.status === "approved" || value.status === "pending");
+  return hasType(value, "onboarded") && typeof value.address === "string" && EVM_ADDRESS_RE.test(value.address) && typeof value.chain === "string" && // `created` is new; an older wallet sent `status` instead and always created or reused a wallet.
+  (typeof value.created === "boolean" || value.status === "approved" || value.status === "pending");
 }
 function isOnboardCancelledMessage(value) {
   return hasType(value, "onboard-cancelled") && (value.reason === "user" || value.reason === "refused" || value.reason === "error");
@@ -64,10 +85,11 @@ function isOnboardCancelledMessage(value) {
 function isCaip2EvmChain(value) {
   return /^eip155:\d{1,32}$/.test(value);
 }
-function connectUrl(walletUrl, partnerOrigin) {
+function connectUrl(walletUrl, partnerOrigin, signIn) {
   const url = new URL(CONNECT_PATH, walletUrl);
   url.searchParams.set("origin", partnerOrigin);
   url.searchParams.set("v", String(PROTOCOL_VERSION));
+  if (signIn !== void 0) url.searchParams.set("signIn", signIn);
   return url.toString();
 }
 function onboardUrl(walletUrl, partnerOrigin, options) {
@@ -76,14 +98,26 @@ function onboardUrl(walletUrl, partnerOrigin, options) {
   url.searchParams.set("v", String(PROTOCOL_VERSION));
   url.searchParams.set("chain", options.chain);
   if (options.locale !== void 0) url.searchParams.set("lang", options.locale);
+  if (options.add) url.searchParams.set("add", "1");
+  if (options.signIn !== void 0) url.searchParams.set("signIn", options.signIn);
+  return url.toString();
+}
+function manageUrl(walletUrl, partnerOrigin, options = {}) {
+  const url = new URL(MANAGE_PATH, walletUrl);
+  url.searchParams.set("origin", partnerOrigin);
+  url.searchParams.set("v", String(PROTOCOL_VERSION));
+  if (options.locale !== void 0) url.searchParams.set("lang", options.locale);
+  if (options.signIn !== void 0) url.searchParams.set("signIn", options.signIn);
   return url.toString();
 }
 
 exports.CONNECT_PATH = CONNECT_PATH;
+exports.MANAGE_PATH = MANAGE_PATH;
 exports.MESSAGE_PREFIX = MESSAGE_PREFIX;
 exports.ONBOARD_PATH = ONBOARD_PATH;
 exports.PROTOCOL_VERSION = PROTOCOL_VERSION;
 exports.RpcErrorCode = RpcErrorCode;
+exports.SIGN_IN_HINTS = SIGN_IN_HINTS;
 exports.SUPPORTED_METHODS = SUPPORTED_METHODS;
 exports.connectUrl = connectUrl;
 exports.isCaip2EvmChain = isCaip2EvmChain;
@@ -94,7 +128,10 @@ exports.isOnboardedMessage = isOnboardedMessage;
 exports.isReadyMessage = isReadyMessage;
 exports.isRequestMessage = isRequestMessage;
 exports.isResponseMessage = isResponseMessage;
+exports.isSecurityMessage = isSecurityMessage;
+exports.isSignInHint = isSignInHint;
 exports.isSupportedMethod = isSupportedMethod;
+exports.manageUrl = manageUrl;
 exports.onboardUrl = onboardUrl;
 //# sourceMappingURL=protocol.cjs.map
 //# sourceMappingURL=protocol.cjs.map

package/dist/protocol.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/protocol.ts"],"names":[],"mappings":";;;AAqCO,IAAM,gBAAA,GAAmB;AAGzB,IAAM,YAAA,GAAe;AAGrB,IAAM,YAAA,GAAe;AAGrB,IAAM,cAAA,GAAiB;AAMvB,IAAM,iBAAA,GAAoB;AAAA,EAC/B,qBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,4BAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA;AACF;AAIO,SAAS,kBAAkB,MAAA,EAA2C;AAC3E,EAAA,OAAQ,iBAAA,CAAwC,SAAS,MAAM,CAAA;AACjE;AAGO,IAAM,YAAA,GAAe;AAAA;AAAA,EAE1B,YAAA,EAAc,IAAA;AAAA;AAAA,EAEd,YAAA,EAAc,IAAA;AAAA;AAAA,EAEd,iBAAA,EAAmB,IAAA;AAAA;AAAA,EAEnB,YAAA,EAAc,IAAA;AAAA;AAAA,EAEd,iBAAA,EAAmB,IAAA;AAAA;AAAA,EAEnB,aAAA,EAAe,MAAA;AAAA;AAAA,EAEf,QAAA,EAAU;AACZ;AA2FA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA;AAChD;AAEA,SAAS,OAAA,CAAQ,OAAgB,MAAA,EAAkD;AACjF,EAAA,OAAO,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,KAAS,CAAA,EAAG,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,IAAM,KAAA,CAAM,CAAA,KAAM,gBAAA;AACvF;AAEO,SAAS,eAAe,KAAA,EAAuC;AACpE,EAAA,OAAO,OAAA,CAAQ,OAAO,OAAO,CAAA;AAC/B;AAEO,SAAS,kBAAkB,KAAA,EAA0C;AAC1E,EAAA,OACE,QAAQ,KAAA,EAAO,UAAU,CAAA,IACzB,OAAO,MAAM,EAAA,KAAO,QAAA,KACnB,QAAA,IAAY,KAAA,IAAU,SAAS,KAAA,CAAM,KAAK,KAAK,OAAO,KAAA,CAAM,MAAM,IAAA,KAAS,QAAA,CAAA;AAEhF;AAEO,SAAS,eAAe,KAAA,EAAuC;AACpE,EAAA,OACE,OAAA,CAAQ,KAAA,EAAO,OAAO,CAAA,KACrB,KAAA,CAAM,KAAA,KAAU,iBAAA,IAAqB,KAAA,CAAM,KAAA,KAAU,cAAA,IAAkB,KAAA,CAAM,KAAA,KAAU,YAAA,CAAA;AAE5F;AAEO,SAAS,iBAAiB,KAAA,EAAyC;AACxE,EAAA,OAAO,OAAA,CAAQ,KAAA,EAAO,SAAS,CAAA,IAAK,OAAO,MAAM,EAAA,KAAO,QAAA,IAAY,OAAO,KAAA,CAAM,MAAA,KAAW,QAAA;AAC9F;AAEO,SAAS,oBAAoB,KAAA,EAA4C;AAC9E,EAAA,OAAO,OAAA,CAAQ,OAAO,YAAY,CAAA;AACpC;AAGA,IAAM,cAAA,GAAiB,qBAAA;AAEhB,SAAS,mBAAmB,KAAA,EAA2C;AAC5E,EAAA,OACE,OAAA,CAAQ,OAAO,WAAW,CAAA,IAC1B,OAAO,KAAA,CAAM,OAAA,KAAY,YACzB,cAAA,CAAe,IAAA,CAAK,MAAM,OAAO,CAAA,IACjC,OAAO,KAAA,CAAM,KAAA,KAAU,aACtB,KAAA,CAAM,MAAA,KAAW,UAAA,IAAc,KAAA,CAAM,MAAA,KAAW,SAAA,CAAA;AAErD;AAEO,SAAS,0BAA0B,KAAA,EAAkD;AAC1F,EAAA,OACE,OAAA,CAAQ,KAAA,EAAO,mBAAmB,CAAA,KACjC,KAAA,CAAM,MAAA,KAAW,MAAA,IAAU,KAAA,CAAM,MAAA,KAAW,SAAA,IAAa,KAAA,CAAM,MAAA,KAAW,OAAA,CAAA;AAE/E;AAGO,SAAS,gBAAgB,KAAA,EAAwB;AACtD,EAAA,OAAO,mBAAA,CAAoB,KAAK,KAAK,CAAA;AACvC;AAGO,SAAS,UAAA,CAAW,WAAmB,aAAA,EAA+B;AAC3E,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,YAAA,EAAc,SAAS,CAAA;AAC3C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,aAAa,CAAA;AAC5C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,gBAAgB,CAAC,CAAA;AAClD,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAOO,SAAS,UAAA,CACd,SAAA,EACA,aAAA,EACA,OAAA,EACQ;AACR,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,YAAA,EAAc,SAAS,CAAA;AAC3C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,aAAa,CAAA;AAC5C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,gBAAgB,CAAC,CAAA;AAClD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAC3C,EAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW,GAAA,CAAI,aAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAC7E,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB","file":"protocol.cjs","sourcesContent":["/**\n * The pop-up protocol between a partner page (the opener) and the Assetera Wallet (the pop-up) — ADR-0054 D3/D4.\n *\n * This file is the CONTRACT. The connector in this package speaks the opener side; AsseteraWalletFront's\n * `/connect` page speaks the pop-up side and imports these types from `@asseteragmbh/wallet-connector/protocol`.\n * Change it only in a backwards-compatible way, or bump `PROTOCOL_VERSION` and support both on the wallet side:\n * partner sites upgrade on their own schedule.\n *\n * ## The handshake\n *\n * 1. The partner opens `${walletUrl}${CONNECT_PATH}?origin=<partner origin>&v=<version>` from a user click.\n * 2. The pop-up checks the claimed origin against its allowlist (D4). If listed, it posts `ready` to\n *    `window.opener` with `targetOrigin` = that origin. The browser delivers it ONLY if the opener really is\n *    that origin, so a page cannot claim someone else's origin and still hear the answer.\n * 3. The opener waits for `ready` from the wallet origin, then sends `request`s with `targetOrigin` = the wallet\n *    origin. The pop-up accepts a message only when `event.origin` is the allowed origin from step 2 AND\n *    `event.source === window.opener`, and answers with `targetOrigin` = that origin. Nothing else is accepted.\n *\n * ## Lifetime\n *\n * The pop-up stays open while the partner uses the wallet (ADR-0054, \"the wallet tab must stay open\"). When it is\n * closed, the opener sees `disconnect` (or notices `popup.closed`) and must reconnect from a user click.\n *\n * ## Onboarding\n *\n * Onboarding is a second, one-shot flow on the same wallet origin, for a partner that wants to create a brand\n * new client wallet rather than connect to an existing one. The partner opens\n * `${walletUrl}${ONBOARD_PATH}?origin=<partner origin>&v=<version>&chain=<CAIP-2 chain id>` from a user click.\n * The pop-up checks the claimed origin against its partner list, signs the client in through SSO, runs the\n * wizard (accept the terms, create the wallet, register it with Compliance, wait for the screening) and then\n * posts `onboarded` (or `onboard-cancelled`) to `window.opener` with `targetOrigin` = the partner origin, and\n * closes.\n *\n * The opener accepts the result only when `event.origin` is the wallet origin AND `event.source` is the pop-up\n * it opened. The wizard never returns a private key or a token, only the resulting wallet address.\n */\n\nexport const PROTOCOL_VERSION = 1 as const;\n\n/** The pop-up route on the wallet origin. */\nexport const CONNECT_PATH = \"/connect\";\n\n/** The onboarding wizard route on the wallet origin. */\nexport const ONBOARD_PATH = \"/onboard\";\n\n/** Every message carries this prefix in `type`, so both sides can ignore unrelated `postMessage` traffic. */\nexport const MESSAGE_PREFIX = \"assetera-wallet:\" as const;\n\n/**\n * The EIP-1193 methods the pop-up answers (ADR-0054 D3). Anything else is refused with 4200. Read-only chain\n * calls (`eth_call`, `eth_getBalance`, …) do not go through the pop-up; wagmi sends them to its own transports.\n */\nexport const SUPPORTED_METHODS = [\n  \"eth_requestAccounts\",\n  \"eth_accounts\",\n  \"eth_chainId\",\n  \"wallet_switchEthereumChain\",\n  \"personal_sign\",\n  \"eth_signTypedData_v4\",\n  \"eth_sendTransaction\",\n] as const;\n\nexport type SupportedMethod = (typeof SUPPORTED_METHODS)[number];\n\nexport function isSupportedMethod(method: string): method is SupportedMethod {\n  return (SUPPORTED_METHODS as readonly string[]).includes(method);\n}\n\n/** EIP-1193 / EIP-1474 error codes the pop-up uses. */\nexport const RpcErrorCode = {\n  /** The client rejected the request in the pop-up. */\n  UserRejected: 4001,\n  /** Not connected yet (no `eth_requestAccounts` approved in this pop-up). */\n  Unauthorized: 4100,\n  /** The method is not in SUPPORTED_METHODS. */\n  UnsupportedMethod: 4200,\n  /** The pop-up closed, or the wallet session ended. */\n  Disconnected: 4900,\n  /** `wallet_switchEthereumChain` to a chain the wallet does not offer. */\n  UnrecognizedChain: 4902,\n  /** Malformed params. */\n  InvalidParams: -32602,\n  /** Anything unexpected inside the wallet. */\n  Internal: -32603,\n} as const;\n\nexport type RpcErrorCode = (typeof RpcErrorCode)[keyof typeof RpcErrorCode];\n\nexport interface RpcError {\n  code: number;\n  message: string;\n  data?: unknown;\n}\n\n// --- pop-up → opener ---------------------------------------------------------------------------------\n\n/** The pop-up is loaded and accepts requests from this opener. */\nexport interface ReadyMessage {\n  type: `${typeof MESSAGE_PREFIX}ready`;\n  v: typeof PROTOCOL_VERSION;\n  /** Shown to the partner for diagnostics only; the partner must not rely on it for anything. */\n  walletVersion?: string;\n}\n\n/** The answer to one `request`, matched by `id`. Exactly one of `result` / `error`. */\nexport type ResponseMessage =\n  | { type: `${typeof MESSAGE_PREFIX}response`; v: typeof PROTOCOL_VERSION; id: string; result: unknown }\n  | { type: `${typeof MESSAGE_PREFIX}response`; v: typeof PROTOCOL_VERSION; id: string; error: RpcError };\n\n/** EIP-1193 provider events, forwarded to the partner. */\nexport type EventMessage =\n  | {\n      type: `${typeof MESSAGE_PREFIX}event`;\n      v: typeof PROTOCOL_VERSION;\n      event: \"accountsChanged\";\n      data: `0x${string}`[];\n    }\n  | {\n      type: `${typeof MESSAGE_PREFIX}event`;\n      v: typeof PROTOCOL_VERSION;\n      event: \"chainChanged\";\n      data: `0x${string}`;\n    }\n  | {\n      type: `${typeof MESSAGE_PREFIX}event`;\n      v: typeof PROTOCOL_VERSION;\n      event: \"disconnect\";\n      data: RpcError;\n    };\n\n/**\n * The onboarding wizard finished and the wallet was created (or is still waiting for the Compliance screening).\n * `status: \"approved\"` means the client can transact, `\"pending\"` means the screening is still running; the\n * address is valid in both cases.\n */\nexport interface OnboardedMessage {\n  type: `${typeof MESSAGE_PREFIX}onboarded`;\n  v: typeof PROTOCOL_VERSION;\n  address: `0x${string}`;\n  chain: string;\n  status: \"approved\" | \"pending\";\n}\n\n/** The onboarding wizard did not produce a wallet. `message` is optional diagnostics for the partner. */\nexport interface OnboardCancelledMessage {\n  type: `${typeof MESSAGE_PREFIX}onboard-cancelled`;\n  v: typeof PROTOCOL_VERSION;\n  reason: \"user\" | \"refused\" | \"error\";\n  message?: string;\n}\n\nexport type WalletToPartnerMessage =\n  ReadyMessage | ResponseMessage | EventMessage | OnboardedMessage | OnboardCancelledMessage;\n\n// --- opener → pop-up ---------------------------------------------------------------------------------\n\nexport interface RequestMessage {\n  type: `${typeof MESSAGE_PREFIX}request`;\n  v: typeof PROTOCOL_VERSION;\n  /** Unique per request within one connection; the response carries it back. */\n  id: string;\n  method: string;\n  params?: unknown[] | Record<string, unknown>;\n}\n\n/** The partner disconnects (for example the user clicked \"Disconnect\" in the partner page). */\nexport interface DisconnectMessage {\n  type: `${typeof MESSAGE_PREFIX}disconnect`;\n  v: typeof PROTOCOL_VERSION;\n}\n\nexport type PartnerToWalletMessage = RequestMessage | DisconnectMessage;\n\n// --- guards ------------------------------------------------------------------------------------------\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction hasType(value: unknown, suffix: string): value is Record<string, unknown> {\n  return isRecord(value) && value.type === `${MESSAGE_PREFIX}${suffix}` && value.v === PROTOCOL_VERSION;\n}\n\nexport function isReadyMessage(value: unknown): value is ReadyMessage {\n  return hasType(value, \"ready\");\n}\n\nexport function isResponseMessage(value: unknown): value is ResponseMessage {\n  return (\n    hasType(value, \"response\") &&\n    typeof value.id === \"string\" &&\n    (\"result\" in value || (isRecord(value.error) && typeof value.error.code === \"number\"))\n  );\n}\n\nexport function isEventMessage(value: unknown): value is EventMessage {\n  return (\n    hasType(value, \"event\") &&\n    (value.event === \"accountsChanged\" || value.event === \"chainChanged\" || value.event === \"disconnect\")\n  );\n}\n\nexport function isRequestMessage(value: unknown): value is RequestMessage {\n  return hasType(value, \"request\") && typeof value.id === \"string\" && typeof value.method === \"string\";\n}\n\nexport function isDisconnectMessage(value: unknown): value is DisconnectMessage {\n  return hasType(value, \"disconnect\");\n}\n\n/** `0x` followed by exactly 40 hexadecimal digits, the shape of an EVM address. */\nconst EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\n\nexport function isOnboardedMessage(value: unknown): value is OnboardedMessage {\n  return (\n    hasType(value, \"onboarded\") &&\n    typeof value.address === \"string\" &&\n    EVM_ADDRESS_RE.test(value.address) &&\n    typeof value.chain === \"string\" &&\n    (value.status === \"approved\" || value.status === \"pending\")\n  );\n}\n\nexport function isOnboardCancelledMessage(value: unknown): value is OnboardCancelledMessage {\n  return (\n    hasType(value, \"onboard-cancelled\") &&\n    (value.reason === \"user\" || value.reason === \"refused\" || value.reason === \"error\")\n  );\n}\n\n/** A CAIP-2 EVM chain id, for example `eip155:80002` (Polygon Amoy) or `eip155:1` (mainnet). */\nexport function isCaip2EvmChain(value: string): boolean {\n  return /^eip155:\\d{1,32}$/.test(value);\n}\n\n/** The URL the partner opens. `partnerOrigin` is `window.location.origin` of the partner page. */\nexport function connectUrl(walletUrl: string, partnerOrigin: string): string {\n  const url = new URL(CONNECT_PATH, walletUrl);\n  url.searchParams.set(\"origin\", partnerOrigin);\n  url.searchParams.set(\"v\", String(PROTOCOL_VERSION));\n  return url.toString();\n}\n\n/**\n * The URL the partner opens for the onboarding wizard. `partnerOrigin` is `window.location.origin` of the\n * partner page; `chain` is the CAIP-2 chain id the new wallet should be created on; `locale` is passed as `lang`\n * when the partner wants a specific wizard language.\n */\nexport function onboardUrl(\n  walletUrl: string,\n  partnerOrigin: string,\n  options: { chain: string; locale?: string },\n): string {\n  const url = new URL(ONBOARD_PATH, walletUrl);\n  url.searchParams.set(\"origin\", partnerOrigin);\n  url.searchParams.set(\"v\", String(PROTOCOL_VERSION));\n  url.searchParams.set(\"chain\", options.chain);\n  if (options.locale !== undefined) url.searchParams.set(\"lang\", options.locale);\n  return url.toString();\n}\n"]}
+{"version":3,"sources":["../src/protocol.ts"],"names":[],"mappings":";;;AA6DO,IAAM,gBAAA,GAAmB;AAGzB,IAAM,YAAA,GAAe;AAGrB,IAAM,YAAA,GAAe;AAGrB,IAAM,WAAA,GAAc;AAGpB,IAAM,aAAA,GAAgB,CAAC,sBAAsB;AAM7C,SAAS,aAAa,KAAA,EAAqC;AAChE,EAAA,OAAQ,aAAA,CAAqC,SAAS,KAAK,CAAA;AAC7D;AAGO,IAAM,cAAA,GAAiB;AAMvB,IAAM,iBAAA,GAAoB;AAAA,EAC/B,qBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,4BAAA;AAAA,EACA,eAAA;AAAA,EACA,sBAAA;AAAA,EACA;AACF;AAIO,SAAS,kBAAkB,MAAA,EAA2C;AAC3E,EAAA,OAAQ,iBAAA,CAAwC,SAAS,MAAM,CAAA;AACjE;AAGO,IAAM,YAAA,GAAe;AAAA;AAAA,EAE1B,YAAA,EAAc,IAAA;AAAA;AAAA,EAEd,YAAA,EAAc,IAAA;AAAA;AAAA,EAEd,iBAAA,EAAmB,IAAA;AAAA;AAAA,EAEnB,YAAA,EAAc,IAAA;AAAA;AAAA,EAEd,iBAAA,EAAmB,IAAA;AAAA;AAAA,EAEnB,aAAA,EAAe,MAAA;AAAA;AAAA,EAEf,QAAA,EAAU;AACZ;AAmIA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA;AAChD;AAEA,SAAS,OAAA,CAAQ,OAAgB,MAAA,EAAkD;AACjF,EAAA,OAAO,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,KAAS,CAAA,EAAG,cAAc,CAAA,EAAG,MAAM,CAAA,CAAA,IAAM,KAAA,CAAM,CAAA,KAAM,gBAAA;AACvF;AAEO,SAAS,eAAe,KAAA,EAAuC;AACpE,EAAA,OAAO,OAAA,CAAQ,OAAO,OAAO,CAAA;AAC/B;AAEO,SAAS,kBAAkB,KAAA,EAA0C;AAC1E,EAAA,OACE,QAAQ,KAAA,EAAO,UAAU,CAAA,IACzB,OAAO,MAAM,EAAA,KAAO,QAAA,KACnB,QAAA,IAAY,KAAA,IAAU,SAAS,KAAA,CAAM,KAAK,KAAK,OAAO,KAAA,CAAM,MAAM,IAAA,KAAS,QAAA,CAAA;AAEhF;AAEO,SAAS,eAAe,KAAA,EAAuC;AACpE,EAAA,OACE,OAAA,CAAQ,KAAA,EAAO,OAAO,CAAA,KACrB,KAAA,CAAM,KAAA,KAAU,iBAAA,IAAqB,KAAA,CAAM,KAAA,KAAU,cAAA,IAAkB,KAAA,CAAM,KAAA,KAAU,YAAA,CAAA;AAE5F;AAEA,IAAM,kBAAA,GAAkD;AAAA,EACtD,SAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAA;AAGA,SAAS,QAAQ,KAAA,EAAiC;AAChD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,SAAA,CAAU,KAAK,KAAK,KAAA,IAAS,CAAA;AAC1E;AAGO,SAAS,kBAAkB,KAAA,EAA0C;AAC1E,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,EAAO,UAAU,GAAG,OAAO,KAAA;AACxC,EAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,EAAA,OACE,SAAS,IAAI,CAAA,IACb,OAAO,IAAA,CAAK,UAAA,KAAe,YAC1B,kBAAA,CAAyC,QAAA,CAAS,IAAA,CAAK,UAAU,KAClE,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,IACrB,OAAA,CAAQ,KAAK,iBAAiB,CAAA;AAElC;AAEO,SAAS,iBAAiB,KAAA,EAAyC;AACxE,EAAA,OAAO,OAAA,CAAQ,KAAA,EAAO,SAAS,CAAA,IAAK,OAAO,MAAM,EAAA,KAAO,QAAA,IAAY,OAAO,KAAA,CAAM,MAAA,KAAW,QAAA;AAC9F;AAEO,SAAS,oBAAoB,KAAA,EAA4C;AAC9E,EAAA,OAAO,OAAA,CAAQ,OAAO,YAAY,CAAA;AACpC;AAGA,IAAM,cAAA,GAAiB,qBAAA;AAEhB,SAAS,mBAAmB,KAAA,EAA2C;AAC5E,EAAA,OACE,OAAA,CAAQ,KAAA,EAAO,WAAW,CAAA,IAC1B,OAAO,KAAA,CAAM,OAAA,KAAY,QAAA,IACzB,cAAA,CAAe,KAAK,KAAA,CAAM,OAAO,CAAA,IACjC,OAAO,MAAM,KAAA,KAAU,QAAA;AAAA,GAEtB,OAAO,MAAM,OAAA,KAAY,SAAA,IAAa,MAAM,MAAA,KAAW,UAAA,IAAc,MAAM,MAAA,KAAW,SAAA,CAAA;AAE3F;AAEO,SAAS,0BAA0B,KAAA,EAAkD;AAC1F,EAAA,OACE,OAAA,CAAQ,KAAA,EAAO,mBAAmB,CAAA,KACjC,KAAA,CAAM,MAAA,KAAW,MAAA,IAAU,KAAA,CAAM,MAAA,KAAW,SAAA,IAAa,KAAA,CAAM,MAAA,KAAW,OAAA,CAAA;AAE/E;AAGO,SAAS,gBAAgB,KAAA,EAAwB;AACtD,EAAA,OAAO,mBAAA,CAAoB,KAAK,KAAK,CAAA;AACvC;AAMO,SAAS,UAAA,CAAW,SAAA,EAAmB,aAAA,EAAuB,MAAA,EAA6B;AAChG,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,YAAA,EAAc,SAAS,CAAA;AAC3C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,aAAa,CAAA;AAC5C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,gBAAgB,CAAC,CAAA;AAClD,EAAA,IAAI,WAAW,MAAA,EAAW,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,UAAU,MAAM,CAAA;AAC/D,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAQO,SAAS,UAAA,CACd,SAAA,EACA,aAAA,EACA,OAAA,EACQ;AACR,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,YAAA,EAAc,SAAS,CAAA;AAC3C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,aAAa,CAAA;AAC5C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,gBAAgB,CAAC,CAAA;AAClD,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAC3C,EAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW,GAAA,CAAI,aAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAC7E,EAAA,IAAI,QAAQ,GAAA,EAAK,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,GAAG,CAAA;AAChD,EAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW,GAAA,CAAI,aAAa,GAAA,CAAI,QAAA,EAAU,QAAQ,MAAM,CAAA;AAC/E,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAOO,SAAS,SAAA,CACd,SAAA,EACA,aAAA,EACA,OAAA,GAAoD,EAAC,EAC7C;AACR,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,WAAA,EAAa,SAAS,CAAA;AAC1C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,aAAa,CAAA;AAC5C,EAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,gBAAgB,CAAC,CAAA;AAClD,EAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW,GAAA,CAAI,aAAa,GAAA,CAAI,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAC7E,EAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW,GAAA,CAAI,aAAa,GAAA,CAAI,QAAA,EAAU,QAAQ,MAAM,CAAA;AAC/E,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB","file":"protocol.cjs","sourcesContent":["/**\n * The pop-up protocol between a partner page (the opener) and the Assetera Wallet (the pop-up) — ADR-0054 D3/D4.\n *\n * This file is the CONTRACT. The connector in this package speaks the opener side; AsseteraWalletFront's\n * `/connect` page speaks the pop-up side and imports these types from `@asseteragmbh/wallet-connector/protocol`.\n * Change it only in a backwards-compatible way, or bump `PROTOCOL_VERSION` and support both on the wallet side:\n * partner sites upgrade on their own schedule.\n *\n * ## The handshake\n *\n * 1. The partner opens `${walletUrl}${CONNECT_PATH}?origin=<partner origin>&v=<version>` from a user click.\n * 2. The pop-up checks the claimed origin against its allowlist (D4). If listed, it posts `ready` to\n *    `window.opener` with `targetOrigin` = that origin. The browser delivers it ONLY if the opener really is\n *    that origin, so a page cannot claim someone else's origin and still hear the answer.\n * 3. The opener waits for `ready` from the wallet origin, then sends `request`s with `targetOrigin` = the wallet\n *    origin. The pop-up accepts a message only when `event.origin` is the allowed origin from step 2 AND\n *    `event.source === window.opener`, and answers with `targetOrigin` = that origin. Nothing else is accepted.\n *\n * ## Sign-in hint\n *\n * A partner may tell the wallet how the client signed in at the partner, through the optional `signIn` URL\n * parameter (`SIGN_IN_HINTS`). The hint only names an identity provider: the wallet checks it against its own\n * list, may ignore it and then falls back to its own login page. The hint never carries a token, an identity or\n * any other credential.\n *\n * ## Lifetime\n *\n * The pop-up is not guaranteed to stay open. The wallet site may close the `/connect` pop-up after it connected\n * or answered a request. The provider keeps the last `accounts` and `chainId` it saw, so the partner page still\n * looks connected after the pop-up closes, and it opens the pop-up again on the next request from a user click.\n * (ADR-0054, \"the wallet tab must stay open\", no longer holds.)\n *\n * ## Onboarding\n *\n * Onboarding is a second flow on the same wallet origin, for a partner that wants the client to get an Assetera\n * Wallet (a new one, or the one the client already has). The partner opens\n * `${walletUrl}${ONBOARD_PATH}?origin=<partner origin>&v=<version>&chain=<CAIP-2 chain id>[&add=1]` from a user\n * click. The pop-up checks the claimed origin against its partner list, signs the client in through SSO, runs the\n * wizard (accept the wallet terms, create the wallet) and then posts `onboarded` (or `onboard-cancelled`) to\n * `window.opener` with `targetOrigin` = the partner origin. `add=1` asks for one more wallet even when the client\n * already has one.\n *\n * After `onboarded` the pop-up STAYS OPEN and answers `request` messages for `personal_sign` by the onboarded\n * address (plus `eth_accounts` and `eth_chainId`), with the same `response` messages as `/connect`. That is how\n * the partner gets the ownership signature it needs to register the wallet with its own compliance service: the\n * wallet itself never calls a regulated service (ADR-0059 D3), and a second `window.open` after an asynchronous\n * step would be blocked by the browser. The partner closes the pop-up when it is done.\n *\n * The opener accepts messages only when `event.origin` is the wallet origin AND `event.source` is the pop-up\n * it opened. The wizard never returns a private key or a token, only the wallet address and signatures the\n * client approved.\n *\n * ## Manage\n *\n * The partner can open `${walletUrl}${MANAGE_PATH}?origin=<partner origin>&v=<version>[&lang=<locale>][&signIn=<hint>]`\n * from a user click, so the client can see and change the wallet accounts and the wallet security (passkeys,\n * authenticator app, recovery codes). The pop-up checks the claimed origin against its partner list, posts\n * `ready` to `window.opener` (the same message as `/connect`) and then posts `security` messages. It never\n * answers `request` messages.\n */\n\nexport const PROTOCOL_VERSION = 1 as const;\n\n/** The pop-up route on the wallet origin. */\nexport const CONNECT_PATH = \"/connect\";\n\n/** The onboarding wizard route on the wallet origin. */\nexport const ONBOARD_PATH = \"/onboard\";\n\n/** The manage wallet route on the wallet origin. */\nexport const MANAGE_PATH = \"/manage\";\n\n/** The identity providers a partner can name in the `signIn` hint. */\nexport const SIGN_IN_HINTS = [\"assetera-marketplace\"] as const;\n\n/** A named identity provider the wallet may use for a silent sign-in. */\nexport type SignInHint = (typeof SIGN_IN_HINTS)[number];\n\n/** True when `value` is one of {@link SIGN_IN_HINTS}. */\nexport function isSignInHint(value: unknown): value is SignInHint {\n  return (SIGN_IN_HINTS as readonly unknown[]).includes(value);\n}\n\n/** Every message carries this prefix in `type`, so both sides can ignore unrelated `postMessage` traffic. */\nexport const MESSAGE_PREFIX = \"assetera-wallet:\" as const;\n\n/**\n * The EIP-1193 methods the pop-up answers (ADR-0054 D3). Anything else is refused with 4200. Read-only chain\n * calls (`eth_call`, `eth_getBalance`, …) do not go through the pop-up; wagmi sends them to its own transports.\n */\nexport const SUPPORTED_METHODS = [\n  \"eth_requestAccounts\",\n  \"eth_accounts\",\n  \"eth_chainId\",\n  \"wallet_switchEthereumChain\",\n  \"personal_sign\",\n  \"eth_signTypedData_v4\",\n  \"eth_sendTransaction\",\n] as const;\n\nexport type SupportedMethod = (typeof SUPPORTED_METHODS)[number];\n\nexport function isSupportedMethod(method: string): method is SupportedMethod {\n  return (SUPPORTED_METHODS as readonly string[]).includes(method);\n}\n\n/** EIP-1193 / EIP-1474 error codes the pop-up uses. */\nexport const RpcErrorCode = {\n  /** The client rejected the request in the pop-up. */\n  UserRejected: 4001,\n  /** Not connected yet (no `eth_requestAccounts` approved in this pop-up). */\n  Unauthorized: 4100,\n  /** The method is not in SUPPORTED_METHODS. */\n  UnsupportedMethod: 4200,\n  /** The pop-up closed, or the wallet session ended. */\n  Disconnected: 4900,\n  /** `wallet_switchEthereumChain` to a chain the wallet does not offer. */\n  UnrecognizedChain: 4902,\n  /** Malformed params. */\n  InvalidParams: -32602,\n  /** Anything unexpected inside the wallet. */\n  Internal: -32603,\n} as const;\n\nexport type RpcErrorCode = (typeof RpcErrorCode)[keyof typeof RpcErrorCode];\n\nexport interface RpcError {\n  code: number;\n  message: string;\n  data?: unknown;\n}\n\n// --- pop-up → opener ---------------------------------------------------------------------------------\n\n/** The pop-up is loaded and accepts requests from this opener. */\nexport interface ReadyMessage {\n  type: `${typeof MESSAGE_PREFIX}ready`;\n  v: typeof PROTOCOL_VERSION;\n  /** Shown to the partner for diagnostics only; the partner must not rely on it for anything. */\n  walletVersion?: string;\n}\n\n/** The answer to one `request`, matched by `id`. Exactly one of `result` / `error`. */\nexport type ResponseMessage =\n  | { type: `${typeof MESSAGE_PREFIX}response`; v: typeof PROTOCOL_VERSION; id: string; result: unknown }\n  | { type: `${typeof MESSAGE_PREFIX}response`; v: typeof PROTOCOL_VERSION; id: string; error: RpcError };\n\n/** EIP-1193 provider events, forwarded to the partner. */\nexport type EventMessage =\n  | {\n      type: `${typeof MESSAGE_PREFIX}event`;\n      v: typeof PROTOCOL_VERSION;\n      event: \"accountsChanged\";\n      data: `0x${string}`[];\n    }\n  | {\n      type: `${typeof MESSAGE_PREFIX}event`;\n      v: typeof PROTOCOL_VERSION;\n      event: \"chainChanged\";\n      data: `0x${string}`;\n    }\n  | {\n      type: `${typeof MESSAGE_PREFIX}event`;\n      v: typeof PROTOCOL_VERSION;\n      event: \"disconnect\";\n      data: RpcError;\n    };\n\n/**\n * How well the client's Assetera Wallet is protected. The values are the ones the wallet site shows:\n *\n * - `add-factor`: there is no passkey and no authenticator app yet.\n * - `save-codes`: recovery codes exist, but the client has not confirmed saving them.\n * - `create-codes`: a factor exists, but there are no recovery codes.\n * - `protected`: a factor exists and the recovery codes are saved.\n * - `unknown`: the wallet could not read the state.\n */\nexport type WalletProtection = \"unknown\" | \"add-factor\" | \"save-codes\" | \"create-codes\" | \"protected\";\n\n/** The wallet security status sent by a manage (or connect) pop-up. */\nexport interface WalletSecurityStatus {\n  /** Overall result, the same values the wallet site shows. */\n  protection: WalletProtection;\n  /** Passkeys registered for signing (Dynamic step-up), not sign-in factors. */\n  passkeys: number;\n  /** Authenticator apps (TOTP) registered for signing (Dynamic step-up). */\n  authenticatorApps: number;\n}\n\n/**\n * The wallet reports the security status while a pop-up is open. The partner cannot ask for it. It never\n * carries a token, an identity or a credential.\n */\nexport interface SecurityMessage {\n  type: `${typeof MESSAGE_PREFIX}security`;\n  v: typeof PROTOCOL_VERSION;\n  data: WalletSecurityStatus;\n}\n\n/**\n * The onboarding wizard finished: the client accepted the wallet terms and has an Assetera Wallet on `chain`.\n * `created` is `true` when the wallet was created in this run, `false` when the wizard returned the client's\n * existing wallet. The wallet is not registered with any compliance service; that is the partner's step.\n */\nexport interface OnboardedMessage {\n  type: `${typeof MESSAGE_PREFIX}onboarded`;\n  v: typeof PROTOCOL_VERSION;\n  address: `0x${string}`;\n  chain: string;\n  created: boolean;\n  /**\n   * @deprecated Sent by wallet versions that registered the wallet themselves (before ADR-0059). Ignored.\n   */\n  status?: \"approved\" | \"pending\";\n}\n\n/** The onboarding wizard did not produce a wallet. `message` is optional diagnostics for the partner. */\nexport interface OnboardCancelledMessage {\n  type: `${typeof MESSAGE_PREFIX}onboard-cancelled`;\n  v: typeof PROTOCOL_VERSION;\n  reason: \"user\" | \"refused\" | \"error\";\n  message?: string;\n}\n\nexport type WalletToPartnerMessage =\n  | ReadyMessage\n  | ResponseMessage\n  | EventMessage\n  | SecurityMessage\n  | OnboardedMessage\n  | OnboardCancelledMessage;\n\n// --- opener → pop-up ---------------------------------------------------------------------------------\n\nexport interface RequestMessage {\n  type: `${typeof MESSAGE_PREFIX}request`;\n  v: typeof PROTOCOL_VERSION;\n  /** Unique per request within one connection; the response carries it back. */\n  id: string;\n  method: string;\n  params?: unknown[] | Record<string, unknown>;\n}\n\n/** The partner disconnects (for example the user clicked \"Disconnect\" in the partner page). */\nexport interface DisconnectMessage {\n  type: `${typeof MESSAGE_PREFIX}disconnect`;\n  v: typeof PROTOCOL_VERSION;\n}\n\nexport type PartnerToWalletMessage = RequestMessage | DisconnectMessage;\n\n// --- guards ------------------------------------------------------------------------------------------\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction hasType(value: unknown, suffix: string): value is Record<string, unknown> {\n  return isRecord(value) && value.type === `${MESSAGE_PREFIX}${suffix}` && value.v === PROTOCOL_VERSION;\n}\n\nexport function isReadyMessage(value: unknown): value is ReadyMessage {\n  return hasType(value, \"ready\");\n}\n\nexport function isResponseMessage(value: unknown): value is ResponseMessage {\n  return (\n    hasType(value, \"response\") &&\n    typeof value.id === \"string\" &&\n    (\"result\" in value || (isRecord(value.error) && typeof value.error.code === \"number\"))\n  );\n}\n\nexport function isEventMessage(value: unknown): value is EventMessage {\n  return (\n    hasType(value, \"event\") &&\n    (value.event === \"accountsChanged\" || value.event === \"chainChanged\" || value.event === \"disconnect\")\n  );\n}\n\nconst WALLET_PROTECTIONS: readonly WalletProtection[] = [\n  \"unknown\",\n  \"add-factor\",\n  \"save-codes\",\n  \"create-codes\",\n  \"protected\",\n];\n\n/** A factor count: a whole number, zero or more. */\nfunction isCount(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isInteger(value) && value >= 0;\n}\n\n/** True for a `security` message with a known `protection` value and whole, non-negative factor counts. */\nexport function isSecurityMessage(value: unknown): value is SecurityMessage {\n  if (!hasType(value, \"security\")) return false;\n  const data = value.data;\n  return (\n    isRecord(data) &&\n    typeof data.protection === \"string\" &&\n    (WALLET_PROTECTIONS as readonly string[]).includes(data.protection) &&\n    isCount(data.passkeys) &&\n    isCount(data.authenticatorApps)\n  );\n}\n\nexport function isRequestMessage(value: unknown): value is RequestMessage {\n  return hasType(value, \"request\") && typeof value.id === \"string\" && typeof value.method === \"string\";\n}\n\nexport function isDisconnectMessage(value: unknown): value is DisconnectMessage {\n  return hasType(value, \"disconnect\");\n}\n\n/** `0x` followed by exactly 40 hexadecimal digits, the shape of an EVM address. */\nconst EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\n\nexport function isOnboardedMessage(value: unknown): value is OnboardedMessage {\n  return (\n    hasType(value, \"onboarded\") &&\n    typeof value.address === \"string\" &&\n    EVM_ADDRESS_RE.test(value.address) &&\n    typeof value.chain === \"string\" &&\n    // `created` is new; an older wallet sent `status` instead and always created or reused a wallet.\n    (typeof value.created === \"boolean\" || value.status === \"approved\" || value.status === \"pending\")\n  );\n}\n\nexport function isOnboardCancelledMessage(value: unknown): value is OnboardCancelledMessage {\n  return (\n    hasType(value, \"onboard-cancelled\") &&\n    (value.reason === \"user\" || value.reason === \"refused\" || value.reason === \"error\")\n  );\n}\n\n/** A CAIP-2 EVM chain id, for example `eip155:80002` (Polygon Amoy) or `eip155:1` (mainnet). */\nexport function isCaip2EvmChain(value: string): boolean {\n  return /^eip155:\\d{1,32}$/.test(value);\n}\n\n/**\n * The URL the partner opens. `partnerOrigin` is `window.location.origin` of the partner page. `signIn` adds the\n * optional sign-in hint; it is only a hint and the wallet may ignore it.\n */\nexport function connectUrl(walletUrl: string, partnerOrigin: string, signIn?: SignInHint): string {\n  const url = new URL(CONNECT_PATH, walletUrl);\n  url.searchParams.set(\"origin\", partnerOrigin);\n  url.searchParams.set(\"v\", String(PROTOCOL_VERSION));\n  if (signIn !== undefined) url.searchParams.set(\"signIn\", signIn);\n  return url.toString();\n}\n\n/**\n * The URL the partner opens for the onboarding wizard. `partnerOrigin` is `window.location.origin` of the\n * partner page; `chain` is the CAIP-2 chain id the new wallet should be created on; `locale` is passed as `lang`\n * when the partner wants a specific wizard language. `signIn` adds the optional sign-in hint; it is only a hint\n * and the wallet may ignore it.\n */\nexport function onboardUrl(\n  walletUrl: string,\n  partnerOrigin: string,\n  options: { chain: string; locale?: string; add?: boolean; signIn?: SignInHint },\n): string {\n  const url = new URL(ONBOARD_PATH, walletUrl);\n  url.searchParams.set(\"origin\", partnerOrigin);\n  url.searchParams.set(\"v\", String(PROTOCOL_VERSION));\n  url.searchParams.set(\"chain\", options.chain);\n  if (options.locale !== undefined) url.searchParams.set(\"lang\", options.locale);\n  if (options.add) url.searchParams.set(\"add\", \"1\");\n  if (options.signIn !== undefined) url.searchParams.set(\"signIn\", options.signIn);\n  return url.toString();\n}\n\n/**\n * The URL the partner opens to manage the wallet. `partnerOrigin` is `window.location.origin` of the partner\n * page. `locale` is passed as `lang` when the partner wants a specific language. `signIn` adds the optional\n * sign-in hint; it is only a hint and the wallet may ignore it.\n */\nexport function manageUrl(\n  walletUrl: string,\n  partnerOrigin: string,\n  options: { locale?: string; signIn?: SignInHint } = {},\n): string {\n  const url = new URL(MANAGE_PATH, walletUrl);\n  url.searchParams.set(\"origin\", partnerOrigin);\n  url.searchParams.set(\"v\", String(PROTOCOL_VERSION));\n  if (options.locale !== undefined) url.searchParams.set(\"lang\", options.locale);\n  if (options.signIn !== undefined) url.searchParams.set(\"signIn\", options.signIn);\n  return url.toString();\n}\n"]}