@chaindaddy/js 0.1.0 → 0.3.0

package/dist/cd.js

@@ -1,4 +1,4 @@
-"use strict";(()=>{var m="0.1.0";function f(e){let t="";for(let r of e)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function u(){return f(crypto.getRandomValues(new Uint8Array(32)))}function b(e,t,r,n){let i=s=>{if(s&&typeof s=="object"&&s.type===e)try{r(s)}catch{}},c=s=>{s.origin===t&&i(s.data)};window.addEventListener("message",c);let a=null;if(n&&typeof BroadcastChannel=="function"&&t===location.origin)try{a=new BroadcastChannel(n),a.onmessage=s=>i(s.data)}catch{a=null}return()=>{window.removeEventListener("message",c),a?.close()}}var d={get(e){try{return sessionStorage.getItem(e)}catch{return null}},set(e,t){try{sessionStorage.setItem(e,t)}catch{}},remove(e){try{sessionStorage.removeItem(e)}catch{}}};var x="https://api.chaindaddy.io",_={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},g="cd-signin",y="cd:signin",h="cd.signin";async function U(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return f(new Uint8Array(t))}function k(e="openid"){let t=e.split(/\s+/).filter(Boolean);return(t.includes("openid")?t:["openid",...t]).join(" ")}async function C(e,t,r){let n=new URLSearchParams({response_type:"code",client_id:t.clientId,redirect_uri:t.redirectUri,scope:k(e.scope),state:t.state,nonce:t.nonce,code_challenge:await U(t.verifier),code_challenge_method:"S256"});return e.claims&&n.set("claims",typeof e.claims=="string"?e.claims:JSON.stringify(e.claims)),`${r}?${n}`}function S(e,t){return{code:t,codeVerifier:e.verifier,state:e.state,nonce:e.nonce,issuer:e.issuer,clientId:e.clientId,redirectUri:e.redirectUri}}function p(e){let t=(e.issuer??x).replace(/\/$/,""),r=e.authorizeUrl??_[t];if(!r)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!e.clientId||!e.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let n={state:u(),nonce:u(),verifier:u(),issuer:t,clientId:e.clientId,redirectUri:e.redirectUri};d.set(h,JSON.stringify(n));let i=window.open("",g,"popup,width=480,height=720");return(async()=>{let c=await C(e,n,r);if(!i)return location.assign(c),null;i.location.href=c;let a=new URL(e.redirectUri,location.href).origin;return new Promise((s,l)=>{let w=b(y,a,o=>{o.state===n.state&&(w(),d.remove(h),typeof o.error=="string"&&o.error?l(new Error(o.error)):o.iss!==t?l(new Error("the answer came from another issuer")):typeof o.code!="string"||!o.code?l(new Error("the answer carried no code")):s(S(n,o.code)))},g);e.signal?.addEventListener("abort",()=>{w(),l(new Error("aborted"))})})})()}async function E(){let e=new URLSearchParams(location.search),t={type:y,code:e.get("code"),state:e.get("state"),iss:e.get("iss"),error:e.get("error")};if(window.name===g){try{window.opener?.postMessage(t,location.origin)}catch{}try{let i=new BroadcastChannel(g);i.postMessage(t),i.close()}catch{}return window.close(),null}let r=d.get(h);d.remove(h);let n=r?JSON.parse(r):null;if(!n||t.state!==n.state)throw new Error("the sign-in state does not match: start again");if(t.error)throw new Error(t.error);if(t.iss!==n.issuer)throw new Error("the answer came from another issuer");if(!t.code)throw new Error("the answer carried no code");return S(n,t.code)}async function v(e){let t=await fetch(`${e.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e.code,redirect_uri:e.redirectUri,client_id:e.clientId,code_verifier:e.codeVerifier})}),r=await t.json();if(!t.ok)throw new Error(`${r.error??t.status}: ${r.error_description??""}`.trim());return r}var R='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',P=`
+"use strict";(()=>{var S="0.3.0";function v(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function f(){return v(crypto.getRandomValues(new Uint8Array(32)))}function R(t,e,n,s){let a=o=>{if(o&&typeof o=="object"&&o.type===t)try{n(o)}catch{}},d=o=>{o.origin===e&&a(o.data)};window.addEventListener("message",d);let u=null;if(s&&typeof BroadcastChannel=="function"&&e===location.origin)try{u=new BroadcastChannel(s),u.onmessage=o=>a(o.data)}catch{u=null}return()=>{window.removeEventListener("message",d),u?.close()}}var m={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var q="https://api.chaindaddy.io",V={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},w="cd-signin",T="cd:signin",y="cd.signin";async function F(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return v(new Uint8Array(e))}function G(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function K(t,e,n){let s=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:G(t.scope),state:e.state,nonce:e.nonce,code_challenge:await F(e.verifier),code_challenge_method:"S256"});return t.claims&&s.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${n}?${s}`}function _(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}function b(t){let e=(t.issuer??q).replace(/\/$/,""),n=t.authorizeUrl??V[e];if(!n)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let s={state:f(),nonce:f(),verifier:f(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};m.set(y,JSON.stringify(s));let a=window.open("",w,"popup,width=480,height=720");return(async()=>{let d=await K(t,s,n);if(!a)return location.assign(d),null;a.location.href=d;let u=new URL(t.redirectUri,location.href).origin;return new Promise((o,i)=>{let c=R(T,u,r=>{r.state===s.state&&(c(),m.remove(y),typeof r.error=="string"&&r.error?i(new Error(r.error)):r.iss!==e?i(new Error("the answer came from another issuer")):typeof r.code!="string"||!r.code?i(new Error("the answer carried no code")):o(_(s,r.code)))},w);t.signal?.addEventListener("abort",()=>{c(),i(new Error("aborted"))})})})()}async function U(){let t=new URLSearchParams(location.search),e={type:T,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===w){try{window.opener?.postMessage(e,location.origin)}catch{}try{let a=new BroadcastChannel(w);a.postMessage(e),a.close()}catch{}return window.close(),null}let n=m.get(y);m.remove(y);let s=n?JSON.parse(n):null;if(!s||e.state!==s.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==s.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return _(s,e.code)}async function A(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),n=await e.json();if(!e.ok)throw new Error(`${n.error??e.status}: ${n.error_description??""}`.trim());return n}var W='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',Y=`
 :host { display: inline-block; }
 button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
   min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
@@ -7,4 +7,16 @@ button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #
 button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
 button:disabled { opacity: .6; cursor: default; }
 svg { flex: none; }
-`;function I(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class e extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let r=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",n=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${P}</style><button type="button" part="button" data-theme="${n}">${R}<span></span></button>`;let i=this.root.querySelector("button");i.querySelector("span").textContent=r,i.addEventListener("click",()=>this.start())}start(){let r=n=>this.getAttribute(n)||void 0;p({clientId:r("client-id")??"",redirectUri:r("redirect-uri")??"",scope:r("scope"),claims:r("claims"),issuer:r("issuer"),authorizeUrl:r("authorize-url")}).then(n=>n&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:n,bubbles:!0,composed:!0})),n=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(n?.message??n)},bubbles:!0,composed:!0})))}}e.observedAttributes=["theme","text"],customElements.define("cd-signin-button",e)}var O={version:m,signIn:p,handleCallback:E,exchangeCode:v};window.ChainDaddy=Object.assign(window.ChainDaddy??{},O);I();})();
+`;function L(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let n=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",s=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${Y}</style><button type="button" part="button" data-theme="${s}">${W}<span></span></button>`;let a=this.root.querySelector("button");a.querySelector("span").textContent=n,a.addEventListener("click",()=>this.start())}start(){let n=s=>this.getAttribute(s)||void 0;b({clientId:n("client-id")??"",redirectUri:n("redirect-uri")??"",scope:n("scope"),claims:n("claims"),issuer:n("issuer"),authorizeUrl:n("authorize-url")}).then(s=>s&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:s,bubbles:!0,composed:!0})),s=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(s?.message??s)},bubbles:!0,composed:!0})))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var M="https://embed.chaindaddy.io",k="https://embed-staging.chaindaddy.io";var J=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function P(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return k}catch{}return M}var X=`
+:host { display: block; }
+iframe { display: block; width: 100%; border: 0; height: 1px; opacity: 0; color-scheme: normal; }
+:host([data-cd-ready]) iframe { opacity: 1; }
+:host([data-cd-ready]) slot { display: none; }
+:host([data-cd-unavailable]) iframe { display: none; }
+`,Q=`
+:host { display: inline-block; }
+button { box-sizing: border-box; min-height: 40px; padding: 0 16px; border-radius: 10px; cursor: pointer;
+  font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
+  border: 1px solid var(--cd-border, #d0d5dd); background: var(--cd-accent, #f59e0b); color: var(--cd-text, #101828); }
+button:focus-visible { outline: 2px solid var(--cd-accent, #f59e0b); outline-offset: 2px; }
+`;function O(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===k?k:M;class n extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=i=>this.receive(i)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer)}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let i=(this.getAttribute("crown")??"").trim(),c=(this.getAttribute("chain")??"").trim(),r=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(i)||!c||this.kind==="app"&&!r)return null;let l=new URLSearchParams({crown:i,chain:c});return this.kind==="app"?l.set("app",r):l.set("kind","coin"),l.set("mode",this.mode()),l.set("v","1"),`${e}/v1/frame?${l.toString()}`}mode(){let i=this.getAttribute("mode");if(i==="light"||i==="dark")return i;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let i=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let c=this.src();if(!c){i.innerHTML="<slot></slot>",this.frame=null;return}i.innerHTML=`<style>${X}</style><slot></slot>`;let r=document.createElement("iframe");r.setAttribute("loading","lazy"),r.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),r.setAttribute("allow","clipboard-write; fullscreen"),r.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),r.src=c,i.appendChild(r),this.frame=r,window.addEventListener("message",this.onMessage),this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)}receive(i){try{if(i.origin!==e||!this.frame||!i.source||i.source!==this.frame.contentWindow)return;let c=i.data;if(!c||typeof c!="object")return;if(c.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(c.type==="cd:resize"){let r=Number(c.height);Number.isFinite(r)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(r)))}px`)}else c.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let i={},c=getComputedStyle(this);for(let r of J){let l=c.getPropertyValue(r).trim();l&&(i[r]=l)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:i},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable"))}catch{}}}n.observedAttributes=["crown","chain","app","mode"];class s extends n{}class a extends n{constructor(){super(...arguments);this.kind="coin"}}class d extends HTMLElement{connectedCallback(){try{let o=this.querySelector("a[href]"),i=o?new URL(o.getAttribute("href")??"",document.baseURI):null;if(!i||i.protocol!=="https:")return;let c=this.shadowRoot??this.attachShadow({mode:"open"});c.innerHTML=`<style>${Q}</style><button type="button" part="button"></button>`;let r=c.querySelector("button");r.textContent=(o.textContent??"").trim()||"Buy on Chain Daddy",r.addEventListener("click",()=>{try{window.open(i.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(i.toString())}catch{}})}catch{}}}for(let[u,o]of[["cd-app",s],["cd-coin",a],["cd-buy",d]])customElements.get(u)||customElements.define(u,o)}catch{}}var Z=["https://chaindaddy.io","https://staging.chaindaddy.io"],D=()=>"cd-checkout-"+f(),H="popup,width=480,height=820",$=300,tt=7;function E(t){if(typeof t!="string")return null;let e;try{e=new URL(t)}catch{return null}let n=/^\/_pay\/([\w-]+)$/.exec(e.pathname);return n&&Z.includes(e.origin)&&!e.username&&!e.password?{href:e.origin+e.pathname,origin:e.origin,id:n[1]}:null}function C(t,e){if(typeof t!="string")return null;let n;try{n=new URL(t,location.href)}catch{return null}if(!/^https?:$/.test(n.protocol)||n.username||n.password)return null;let s=d=>{let u=d.split("=")[0];try{return decodeURIComponent(u.replace(/\+/g," "))}catch{return u}},a=n.search.slice(1).split("&").filter(d=>d&&s(d)!=="session_id");return a.push("session_id="+encodeURIComponent(e)),n.origin+n.pathname+"?"+a.join("&")+n.hash}var p;function N(t,e,n){return new Promise(s=>{let a=!1,d=0,u,o=l=>{clearInterval(r),clearTimeout(u),window.removeEventListener("message",i),n&&l.status==="completed"&&location.assign(n),s(l)},i=l=>{if(l.origin!==e.origin||l.source!==t)return;let g=l.data;if(!g||typeof g!="object")return;g.type==="cd:checkout.ready"&&(a=!0);let h=g.session;if(!(!h||typeof h!="object"||h.id!==e.id)){if(g.type==="cd:checkout.cancelled")o({status:"cancelled",session:{id:e.id}});else if(g.type==="cd:checkout.completed"&&(h.status==="complete"||h.status==="paid")){let I={id:e.id,status:h.status};typeof h.orderId=="string"&&/^[\w-]{1,128}$/.test(h.orderId)&&(I.orderId=h.orderId),o({status:"completed",session:I})}}},c=()=>{try{t.postMessage({type:"cd:checkout.hello"},e.origin)}catch{}},r=setInterval(()=>{t.closed?(clearInterval(r),u=setTimeout(()=>o({status:"closed"}),$)):(!a||++d%tt===0)&&c()},$);window.addEventListener("message",i),c()})}function x(t){let e=()=>new Error("checkout: url is not a Chain Daddy checkout session link"),n=(a,d,u)=>{p={popup:a,result:d,href:u};let o=()=>{p&&p.popup===a&&(p=void 0)};return d.then(o,o),d},s=a=>(location.assign(a.href),{status:"redirected"});try{let{url:a,successUrl:d}=t;if(d&&!C(d,""))throw new Error("checkout: successUrl is not a web address");let u=r=>d?C(d,r.id):null,o=typeof a=="function"?null:E(a);if(typeof a!="function"&&!o)throw e();if(p&&!p.popup.closed&&(!o||p.href===o.href))return p.popup.focus(),p.result;if(o){let r=window.open(o.href,D(),H);return r?n(r,N(r,o,u(o)),o.href):Promise.resolve(s(o))}let i=window.open("",D(),H),c=new Promise(r=>r(a())).then(r=>{let l=E(r);if(!l)throw i?.close(),e();return i?(i.location.href=l.href,N(i,l,u(l))):s(l)},r=>{throw i?.close(),r});return i?n(i,c):c}catch(a){return Promise.reject(a)}}var B=!1,z;function j(){B||typeof document>"u"||(B=!0,document.addEventListener("click",t=>{let e=t.target instanceof Element?t.target.closest("[data-cd-checkout]"):null;if(!e||t.defaultPrevented||t.button||t.metaKey||t.ctrlKey||t.shiftKey||t.altKey)return;let n=e.getAttribute("data-cd-checkout")||e.href,s=e.getAttribute("data-cd-success");if(!E(n)||s&&!C(s,""))return;t.preventDefault();let a=x({url:n,successUrl:s});a!==z&&(z=a,a.then(d=>void e.dispatchEvent(new CustomEvent("cd:checkout",{detail:d,bubbles:!0})),()=>{}))}))}var et={version:S,signIn:b,handleCallback:U,exchangeCode:A,checkout:x};window.ChainDaddy=Object.assign(window.ChainDaddy??{},et);L();O({origin:P(document.currentScript?.src)});j();})();

package/dist/cd.js.sri

@@ -1 +1 @@
-sha384-bZAt1vfljBunvk1nBTTcEr8Ir5WYMSnmrhuWN0uMusRcqf/oMlvNzVN26tBxHL+I
+sha384-oAzz7JY6TsxFo7MvOAoI5wWjgXMDQsM27deR2Rr9F1DCHjZMz+Tb0oN9LT46GSnm

package/dist/checkout.d.ts

@@ -0,0 +1,73 @@
+export interface CheckoutOptions {
+    /**
+     * The session's `url`, or a function that fetches it. With a function the
+     * popup opens blank at once (inside the click) and goes to the link when it
+     * arrives.
+     */
+    url: string | (() => string | Promise<string>);
+    /**
+     * Where your page goes once the buyer has paid, with `session_id` added, as
+     * the checkout's own return does. Left out, the call only resolves. The
+     * checkout never tells this page where to go.
+     */
+    successUrl?: string | null;
+}
+export type CheckoutResult = 
+/** The buyer paid. `session.status` is "complete" (confirmed) or "paid" (sent, still confirming). */
+{
+    status: 'completed';
+    session: {
+        id: string;
+        status: 'complete' | 'paid';
+        orderId?: string;
+    };
+}
+/** The buyer left the checkout without paying. */
+ | {
+    status: 'cancelled';
+    session: {
+        id: string;
+    };
+}
+/** The popup closed and said nothing: read the session on your server to know. */
+ | {
+    status: 'closed';
+}
+/** The popup was blocked, so this page is going to the session by link. */
+ | {
+    status: 'redirected';
+};
+/** A session page: its address as parsed, its origin, and the session's id. */
+export interface CheckoutTarget {
+    href: string;
+    origin: string;
+    id: string;
+}
+/**
+ * The session page `url` names, or null when it is anything else. Exact
+ * origin (so https, our host, no port), no credentials, and the path
+ * /_pay/<id> and nothing under it, all read from the parsed URL: never a
+ * prefix test on the string, which "https://chaindaddy.io@evil.example/_pay/x"
+ * passes. `href` is the page and nothing more: a query or fragment on the
+ * link is dropped, so nothing rides into our site on a checkout link.
+ */
+export declare function parseCheckoutUrl(url: unknown): CheckoutTarget | null;
+/**
+ * Opens a checkout session in a popup. Call it from a click handler: the popup
+ * opens at once, or a browser blocks it. Resolves with how it ended; rejects,
+ * before any window opens or moves, when `url` is not a checkout session link.
+ * When the popup is blocked, the page goes to the session by link instead.
+ */
+export declare function checkout(o: CheckoutOptions): Promise<CheckoutResult>;
+/**
+ * Makes every element with `data-cd-checkout` open its session in the popup:
+ * a link by its `href`, anything else by the attribute's value. One listener
+ * on the document, so elements added later work too. On a link this only adds
+ * to what the link already does: without this script, with a modifier key, or
+ * when the address is not a session link, the link is followed as usual.
+ *
+ * When the visit ends the element fires `cd:checkout` (bubbling) with the
+ * result as `detail`; once the buyer has paid, the page goes to the element's
+ * `data-cd-success`, if it has one.
+ */
+export declare function bindCheckoutButtons(): void;

package/dist/checkout.js

@@ -0,0 +1,168 @@
+// src/core.ts
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return b64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+
+// src/checkout.ts
+var ORIGINS = ["https://chaindaddy.io", "https://staging.chaindaddy.io"];
+var windowName = () => "cd-checkout-" + randomToken();
+var FEATURES = "popup,width=480,height=820";
+var TICK_MS = 300;
+var QUIET_TICKS = 7;
+function parseCheckoutUrl(url) {
+  if (typeof url !== "string") return null;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return null;
+  }
+  const m = /^\/_pay\/([\w-]+)$/.exec(u.pathname);
+  return m && ORIGINS.includes(u.origin) && !u.username && !u.password ? { href: u.origin + u.pathname, origin: u.origin, id: m[1] } : null;
+}
+function successTarget(successUrl, id) {
+  if (typeof successUrl !== "string") return null;
+  let u;
+  try {
+    u = new URL(successUrl, location.href);
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol) || u.username || u.password) return null;
+  const key = (pair) => {
+    const raw = pair.split("=")[0];
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, " "));
+    } catch {
+      return raw;
+    }
+  };
+  const pairs = u.search.slice(1).split("&").filter((pair) => pair && key(pair) !== "session_id");
+  pairs.push("session_id=" + encodeURIComponent(id));
+  return u.origin + u.pathname + "?" + pairs.join("&") + u.hash;
+}
+var current;
+function wait(popup, target, success) {
+  return new Promise((resolve) => {
+    let ready = false;
+    let quiet = 0;
+    let last;
+    const done = (result) => {
+      clearInterval(timer);
+      clearTimeout(last);
+      window.removeEventListener("message", onMessage);
+      if (success && result.status === "completed") location.assign(success);
+      resolve(result);
+    };
+    const onMessage = (e) => {
+      if (e.origin !== target.origin || e.source !== popup) return;
+      const data = e.data;
+      if (!data || typeof data !== "object") return;
+      if (data.type === "cd:checkout.ready") ready = true;
+      const s = data.session;
+      if (!s || typeof s !== "object" || s.id !== target.id) return;
+      if (data.type === "cd:checkout.cancelled") done({ status: "cancelled", session: { id: target.id } });
+      else if (data.type === "cd:checkout.completed" && (s.status === "complete" || s.status === "paid")) {
+        const session = { id: target.id, status: s.status };
+        if (typeof s.orderId === "string" && /^[\w-]{1,128}$/.test(s.orderId)) session.orderId = s.orderId;
+        done({ status: "completed", session });
+      }
+    };
+    const hello = () => {
+      try {
+        popup.postMessage({ type: "cd:checkout.hello" }, target.origin);
+      } catch {
+      }
+    };
+    const timer = setInterval(() => {
+      if (popup.closed) {
+        clearInterval(timer);
+        last = setTimeout(() => done({ status: "closed" }), TICK_MS);
+      } else if (!ready || ++quiet % QUIET_TICKS === 0) hello();
+    }, TICK_MS);
+    window.addEventListener("message", onMessage);
+    hello();
+  });
+}
+function checkout(o) {
+  const refused = () => new Error("checkout: url is not a Chain Daddy checkout session link");
+  const track = (popup, result, href) => {
+    current = { popup, result, href };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    result.then(over, over);
+    return result;
+  };
+  const byLink = (target) => {
+    location.assign(target.href);
+    return { status: "redirected" };
+  };
+  try {
+    const { url, successUrl } = o;
+    if (successUrl && !successTarget(successUrl, "")) throw new Error("checkout: successUrl is not a web address");
+    const success = (t) => successUrl ? successTarget(successUrl, t.id) : null;
+    const target = typeof url === "function" ? null : parseCheckoutUrl(url);
+    if (typeof url !== "function" && !target) throw refused();
+    if (current && !current.popup.closed && (!target || current.href === target.href)) {
+      current.popup.focus();
+      return current.result;
+    }
+    if (target) {
+      const popup2 = window.open(target.href, windowName(), FEATURES);
+      return popup2 ? track(popup2, wait(popup2, target, success(target)), target.href) : Promise.resolve(byLink(target));
+    }
+    const popup = window.open("", windowName(), FEATURES);
+    const result = new Promise((resolve) => resolve(url())).then(
+      (fetched) => {
+        const t = parseCheckoutUrl(fetched);
+        if (!t) {
+          popup?.close();
+          throw refused();
+        }
+        if (!popup) return byLink(t);
+        popup.location.href = t.href;
+        return wait(popup, t, success(t));
+      },
+      (e) => {
+        popup?.close();
+        throw e;
+      }
+    );
+    return popup ? track(popup, result) : result;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
+var bound = false;
+var reporting;
+function bindCheckoutButtons() {
+  if (bound || typeof document === "undefined") return;
+  bound = true;
+  document.addEventListener("click", (e) => {
+    const el = e.target instanceof Element ? e.target.closest("[data-cd-checkout]") : null;
+    if (!el || e.defaultPrevented || e.button || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    const url = el.getAttribute("data-cd-checkout") || el.href;
+    const successUrl = el.getAttribute("data-cd-success");
+    if (!parseCheckoutUrl(url) || successUrl && !successTarget(successUrl, "")) return;
+    e.preventDefault();
+    const visit = checkout({ url, successUrl });
+    if (visit === reporting) return;
+    reporting = visit;
+    visit.then(
+      (detail) => void el.dispatchEvent(new CustomEvent("cd:checkout", { detail, bubbles: true })),
+      () => {
+      }
+    );
+  });
+}
+export {
+  bindCheckoutButtons,
+  checkout,
+  parseCheckoutUrl
+};

package/dist/embed.d.ts

@@ -0,0 +1,8 @@
+/** The embed origin for a build loaded from scriptSrc: staging's CDN frames staging, anything else prod. */
+export declare function embedOriginFor(scriptSrc?: string | null): string;
+export interface EmbedOptions {
+    /** The embed origin. Only the two Chain Daddy embed origins are taken; anything else is prod. */
+    origin?: string;
+}
+/** Defines <cd-app>, <cd-coin> and <cd-buy>, each once. cd.js calls it for you. */
+export declare function defineEmbedElements(options?: EmbedOptions): void;

package/dist/embed.js

@@ -0,0 +1,188 @@
+// src/embed.ts
+var PROD_ORIGIN = "https://embed.chaindaddy.io";
+var STAGING_ORIGIN = "https://embed-staging.chaindaddy.io";
+var READY_TIMEOUT_MS = 8e3;
+var MAX_HEIGHT = 4e3;
+var THEME_TOKENS = ["--cd-accent", "--cd-surface", "--cd-text", "--cd-text-muted", "--cd-border"];
+function embedOriginFor(scriptSrc) {
+  try {
+    if (scriptSrc && new URL(scriptSrc).hostname === "js.staging.chaindaddy.io") return STAGING_ORIGIN;
+  } catch {
+  }
+  return PROD_ORIGIN;
+}
+var STYLE = `
+:host { display: block; }
+iframe { display: block; width: 100%; border: 0; height: 1px; opacity: 0; color-scheme: normal; }
+:host([data-cd-ready]) iframe { opacity: 1; }
+:host([data-cd-ready]) slot { display: none; }
+:host([data-cd-unavailable]) iframe { display: none; }
+`;
+var BUY_STYLE = `
+:host { display: inline-block; }
+button { box-sizing: border-box; min-height: 40px; padding: 0 16px; border-radius: 10px; cursor: pointer;
+  font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
+  border: 1px solid var(--cd-border, #d0d5dd); background: var(--cd-accent, #f59e0b); color: var(--cd-text, #101828); }
+button:focus-visible { outline: 2px solid var(--cd-accent, #f59e0b); outline-offset: 2px; }
+`;
+function defineEmbedElements(options = {}) {
+  try {
+    if (typeof customElements === "undefined" || typeof HTMLElement === "undefined") return;
+    const origin = options.origin === STAGING_ORIGIN ? STAGING_ORIGIN : PROD_ORIGIN;
+    class CdFrame extends HTMLElement {
+      constructor() {
+        super(...arguments);
+        this.kind = "app";
+        this.frame = null;
+        this.onMessage = (event) => this.receive(event);
+      }
+      connectedCallback() {
+        try {
+          if (!this.shadowRoot) this.attachShadow({ mode: "open" });
+          this.mount();
+        } catch {
+          this.unavailable();
+        }
+      }
+      disconnectedCallback() {
+        try {
+          window.removeEventListener("message", this.onMessage);
+          clearTimeout(this.timer);
+        } catch {
+        }
+      }
+      attributeChangedCallback() {
+        try {
+          if (this.isConnected && this.shadowRoot) this.mount();
+        } catch {
+          this.unavailable();
+        }
+      }
+      /** The frame's address, or null when the element does not name enough. */
+      src() {
+        const crown = (this.getAttribute("crown") ?? "").trim();
+        const chain = (this.getAttribute("chain") ?? "").trim();
+        const app = (this.getAttribute("app") ?? "").trim();
+        if (!/^[0-9]{1,18}$/.test(crown) || !chain || this.kind === "app" && !app) return null;
+        const q = new URLSearchParams({ crown, chain });
+        if (this.kind === "app") q.set("app", app);
+        else q.set("kind", "coin");
+        q.set("mode", this.mode());
+        q.set("v", "1");
+        return `${origin}/v1/frame?${q.toString()}`;
+      }
+      mode() {
+        const attr = this.getAttribute("mode");
+        if (attr === "light" || attr === "dark") return attr;
+        try {
+          return window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";
+        } catch {
+          return "light";
+        }
+      }
+      mount() {
+        const root = this.shadowRoot;
+        window.removeEventListener("message", this.onMessage);
+        clearTimeout(this.timer);
+        this.removeAttribute("data-cd-ready");
+        this.removeAttribute("data-cd-unavailable");
+        const src = this.src();
+        if (!src) {
+          root.innerHTML = "<slot></slot>";
+          this.frame = null;
+          return;
+        }
+        root.innerHTML = `<style>${STYLE}</style><slot></slot>`;
+        const frame = document.createElement("iframe");
+        frame.setAttribute("loading", "lazy");
+        frame.setAttribute("referrerpolicy", "strict-origin-when-cross-origin");
+        frame.setAttribute("allow", "clipboard-write; fullscreen");
+        frame.setAttribute("title", this.kind === "coin" ? "Coin on Chain Daddy" : "App on Chain Daddy");
+        frame.src = src;
+        root.appendChild(frame);
+        this.frame = frame;
+        window.addEventListener("message", this.onMessage);
+        this.timer = setTimeout(() => {
+          if (!this.hasAttribute("data-cd-ready")) this.unavailable();
+        }, READY_TIMEOUT_MS);
+      }
+      receive(event) {
+        try {
+          if (event.origin !== origin || !this.frame || !event.source || event.source !== this.frame.contentWindow) return;
+          const data = event.data;
+          if (!data || typeof data !== "object") return;
+          if (data.type === "cd:ready") {
+            clearTimeout(this.timer);
+            this.removeAttribute("data-cd-unavailable");
+            this.setAttribute("data-cd-ready", "");
+            this.sendTheme();
+            this.dispatchEvent(new CustomEvent("cd:ready"));
+          } else if (data.type === "cd:resize") {
+            const h = Number(data.height);
+            if (Number.isFinite(h)) this.frame.style.height = `${Math.max(1, Math.min(MAX_HEIGHT, Math.ceil(h)))}px`;
+          } else if (data.type === "cd:unavailable") {
+            this.unavailable();
+          }
+        } catch {
+        }
+      }
+      /** The page's --cd-* colours, for an app that takes them. */
+      sendTheme() {
+        const tokens = {};
+        const style = getComputedStyle(this);
+        for (const token of THEME_TOKENS) {
+          const value = style.getPropertyValue(token).trim();
+          if (value) tokens[token] = value;
+        }
+        this.frame?.contentWindow?.postMessage({ type: "cd:theme", tokens }, origin);
+      }
+      unavailable() {
+        try {
+          clearTimeout(this.timer);
+          this.removeAttribute("data-cd-ready");
+          if (this.hasAttribute("data-cd-unavailable")) return;
+          this.setAttribute("data-cd-unavailable", "");
+          this.dispatchEvent(new CustomEvent("cd:unavailable"));
+        } catch {
+        }
+      }
+    }
+    CdFrame.observedAttributes = ["crown", "chain", "app", "mode"];
+    class CdApp extends CdFrame {
+    }
+    class CdCoin extends CdFrame {
+      constructor() {
+        super(...arguments);
+        this.kind = "coin";
+      }
+    }
+    class CdBuy extends HTMLElement {
+      connectedCallback() {
+        try {
+          const link = this.querySelector("a[href]");
+          const href = link ? new URL(link.getAttribute("href") ?? "", document.baseURI) : null;
+          if (!href || href.protocol !== "https:") return;
+          const root = this.shadowRoot ?? this.attachShadow({ mode: "open" });
+          root.innerHTML = `<style>${BUY_STYLE}</style><button type="button" part="button"></button>`;
+          const button = root.querySelector("button");
+          button.textContent = (link.textContent ?? "").trim() || "Buy on Chain Daddy";
+          button.addEventListener("click", () => {
+            try {
+              if (!window.open(href.toString(), "cd-buy", "popup,width=460,height=760")) window.location.assign(href.toString());
+            } catch {
+            }
+          });
+        } catch {
+        }
+      }
+    }
+    for (const [name, ctor] of [["cd-app", CdApp], ["cd-coin", CdCoin], ["cd-buy", CdBuy]]) {
+      if (!customElements.get(name)) customElements.define(name, ctor);
+    }
+  } catch {
+  }
+}
+export {
+  defineEmbedElements,
+  embedOriginFor
+};

package/dist/index.d.ts

@@ -2,3 +2,7 @@ export { VERSION } from './core';
 export { DEFAULT_ISSUER, challengeFor, exchangeCode, handleCallback, signIn } from './signin';
 export type { SignInOptions, SignInResult } from './signin';
 export { defineSignInButton } from './button';
+export { defineEmbedElements, embedOriginFor } from './embed';
+export type { EmbedOptions } from './embed';
+export { bindCheckoutButtons, checkout, parseCheckoutUrl } from './checkout';
+export type { CheckoutOptions, CheckoutResult, CheckoutTarget } from './checkout';