@auphere/embed 0.1.0

package/README.md

@@ -0,0 +1,116 @@
+# @auphere/embed
+
+Send WhatsApp template broadcasts from **your own product**, powered by
+[Auphere](https://auphere.com). This SDK is a thin loader: it mounts a
+secure Auphere iframe and hands it a short-lived session token. Your
+bundle never contains Auphere or WhatsApp credentials, and the modal UI
+updates without you redeploying.
+
+## Install
+
+```bash
+npm install @auphere/embed
+```
+
+## 1. Mint session tokens in YOUR backend
+
+Your secret API key (`ak_live_…`) must never reach the browser. Expose a
+tiny endpoint that exchanges it for a short-lived widget session:
+
+```ts
+// e.g. app/api/auphere/session/route.ts (Next.js)
+export async function POST() {
+  const response = await fetch("https://api.auphere.com/v1/widget-sessions", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${process.env.AUPHERE_SECRET_KEY}`,
+      "Content-Type": "application/json",
+    },
+    // your OWN id for the signed-in client (tenant mapping is automatic)
+    body: JSON.stringify({ external_client_ref: currentClient.id }),
+  });
+  return Response.json(await response.json());
+}
+```
+
+> The endpoint is called on open **and again ~every 15 minutes** while a
+> modal is open, so it must work without user interaction.
+
+Register your client once (idempotent) with
+`POST /v1/partners/clients { external_client_ref, name }`.
+
+## 2. Create the client
+
+```ts
+import { createAuphere } from "@auphere/embed";
+
+const auphere = createAuphere({
+  partnerSlug: "acme", // shown in your Auphere dashboard
+  fetchSession: async () =>
+    (await fetch("/api/auphere/session", { method: "POST" })).json(),
+  appearance: { colorPrimary: "#25D366", radius: "8px" },
+  locale: "es",
+});
+```
+
+## 3a. Broadcast button (React)
+
+The button renders **only when the client's WhatsApp is connected**:
+
+```tsx
+import { AuphereBroadcastButton } from "@auphere/embed/react";
+
+<AuphereBroadcastButton
+  auphere={auphere}
+  recipients={[
+    { phone: "+56912345678", variables: { cliente: "Ana", saldo_pendiente: "$12.000" } },
+    { phone: "+56987654321", variables: { cliente: "Luis", saldo_pendiente: "$8.000" } },
+  ]}
+  className="your-button-class"
+  onDone={({ broadcastId, accepted }) => console.log(broadcastId, accepted)}
+>
+  Campañas WhatsApp
+</AuphereBroadcastButton>;
+```
+
+`variables` keys must match the template's **named parameters** — you
+map your schema to them in your backend. Recipients always come from
+your data; the modal previews and sends, it never invents an audience.
+
+## 3b. Vanilla JS
+
+```ts
+auphere.getStatus();                    // "connected" | "not_connected" | "unknown"
+auphere.onStatusChange((s) => { ... }); // subscription
+
+await auphere.openBroadcast({ recipients });
+```
+
+## 4. Connect WhatsApp (self-serve signup)
+
+Call it from your settings/onboarding page — it opens Meta's Embedded
+Signup inside the Auphere iframe:
+
+```ts
+await auphere.connectWhatsApp({
+  onConnected: ({ displayPhoneNumber }) => refreshUI(),
+});
+```
+
+## Security model (short version)
+
+- Your secret key lives only in your backend; the browser only ever
+  holds a 15-minute JWT scoped to one client.
+- The modal runs on `embed.auphere.com`, isolated from your page's JS.
+- Tokens travel via `postMessage` with strict origin checks — never in
+  URLs or cookies.
+- Allowed embedding origins are configured per API key in the Auphere
+  dashboard; other origins are blocked by CSP.
+
+## Content-Security-Policy
+
+If your site sets a CSP, allow:
+
+```
+frame-src https://embed.auphere.com;
+```

package/dist/index.cjs

@@ -0,0 +1,223 @@
+'use strict';
+
+// src/constants.ts
+var DEFAULT_EMBED_ORIGIN = "https://embed.auphere.com";
+var MSG = {
+  // iframe → loader
+  READY: "auph:ready",
+  CLOSE: "auph:close",
+  STATUS: "auph:status",
+  BROADCAST_DONE: "auph:broadcast:done",
+  TOKEN_EXPIRING: "auph:token:expiring",
+  CONNECTED: "auph:connected",
+  ERROR: "auph:error",
+  // loader → iframe
+  INIT: "auph:init",
+  TOKEN: "auph:token"
+};
+
+// src/iframe-manager.ts
+var OVERLAY_Z = 2147483646;
+function openOverlay(options) {
+  const { url, embedOrigin, title, onMessage, onClose } = options;
+  const previousFocus = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+  const previousOverflow = document.body.style.overflow;
+  const backdrop = document.createElement("div");
+  backdrop.setAttribute("data-auphere-embed", "");
+  backdrop.style.cssText = [
+    "position:fixed",
+    "inset:0",
+    `z-index:${OVERLAY_Z}`,
+    "background:rgba(0,0,0,0.45)",
+    "opacity:0",
+    "transition:opacity 200ms ease"
+  ].join(";");
+  const iframe = document.createElement("iframe");
+  iframe.src = url;
+  iframe.title = title;
+  iframe.setAttribute("role", "dialog");
+  iframe.setAttribute("aria-modal", "true");
+  iframe.allow = "clipboard-write";
+  iframe.style.cssText = [
+    "position:fixed",
+    "inset:0",
+    "width:100%",
+    "height:100%",
+    "border:0",
+    `z-index:${OVERLAY_Z + 1}`,
+    "background:transparent",
+    "color-scheme:normal"
+  ].join(";");
+  let closed = false;
+  function handleMessage(event) {
+    if (event.origin !== embedOrigin) return;
+    if (event.source !== iframe.contentWindow) return;
+    const data = event.data;
+    if (!data || typeof data.type !== "string" || !data.type.startsWith("auph:")) return;
+    onMessage(data.type, data);
+  }
+  function handleKeydown(event) {
+    if (event.key === "Escape") close();
+  }
+  function close() {
+    if (closed) return;
+    closed = true;
+    window.removeEventListener("message", handleMessage);
+    document.removeEventListener("keydown", handleKeydown);
+    document.body.style.overflow = previousOverflow;
+    backdrop.remove();
+    iframe.remove();
+    previousFocus?.focus?.();
+    onClose();
+  }
+  window.addEventListener("message", handleMessage);
+  document.addEventListener("keydown", handleKeydown);
+  document.body.style.overflow = "hidden";
+  document.body.append(backdrop, iframe);
+  requestAnimationFrame(() => {
+    backdrop.style.opacity = "1";
+  });
+  iframe.focus();
+  return {
+    post(type, payload = {}) {
+      iframe.contentWindow?.postMessage({ type, ...payload }, embedOrigin);
+    },
+    close
+  };
+}
+
+// src/index.ts
+function normalizeSession(raw) {
+  if ("sessionToken" in raw && typeof raw.sessionToken === "string") return raw;
+  const wire = raw;
+  return {
+    sessionToken: wire.session_token,
+    expiresIn: wire.expires_in,
+    whatsapp: wire.whatsapp ? {
+      status: wire.whatsapp.status,
+      displayPhoneNumber: wire.whatsapp.display_phone_number ?? null
+    } : void 0
+  };
+}
+function createAuphere(config) {
+  if (typeof config?.fetchSession !== "function") {
+    throw new Error("@auphere/embed: `fetchSession` is required");
+  }
+  if (!config.partnerSlug) {
+    throw new Error("@auphere/embed: `partnerSlug` is required");
+  }
+  const embedOrigin = (config.embedOrigin ?? DEFAULT_EMBED_ORIGIN).replace(/\/+$/, "");
+  let status = "unknown";
+  const listeners = /* @__PURE__ */ new Set();
+  let activeOverlay = null;
+  function setStatus(next) {
+    if (next === status) return;
+    status = next;
+    listeners.forEach((listener) => listener(status));
+  }
+  async function mintSession() {
+    const session = normalizeSession(await config.fetchSession());
+    if (!session.sessionToken) {
+      throw new Error("@auphere/embed: fetchSession returned no session token");
+    }
+    if (session.whatsapp?.status) setStatus(session.whatsapp.status);
+    return session;
+  }
+  function iframeUrl(route) {
+    return `${embedOrigin}/${route}?p=${encodeURIComponent(config.partnerSlug)}`;
+  }
+  async function open(route, handlers) {
+    if (activeOverlay) activeOverlay.close();
+    const session = await mintSession();
+    await new Promise((resolve, reject) => {
+      let settled = false;
+      const overlay = openOverlay({
+        url: iframeUrl(route),
+        embedOrigin,
+        title: route === "broadcast" ? "Auphere \u2014 Campa\xF1as WhatsApp" : "Auphere \u2014 Conectar WhatsApp",
+        onClose: () => {
+          activeOverlay = null;
+          handlers.onExit?.();
+          if (!settled) {
+            settled = true;
+            resolve();
+          }
+        },
+        onMessage: (type, payload) => {
+          switch (type) {
+            case MSG.READY:
+              overlay.post(MSG.INIT, {
+                mode: route,
+                token: session.sessionToken,
+                appearance: config.appearance ?? {},
+                locale: config.locale ?? document.documentElement.lang ?? "es",
+                recipients: handlers.recipients ?? []
+              });
+              if (!settled) {
+                settled = true;
+                resolve();
+              }
+              break;
+            case MSG.TOKEN_EXPIRING:
+              void mintSession().then((fresh) => overlay.post(MSG.TOKEN, { token: fresh.sessionToken })).catch(() => overlay.post(MSG.ERROR, { code: "token_refresh_failed" }));
+              break;
+            case MSG.STATUS: {
+              const value = payload["whatsappConnected"];
+              if (typeof value === "boolean") setStatus(value ? "connected" : "not_connected");
+              break;
+            }
+            case MSG.BROADCAST_DONE:
+              handlers.onDone?.({
+                broadcastId: String(payload["broadcastId"] ?? ""),
+                accepted: Number(payload["accepted"] ?? 0)
+              });
+              break;
+            case MSG.CONNECTED:
+              setStatus("connected");
+              handlers.onConnected?.({
+                displayPhoneNumber: typeof payload["displayPhoneNumber"] === "string" ? payload["displayPhoneNumber"] : null
+              });
+              break;
+            case MSG.CLOSE:
+              overlay.close();
+              break;
+            case MSG.ERROR:
+              if (!settled) {
+                settled = true;
+                overlay.close();
+                reject(new Error(`@auphere/embed: ${String(payload["code"] ?? "embed_error")}`));
+              }
+              break;
+          }
+        }
+      });
+      activeOverlay = overlay;
+    });
+  }
+  return {
+    getStatus: () => status,
+    async refreshStatus() {
+      await mintSession();
+      return status;
+    },
+    onStatusChange(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    openBroadcast(options) {
+      return open("broadcast", options);
+    },
+    connectWhatsApp(options = {}) {
+      return open("signup", options);
+    },
+    destroy() {
+      activeOverlay?.close();
+      activeOverlay = null;
+      listeners.clear();
+    }
+  };
+}
+
+exports.createAuphere = createAuphere;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/iframe-manager.ts","../src/index.ts"],"names":[],"mappings":";;;AACO,IAAM,oBAAA,GAAuB,2BAAA;AAG7B,IAAM,GAAA,GAAM;AAAA;AAAA,EAEjB,KAAA,EAAO,YAAA;AAAA,EAEP,KAAA,EAAO,YAAA;AAAA,EACP,MAAA,EAAQ,aAAA;AAAA,EACR,cAAA,EAAgB,qBAAA;AAAA,EAChB,cAAA,EAAgB,qBAAA;AAAA,EAChB,SAAA,EAAW,gBAAA;AAAA,EACX,KAAA,EAAO,YAAA;AAAA;AAAA,EAEP,IAAA,EAAM,WAAA;AAAA,EACN,KAAA,EAAO;AACT,CAAA;;;ACQA,IAAM,SAAA,GAAY,UAAA;AAEX,SAAS,YAAY,OAAA,EAMV;AAChB,EAAA,MAAM,EAAE,GAAA,EAAK,WAAA,EAAa,KAAA,EAAO,SAAA,EAAW,SAAQ,GAAI,OAAA;AAExD,EAAA,MAAM,aAAA,GACJ,QAAA,CAAS,aAAA,YAAyB,WAAA,GAAc,SAAS,aAAA,GAAgB,IAAA;AAC3E,EAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,QAAA;AAE7C,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AAC7C,EAAA,QAAA,CAAS,YAAA,CAAa,sBAAsB,EAAE,CAAA;AAC9C,EAAA,QAAA,CAAS,MAAM,OAAA,GAAU;AAAA,IACvB,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAW,SAAS,CAAA,CAAA;AAAA,IACpB,6BAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,GAAG,CAAA;AAEV,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,EAAA,MAAA,CAAO,GAAA,GAAM,GAAA;AACb,EAAA,MAAA,CAAO,KAAA,GAAQ,KAAA;AACf,EAAA,MAAA,CAAO,YAAA,CAAa,QAAQ,QAAQ,CAAA;AACpC,EAAA,MAAA,CAAO,YAAA,CAAa,cAAc,MAAM,CAAA;AACxC,EAAA,MAAA,CAAO,KAAA,GAAQ,iBAAA;AACf,EAAA,MAAA,CAAO,MAAM,OAAA,GAAU;AAAA,IACrB,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA;AAAA,IACA,UAAA;AAAA,IACA,CAAA,QAAA,EAAW,YAAY,CAAC,CAAA,CAAA;AAAA,IACxB,wBAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,GAAG,CAAA;AAEV,EAAA,IAAI,MAAA,GAAS,KAAA;AAEb,EAAA,SAAS,cAAc,KAAA,EAA2B;AAGhD,IAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AAC3C,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,CAAC,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,EAAG;AAC9E,IAAA,SAAA,CAAU,IAAA,CAAK,MAAM,IAA+B,CAAA;AAAA,EACtD;AAEA,EAAA,SAAS,cAAc,KAAA,EAA4B;AACjD,IAAA,IAAI,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU,KAAA,EAAM;AAAA,EACpC;AAEA,EAAA,SAAS,KAAA,GAAc;AACrB,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AACnD,IAAA,QAAA,CAAS,mBAAA,CAAoB,WAAW,aAAa,CAAA;AACrD,IAAA,QAAA,CAAS,IAAA,CAAK,MAAM,QAAA,GAAW,gBAAA;AAC/B,IAAA,QAAA,CAAS,MAAA,EAAO;AAChB,IAAA,MAAA,CAAO,MAAA,EAAO;AACd,IAAA,aAAA,EAAe,KAAA,IAAQ;AACvB,IAAA,OAAA,EAAQ;AAAA,EACV;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAChD,EAAA,QAAA,CAAS,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAClD,EAAA,QAAA,CAAS,IAAA,CAAK,MAAM,QAAA,GAAW,QAAA;AAC/B,EAAA,QAAA,CAAS,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,MAAM,CAAA;AACrC,EAAA,qBAAA,CAAsB,MAAM;AAC1B,IAAA,QAAA,CAAS,MAAM,OAAA,GAAU,GAAA;AAAA,EAC3B,CAAC,CAAA;AACD,EAAA,MAAA,CAAO,KAAA,EAAM;AAEb,EAAA,OAAO;AAAA,IACL,IAAA,CAAK,IAAA,EAAM,OAAA,GAAU,EAAC,EAAG;AAGvB,MAAA,MAAA,CAAO,eAAe,WAAA,CAAY,EAAE,MAAM,GAAG,OAAA,IAAW,WAAW,CAAA;AAAA,IACrE,CAAA;AAAA,IACA;AAAA,GACF;AACF;;;AC1EA,SAAS,iBAAiB,GAAA,EAAuD;AAC/E,EAAA,IAAI,kBAAkB,GAAA,IAAO,OAAO,GAAA,CAAI,YAAA,KAAiB,UAAU,OAAO,GAAA;AAC1E,EAAA,MAAM,IAAA,GAAO,GAAA;AACb,EAAA,OAAO;AAAA,IACL,cAAc,IAAA,CAAK,aAAA;AAAA,IACnB,WAAW,IAAA,CAAK,UAAA;AAAA,IAChB,QAAA,EAAU,KAAK,QAAA,GACX;AAAA,MACE,MAAA,EAAQ,KAAK,QAAA,CAAS,MAAA;AAAA,MACtB,kBAAA,EAAoB,IAAA,CAAK,QAAA,CAAS,oBAAA,IAAwB;AAAA,KAC5D,GACA;AAAA,GACN;AACF;AAEO,SAAS,cAAc,MAAA,EAAgC;AAC5D,EAAA,IAAI,OAAO,MAAA,EAAQ,YAAA,KAAiB,UAAA,EAAY;AAC9C,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC7D;AACA,EAAA,MAAM,eAAe,MAAA,CAAO,WAAA,IAAe,oBAAA,EAAsB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAEnF,EAAA,IAAI,MAAA,GAA2B,SAAA;AAC/B,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAwC;AAC9D,EAAA,IAAI,aAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,UAAU,IAAA,EAA8B;AAC/C,IAAA,IAAI,SAAS,MAAA,EAAQ;AACrB,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,SAAA,CAAU,OAAA,CAAQ,CAAC,QAAA,KAAa,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EAClD;AAEA,EAAA,eAAe,WAAA,GAAsC;AACnD,IAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,MAAM,MAAA,CAAO,cAAc,CAAA;AAC5D,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU,MAAA,EAAQ,SAAA,CAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAC/D,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAU,KAAA,EAAuC;AACxD,IAAA,OAAO,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,MAAM,kBAAA,CAAmB,MAAA,CAAO,WAAW,CAAC,CAAA,CAAA;AAAA,EAC5E;AAEA,EAAA,eAAe,IAAA,CACb,OACA,QAAA,EAMe;AACf,IAAA,IAAI,aAAA,gBAA6B,KAAA,EAAM;AACvC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAElC,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,MAAM,UAAU,WAAA,CAAY;AAAA,QAC1B,GAAA,EAAK,UAAU,KAAK,CAAA;AAAA,QACpB,WAAA;AAAA,QACA,KAAA,EAAO,KAAA,KAAU,WAAA,GAAc,qCAAA,GAAgC,kCAAA;AAAA,QAC/D,SAAS,MAAM;AACb,UAAA,aAAA,GAAgB,IAAA;AAChB,UAAA,QAAA,CAAS,MAAA,IAAS;AAClB,UAAA,IAAI,CAAC,OAAA,EAAS;AACZ,YAAA,OAAA,GAAU,IAAA;AACV,YAAA,OAAA,EAAQ;AAAA,UACV;AAAA,QACF,CAAA;AAAA,QACA,SAAA,EAAW,CAAC,IAAA,EAAM,OAAA,KAAY;AAC5B,UAAA,QAAQ,IAAA;AAAM,YACZ,KAAK,GAAA,CAAI,KAAA;AACP,cAAA,OAAA,CAAQ,IAAA,CAAK,IAAI,IAAA,EAAM;AAAA,gBACrB,IAAA,EAAM,KAAA;AAAA,gBACN,OAAO,OAAA,CAAQ,YAAA;AAAA,gBACf,UAAA,EAAY,MAAA,CAAO,UAAA,IAAc,EAAC;AAAA,gBAClC,MAAA,EAAQ,MAAA,CAAO,MAAA,IAAU,QAAA,CAAS,gBAAgB,IAAA,IAAQ,IAAA;AAAA,gBAC1D,UAAA,EAAY,QAAA,CAAS,UAAA,IAAc;AAAC,eACrC,CAAA;AACD,cAAA,IAAI,CAAC,OAAA,EAAS;AACZ,gBAAA,OAAA,GAAU,IAAA;AACV,gBAAA,OAAA,EAAQ;AAAA,cACV;AACA,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,cAAA;AACP,cAAA,KAAK,WAAA,EAAY,CACd,IAAA,CAAK,CAAC,KAAA,KAAU,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,EAAE,KAAA,EAAO,KAAA,CAAM,YAAA,EAAc,CAAC,CAAA,CACtE,KAAA,CAAM,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,EAAE,IAAA,EAAM,sBAAA,EAAwB,CAAC,CAAA;AACxE,cAAA;AAAA,YACF,KAAK,IAAI,MAAA,EAAQ;AACf,cAAA,MAAM,KAAA,GAAQ,QAAQ,mBAAmB,CAAA;AACzC,cAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,SAAA,CAAU,KAAA,GAAQ,cAAc,eAAe,CAAA;AAC/E,cAAA;AAAA,YACF;AAAA,YACA,KAAK,GAAA,CAAI,cAAA;AACP,cAAA,QAAA,CAAS,MAAA,GAAS;AAAA,gBAChB,WAAA,EAAa,MAAA,CAAO,OAAA,CAAQ,aAAa,KAAK,EAAE,CAAA;AAAA,gBAChD,QAAA,EAAU,MAAA,CAAO,OAAA,CAAQ,UAAU,KAAK,CAAC;AAAA,eAC1C,CAAA;AACD,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,SAAA;AACP,cAAA,SAAA,CAAU,WAAW,CAAA;AACrB,cAAA,QAAA,CAAS,WAAA,GAAc;AAAA,gBACrB,kBAAA,EACE,OAAO,OAAA,CAAQ,oBAAoB,MAAM,QAAA,GACrC,OAAA,CAAQ,oBAAoB,CAAA,GAC5B;AAAA,eACP,CAAA;AACD,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,KAAA;AACP,cAAA,OAAA,CAAQ,KAAA,EAAM;AACd,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,KAAA;AACP,cAAA,IAAI,CAAC,OAAA,EAAS;AACZ,gBAAA,OAAA,GAAU,IAAA;AACV,gBAAA,OAAA,CAAQ,KAAA,EAAM;AACd,gBAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,IAAK,aAAa,CAAC,CAAA,CAAE,CAAC,CAAA;AAAA,cACjF;AACA,cAAA;AAAA;AACJ,QACF;AAAA,OACD,CAAA;AACD,MAAA,aAAA,GAAgB,OAAA;AAAA,IAClB,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,WAAW,MAAM,MAAA;AAAA,IACjB,MAAM,aAAA,GAAgB;AACpB,MAAA,MAAM,WAAA,EAAY;AAClB,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,eAAe,QAAA,EAAU;AACvB,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,cAAc,OAAA,EAA+B;AAC3C,MAAA,OAAO,IAAA,CAAK,aAAa,OAAO,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,eAAA,CAAgB,OAAA,GAAkC,EAAC,EAAG;AACpD,MAAA,OAAO,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,IAC/B,CAAA;AAAA,IACA,OAAA,GAAU;AACR,MAAA,aAAA,EAAe,KAAA,EAAM;AACrB,MAAA,aAAA,GAAgB,IAAA;AAChB,MAAA,SAAA,CAAU,KAAA,EAAM;AAAA,IAClB;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/** Production embed origin. Overridable per-instance via `config.embedOrigin` (dev/staging). */\nexport const DEFAULT_EMBED_ORIGIN = \"https://embed.auphere.com\";\n\n/** postMessage envelope namespace — every message is `{ type: \"auph:…\" }`. */\nexport const MSG = {\n  // iframe → loader\n  READY: \"auph:ready\",\n  RESIZE: \"auph:resize\",\n  CLOSE: \"auph:close\",\n  STATUS: \"auph:status\",\n  BROADCAST_DONE: \"auph:broadcast:done\",\n  TOKEN_EXPIRING: \"auph:token:expiring\",\n  CONNECTED: \"auph:connected\",\n  ERROR: \"auph:error\",\n  // loader → iframe\n  INIT: \"auph:init\",\n  TOKEN: \"auph:token\",\n} as const;\n","/**\n * Fullscreen iframe overlay lifecycle (ADR-028).\n *\n * The iframe cannot escape its own box, so the LOADER styles it to\n * cover the viewport (`position: fixed; inset: 0`) while it's open —\n * the \"breakout\" pattern used by Stripe Checkout and Plaid Link.\n * Scroll-lock + focus restore are handled here; the focus trap itself\n * lives inside the iframe document (it owns the focusable elements).\n *\n * Security invariants enforced in this file:\n *  - messages are only accepted from the configured embed origin AND\n *    from this exact iframe's contentWindow;\n *  - outgoing messages always use an explicit `targetOrigin` (never `*`);\n *  - the session token travels ONLY via postMessage — never in the URL.\n */\n\nimport { MSG } from \"./constants\";\n\ntype MessageHandler = (type: string, payload: Record<string, unknown>) => void;\n\nexport interface OverlayHandle {\n  post(type: string, payload?: Record<string, unknown>): void;\n  close(): void;\n}\n\nconst OVERLAY_Z = 2147483646; // one below max — leaves room for the host's own emergency layers\n\nexport function openOverlay(options: {\n  url: string;\n  embedOrigin: string;\n  title: string;\n  onMessage: MessageHandler;\n  onClose: () => void;\n}): OverlayHandle {\n  const { url, embedOrigin, title, onMessage, onClose } = options;\n\n  const previousFocus =\n    document.activeElement instanceof HTMLElement ? document.activeElement : null;\n  const previousOverflow = document.body.style.overflow;\n\n  const backdrop = document.createElement(\"div\");\n  backdrop.setAttribute(\"data-auphere-embed\", \"\");\n  backdrop.style.cssText = [\n    \"position:fixed\",\n    \"inset:0\",\n    `z-index:${OVERLAY_Z}`,\n    \"background:rgba(0,0,0,0.45)\",\n    \"opacity:0\",\n    \"transition:opacity 200ms ease\",\n  ].join(\";\");\n\n  const iframe = document.createElement(\"iframe\");\n  iframe.src = url;\n  iframe.title = title;\n  iframe.setAttribute(\"role\", \"dialog\");\n  iframe.setAttribute(\"aria-modal\", \"true\");\n  iframe.allow = \"clipboard-write\";\n  iframe.style.cssText = [\n    \"position:fixed\",\n    \"inset:0\",\n    \"width:100%\",\n    \"height:100%\",\n    \"border:0\",\n    `z-index:${OVERLAY_Z + 1}`,\n    \"background:transparent\",\n    \"color-scheme:normal\",\n  ].join(\";\");\n\n  let closed = false;\n\n  function handleMessage(event: MessageEvent): void {\n    // Origin AND source must match — a message from another tab or a\n    // nested frame on the same origin is not our modal.\n    if (event.origin !== embedOrigin) return;\n    if (event.source !== iframe.contentWindow) return;\n    const data = event.data as { type?: unknown } | null;\n    if (!data || typeof data.type !== \"string\" || !data.type.startsWith(\"auph:\")) return;\n    onMessage(data.type, data as Record<string, unknown>);\n  }\n\n  function handleKeydown(event: KeyboardEvent): void {\n    if (event.key === \"Escape\") close();\n  }\n\n  function close(): void {\n    if (closed) return;\n    closed = true;\n    window.removeEventListener(\"message\", handleMessage);\n    document.removeEventListener(\"keydown\", handleKeydown);\n    document.body.style.overflow = previousOverflow;\n    backdrop.remove();\n    iframe.remove();\n    previousFocus?.focus?.();\n    onClose();\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n  document.addEventListener(\"keydown\", handleKeydown);\n  document.body.style.overflow = \"hidden\"; // scroll-lock while open\n  document.body.append(backdrop, iframe);\n  requestAnimationFrame(() => {\n    backdrop.style.opacity = \"1\";\n  });\n  iframe.focus();\n\n  return {\n    post(type, payload = {}) {\n      // Explicit targetOrigin — if the frame navigated elsewhere the\n      // browser drops the message instead of leaking the token.\n      iframe.contentWindow?.postMessage({ type, ...payload }, embedOrigin);\n    },\n    close,\n  };\n}\n\nexport { MSG };\n","/**\n * `@auphere/embed` — public entrypoint (ADR-028).\n *\n * ```ts\n * import { createAuphere } from \"@auphere/embed\";\n *\n * const auphere = createAuphere({\n *   partnerSlug: \"acme\",\n *   fetchSession: async () => (await fetch(\"/api/auphere/session\", { method: \"POST\" })).json(),\n * });\n *\n * await auphere.openBroadcast({ recipients: [{ phone: \"+56912345678\", variables: { cliente: \"Ana\" } }] });\n * ```\n */\n\nimport { DEFAULT_EMBED_ORIGIN, MSG } from \"./constants\";\nimport { openOverlay } from \"./iframe-manager\";\nimport type {\n  Auphere,\n  AuphereConfig,\n  ConnectionStatus,\n  ConnectWhatsAppOptions,\n  OpenBroadcastOptions,\n  WidgetSession,\n  WidgetSessionWire,\n} from \"./types\";\n\nexport type {\n  Appearance,\n  Auphere,\n  AuphereConfig,\n  BroadcastRecipient,\n  ConnectionStatus,\n  ConnectWhatsAppOptions,\n  FetchSession,\n  OpenBroadcastOptions,\n  WidgetSession,\n} from \"./types\";\n\nfunction normalizeSession(raw: WidgetSession | WidgetSessionWire): WidgetSession {\n  if (\"sessionToken\" in raw && typeof raw.sessionToken === \"string\") return raw;\n  const wire = raw as WidgetSessionWire;\n  return {\n    sessionToken: wire.session_token,\n    expiresIn: wire.expires_in,\n    whatsapp: wire.whatsapp\n      ? {\n          status: wire.whatsapp.status,\n          displayPhoneNumber: wire.whatsapp.display_phone_number ?? null,\n        }\n      : undefined,\n  };\n}\n\nexport function createAuphere(config: AuphereConfig): Auphere {\n  if (typeof config?.fetchSession !== \"function\") {\n    throw new Error(\"@auphere/embed: `fetchSession` is required\");\n  }\n  if (!config.partnerSlug) {\n    throw new Error(\"@auphere/embed: `partnerSlug` is required\");\n  }\n  const embedOrigin = (config.embedOrigin ?? DEFAULT_EMBED_ORIGIN).replace(/\\/+$/, \"\");\n\n  let status: ConnectionStatus = \"unknown\";\n  const listeners = new Set<(status: ConnectionStatus) => void>();\n  let activeOverlay: { close(): void } | null = null;\n\n  function setStatus(next: ConnectionStatus): void {\n    if (next === status) return;\n    status = next;\n    listeners.forEach((listener) => listener(status));\n  }\n\n  async function mintSession(): Promise<WidgetSession> {\n    const session = normalizeSession(await config.fetchSession());\n    if (!session.sessionToken) {\n      throw new Error(\"@auphere/embed: fetchSession returned no session token\");\n    }\n    if (session.whatsapp?.status) setStatus(session.whatsapp.status);\n    return session;\n  }\n\n  function iframeUrl(route: \"broadcast\" | \"signup\"): string {\n    return `${embedOrigin}/${route}?p=${encodeURIComponent(config.partnerSlug)}`;\n  }\n\n  async function open(\n    route: \"broadcast\" | \"signup\",\n    handlers: {\n      recipients?: OpenBroadcastOptions[\"recipients\"];\n      onDone?: OpenBroadcastOptions[\"onDone\"];\n      onConnected?: ConnectWhatsAppOptions[\"onConnected\"];\n      onExit?: () => void;\n    },\n  ): Promise<void> {\n    if (activeOverlay) activeOverlay.close();\n    const session = await mintSession(); // mint BEFORE mounting: fail fast, no empty modal\n\n    await new Promise<void>((resolve, reject) => {\n      let settled = false;\n      const overlay = openOverlay({\n        url: iframeUrl(route),\n        embedOrigin,\n        title: route === \"broadcast\" ? \"Auphere — Campañas WhatsApp\" : \"Auphere — Conectar WhatsApp\",\n        onClose: () => {\n          activeOverlay = null;\n          handlers.onExit?.();\n          if (!settled) {\n            settled = true;\n            resolve();\n          }\n        },\n        onMessage: (type, payload) => {\n          switch (type) {\n            case MSG.READY:\n              overlay.post(MSG.INIT, {\n                mode: route,\n                token: session.sessionToken,\n                appearance: config.appearance ?? {},\n                locale: config.locale ?? document.documentElement.lang ?? \"es\",\n                recipients: handlers.recipients ?? [],\n              });\n              if (!settled) {\n                settled = true;\n                resolve();\n              }\n              break;\n            case MSG.TOKEN_EXPIRING:\n              void mintSession()\n                .then((fresh) => overlay.post(MSG.TOKEN, { token: fresh.sessionToken }))\n                .catch(() => overlay.post(MSG.ERROR, { code: \"token_refresh_failed\" }));\n              break;\n            case MSG.STATUS: {\n              const value = payload[\"whatsappConnected\"];\n              if (typeof value === \"boolean\") setStatus(value ? \"connected\" : \"not_connected\");\n              break;\n            }\n            case MSG.BROADCAST_DONE:\n              handlers.onDone?.({\n                broadcastId: String(payload[\"broadcastId\"] ?? \"\"),\n                accepted: Number(payload[\"accepted\"] ?? 0),\n              });\n              break;\n            case MSG.CONNECTED:\n              setStatus(\"connected\");\n              handlers.onConnected?.({\n                displayPhoneNumber:\n                  typeof payload[\"displayPhoneNumber\"] === \"string\"\n                    ? payload[\"displayPhoneNumber\"]\n                    : null,\n              });\n              break;\n            case MSG.CLOSE:\n              overlay.close();\n              break;\n            case MSG.ERROR:\n              if (!settled) {\n                settled = true;\n                overlay.close();\n                reject(new Error(`@auphere/embed: ${String(payload[\"code\"] ?? \"embed_error\")}`));\n              }\n              break;\n          }\n        },\n      });\n      activeOverlay = overlay;\n    });\n  }\n\n  return {\n    getStatus: () => status,\n    async refreshStatus() {\n      await mintSession();\n      return status;\n    },\n    onStatusChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n    openBroadcast(options: OpenBroadcastOptions) {\n      return open(\"broadcast\", options);\n    },\n    connectWhatsApp(options: ConnectWhatsAppOptions = {}) {\n      return open(\"signup\", options);\n    },\n    destroy() {\n      activeOverlay?.close();\n      activeOverlay = null;\n      listeners.clear();\n    },\n  };\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,21 @@
+import { A as AuphereConfig, a as Auphere } from './types-BomPnFf3.cjs';
+export { b as Appearance, B as BroadcastRecipient, C as ConnectWhatsAppOptions, c as ConnectionStatus, F as FetchSession, O as OpenBroadcastOptions, W as WidgetSession } from './types-BomPnFf3.cjs';
+
+/**
+ * `@auphere/embed` — public entrypoint (ADR-028).
+ *
+ * ```ts
+ * import { createAuphere } from "@auphere/embed";
+ *
+ * const auphere = createAuphere({
+ *   partnerSlug: "acme",
+ *   fetchSession: async () => (await fetch("/api/auphere/session", { method: "POST" })).json(),
+ * });
+ *
+ * await auphere.openBroadcast({ recipients: [{ phone: "+56912345678", variables: { cliente: "Ana" } }] });
+ * ```
+ */
+
+declare function createAuphere(config: AuphereConfig): Auphere;
+
+export { Auphere, AuphereConfig, createAuphere };

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+import { A as AuphereConfig, a as Auphere } from './types-BomPnFf3.js';
+export { b as Appearance, B as BroadcastRecipient, C as ConnectWhatsAppOptions, c as ConnectionStatus, F as FetchSession, O as OpenBroadcastOptions, W as WidgetSession } from './types-BomPnFf3.js';
+
+/**
+ * `@auphere/embed` — public entrypoint (ADR-028).
+ *
+ * ```ts
+ * import { createAuphere } from "@auphere/embed";
+ *
+ * const auphere = createAuphere({
+ *   partnerSlug: "acme",
+ *   fetchSession: async () => (await fetch("/api/auphere/session", { method: "POST" })).json(),
+ * });
+ *
+ * await auphere.openBroadcast({ recipients: [{ phone: "+56912345678", variables: { cliente: "Ana" } }] });
+ * ```
+ */
+
+declare function createAuphere(config: AuphereConfig): Auphere;
+
+export { Auphere, AuphereConfig, createAuphere };

package/dist/index.js

@@ -0,0 +1,221 @@
+// src/constants.ts
+var DEFAULT_EMBED_ORIGIN = "https://embed.auphere.com";
+var MSG = {
+  // iframe → loader
+  READY: "auph:ready",
+  CLOSE: "auph:close",
+  STATUS: "auph:status",
+  BROADCAST_DONE: "auph:broadcast:done",
+  TOKEN_EXPIRING: "auph:token:expiring",
+  CONNECTED: "auph:connected",
+  ERROR: "auph:error",
+  // loader → iframe
+  INIT: "auph:init",
+  TOKEN: "auph:token"
+};
+
+// src/iframe-manager.ts
+var OVERLAY_Z = 2147483646;
+function openOverlay(options) {
+  const { url, embedOrigin, title, onMessage, onClose } = options;
+  const previousFocus = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+  const previousOverflow = document.body.style.overflow;
+  const backdrop = document.createElement("div");
+  backdrop.setAttribute("data-auphere-embed", "");
+  backdrop.style.cssText = [
+    "position:fixed",
+    "inset:0",
+    `z-index:${OVERLAY_Z}`,
+    "background:rgba(0,0,0,0.45)",
+    "opacity:0",
+    "transition:opacity 200ms ease"
+  ].join(";");
+  const iframe = document.createElement("iframe");
+  iframe.src = url;
+  iframe.title = title;
+  iframe.setAttribute("role", "dialog");
+  iframe.setAttribute("aria-modal", "true");
+  iframe.allow = "clipboard-write";
+  iframe.style.cssText = [
+    "position:fixed",
+    "inset:0",
+    "width:100%",
+    "height:100%",
+    "border:0",
+    `z-index:${OVERLAY_Z + 1}`,
+    "background:transparent",
+    "color-scheme:normal"
+  ].join(";");
+  let closed = false;
+  function handleMessage(event) {
+    if (event.origin !== embedOrigin) return;
+    if (event.source !== iframe.contentWindow) return;
+    const data = event.data;
+    if (!data || typeof data.type !== "string" || !data.type.startsWith("auph:")) return;
+    onMessage(data.type, data);
+  }
+  function handleKeydown(event) {
+    if (event.key === "Escape") close();
+  }
+  function close() {
+    if (closed) return;
+    closed = true;
+    window.removeEventListener("message", handleMessage);
+    document.removeEventListener("keydown", handleKeydown);
+    document.body.style.overflow = previousOverflow;
+    backdrop.remove();
+    iframe.remove();
+    previousFocus?.focus?.();
+    onClose();
+  }
+  window.addEventListener("message", handleMessage);
+  document.addEventListener("keydown", handleKeydown);
+  document.body.style.overflow = "hidden";
+  document.body.append(backdrop, iframe);
+  requestAnimationFrame(() => {
+    backdrop.style.opacity = "1";
+  });
+  iframe.focus();
+  return {
+    post(type, payload = {}) {
+      iframe.contentWindow?.postMessage({ type, ...payload }, embedOrigin);
+    },
+    close
+  };
+}
+
+// src/index.ts
+function normalizeSession(raw) {
+  if ("sessionToken" in raw && typeof raw.sessionToken === "string") return raw;
+  const wire = raw;
+  return {
+    sessionToken: wire.session_token,
+    expiresIn: wire.expires_in,
+    whatsapp: wire.whatsapp ? {
+      status: wire.whatsapp.status,
+      displayPhoneNumber: wire.whatsapp.display_phone_number ?? null
+    } : void 0
+  };
+}
+function createAuphere(config) {
+  if (typeof config?.fetchSession !== "function") {
+    throw new Error("@auphere/embed: `fetchSession` is required");
+  }
+  if (!config.partnerSlug) {
+    throw new Error("@auphere/embed: `partnerSlug` is required");
+  }
+  const embedOrigin = (config.embedOrigin ?? DEFAULT_EMBED_ORIGIN).replace(/\/+$/, "");
+  let status = "unknown";
+  const listeners = /* @__PURE__ */ new Set();
+  let activeOverlay = null;
+  function setStatus(next) {
+    if (next === status) return;
+    status = next;
+    listeners.forEach((listener) => listener(status));
+  }
+  async function mintSession() {
+    const session = normalizeSession(await config.fetchSession());
+    if (!session.sessionToken) {
+      throw new Error("@auphere/embed: fetchSession returned no session token");
+    }
+    if (session.whatsapp?.status) setStatus(session.whatsapp.status);
+    return session;
+  }
+  function iframeUrl(route) {
+    return `${embedOrigin}/${route}?p=${encodeURIComponent(config.partnerSlug)}`;
+  }
+  async function open(route, handlers) {
+    if (activeOverlay) activeOverlay.close();
+    const session = await mintSession();
+    await new Promise((resolve, reject) => {
+      let settled = false;
+      const overlay = openOverlay({
+        url: iframeUrl(route),
+        embedOrigin,
+        title: route === "broadcast" ? "Auphere \u2014 Campa\xF1as WhatsApp" : "Auphere \u2014 Conectar WhatsApp",
+        onClose: () => {
+          activeOverlay = null;
+          handlers.onExit?.();
+          if (!settled) {
+            settled = true;
+            resolve();
+          }
+        },
+        onMessage: (type, payload) => {
+          switch (type) {
+            case MSG.READY:
+              overlay.post(MSG.INIT, {
+                mode: route,
+                token: session.sessionToken,
+                appearance: config.appearance ?? {},
+                locale: config.locale ?? document.documentElement.lang ?? "es",
+                recipients: handlers.recipients ?? []
+              });
+              if (!settled) {
+                settled = true;
+                resolve();
+              }
+              break;
+            case MSG.TOKEN_EXPIRING:
+              void mintSession().then((fresh) => overlay.post(MSG.TOKEN, { token: fresh.sessionToken })).catch(() => overlay.post(MSG.ERROR, { code: "token_refresh_failed" }));
+              break;
+            case MSG.STATUS: {
+              const value = payload["whatsappConnected"];
+              if (typeof value === "boolean") setStatus(value ? "connected" : "not_connected");
+              break;
+            }
+            case MSG.BROADCAST_DONE:
+              handlers.onDone?.({
+                broadcastId: String(payload["broadcastId"] ?? ""),
+                accepted: Number(payload["accepted"] ?? 0)
+              });
+              break;
+            case MSG.CONNECTED:
+              setStatus("connected");
+              handlers.onConnected?.({
+                displayPhoneNumber: typeof payload["displayPhoneNumber"] === "string" ? payload["displayPhoneNumber"] : null
+              });
+              break;
+            case MSG.CLOSE:
+              overlay.close();
+              break;
+            case MSG.ERROR:
+              if (!settled) {
+                settled = true;
+                overlay.close();
+                reject(new Error(`@auphere/embed: ${String(payload["code"] ?? "embed_error")}`));
+              }
+              break;
+          }
+        }
+      });
+      activeOverlay = overlay;
+    });
+  }
+  return {
+    getStatus: () => status,
+    async refreshStatus() {
+      await mintSession();
+      return status;
+    },
+    onStatusChange(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    openBroadcast(options) {
+      return open("broadcast", options);
+    },
+    connectWhatsApp(options = {}) {
+      return open("signup", options);
+    },
+    destroy() {
+      activeOverlay?.close();
+      activeOverlay = null;
+      listeners.clear();
+    }
+  };
+}
+
+export { createAuphere };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants.ts","../src/iframe-manager.ts","../src/index.ts"],"names":[],"mappings":";AACO,IAAM,oBAAA,GAAuB,2BAAA;AAG7B,IAAM,GAAA,GAAM;AAAA;AAAA,EAEjB,KAAA,EAAO,YAAA;AAAA,EAEP,KAAA,EAAO,YAAA;AAAA,EACP,MAAA,EAAQ,aAAA;AAAA,EACR,cAAA,EAAgB,qBAAA;AAAA,EAChB,cAAA,EAAgB,qBAAA;AAAA,EAChB,SAAA,EAAW,gBAAA;AAAA,EACX,KAAA,EAAO,YAAA;AAAA;AAAA,EAEP,IAAA,EAAM,WAAA;AAAA,EACN,KAAA,EAAO;AACT,CAAA;;;ACQA,IAAM,SAAA,GAAY,UAAA;AAEX,SAAS,YAAY,OAAA,EAMV;AAChB,EAAA,MAAM,EAAE,GAAA,EAAK,WAAA,EAAa,KAAA,EAAO,SAAA,EAAW,SAAQ,GAAI,OAAA;AAExD,EAAA,MAAM,aAAA,GACJ,QAAA,CAAS,aAAA,YAAyB,WAAA,GAAc,SAAS,aAAA,GAAgB,IAAA;AAC3E,EAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,QAAA;AAE7C,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,aAAA,CAAc,KAAK,CAAA;AAC7C,EAAA,QAAA,CAAS,YAAA,CAAa,sBAAsB,EAAE,CAAA;AAC9C,EAAA,QAAA,CAAS,MAAM,OAAA,GAAU;AAAA,IACvB,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAW,SAAS,CAAA,CAAA;AAAA,IACpB,6BAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,GAAG,CAAA;AAEV,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,EAAA,MAAA,CAAO,GAAA,GAAM,GAAA;AACb,EAAA,MAAA,CAAO,KAAA,GAAQ,KAAA;AACf,EAAA,MAAA,CAAO,YAAA,CAAa,QAAQ,QAAQ,CAAA;AACpC,EAAA,MAAA,CAAO,YAAA,CAAa,cAAc,MAAM,CAAA;AACxC,EAAA,MAAA,CAAO,KAAA,GAAQ,iBAAA;AACf,EAAA,MAAA,CAAO,MAAM,OAAA,GAAU;AAAA,IACrB,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAA;AAAA,IACA,UAAA;AAAA,IACA,CAAA,QAAA,EAAW,YAAY,CAAC,CAAA,CAAA;AAAA,IACxB,wBAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,GAAG,CAAA;AAEV,EAAA,IAAI,MAAA,GAAS,KAAA;AAEb,EAAA,SAAS,cAAc,KAAA,EAA2B;AAGhD,IAAA,IAAI,KAAA,CAAM,WAAW,WAAA,EAAa;AAClC,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AAC3C,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,CAAC,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,EAAG;AAC9E,IAAA,SAAA,CAAU,IAAA,CAAK,MAAM,IAA+B,CAAA;AAAA,EACtD;AAEA,EAAA,SAAS,cAAc,KAAA,EAA4B;AACjD,IAAA,IAAI,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU,KAAA,EAAM;AAAA,EACpC;AAEA,EAAA,SAAS,KAAA,GAAc;AACrB,IAAA,IAAI,MAAA,EAAQ;AACZ,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AACnD,IAAA,QAAA,CAAS,mBAAA,CAAoB,WAAW,aAAa,CAAA;AACrD,IAAA,QAAA,CAAS,IAAA,CAAK,MAAM,QAAA,GAAW,gBAAA;AAC/B,IAAA,QAAA,CAAS,MAAA,EAAO;AAChB,IAAA,MAAA,CAAO,MAAA,EAAO;AACd,IAAA,aAAA,EAAe,KAAA,IAAQ;AACvB,IAAA,OAAA,EAAQ;AAAA,EACV;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAChD,EAAA,QAAA,CAAS,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAClD,EAAA,QAAA,CAAS,IAAA,CAAK,MAAM,QAAA,GAAW,QAAA;AAC/B,EAAA,QAAA,CAAS,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU,MAAM,CAAA;AACrC,EAAA,qBAAA,CAAsB,MAAM;AAC1B,IAAA,QAAA,CAAS,MAAM,OAAA,GAAU,GAAA;AAAA,EAC3B,CAAC,CAAA;AACD,EAAA,MAAA,CAAO,KAAA,EAAM;AAEb,EAAA,OAAO;AAAA,IACL,IAAA,CAAK,IAAA,EAAM,OAAA,GAAU,EAAC,EAAG;AAGvB,MAAA,MAAA,CAAO,eAAe,WAAA,CAAY,EAAE,MAAM,GAAG,OAAA,IAAW,WAAW,CAAA;AAAA,IACrE,CAAA;AAAA,IACA;AAAA,GACF;AACF;;;AC1EA,SAAS,iBAAiB,GAAA,EAAuD;AAC/E,EAAA,IAAI,kBAAkB,GAAA,IAAO,OAAO,GAAA,CAAI,YAAA,KAAiB,UAAU,OAAO,GAAA;AAC1E,EAAA,MAAM,IAAA,GAAO,GAAA;AACb,EAAA,OAAO;AAAA,IACL,cAAc,IAAA,CAAK,aAAA;AAAA,IACnB,WAAW,IAAA,CAAK,UAAA;AAAA,IAChB,QAAA,EAAU,KAAK,QAAA,GACX;AAAA,MACE,MAAA,EAAQ,KAAK,QAAA,CAAS,MAAA;AAAA,MACtB,kBAAA,EAAoB,IAAA,CAAK,QAAA,CAAS,oBAAA,IAAwB;AAAA,KAC5D,GACA;AAAA,GACN;AACF;AAEO,SAAS,cAAc,MAAA,EAAgC;AAC5D,EAAA,IAAI,OAAO,MAAA,EAAQ,YAAA,KAAiB,UAAA,EAAY;AAC9C,IAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,EAC9D;AACA,EAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,IAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,EAC7D;AACA,EAAA,MAAM,eAAe,MAAA,CAAO,WAAA,IAAe,oBAAA,EAAsB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAEnF,EAAA,IAAI,MAAA,GAA2B,SAAA;AAC/B,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAwC;AAC9D,EAAA,IAAI,aAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,UAAU,IAAA,EAA8B;AAC/C,IAAA,IAAI,SAAS,MAAA,EAAQ;AACrB,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,SAAA,CAAU,OAAA,CAAQ,CAAC,QAAA,KAAa,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,EAClD;AAEA,EAAA,eAAe,WAAA,GAAsC;AACnD,IAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,MAAM,MAAA,CAAO,cAAc,CAAA;AAC5D,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,QAAQ,QAAA,EAAU,MAAA,EAAQ,SAAA,CAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAC/D,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAU,KAAA,EAAuC;AACxD,IAAA,OAAO,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,KAAK,MAAM,kBAAA,CAAmB,MAAA,CAAO,WAAW,CAAC,CAAA,CAAA;AAAA,EAC5E;AAEA,EAAA,eAAe,IAAA,CACb,OACA,QAAA,EAMe;AACf,IAAA,IAAI,aAAA,gBAA6B,KAAA,EAAM;AACvC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAElC,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC3C,MAAA,IAAI,OAAA,GAAU,KAAA;AACd,MAAA,MAAM,UAAU,WAAA,CAAY;AAAA,QAC1B,GAAA,EAAK,UAAU,KAAK,CAAA;AAAA,QACpB,WAAA;AAAA,QACA,KAAA,EAAO,KAAA,KAAU,WAAA,GAAc,qCAAA,GAAgC,kCAAA;AAAA,QAC/D,SAAS,MAAM;AACb,UAAA,aAAA,GAAgB,IAAA;AAChB,UAAA,QAAA,CAAS,MAAA,IAAS;AAClB,UAAA,IAAI,CAAC,OAAA,EAAS;AACZ,YAAA,OAAA,GAAU,IAAA;AACV,YAAA,OAAA,EAAQ;AAAA,UACV;AAAA,QACF,CAAA;AAAA,QACA,SAAA,EAAW,CAAC,IAAA,EAAM,OAAA,KAAY;AAC5B,UAAA,QAAQ,IAAA;AAAM,YACZ,KAAK,GAAA,CAAI,KAAA;AACP,cAAA,OAAA,CAAQ,IAAA,CAAK,IAAI,IAAA,EAAM;AAAA,gBACrB,IAAA,EAAM,KAAA;AAAA,gBACN,OAAO,OAAA,CAAQ,YAAA;AAAA,gBACf,UAAA,EAAY,MAAA,CAAO,UAAA,IAAc,EAAC;AAAA,gBAClC,MAAA,EAAQ,MAAA,CAAO,MAAA,IAAU,QAAA,CAAS,gBAAgB,IAAA,IAAQ,IAAA;AAAA,gBAC1D,UAAA,EAAY,QAAA,CAAS,UAAA,IAAc;AAAC,eACrC,CAAA;AACD,cAAA,IAAI,CAAC,OAAA,EAAS;AACZ,gBAAA,OAAA,GAAU,IAAA;AACV,gBAAA,OAAA,EAAQ;AAAA,cACV;AACA,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,cAAA;AACP,cAAA,KAAK,WAAA,EAAY,CACd,IAAA,CAAK,CAAC,KAAA,KAAU,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,EAAE,KAAA,EAAO,KAAA,CAAM,YAAA,EAAc,CAAC,CAAA,CACtE,KAAA,CAAM,MAAM,OAAA,CAAQ,IAAA,CAAK,GAAA,CAAI,KAAA,EAAO,EAAE,IAAA,EAAM,sBAAA,EAAwB,CAAC,CAAA;AACxE,cAAA;AAAA,YACF,KAAK,IAAI,MAAA,EAAQ;AACf,cAAA,MAAM,KAAA,GAAQ,QAAQ,mBAAmB,CAAA;AACzC,cAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,SAAA,CAAU,KAAA,GAAQ,cAAc,eAAe,CAAA;AAC/E,cAAA;AAAA,YACF;AAAA,YACA,KAAK,GAAA,CAAI,cAAA;AACP,cAAA,QAAA,CAAS,MAAA,GAAS;AAAA,gBAChB,WAAA,EAAa,MAAA,CAAO,OAAA,CAAQ,aAAa,KAAK,EAAE,CAAA;AAAA,gBAChD,QAAA,EAAU,MAAA,CAAO,OAAA,CAAQ,UAAU,KAAK,CAAC;AAAA,eAC1C,CAAA;AACD,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,SAAA;AACP,cAAA,SAAA,CAAU,WAAW,CAAA;AACrB,cAAA,QAAA,CAAS,WAAA,GAAc;AAAA,gBACrB,kBAAA,EACE,OAAO,OAAA,CAAQ,oBAAoB,MAAM,QAAA,GACrC,OAAA,CAAQ,oBAAoB,CAAA,GAC5B;AAAA,eACP,CAAA;AACD,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,KAAA;AACP,cAAA,OAAA,CAAQ,KAAA,EAAM;AACd,cAAA;AAAA,YACF,KAAK,GAAA,CAAI,KAAA;AACP,cAAA,IAAI,CAAC,OAAA,EAAS;AACZ,gBAAA,OAAA,GAAU,IAAA;AACV,gBAAA,OAAA,CAAQ,KAAA,EAAM;AACd,gBAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,IAAK,aAAa,CAAC,CAAA,CAAE,CAAC,CAAA;AAAA,cACjF;AACA,cAAA;AAAA;AACJ,QACF;AAAA,OACD,CAAA;AACD,MAAA,aAAA,GAAgB,OAAA;AAAA,IAClB,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,WAAW,MAAM,MAAA;AAAA,IACjB,MAAM,aAAA,GAAgB;AACpB,MAAA,MAAM,WAAA,EAAY;AAClB,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,eAAe,QAAA,EAAU;AACvB,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,cAAc,OAAA,EAA+B;AAC3C,MAAA,OAAO,IAAA,CAAK,aAAa,OAAO,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,eAAA,CAAgB,OAAA,GAAkC,EAAC,EAAG;AACpD,MAAA,OAAO,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,IAC/B,CAAA;AAAA,IACA,OAAA,GAAU;AACR,MAAA,aAAA,EAAe,KAAA,EAAM;AACrB,MAAA,aAAA,GAAgB,IAAA;AAChB,MAAA,SAAA,CAAU,KAAA,EAAM;AAAA,IAClB;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/** Production embed origin. Overridable per-instance via `config.embedOrigin` (dev/staging). */\nexport const DEFAULT_EMBED_ORIGIN = \"https://embed.auphere.com\";\n\n/** postMessage envelope namespace — every message is `{ type: \"auph:…\" }`. */\nexport const MSG = {\n  // iframe → loader\n  READY: \"auph:ready\",\n  RESIZE: \"auph:resize\",\n  CLOSE: \"auph:close\",\n  STATUS: \"auph:status\",\n  BROADCAST_DONE: \"auph:broadcast:done\",\n  TOKEN_EXPIRING: \"auph:token:expiring\",\n  CONNECTED: \"auph:connected\",\n  ERROR: \"auph:error\",\n  // loader → iframe\n  INIT: \"auph:init\",\n  TOKEN: \"auph:token\",\n} as const;\n","/**\n * Fullscreen iframe overlay lifecycle (ADR-028).\n *\n * The iframe cannot escape its own box, so the LOADER styles it to\n * cover the viewport (`position: fixed; inset: 0`) while it's open —\n * the \"breakout\" pattern used by Stripe Checkout and Plaid Link.\n * Scroll-lock + focus restore are handled here; the focus trap itself\n * lives inside the iframe document (it owns the focusable elements).\n *\n * Security invariants enforced in this file:\n *  - messages are only accepted from the configured embed origin AND\n *    from this exact iframe's contentWindow;\n *  - outgoing messages always use an explicit `targetOrigin` (never `*`);\n *  - the session token travels ONLY via postMessage — never in the URL.\n */\n\nimport { MSG } from \"./constants\";\n\ntype MessageHandler = (type: string, payload: Record<string, unknown>) => void;\n\nexport interface OverlayHandle {\n  post(type: string, payload?: Record<string, unknown>): void;\n  close(): void;\n}\n\nconst OVERLAY_Z = 2147483646; // one below max — leaves room for the host's own emergency layers\n\nexport function openOverlay(options: {\n  url: string;\n  embedOrigin: string;\n  title: string;\n  onMessage: MessageHandler;\n  onClose: () => void;\n}): OverlayHandle {\n  const { url, embedOrigin, title, onMessage, onClose } = options;\n\n  const previousFocus =\n    document.activeElement instanceof HTMLElement ? document.activeElement : null;\n  const previousOverflow = document.body.style.overflow;\n\n  const backdrop = document.createElement(\"div\");\n  backdrop.setAttribute(\"data-auphere-embed\", \"\");\n  backdrop.style.cssText = [\n    \"position:fixed\",\n    \"inset:0\",\n    `z-index:${OVERLAY_Z}`,\n    \"background:rgba(0,0,0,0.45)\",\n    \"opacity:0\",\n    \"transition:opacity 200ms ease\",\n  ].join(\";\");\n\n  const iframe = document.createElement(\"iframe\");\n  iframe.src = url;\n  iframe.title = title;\n  iframe.setAttribute(\"role\", \"dialog\");\n  iframe.setAttribute(\"aria-modal\", \"true\");\n  iframe.allow = \"clipboard-write\";\n  iframe.style.cssText = [\n    \"position:fixed\",\n    \"inset:0\",\n    \"width:100%\",\n    \"height:100%\",\n    \"border:0\",\n    `z-index:${OVERLAY_Z + 1}`,\n    \"background:transparent\",\n    \"color-scheme:normal\",\n  ].join(\";\");\n\n  let closed = false;\n\n  function handleMessage(event: MessageEvent): void {\n    // Origin AND source must match — a message from another tab or a\n    // nested frame on the same origin is not our modal.\n    if (event.origin !== embedOrigin) return;\n    if (event.source !== iframe.contentWindow) return;\n    const data = event.data as { type?: unknown } | null;\n    if (!data || typeof data.type !== \"string\" || !data.type.startsWith(\"auph:\")) return;\n    onMessage(data.type, data as Record<string, unknown>);\n  }\n\n  function handleKeydown(event: KeyboardEvent): void {\n    if (event.key === \"Escape\") close();\n  }\n\n  function close(): void {\n    if (closed) return;\n    closed = true;\n    window.removeEventListener(\"message\", handleMessage);\n    document.removeEventListener(\"keydown\", handleKeydown);\n    document.body.style.overflow = previousOverflow;\n    backdrop.remove();\n    iframe.remove();\n    previousFocus?.focus?.();\n    onClose();\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n  document.addEventListener(\"keydown\", handleKeydown);\n  document.body.style.overflow = \"hidden\"; // scroll-lock while open\n  document.body.append(backdrop, iframe);\n  requestAnimationFrame(() => {\n    backdrop.style.opacity = \"1\";\n  });\n  iframe.focus();\n\n  return {\n    post(type, payload = {}) {\n      // Explicit targetOrigin — if the frame navigated elsewhere the\n      // browser drops the message instead of leaking the token.\n      iframe.contentWindow?.postMessage({ type, ...payload }, embedOrigin);\n    },\n    close,\n  };\n}\n\nexport { MSG };\n","/**\n * `@auphere/embed` — public entrypoint (ADR-028).\n *\n * ```ts\n * import { createAuphere } from \"@auphere/embed\";\n *\n * const auphere = createAuphere({\n *   partnerSlug: \"acme\",\n *   fetchSession: async () => (await fetch(\"/api/auphere/session\", { method: \"POST\" })).json(),\n * });\n *\n * await auphere.openBroadcast({ recipients: [{ phone: \"+56912345678\", variables: { cliente: \"Ana\" } }] });\n * ```\n */\n\nimport { DEFAULT_EMBED_ORIGIN, MSG } from \"./constants\";\nimport { openOverlay } from \"./iframe-manager\";\nimport type {\n  Auphere,\n  AuphereConfig,\n  ConnectionStatus,\n  ConnectWhatsAppOptions,\n  OpenBroadcastOptions,\n  WidgetSession,\n  WidgetSessionWire,\n} from \"./types\";\n\nexport type {\n  Appearance,\n  Auphere,\n  AuphereConfig,\n  BroadcastRecipient,\n  ConnectionStatus,\n  ConnectWhatsAppOptions,\n  FetchSession,\n  OpenBroadcastOptions,\n  WidgetSession,\n} from \"./types\";\n\nfunction normalizeSession(raw: WidgetSession | WidgetSessionWire): WidgetSession {\n  if (\"sessionToken\" in raw && typeof raw.sessionToken === \"string\") return raw;\n  const wire = raw as WidgetSessionWire;\n  return {\n    sessionToken: wire.session_token,\n    expiresIn: wire.expires_in,\n    whatsapp: wire.whatsapp\n      ? {\n          status: wire.whatsapp.status,\n          displayPhoneNumber: wire.whatsapp.display_phone_number ?? null,\n        }\n      : undefined,\n  };\n}\n\nexport function createAuphere(config: AuphereConfig): Auphere {\n  if (typeof config?.fetchSession !== \"function\") {\n    throw new Error(\"@auphere/embed: `fetchSession` is required\");\n  }\n  if (!config.partnerSlug) {\n    throw new Error(\"@auphere/embed: `partnerSlug` is required\");\n  }\n  const embedOrigin = (config.embedOrigin ?? DEFAULT_EMBED_ORIGIN).replace(/\\/+$/, \"\");\n\n  let status: ConnectionStatus = \"unknown\";\n  const listeners = new Set<(status: ConnectionStatus) => void>();\n  let activeOverlay: { close(): void } | null = null;\n\n  function setStatus(next: ConnectionStatus): void {\n    if (next === status) return;\n    status = next;\n    listeners.forEach((listener) => listener(status));\n  }\n\n  async function mintSession(): Promise<WidgetSession> {\n    const session = normalizeSession(await config.fetchSession());\n    if (!session.sessionToken) {\n      throw new Error(\"@auphere/embed: fetchSession returned no session token\");\n    }\n    if (session.whatsapp?.status) setStatus(session.whatsapp.status);\n    return session;\n  }\n\n  function iframeUrl(route: \"broadcast\" | \"signup\"): string {\n    return `${embedOrigin}/${route}?p=${encodeURIComponent(config.partnerSlug)}`;\n  }\n\n  async function open(\n    route: \"broadcast\" | \"signup\",\n    handlers: {\n      recipients?: OpenBroadcastOptions[\"recipients\"];\n      onDone?: OpenBroadcastOptions[\"onDone\"];\n      onConnected?: ConnectWhatsAppOptions[\"onConnected\"];\n      onExit?: () => void;\n    },\n  ): Promise<void> {\n    if (activeOverlay) activeOverlay.close();\n    const session = await mintSession(); // mint BEFORE mounting: fail fast, no empty modal\n\n    await new Promise<void>((resolve, reject) => {\n      let settled = false;\n      const overlay = openOverlay({\n        url: iframeUrl(route),\n        embedOrigin,\n        title: route === \"broadcast\" ? \"Auphere — Campañas WhatsApp\" : \"Auphere — Conectar WhatsApp\",\n        onClose: () => {\n          activeOverlay = null;\n          handlers.onExit?.();\n          if (!settled) {\n            settled = true;\n            resolve();\n          }\n        },\n        onMessage: (type, payload) => {\n          switch (type) {\n            case MSG.READY:\n              overlay.post(MSG.INIT, {\n                mode: route,\n                token: session.sessionToken,\n                appearance: config.appearance ?? {},\n                locale: config.locale ?? document.documentElement.lang ?? \"es\",\n                recipients: handlers.recipients ?? [],\n              });\n              if (!settled) {\n                settled = true;\n                resolve();\n              }\n              break;\n            case MSG.TOKEN_EXPIRING:\n              void mintSession()\n                .then((fresh) => overlay.post(MSG.TOKEN, { token: fresh.sessionToken }))\n                .catch(() => overlay.post(MSG.ERROR, { code: \"token_refresh_failed\" }));\n              break;\n            case MSG.STATUS: {\n              const value = payload[\"whatsappConnected\"];\n              if (typeof value === \"boolean\") setStatus(value ? \"connected\" : \"not_connected\");\n              break;\n            }\n            case MSG.BROADCAST_DONE:\n              handlers.onDone?.({\n                broadcastId: String(payload[\"broadcastId\"] ?? \"\"),\n                accepted: Number(payload[\"accepted\"] ?? 0),\n              });\n              break;\n            case MSG.CONNECTED:\n              setStatus(\"connected\");\n              handlers.onConnected?.({\n                displayPhoneNumber:\n                  typeof payload[\"displayPhoneNumber\"] === \"string\"\n                    ? payload[\"displayPhoneNumber\"]\n                    : null,\n              });\n              break;\n            case MSG.CLOSE:\n              overlay.close();\n              break;\n            case MSG.ERROR:\n              if (!settled) {\n                settled = true;\n                overlay.close();\n                reject(new Error(`@auphere/embed: ${String(payload[\"code\"] ?? \"embed_error\")}`));\n              }\n              break;\n          }\n        },\n      });\n      activeOverlay = overlay;\n    });\n  }\n\n  return {\n    getStatus: () => status,\n    async refreshStatus() {\n      await mintSession();\n      return status;\n    },\n    onStatusChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n    openBroadcast(options: OpenBroadcastOptions) {\n      return open(\"broadcast\", options);\n    },\n    connectWhatsApp(options: ConnectWhatsAppOptions = {}) {\n      return open(\"signup\", options);\n    },\n    destroy() {\n      activeOverlay?.close();\n      activeOverlay = null;\n      listeners.clear();\n    },\n  };\n}\n"]}

package/dist/react/index.cjs

@@ -0,0 +1,49 @@
+'use strict';
+
+var react = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+// src/react/index.tsx
+function useAuphereStatus(auphere) {
+  const [status, setStatus] = react.useState(() => auphere.getStatus());
+  react.useEffect(() => {
+    setStatus(auphere.getStatus());
+    const unsubscribe = auphere.onStatusChange(setStatus);
+    if (auphere.getStatus() === "unknown") {
+      void auphere.refreshStatus().catch(() => {
+      });
+    }
+    return unsubscribe;
+  }, [auphere]);
+  return status;
+}
+function AuphereBroadcastButton({
+  auphere,
+  recipients,
+  onDone,
+  onExit,
+  children,
+  ...buttonProps
+}) {
+  const status = useAuphereStatus(auphere);
+  const [opening, setOpening] = react.useState(false);
+  if (status !== "connected") return null;
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    "button",
+    {
+      type: "button",
+      ...buttonProps,
+      disabled: opening || buttonProps.disabled,
+      onClick: () => {
+        setOpening(true);
+        void auphere.openBroadcast({ recipients, onDone, onExit }).finally(() => setOpening(false));
+      },
+      children: children ?? "Campa\xF1as WhatsApp"
+    }
+  );
+}
+
+exports.AuphereBroadcastButton = AuphereBroadcastButton;
+exports.useAuphereStatus = useAuphereStatus;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/react/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/react/index.tsx"],"names":["useState","useEffect","jsx"],"mappings":";;;;;;AAiBO,SAAS,iBAAiB,OAAA,EAAoC;AACnE,EAAA,MAAM,CAAC,QAAQ,SAAS,CAAA,GAAIA,eAA2B,MAAM,OAAA,CAAQ,WAAW,CAAA;AAChF,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA;AAC7B,IAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,cAAA,CAAe,SAAS,CAAA;AACpD,IAAA,IAAI,OAAA,CAAQ,SAAA,EAAU,KAAM,SAAA,EAAW;AACrC,MAAA,KAAK,OAAA,CAAQ,aAAA,EAAc,CAAE,KAAA,CAAM,MAAM;AAAA,MAEzC,CAAC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,WAAA;AAAA,EACT,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AACZ,EAAA,OAAO,MAAA;AACT;AAiBO,SAAS,sBAAA,CAAuB;AAAA,EACrC,OAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAAgC;AAC9B,EAAA,MAAM,MAAA,GAAS,iBAAiB,OAAO,CAAA;AACvC,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAID,eAAS,KAAK,CAAA;AAE5C,EAAA,IAAI,MAAA,KAAW,aAAa,OAAO,IAAA;AAEnC,EAAA,uBACEE,cAAA;AAAA,IAAC,QAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,QAAA;AAAA,MACJ,GAAG,WAAA;AAAA,MACJ,QAAA,EAAU,WAAW,WAAA,CAAY,QAAA;AAAA,MACjC,SAAS,MAAM;AACb,QAAA,UAAA,CAAW,IAAI,CAAA;AACf,QAAA,KAAK,OAAA,CACF,aAAA,CAAc,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA,CAC5C,OAAA,CAAQ,MAAM,UAAA,CAAW,KAAK,CAAC,CAAA;AAAA,MACpC,CAAA;AAAA,MAEC,QAAA,EAAA,QAAA,IAAY;AAAA;AAAA,GACf;AAEJ","file":"index.cjs","sourcesContent":["/**\n * React bindings for `@auphere/embed` (optional peer dependency).\n *\n * ```tsx\n * import { AuphereBroadcastButton } from \"@auphere/embed/react\";\n *\n * <AuphereBroadcastButton auphere={auphere} recipients={recipients}>\n *   Campañas WhatsApp\n * </AuphereBroadcastButton>\n * ```\n */\n\nimport { useEffect, useState, type ButtonHTMLAttributes, type ReactNode } from \"react\";\n\nimport type { Auphere, BroadcastRecipient, ConnectionStatus, OpenBroadcastOptions } from \"../types\";\n\n/** Live connection status for gating your own UI. */\nexport function useAuphereStatus(auphere: Auphere): ConnectionStatus {\n  const [status, setStatus] = useState<ConnectionStatus>(() => auphere.getStatus());\n  useEffect(() => {\n    setStatus(auphere.getStatus());\n    const unsubscribe = auphere.onStatusChange(setStatus);\n    if (auphere.getStatus() === \"unknown\") {\n      void auphere.refreshStatus().catch(() => {\n        /* stays \"unknown\" — button stays hidden */\n      });\n    }\n    return unsubscribe;\n  }, [auphere]);\n  return status;\n}\n\nexport interface AuphereBroadcastButtonProps\n  extends Omit<ButtonHTMLAttributes<HTMLButtonElement>, \"onClick\"> {\n  auphere: Auphere;\n  /** The audience, from YOUR data (CRM, table selection…). */\n  recipients: BroadcastRecipient[];\n  onDone?: OpenBroadcastOptions[\"onDone\"];\n  onExit?: OpenBroadcastOptions[\"onExit\"];\n  children?: ReactNode;\n}\n\n/**\n * Renders its children as a button ONLY while the client's WhatsApp is\n * connected — the gating decision of ADR-028. Style it like any button\n * (className/style pass through).\n */\nexport function AuphereBroadcastButton({\n  auphere,\n  recipients,\n  onDone,\n  onExit,\n  children,\n  ...buttonProps\n}: AuphereBroadcastButtonProps) {\n  const status = useAuphereStatus(auphere);\n  const [opening, setOpening] = useState(false);\n\n  if (status !== \"connected\") return null;\n\n  return (\n    <button\n      type=\"button\"\n      {...buttonProps}\n      disabled={opening || buttonProps.disabled}\n      onClick={() => {\n        setOpening(true);\n        void auphere\n          .openBroadcast({ recipients, onDone, onExit })\n          .finally(() => setOpening(false));\n      }}\n    >\n      {children ?? \"Campañas WhatsApp\"}\n    </button>\n  );\n}\n\nexport type { Auphere, BroadcastRecipient, ConnectionStatus };\n"]}

package/dist/react/index.d.cts

@@ -0,0 +1,22 @@
+import * as react from 'react';
+import { ButtonHTMLAttributes, ReactNode } from 'react';
+import { a as Auphere, B as BroadcastRecipient, O as OpenBroadcastOptions, c as ConnectionStatus } from '../types-BomPnFf3.cjs';
+
+/** Live connection status for gating your own UI. */
+declare function useAuphereStatus(auphere: Auphere): ConnectionStatus;
+interface AuphereBroadcastButtonProps extends Omit<ButtonHTMLAttributes<HTMLButtonElement>, "onClick"> {
+    auphere: Auphere;
+    /** The audience, from YOUR data (CRM, table selection…). */
+    recipients: BroadcastRecipient[];
+    onDone?: OpenBroadcastOptions["onDone"];
+    onExit?: OpenBroadcastOptions["onExit"];
+    children?: ReactNode;
+}
+/**
+ * Renders its children as a button ONLY while the client's WhatsApp is
+ * connected — the gating decision of ADR-028. Style it like any button
+ * (className/style pass through).
+ */
+declare function AuphereBroadcastButton({ auphere, recipients, onDone, onExit, children, ...buttonProps }: AuphereBroadcastButtonProps): react.JSX.Element | null;
+
+export { Auphere, AuphereBroadcastButton, type AuphereBroadcastButtonProps, BroadcastRecipient, ConnectionStatus, useAuphereStatus };

package/dist/react/index.d.ts

@@ -0,0 +1,22 @@
+import * as react from 'react';
+import { ButtonHTMLAttributes, ReactNode } from 'react';
+import { a as Auphere, B as BroadcastRecipient, O as OpenBroadcastOptions, c as ConnectionStatus } from '../types-BomPnFf3.js';
+
+/** Live connection status for gating your own UI. */
+declare function useAuphereStatus(auphere: Auphere): ConnectionStatus;
+interface AuphereBroadcastButtonProps extends Omit<ButtonHTMLAttributes<HTMLButtonElement>, "onClick"> {
+    auphere: Auphere;
+    /** The audience, from YOUR data (CRM, table selection…). */
+    recipients: BroadcastRecipient[];
+    onDone?: OpenBroadcastOptions["onDone"];
+    onExit?: OpenBroadcastOptions["onExit"];
+    children?: ReactNode;
+}
+/**
+ * Renders its children as a button ONLY while the client's WhatsApp is
+ * connected — the gating decision of ADR-028. Style it like any button
+ * (className/style pass through).
+ */
+declare function AuphereBroadcastButton({ auphere, recipients, onDone, onExit, children, ...buttonProps }: AuphereBroadcastButtonProps): react.JSX.Element | null;
+
+export { Auphere, AuphereBroadcastButton, type AuphereBroadcastButtonProps, BroadcastRecipient, ConnectionStatus, useAuphereStatus };

package/dist/react/index.js

@@ -0,0 +1,46 @@
+import { useState, useEffect } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+// src/react/index.tsx
+function useAuphereStatus(auphere) {
+  const [status, setStatus] = useState(() => auphere.getStatus());
+  useEffect(() => {
+    setStatus(auphere.getStatus());
+    const unsubscribe = auphere.onStatusChange(setStatus);
+    if (auphere.getStatus() === "unknown") {
+      void auphere.refreshStatus().catch(() => {
+      });
+    }
+    return unsubscribe;
+  }, [auphere]);
+  return status;
+}
+function AuphereBroadcastButton({
+  auphere,
+  recipients,
+  onDone,
+  onExit,
+  children,
+  ...buttonProps
+}) {
+  const status = useAuphereStatus(auphere);
+  const [opening, setOpening] = useState(false);
+  if (status !== "connected") return null;
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      type: "button",
+      ...buttonProps,
+      disabled: opening || buttonProps.disabled,
+      onClick: () => {
+        setOpening(true);
+        void auphere.openBroadcast({ recipients, onDone, onExit }).finally(() => setOpening(false));
+      },
+      children: children ?? "Campa\xF1as WhatsApp"
+    }
+  );
+}
+
+export { AuphereBroadcastButton, useAuphereStatus };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/react/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/react/index.tsx"],"names":[],"mappings":";;;;AAiBO,SAAS,iBAAiB,OAAA,EAAoC;AACnE,EAAA,MAAM,CAAC,QAAQ,SAAS,CAAA,GAAI,SAA2B,MAAM,OAAA,CAAQ,WAAW,CAAA;AAChF,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA;AAC7B,IAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,cAAA,CAAe,SAAS,CAAA;AACpD,IAAA,IAAI,OAAA,CAAQ,SAAA,EAAU,KAAM,SAAA,EAAW;AACrC,MAAA,KAAK,OAAA,CAAQ,aAAA,EAAc,CAAE,KAAA,CAAM,MAAM;AAAA,MAEzC,CAAC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,WAAA;AAAA,EACT,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AACZ,EAAA,OAAO,MAAA;AACT;AAiBO,SAAS,sBAAA,CAAuB;AAAA,EACrC,OAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAAgC;AAC9B,EAAA,MAAM,MAAA,GAAS,iBAAiB,OAAO,CAAA;AACvC,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,KAAK,CAAA;AAE5C,EAAA,IAAI,MAAA,KAAW,aAAa,OAAO,IAAA;AAEnC,EAAA,uBACE,GAAA;AAAA,IAAC,QAAA;AAAA,IAAA;AAAA,MACC,IAAA,EAAK,QAAA;AAAA,MACJ,GAAG,WAAA;AAAA,MACJ,QAAA,EAAU,WAAW,WAAA,CAAY,QAAA;AAAA,MACjC,SAAS,MAAM;AACb,QAAA,UAAA,CAAW,IAAI,CAAA;AACf,QAAA,KAAK,OAAA,CACF,aAAA,CAAc,EAAE,UAAA,EAAY,MAAA,EAAQ,MAAA,EAAQ,CAAA,CAC5C,OAAA,CAAQ,MAAM,UAAA,CAAW,KAAK,CAAC,CAAA;AAAA,MACpC,CAAA;AAAA,MAEC,QAAA,EAAA,QAAA,IAAY;AAAA;AAAA,GACf;AAEJ","file":"index.js","sourcesContent":["/**\n * React bindings for `@auphere/embed` (optional peer dependency).\n *\n * ```tsx\n * import { AuphereBroadcastButton } from \"@auphere/embed/react\";\n *\n * <AuphereBroadcastButton auphere={auphere} recipients={recipients}>\n *   Campañas WhatsApp\n * </AuphereBroadcastButton>\n * ```\n */\n\nimport { useEffect, useState, type ButtonHTMLAttributes, type ReactNode } from \"react\";\n\nimport type { Auphere, BroadcastRecipient, ConnectionStatus, OpenBroadcastOptions } from \"../types\";\n\n/** Live connection status for gating your own UI. */\nexport function useAuphereStatus(auphere: Auphere): ConnectionStatus {\n  const [status, setStatus] = useState<ConnectionStatus>(() => auphere.getStatus());\n  useEffect(() => {\n    setStatus(auphere.getStatus());\n    const unsubscribe = auphere.onStatusChange(setStatus);\n    if (auphere.getStatus() === \"unknown\") {\n      void auphere.refreshStatus().catch(() => {\n        /* stays \"unknown\" — button stays hidden */\n      });\n    }\n    return unsubscribe;\n  }, [auphere]);\n  return status;\n}\n\nexport interface AuphereBroadcastButtonProps\n  extends Omit<ButtonHTMLAttributes<HTMLButtonElement>, \"onClick\"> {\n  auphere: Auphere;\n  /** The audience, from YOUR data (CRM, table selection…). */\n  recipients: BroadcastRecipient[];\n  onDone?: OpenBroadcastOptions[\"onDone\"];\n  onExit?: OpenBroadcastOptions[\"onExit\"];\n  children?: ReactNode;\n}\n\n/**\n * Renders its children as a button ONLY while the client's WhatsApp is\n * connected — the gating decision of ADR-028. Style it like any button\n * (className/style pass through).\n */\nexport function AuphereBroadcastButton({\n  auphere,\n  recipients,\n  onDone,\n  onExit,\n  children,\n  ...buttonProps\n}: AuphereBroadcastButtonProps) {\n  const status = useAuphereStatus(auphere);\n  const [opening, setOpening] = useState(false);\n\n  if (status !== \"connected\") return null;\n\n  return (\n    <button\n      type=\"button\"\n      {...buttonProps}\n      disabled={opening || buttonProps.disabled}\n      onClick={() => {\n        setOpening(true);\n        void auphere\n          .openBroadcast({ recipients, onDone, onExit })\n          .finally(() => setOpening(false));\n      }}\n    >\n      {children ?? \"Campañas WhatsApp\"}\n    </button>\n  );\n}\n\nexport type { Auphere, BroadcastRecipient, ConnectionStatus };\n"]}

package/dist/types-BomPnFf3.d.cts

@@ -0,0 +1,101 @@
+/**
+ * Public types for `@auphere/embed` (ADR-028).
+ *
+ * The SDK is a thin loader: it renders nothing itself beyond an iframe
+ * overlay, and it never sees WhatsApp or Auphere credentials. All the
+ * heavy UI lives on the Auphere-controlled embed origin and is updated
+ * without you redeploying.
+ */
+/** One WhatsApp recipient of a broadcast, with the named template variables. */
+interface BroadcastRecipient {
+    /** E.164 phone, e.g. `+56912345678`. Spaces/dashes are tolerated. */
+    phone: string;
+    /**
+     * Named template variables, keys matching the template's named
+     * parameters (e.g. `{ cliente: "Ana", saldo_pendiente: "$12.000" }`).
+     */
+    variables?: Record<string, string>;
+}
+/** What your backend returns after minting `POST /v1/widget-sessions`. */
+interface WidgetSession {
+    /** The short-lived session JWT (`session_token` from the mint response). */
+    sessionToken: string;
+    /** Seconds until expiry (`expires_in`). */
+    expiresIn?: number;
+    /** Connection state included in the mint response. */
+    whatsapp?: {
+        status: "connected" | "not_connected";
+        displayPhoneNumber?: string | null;
+    };
+}
+/** Raw mint response shape (snake_case) is also accepted. */
+interface WidgetSessionWire {
+    session_token: string;
+    expires_in?: number;
+    whatsapp?: {
+        status: "connected" | "not_connected";
+        display_phone_number?: string | null;
+    };
+}
+type FetchSession = () => Promise<WidgetSession | WidgetSessionWire>;
+interface Appearance {
+    /** Primary accent color (CSS color). */
+    colorPrimary?: string;
+    /** Border radius, e.g. `"8px"`. */
+    radius?: string;
+    /** `"light" | "dark"` — defaults to the embedding page's scheme. */
+    theme?: "light" | "dark";
+}
+interface AuphereConfig {
+    /**
+     * Called whenever the SDK needs a session token: on open and again
+     * when a token is about to expire. MUST be re-invocable without user
+     * interaction — typically a `fetch("/api/auphere/session")` to your
+     * backend, which mints with your secret key.
+     */
+    fetchSession: FetchSession;
+    /**
+     * Your partner slug (shown in the Auphere dashboard). Used to resolve
+     * the iframe's security policy before any token exists.
+     */
+    partnerSlug: string;
+    appearance?: Appearance;
+    /** BCP-47, e.g. `"es"`. Defaults to the page language. */
+    locale?: string;
+    /** Override the embed origin — staging/dev only. */
+    embedOrigin?: string;
+}
+type ConnectionStatus = "connected" | "not_connected" | "unknown";
+interface OpenBroadcastOptions {
+    /** The audience, built from YOUR data. The modal previews and sends — it never invents recipients. */
+    recipients: BroadcastRecipient[];
+    /** Fired after the broadcast is accepted by Auphere. */
+    onDone?: (result: {
+        broadcastId: string;
+        accepted: number;
+    }) => void;
+    /** Fired when the modal closes (sent or not). */
+    onExit?: () => void;
+}
+interface ConnectWhatsAppOptions {
+    onConnected?: (info: {
+        displayPhoneNumber: string | null;
+    }) => void;
+    onExit?: () => void;
+}
+interface Auphere {
+    /** Last known WhatsApp connection state (from the latest session mint/refresh). */
+    getStatus(): ConnectionStatus;
+    /** Re-mint a session and refresh the status. */
+    refreshStatus(): Promise<ConnectionStatus>;
+    /** Subscribe to status flips. Returns an unsubscribe function. */
+    onStatusChange(listener: (status: ConnectionStatus) => void): () => void;
+    /** Open the broadcast modal (fullscreen iframe overlay). */
+    openBroadcast(options: OpenBroadcastOptions): Promise<void>;
+    /** Open the WhatsApp Embedded Signup flow (fullscreen iframe overlay). */
+    connectWhatsApp(options?: ConnectWhatsAppOptions): Promise<void>;
+    /** Remove any mounted iframe and listeners. */
+    destroy(): void;
+}
+
+export type { AuphereConfig as A, BroadcastRecipient as B, ConnectWhatsAppOptions as C, FetchSession as F, OpenBroadcastOptions as O, WidgetSession as W, Auphere as a, Appearance as b, ConnectionStatus as c };

package/dist/types-BomPnFf3.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Public types for `@auphere/embed` (ADR-028).
+ *
+ * The SDK is a thin loader: it renders nothing itself beyond an iframe
+ * overlay, and it never sees WhatsApp or Auphere credentials. All the
+ * heavy UI lives on the Auphere-controlled embed origin and is updated
+ * without you redeploying.
+ */
+/** One WhatsApp recipient of a broadcast, with the named template variables. */
+interface BroadcastRecipient {
+    /** E.164 phone, e.g. `+56912345678`. Spaces/dashes are tolerated. */
+    phone: string;
+    /**
+     * Named template variables, keys matching the template's named
+     * parameters (e.g. `{ cliente: "Ana", saldo_pendiente: "$12.000" }`).
+     */
+    variables?: Record<string, string>;
+}
+/** What your backend returns after minting `POST /v1/widget-sessions`. */
+interface WidgetSession {
+    /** The short-lived session JWT (`session_token` from the mint response). */
+    sessionToken: string;
+    /** Seconds until expiry (`expires_in`). */
+    expiresIn?: number;
+    /** Connection state included in the mint response. */
+    whatsapp?: {
+        status: "connected" | "not_connected";
+        displayPhoneNumber?: string | null;
+    };
+}
+/** Raw mint response shape (snake_case) is also accepted. */
+interface WidgetSessionWire {
+    session_token: string;
+    expires_in?: number;
+    whatsapp?: {
+        status: "connected" | "not_connected";
+        display_phone_number?: string | null;
+    };
+}
+type FetchSession = () => Promise<WidgetSession | WidgetSessionWire>;
+interface Appearance {
+    /** Primary accent color (CSS color). */
+    colorPrimary?: string;
+    /** Border radius, e.g. `"8px"`. */
+    radius?: string;
+    /** `"light" | "dark"` — defaults to the embedding page's scheme. */
+    theme?: "light" | "dark";
+}
+interface AuphereConfig {
+    /**
+     * Called whenever the SDK needs a session token: on open and again
+     * when a token is about to expire. MUST be re-invocable without user
+     * interaction — typically a `fetch("/api/auphere/session")` to your
+     * backend, which mints with your secret key.
+     */
+    fetchSession: FetchSession;
+    /**
+     * Your partner slug (shown in the Auphere dashboard). Used to resolve
+     * the iframe's security policy before any token exists.
+     */
+    partnerSlug: string;
+    appearance?: Appearance;
+    /** BCP-47, e.g. `"es"`. Defaults to the page language. */
+    locale?: string;
+    /** Override the embed origin — staging/dev only. */
+    embedOrigin?: string;
+}
+type ConnectionStatus = "connected" | "not_connected" | "unknown";
+interface OpenBroadcastOptions {
+    /** The audience, built from YOUR data. The modal previews and sends — it never invents recipients. */
+    recipients: BroadcastRecipient[];
+    /** Fired after the broadcast is accepted by Auphere. */
+    onDone?: (result: {
+        broadcastId: string;
+        accepted: number;
+    }) => void;
+    /** Fired when the modal closes (sent or not). */
+    onExit?: () => void;
+}
+interface ConnectWhatsAppOptions {
+    onConnected?: (info: {
+        displayPhoneNumber: string | null;
+    }) => void;
+    onExit?: () => void;
+}
+interface Auphere {
+    /** Last known WhatsApp connection state (from the latest session mint/refresh). */
+    getStatus(): ConnectionStatus;
+    /** Re-mint a session and refresh the status. */
+    refreshStatus(): Promise<ConnectionStatus>;
+    /** Subscribe to status flips. Returns an unsubscribe function. */
+    onStatusChange(listener: (status: ConnectionStatus) => void): () => void;
+    /** Open the broadcast modal (fullscreen iframe overlay). */
+    openBroadcast(options: OpenBroadcastOptions): Promise<void>;
+    /** Open the WhatsApp Embedded Signup flow (fullscreen iframe overlay). */
+    connectWhatsApp(options?: ConnectWhatsAppOptions): Promise<void>;
+    /** Remove any mounted iframe and listeners. */
+    destroy(): void;
+}
+
+export type { AuphereConfig as A, BroadcastRecipient as B, ConnectWhatsAppOptions as C, FetchSession as F, OpenBroadcastOptions as O, WidgetSession as W, Auphere as a, Appearance as b, ConnectionStatus as c };

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@auphere/embed",
+  "version": "0.1.0",
+  "description": "Auphere embed SDK — WhatsApp template broadcasts inside your own product. Thin loader: mounts the Auphere iframe, handshakes a short-lived session token, never touches credentials.",
+  "license": "MIT",
+  "homepage": "https://github.com/ladrian-dev/auphere-admin/tree/main/packages/embed-sdk#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ladrian-dev/auphere-admin.git",
+    "directory": "packages/embed-sdk"
+  },
+  "bugs": {
+    "url": "https://github.com/ladrian-dev/auphere-admin/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js",
+      "require": "./dist/react/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^19",
+    "jsdom": "^29.1.1",
+    "react": "19.2.4",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "auphere",
+    "whatsapp",
+    "embed",
+    "widget",
+    "broadcast"
+  ]
+}