@chaindaddy/js 0.0.0-stage → 0.1.0

package/dist/browser.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/button.d.ts

@@ -0,0 +1,2 @@
+/** Defines <cd-signin-button> once. cd.js calls it for you. */
+export declare function defineSignInButton(): void;

package/dist/cd.js

@@ -0,0 +1,10 @@
+"use strict";(()=>{var m="0.1.0";function f(e){let t="";for(let r of e)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function u(){return f(crypto.getRandomValues(new Uint8Array(32)))}function b(e,t,r,n){let i=s=>{if(s&&typeof s=="object"&&s.type===e)try{r(s)}catch{}},c=s=>{s.origin===t&&i(s.data)};window.addEventListener("message",c);let a=null;if(n&&typeof BroadcastChannel=="function"&&t===location.origin)try{a=new BroadcastChannel(n),a.onmessage=s=>i(s.data)}catch{a=null}return()=>{window.removeEventListener("message",c),a?.close()}}var d={get(e){try{return sessionStorage.getItem(e)}catch{return null}},set(e,t){try{sessionStorage.setItem(e,t)}catch{}},remove(e){try{sessionStorage.removeItem(e)}catch{}}};var x="https://api.chaindaddy.io",_={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},g="cd-signin",y="cd:signin",h="cd.signin";async function U(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return f(new Uint8Array(t))}function k(e="openid"){let t=e.split(/\s+/).filter(Boolean);return(t.includes("openid")?t:["openid",...t]).join(" ")}async function C(e,t,r){let n=new URLSearchParams({response_type:"code",client_id:t.clientId,redirect_uri:t.redirectUri,scope:k(e.scope),state:t.state,nonce:t.nonce,code_challenge:await U(t.verifier),code_challenge_method:"S256"});return e.claims&&n.set("claims",typeof e.claims=="string"?e.claims:JSON.stringify(e.claims)),`${r}?${n}`}function S(e,t){return{code:t,codeVerifier:e.verifier,state:e.state,nonce:e.nonce,issuer:e.issuer,clientId:e.clientId,redirectUri:e.redirectUri}}function p(e){let t=(e.issuer??x).replace(/\/$/,""),r=e.authorizeUrl??_[t];if(!r)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!e.clientId||!e.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let n={state:u(),nonce:u(),verifier:u(),issuer:t,clientId:e.clientId,redirectUri:e.redirectUri};d.set(h,JSON.stringify(n));let i=window.open("",g,"popup,width=480,height=720");return(async()=>{let c=await C(e,n,r);if(!i)return location.assign(c),null;i.location.href=c;let a=new URL(e.redirectUri,location.href).origin;return new Promise((s,l)=>{let w=b(y,a,o=>{o.state===n.state&&(w(),d.remove(h),typeof o.error=="string"&&o.error?l(new Error(o.error)):o.iss!==t?l(new Error("the answer came from another issuer")):typeof o.code!="string"||!o.code?l(new Error("the answer carried no code")):s(S(n,o.code)))},g);e.signal?.addEventListener("abort",()=>{w(),l(new Error("aborted"))})})})()}async function E(){let e=new URLSearchParams(location.search),t={type:y,code:e.get("code"),state:e.get("state"),iss:e.get("iss"),error:e.get("error")};if(window.name===g){try{window.opener?.postMessage(t,location.origin)}catch{}try{let i=new BroadcastChannel(g);i.postMessage(t),i.close()}catch{}return window.close(),null}let r=d.get(h);d.remove(h);let n=r?JSON.parse(r):null;if(!n||t.state!==n.state)throw new Error("the sign-in state does not match: start again");if(t.error)throw new Error(t.error);if(t.iss!==n.issuer)throw new Error("the answer came from another issuer");if(!t.code)throw new Error("the answer carried no code");return S(n,t.code)}async function v(e){let t=await fetch(`${e.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e.code,redirect_uri:e.redirectUri,client_id:e.clientId,code_verifier:e.codeVerifier})}),r=await t.json();if(!t.ok)throw new Error(`${r.error??t.status}: ${r.error_description??""}`.trim());return r}var R='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',P=`
+:host { display: inline-block; }
+button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
+  min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
+  cursor: pointer; border: 1px solid #d0d5dd; background: #ffffff; color: #101828; }
+button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #101828; }
+button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
+button:disabled { opacity: .6; cursor: default; }
+svg { flex: none; }
+`;function I(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class e extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let r=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",n=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${P}</style><button type="button" part="button" data-theme="${n}">${R}<span></span></button>`;let i=this.root.querySelector("button");i.querySelector("span").textContent=r,i.addEventListener("click",()=>this.start())}start(){let r=n=>this.getAttribute(n)||void 0;p({clientId:r("client-id")??"",redirectUri:r("redirect-uri")??"",scope:r("scope"),claims:r("claims"),issuer:r("issuer"),authorizeUrl:r("authorize-url")}).then(n=>n&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:n,bubbles:!0,composed:!0})),n=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(n?.message??n)},bubbles:!0,composed:!0})))}}e.observedAttributes=["theme","text"],customElements.define("cd-signin-button",e)}var O={version:m,signIn:p,handleCallback:E,exchangeCode:v};window.ChainDaddy=Object.assign(window.ChainDaddy??{},O);I();})();

package/dist/cd.js.sri

@@ -0,0 +1 @@
+sha384-bZAt1vfljBunvk1nBTTcEr8Ir5WYMSnmrhuWN0uMusRcqf/oMlvNzVN26tBxHL+I

package/dist/core.d.ts

@@ -0,0 +1,17 @@
+export declare const VERSION: string;
+/** base64url without padding. */
+export declare function b64url(bytes: Uint8Array): string;
+/** 32 random bytes, base64url: 43 characters. */
+export declare function randomToken(): string;
+/**
+ * Listens for messages of `type` from exactly `origin`, on window and on a
+ * same-origin BroadcastChannel (which still works when a COOP header has
+ * severed window.opener). Returns a function that stops listening.
+ */
+export declare function listen(type: string, origin: string, onMessage: (data: Record<string, unknown>) => void, channel?: string): () => void;
+/** sessionStorage that never throws (private windows, blocked storage). */
+export declare const store: {
+    get(key: string): string | null;
+    set(key: string, value: string): void;
+    remove(key: string): void;
+};

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { VERSION } from './core';
+export { DEFAULT_ISSUER, challengeFor, exchangeCode, handleCallback, signIn } from './signin';
+export type { SignInOptions, SignInResult } from './signin';
+export { defineSignInButton } from './button';

package/dist/index.js

@@ -0,0 +1,223 @@
+// src/core.ts
+var VERSION = true ? "0.1.0" : "0.0.0";
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return b64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function listen(type, origin, onMessage, channel) {
+  const accept = (data) => {
+    if (data && typeof data === "object" && data.type === type) {
+      try {
+        onMessage(data);
+      } catch {
+      }
+    }
+  };
+  const onWindow = (e) => {
+    if (e.origin === origin) accept(e.data);
+  };
+  window.addEventListener("message", onWindow);
+  let bc = null;
+  if (channel && typeof BroadcastChannel === "function" && origin === location.origin) {
+    try {
+      bc = new BroadcastChannel(channel);
+      bc.onmessage = (e) => accept(e.data);
+    } catch {
+      bc = null;
+    }
+  }
+  return () => {
+    window.removeEventListener("message", onWindow);
+    bc?.close();
+  };
+}
+var store = {
+  get(key) {
+    try {
+      return sessionStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    try {
+      sessionStorage.setItem(key, value);
+    } catch {
+    }
+  },
+  remove(key) {
+    try {
+      sessionStorage.removeItem(key);
+    } catch {
+    }
+  }
+};
+
+// src/signin.ts
+var DEFAULT_ISSUER = "https://api.chaindaddy.io";
+var AUTHORIZE = {
+  "https://api.chaindaddy.io": "https://chaindaddy.io/_oauth/authorize",
+  "https://staging-api.chaindaddy.io": "https://staging.chaindaddy.io/_oauth/authorize"
+};
+var POPUP_NAME = "cd-signin";
+var MESSAGE = "cd:signin";
+var STORAGE_KEY = "cd.signin";
+async function challengeFor(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return b64url(new Uint8Array(digest));
+}
+function withOpenID(scope = "openid") {
+  const parts = scope.split(/\s+/).filter(Boolean);
+  return (parts.includes("openid") ? parts : ["openid", ...parts]).join(" ");
+}
+async function authorizeURL(o, p, authorize) {
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: p.clientId,
+    redirect_uri: p.redirectUri,
+    scope: withOpenID(o.scope),
+    state: p.state,
+    nonce: p.nonce,
+    code_challenge: await challengeFor(p.verifier),
+    code_challenge_method: "S256"
+  });
+  if (o.claims) q.set("claims", typeof o.claims === "string" ? o.claims : JSON.stringify(o.claims));
+  return `${authorize}?${q}`;
+}
+function result(p, code) {
+  return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
+}
+function signIn(o) {
+  const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
+  const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
+  if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
+  if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
+  store.set(STORAGE_KEY, JSON.stringify(p));
+  const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
+  return (async () => {
+    const url = await authorizeURL(o, p, authorize);
+    if (!popup) {
+      location.assign(url);
+      return null;
+    }
+    popup.location.href = url;
+    const callbackOrigin = new URL(o.redirectUri, location.href).origin;
+    return new Promise((resolve, reject) => {
+      const stop = listen(MESSAGE, callbackOrigin, (m) => {
+        if (m.state !== p.state) return;
+        stop();
+        store.remove(STORAGE_KEY);
+        if (typeof m.error === "string" && m.error) reject(new Error(m.error));
+        else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
+        else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
+        else resolve(result(p, m.code));
+      }, POPUP_NAME);
+      o.signal?.addEventListener("abort", () => {
+        stop();
+        reject(new Error("aborted"));
+      });
+    });
+  })();
+}
+async function handleCallback() {
+  const q = new URLSearchParams(location.search);
+  const message = { type: MESSAGE, code: q.get("code"), state: q.get("state"), iss: q.get("iss"), error: q.get("error") };
+  if (window.name === POPUP_NAME) {
+    try {
+      window.opener?.postMessage(message, location.origin);
+    } catch {
+    }
+    try {
+      const bc = new BroadcastChannel(POPUP_NAME);
+      bc.postMessage(message);
+      bc.close();
+    } catch {
+    }
+    window.close();
+    return null;
+  }
+  const raw = store.get(STORAGE_KEY);
+  store.remove(STORAGE_KEY);
+  const p = raw ? JSON.parse(raw) : null;
+  if (!p || message.state !== p.state) throw new Error("the sign-in state does not match: start again");
+  if (message.error) throw new Error(message.error);
+  if (message.iss !== p.issuer) throw new Error("the answer came from another issuer");
+  if (!message.code) throw new Error("the answer carried no code");
+  return result(p, message.code);
+}
+async function exchangeCode(r) {
+  const res = await fetch(`${r.issuer}/api/v2/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ grant_type: "authorization_code", code: r.code, redirect_uri: r.redirectUri, client_id: r.clientId, code_verifier: r.codeVerifier })
+  });
+  const body = await res.json();
+  if (!res.ok) throw new Error(`${body.error ?? res.status}: ${body.error_description ?? ""}`.trim());
+  return body;
+}
+
+// src/button.ts
+var CROWN = `<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>`;
+var STYLE = `
+:host { display: inline-block; }
+button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
+  min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
+  cursor: pointer; border: 1px solid #d0d5dd; background: #ffffff; color: #101828; }
+button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #101828; }
+button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
+button:disabled { opacity: .6; cursor: default; }
+svg { flex: none; }
+`;
+function defineSignInButton() {
+  if (typeof customElements === "undefined" || customElements.get("cd-signin-button")) return;
+  class CdSigninButton extends HTMLElement {
+    constructor() {
+      super();
+      this.root = this.attachShadow({ mode: "open" });
+    }
+    connectedCallback() {
+      this.render();
+    }
+    attributeChangedCallback() {
+      if (this.isConnected) this.render();
+    }
+    render() {
+      const label = this.getAttribute("text") === "continue" ? "Continue with Chain Daddy" : "Sign in with Chain Daddy";
+      const theme = this.getAttribute("theme") === "dark" ? "dark" : "light";
+      this.root.innerHTML = `<style>${STYLE}</style><button type="button" part="button" data-theme="${theme}">${CROWN}<span></span></button>`;
+      const button = this.root.querySelector("button");
+      button.querySelector("span").textContent = label;
+      button.addEventListener("click", () => this.start());
+    }
+    start() {
+      const attr = (n) => this.getAttribute(n) || void 0;
+      signIn({
+        clientId: attr("client-id") ?? "",
+        redirectUri: attr("redirect-uri") ?? "",
+        scope: attr("scope"),
+        claims: attr("claims"),
+        issuer: attr("issuer"),
+        authorizeUrl: attr("authorize-url")
+      }).then(
+        (r) => r && this.dispatchEvent(new CustomEvent("cd-signin", { detail: r, bubbles: true, composed: true })),
+        (e) => this.dispatchEvent(new CustomEvent("cd-signin-error", { detail: { message: String(e?.message ?? e) }, bubbles: true, composed: true }))
+      );
+    }
+  }
+  CdSigninButton.observedAttributes = ["theme", "text"];
+  customElements.define("cd-signin-button", CdSigninButton);
+}
+export {
+  DEFAULT_ISSUER,
+  VERSION,
+  challengeFor,
+  defineSignInButton,
+  exchangeCode,
+  handleCallback,
+  signIn
+};

package/dist/signin.d.ts

@@ -0,0 +1,57 @@
+export declare const DEFAULT_ISSUER = "https://api.chaindaddy.io";
+export interface SignInOptions {
+    /** Your client id: the URL of your client.json, or a registered cdc_ id. */
+    clientId: string;
+    /** Your callback page, exactly as your client lists it. It must be on this page's origin. */
+    redirectUri: string;
+    /** Space-separated scopes; openid is added when missing. Default "openid". */
+    scope?: string;
+    /** The OIDC `claims` request (holdings of your coin, crowns): an object or its JSON. */
+    claims?: object | string;
+    /** Default https://api.chaindaddy.io. */
+    issuer?: string;
+    /** The consent page; derived from the issuer for Chain Daddy's own. */
+    authorizeUrl?: string;
+    /** Stops waiting. Closing the popup does not: a closed-looking popup is not a cancel. */
+    signal?: AbortSignal;
+}
+/** What your server exchanges at the token endpoint (or exchangeCode does here). */
+export interface SignInResult {
+    code: string;
+    codeVerifier: string;
+    state: string;
+    nonce: string;
+    issuer: string;
+    clientId: string;
+    redirectUri: string;
+}
+/** RFC 7636 S256: base64url(SHA-256(verifier)). */
+export declare function challengeFor(verifier: string): Promise<string>;
+/**
+ * Starts a sign-in. Call it from a click handler: the popup opens at once,
+ * before anything is awaited, or a browser blocks it. Resolves with the code
+ * once the visitor approves; resolves null when the popup was blocked and the
+ * page is redirecting instead (your callback page then calls handleCallback).
+ * Rejects when they cancel (access_denied) or the answer is not for this
+ * request.
+ */
+export declare function signIn(o: SignInOptions): Promise<SignInResult | null>;
+/**
+ * Runs on your callback page. In the sign-in popup it hands the answer to the
+ * page that opened it (by postMessage to this origin, and by a same-origin
+ * BroadcastChannel in case the opener link was cut), closes, and resolves
+ * null. After a full-page redirect it checks the answer against the request
+ * this tab stored and resolves with the code, or rejects.
+ */
+export declare function handleCallback(): Promise<SignInResult | null>;
+/**
+ * Redeems the code at the token endpoint from the browser (a public client:
+ * no secret). Send the id_token to your server and verify it there; do not
+ * trust it here.
+ */
+export declare function exchangeCode(r: SignInResult): Promise<{
+    id_token: string;
+    access_token: string;
+    expires_in: number;
+    scope: string;
+}>;

package/dist/signin.js

@@ -0,0 +1,168 @@
+// src/core.ts
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return b64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function listen(type, origin, onMessage, channel) {
+  const accept = (data) => {
+    if (data && typeof data === "object" && data.type === type) {
+      try {
+        onMessage(data);
+      } catch {
+      }
+    }
+  };
+  const onWindow = (e) => {
+    if (e.origin === origin) accept(e.data);
+  };
+  window.addEventListener("message", onWindow);
+  let bc = null;
+  if (channel && typeof BroadcastChannel === "function" && origin === location.origin) {
+    try {
+      bc = new BroadcastChannel(channel);
+      bc.onmessage = (e) => accept(e.data);
+    } catch {
+      bc = null;
+    }
+  }
+  return () => {
+    window.removeEventListener("message", onWindow);
+    bc?.close();
+  };
+}
+var store = {
+  get(key) {
+    try {
+      return sessionStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    try {
+      sessionStorage.setItem(key, value);
+    } catch {
+    }
+  },
+  remove(key) {
+    try {
+      sessionStorage.removeItem(key);
+    } catch {
+    }
+  }
+};
+
+// src/signin.ts
+var DEFAULT_ISSUER = "https://api.chaindaddy.io";
+var AUTHORIZE = {
+  "https://api.chaindaddy.io": "https://chaindaddy.io/_oauth/authorize",
+  "https://staging-api.chaindaddy.io": "https://staging.chaindaddy.io/_oauth/authorize"
+};
+var POPUP_NAME = "cd-signin";
+var MESSAGE = "cd:signin";
+var STORAGE_KEY = "cd.signin";
+async function challengeFor(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return b64url(new Uint8Array(digest));
+}
+function withOpenID(scope = "openid") {
+  const parts = scope.split(/\s+/).filter(Boolean);
+  return (parts.includes("openid") ? parts : ["openid", ...parts]).join(" ");
+}
+async function authorizeURL(o, p, authorize) {
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: p.clientId,
+    redirect_uri: p.redirectUri,
+    scope: withOpenID(o.scope),
+    state: p.state,
+    nonce: p.nonce,
+    code_challenge: await challengeFor(p.verifier),
+    code_challenge_method: "S256"
+  });
+  if (o.claims) q.set("claims", typeof o.claims === "string" ? o.claims : JSON.stringify(o.claims));
+  return `${authorize}?${q}`;
+}
+function result(p, code) {
+  return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
+}
+function signIn(o) {
+  const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
+  const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
+  if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
+  if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
+  store.set(STORAGE_KEY, JSON.stringify(p));
+  const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
+  return (async () => {
+    const url = await authorizeURL(o, p, authorize);
+    if (!popup) {
+      location.assign(url);
+      return null;
+    }
+    popup.location.href = url;
+    const callbackOrigin = new URL(o.redirectUri, location.href).origin;
+    return new Promise((resolve, reject) => {
+      const stop = listen(MESSAGE, callbackOrigin, (m) => {
+        if (m.state !== p.state) return;
+        stop();
+        store.remove(STORAGE_KEY);
+        if (typeof m.error === "string" && m.error) reject(new Error(m.error));
+        else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
+        else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
+        else resolve(result(p, m.code));
+      }, POPUP_NAME);
+      o.signal?.addEventListener("abort", () => {
+        stop();
+        reject(new Error("aborted"));
+      });
+    });
+  })();
+}
+async function handleCallback() {
+  const q = new URLSearchParams(location.search);
+  const message = { type: MESSAGE, code: q.get("code"), state: q.get("state"), iss: q.get("iss"), error: q.get("error") };
+  if (window.name === POPUP_NAME) {
+    try {
+      window.opener?.postMessage(message, location.origin);
+    } catch {
+    }
+    try {
+      const bc = new BroadcastChannel(POPUP_NAME);
+      bc.postMessage(message);
+      bc.close();
+    } catch {
+    }
+    window.close();
+    return null;
+  }
+  const raw = store.get(STORAGE_KEY);
+  store.remove(STORAGE_KEY);
+  const p = raw ? JSON.parse(raw) : null;
+  if (!p || message.state !== p.state) throw new Error("the sign-in state does not match: start again");
+  if (message.error) throw new Error(message.error);
+  if (message.iss !== p.issuer) throw new Error("the answer came from another issuer");
+  if (!message.code) throw new Error("the answer carried no code");
+  return result(p, message.code);
+}
+async function exchangeCode(r) {
+  const res = await fetch(`${r.issuer}/api/v2/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ grant_type: "authorization_code", code: r.code, redirect_uri: r.redirectUri, client_id: r.clientId, code_verifier: r.codeVerifier })
+  });
+  const body = await res.json();
+  if (!res.ok) throw new Error(`${body.error ?? res.status}: ${body.error_description ?? ""}`.trim());
+  return body;
+}
+export {
+  DEFAULT_ISSUER,
+  challengeFor,
+  exchangeCode,
+  handleCallback,
+  signIn
+};

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@chaindaddy/js",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), with embeds and checkout to follow",
+  "homepage": "https://docs.chaindaddy.io/developer/javascript-sdk",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/opencrown/chaindaddy-js.git",
+    "directory": "js"
+  },
+  "type": "module",
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./signin": {
+      "types": "./dist/signin.d.ts",
+      "default": "./dist/signin.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "chaindaddy",
+    "oidc",
+    "sign-in",
+    "crypto",
+    "wallet"
+  ],
+  "license": "MIT",
+  "devDependencies": {
+    "esbuild": "^0.25.0",
+    "jsdom": "^26.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.2.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.