@aztec/wallet-sdk 5.0.0-private.20260319 → 5.0.0-rc.2

package/dest/extension/provider/extension_wallet.js

@@ -1,9 +1,9 @@
 import { WalletSchema } from '@aztec/aztec.js/wallet';
 import { jsonStringify } from '@aztec/foundation/json-rpc';
 import { promiseWithResolvers } from '@aztec/foundation/promise';
-import { schemaHasMethod } from '@aztec/foundation/schemas';
+import { getSchemaReturnType, schemaHasMethod } from '@aztec/foundation/schemas';
 import { decrypt, encrypt } from '../../crypto.js';
-import { WalletMessageType } from '../../types.js';
+import { DEFAULT_HEARTBEAT_DEAD_AFTER_MS, DEFAULT_HEARTBEAT_INTERVAL_MS, NOOP_LOGGER, WalletMessageType } from '../../types.js';
 /**
  * A wallet implementation that communicates with browser extension wallets
  * using an encrypted MessageChannel.
@@ -43,6 +43,11 @@ import { WalletMessageType } from '../../types.js';
     /** Map of pending requests awaiting responses, keyed by message ID */ inFlight;
     disconnected;
     disconnectCallbacks;
+    heartbeatTimer;
+    lastInboundAt;
+    log;
+    heartbeatIntervalMs;
+    heartbeatDeadAfterMs;
     /**
    * Private constructor - use {@link ExtensionWallet.create} to instantiate.
    * @param chainInfo - The chain information (chainId and version)
@@ -50,7 +55,9 @@ import { WalletMessageType } from '../../types.js';
    * @param extensionId - The unique identifier of the target wallet extension
    * @param port - The MessagePort for private communication with the wallet
    * @param sharedKey - The derived AES-256-GCM shared key for encryption
-   */ constructor(chainInfo, appId, extensionId, port, sharedKey){
+   * @param logger - Optional logger; defaults to a no-op logger
+   * @param heartbeatOptions - Optional heartbeat tuning (mostly useful for tests)
+   */ constructor(chainInfo, appId, extensionId, port, sharedKey, logger, heartbeatOptions){
         this.chainInfo = chainInfo;
         this.appId = appId;
         this.extensionId = extensionId;
@@ -59,6 +66,11 @@ import { WalletMessageType } from '../../types.js';
         this.inFlight = new Map();
         this.disconnected = false;
         this.disconnectCallbacks = [];
+        this.heartbeatTimer = null;
+        this.lastInboundAt = 0;
+        this.log = logger ?? NOOP_LOGGER;
+        this.heartbeatIntervalMs = heartbeatOptions?.intervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS;
+        this.heartbeatDeadAfterMs = heartbeatOptions?.deadAfterMs ?? DEFAULT_HEARTBEAT_DEAD_AFTER_MS;
     }
     /**
    * Creates a Wallet that communicates with a browser extension
@@ -69,6 +81,8 @@ import { WalletMessageType } from '../../types.js';
    * @param sharedKey - The derived AES-256-GCM shared key for encryption
    * @param chainInfo - The chain information (chainId and version) for request context
    * @param appId - Application identifier used to identify the requesting dApp to the wallet
+   * @param logger - Optional logger; defaults to a no-op logger to keep extension/page bundles small
+   * @param heartbeatOptions - Optional override for heartbeat tuning (mostly useful for tests)
    * @returns A Wallet interface where all method calls are encrypted
    *
    * @example
@@ -85,12 +99,13 @@ import { WalletMessageType } from '../../types.js';
    *
    * const accounts = await wallet.getAccounts();
    * ```
-   */ static create(extensionId, port, sharedKey, chainInfo, appId) {
-        const wallet = new ExtensionWallet(chainInfo, appId, extensionId, port, sharedKey);
+   */ static create(extensionId, port, sharedKey, chainInfo, appId, logger, heartbeatOptions) {
+        const wallet = new ExtensionWallet(chainInfo, appId, extensionId, port, sharedKey, logger, heartbeatOptions);
         // Set up message handler for encrypted responses and unencrypted control messages
         wallet.port.onmessage = (event)=>{
             const data = event.data;
-            // Check for unencrypted disconnect notification
+            // Any inbound traffic counts as proof of liveness.
+            wallet.lastInboundAt = Date.now();
             if (data && typeof data === 'object' && 'type' in data && data.type === WalletMessageType.DISCONNECT) {
                 wallet.handleDisconnect();
                 return;
@@ -109,7 +124,7 @@ import { WalletMessageType } from '../../types.js';
                             type: prop.toString(),
                             args
                         });
-                        return WalletSchema[prop.toString()].returnType().parseAsync(result);
+                        return getSchemaReturnType(WalletSchema[prop.toString()]).parseAsync(result);
                     };
                 } else {
                     return target[prop];
@@ -152,8 +167,12 @@ import { WalletMessageType } from '../../types.js';
                 resolve(result);
             }
             this.inFlight.delete(messageId);
-        // eslint-disable-next-line no-empty
-        } catch  {}
+            this.maybeStopHeartbeat();
+        } catch (err) {
+            this.log.warn('Failed to decrypt wallet response', {
+                err
+            });
+        }
     }
     /**
    * Sends an encrypted wallet method call over the secure MessageChannel.
@@ -190,9 +209,57 @@ import { WalletMessageType } from '../../types.js';
             resolve,
             reject
         });
+        this.startHeartbeat();
         return promise;
     }
     /**
+   * Start the heartbeat probe loop while at least one request is in flight.
+   * Idempotent — calling while already running is a no-op.
+   *
+   * Heartbeat is opt-in via wire protocol: PINGs are unencrypted control messages
+   * (like DISCONNECT). Older wallets that do not understand PING simply drop it,
+   * which is safe — we only declare disconnect when **no** inbound traffic of any
+   * kind (PONG, encrypted response, DISCONNECT) arrives within the dead window.
+   * A wallet that is processing a slow request will reset the timer when it
+   * eventually responds, so this never causes false disconnects on legacy peers.
+   */ startHeartbeat() {
+        if (this.heartbeatTimer !== null || this.disconnected) {
+            return;
+        }
+        this.lastInboundAt = Date.now();
+        this.heartbeatTimer = setInterval(()=>this.heartbeatTick(), this.heartbeatIntervalMs);
+    }
+    maybeStopHeartbeat() {
+        if (this.inFlight.size === 0 && this.heartbeatTimer !== null) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = null;
+        }
+    }
+    heartbeatTick() {
+        if (this.disconnected || this.inFlight.size === 0) {
+            this.maybeStopHeartbeat();
+            return;
+        }
+        const idleMs = Date.now() - this.lastInboundAt;
+        if (idleMs >= this.heartbeatDeadAfterMs) {
+            this.log.warn('Wallet channel unresponsive — declaring disconnect', {
+                idleMs,
+                inFlight: this.inFlight.size
+            });
+            this.handleDisconnect();
+            return;
+        }
+        try {
+            this.port.postMessage({
+                type: WalletMessageType.PING
+            });
+        } catch (err) {
+            this.log.warn('Failed to send heartbeat PING', {
+                err
+            });
+        }
+    }
+    /**
    * Handles wallet disconnection.
    * Rejects all pending requests and notifies registered callbacks.
    * @internal
@@ -201,6 +268,10 @@ import { WalletMessageType } from '../../types.js';
             return;
         }
         this.disconnected = true;
+        if (this.heartbeatTimer !== null) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = null;
+        }
         if (this.port) {
             this.port.onmessage = null;
             this.port.close();

package/dest/extension/provider/index.d.ts

@@ -1,3 +1,3 @@
-export { ExtensionWallet, type DisconnectCallback } from './extension_wallet.js';
+export { ExtensionWallet } from './extension_wallet.js';
 export { ExtensionProvider, type DiscoveredWallet, type ConnectedWallet, type DiscoveryOptions, } from './extension_provider.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9leHRlbnNpb24vcHJvdmlkZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGVBQWUsRUFBRSxLQUFLLGtCQUFrQixFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDakYsT0FBTyxFQUNMLGlCQUFpQixFQUNqQixLQUFLLGdCQUFnQixFQUNyQixLQUFLLGVBQWUsRUFDcEIsS0FBSyxnQkFBZ0IsR0FDdEIsTUFBTSx5QkFBeUIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9leHRlbnNpb24vcHJvdmlkZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hELE9BQU8sRUFDTCxpQkFBaUIsRUFDakIsS0FBSyxnQkFBZ0IsRUFDckIsS0FBSyxlQUFlLEVBQ3BCLEtBQUssZ0JBQWdCLEdBQ3RCLE1BQU0seUJBQXlCLENBQUMifQ==

package/dest/extension/provider/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/extension/provider/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EACL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/extension/provider/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC"}

package/dest/iframe/handlers/iframe_connection_handler.d.ts

@@ -0,0 +1,122 @@
+/**
+ * IframeConnectionHandler — wallet-side of the cross-origin iframe protocol.
+ *
+ * This mirrors {@link BackgroundConnectionHandler} from `@aztec/wallet-sdk/extension/handlers`
+ * but uses `window.postMessage` instead of browser.runtime messaging.
+ *
+ * Message flow (wallet receives):
+ *   parent → DISCOVERY            → show approval UI → send DISCOVERY_RESPONSE
+ *   parent → KEY_EXCHANGE_REQUEST → ECDH             → send KEY_EXCHANGE_RESPONSE
+ *   parent → SECURE_MESSAGE       → decrypt → Wallet → encrypt → SECURE_RESPONSE
+ *   parent → DISCONNECT           → terminate session
+ *
+ * The wallet announces itself by posting WALLET_READY as soon as the handler starts,
+ * so the dApp knows it can send a discovery request.
+ */
+import type { ChainInfo } from '@aztec/aztec.js/account';
+import type { Wallet } from '@aztec/aztec.js/wallet';
+import { type WalletSdkLogger } from '../../types.js';
+/**
+ * A pending discovery request from a dApp (before user approval).
+ */
+export interface PendingSession {
+    /** Unique request identifier */
+    requestId: string;
+    /** Application identifier */
+    appId: string;
+    /** Origin URL of the requesting page */
+    origin: string;
+    /** Approval status */
+    status: 'pending' | 'approved';
+}
+/**
+ * An active session (after key exchange).
+ */
+export interface ActiveSession {
+    /** Session identifier (same as the discovery requestId) */
+    sessionId: string;
+    /** AES-256-GCM shared key for this session */
+    sharedKey: CryptoKey;
+    /** Verification hash for emoji display */
+    verificationHash: string;
+    /** Origin URL of the connected dApp */
+    origin: string;
+    /** Application identifier */
+    appId: string;
+}
+/**
+ * Configuration for the iframe connection handler.
+ */
+export interface IframeConnectionConfig {
+    /** Unique wallet identifier */
+    walletId: string;
+    /** Display name for the wallet */
+    walletName: string;
+    /** Wallet version string */
+    walletVersion: string;
+    /** Optional wallet icon URL */
+    walletIcon?: string;
+    /** Origins allowed to connect. If empty or undefined, all origins are allowed (dev mode). */
+    allowedOrigins?: string[];
+    /** Logger used for diagnostics. */
+    logger: WalletSdkLogger;
+}
+/**
+ * Event callbacks for the iframe connection handler.
+ */
+export interface IframeConnectionCallbacks {
+    /** Called when a new discovery request arrives — wallet can show approval UI */
+    onPendingDiscovery?: (session: PendingSession) => void;
+    /** Called when a session is established (key exchange complete) */
+    onSessionEstablished?: (session: ActiveSession) => void;
+    /** Called when a session is terminated */
+    onSessionTerminated?: (sessionId: string) => void;
+    /** Called when a key exchange completes — show verificationHash as emojis to the user */
+    onVerificationHash?: (verificationHash: string) => void;
+    /**
+     * Resolves the Wallet instance to use for a given dApp and chain.
+     * Called when an encrypted message arrives and needs to be dispatched.
+     */
+    getWallet: (appId: string, chainInfo: ChainInfo) => Promise<Wallet>;
+}
+/**
+ * Handles the wallet side of the cross-origin iframe protocol.
+ *
+ * Manages the full lifecycle: discovery, ECDH key exchange, encrypted message
+ * dispatch to a {@link Wallet} instance, and session termination.
+ *
+ * @example
+ * ```typescript
+ * const handler = new IframeConnectionHandler(
+ *   { walletId: 'my-wallet', walletName: 'My Wallet', walletVersion: '1.0.0', logger: console },
+ *   {
+ *     onPendingDiscovery: (session) => showApprovalUI(session),
+ *     getWallet: (appId, chainInfo) => createWalletForApp(appId, chainInfo),
+ *   },
+ * );
+ * handler.start();
+ * ```
+ */
+export declare class IframeConnectionHandler {
+    private config;
+    private callbacks;
+    private pendingSessions;
+    private activeSessions;
+    private log;
+    constructor(config: IframeConnectionConfig, callbacks: IframeConnectionCallbacks);
+    start(): void;
+    stop(): void;
+    approveDiscovery(requestId: string): void;
+    rejectDiscovery(requestId: string): void;
+    terminateSession(sessionId: string): void;
+    getPendingSessions(): PendingSession[];
+    private handleMessage;
+    private handleMessageAsync;
+    private handlePing;
+    private handleDiscoveryRequest;
+    private handleKeyExchangeRequest;
+    private handleSecureMessage;
+    private postToParent;
+    private postToOrigin;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWZyYW1lX2Nvbm5lY3Rpb25faGFuZGxlci5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2lmcmFtZS9oYW5kbGVycy9pZnJhbWVfY29ubmVjdGlvbl9oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBQ0gsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDekQsT0FBTyxLQUFLLEVBQUUsTUFBTSxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFjckQsT0FBTyxFQUE4RCxLQUFLLGVBQWUsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBRWxIOztHQUVHO0FBQ0gsTUFBTSxXQUFXLGNBQWM7SUFDN0IsZ0NBQWdDO0lBQ2hDLFNBQVMsRUFBRSxNQUFNLENBQUM7SUFDbEIsNkJBQTZCO0lBQzdCLEtBQUssRUFBRSxNQUFNLENBQUM7SUFDZCx3Q0FBd0M7SUFDeEMsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUNmLHNCQUFzQjtJQUN0QixNQUFNLEVBQUUsU0FBUyxHQUFHLFVBQVUsQ0FBQztDQUNoQztBQUVEOztHQUVHO0FBQ0gsTUFBTSxXQUFXLGFBQWE7SUFDNUIsMkRBQTJEO0lBQzNELFNBQVMsRUFBRSxNQUFNLENBQUM7SUFDbEIsOENBQThDO0lBQzlDLFNBQVMsRUFBRSxTQUFTLENBQUM7SUFDckIsMENBQTBDO0lBQzFDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQztJQUN6Qix1Q0FBdUM7SUFDdkMsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUNmLDZCQUE2QjtJQUM3QixLQUFLLEVBQUUsTUFBTSxDQUFDO0NBQ2Y7QUFFRDs7R0FFRztBQUNILE1BQU0sV0FBVyxzQkFBc0I7SUFDckMsK0JBQStCO0lBQy9CLFFBQVEsRUFBRSxNQUFNLENBQUM7SUFDakIsa0NBQWtDO0lBQ2xDLFVBQVUsRUFBRSxNQUFNLENBQUM7SUFDbkIsNEJBQTRCO0lBQzVCLGFBQWEsRUFBRSxNQUFNLENBQUM7SUFDdEIsK0JBQStCO0lBQy9CLFVBQVUsQ0FBQyxFQUFFLE1BQU0sQ0FBQztJQUNwQiw2RkFBNkY7SUFDN0YsY0FBYyxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7SUFDMUIsbUNBQW1DO0lBQ25DLE1BQU0sRUFBRSxlQUFlLENBQUM7Q0FDekI7QUFFRDs7R0FFRztBQUNILE1BQU0sV0FBVyx5QkFBeUI7SUFDeEMsa0ZBQWdGO0lBQ2hGLGtCQUFrQixDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsY0FBYyxLQUFLLElBQUksQ0FBQztJQUN2RCxtRUFBbUU7SUFDbkUsb0JBQW9CLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxhQUFhLEtBQUssSUFBSSxDQUFDO0lBQ3hELDBDQUEwQztJQUMxQyxtQkFBbUIsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLE1BQU0sS0FBSyxJQUFJLENBQUM7SUFDbEQsMkZBQXlGO0lBQ3pGLGtCQUFrQixDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsRUFBRSxNQUFNLEtBQUssSUFBSSxDQUFDO0lBQ3hEOzs7T0FHRztJQUNILFNBQVMsRUFBRSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFNBQVMsS0FBSyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7Q0FDckU7QUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FpQkc7QUFDSCxxQkFBYSx1QkFBdUI7SUFNaEMsT0FBTyxDQUFDLE1BQU07SUFDZCxPQUFPLENBQUMsU0FBUztJQU5uQixPQUFPLENBQUMsZUFBZSxDQUFxQztJQUM1RCxPQUFPLENBQUMsY0FBYyxDQUFvQztJQUMxRCxPQUFPLENBQUMsR0FBRyxDQUFrQjtJQUU3QixZQUNVLE1BQU0sRUFBRSxzQkFBc0IsRUFDOUIsU0FBUyxFQUFFLHlCQUF5QixFQUc3QztJQUVELEtBQUssSUFBSSxJQUFJLENBSVo7SUFFRCxJQUFJLElBQUksSUFBSSxDQUVYO0lBRUQsZ0JBQWdCLENBQUMsU0FBUyxFQUFFLE1BQU0sR0FBRyxJQUFJLENBa0J4QztJQUVELGVBQWUsQ0FBQyxTQUFTLEVBQUUsTUFBTSxHQUFHLElBQUksQ0FFdkM7SUFFRCxnQkFBZ0IsQ0FBQyxTQUFTLEVBQUUsTUFBTSxHQUFHLElBQUksQ0FVeEM7SUFFRCxrQkFBa0IsSUFBSSxjQUFjLEVBQUUsQ0FFckM7SUFFRCxPQUFPLENBQUMsYUFBYSxDQUVuQjtZQUVZLGtCQUFrQjtJQStCaEMsT0FBTyxDQUFDLFVBQVU7SUFRbEIsT0FBTyxDQUFDLHNCQUFzQjtZQVNoQix3QkFBd0I7WUE2Q3hCLG1CQUFtQjtJQXFEakMsT0FBTyxDQUFDLFlBQVk7SUFNcEIsT0FBTyxDQUFDLFlBQVk7Q0FLckIifQ==

package/dest/iframe/handlers/iframe_connection_handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframe_connection_handler.d.ts","sourceRoot":"","sources":["../../../src/iframe/handlers/iframe_connection_handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAcrD,OAAO,EAA8D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAElH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,SAAS,CAAC;IACrB,0CAA0C;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mCAAmC;IACnC,MAAM,EAAE,eAAe,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,kFAAgF;IAChF,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IACvD,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IACxD,0CAA0C;IAC1C,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAClD,2FAAyF;IACzF,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD;;;OAGG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,uBAAuB;IAMhC,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;IANnB,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,GAAG,CAAkB;IAE7B,YACU,MAAM,EAAE,sBAAsB,EAC9B,SAAS,EAAE,yBAAyB,EAG7C;IAED,KAAK,IAAI,IAAI,CAIZ;IAED,IAAI,IAAI,IAAI,CAEX;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAkBxC;IAED,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAEvC;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAUxC;IAED,kBAAkB,IAAI,cAAc,EAAE,CAErC;IAED,OAAO,CAAC,aAAa,CAEnB;YAEY,kBAAkB;IA+BhC,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,sBAAsB;YAShB,wBAAwB;YA6CxB,mBAAmB;IAqDjC,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,YAAY;CAKrB"}

package/dest/iframe/handlers/iframe_connection_handler.js

@@ -0,0 +1,239 @@
+/**
+ * IframeConnectionHandler — wallet-side of the cross-origin iframe protocol.
+ *
+ * This mirrors {@link BackgroundConnectionHandler} from `@aztec/wallet-sdk/extension/handlers`
+ * but uses `window.postMessage` instead of browser.runtime messaging.
+ *
+ * Message flow (wallet receives):
+ *   parent → DISCOVERY            → show approval UI → send DISCOVERY_RESPONSE
+ *   parent → KEY_EXCHANGE_REQUEST → ECDH             → send KEY_EXCHANGE_RESPONSE
+ *   parent → SECURE_MESSAGE       → decrypt → Wallet → encrypt → SECURE_RESPONSE
+ *   parent → DISCONNECT           → terminate session
+ *
+ * The wallet announces itself by posting WALLET_READY as soon as the handler starts,
+ * so the dApp knows it can send a discovery request.
+ */ import { WalletSchema } from '@aztec/aztec.js/wallet';
+import { jsonStringify } from '@aztec/foundation/json-rpc';
+import { getSchemaParameters, parseWithOptionals, schemaHasMethod } from '@aztec/foundation/schemas';
+import { decrypt, deriveSessionKeys, encrypt, exportPublicKey, generateKeyPair, importPublicKey } from '../../crypto.js';
+import { WalletMessageType } from '../../types.js';
+/**
+ * Handles the wallet side of the cross-origin iframe protocol.
+ *
+ * Manages the full lifecycle: discovery, ECDH key exchange, encrypted message
+ * dispatch to a {@link Wallet} instance, and session termination.
+ *
+ * @example
+ * ```typescript
+ * const handler = new IframeConnectionHandler(
+ *   { walletId: 'my-wallet', walletName: 'My Wallet', walletVersion: '1.0.0', logger: console },
+ *   {
+ *     onPendingDiscovery: (session) => showApprovalUI(session),
+ *     getWallet: (appId, chainInfo) => createWalletForApp(appId, chainInfo),
+ *   },
+ * );
+ * handler.start();
+ * ```
+ */ export class IframeConnectionHandler {
+    config;
+    callbacks;
+    pendingSessions;
+    activeSessions;
+    log;
+    constructor(config, callbacks){
+        this.config = config;
+        this.callbacks = callbacks;
+        this.pendingSessions = new Map();
+        this.activeSessions = new Map();
+        this.handleMessage = (event)=>{
+            void this.handleMessageAsync(event);
+        };
+        this.log = config.logger;
+    }
+    start() {
+        window.addEventListener('message', this.handleMessage);
+        this.postToParent({
+            type: WalletMessageType.WALLET_READY
+        });
+        this.log.info('IframeConnectionHandler started, posted WALLET_READY');
+    }
+    stop() {
+        window.removeEventListener('message', this.handleMessage);
+    }
+    approveDiscovery(requestId) {
+        const pending = this.pendingSessions.get(requestId);
+        if (!pending || pending.status !== 'pending') {
+            return;
+        }
+        pending.status = 'approved';
+        this.postToOrigin(pending.origin, {
+            type: WalletMessageType.DISCOVERY_RESPONSE,
+            requestId,
+            walletInfo: {
+                id: this.config.walletId,
+                name: this.config.walletName,
+                version: this.config.walletVersion,
+                icon: this.config.walletIcon
+            }
+        });
+        this.log.info(`Discovery approved for requestId=${requestId}`);
+    }
+    rejectDiscovery(requestId) {
+        this.pendingSessions.delete(requestId);
+    }
+    terminateSession(sessionId) {
+        const session = this.activeSessions.get(sessionId);
+        if (session) {
+            this.postToOrigin(session.origin, {
+                type: WalletMessageType.SESSION_DISCONNECTED,
+                sessionId
+            });
+            this.activeSessions.delete(sessionId);
+            this.callbacks.onSessionTerminated?.(sessionId);
+        }
+    }
+    getPendingSessions() {
+        return Array.from(this.pendingSessions.values()).filter((s)=>s.status === 'pending');
+    }
+    handleMessage;
+    async handleMessageAsync(event) {
+        if (this.config.allowedOrigins && this.config.allowedOrigins.length > 0) {
+            if (!this.config.allowedOrigins.includes(event.origin)) {
+                return;
+            }
+        }
+        const msg = event.data;
+        if (!msg || typeof msg !== 'object' || !msg.type) {
+            return;
+        }
+        switch(msg.type){
+            case WalletMessageType.DISCOVERY:
+                this.handleDiscoveryRequest(msg, event.origin);
+                break;
+            case WalletMessageType.KEY_EXCHANGE_REQUEST:
+                await this.handleKeyExchangeRequest(msg, event.origin);
+                break;
+            case WalletMessageType.SECURE_MESSAGE:
+                await this.handleSecureMessage(msg);
+                break;
+            case WalletMessageType.DISCONNECT:
+                this.terminateSession(msg.sessionId);
+                break;
+            case WalletMessageType.PING:
+                this.handlePing(msg.sessionId);
+                break;
+        }
+    }
+    handlePing(sessionId) {
+        const session = this.activeSessions.get(sessionId);
+        if (!session) {
+            return;
+        }
+        this.postToOrigin(session.origin, {
+            type: WalletMessageType.PONG,
+            sessionId
+        });
+    }
+    handleDiscoveryRequest(msg, origin) {
+        // eslint-disable-next-line jsdoc/require-jsdoc
+        const { requestId, appId } = msg;
+        const pending = {
+            requestId,
+            appId,
+            origin,
+            status: 'pending'
+        };
+        this.pendingSessions.set(requestId, pending);
+        this.log.info(`Discovery request from appId=${appId} origin=${origin}`);
+        this.callbacks.onPendingDiscovery?.(pending);
+    }
+    async handleKeyExchangeRequest(msg, origin) {
+        const { requestId, publicKey: appPublicKeyRaw } = msg;
+        const pending = this.pendingSessions.get(requestId);
+        if (!pending || pending.status !== 'approved') {
+            this.log.warn(`Key exchange for unknown/unapproved requestId=${requestId}`);
+            return;
+        }
+        try {
+            const keyPair = await generateKeyPair();
+            const walletPublicKey = await exportPublicKey(keyPair.publicKey);
+            const appPublicKey = await importPublicKey(appPublicKeyRaw);
+            const sessionKeys = await deriveSessionKeys(keyPair, appPublicKey, false);
+            const session = {
+                sessionId: requestId,
+                sharedKey: sessionKeys.encryptionKey,
+                verificationHash: sessionKeys.verificationHash,
+                origin: pending.origin,
+                appId: pending.appId
+            };
+            this.activeSessions.set(requestId, session);
+            this.pendingSessions.delete(requestId);
+            this.postToOrigin(origin, {
+                type: WalletMessageType.KEY_EXCHANGE_RESPONSE,
+                requestId,
+                publicKey: walletPublicKey,
+                verificationHash: sessionKeys.verificationHash
+            });
+            this.callbacks.onVerificationHash?.(sessionKeys.verificationHash);
+            this.callbacks.onSessionEstablished?.(session);
+            this.log.info(`Key exchange complete, sessionId=${requestId}`);
+        } catch (err) {
+            this.log.error(`Key exchange failed: ${err}`);
+        }
+    }
+    async handleSecureMessage(msg) {
+        // eslint-disable-next-line jsdoc/require-jsdoc
+        const { sessionId, encrypted } = msg;
+        const session = this.activeSessions.get(sessionId);
+        if (!session) {
+            return;
+        }
+        let walletMessage;
+        try {
+            walletMessage = await decrypt(session.sharedKey, encrypted);
+        } catch  {
+            this.log.warn(`Decryption failed for sessionId=${sessionId}`);
+            return;
+        }
+        const { messageId, type, args, chainInfo, appId } = walletMessage;
+        let result;
+        let error;
+        try {
+            const wallet = await this.callbacks.getWallet(appId, chainInfo);
+            if (!schemaHasMethod(WalletSchema, type)) {
+                throw new Error(`Unknown wallet method: ${type}`);
+            }
+            const sanitizedArgs = await parseWithOptionals(args, getSchemaParameters(WalletSchema[type]));
+            result = await wallet[type](...sanitizedArgs);
+        } catch (err) {
+            error = err instanceof Error ? err.message : String(err);
+            this.log.error(`Error handling ${type}: ${error}`);
+        }
+        const response = {
+            messageId,
+            walletId: this.config.walletId,
+            result,
+            error
+        };
+        try {
+            const encryptedResponse = await encrypt(session.sharedKey, jsonStringify(response));
+            this.postToOrigin(session.origin, {
+                type: WalletMessageType.SECURE_RESPONSE,
+                sessionId,
+                encrypted: encryptedResponse
+            });
+        } catch (err) {
+            this.log.error(`Encryption of response failed: ${err}`);
+        }
+    }
+    postToParent(msg) {
+        if (window.parent !== window) {
+            window.parent.postMessage(msg, '*');
+        }
+    }
+    postToOrigin(origin, msg) {
+        if (window.parent !== window) {
+            window.parent.postMessage(msg, origin);
+        }
+    }
+}

package/dest/iframe/handlers/index.d.ts

@@ -0,0 +1,2 @@
+export { IframeConnectionHandler, type IframeConnectionConfig, type IframeConnectionCallbacks, type PendingSession, type ActiveSession, } from './iframe_connection_handler.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9pZnJhbWUvaGFuZGxlcnMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixLQUFLLHNCQUFzQixFQUMzQixLQUFLLHlCQUF5QixFQUM5QixLQUFLLGNBQWMsRUFDbkIsS0FBSyxhQUFhLEdBQ25CLE1BQU0sZ0NBQWdDLENBQUMifQ==

package/dest/iframe/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/iframe/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,gCAAgC,CAAC"}

package/dest/iframe/handlers/index.js

@@ -0,0 +1 @@
+export { IframeConnectionHandler } from './iframe_connection_handler.js';

package/dest/iframe/provider/iframe_discovery.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Web wallet discovery — creates {@link IframeWalletProvider} instances from a list of URLs.
+ *
+ * For each configured URL we probe the wallet by loading a tiny invisible iframe,
+ * waiting for WALLET_READY, then sending a DISCOVERY request. On a successful
+ * DISCOVERY_RESPONSE we emit an IframeWalletProvider to the caller.
+ *
+ * This is intentionally lightweight (no key exchange yet) — key exchange happens
+ * later when the user selects the wallet and calls `provider.establishSecureChannel()`.
+ */
+import type { ChainInfo } from '@aztec/aztec.js/account';
+import type { DiscoverySession } from '../../manager/types.js';
+/**
+ * Probes a list of web wallet URLs and returns a {@link DiscoverySession} compatible
+ * with WalletManager's `getAvailableWallets()` interface.
+ *
+ * Discovered {@link IframeWalletProvider} instances are yielded asynchronously as each
+ * wallet responds to the probe.
+ *
+ * @param walletUrls - URLs of web wallets to probe
+ * @param chainInfo - Network information to pass during discovery
+ * @returns A cancellable discovery session
+ */
+export declare function discoverWebWallets(walletUrls: string[], chainInfo: ChainInfo): DiscoverySession;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWZyYW1lX2Rpc2NvdmVyeS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2lmcmFtZS9wcm92aWRlci9pZnJhbWVfZGlzY292ZXJ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7R0FTRztBQUNILE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBR3pELE9BQU8sS0FBSyxFQUFFLGdCQUFnQixFQUFrQixNQUFNLHdCQUF3QixDQUFDO0FBTS9FOzs7Ozs7Ozs7O0dBVUc7QUFDSCx3QkFBZ0Isa0JBQWtCLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxFQUFFLFNBQVMsRUFBRSxTQUFTLEdBQUcsZ0JBQWdCLENBdUYvRiJ9

package/dest/iframe/provider/iframe_discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframe_discovery.d.ts","sourceRoot":"","sources":["../../../src/iframe/provider/iframe_discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,wBAAwB,CAAC;AAM/E;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAuF/F"}