@asseteragmbh/wallet-connector 0.1.2 → 0.2.1

package/dist/protocol.d.cts

@@ -16,29 +16,61 @@
  *    origin. The pop-up accepts a message only when `event.origin` is the allowed origin from step 2 AND
  *    `event.source === window.opener`, and answers with `targetOrigin` = that origin. Nothing else is accepted.
  *
+ * ## Sign-in hint
+ *
+ * A partner may tell the wallet how the client signed in at the partner, through the optional `signIn` URL
+ * parameter (`SIGN_IN_HINTS`). The hint only names an identity provider: the wallet checks it against its own
+ * list, may ignore it and then falls back to its own login page. The hint never carries a token, an identity or
+ * any other credential.
+ *
  * ## Lifetime
  *
- * The pop-up stays open while the partner uses the wallet (ADR-0054, "the wallet tab must stay open"). When it is
- * closed, the opener sees `disconnect` (or notices `popup.closed`) and must reconnect from a user click.
+ * The pop-up is not guaranteed to stay open. The wallet site may close the `/connect` pop-up after it connected
+ * or answered a request. The provider keeps the last `accounts` and `chainId` it saw, so the partner page still
+ * looks connected after the pop-up closes, and it opens the pop-up again on the next request from a user click.
+ * (ADR-0054, "the wallet tab must stay open", no longer holds.)
  *
  * ## Onboarding
  *
- * Onboarding is a second, one-shot flow on the same wallet origin, for a partner that wants to create a brand
- * new client wallet rather than connect to an existing one. The partner opens
- * `${walletUrl}${ONBOARD_PATH}?origin=<partner origin>&v=<version>&chain=<CAIP-2 chain id>` from a user click.
- * The pop-up checks the claimed origin against its partner list, signs the client in through SSO, runs the
- * wizard (accept the terms, create the wallet, register it with Compliance, wait for the screening) and then
- * posts `onboarded` (or `onboard-cancelled`) to `window.opener` with `targetOrigin` = the partner origin, and
- * closes.
+ * Onboarding is a second flow on the same wallet origin, for a partner that wants the client to get an Assetera
+ * Wallet (a new one, or the one the client already has). The partner opens
+ * `${walletUrl}${ONBOARD_PATH}?origin=<partner origin>&v=<version>&chain=<CAIP-2 chain id>[&add=1]` from a user
+ * click. The pop-up checks the claimed origin against its partner list, signs the client in through SSO, runs the
+ * wizard (accept the wallet terms, create the wallet) and then posts `onboarded` (or `onboard-cancelled`) to
+ * `window.opener` with `targetOrigin` = the partner origin. `add=1` asks for one more wallet even when the client
+ * already has one.
+ *
+ * After `onboarded` the pop-up STAYS OPEN and answers `request` messages for `personal_sign` by the onboarded
+ * address (plus `eth_accounts` and `eth_chainId`), with the same `response` messages as `/connect`. That is how
+ * the partner gets the ownership signature it needs to register the wallet with its own compliance service: the
+ * wallet itself never calls a regulated service (ADR-0059 D3), and a second `window.open` after an asynchronous
+ * step would be blocked by the browser. The partner closes the pop-up when it is done.
+ *
+ * The opener accepts messages only when `event.origin` is the wallet origin AND `event.source` is the pop-up
+ * it opened. The wizard never returns a private key or a token, only the wallet address and signatures the
+ * client approved.
+ *
+ * ## Manage
  *
- * The opener accepts the result only when `event.origin` is the wallet origin AND `event.source` is the pop-up
- * it opened. The wizard never returns a private key or a token, only the resulting wallet address.
+ * The partner can open `${walletUrl}${MANAGE_PATH}?origin=<partner origin>&v=<version>[&lang=<locale>][&signIn=<hint>]`
+ * from a user click, so the client can see and change the wallet accounts and the wallet security (passkeys,
+ * authenticator app, recovery codes). The pop-up checks the claimed origin against its partner list, posts
+ * `ready` to `window.opener` (the same message as `/connect`) and then posts `security` messages. It never
+ * answers `request` messages.
  */
 declare const PROTOCOL_VERSION: 1;
 /** The pop-up route on the wallet origin. */
 declare const CONNECT_PATH = "/connect";
 /** The onboarding wizard route on the wallet origin. */
 declare const ONBOARD_PATH = "/onboard";
+/** The manage wallet route on the wallet origin. */
+declare const MANAGE_PATH = "/manage";
+/** The identity providers a partner can name in the `signIn` hint. */
+declare const SIGN_IN_HINTS: readonly ["assetera-marketplace"];
+/** A named identity provider the wallet may use for a silent sign-in. */
+type SignInHint = (typeof SIGN_IN_HINTS)[number];
+/** True when `value` is one of {@link SIGN_IN_HINTS}. */
+declare function isSignInHint(value: unknown): value is SignInHint;
 /** Every message carries this prefix in `type`, so both sides can ignore unrelated `postMessage` traffic. */
 declare const MESSAGE_PREFIX: "assetera-wallet:";
 /**
@@ -108,16 +140,48 @@ type EventMessage = {
     data: RpcError;
 };
 /**
- * The onboarding wizard finished and the wallet was created (or is still waiting for the Compliance screening).
- * `status: "approved"` means the client can transact, `"pending"` means the screening is still running; the
- * address is valid in both cases.
+ * How well the client's Assetera Wallet is protected. The values are the ones the wallet site shows:
+ *
+ * - `add-factor`: there is no passkey and no authenticator app yet.
+ * - `save-codes`: recovery codes exist, but the client has not confirmed saving them.
+ * - `create-codes`: a factor exists, but there are no recovery codes.
+ * - `protected`: a factor exists and the recovery codes are saved.
+ * - `unknown`: the wallet could not read the state.
+ */
+type WalletProtection = "unknown" | "add-factor" | "save-codes" | "create-codes" | "protected";
+/** The wallet security status sent by a manage (or connect) pop-up. */
+interface WalletSecurityStatus {
+    /** Overall result, the same values the wallet site shows. */
+    protection: WalletProtection;
+    /** Passkeys registered for signing (Dynamic step-up), not sign-in factors. */
+    passkeys: number;
+    /** Authenticator apps (TOTP) registered for signing (Dynamic step-up). */
+    authenticatorApps: number;
+}
+/**
+ * The wallet reports the security status while a pop-up is open. The partner cannot ask for it. It never
+ * carries a token, an identity or a credential.
+ */
+interface SecurityMessage {
+    type: `${typeof MESSAGE_PREFIX}security`;
+    v: typeof PROTOCOL_VERSION;
+    data: WalletSecurityStatus;
+}
+/**
+ * The onboarding wizard finished: the client accepted the wallet terms and has an Assetera Wallet on `chain`.
+ * `created` is `true` when the wallet was created in this run, `false` when the wizard returned the client's
+ * existing wallet. The wallet is not registered with any compliance service; that is the partner's step.
  */
 interface OnboardedMessage {
     type: `${typeof MESSAGE_PREFIX}onboarded`;
     v: typeof PROTOCOL_VERSION;
     address: `0x${string}`;
     chain: string;
-    status: "approved" | "pending";
+    created: boolean;
+    /**
+     * @deprecated Sent by wallet versions that registered the wallet themselves (before ADR-0059). Ignored.
+     */
+    status?: "approved" | "pending";
 }
 /** The onboarding wizard did not produce a wallet. `message` is optional diagnostics for the partner. */
 interface OnboardCancelledMessage {
@@ -126,7 +190,7 @@ interface OnboardCancelledMessage {
     reason: "user" | "refused" | "error";
     message?: string;
 }
-type WalletToPartnerMessage = ReadyMessage | ResponseMessage | EventMessage | OnboardedMessage | OnboardCancelledMessage;
+type WalletToPartnerMessage = ReadyMessage | ResponseMessage | EventMessage | SecurityMessage | OnboardedMessage | OnboardCancelledMessage;
 interface RequestMessage {
     type: `${typeof MESSAGE_PREFIX}request`;
     v: typeof PROTOCOL_VERSION;
@@ -144,22 +208,39 @@ type PartnerToWalletMessage = RequestMessage | DisconnectMessage;
 declare function isReadyMessage(value: unknown): value is ReadyMessage;
 declare function isResponseMessage(value: unknown): value is ResponseMessage;
 declare function isEventMessage(value: unknown): value is EventMessage;
+/** True for a `security` message with a known `protection` value and whole, non-negative factor counts. */
+declare function isSecurityMessage(value: unknown): value is SecurityMessage;
 declare function isRequestMessage(value: unknown): value is RequestMessage;
 declare function isDisconnectMessage(value: unknown): value is DisconnectMessage;
 declare function isOnboardedMessage(value: unknown): value is OnboardedMessage;
 declare function isOnboardCancelledMessage(value: unknown): value is OnboardCancelledMessage;
 /** A CAIP-2 EVM chain id, for example `eip155:80002` (Polygon Amoy) or `eip155:1` (mainnet). */
 declare function isCaip2EvmChain(value: string): boolean;
-/** The URL the partner opens. `partnerOrigin` is `window.location.origin` of the partner page. */
-declare function connectUrl(walletUrl: string, partnerOrigin: string): string;
+/**
+ * The URL the partner opens. `partnerOrigin` is `window.location.origin` of the partner page. `signIn` adds the
+ * optional sign-in hint; it is only a hint and the wallet may ignore it.
+ */
+declare function connectUrl(walletUrl: string, partnerOrigin: string, signIn?: SignInHint): string;
 /**
  * The URL the partner opens for the onboarding wizard. `partnerOrigin` is `window.location.origin` of the
  * partner page; `chain` is the CAIP-2 chain id the new wallet should be created on; `locale` is passed as `lang`
- * when the partner wants a specific wizard language.
+ * when the partner wants a specific wizard language. `signIn` adds the optional sign-in hint; it is only a hint
+ * and the wallet may ignore it.
  */
 declare function onboardUrl(walletUrl: string, partnerOrigin: string, options: {
     chain: string;
     locale?: string;
+    add?: boolean;
+    signIn?: SignInHint;
+}): string;
+/**
+ * The URL the partner opens to manage the wallet. `partnerOrigin` is `window.location.origin` of the partner
+ * page. `locale` is passed as `lang` when the partner wants a specific language. `signIn` adds the optional
+ * sign-in hint; it is only a hint and the wallet may ignore it.
+ */
+declare function manageUrl(walletUrl: string, partnerOrigin: string, options?: {
+    locale?: string;
+    signIn?: SignInHint;
 }): string;
 
-export { CONNECT_PATH, type DisconnectMessage, type EventMessage, MESSAGE_PREFIX, ONBOARD_PATH, type OnboardCancelledMessage, type OnboardedMessage, PROTOCOL_VERSION, type PartnerToWalletMessage, type ReadyMessage, type RequestMessage, type ResponseMessage, type RpcError, RpcErrorCode, SUPPORTED_METHODS, type SupportedMethod, type WalletToPartnerMessage, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSupportedMethod, onboardUrl };
+export { CONNECT_PATH, type DisconnectMessage, type EventMessage, MANAGE_PATH, MESSAGE_PREFIX, ONBOARD_PATH, type OnboardCancelledMessage, type OnboardedMessage, PROTOCOL_VERSION, type PartnerToWalletMessage, type ReadyMessage, type RequestMessage, type ResponseMessage, type RpcError, RpcErrorCode, SIGN_IN_HINTS, SUPPORTED_METHODS, type SecurityMessage, type SignInHint, type SupportedMethod, type WalletProtection, type WalletSecurityStatus, type WalletToPartnerMessage, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSecurityMessage, isSignInHint, isSupportedMethod, manageUrl, onboardUrl };

package/dist/protocol.d.ts

@@ -16,29 +16,61 @@
  *    origin. The pop-up accepts a message only when `event.origin` is the allowed origin from step 2 AND
  *    `event.source === window.opener`, and answers with `targetOrigin` = that origin. Nothing else is accepted.
  *
+ * ## Sign-in hint
+ *
+ * A partner may tell the wallet how the client signed in at the partner, through the optional `signIn` URL
+ * parameter (`SIGN_IN_HINTS`). The hint only names an identity provider: the wallet checks it against its own
+ * list, may ignore it and then falls back to its own login page. The hint never carries a token, an identity or
+ * any other credential.
+ *
  * ## Lifetime
  *
- * The pop-up stays open while the partner uses the wallet (ADR-0054, "the wallet tab must stay open"). When it is
- * closed, the opener sees `disconnect` (or notices `popup.closed`) and must reconnect from a user click.
+ * The pop-up is not guaranteed to stay open. The wallet site may close the `/connect` pop-up after it connected
+ * or answered a request. The provider keeps the last `accounts` and `chainId` it saw, so the partner page still
+ * looks connected after the pop-up closes, and it opens the pop-up again on the next request from a user click.
+ * (ADR-0054, "the wallet tab must stay open", no longer holds.)
  *
  * ## Onboarding
  *
- * Onboarding is a second, one-shot flow on the same wallet origin, for a partner that wants to create a brand
- * new client wallet rather than connect to an existing one. The partner opens
- * `${walletUrl}${ONBOARD_PATH}?origin=<partner origin>&v=<version>&chain=<CAIP-2 chain id>` from a user click.
- * The pop-up checks the claimed origin against its partner list, signs the client in through SSO, runs the
- * wizard (accept the terms, create the wallet, register it with Compliance, wait for the screening) and then
- * posts `onboarded` (or `onboard-cancelled`) to `window.opener` with `targetOrigin` = the partner origin, and
- * closes.
+ * Onboarding is a second flow on the same wallet origin, for a partner that wants the client to get an Assetera
+ * Wallet (a new one, or the one the client already has). The partner opens
+ * `${walletUrl}${ONBOARD_PATH}?origin=<partner origin>&v=<version>&chain=<CAIP-2 chain id>[&add=1]` from a user
+ * click. The pop-up checks the claimed origin against its partner list, signs the client in through SSO, runs the
+ * wizard (accept the wallet terms, create the wallet) and then posts `onboarded` (or `onboard-cancelled`) to
+ * `window.opener` with `targetOrigin` = the partner origin. `add=1` asks for one more wallet even when the client
+ * already has one.
+ *
+ * After `onboarded` the pop-up STAYS OPEN and answers `request` messages for `personal_sign` by the onboarded
+ * address (plus `eth_accounts` and `eth_chainId`), with the same `response` messages as `/connect`. That is how
+ * the partner gets the ownership signature it needs to register the wallet with its own compliance service: the
+ * wallet itself never calls a regulated service (ADR-0059 D3), and a second `window.open` after an asynchronous
+ * step would be blocked by the browser. The partner closes the pop-up when it is done.
+ *
+ * The opener accepts messages only when `event.origin` is the wallet origin AND `event.source` is the pop-up
+ * it opened. The wizard never returns a private key or a token, only the wallet address and signatures the
+ * client approved.
+ *
+ * ## Manage
  *
- * The opener accepts the result only when `event.origin` is the wallet origin AND `event.source` is the pop-up
- * it opened. The wizard never returns a private key or a token, only the resulting wallet address.
+ * The partner can open `${walletUrl}${MANAGE_PATH}?origin=<partner origin>&v=<version>[&lang=<locale>][&signIn=<hint>]`
+ * from a user click, so the client can see and change the wallet accounts and the wallet security (passkeys,
+ * authenticator app, recovery codes). The pop-up checks the claimed origin against its partner list, posts
+ * `ready` to `window.opener` (the same message as `/connect`) and then posts `security` messages. It never
+ * answers `request` messages.
  */
 declare const PROTOCOL_VERSION: 1;
 /** The pop-up route on the wallet origin. */
 declare const CONNECT_PATH = "/connect";
 /** The onboarding wizard route on the wallet origin. */
 declare const ONBOARD_PATH = "/onboard";
+/** The manage wallet route on the wallet origin. */
+declare const MANAGE_PATH = "/manage";
+/** The identity providers a partner can name in the `signIn` hint. */
+declare const SIGN_IN_HINTS: readonly ["assetera-marketplace"];
+/** A named identity provider the wallet may use for a silent sign-in. */
+type SignInHint = (typeof SIGN_IN_HINTS)[number];
+/** True when `value` is one of {@link SIGN_IN_HINTS}. */
+declare function isSignInHint(value: unknown): value is SignInHint;
 /** Every message carries this prefix in `type`, so both sides can ignore unrelated `postMessage` traffic. */
 declare const MESSAGE_PREFIX: "assetera-wallet:";
 /**
@@ -108,16 +140,48 @@ type EventMessage = {
     data: RpcError;
 };
 /**
- * The onboarding wizard finished and the wallet was created (or is still waiting for the Compliance screening).
- * `status: "approved"` means the client can transact, `"pending"` means the screening is still running; the
- * address is valid in both cases.
+ * How well the client's Assetera Wallet is protected. The values are the ones the wallet site shows:
+ *
+ * - `add-factor`: there is no passkey and no authenticator app yet.
+ * - `save-codes`: recovery codes exist, but the client has not confirmed saving them.
+ * - `create-codes`: a factor exists, but there are no recovery codes.
+ * - `protected`: a factor exists and the recovery codes are saved.
+ * - `unknown`: the wallet could not read the state.
+ */
+type WalletProtection = "unknown" | "add-factor" | "save-codes" | "create-codes" | "protected";
+/** The wallet security status sent by a manage (or connect) pop-up. */
+interface WalletSecurityStatus {
+    /** Overall result, the same values the wallet site shows. */
+    protection: WalletProtection;
+    /** Passkeys registered for signing (Dynamic step-up), not sign-in factors. */
+    passkeys: number;
+    /** Authenticator apps (TOTP) registered for signing (Dynamic step-up). */
+    authenticatorApps: number;
+}
+/**
+ * The wallet reports the security status while a pop-up is open. The partner cannot ask for it. It never
+ * carries a token, an identity or a credential.
+ */
+interface SecurityMessage {
+    type: `${typeof MESSAGE_PREFIX}security`;
+    v: typeof PROTOCOL_VERSION;
+    data: WalletSecurityStatus;
+}
+/**
+ * The onboarding wizard finished: the client accepted the wallet terms and has an Assetera Wallet on `chain`.
+ * `created` is `true` when the wallet was created in this run, `false` when the wizard returned the client's
+ * existing wallet. The wallet is not registered with any compliance service; that is the partner's step.
  */
 interface OnboardedMessage {
     type: `${typeof MESSAGE_PREFIX}onboarded`;
     v: typeof PROTOCOL_VERSION;
     address: `0x${string}`;
     chain: string;
-    status: "approved" | "pending";
+    created: boolean;
+    /**
+     * @deprecated Sent by wallet versions that registered the wallet themselves (before ADR-0059). Ignored.
+     */
+    status?: "approved" | "pending";
 }
 /** The onboarding wizard did not produce a wallet. `message` is optional diagnostics for the partner. */
 interface OnboardCancelledMessage {
@@ -126,7 +190,7 @@ interface OnboardCancelledMessage {
     reason: "user" | "refused" | "error";
     message?: string;
 }
-type WalletToPartnerMessage = ReadyMessage | ResponseMessage | EventMessage | OnboardedMessage | OnboardCancelledMessage;
+type WalletToPartnerMessage = ReadyMessage | ResponseMessage | EventMessage | SecurityMessage | OnboardedMessage | OnboardCancelledMessage;
 interface RequestMessage {
     type: `${typeof MESSAGE_PREFIX}request`;
     v: typeof PROTOCOL_VERSION;
@@ -144,22 +208,39 @@ type PartnerToWalletMessage = RequestMessage | DisconnectMessage;
 declare function isReadyMessage(value: unknown): value is ReadyMessage;
 declare function isResponseMessage(value: unknown): value is ResponseMessage;
 declare function isEventMessage(value: unknown): value is EventMessage;
+/** True for a `security` message with a known `protection` value and whole, non-negative factor counts. */
+declare function isSecurityMessage(value: unknown): value is SecurityMessage;
 declare function isRequestMessage(value: unknown): value is RequestMessage;
 declare function isDisconnectMessage(value: unknown): value is DisconnectMessage;
 declare function isOnboardedMessage(value: unknown): value is OnboardedMessage;
 declare function isOnboardCancelledMessage(value: unknown): value is OnboardCancelledMessage;
 /** A CAIP-2 EVM chain id, for example `eip155:80002` (Polygon Amoy) or `eip155:1` (mainnet). */
 declare function isCaip2EvmChain(value: string): boolean;
-/** The URL the partner opens. `partnerOrigin` is `window.location.origin` of the partner page. */
-declare function connectUrl(walletUrl: string, partnerOrigin: string): string;
+/**
+ * The URL the partner opens. `partnerOrigin` is `window.location.origin` of the partner page. `signIn` adds the
+ * optional sign-in hint; it is only a hint and the wallet may ignore it.
+ */
+declare function connectUrl(walletUrl: string, partnerOrigin: string, signIn?: SignInHint): string;
 /**
  * The URL the partner opens for the onboarding wizard. `partnerOrigin` is `window.location.origin` of the
  * partner page; `chain` is the CAIP-2 chain id the new wallet should be created on; `locale` is passed as `lang`
- * when the partner wants a specific wizard language.
+ * when the partner wants a specific wizard language. `signIn` adds the optional sign-in hint; it is only a hint
+ * and the wallet may ignore it.
  */
 declare function onboardUrl(walletUrl: string, partnerOrigin: string, options: {
     chain: string;
     locale?: string;
+    add?: boolean;
+    signIn?: SignInHint;
+}): string;
+/**
+ * The URL the partner opens to manage the wallet. `partnerOrigin` is `window.location.origin` of the partner
+ * page. `locale` is passed as `lang` when the partner wants a specific language. `signIn` adds the optional
+ * sign-in hint; it is only a hint and the wallet may ignore it.
+ */
+declare function manageUrl(walletUrl: string, partnerOrigin: string, options?: {
+    locale?: string;
+    signIn?: SignInHint;
 }): string;
 
-export { CONNECT_PATH, type DisconnectMessage, type EventMessage, MESSAGE_PREFIX, ONBOARD_PATH, type OnboardCancelledMessage, type OnboardedMessage, PROTOCOL_VERSION, type PartnerToWalletMessage, type ReadyMessage, type RequestMessage, type ResponseMessage, type RpcError, RpcErrorCode, SUPPORTED_METHODS, type SupportedMethod, type WalletToPartnerMessage, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSupportedMethod, onboardUrl };
+export { CONNECT_PATH, type DisconnectMessage, type EventMessage, MANAGE_PATH, MESSAGE_PREFIX, ONBOARD_PATH, type OnboardCancelledMessage, type OnboardedMessage, PROTOCOL_VERSION, type PartnerToWalletMessage, type ReadyMessage, type RequestMessage, type ResponseMessage, type RpcError, RpcErrorCode, SIGN_IN_HINTS, SUPPORTED_METHODS, type SecurityMessage, type SignInHint, type SupportedMethod, type WalletProtection, type WalletSecurityStatus, type WalletToPartnerMessage, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSecurityMessage, isSignInHint, isSupportedMethod, manageUrl, onboardUrl };

package/dist/protocol.js

@@ -1,3 +1,3 @@
-export { CONNECT_PATH, MESSAGE_PREFIX, ONBOARD_PATH, PROTOCOL_VERSION, RpcErrorCode, SUPPORTED_METHODS, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSupportedMethod, onboardUrl } from './chunk-FRKTOKLC.js';
+export { CONNECT_PATH, MANAGE_PATH, MESSAGE_PREFIX, ONBOARD_PATH, PROTOCOL_VERSION, RpcErrorCode, SIGN_IN_HINTS, SUPPORTED_METHODS, connectUrl, isCaip2EvmChain, isDisconnectMessage, isEventMessage, isOnboardCancelledMessage, isOnboardedMessage, isReadyMessage, isRequestMessage, isResponseMessage, isSecurityMessage, isSignInHint, isSupportedMethod, manageUrl, onboardUrl } from './chunk-H7PEM735.js';
 //# sourceMappingURL=protocol.js.map
 //# sourceMappingURL=protocol.js.map

package/dist/{provider-BEIsX3q_.d.ts → provider-Cn9rPKZh.d.cts}

@@ -1,10 +1,20 @@
+import { WalletSecurityStatus, SignInHint } from './protocol.cjs';
+
+/**
+ * EIP-1193 provider for the Assetera Wallet pop-up — the opener side of the ADR-0054 D3/D4 protocol.
+ *
+ * The provider owns a single pop-up (`window.open(connectUrl(...), "assetera-wallet", ...)`) and speaks the
+ * wire format defined in `./protocol`. It never touches Dynamic, React, wagmi or viem, so a partner can use it
+ * on its own or through the wagmi / RainbowKit adapters in this package.
+ */
+
 /** Arguments accepted by `request`, mirroring EIP-1193. */
 interface RequestArguments {
     method: string;
     params?: unknown[] | Record<string, unknown>;
 }
-/** EIP-1193 provider events emitted by the pop-up. */
-type ProviderEvent = "accountsChanged" | "chainChanged" | "connect" | "disconnect";
+/** EIP-1193 provider events emitted by the pop-up, plus the wallet security status. */
+type ProviderEvent = "accountsChanged" | "chainChanged" | "connect" | "disconnect" | "assetera_security";
 /**
  * Listener shape for EIP-1193 provider events. `never[]` accepts a listener with any concrete parameter list
  * (for example wagmi's `(accounts: string[]) => void`), while internal emission stays type-safe via a cast.
@@ -16,15 +26,22 @@ interface AsseteraWalletProvider {
     on(event: ProviderEvent, listener: ProviderListener): void;
     removeListener(event: ProviderEvent, listener: ProviderListener): void;
     disconnect(): void;
+    /**
+     * The last security status reported by a wallet pop-up, or `undefined` when none arrived yet. A closed pop-up
+     * does not clear it.
+     */
+    lastSecurityStatus(): WalletSecurityStatus | undefined;
 }
 /** Options for {@link createAsseteraWalletProvider}. */
 interface AsseteraWalletProviderOptions {
-    /** Base URL of the wallet origin, e.g. `https://wallet.playground.assetera.com`. */
+    /** Base URL of the wallet origin, e.g. `https://wallet.wallet-staging.assetera.com`. */
     walletUrl: string;
     /** Chain id used before the wallet reports one, and as the local `eth_chainId` fallback. */
     defaultChainId: number;
     /** `window.open` feature string. Defaults to `"popup,width=420,height=720"`. */
     popupFeatures?: string;
+    /** Sign-in hint passed as `signIn`. Only a hint; the wallet may ignore it. */
+    signIn?: SignInHint;
 }
 /**
  * EIP-1193 error carrying a JSON-RPC `code` (and optional `data`). This is what every rejected `request`

package/dist/{provider-BEIsX3q_.d.cts → provider-OStA8Fqx.d.ts}

@@ -1,10 +1,20 @@
+import { WalletSecurityStatus, SignInHint } from './protocol.js';
+
+/**
+ * EIP-1193 provider for the Assetera Wallet pop-up — the opener side of the ADR-0054 D3/D4 protocol.
+ *
+ * The provider owns a single pop-up (`window.open(connectUrl(...), "assetera-wallet", ...)`) and speaks the
+ * wire format defined in `./protocol`. It never touches Dynamic, React, wagmi or viem, so a partner can use it
+ * on its own or through the wagmi / RainbowKit adapters in this package.
+ */
+
 /** Arguments accepted by `request`, mirroring EIP-1193. */
 interface RequestArguments {
     method: string;
     params?: unknown[] | Record<string, unknown>;
 }
-/** EIP-1193 provider events emitted by the pop-up. */
-type ProviderEvent = "accountsChanged" | "chainChanged" | "connect" | "disconnect";
+/** EIP-1193 provider events emitted by the pop-up, plus the wallet security status. */
+type ProviderEvent = "accountsChanged" | "chainChanged" | "connect" | "disconnect" | "assetera_security";
 /**
  * Listener shape for EIP-1193 provider events. `never[]` accepts a listener with any concrete parameter list
  * (for example wagmi's `(accounts: string[]) => void`), while internal emission stays type-safe via a cast.
@@ -16,15 +26,22 @@ interface AsseteraWalletProvider {
     on(event: ProviderEvent, listener: ProviderListener): void;
     removeListener(event: ProviderEvent, listener: ProviderListener): void;
     disconnect(): void;
+    /**
+     * The last security status reported by a wallet pop-up, or `undefined` when none arrived yet. A closed pop-up
+     * does not clear it.
+     */
+    lastSecurityStatus(): WalletSecurityStatus | undefined;
 }
 /** Options for {@link createAsseteraWalletProvider}. */
 interface AsseteraWalletProviderOptions {
-    /** Base URL of the wallet origin, e.g. `https://wallet.playground.assetera.com`. */
+    /** Base URL of the wallet origin, e.g. `https://wallet.wallet-staging.assetera.com`. */
     walletUrl: string;
     /** Chain id used before the wallet reports one, and as the local `eth_chainId` fallback. */
     defaultChainId: number;
     /** `window.open` feature string. Defaults to `"popup,width=420,height=720"`. */
     popupFeatures?: string;
+    /** Sign-in hint passed as `signIn`. Only a hint; the wallet may ignore it. */
+    signIn?: SignInHint;
 }
 /**
  * EIP-1193 error carrying a JSON-RPC `code` (and optional `data`). This is what every rejected `request`

package/dist/rainbowkit.cjs

@@ -47,10 +47,26 @@ function isResponseMessage(value) {
 function isEventMessage(value) {
   return hasType(value, "event") && (value.event === "accountsChanged" || value.event === "chainChanged" || value.event === "disconnect");
 }
-function connectUrl(walletUrl, partnerOrigin) {
+var WALLET_PROTECTIONS = [
+  "unknown",
+  "add-factor",
+  "save-codes",
+  "create-codes",
+  "protected"
+];
+function isCount(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function isSecurityMessage(value) {
+  if (!hasType(value, "security")) return false;
+  const data = value.data;
+  return isRecord(data) && typeof data.protection === "string" && WALLET_PROTECTIONS.includes(data.protection) && isCount(data.passkeys) && isCount(data.authenticatorApps);
+}
+function connectUrl(walletUrl, partnerOrigin, signIn) {
   const url = new URL(CONNECT_PATH, walletUrl);
   url.searchParams.set("origin", partnerOrigin);
   url.searchParams.set("v", String(PROTOCOL_VERSION));
+  if (signIn !== void 0) url.searchParams.set("signIn", signIn);
   return url.toString();
 }
 
@@ -96,6 +112,7 @@ function createAsseteraWalletProvider(options) {
   let accounts = [];
   let chainIdHex = null;
   let walletDisconnected = false;
+  let lastSecurity;
   const pending = /* @__PURE__ */ new Map();
   const listeners = /* @__PURE__ */ new Map();
   let closeTimer = null;
@@ -170,7 +187,7 @@ function createAsseteraWalletProvider(options) {
     }
     if (typeof window === "undefined") return null;
     const opened = window.open(
-      connectUrl(options.walletUrl, window.location.origin),
+      connectUrl(options.walletUrl, window.location.origin, options.signIn),
       POPUP_NAME,
       popupFeatures
     );
@@ -221,6 +238,14 @@ function createAsseteraWalletProvider(options) {
     walletDisconnected = true;
     emit("disconnect", new ProviderRpcError(message.data.code, message.data.message, message.data.data));
   }
+  function handleSecurityMessage(message) {
+    lastSecurity = {
+      protection: message.data.protection,
+      passkeys: message.data.passkeys,
+      authenticatorApps: message.data.authenticatorApps
+    };
+    emit("assetera_security", lastSecurity);
+  }
   function onWindowMessage(event) {
     if (event.origin !== walletOrigin) return;
     if (popup === null || event.source !== popup) return;
@@ -233,6 +258,10 @@ function createAsseteraWalletProvider(options) {
       handleResponse(data);
       return;
     }
+    if (isSecurityMessage(data)) {
+      handleSecurityMessage(data);
+      return;
+    }
     if (isEventMessage(data)) handleEventMessage(data);
   }
   if (typeof window !== "undefined") window.addEventListener("message", onWindowMessage);
@@ -305,7 +334,10 @@ function createAsseteraWalletProvider(options) {
   function removeListener(event, listener) {
     removeEventListener(event, listener);
   }
-  return { request, on, removeListener, disconnect };
+  function lastSecurityStatus() {
+    return lastSecurity;
+  }
+  return { request, on, removeListener, disconnect, lastSecurityStatus };
 }
 
 // src/wagmi.ts
@@ -385,7 +417,8 @@ function asseteraWallet(parameters) {
       if (!provider) {
         provider = createAsseteraWalletProvider({
           walletUrl: parameters.walletUrl,
-          defaultChainId: config.chains[0].id
+          defaultChainId: config.chains[0].id,
+          ...parameters.signIn === void 0 ? {} : { signIn: parameters.signIn }
         });
       }
       return provider;
@@ -435,7 +468,10 @@ function asseteraRainbowWallet(options) {
     iconBackground: "#1a1a2e",
     installed: true,
     createConnector: (walletDetails) => core.createConnector((config) => ({
-      ...asseteraWallet({ walletUrl: options.walletUrl })(config),
+      ...asseteraWallet({
+        walletUrl: options.walletUrl,
+        ...options.signIn === void 0 ? {} : { signIn: options.signIn }
+      })(config),
       ...walletDetails
     }))
   });