@cef-ai/widget-runtime 0.2.0

package/dist/audio/mic.js

@@ -0,0 +1,23 @@
+// packages/widget-runtime/src/audio/mic.ts
+// One place to acquire a microphone stream that captures the FULL acoustic scene.
+//
+// getUserMedia({ audio: true }) applies the browser's voice-call DSP by default:
+//   • noiseSuppression  — treats music and a second/far speaker as "noise" → removes them
+//   • echoCancellation  — drops audio that correlates with speaker output (far-end/system bleed)
+//   • autoGainControl   — pumps levels up/down
+// For interview / transcription capture we want everything the device hears, so
+// we opt all three OFF. Some browsers reject the explicit constraints, so we fall
+// back to plain { audio: true }.
+const RAW_AUDIO = { echoCancellation: false, noiseSuppression: false, autoGainControl: false };
+export async function requestMicStream() {
+    try {
+        return await navigator.mediaDevices.getUserMedia({ audio: RAW_AUDIO });
+    }
+    catch (err) {
+        const name = err?.name;
+        if (name === 'OverconstrainedError' || name === 'TypeError') {
+            return navigator.mediaDevices.getUserMedia({ audio: true });
+        }
+        throw err;
+    }
+}

package/dist/audio/segment.d.ts

@@ -0,0 +1,3 @@
+export declare function segmentPcm(pcm: Float32Array, sampleRate: number, segmentSeconds: number): Float32Array[];
+/** Decode an audio Blob to mono Float32 PCM resampled to 16 kHz (browser only). */
+export declare function decodeToMono16k(blob: Blob): Promise<Float32Array>;

package/dist/audio/segment.js

@@ -0,0 +1,24 @@
+// packages/widget-runtime/src/audio/segment.ts
+export function segmentPcm(pcm, sampleRate, segmentSeconds) {
+    const per = sampleRate * segmentSeconds;
+    const out = [];
+    for (let i = 0; i < pcm.length; i += per)
+        out.push(pcm.subarray(i, Math.min(i + per, pcm.length)));
+    return out.length ? out : [pcm];
+}
+/** Decode an audio Blob to mono Float32 PCM resampled to 16 kHz (browser only). */
+export async function decodeToMono16k(blob) {
+    const bytes = await blob.arrayBuffer();
+    const Ctx = (window.OfflineAudioContext || window.webkitOfflineAudioContext);
+    const tmp = new (window.AudioContext || window.webkitAudioContext)();
+    const decoded = await tmp.decodeAudioData(bytes.slice(0));
+    void tmp.close();
+    const durationFrames = Math.ceil(decoded.duration * 16000);
+    const off = new Ctx(1, durationFrames, 16000);
+    const src = off.createBufferSource();
+    src.buffer = decoded;
+    src.connect(off.destination);
+    src.start();
+    const rendered = await off.startRendering();
+    return rendered.getChannelData(0).slice();
+}

package/dist/audio/wav.d.ts

@@ -0,0 +1,2 @@
+/** Encode mono Float32 PCM [-1,1] as a 16-bit PCM WAV ArrayBuffer. */
+export declare function encodeWav(samples: Float32Array, sampleRate: number): ArrayBuffer;

package/dist/audio/wav.js

@@ -0,0 +1,27 @@
+// packages/widget-runtime/src/audio/wav.ts
+/** Encode mono Float32 PCM [-1,1] as a 16-bit PCM WAV ArrayBuffer. */
+export function encodeWav(samples, sampleRate) {
+    const buf = new ArrayBuffer(44 + samples.length * 2);
+    const v = new DataView(buf);
+    const str = (off, s) => { for (let i = 0; i < s.length; i++)
+        v.setUint8(off + i, s.charCodeAt(i)); };
+    str(0, 'RIFF');
+    v.setUint32(4, 36 + samples.length * 2, true);
+    str(8, 'WAVE');
+    str(12, 'fmt ');
+    v.setUint32(16, 16, true);
+    v.setUint16(20, 1, true);
+    v.setUint16(22, 1, true);
+    v.setUint32(24, sampleRate, true);
+    v.setUint32(28, sampleRate * 2, true);
+    v.setUint16(32, 2, true);
+    v.setUint16(34, 16, true);
+    str(36, 'data');
+    v.setUint32(40, samples.length * 2, true);
+    let off = 44;
+    for (let i = 0; i < samples.length; i++, off += 2) {
+        const s = Math.max(-1, Math.min(1, samples[i]));
+        v.setInt16(off, s < 0 ? s * 0x8000 : s * 0x7fff, true);
+    }
+    return buf;
+}

package/dist/bridge-wallet.d.ts

@@ -0,0 +1,46 @@
+import type { Signer } from '@cef-ai/vault-sdk';
+/**
+ * Wallet shape required by @cef-ai/client-sdk's Vault constructor.
+ * sign/signRawBytes return hex WITHOUT a `0x` prefix.
+ *
+ * Formerly in embed-adapter.ts — moved here since the bridge is now the
+ * sole wallet source.
+ */
+export interface VaultSignedWallet {
+    type: 'ed25519' | 'sr25519';
+    address: string;
+    publicKey: string;
+    isReady: () => Promise<boolean>;
+    sign: (data: string) => Promise<string>;
+    signRawBytes: (bytes: Uint8Array) => Promise<string>;
+}
+/**
+ * Build a vault-sdk `Signer` (`@cef-ai/signer`) from a bridge identity + sign
+ * function. vault-sdk 3.0.0 consumes a `Signer` directly (no `Wallet` adapter).
+ *
+ * @param pubkey   Hex public key (with or without 0x). Decoded to the `publicKey`
+ *                 bytes the SDK reads for `X-Public-Key`.
+ * @param sigType  Signature scheme reported by the host ('ed25519' | 'sr25519').
+ * @param signFn   Raw-bytes signer from the host bridge. The optional `intent`
+ *                 is ignored — the host bridge signs raw bytes regardless.
+ */
+export declare function toVaultSdkSigner(pubkey: string, sigType: 'ed25519' | 'sr25519', signFn: (bytes: Uint8Array) => Promise<Uint8Array>): Signer;
+/**
+ * Build a VaultSignedWallet (shape expected by @cef-ai/client-sdk's Vault)
+ * from a bridge identity + sign function.
+ *
+ * sign(data: string) encodes the string as UTF-8 bytes and signs them.
+ * signRawBytes signs the bytes directly.
+ * Both return hex WITHOUT `0x`.
+ *
+ * @param sigType  Signature scheme reported by the host ('ed25519' | 'sr25519').
+ */
+export declare function toClientSdkWallet(pubkey: string, sigType: 'ed25519' | 'sr25519', signFn: (bytes: Uint8Array) => Promise<Uint8Array>): VaultSignedWallet;
+/**
+ * Build the signerPair shape that `createVaultUploader` (and `mintDelegationToken`)
+ * accept, from a bridge pubkey + sign function.
+ */
+export declare function toUploaderSignerPair(pubkey: string, signFn: (bytes: Uint8Array) => Promise<Uint8Array>): {
+    publicKey: Uint8Array;
+    sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+};

package/dist/bridge-wallet.js

@@ -0,0 +1,80 @@
+// packages/widget-runtime/src/bridge-wallet.ts
+//
+// Adapters that expose the Vault host-bridge signing surface in the three
+// shapes the rest of the runtime expects:
+//
+//   toVaultSdkSigner    → @cef-ai/signer `Signer` (type/address/publicKey/isReady/sign)
+//   toClientSdkWallet   → @cef-ai/client-sdk VaultSignedWallet
+//   toUploaderSignerPair → { publicKey: Uint8Array; sign } for createVaultUploader
+//
+// All hex values in the client-sdk shape are WITHOUT a 0x prefix, matching
+// the proven embed-wallet behaviour (see embed-adapter.ts history).
+import { hexToU8a } from '@polkadot/util';
+// ── Internal helpers ──────────────────────────────────────────────────────────
+/** Encode bytes as lowercase hex WITHOUT a `0x` prefix. */
+function bytesToHexNo0x(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += b.toString(16).padStart(2, '0');
+    return s;
+}
+// ── Adapters ──────────────────────────────────────────────────────────────────
+/**
+ * Build a vault-sdk `Signer` (`@cef-ai/signer`) from a bridge identity + sign
+ * function. vault-sdk 3.0.0 consumes a `Signer` directly (no `Wallet` adapter).
+ *
+ * @param pubkey   Hex public key (with or without 0x). Decoded to the `publicKey`
+ *                 bytes the SDK reads for `X-Public-Key`.
+ * @param sigType  Signature scheme reported by the host ('ed25519' | 'sr25519').
+ * @param signFn   Raw-bytes signer from the host bridge. The optional `intent`
+ *                 is ignored — the host bridge signs raw bytes regardless.
+ */
+export function toVaultSdkSigner(pubkey, sigType, signFn) {
+    return {
+        type: sigType,
+        // `address` is set to the hex pubkey (NOT an SS58 address). vault-sdk's
+        // WalletAuthProvider reads `publicKey`/`type`, not `address`, to build the
+        // auth headers — matching the toClientSdkWallet note below.
+        address: pubkey,
+        publicKey: hexToU8a(pubkey),
+        isReady: async () => true,
+        sign: (bytes) => signFn(bytes),
+    };
+}
+/**
+ * Build a VaultSignedWallet (shape expected by @cef-ai/client-sdk's Vault)
+ * from a bridge identity + sign function.
+ *
+ * sign(data: string) encodes the string as UTF-8 bytes and signs them.
+ * signRawBytes signs the bytes directly.
+ * Both return hex WITHOUT `0x`.
+ *
+ * @param sigType  Signature scheme reported by the host ('ed25519' | 'sr25519').
+ */
+export function toClientSdkWallet(pubkey, sigType, signFn) {
+    return {
+        type: sigType,
+        // `address` is set to the hex pubkey (NOT an SS58 address). This is safe
+        // because current @cef-ai/client-sdk consumers read `publicKey`, not `address`.
+        address: pubkey,
+        publicKey: pubkey,
+        isReady: async () => true,
+        sign: async (data) => {
+            const bytes = new TextEncoder().encode(data);
+            return bytesToHexNo0x(await signFn(bytes));
+        },
+        signRawBytes: async (bytes) => {
+            return bytesToHexNo0x(await signFn(bytes));
+        },
+    };
+}
+/**
+ * Build the signerPair shape that `createVaultUploader` (and `mintDelegationToken`)
+ * accept, from a bridge pubkey + sign function.
+ */
+export function toUploaderSignerPair(pubkey, signFn) {
+    return {
+        publicKey: hexToU8a(pubkey),
+        sign: signFn,
+    };
+}

package/dist/bridge.d.ts

@@ -0,0 +1,6 @@
+import type { WidgetManifest } from './types.js';
+export interface BridgeInput {
+    manifest: WidgetManifest;
+    runtimeUrl: string;
+}
+export declare function injectWidgetBridge(html: string, input: BridgeInput): string;

package/dist/bridge.js

@@ -0,0 +1,15 @@
+const MARKER = '/* cere-widget-bridge */';
+function escapeForScript(json) {
+    return json.replace(/<\/script/gi, '<\\/script');
+}
+function escapeAttr(value) {
+    return value.replace(/[&"<>]/g, (c) => ({ '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' }[c]));
+}
+export function injectWidgetBridge(html, input) {
+    if (html.includes(MARKER))
+        return html;
+    const manifestJson = escapeForScript(JSON.stringify(input.manifest, null, 2));
+    const head = `<script>${MARKER}\nwindow.WidgetSandbox = { manifest: ${manifestJson} };\n</script>\n` +
+        `<script src="${escapeAttr(input.runtimeUrl)}"></script>\n`;
+    return html.includes('</head>') ? html.replace('</head>', `${head}</head>`) : head + html;
+}

package/dist/build-tools.d.ts

@@ -0,0 +1,4 @@
+export { buildWidgetManifest, type BuildManifestInput } from './manifest.js';
+export { injectWidgetBridge, type BridgeInput } from './bridge.js';
+export { validateConfig } from './validate-config.js';
+export type { WidgetManifest, WidgetKind, WidgetConfig, RecordConfig, ListConfig, DashboardConfig, SubmitConfig, ConversationConfig, CustomPanelConfig, CompositePanel, CompositeConfig, } from './types.js';

package/dist/build-tools.js

@@ -0,0 +1,12 @@
+// packages/widget-runtime/src/build-tools.ts
+//
+// Build-time surface for tooling (e.g. `@cef-ai/cli`) that needs to BUILD a
+// manifest and inject the bridge WITHOUT loading the browser runtime. The main
+// entry (`index.ts`) re-exports the interactive standalone wallet, which pulls
+// in `@cere/embed-wallet` (a browser UMD bundle that references `self`) — that
+// cannot be imported in Node. This entry re-exports only the pure,
+// environment-agnostic pieces: the manifest builder, the HTML bridge injector,
+// and the manifest/config types.
+export { buildWidgetManifest } from './manifest.js';
+export { injectWidgetBridge } from './bridge.js';
+export { validateConfig } from './validate-config.js';

package/dist/entry.d.ts

@@ -0,0 +1,11 @@
+import type { WidgetManifest } from './types.js';
+import { createWidgetRuntime } from './runtime.js';
+declare global {
+    interface Window {
+        WidgetSandbox?: {
+            manifest: WidgetManifest;
+        };
+        WidgetRuntime?: ReturnType<typeof createWidgetRuntime>;
+        registerCompositePanel?: (name: string, fn: (root: HTMLElement, runtime: unknown, deps?: unknown) => void | Promise<void>) => void;
+    }
+}

package/dist/entry.js

@@ -0,0 +1,159 @@
+// packages/widget-runtime/src/entry.ts
+import { VaultSDK } from '@cef-ai/vault-sdk';
+import { createHostBridge } from './host-bridge.js';
+import { toVaultSdkSigner, toUploaderSignerPair } from './bridge-wallet.js';
+import { connectStandaloneWallet } from './standalone-wallet.js';
+import { createVaultClient } from './vault-client.js';
+import { createWidgetRuntime } from './runtime.js';
+import { captureAndUploadAudio, createVaultUploader } from './audio/capture-upload.js';
+import { decodeToMono16k } from './audio/segment.js';
+import { registerCompositePanel } from './kinds/composite.js';
+/**
+ * Run `fn` once the DOM is parsed. The runtime <script> is injected into
+ * <head>, so boot() executes BEFORE <body>/#app is parsed — any
+ * document.getElementById('app') at boot time would be null.
+ */
+function onDomReady(fn) {
+    if (typeof document !== 'undefined' && document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', fn, { once: true });
+    }
+    else {
+        fn();
+    }
+}
+function boot() {
+    const manifest = window.WidgetSandbox?.manifest;
+    if (!manifest)
+        return;
+    const bridge = createHostBridge();
+    // ── Multi-source identity ─────────────────────────────────────────────────
+    // Tier 1: the Vault host iframes us → use the postMessage sign-bridge.
+    // Tier 2/3: no responding host (top-level link, or the bridge times out
+    // returning null) → connect an interactive Cere embed-wallet built from
+    // `manifest.wallet.{appId,env}` (opens the wallet UI). Both paths yield a
+    // pubkey + raw-bytes signer that feed the SAME vault-sdk client.
+    //
+    // Memoized so the (possibly interactive) resolution runs at most once — the
+    // wallet popup must not open on every query/connect/upload.
+    let identityP = null;
+    const resolveSigningIdentity = () => {
+        if (identityP)
+            return identityP;
+        identityP = (async () => {
+            const hostId = await bridge.requestIdentity();
+            if (hostId) {
+                return {
+                    source: 'host',
+                    publicKey: hostId.pubkey,
+                    sigType: hostId.sigType,
+                    sign: (bytes) => bridge.sign(bytes),
+                };
+            }
+            // No host → interactive wallet (standalone / direct-link boot).
+            const wallet = await connectStandaloneWallet(manifest.wallet);
+            return {
+                source: 'wallet',
+                publicKey: wallet.pubkey(),
+                sigType: wallet.sigType,
+                sign: (bytes) => wallet.signRawBytes(bytes),
+            };
+        })().catch((err) => {
+            identityP = null; // let a later action retry (e.g. user reopens the wallet)
+            throw err;
+        });
+        return identityP;
+    };
+    const deps = {
+        resolveIdentity: async () => {
+            const id = await resolveSigningIdentity();
+            return { source: id.source, publicKey: id.publicKey, sigType: id.sigType };
+        },
+        buildVaultClient: (m, id) => {
+            const sigType = id.sigType ?? 'ed25519';
+            // Defer to the memoized identity for signing — resolveIdentity() has
+            // already run by the time buildVaultClient is called, so this resolves
+            // to the same (host or wallet) signer without a second handshake/popup.
+            const signFn = (bytes) => resolveSigningIdentity().then((rid) => rid.sign(bytes));
+            const vaultSdkSigner = toVaultSdkSigner(id.publicKey, sigType, signFn);
+            // vault-sdk SDK instance: used for vault.ensure(), cubby reads, publish,
+            // connectAgent, agentStatus — the single SDK for the whole runtime.
+            const makeSdk = () => new VaultSDK({
+                endpoint: m.endpoints.vault,
+                garEndpoint: m.endpoints.gar,
+                marketplaceEndpoint: m.endpoints.marketplace,
+                s3GatewayAuthInfoUrl: m.endpoints.s3GatewayAuthInfo,
+                signer: vaultSdkSigner,
+            });
+            return createVaultClient(m, makeSdk);
+        },
+    };
+    // Build the mount deps (audio uploader) for config-driven audio kinds.
+    // The uploader resolves its identity lazily via the shared (memoized)
+    // resolver on the first upload — it never blocks WidgetRuntime exposure and
+    // reuses the same host-or-wallet signer as the vault client.
+    let mountDeps;
+    if (manifest.kind === 'submit' || manifest.kind === 'conversation' || manifest.kind === 'composite') {
+        // Memoize: build uploader once, reuse across multiple uploads in same session.
+        let uploaderP = null;
+        const getUploader = () => {
+            if (uploaderP)
+                return uploaderP;
+            uploaderP = (async () => {
+                const id = await resolveSigningIdentity();
+                const signerPair = toUploaderSignerPair(id.publicKey, id.sign);
+                const vaultSdkSigner = toVaultSdkSigner(id.publicKey, id.sigType, id.sign);
+                const sdk = new VaultSDK({
+                    endpoint: manifest.endpoints.vault,
+                    garEndpoint: manifest.endpoints.gar,
+                    marketplaceEndpoint: manifest.endpoints.marketplace,
+                    s3GatewayAuthInfoUrl: manifest.endpoints.s3GatewayAuthInfo,
+                    signer: vaultSdkSigner,
+                });
+                const ensuredVault = await sdk.vault.ensure({ onboard: false });
+                return createVaultUploader({
+                    signerPair,
+                    sigType: id.sigType,
+                    gatewayUrl: manifest.endpoints.s3GatewayAuthInfo.replace(/\/auth\/info\/?$/, ''),
+                    bucketId: ensuredVault.bucketId,
+                    region: ensuredVault.region,
+                });
+            })().catch((err) => { uploaderP = null; throw err; });
+            return uploaderP;
+        };
+        const uploadAudio = (blob, opts) => getUploader().then((upload) => captureAndUploadAudio({
+            blob,
+            segmentSeconds: opts?.segmentSeconds,
+            softCapSeconds: opts?.softCapSeconds,
+            onProgress: opts?.onProgress,
+            onWarn: opts?.onWarn,
+        }, { decode: decodeToMono16k, upload, sampleRate: 16000 }));
+        mountDeps = { uploadAudio };
+    }
+    // Expose WidgetRuntime SYNCHRONOUSLY at boot. Custom widgets read
+    // window.WidgetRuntime in their own inline boot() at page load and would
+    // otherwise find it undefined (race) and render a fallback. The identity
+    // resolution runs lazily inside createWidgetRuntime's resolveIdentity on the
+    // first query/publish/connect (host handshake or interactive wallet).
+    window.WidgetRuntime = createWidgetRuntime(manifest, deps);
+    // Expose the composite panel registry SYNCHRONOUSLY so a host app bundle
+    // (loaded in <head> as a classic <script> right after widget-runtime.js) can
+    // call registerCompositePanel before the deferred mountKind runs. A dynamic
+    // import would settle on a later microtask and race that synchronous call.
+    // The static import is safe: entry.ts is a leaf importer, so it does not add
+    // to the existing composite↔mount module cycle (both export only functions).
+    window.registerCompositePanel = registerCompositePanel;
+    // Config-driven kinds: mount automatically. Custom widgets (custom/no kind)
+    // self-boot and now find window.WidgetRuntime present.
+    if (manifest.kind && manifest.kind !== 'custom' && manifest.config) {
+        // Defer until the DOM is ready: the runtime <script> is in <head>, so
+        // #app isn't parsed yet at boot. (Custom widgets self-boot from a <body>
+        // script and are unaffected.)
+        onDomReady(() => {
+            const app = document.getElementById('app');
+            if (app) {
+                void import('./mount.js').then(({ mountKind }) => mountKind(app, manifest.config, window.WidgetRuntime, mountDeps));
+            }
+        });
+    }
+}
+boot();

package/dist/host-bridge.d.ts

@@ -0,0 +1,19 @@
+export declare const IDENTITY_REQUEST_TYPE = "cef-widget:identity-request";
+export declare const IDENTITY_RESPONSE_TYPE = "cef-widget:identity-response";
+export declare const SIGN_REQUEST_TYPE = "cef-widget:sign-request";
+export declare const SIGN_RESPONSE_TYPE = "cef-widget:sign-response";
+export interface HostBridge {
+    requestIdentity: () => Promise<{
+        pubkey: string;
+        sigType: 'ed25519' | 'sr25519';
+    } | null>;
+    sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+}
+/**
+ * Returns the host bridge client. The bridge is stateless across calls
+ * (identity is cached internally after the first successful handshake).
+ * Safe to call multiple times — returns the same singleton behaviour.
+ */
+export declare function createHostBridge(): HostBridge;
+/** Reset module-level state (for tests only). */
+export declare function _resetBridgeForTest(): void;

package/dist/host-bridge.js

@@ -0,0 +1,214 @@
+// packages/widget-runtime/src/host-bridge.ts
+//
+// postMessage client that talks to the Vault host's widget-sign-bridge.
+// Protocol types MUST match the host repo exactly (protocol.ts in vault):
+//   cef-widget:identity-request / cef-widget:identity-response
+//   cef-widget:sign-request     / cef-widget:sign-response
+//
+// Wire bytes are always number[] (not Uint8Array) — postMessage does not
+// structured-clone Uint8Array reliably across sandboxed origin pairs.
+export const IDENTITY_REQUEST_TYPE = 'cef-widget:identity-request';
+export const IDENTITY_RESPONSE_TYPE = 'cef-widget:identity-response';
+export const SIGN_REQUEST_TYPE = 'cef-widget:sign-request';
+export const SIGN_RESPONSE_TYPE = 'cef-widget:sign-response';
+/** Singleton message listener + pending-request map; set up once on first use. */
+let listenerAttached = false;
+const pending = new Map();
+function ensureListener() {
+    if (listenerAttached)
+        return;
+    listenerAttached = true;
+    window.addEventListener('message', (event) => {
+        // Security: only accept replies from window.parent.
+        if (event.source !== window.parent)
+            return;
+        const data = event.data;
+        if (!data || typeof data !== 'object')
+            return;
+        const { type, requestId } = data;
+        if (typeof requestId !== 'string')
+            return;
+        if (type !== IDENTITY_RESPONSE_TYPE &&
+            type !== SIGN_RESPONSE_TYPE)
+            return;
+        const entry = pending.get(requestId);
+        if (entry) {
+            pending.delete(requestId);
+            entry.resolve(data);
+        }
+    });
+}
+function generateId() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+/** Identity result cached after first successful handshake. */
+let cachedIdentity = undefined;
+/**
+ * Request the connected-wallet identity from the Vault host.
+ *
+ * Returns null when:
+ *   - Not running inside an iframe (window.parent === window).
+ *   - Host doesn't reply within ~8 s (attach-vs-load race exhausted).
+ *   - Host replies with an error on every attempt.
+ *
+ * Resolves immediately (from cache) on subsequent calls after a success.
+ */
+async function requestIdentity() {
+    // Not inside an iframe.
+    if (window.parent === window)
+        return null;
+    // Return cached value if we already succeeded.
+    if (cachedIdentity !== undefined)
+        return cachedIdentity;
+    ensureListener();
+    const RETRY_INTERVAL_MS = 400;
+    const TOTAL_TIMEOUT_MS = 8000;
+    const deadline = Date.now() + TOTAL_TIMEOUT_MS;
+    return new Promise((outerResolve) => {
+        let settled = false;
+        let retryTimer;
+        let guardTimer;
+        let currentRequestId;
+        /** Clear both the retry timer and the outer deadline guard. */
+        function clearTimers() {
+            if (retryTimer !== undefined) {
+                clearTimeout(retryTimer);
+                retryTimer = undefined;
+            }
+            if (guardTimer !== undefined) {
+                clearTimeout(guardTimer);
+                guardTimer = undefined;
+            }
+        }
+        function attempt() {
+            if (settled)
+                return;
+            // Remove old pending entry (the host reply arrives on a per-requestId
+            // basis; stale IDs just get GC'd from the map when we replace them).
+            if (currentRequestId)
+                pending.delete(currentRequestId);
+            currentRequestId = generateId();
+            pending.set(currentRequestId, {
+                resolve: (data) => {
+                    if (settled)
+                        return;
+                    const d = data;
+                    if (d.error || !d.pubkey) {
+                        // Error response — keep retrying until deadline.
+                        scheduleRetryOrTimeout();
+                        return;
+                    }
+                    settled = true;
+                    clearTimers();
+                    const result = { pubkey: d.pubkey, sigType: (d.sigType ?? 'ed25519') };
+                    cachedIdentity = result;
+                    outerResolve(result);
+                },
+                reject: () => {
+                    if (settled)
+                        return;
+                    scheduleRetryOrTimeout();
+                },
+            });
+            // targetOrigin '*' — same trust assumption as the sign request (see the
+            // note below): host origin unknown to the widget; replies are source-gated.
+            window.parent.postMessage({ type: IDENTITY_REQUEST_TYPE, requestId: currentRequestId }, '*');
+            // Schedule an automatic retry in case no reply arrives within the interval.
+            scheduleRetryOrTimeout();
+        }
+        function scheduleRetryOrTimeout() {
+            if (settled)
+                return;
+            // Cancel any existing retry timer before scheduling a fresh one.
+            if (retryTimer !== undefined) {
+                clearTimeout(retryTimer);
+                retryTimer = undefined;
+            }
+            const remaining = deadline - Date.now();
+            if (remaining <= 0) {
+                settled = true;
+                clearTimers();
+                if (currentRequestId)
+                    pending.delete(currentRequestId);
+                cachedIdentity = null;
+                outerResolve(null);
+                return;
+            }
+            retryTimer = setTimeout(() => {
+                if (!settled)
+                    attempt();
+            }, Math.min(RETRY_INTERVAL_MS, remaining));
+        }
+        attempt();
+        // Also set an outer deadline guard in case no reply ever arrives.
+        guardTimer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                clearTimers();
+                if (currentRequestId)
+                    pending.delete(currentRequestId);
+                cachedIdentity = null;
+                outerResolve(null);
+            }
+        }, TOTAL_TIMEOUT_MS + RETRY_INTERVAL_MS);
+    });
+}
+/**
+ * Ask the Vault host to sign `bytes` with the connected wallet.
+ *
+ * Rejects on:
+ *   - `signature === null` (user declined).
+ *   - `error` string in the response.
+ *   - No response within ~60 s (modal closed / stale-reply race).
+ */
+async function sign(bytes) {
+    if (window.parent === window)
+        throw new Error('sign called outside of an iframe');
+    ensureListener();
+    const SIGN_TIMEOUT_MS = 60000;
+    const requestId = generateId();
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            pending.delete(requestId);
+            reject(new Error('widget signing timed out — the vault modal may have closed'));
+        }, SIGN_TIMEOUT_MS);
+        pending.set(requestId, {
+            resolve: (data) => {
+                clearTimeout(timer);
+                const d = data;
+                if (d.error) {
+                    reject(new Error(d.error));
+                }
+                else if (d.signature === null) {
+                    reject(new Error('widget signing was declined'));
+                }
+                else {
+                    resolve(Uint8Array.from(d.signature));
+                }
+            },
+            reject: (reason) => {
+                clearTimeout(timer);
+                reject(reason);
+            },
+        });
+        // targetOrigin '*': the widget doesn't know the Vault host's origin (it's
+        // not in the manifest), and the host is trusted. Safe because replies are
+        // gated on `event.source === window.parent` — only the real parent can
+        // answer. If the manifest ever carries the host origin, pin it here.
+        window.parent.postMessage({ type: SIGN_REQUEST_TYPE, requestId, bytes: Array.from(bytes) }, '*');
+    });
+}
+/**
+ * Returns the host bridge client. The bridge is stateless across calls
+ * (identity is cached internally after the first successful handshake).
+ * Safe to call multiple times — returns the same singleton behaviour.
+ */
+export function createHostBridge() {
+    return { requestIdentity, sign };
+}
+/** Reset module-level state (for tests only). */
+export function _resetBridgeForTest() {
+    listenerAttached = false;
+    pending.clear();
+    cachedIdentity = undefined;
+}