@chaindaddy/js 0.3.1 → 0.3.3

package/dist/api.d.ts

@@ -38,8 +38,9 @@ export interface paths {
          * List the apps on a verified coin's page
          * @description The apps a verified coin's page shows, in page order: each app's ID, name, description, version,
          *     category, icon and whether it is a built-in. It names the apps; it does not include what the owner
-         *     set up inside them. Apps turned off are left out, and so is every app rated NSFW and every app the
-         *     page itself no longer shows (not reviewed yet, suspended or removed). Answers 404 for a ticker
+         *     set up inside them. Apps turned off are left out, and so is every app rated NSFW, every app the
+         *     page itself no longer shows (not reviewed yet, suspended or removed) and the built-in parts of
+         *     the page that are not apps (its header, its market panel). Answers 404 for a ticker
          *     with no verified page on that chain, and for a page Chain Daddy removed. Keyless, the same for
          *     every caller, and cached for about a minute.
          */
@@ -103,6 +104,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v2/iap/config": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Store configuration
+         * @description How creator stores work right now: whether they are switched on, the chains a store can run
+         *     on, what an item on each chain can be priced in besides the store's own token (the chain's
+         *     coin, a dollar stablecoin), and where the receipt signing keys are published. It also says
+         *     whether test stores are available here (`testMode`) and whether checkout sessions are
+         *     (`checkoutSessions`, with the limits on how long one may stay open).
+         */
+        get: operations["getIapConfig"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v2/iap/jwks": {
         parameters: {
             query?: never;
@@ -139,6 +164,10 @@ export interface paths {
          *     amount paid, when) with its current status. A refunded order's receipt reads `revoked`: offline
          *     verification proves a receipt was issued, this proves it still stands. The receipt is the compact JWS
          *     exactly as issued (three base64url parts joined by dots).
+         *
+         *     The answer is `200` whatever the receipt is. Act on `valid`, which is true only for status `valid`.
+         *     A string that is not a receipt Chain Daddy signed (a bad signature, a changed payload, an unknown
+         *     key, not a JWS at all) answers `{"valid": false, "status": "invalid", "error": "…"}` with no `payload`.
          */
         post: operations["verifyIapReceipt"];
         delete?: never;
@@ -167,6 +196,43 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v2/iap/stores/{storeId}/test-store": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The store's ID (a UUID) */
+                storeId: components["parameters"]["IapStoreId"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get a store's test store
+         * @description The test store that stands beside a live store: the same coin page and payout, its own
+         *     catalog, keys, orders and webhook, and `mode: test`. Its orders are paid with
+         *     `POST /api/v2/iap/orders/{orderId}/test-pay`; nothing is sent on chain and no fee is taken. Pass the
+         *     live store's id (a test store's own id returns that test store). Your account credentials, as a wallet
+         *     that manages the coin's page; a store key is refused (403 `SESSION_REQUIRED`).
+         *     Guide: https://docs.chaindaddy.io/developer/test-your-integration#test-store
+         */
+        get: operations["getIapTestStore"];
+        put?: never;
+        /**
+         * Create a store's test store
+         * @description Creates the live store's test store with a copy of its catalog as it is now, drafts included and
+         *     nothing sold (201), or returns the one it already has (200). Safe to call again. From then on the
+         *     two catalogs are separate. Make its keys with `POST /api/v2/iap/stores/{storeId}/keys` on the test
+         *     store's id: they start with `cd_iap_test_` and work only on it. It takes no body. Your account
+         *     credentials, as a wallet that manages the coin's page and has the plan a store needs.
+         *     Guide: https://docs.chaindaddy.io/developer/test-your-integration#test-store
+         */
+        post: operations["openIapTestStore"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v2/iap/stores/{storeId}/skus": {
         parameters: {
             query?: never;
@@ -714,9 +780,8 @@ export interface paths {
          *     (200, secret unchanged; also turns back on a webhook turned off after repeated failures). Events default
          *     to every `iap.*` type there is at the time of the save (a type added later needs another save); names
          *     may omit the `iap.` prefix. The URL must be https and must not resolve to a
-         *     private address. Needs the store's own plan (a Developer plan or developer program membership), not
-         *     the Developer plan the general `/api/v2/webhooks` routes need. Account credentials, or a store key
-         *     with `webhooks:write`.
+         *     private address. Needs only the plan the store itself needs (any paid plan), not the Developer plan the
+         *     general `/api/v2/webhooks` routes need. Account credentials, or a store key with `webhooks:write`.
          */
         put: operations["setIapStoreWebhook"];
         post?: never;
@@ -873,6 +938,36 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v2/iap/orders/{orderId}/test-pay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description `0x` followed by 64 hex characters */
+                orderId: components["parameters"]["IapOrderId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Pay a test order
+         * @description Pays a pending order of a test store with a simulated payment and confirms it at once: the items
+         *     are granted, the receipt is signed and `order.confirmed` is written, exactly as for a real payment.
+         *     No chain is read or written and no money moves. Where a transaction hash would be, the order carries
+         *     `test:` and an id. Calling it again on a confirmed order returns that order and changes nothing.
+         *
+         *     Call it with a key of the order's test store (`cd_iap_test_…`, scope `orders:write`), or signed in as
+         *     a wallet that manages the coin's page. It takes no body. A live store's order is only ever paid on
+         *     chain (409 `LIVE_ORDER`). Guide: https://docs.chaindaddy.io/developer/test-your-integration#test-store
+         */
+        post: operations["testPayIapOrder"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v2/iap/checkout/sessions": {
         parameters: {
             query?: never;
@@ -1446,6 +1541,112 @@ export interface components {
             award?: components["schemas"]["IapAirdropAward"];
             campaign?: components["schemas"]["IapAwardAirdrop"];
         };
+        IapChain: {
+            /**
+             * @description CAIP-2 chain id
+             * @example eip155:8453
+             */
+            chainId?: string;
+            /** @example base */
+            chainKey?: string;
+            /**
+             * @description The checkout contract an order with a fee is paid through. Absent on Solana. A hint only: the
+             *     contract to pay is always the one in the order's own `payment` block.
+             */
+            checkout?: string;
+            /**
+             * @description The checkout contract an order with no fee is paid through (a store whose `feeBps` is 0). Absent on
+             *     Solana and where the chain has none. A hint only, like `checkout`.
+             */
+            checkoutNoFee?: string;
+            /** @description Confirmations an order waits for before it is `confirmed` */
+            confirmations?: number;
+            /**
+             * @description What a SKU on this chain may be paid in besides the store's own token (always allowed, and the
+             *     default): the chain's coin and, where the chain has one, its dollar stable.
+             */
+            currencies?: components["schemas"]["IapCurrency"][];
+        };
+        IapCurrency: {
+            /** @enum {string} */
+            currency?: "native" | "usdc";
+            /**
+             * @description The zero address for an EVM chain's coin, `11111111111111111111111111111111` for SOL, otherwise
+             *     the stable's contract or mint
+             */
+            address?: string;
+            /** @example USDC */
+            symbol?: string;
+            /** @example 6 */
+            decimals?: number;
+        };
+        IapConfig: {
+            enabled?: boolean;
+            /**
+             * @description Whether test stores are available here: a store's test store, its `cd_iap_test_` keys, and paying a
+             *     test order with no money
+             */
+            testMode?: boolean;
+            chains?: components["schemas"]["IapChain"][];
+            /** @description The read-only account every Solana store payment references */
+            solanaStaticKey?: string;
+            /** @example https://api.chaindaddy.io/api/v2/iap/jwks */
+            jwksUrl?: string;
+            /**
+             * @description The limits on what an app can make a buyer pay (paid apps). Chain Daddy may change them at any time.
+             *     Amounts are in millionths of a dollar.
+             */
+            paidApps?: {
+                /**
+                 * Format: int64
+                 * @description The most one purchase through an app may cost; an app item priced above it cannot be saved
+                 * @example 250000000
+                 */
+                maxOrderUsdMicros?: number;
+                /**
+                 * Format: int64
+                 * @description The most one buyer wallet may pay one app in any 24 hours
+                 * @example 1000000000
+                 */
+                walletAppDayUsdMicros?: number;
+                /**
+                 * Format: int64
+                 * @description Above this, the purchase sheet asks the buyer to press and hold
+                 * @example 50000000
+                 */
+                confirmAboveUsdMicros?: number;
+                /**
+                 * @description The most units in one order through an app
+                 * @example 10
+                 */
+                maxQuantity?: number;
+                /**
+                 * @description The most orders one buyer wallet may open through one app in a minute
+                 * @example 5
+                 */
+                ordersPerMinute?: number;
+            };
+            /** @description Present only where checkout sessions are switched on */
+            checkoutSessions?: {
+                /** @description When true, only a test store's key can open a checkout session here */
+                testOnly?: boolean;
+                /**
+                 * @description The least `expiresInSeconds` a session may ask for
+                 * @example 900
+                 */
+                minExpiresInSeconds?: number;
+                /**
+                 * @description The most `expiresInSeconds` a session may ask for
+                 * @example 86400
+                 */
+                maxExpiresInSeconds?: number;
+                /**
+                 * @description How long a session stays open when it does not say
+                 * @example 3600
+                 */
+                defaultExpiresInSeconds?: number;
+            };
+        };
         IapStore: {
             /** Format: uuid */
             id?: string;
@@ -1483,6 +1684,12 @@ export interface components {
              *     for its own items; items from apps installed on the page keep selling.
              */
             live?: boolean;
+            /**
+             * @description `test` for a test store: its orders are paid by the test-pay call instead of a wallet, nothing is sent
+             *     on chain and no fee is taken. Unrelated to `live` above.
+             * @enum {string}
+             */
+            mode?: "live" | "test";
             /** Format: date-time */
             createdAt?: string;
             /**
@@ -1887,13 +2094,24 @@ export interface components {
             refundedAt?: string | null;
             /** @description Signed receipt (JWS) once confirmed */
             receipt?: string | null;
-            /** @description Present while pending; how to pay */
-            payment?: components["schemas"]["IapEvmPayment"] | components["schemas"]["IapSolanaPayment"];
+            /**
+             * @description Present while pending; how to pay. A test store's order carries `{"kind": "test"}`: nothing is signed,
+             *     and it is paid with `POST /api/v2/iap/orders/{orderId}/test-pay`.
+             */
+            payment?: components["schemas"]["IapEvmPayment"] | components["schemas"]["IapSolanaPayment"] | components["schemas"]["IapTestPayment"];
             /** @description How to check this order's payment on chain without trusting the API. EVM: call hashOrder(order) on `checkout`, then paidBy(hash) at a block `confirmations` deep; `checkout` is the contract the order was (or will be) paid through, which hashOrder is bound to. Solana: find the transfer by its `reference` key and `memo`. Absent on test orders, and on EVM orders paid before the contract was recorded. */
             verification?: components["schemas"]["IapEvmVerification"] | components["schemas"]["IapSolanaVerification"];
             /** Format: date-time */
             createdAt?: string;
         };
+        /** @description The payment block of a test store's pending order. There is nothing to sign or send */
+        IapTestPayment: {
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            kind: "test";
+        };
         IapEvmVerification: {
             /**
              * @description discriminator enum property added by openapi-typescript
@@ -2149,12 +2367,18 @@ export interface components {
             deliveredAt?: string | null;
         };
         IapReceiptVerification: {
+            /** @description True only when `status` is `valid`. Deliver on this */
+            valid?: boolean;
             /**
-             * @description `revoked` once the order is refunded
+             * @description `valid`: the receipt is ours and its order stands. `revoked`: a refund was recorded since.
+             *     `invalid`: not a receipt Chain Daddy signed; `error` says why and there is no `payload`.
+             *     `unknown`: the signature is ours, but this API has no record of the receipt.
              * @enum {string}
              */
-            status?: "valid" | "revoked";
-            /** @description The receipt's decoded claims */
+            status?: "valid" | "revoked" | "invalid" | "unknown";
+            /** @description Why the receipt is `invalid`. Absent otherwise */
+            error?: string;
+            /** @description The receipt's decoded claims. Absent when `status` is `invalid` */
             payload?: {
                 /** @example https://chaindaddy.io */
                 iss?: string;
@@ -2563,8 +2787,9 @@ export interface components {
         };
         /**
          * @description Not allowed. `IAP_PLAN_REQUIRED` when the wallet (for a store key, the wallet that opened the store)
-         *     has neither a Developer plan nor Developer Beta program membership in good standing. Otherwise the
-         *     caller does not manage this token page, or the store key lacks the scope.
+         *     cannot run a store. That takes any paid plan with the Seller Terms signed, or Developer Beta Program
+         *     membership in good standing. Otherwise the caller does not manage this token page, or the store key
+         *     lacks the scope.
          */
         IapForbidden: {
             headers: {
@@ -2573,13 +2798,28 @@ export interface components {
             content: {
                 /**
                  * @example {
-                 *       "error": "a Developer plan is required to run a store",
+                 *       "error": "running a store needs a paid plan or Developer Beta Program membership (the Developer plan is in beta and free while it is): https://chaindaddy.io/_developer",
                  *       "code": "IAP_PLAN_REQUIRED"
                  *     }
                  */
                 "application/json": components["schemas"]["IapError"];
             };
         };
+        /** @description No wallet session */
+        IapUnauthorized: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                /**
+                 * @example {
+                 *       "error": "sign in first",
+                 *       "code": "UNAUTHORIZED"
+                 *     }
+                 */
+                "application/json": components["schemas"]["IapError"];
+            };
+        };
         /** @description `AIRDROPS_DISABLED` or `IAP_DISABLED`: the feature is switched off */
         IapAirdropsUnavailable: {
             headers: {
@@ -2695,6 +2935,12 @@ export interface components {
          *     and never sells, grants or consumes twice.
          */
         IdempotencyKey: string;
+        /**
+         * @description Required: a call without it answers 400 `IDEMPOTENCY_KEY_REQUIRED`. Send one value per attempt (a UUID,
+         *     or an id of your own such as `cart-8842-attempt-1`), up to 255 characters. Retrying with the same key
+         *     and the same request returns the first result and never sells, grants or consumes twice.
+         */
+        IdempotencyKeyRequired: string;
         /** @description The store's ID (a UUID) */
         IapStoreId: string;
         /** @description The SKU key, e.g. `badge.gold` */
@@ -3215,6 +3461,26 @@ export interface operations {
             };
         };
     };
+    getIapConfig: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Configuration */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapConfig"];
+                };
+            };
+        };
+    };
     getIapJwks: {
         parameters: {
             query?: never;
@@ -3271,7 +3537,7 @@ export interface operations {
             };
         };
         responses: {
-            /** @description Verified receipt */
+            /** @description The check's answer, also for a receipt that is not valid (read `valid` and `status`) */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -3308,6 +3574,89 @@ export interface operations {
             404: components["responses"]["IapNotFound"];
         };
     };
+    getIapTestStore: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The store's ID (a UUID) */
+                storeId: components["parameters"]["IapStoreId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The test store */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapStore"];
+                };
+            };
+            401: components["responses"]["IapUnauthorized"];
+            403: components["responses"]["IapForbidden"];
+            /**
+             * @description `NOT_FOUND`: no such store, or it has no test store yet (POST here to create it).
+             *     `TEST_MODE_DISABLED`: test stores are not available here (`testMode` in `GET /api/v2/iap/config`).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+        };
+    };
+    openIapTestStore: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The store's ID (a UUID) */
+                storeId: components["parameters"]["IapStoreId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The test store the live store already had */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapStore"];
+                };
+            };
+            /** @description The test store, just created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapStore"];
+                };
+            };
+            401: components["responses"]["IapUnauthorized"];
+            403: components["responses"]["IapForbidden"];
+            /**
+             * @description `NOT_FOUND`: no such store. `TEST_MODE_DISABLED`: test stores are not available here (`testMode` in
+             *     `GET /api/v2/iap/config`).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+        };
+    };
     listIapSkus: {
         parameters: {
             query?: never;
@@ -3577,12 +3926,13 @@ export interface operations {
     grantIapItems: {
         parameters: {
             query?: never;
-            header?: {
+            header: {
                 /**
-                 * @description Send a unique value (a UUID) with every POST. Retrying with the same key returns the first result
-                 *     and never sells, grants or consumes twice.
+                 * @description Required: a call without it answers 400 `IDEMPOTENCY_KEY_REQUIRED`. Send one value per attempt (a UUID,
+                 *     or an id of your own such as `cart-8842-attempt-1`), up to 255 characters. Retrying with the same key
+                 *     and the same request returns the first result and never sells, grants or consumes twice.
                  */
-                "Idempotency-Key"?: components["parameters"]["IdempotencyKey"];
+                "Idempotency-Key": components["parameters"]["IdempotencyKeyRequired"];
             };
             path: {
                 /** @description The store's ID (a UUID) */
@@ -3617,12 +3967,13 @@ export interface operations {
     consumeIapItems: {
         parameters: {
             query?: never;
-            header?: {
+            header: {
                 /**
-                 * @description Send a unique value (a UUID) with every POST. Retrying with the same key returns the first result
-                 *     and never sells, grants or consumes twice.
+                 * @description Required: a call without it answers 400 `IDEMPOTENCY_KEY_REQUIRED`. Send one value per attempt (a UUID,
+                 *     or an id of your own such as `cart-8842-attempt-1`), up to 255 characters. Retrying with the same key
+                 *     and the same request returns the first result and never sells, grants or consumes twice.
                  */
-                "Idempotency-Key"?: components["parameters"]["IdempotencyKey"];
+                "Idempotency-Key": components["parameters"]["IdempotencyKeyRequired"];
             };
             path: {
                 /** @description The store's ID (a UUID) */
@@ -3940,12 +4291,13 @@ export interface operations {
     awardIapDrop: {
         parameters: {
             query?: never;
-            header?: {
+            header: {
                 /**
-                 * @description Send a unique value (a UUID) with every POST. Retrying with the same key returns the first result
-                 *     and never sells, grants or consumes twice.
+                 * @description Required: a call without it answers 400 `IDEMPOTENCY_KEY_REQUIRED`. Send one value per attempt (a UUID,
+                 *     or an id of your own such as `cart-8842-attempt-1`), up to 255 characters. Retrying with the same key
+                 *     and the same request returns the first result and never sells, grants or consumes twice.
                  */
-                "Idempotency-Key"?: components["parameters"]["IdempotencyKey"];
+                "Idempotency-Key": components["parameters"]["IdempotencyKeyRequired"];
             };
             path: {
                 /** @description The store's ID (a UUID) */
@@ -4497,12 +4849,13 @@ export interface operations {
     createIapOrder: {
         parameters: {
             query?: never;
-            header?: {
+            header: {
                 /**
-                 * @description Send a unique value (a UUID) with every POST. Retrying with the same key returns the first result
-                 *     and never sells, grants or consumes twice.
+                 * @description Required: a call without it answers 400 `IDEMPOTENCY_KEY_REQUIRED`. Send one value per attempt (a UUID,
+                 *     or an id of your own such as `cart-8842-attempt-1`), up to 255 characters. Retrying with the same key
+                 *     and the same request returns the first result and never sells, grants or consumes twice.
                  */
-                "Idempotency-Key"?: components["parameters"]["IdempotencyKey"];
+                "Idempotency-Key": components["parameters"]["IdempotencyKeyRequired"];
             };
             path?: never;
             cookie?: never;
@@ -4546,9 +4899,24 @@ export interface operations {
                 };
             };
             400: components["responses"]["IapBadRequest"];
+            /**
+             * @description `AUTHENTICATION_REQUIRED`: no credential at all. The buyer signs in, or your server sends a store key
+             *     (`Authorization: Bearer cd_iap_…`); an order for a checkout session is the signed-in buyer's only.
+             *     `INVALID_STORE_KEY`: the key is unknown or revoked
+             */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
             /**
              * @description Not allowed, the purchase rule is not met, or the store is not taking orders. `APP_ITEM_NOT_YOURS`: an
-             *     app asked for another app's item, or an app's item was asked for outside its app
+             *     app asked for another app's item, or an app's item was asked for outside its app. For a checkout
+             *     session: `SESSION_REQUIRED` (a store key tried to pay it) or `CHECKOUT_SESSION_WALLET` (the session
+             *     names another wallet)
              */
             403: {
                 headers: {
@@ -4558,12 +4926,26 @@ export interface operations {
                     "application/json": components["schemas"]["IapError"];
                 };
             };
+            /**
+             * @description `NOT_FOUND`: no such store, or no such checkout session. `SKU_NOT_FOR_SALE`: no such item in the store.
+             *     `CHECKOUT_SESSIONS_DISABLED`: the order names a checkout session where sessions are not switched on
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
             /**
              * @description Sold out, or the wallet has reached the SKU's per-wallet limit. For an app's item: `APP_TERMS_CHANGED`
              *     (its developer changed its terms and the page's owner has not accepted them yet), `APP_NOT_INSTALLED`,
              *     `APP_NOT_SELLING`, `APP_ORDER_LIMIT` (above the per-purchase limit) or `APP_DAILY_LIMIT` (the wallet
              *     reached what it may pay that app in 24 hours). For an app's item paid through a checkout session:
-             *     `APP_ITEM_NOT_SOLD_HERE`, with a `reason`
+             *     `APP_ITEM_NOT_SOLD_HERE`, with a `reason`. For any checkout session: `CHECKOUT_SESSION_EXPIRED`,
+             *     `CHECKOUT_SESSION_COMPLETE` (already paid) or `CHECKOUT_SESSION_IN_USE` (another wallet is paying it
+             *     right now)
              */
             409: {
                 headers: {
@@ -4635,15 +5017,79 @@ export interface operations {
             404: components["responses"]["IapNotFound"];
         };
     };
+    testPayIapOrder: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description `0x` followed by 64 hex characters */
+                orderId: components["parameters"]["IapOrderId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The order, confirmed, with its receipt */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapOrder"];
+                };
+            };
+            /** @description No credential, or a store key that is unknown or revoked (`INVALID_STORE_KEY`) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            403: components["responses"]["IapForbidden"];
+            /**
+             * @description `NOT_FOUND`: no such order, or it is not an order of the caller's store or coin page.
+             *     `TEST_MODE_DISABLED`: test stores are not available here (`testMode` in `GET /api/v2/iap/config`).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `LIVE_ORDER`: the order belongs to a live store. `ORDER_EXPIRED`: the order's deadline has passed;
+             *     create a new one.
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "this is a live order: it is paid on chain, and test-pay pays test orders only",
+                     *       "code": "LIVE_ORDER"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+        };
+    };
     createIapCheckoutSession: {
         parameters: {
             query?: never;
-            header?: {
+            header: {
                 /**
-                 * @description Send a unique value (a UUID) with every POST. Retrying with the same key returns the first result
-                 *     and never sells, grants or consumes twice.
+                 * @description Required: a call without it answers 400 `IDEMPOTENCY_KEY_REQUIRED`. Send one value per attempt (a UUID,
+                 *     or an id of your own such as `cart-8842-attempt-1`), up to 255 characters. Retrying with the same key
+                 *     and the same request returns the first result and never sells, grants or consumes twice.
                  */
-                "Idempotency-Key"?: components["parameters"]["IdempotencyKey"];
+                "Idempotency-Key": components["parameters"]["IdempotencyKeyRequired"];
             };
             path?: never;
             cookie?: never;
@@ -4719,7 +5165,11 @@ export interface operations {
                     "application/json": components["schemas"]["IapError"];
                 };
             };
-            /** @description No store key, or one that is unknown or revoked (`INVALID_STORE_KEY`) */
+            /**
+             * @description `AUTHENTICATION_REQUIRED`: no credential at all; send the store key as
+             *     `Authorization: Bearer cd_iap_…`. `INVALID_STORE_KEY`: the key is unknown or revoked.
+             *     `TEST_MODE_DISABLED`: a test key where test mode is not available
+             */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4800,7 +5250,11 @@ export interface operations {
                     "application/json": components["schemas"]["IapCheckoutSession"];
                 };
             };
-            /** @description No store key, or one that is unknown or revoked */
+            /**
+             * @description `AUTHENTICATION_REQUIRED`: no credential at all; send the store key as
+             *     `Authorization: Bearer cd_iap_…`. `INVALID_STORE_KEY`: the key is unknown or revoked.
+             *     `TEST_MODE_DISABLED`: a test key where test mode is not available
+             */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4818,7 +5272,18 @@ export interface operations {
                     "application/json": components["schemas"]["IapError"];
                 };
             };
-            404: components["responses"]["IapNotFound"];
+            /**
+             * @description `NOT_FOUND`: no such session, or it belongs to another store. `CHECKOUT_SESSIONS_DISABLED`: checkout
+             *     sessions are not switched on here, or are open to test stores only and the key is a live store's
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
         };
     };
     getIapPublicCheckoutSession: {
@@ -4845,7 +5310,18 @@ export interface operations {
                     "application/json": components["schemas"]["IapPublicCheckoutSession"];
                 };
             };
-            404: components["responses"]["IapNotFound"];
+            /**
+             * @description `NOT_FOUND`: no such session. `CHECKOUT_SESSIONS_DISABLED`: checkout sessions are not switched on
+             *     here, or are open to test stores only and the session is a live store's
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
         };
     };
     listWebhooks: {

package/dist/cd.js

@@ -1,4 +1,4 @@
-"use strict";(()=>{var S="0.3.1";function v(t){let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function f(){return v(crypto.getRandomValues(new Uint8Array(32)))}function R(t,e,r,s,o){let d=n=>{if(n&&typeof n=="object"&&n.type===t)try{r(n)}catch{}},u=n=>{n.origin===e&&(!o||n.source===o)&&d(n.data)};window.addEventListener("message",u);let c=null;if(s&&typeof BroadcastChannel=="function"&&e===location.origin)try{c=new BroadcastChannel(s),c.onmessage=n=>d(n.data)}catch{c=null}return()=>{window.removeEventListener("message",u),c?.close()}}var m={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var q="https://api.chaindaddy.io",V={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},w="cd-signin",T="cd:signin",y="cd.signin";async function F(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return v(new Uint8Array(e))}function G(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function K(t,e,r){let s=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:G(t.scope),state:e.state,nonce:e.nonce,code_challenge:await F(e.verifier),code_challenge_method:"S256"});return t.claims&&s.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${r}?${s}`}function _(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}function b(t){let e=(t.issuer??q).replace(/\/$/,""),r=t.authorizeUrl??V[e];if(!r)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let s={state:f(),nonce:f(),verifier:f(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};m.set(y,JSON.stringify(s));let o=window.open("",w,"popup,width=480,height=720");return(async()=>{let d=await K(t,s,r);if(!o)return location.assign(d),null;o.location.href=d;let u=new URL(t.redirectUri,location.href).origin;return new Promise((c,n)=>{let a=R(T,u,i=>{i.state===s.state&&(a(),m.remove(y),typeof i.error=="string"&&i.error?n(new Error(i.error)):i.iss!==e?n(new Error("the answer came from another issuer")):typeof i.code!="string"||!i.code?n(new Error("the answer carried no code")):c(_(s,i.code)))},w,o);t.signal?.addEventListener("abort",()=>{a(),n(new Error("aborted"))})})})()}async function U(){let t=new URLSearchParams(location.search),e={type:T,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===w){try{window.opener?.postMessage(e,location.origin)}catch{}try{let o=new BroadcastChannel(w);o.postMessage(e),o.close()}catch{}return window.close(),null}let r=m.get(y);m.remove(y);let s=r?JSON.parse(r):null;if(!s||e.state!==s.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==s.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return _(s,e.code)}async function A(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),r=await e.json();if(!e.ok)throw new Error(`${r.error??e.status}: ${r.error_description??""}`.trim());return r}var W='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',Y=`
+"use strict";(()=>{var R="0.3.3";function C(t){let e="";for(let i of t)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function w(){return C(crypto.getRandomValues(new Uint8Array(32)))}function T(t,e,i,o,r){let u=n=>{if(n&&typeof n=="object"&&n.type===t)try{i(n)}catch{}},l=n=>{n.origin===e&&(!r||n.source===r)&&u(n.data)};window.addEventListener("message",l);let a=null;if(o&&typeof BroadcastChannel=="function"&&e===location.origin)try{a=new BroadcastChannel(o),a.onmessage=n=>u(n.data)}catch{a=null}return()=>{window.removeEventListener("message",l),a?.close()}}var y={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var F="https://api.chaindaddy.io",G={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},b="cd-signin",U="cd:signin",v="cd.signin",_=300;async function K(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return C(new Uint8Array(e))}function W(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function Y(t,e,i){let o=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:W(t.scope),state:e.state,nonce:e.nonce,code_challenge:await K(e.verifier),code_challenge_method:"S256"});return t.claims&&o.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${i}?${o}`}function A(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}var m;function k(t){let e=(t.issuer??F).replace(/\/$/,""),i=t.authorizeUrl??G[e];if(!i)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));if(m&&!m.popup.closed)return m.popup.focus(),m.waiting;let o={state:w(),nonce:w(),verifier:w(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};y.set(v,JSON.stringify(o));let r=window.open("",b,"popup,width=480,height=720"),u=(async()=>{let l=await Y(t,o,i);if(!r)return location.assign(l),null;r.location.href=l;let a=new URL(t.redirectUri,location.href).origin;return new Promise((n,c)=>{let s,d=()=>{g(),clearInterval(h),clearTimeout(s)},g=T(U,a,p=>{p.state===o.state&&(d(),y.remove(v),typeof p.error=="string"&&p.error?c(new Error(p.error)):p.iss!==e?c(new Error("the answer came from another issuer")):typeof p.code!="string"||!p.code?c(new Error("the answer carried no code")):n(A(o,p.code)))},b,r),h=setInterval(()=>{r.closed&&(clearInterval(h),s=setTimeout(()=>{d(),c(new Error("closed"))},_))},_);t.signal?.addEventListener("abort",()=>{d(),c(new Error("aborted"))})})})();if(r){m={popup:r,waiting:u};let l=()=>{m&&m.popup===r&&(m=void 0)};u.then(l,l)}return u}async function L(){let t=new URLSearchParams(location.search),e={type:U,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===b){try{window.opener?.postMessage(e,location.origin)}catch{}try{let r=new BroadcastChannel(b);r.postMessage(e),r.close()}catch{}return window.close(),null}let i=y.get(v);y.remove(v);let o=i?JSON.parse(i):null;if(!o||e.state!==o.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==o.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return A(o,e.code)}async function M(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),i=await e.json();if(!e.ok)throw new Error(`${i.error??e.status}: ${i.error_description??""}`.trim());return i}var J='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',X=`
 :host { display: inline-block; }
 button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
   min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
@@ -7,16 +7,16 @@ button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #
 button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
 button:disabled { opacity: .6; cursor: default; }
 svg { flex: none; }
-`;function L(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let r=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",s=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${Y}</style><button type="button" part="button" data-theme="${s}">${W}<span></span></button>`;let o=this.root.querySelector("button");o.querySelector("span").textContent=r,o.addEventListener("click",()=>this.start())}start(){let r=s=>this.getAttribute(s)||void 0;b({clientId:r("client-id")??"",redirectUri:r("redirect-uri")??"",scope:r("scope"),claims:r("claims"),issuer:r("issuer"),authorizeUrl:r("authorize-url")}).then(s=>s&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:s,bubbles:!0,composed:!0})),s=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(s?.message??s)},bubbles:!0,composed:!0})))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var M="https://embed.chaindaddy.io",k="https://embed-staging.chaindaddy.io";var J=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function P(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return k}catch{}return M}var X=`
+`;function P(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let i=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",o=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${X}</style><button type="button" part="button" data-theme="${o}">${J}<span></span></button>`;let r=this.root.querySelector("button");r.querySelector("span").textContent=i,r.addEventListener("click",()=>this.start())}start(){let i=r=>this.getAttribute(r)||void 0,o=k({clientId:i("client-id")??"",redirectUri:i("redirect-uri")??"",scope:i("scope"),claims:i("claims"),issuer:i("issuer"),authorizeUrl:i("authorize-url")});o!==this.reporting&&(this.reporting=o,o.then(r=>r&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:r,bubbles:!0,composed:!0})),r=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(r?.message??r)},bubbles:!0,composed:!0}))))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var O="https://embed.chaindaddy.io",E="https://embed-staging.chaindaddy.io";var Q="1500px 0px",Z="docs.chaindaddy.io/token/apps-on-your-site#if-the-link-stays";var tt=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function $(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return E}catch{}return O}var et=`
 :host { display: block; }
 iframe { display: block; width: 100%; border: 0; height: 1px; opacity: 0; color-scheme: normal; }
 :host([data-cd-ready]) iframe { opacity: 1; }
 :host([data-cd-ready]) slot { display: none; }
 :host([data-cd-unavailable]) iframe { display: none; }
-`,Q=`
+`,nt=`
 :host { display: inline-block; }
 button { box-sizing: border-box; min-height: 40px; padding: 0 16px; border-radius: 10px; cursor: pointer;
   font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
   border: 1px solid var(--cd-border, #d0d5dd); background: var(--cd-accent, #f59e0b); color: var(--cd-text, #101828); }
 button:focus-visible { outline: 2px solid var(--cd-accent, #f59e0b); outline-offset: 2px; }
-`;function O(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===k?k:M;class r extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=n=>this.receive(n)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer)}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let n=(this.getAttribute("crown")??"").trim(),a=(this.getAttribute("chain")??"").trim(),i=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(n)||!a||this.kind==="app"&&!i)return null;let l=new URLSearchParams({crown:n,chain:a});return this.kind==="app"?l.set("app",i):l.set("kind","coin"),l.set("mode",this.mode()),l.set("v","1"),`${e}/v1/frame?${l.toString()}`}mode(){let n=this.getAttribute("mode");if(n==="light"||n==="dark")return n;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let n=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let a=this.src();if(!a){n.innerHTML="<slot></slot>",this.frame=null;return}n.innerHTML=`<style>${X}</style><slot></slot>`;let i=document.createElement("iframe");i.setAttribute("loading","lazy"),i.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),i.setAttribute("allow","clipboard-write; fullscreen"),i.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),i.src=a,n.appendChild(i),this.frame=i,window.addEventListener("message",this.onMessage),this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)}receive(n){try{if(n.origin!==e||!this.frame||!n.source||n.source!==this.frame.contentWindow)return;let a=n.data;if(!a||typeof a!="object")return;if(a.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(a.type==="cd:resize"){let i=Number(a.height);Number.isFinite(i)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(i)))}px`)}else a.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let n={},a=getComputedStyle(this);for(let i of J){let l=a.getPropertyValue(i).trim();l&&(n[i]=l)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:n},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable"))}catch{}}}r.observedAttributes=["crown","chain","app","mode"];class s extends r{}class o extends r{constructor(){super(...arguments);this.kind="coin"}}class d extends HTMLElement{connectedCallback(){try{let c=this.querySelector("a[href]"),n=c?new URL(c.getAttribute("href")??"",document.baseURI):null;if(!n||n.protocol!=="https:")return;let a=this.shadowRoot??this.attachShadow({mode:"open"});a.innerHTML=`<style>${Q}</style><button type="button" part="button"></button>`;let i=a.querySelector("button");i.textContent=(c.textContent??"").trim()||"Buy on Chain Daddy",i.addEventListener("click",()=>{try{window.open(n.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(n.toString())}catch{}})}catch{}}}for(let[u,c]of[["cd-app",s],["cd-coin",o],["cd-buy",d]])customElements.get(u)||customElements.define(u,c)}catch{}}var Z=["https://chaindaddy.io","https://staging.chaindaddy.io"],D=()=>"cd-checkout-"+f(),H="popup,width=480,height=820",$=300,tt=7;function E(t){if(typeof t!="string")return null;let e;try{e=new URL(t)}catch{return null}let r=/^\/_pay\/([\w-]+)$/.exec(e.pathname);return r&&Z.includes(e.origin)&&!e.username&&!e.password?{href:e.origin+e.pathname,origin:e.origin,id:r[1]}:null}function C(t,e){if(typeof t!="string")return null;let r;try{r=new URL(t,location.href)}catch{return null}if(!/^https?:$/.test(r.protocol)||r.username||r.password)return null;let s=d=>{let u=d.split("=")[0];try{return decodeURIComponent(u.replace(/\+/g," "))}catch{return u}},o=r.search.slice(1).split("&").filter(d=>d&&s(d)!=="session_id");return o.push("session_id="+encodeURIComponent(e)),r.origin+r.pathname+"?"+o.join("&")+r.hash}var p;function N(t,e,r){return new Promise(s=>{let o=!1,d=0,u,c=l=>{clearInterval(i),clearTimeout(u),window.removeEventListener("message",n),r&&l.status==="completed"&&location.assign(r),s(l)},n=l=>{if(l.origin!==e.origin||l.source!==t)return;let g=l.data;if(!g||typeof g!="object")return;g.type==="cd:checkout.ready"&&(o=!0);let h=g.session;if(!(!h||typeof h!="object"||h.id!==e.id)){if(g.type==="cd:checkout.cancelled")c({status:"cancelled",session:{id:e.id}});else if(g.type==="cd:checkout.completed"&&(h.status==="complete"||h.status==="paid")){let I={id:e.id,status:h.status};typeof h.orderId=="string"&&/^[\w-]{1,128}$/.test(h.orderId)&&(I.orderId=h.orderId),c({status:"completed",session:I})}}},a=()=>{try{t.postMessage({type:"cd:checkout.hello"},e.origin)}catch{}},i=setInterval(()=>{t.closed?(clearInterval(i),u=setTimeout(()=>c({status:"closed"}),$)):(!o||++d%tt===0)&&a()},$);window.addEventListener("message",n),a()})}function x(t){let e=()=>new Error("checkout: url is not a Chain Daddy checkout session link"),r=(o,d,u)=>{p={popup:o,result:d,href:u};let c=()=>{p&&p.popup===o&&(p=void 0)};return d.then(c,c),d},s=o=>(location.assign(o.href),{status:"redirected"});try{let{url:o,successUrl:d}=t;if(d&&!C(d,""))throw new Error("checkout: successUrl is not a web address");let u=i=>d?C(d,i.id):null,c=typeof o=="function"?null:E(o);if(typeof o!="function"&&!c)throw e();if(p&&!p.popup.closed&&(!c||p.href===c.href))return p.popup.focus(),p.result;if(c){let i=window.open(c.href,D(),H);return i?r(i,N(i,c,u(c)),c.href):Promise.resolve(s(c))}let n=window.open("",D(),H),a=new Promise(i=>i(o())).then(i=>{let l=E(i);if(!l)throw n?.close(),e();return n?(n.location.href=l.href,N(n,l,u(l))):s(l)},i=>{throw n?.close(),i});return n?r(n,a):a}catch(o){return Promise.reject(o)}}var B=!1,z;function j(){B||typeof document>"u"||(B=!0,document.addEventListener("click",t=>{let e=t.target instanceof Element?t.target.closest("[data-cd-checkout]"):null;if(!e||t.defaultPrevented||t.button||t.metaKey||t.ctrlKey||t.shiftKey||t.altKey)return;let r=e.getAttribute("data-cd-checkout")||e.href,s=e.getAttribute("data-cd-success");if(!E(r)||s&&!C(s,""))return;t.preventDefault();let o=x({url:r,successUrl:s});o!==z&&(z=o,o.then(d=>void e.dispatchEvent(new CustomEvent("cd:checkout",{detail:d,bubbles:!0})),()=>{}))}))}var et={version:S,signIn:b,handleCallback:U,exchangeCode:A,checkout:x};window.ChainDaddy=Object.assign(window.ChainDaddy??{},et);L();O({origin:P(document.currentScript?.src)});j();})();
+`;function D(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===E?E:O;class i extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=n=>this.receive(n)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.watch?.disconnect()}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let n=(this.getAttribute("crown")??"").trim(),c=(this.getAttribute("chain")??"").trim(),s=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(n)||!c||this.kind==="app"&&!s)return null;let d=new URLSearchParams({crown:n,chain:c});return this.kind==="app"?d.set("app",s):d.set("kind","coin"),d.set("mode",this.mode()),d.set("v","1"),`${e}/v1/frame?${d.toString()}`}mode(){let n=this.getAttribute("mode");if(n==="light"||n==="dark")return n;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let n=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.watch?.disconnect(),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let c=this.src();if(!c){n.innerHTML="<slot></slot>",this.frame=null;return}n.innerHTML=`<style>${et}</style><slot></slot>`;let s=document.createElement("iframe");s.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),s.setAttribute("allow","clipboard-write; fullscreen"),s.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),n.appendChild(s),this.frame=s,window.addEventListener("message",this.onMessage);let d=()=>{s.src=c,this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)};if(typeof IntersectionObserver>"u")return d();this.watch=new IntersectionObserver(g=>{g.some(h=>h.isIntersecting)&&(this.watch?.disconnect(),d())},{rootMargin:Q}),this.watch.observe(this)}why(){try{let n=new URL(this.frame.src).searchParams,c=n.get("app");n.delete("mode"),n.delete("v"),fetch(`https://${e===E?"staging-api":"api"}.chaindaddy.io/api/v2/embed/status?${n}`,{credentials:"omit"}).then(s=>s.json()).then(s=>{let d=s.embeddable?s.interactive?"not a verified site of the coin":"not https, or the app did not start":s.reason;console.info(`[Chain Daddy] cd-${this.kind} ${c??""} cannot show here: ${d}. ${Z}`)}).catch(()=>{})}catch{}}receive(n){try{if(n.origin!==e||!this.frame||!n.source||n.source!==this.frame.contentWindow)return;let c=n.data;if(!c||typeof c!="object")return;if(c.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(c.type==="cd:resize"){let s=Number(c.height);Number.isFinite(s)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(s)))}px`)}else c.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let n={},c=getComputedStyle(this);for(let s of tt){let d=c.getPropertyValue(s).trim();d&&(n[s]=d)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:n},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable")),this.why()}catch{}}}i.observedAttributes=["crown","chain","app","mode"];class o extends i{}class r extends i{constructor(){super(...arguments);this.kind="coin"}}class u extends HTMLElement{connectedCallback(){try{let a=this.querySelector("a[href]"),n=a?new URL(a.getAttribute("href")??"",document.baseURI):null;if(!n||n.protocol!=="https:")return;let c=this.shadowRoot??this.attachShadow({mode:"open"});c.innerHTML=`<style>${nt}</style><button type="button" part="button"></button>`;let s=c.querySelector("button");s.textContent=(a.textContent??"").trim()||"Buy on Chain Daddy",s.addEventListener("click",()=>{try{window.open(n.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(n.toString())}catch{}})}catch{}}}for(let[l,a]of[["cd-app",o],["cd-coin",r],["cd-buy",u]])customElements.get(l)||customElements.define(l,a)}catch{}}var it=["https://chaindaddy.io","https://staging.chaindaddy.io"],H=()=>"cd-checkout-"+w(),N="popup,width=480,height=820",B=300,rt=7;function I(t){if(typeof t!="string")return null;let e;try{e=new URL(t)}catch{return null}let i=/^\/_pay\/([\w-]+)$/.exec(e.pathname);return i&&it.includes(e.origin)&&!e.username&&!e.password?{href:e.origin+e.pathname,origin:e.origin,id:i[1]}:null}function x(t,e){if(typeof t!="string")return null;let i;try{i=new URL(t,location.href)}catch{return null}if(!/^https?:$/.test(i.protocol)||i.username||i.password)return null;let o=u=>{let l=u.split("=")[0];try{return decodeURIComponent(l.replace(/\+/g," "))}catch{return l}},r=i.search.slice(1).split("&").filter(u=>u&&o(u)!=="session_id");return r.push("session_id="+encodeURIComponent(e)),i.origin+i.pathname+"?"+r.join("&")+i.hash}var f;function z(t,e,i){return new Promise(o=>{let r=!1,u=0,l,a=d=>{clearInterval(s),clearTimeout(l),window.removeEventListener("message",n),i&&d.status==="completed"&&location.assign(i),o(d)},n=d=>{if(d.origin!==e.origin||d.source!==t)return;let g=d.data;if(!g||typeof g!="object")return;g.type==="cd:checkout.ready"&&(r=!0);let h=g.session;if(!(!h||typeof h!="object"||h.id!==e.id)){if(g.type==="cd:checkout.cancelled")a({status:"cancelled",session:{id:e.id}});else if(g.type==="cd:checkout.completed"&&(h.status==="complete"||h.status==="paid")){let p={id:e.id,status:h.status};typeof h.orderId=="string"&&/^[\w-]{1,128}$/.test(h.orderId)&&(p.orderId=h.orderId),a({status:"completed",session:p})}}},c=()=>{try{t.postMessage({type:"cd:checkout.hello"},e.origin)}catch{}},s=setInterval(()=>{t.closed?(clearInterval(s),l=setTimeout(()=>a({status:"closed"}),B)):(!r||++u%rt===0)&&c()},B);window.addEventListener("message",n),c()})}function S(t){let e=()=>new Error("checkout: url is not a Chain Daddy checkout session link"),i=(r,u,l)=>{f={popup:r,result:u,href:l};let a=()=>{f&&f.popup===r&&(f=void 0)};return u.then(a,a),u},o=r=>(location.assign(r.href),{status:"redirected"});try{let{url:r,successUrl:u}=t;if(u&&!x(u,""))throw new Error("checkout: successUrl is not a web address");let l=s=>u?x(u,s.id):null,a=typeof r=="function"?null:I(r);if(typeof r!="function"&&!a)throw e();if(f&&!f.popup.closed&&(!a||f.href===a.href))return f.popup.focus(),f.result;if(a){let s=window.open(a.href,H(),N);return s?i(s,z(s,a,l(a)),a.href):Promise.resolve(o(a))}let n=window.open("",H(),N),c=new Promise(s=>s(r())).then(s=>{let d=I(s);if(!d)throw n?.close(),e();return n?(n.location.href=d.href,z(n,d,l(d))):o(d)},s=>{throw n?.close(),s});return n?i(n,c):c}catch(r){return Promise.reject(r)}}var j=!1,q;function V(){j||typeof document>"u"||(j=!0,document.addEventListener("click",t=>{let e=t.target instanceof Element?t.target.closest("[data-cd-checkout]"):null;if(!e||t.defaultPrevented||t.button||t.metaKey||t.ctrlKey||t.shiftKey||t.altKey)return;let i=e.getAttribute("data-cd-checkout")||e.href,o=e.getAttribute("data-cd-success");if(!I(i)||o&&!x(o,""))return;t.preventDefault();let r=S({url:i,successUrl:o});r!==q&&(q=r,r.then(u=>void e.dispatchEvent(new CustomEvent("cd:checkout",{detail:u,bubbles:!0})),()=>{}))}))}var st={version:R,signIn:k,handleCallback:L,exchangeCode:M,checkout:S};window.ChainDaddy=Object.assign(window.ChainDaddy??{},st);P();D({origin:$(document.currentScript?.src)});V();})();

package/dist/cd.js.sri

@@ -1 +1 @@
-sha384-EF2XlOLUJ0J2U3uy/hlkmXdqyRP0WVm2LYjWdTseg/+QC4El1HD+qMhMlandYcSF
+sha384-x7XiOLUzANtLnqFmv/hWd2uhGI7c+jlhVivakZ7LYHklw9zgK/diic0+fJom/mXU

package/dist/embed.js

@@ -2,6 +2,8 @@
 var PROD_ORIGIN = "https://embed.chaindaddy.io";
 var STAGING_ORIGIN = "https://embed-staging.chaindaddy.io";
 var READY_TIMEOUT_MS = 8e3;
+var NEAR = "1500px 0px";
+var DOCS = "docs.chaindaddy.io/token/apps-on-your-site#if-the-link-stays";
 var MAX_HEIGHT = 4e3;
 var THEME_TOKENS = ["--cd-accent", "--cd-surface", "--cd-text", "--cd-text-muted", "--cd-border"];
 function embedOriginFor(scriptSrc) {
@@ -48,6 +50,7 @@ function defineEmbedElements(options = {}) {
         try {
           window.removeEventListener("message", this.onMessage);
           clearTimeout(this.timer);
+          this.watch?.disconnect();
         } catch {
         }
       }
@@ -84,6 +87,7 @@ function defineEmbedElements(options = {}) {
         const root = this.shadowRoot;
         window.removeEventListener("message", this.onMessage);
         clearTimeout(this.timer);
+        this.watch?.disconnect();
         this.removeAttribute("data-cd-ready");
         this.removeAttribute("data-cd-unavailable");
         const src = this.src();
@@ -94,17 +98,43 @@ function defineEmbedElements(options = {}) {
         }
         root.innerHTML = `<style>${STYLE}</style><slot></slot>`;
         const frame = document.createElement("iframe");
-        frame.setAttribute("loading", "lazy");
         frame.setAttribute("referrerpolicy", "strict-origin-when-cross-origin");
         frame.setAttribute("allow", "clipboard-write; fullscreen");
         frame.setAttribute("title", this.kind === "coin" ? "Coin on Chain Daddy" : "App on Chain Daddy");
-        frame.src = src;
         root.appendChild(frame);
         this.frame = frame;
         window.addEventListener("message", this.onMessage);
-        this.timer = setTimeout(() => {
-          if (!this.hasAttribute("data-cd-ready")) this.unavailable();
-        }, READY_TIMEOUT_MS);
+        const load = () => {
+          frame.src = src;
+          this.timer = setTimeout(() => {
+            if (!this.hasAttribute("data-cd-ready")) this.unavailable();
+          }, READY_TIMEOUT_MS);
+        };
+        if (typeof IntersectionObserver === "undefined") return load();
+        this.watch = new IntersectionObserver(
+          (entries) => {
+            if (!entries.some((e) => e.isIntersecting)) return;
+            this.watch?.disconnect();
+            load();
+          },
+          { rootMargin: NEAR }
+        );
+        this.watch.observe(this);
+      }
+      /** Says in the console why the link stayed: the page sees only that it did. */
+      why() {
+        try {
+          const q = new URL(this.frame.src).searchParams;
+          const app = q.get("app");
+          q.delete("mode");
+          q.delete("v");
+          fetch(`https://${origin === STAGING_ORIGIN ? "staging-api" : "api"}.chaindaddy.io/api/v2/embed/status?${q}`, { credentials: "omit" }).then((r) => r.json()).then((s) => {
+            const reason = !s.embeddable ? s.reason : s.interactive ? "not a verified site of the coin" : "not https, or the app did not start";
+            console.info(`[Chain Daddy] cd-${this.kind} ${app ?? ""} cannot show here: ${reason}. ${DOCS}`);
+          }).catch(() => {
+          });
+        } catch {
+        }
       }
       receive(event) {
         try {
@@ -143,6 +173,7 @@ function defineEmbedElements(options = {}) {
           if (this.hasAttribute("data-cd-unavailable")) return;
           this.setAttribute("data-cd-unavailable", "");
           this.dispatchEvent(new CustomEvent("cd:unavailable"));
+          this.why();
         } catch {
         }
       }

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/core.ts
-var VERSION = true ? "0.3.1" : "0.0.0";
+var VERSION = true ? "0.3.3" : "0.0.0";
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -66,6 +66,7 @@ var AUTHORIZE = {
 var POPUP_NAME = "cd-signin";
 var MESSAGE = "cd:signin";
 var STORAGE_KEY = "cd.signin";
+var TICK_MS = 300;
 async function challengeFor(verifier) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
   return b64url(new Uint8Array(digest));
@@ -91,15 +92,20 @@ async function authorizeURL(o, p, authorize) {
 function result(p, code) {
   return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
 }
+var current;
 function signIn(o) {
   const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
   const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
   if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
   if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  if (current && !current.popup.closed) {
+    current.popup.focus();
+    return current.waiting;
+  }
   const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
   store.set(STORAGE_KEY, JSON.stringify(p));
   const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
-  return (async () => {
+  const waiting = (async () => {
     const url = await authorizeURL(o, p, authorize);
     if (!popup) {
       location.assign(url);
@@ -108,21 +114,43 @@ function signIn(o) {
     popup.location.href = url;
     const callbackOrigin = new URL(o.redirectUri, location.href).origin;
     return new Promise((resolve, reject) => {
+      let last;
+      const end = () => {
+        stop();
+        clearInterval(timer);
+        clearTimeout(last);
+      };
       const stop = listen(MESSAGE, callbackOrigin, (m) => {
         if (m.state !== p.state) return;
-        stop();
+        end();
         store.remove(STORAGE_KEY);
         if (typeof m.error === "string" && m.error) reject(new Error(m.error));
         else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
         else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
         else resolve(result(p, m.code));
       }, POPUP_NAME, popup);
+      const timer = setInterval(() => {
+        if (!popup.closed) return;
+        clearInterval(timer);
+        last = setTimeout(() => {
+          end();
+          reject(new Error("closed"));
+        }, TICK_MS);
+      }, TICK_MS);
       o.signal?.addEventListener("abort", () => {
-        stop();
+        end();
         reject(new Error("aborted"));
       });
     });
   })();
+  if (popup) {
+    current = { popup, waiting };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    waiting.then(over, over);
+  }
+  return waiting;
 }
 async function handleCallback() {
   const q = new URLSearchParams(location.search);
@@ -196,14 +224,17 @@ function defineSignInButton() {
     }
     start() {
       const attr = (n) => this.getAttribute(n) || void 0;
-      signIn({
+      const visit = signIn({
         clientId: attr("client-id") ?? "",
         redirectUri: attr("redirect-uri") ?? "",
         scope: attr("scope"),
         claims: attr("claims"),
         issuer: attr("issuer"),
         authorizeUrl: attr("authorize-url")
-      }).then(
+      });
+      if (visit === this.reporting) return;
+      this.reporting = visit;
+      visit.then(
         (r) => r && this.dispatchEvent(new CustomEvent("cd-signin", { detail: r, bubbles: true, composed: true })),
         (e) => this.dispatchEvent(new CustomEvent("cd-signin-error", { detail: { message: String(e?.message ?? e) }, bubbles: true, composed: true }))
       );
@@ -217,6 +248,8 @@ function defineSignInButton() {
 var PROD_ORIGIN = "https://embed.chaindaddy.io";
 var STAGING_ORIGIN = "https://embed-staging.chaindaddy.io";
 var READY_TIMEOUT_MS = 8e3;
+var NEAR = "1500px 0px";
+var DOCS = "docs.chaindaddy.io/token/apps-on-your-site#if-the-link-stays";
 var MAX_HEIGHT = 4e3;
 var THEME_TOKENS = ["--cd-accent", "--cd-surface", "--cd-text", "--cd-text-muted", "--cd-border"];
 function embedOriginFor(scriptSrc) {
@@ -263,6 +296,7 @@ function defineEmbedElements(options = {}) {
         try {
           window.removeEventListener("message", this.onMessage);
           clearTimeout(this.timer);
+          this.watch?.disconnect();
         } catch {
         }
       }
@@ -299,6 +333,7 @@ function defineEmbedElements(options = {}) {
         const root = this.shadowRoot;
         window.removeEventListener("message", this.onMessage);
         clearTimeout(this.timer);
+        this.watch?.disconnect();
         this.removeAttribute("data-cd-ready");
         this.removeAttribute("data-cd-unavailable");
         const src = this.src();
@@ -309,17 +344,43 @@ function defineEmbedElements(options = {}) {
         }
         root.innerHTML = `<style>${STYLE2}</style><slot></slot>`;
         const frame = document.createElement("iframe");
-        frame.setAttribute("loading", "lazy");
         frame.setAttribute("referrerpolicy", "strict-origin-when-cross-origin");
         frame.setAttribute("allow", "clipboard-write; fullscreen");
         frame.setAttribute("title", this.kind === "coin" ? "Coin on Chain Daddy" : "App on Chain Daddy");
-        frame.src = src;
         root.appendChild(frame);
         this.frame = frame;
         window.addEventListener("message", this.onMessage);
-        this.timer = setTimeout(() => {
-          if (!this.hasAttribute("data-cd-ready")) this.unavailable();
-        }, READY_TIMEOUT_MS);
+        const load = () => {
+          frame.src = src;
+          this.timer = setTimeout(() => {
+            if (!this.hasAttribute("data-cd-ready")) this.unavailable();
+          }, READY_TIMEOUT_MS);
+        };
+        if (typeof IntersectionObserver === "undefined") return load();
+        this.watch = new IntersectionObserver(
+          (entries) => {
+            if (!entries.some((e) => e.isIntersecting)) return;
+            this.watch?.disconnect();
+            load();
+          },
+          { rootMargin: NEAR }
+        );
+        this.watch.observe(this);
+      }
+      /** Says in the console why the link stayed: the page sees only that it did. */
+      why() {
+        try {
+          const q = new URL(this.frame.src).searchParams;
+          const app = q.get("app");
+          q.delete("mode");
+          q.delete("v");
+          fetch(`https://${origin === STAGING_ORIGIN ? "staging-api" : "api"}.chaindaddy.io/api/v2/embed/status?${q}`, { credentials: "omit" }).then((r) => r.json()).then((s) => {
+            const reason = !s.embeddable ? s.reason : s.interactive ? "not a verified site of the coin" : "not https, or the app did not start";
+            console.info(`[Chain Daddy] cd-${this.kind} ${app ?? ""} cannot show here: ${reason}. ${DOCS}`);
+          }).catch(() => {
+          });
+        } catch {
+        }
       }
       receive(event) {
         try {
@@ -358,6 +419,7 @@ function defineEmbedElements(options = {}) {
           if (this.hasAttribute("data-cd-unavailable")) return;
           this.setAttribute("data-cd-unavailable", "");
           this.dispatchEvent(new CustomEvent("cd:unavailable"));
+          this.why();
         } catch {
         }
       }
@@ -402,7 +464,7 @@ function defineEmbedElements(options = {}) {
 var ORIGINS = ["https://chaindaddy.io", "https://staging.chaindaddy.io"];
 var windowName = () => "cd-checkout-" + randomToken();
 var FEATURES = "popup,width=480,height=820";
-var TICK_MS = 300;
+var TICK_MS2 = 300;
 var QUIET_TICKS = 7;
 function parseCheckoutUrl(url) {
   if (typeof url !== "string") return null;
@@ -436,7 +498,7 @@ function successTarget(successUrl, id) {
   pairs.push("session_id=" + encodeURIComponent(id));
   return u.origin + u.pathname + "?" + pairs.join("&") + u.hash;
 }
-var current;
+var current2;
 function wait(popup, target, success) {
   return new Promise((resolve) => {
     let ready = false;
@@ -472,9 +534,9 @@ function wait(popup, target, success) {
     const timer = setInterval(() => {
       if (popup.closed) {
         clearInterval(timer);
-        last = setTimeout(() => done({ status: "closed" }), TICK_MS);
+        last = setTimeout(() => done({ status: "closed" }), TICK_MS2);
       } else if (!ready || ++quiet % QUIET_TICKS === 0) hello();
-    }, TICK_MS);
+    }, TICK_MS2);
     window.addEventListener("message", onMessage);
     hello();
   });
@@ -482,9 +544,9 @@ function wait(popup, target, success) {
 function checkout(o) {
   const refused = () => new Error("checkout: url is not a Chain Daddy checkout session link");
   const track = (popup, result2, href) => {
-    current = { popup, result: result2, href };
+    current2 = { popup, result: result2, href };
     const over = () => {
-      if (current && current.popup === popup) current = void 0;
+      if (current2 && current2.popup === popup) current2 = void 0;
     };
     result2.then(over, over);
     return result2;
@@ -499,9 +561,9 @@ function checkout(o) {
     const success = (t) => successUrl ? successTarget(successUrl, t.id) : null;
     const target = typeof url === "function" ? null : parseCheckoutUrl(url);
     if (typeof url !== "function" && !target) throw refused();
-    if (current && !current.popup.closed && (!target || current.href === target.href)) {
-      current.popup.focus();
-      return current.result;
+    if (current2 && !current2.popup.closed && (!target || current2.href === target.href)) {
+      current2.popup.focus();
+      return current2.result;
     }
     if (target) {
       const popup2 = window.open(target.href, windowName(), FEATURES);

package/dist/signin.d.ts

@@ -12,7 +12,7 @@ export interface SignInOptions {
     issuer?: string;
     /** The consent page; derived from the issuer for Chain Daddy's own. */
     authorizeUrl?: string;
-    /** Stops waiting. Closing the popup does not: a closed-looking popup is not a cancel. */
+    /** Stops waiting: the call rejects "aborted". */
     signal?: AbortSignal;
 }
 /** What your server exchanges at the token endpoint (or exchangeCode does here). */
@@ -32,8 +32,9 @@ export declare function challengeFor(verifier: string): Promise<string>;
  * before anything is awaited, or a browser blocks it. Resolves with the code
  * once the visitor approves; resolves null when the popup was blocked and the
  * page is redirecting instead (your callback page then calls handleCallback).
- * Rejects when they cancel (access_denied) or the answer is not for this
- * request.
+ * Rejects when they cancel (access_denied), when they close the popup without
+ * answering (closed), or when the answer is not for this request. While one
+ * sign-in is open, another call shows its popup and returns the same promise.
  */
 export declare function signIn(o: SignInOptions): Promise<SignInResult | null>;
 /**

package/dist/signin.js

@@ -65,6 +65,7 @@ var AUTHORIZE = {
 var POPUP_NAME = "cd-signin";
 var MESSAGE = "cd:signin";
 var STORAGE_KEY = "cd.signin";
+var TICK_MS = 300;
 async function challengeFor(verifier) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
   return b64url(new Uint8Array(digest));
@@ -90,15 +91,20 @@ async function authorizeURL(o, p, authorize) {
 function result(p, code) {
   return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
 }
+var current;
 function signIn(o) {
   const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
   const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
   if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
   if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  if (current && !current.popup.closed) {
+    current.popup.focus();
+    return current.waiting;
+  }
   const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
   store.set(STORAGE_KEY, JSON.stringify(p));
   const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
-  return (async () => {
+  const waiting = (async () => {
     const url = await authorizeURL(o, p, authorize);
     if (!popup) {
       location.assign(url);
@@ -107,21 +113,43 @@ function signIn(o) {
     popup.location.href = url;
     const callbackOrigin = new URL(o.redirectUri, location.href).origin;
     return new Promise((resolve, reject) => {
+      let last;
+      const end = () => {
+        stop();
+        clearInterval(timer);
+        clearTimeout(last);
+      };
       const stop = listen(MESSAGE, callbackOrigin, (m) => {
         if (m.state !== p.state) return;
-        stop();
+        end();
         store.remove(STORAGE_KEY);
         if (typeof m.error === "string" && m.error) reject(new Error(m.error));
         else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
         else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
         else resolve(result(p, m.code));
       }, POPUP_NAME, popup);
+      const timer = setInterval(() => {
+        if (!popup.closed) return;
+        clearInterval(timer);
+        last = setTimeout(() => {
+          end();
+          reject(new Error("closed"));
+        }, TICK_MS);
+      }, TICK_MS);
       o.signal?.addEventListener("abort", () => {
-        stop();
+        end();
         reject(new Error("aborted"));
       });
     });
   })();
+  if (popup) {
+    current = { popup, waiting };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    waiting.then(over, over);
+  }
+  return waiting;
 }
 async function handleCallback() {
   const q = new URLSearchParams(location.search);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/js",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), a coin's apps on its own site (<cd-app>), checkout for a coin's store in a popup, and a server-side check that a store order was paid on chain",
   "homepage": "https://docs.chaindaddy.io/developer/javascript-sdk",
   "repository": {