@cef-ai/widget-runtime 2.1.1 → 2.2.1

package/dist/sign-in-ui.js

@@ -0,0 +1,217 @@
+// packages/widget-runtime/src/sign-in-ui.ts
+//
+// The standalone sign-in surface, in the RUNTIME rather than in each widget.
+//
+// Every widget that can be shared by link needs the same three things — a
+// prompt, a way in for someone who has an account, a way in for someone who
+// does not — and none of them is the widget author's problem. Putting this here
+// is what makes "send somebody the link" a property of widgets rather than a
+// feature each one reimplements (and reimplements differently).
+//
+// ── The gesture is the whole design ────────────────────────────────────────
+// `login()`/`register()` open the wallet surface, and `window.open` outside
+// user activation is blocked. The previous standalone path called connect() at
+// boot; the browser swallowed the popup and the promise never settled, so the
+// widget sat on "Loading…" with nothing on screen to click. So the ceremony is
+// started from inside the button's own click handler — never from an effect,
+// never from boot — and that is the reason this is a DOM overlay and not a
+// promise the runtime resolves on its own.
+const OVERLAY_ID = 'cef-widget-signin';
+const DEFAULT_COPY = {
+    title: 'Sign in to view this',
+    body: 'This page reads data you need permission for. Sign in with your CEF '
+        + 'account — the same one you use for the console.',
+    signIn: 'Sign in',
+    register: 'Create an account',
+};
+function el(tag, style, text) {
+    const node = document.createElement(tag);
+    node.setAttribute('style', style);
+    if (text !== undefined)
+        node.textContent = text;
+    return node;
+}
+const SHELL = [
+    // JUST UNDER THE MAXIMUM, because the wallet's own ceremony panel sits AT it.
+    // At equal z-index the winner is DOM order, and this overlay won: the wallet
+    // opened its 420x640 panel and this card was painted across the middle of it,
+    // so the reader got a grey slab with a sign-in prompt stuck in it and no way
+    // to reach the passkey. Hiding during the ceremony (below) is the actual fix;
+    // this makes the stacking unambiguous if the two are ever up together.
+    'position:fixed', 'inset:0', 'z-index:2147483000',
+    'display:flex', 'align-items:center', 'justify-content:center',
+    'padding:24px', 'background:rgba(15,18,25,.55)',
+    'font:14px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif',
+].join(';');
+const CARD = [
+    'max-width:420px', 'width:100%', 'box-sizing:border-box',
+    'background:#fff', 'color:#11151c', 'border-radius:14px',
+    'padding:28px', 'box-shadow:0 18px 48px rgba(15,18,25,.28)',
+].join(';');
+const BUTTON = [
+    'appearance:none', 'border:0', 'border-radius:9px',
+    'padding:11px 18px', 'font:inherit', 'font-weight:600',
+    'cursor:pointer', 'background:#6b3df5', 'color:#fff',
+].join(';');
+const SECONDARY = [
+    'appearance:none', 'border:1px solid #d7dae2', 'border-radius:9px',
+    'padding:11px 18px', 'font:inherit', 'font-weight:600',
+    'cursor:pointer', 'background:#fff', 'color:#11151c',
+].join(';');
+/**
+ * Show the sign-in overlay and resolve once the reader is authenticated.
+ *
+ * Never rejects on a dismissed or failed ceremony: the reader is still sitting
+ * in front of the widget and can try the other button, so the overlay reports
+ * what went wrong and stays up. It settles only on success — or when
+ * `resume()`, retried on each attempt, turns out to have a session after all.
+ */
+export function requestSignIn(gate, copy = {}, 
+/**
+ * A second gate to try once, when the first one's ceremony is refused.
+ *
+ * WHAT THIS IS FOR: the framed ceremony needs the page's origin in
+ * wallet-api's embed allowlist, and a widget served off the shared content
+ * gateway is not going to be in it — allowlisting that origin would admit
+ * every bundle anyone has ever published, which is a much larger grant than a
+ * sharing feature should ask for. A popup is not framing, so it works
+ * unlisted. Retried rather than chosen up front because a widget cannot know
+ * whether its own origin is listed, and the listed case is worth having: it
+ * is the only one where a session resumes without a click.
+ */
+fallback) {
+    const text = { ...DEFAULT_COPY, ...copy };
+    return new Promise((resolve) => {
+        const existing = document.getElementById(OVERLAY_ID);
+        if (existing)
+            existing.remove();
+        const shell = el('div', SHELL);
+        shell.id = OVERLAY_ID;
+        const card = el('div', CARD);
+        card.appendChild(el('h2', 'margin:0 0 8px;font-size:18px;font-weight:700', text.title));
+        card.appendChild(el('p', 'margin:0 0 20px;color:#4a5160', text.body));
+        const row = el('div', 'display:flex;gap:10px;flex-wrap:wrap');
+        const primary = el('button', BUTTON, text.signIn);
+        const secondary = el('button', SECONDARY, text.register);
+        primary.type = 'button';
+        secondary.type = 'button';
+        row.appendChild(primary);
+        row.appendChild(secondary);
+        card.appendChild(row);
+        const error = el('p', 'margin:16px 0 0;color:#b00020;display:none');
+        card.appendChild(error);
+        shell.appendChild(card);
+        document.body.appendChild(shell);
+        let busy = false;
+        /**
+         * The gate every attempt uses, REPLACED for good the first time a framed
+         * ceremony is refused.
+         *
+         * Switching permanently rather than retrying per click is the difference
+         * between "the second button works" and "every click re-runs the refusal
+         * before falling back" — and on the unlisted origin the refusal is not a
+         * fluke, it is the standing answer.
+         */
+        let active = gate;
+        let switched = false;
+        const attempt = (pick) => () => {
+            if (busy)
+                return;
+            busy = true;
+            error.style.display = 'none';
+            primary.disabled = true;
+            secondary.disabled = true;
+            /*
+             * OUT OF THE WAY WHILE THE WALLET IS UP.
+             *
+             * This panel exists to collect one click; the moment it has one, the
+             * ceremony owns the screen. Leaving it mounted put it on top of the
+             * wallet's own panel — the reader saw a grey slab with a sign-in prompt
+             * across the middle and could not reach the passkey. It comes back only
+             * if the ceremony fails, which is the one case there is something to
+             * click again.
+             */
+            shell.style.display = 'none';
+            // STARTED INSIDE THE CLICK. Everything awaited happens after the wallet
+            // call has already been made, so the ceremony opens under the gesture —
+            // INCLUDING the retry, which is chained onto this same activation rather
+            // than started from a later tick.
+            pick(active)
+                .catch((err) => {
+                if (!fallback || switched)
+                    throw err;
+                switched = true;
+                active = fallback();
+                console.info('[widget-runtime] framed ceremony refused; retrying in a popup', err);
+                return pick(active);
+            })
+                .then((session) => {
+                shell.remove();
+                resolve(session);
+            })
+                .catch((err) => {
+                busy = false;
+                shell.style.display = 'flex';
+                primary.disabled = false;
+                secondary.disabled = false;
+                error.textContent = err instanceof Error ? err.message : String(err);
+                error.style.display = 'block';
+            });
+        };
+        primary.addEventListener('click', attempt((g) => g.signIn()));
+        secondary.addEventListener('click', attempt((g) => g.register()));
+    });
+}
+/**
+ * Sign the reader in WITHOUT ASKING FIRST.
+ *
+ * The overlay above collects a click so a popup can open under it. That made
+ * the shared-link experience two ceremonies deep: a card saying "Sign in to
+ * view this" with a button, and then the wallet's own panel with ITS button.
+ * The first of those is not the wallet's requirement — it is this file's,
+ * and only for the popup. So it is now the last resort, not the front door.
+ *
+ * In order, stopping at the first that works:
+ *
+ *   1. `resume()` — a session from an earlier visit. No ceremony at all.
+ *   2. The framed ceremony, started immediately. An iframe needs no gesture,
+ *      and the wallet's panel carries its own "Continue" — one click, the
+ *      wallet's, not two. This is what a listed origin gets.
+ *   3. The popup ceremony, also started immediately. A browser that has been
+ *      told to allow popups here opens it; one that has not refuses, and the
+ *      refusal comes back as a rejection rather than a hang.
+ *   4. The overlay, on the popup gate — the one case a gesture is genuinely
+ *      needed, because the browser demands one for `window.open`.
+ *
+ * A `resume()` that THROWS, as opposed to resolving null, is a surface that
+ * never came up (origin not in the embed allowlist, most likely). Step 2 is
+ * skipped then: it would only wait out the same handshake a second time.
+ */
+export async function autoSignIn(gate, fallback, copy = {}) {
+    let surfaceUp = true;
+    try {
+        const resumed = await gate.resume();
+        if (resumed)
+            return resumed;
+    }
+    catch (err) {
+        surfaceUp = false;
+        console.info('[widget-runtime] wallet surface did not come up; skipping the framed ceremony', err);
+    }
+    if (surfaceUp) {
+        try {
+            return await gate.signIn();
+        }
+        catch (err) {
+            console.info('[widget-runtime] framed ceremony refused; trying a popup', err);
+        }
+    }
+    const popup = fallback();
+    try {
+        return await popup.signIn();
+    }
+    catch (err) {
+        console.info('[widget-runtime] popup did not open on its own; asking for a click', err);
+    }
+    return requestSignIn(popup, copy);
+}

package/dist/standalone-wallet.d.ts

@@ -6,6 +6,17 @@ export interface StandaloneWallet {
     sigType: 'ed25519';
     /** Sign the given bytes; returns a 64-byte ed25519 signature. */
     signRawBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /**
+     * A bearer delegation for data-plane reads, when the wallet can mint one.
+     *
+     * OPTIONAL BECAUSE NOT EVERY WALLET HAS THE CONCEPT — the Cere embed-wallet
+     * in this file does not. Where it exists it is strictly better than
+     * `signRawBytes` for reads: a passkey session is keyless after every page
+     * load, so signing per request raises a step-up per request, while a
+     * delegation is minted once with no ceremony and authenticates the same
+     * calls. See ./cef-wallet.
+     */
+    delegation?: () => Promise<string>;
 }
 /**
  * Initialise + connect an interactive Cere embed-wallet and return a

package/dist/types.d.ts

@@ -53,9 +53,22 @@ export interface WidgetManifest {
     agentId: string;
     scope: string;
     cubbyAlias: string;
+    /**
+     * How a STANDALONE widget signs its reader in. Ignored when framed — there a
+     * host supplies the identity over the handshake and no wallet is built.
+     *
+     * `origin` is the CEF passkey wallet SPA (e.g.
+     * `https://wallet.compute.test.ddcdragon.com`), the same one ROC, Vault and
+     * the marketplace authenticate against, so a reader who can see the data in
+     * the console is the same principal here. `appId`/`env` are the older Cere
+     * embed-wallet coordinates, kept so a bundle published before `origin`
+     * existed still parses — such a bundle simply has no standalone sign-in, and
+     * says so rather than hanging. See ./cef-wallet.
+     */
     wallet: {
         appId: string;
         env: string;
+        origin?: string;
     };
     endpoints: {
         vault: string;

package/dist/vault-sdk-config.d.ts

@@ -23,4 +23,4 @@ import type { WidgetManifest } from './types.js';
  * mainnet), so the runtime inherits the deployment's chain instead of
  * hard-coding one.
  */
-export declare function toVaultSdkConfig(endpoints: WidgetManifest['endpoints'], signer: Signer, token?: string): VaultSDKConfig;
+export declare function toVaultSdkConfig(endpoints: WidgetManifest['endpoints'], signer: Signer, token?: string, renewToken?: () => Promise<string>): VaultSDKConfig;

package/dist/vault-sdk-config.js

@@ -23,7 +23,7 @@ import { DelegationAuthProvider } from '@cef-ai/vault-sdk';
  * mainnet), so the runtime inherits the deployment's chain instead of
  * hard-coding one.
  */
-export function toVaultSdkConfig(endpoints, signer, token) {
+export function toVaultSdkConfig(endpoints, signer, token, renewToken) {
     const base = {
         endpoint: endpoints.vault,
         garEndpoint: endpoints.gar,
@@ -31,7 +31,17 @@ export function toVaultSdkConfig(endpoints, signer, token) {
         s3GatewayAuthInfoUrl: endpoints.s3GatewayAuthInfo,
         chainUrl: endpoints.rpc,
     };
+    // A renewable token is asked for on every request, never captured: the
+    // captured string dies after an hour and every later request 401s.
+    if (renewToken)
+        return { ...base, auth: renewingDelegation(renewToken) };
     if (token)
         return { ...base, auth: new DelegationAuthProvider(token) };
     return { ...base, signer };
 }
+/** A delegation provider that takes the CURRENT token from `mint` on each request. */
+function renewingDelegation(mint) {
+    return {
+        authenticate: async (req) => new DelegationAuthProvider(await mint()).authenticate(req),
+    };
+}