@chaindaddy/js 0.3.2 → 0.3.4

package/dist/api.d.ts

@@ -987,16 +987,18 @@ export interface paths {
          *     goes are the item's own, exactly as when it is bought on chaindaddy.io: a session changes none of them.
          *
          *     `successUrl` and `cancelUrl` must be `https` pages on one of the coin's verified sites, or a subdomain of
-         *     one (400 `RETURN_URL_NOT_VERIFIED`, which lists the sites that pass). The wallet that opened the store
-         *     must have signed the Seller Terms (403 `SELLER_TERMS_REQUIRED`).
+         *     one (400 `RETURN_URL_NOT_VERIFIED`, which lists the sites that pass). A test store's key
+         *     (`cd_iap_test_…`) may also use `http://localhost` or `http://127.0.0.1`, on any port: test mode works on
+         *     localhost, live needs a verified site. The wallet that opened the store must have signed the Seller
+         *     Terms (403 `SELLER_TERMS_REQUIRED`).
          *
          *     An item of an app installed on the coin's page (its `sku` starts with `app.`) is sold through a session
          *     only when the app's developer has allowed that item to be sold outside the app; otherwise the call answers
          *     409 `APP_ITEM_NOT_SOLD_HERE`, with a `reason`. The sale pays the same wallets as inside the app: the page,
          *     the fee and the developer's share. Such a session takes at most the app's per-order quantity.
          *
-         *     Send an `Idempotency-Key`. A retry of the same request returns the session it opened, with status 200
-         *     and the header `Idempotent-Replayed: true`.
+         *     An `Idempotency-Key` is required. A retry of the same request returns the session it opened, with
+         *     status 200 and the header `Idempotent-Replayed: true`.
          *
          *     Learn that the session was paid from the `iap.order.confirmed` webhook (its payload carries
          *     `checkoutSessionId`), or by reading the session. Never from the buyer arriving on `successUrl`.
@@ -1054,12 +1056,13 @@ export interface paths {
          *     needs no credential (the session id in the buyer's link is enough) and never carries the session's
          *     `metadata` or `clientReferenceId`. The answer is never cached.
          *
-         *     When the item belongs to an app installed on the coin's page, `sku` names the app (`appId`) and carries
-         *     nothing else of the app's: no `appBps`, `appTermsVersion`, `appItemKey` or `appRole`, and an empty
-         *     `metadata`.
+         *     When the item belongs to an app installed on the coin's page, `sku` names the app (`appId`) and the
+         *     share of the price its developer gets (`appBps`, basis points of the price after the fee), and carries
+         *     nothing else of the app's: no `appTermsVersion`, `appItemKey` or `appRole`, and an empty `metadata`.
          *
          *     Pass `origin` to learn whether a page on that origin may open this checkout in a popup
-         *     (`openerAllowed`): it must be `https` on one of the coin's verified sites.
+         *     (`openerAllowed`): it must be `https` on one of the coin's verified sites. A test store's session
+         *     (`livemode: false`) may also be opened from `http://localhost` or `http://127.0.0.1`, on any port.
          *
          *     `returnAllowed` says whether the buyer may still be sent to `successUrl` and `cancelUrl`. It is checked
          *     again on every read, so a coin whose site stopped being verified after the session was opened no longer
@@ -1074,6 +1077,48 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v2/iap/checkout/sessions/{sessionId}/test-pay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The checkout session's id, `cs_` followed by 48 hex characters */
+                sessionId: components["parameters"]["IapCheckoutSessionId"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Complete a test checkout session
+         * @description Completes a test store's checkout session from your own server or terminal, with no buyer signed in
+         *     and no wallet: the whole loop (open a session, pay it, get the webhook, read it `complete`) with
+         *     nothing but a test store's key. It makes the session's order for `wallet` and pays it as
+         *     `POST /api/v2/iap/orders/{orderId}/test-pay` does: the items are granted, the receipt is signed and the
+         *     test store's webhook gets `iap.order.confirmed` with `checkoutSessionId` and `"livemode": false`. No
+         *     chain is read or written and no money moves. A pay page left open on the session notices within a
+         *     few seconds and takes the buyer back.
+         *
+         *     Call it with a key of the session's test store (`cd_iap_test_…`, scope `orders:write`). `wallet` is the
+         *     wallet the test items go to: required unless the session names one, and then it must be that wallet
+         *     (403 `CHECKOUT_SESSION_WALLET`). The answer is the session as `GET` returns it: `status: complete`,
+         *     the order and its receipt.
+         *
+         *     `Idempotency-Key` is required. A retry of the same request returns the same order, with the header
+         *     `Idempotent-Replayed: true`; the key used for a different session or wallet is a 422.
+         *
+         *     Test stores only. A live store's session is only ever paid by the buyer on chaindaddy.io: a live
+         *     store's key gets 409 `LIVE_ORDER` and nothing is created. A key of any other store gets 404. An item
+         *     of an installed app cannot be bought with a store key (403 `SESSION_REQUIRED`); pay that session on
+         *     its page. Guide: https://docs.chaindaddy.io/developer/take-payments-on-your-site#test-mode
+         */
+        post: operations["testPayIapCheckoutSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v2/webhooks": {
         parameters: {
             query?: never;
@@ -2228,7 +2273,8 @@ export interface components {
             /** @description Whether a page on the `origin` passed may open this checkout in a popup. False when no `origin` is passed */
             openerAllowed?: boolean;
             /**
-             * @description Whether `successUrl` and `cancelUrl` are both still on the coin's verified sites, as of this read.
+             * @description Whether `successUrl` and `cancelUrl` are both still on the coin's verified sites, as of this read
+             *     (for a test store's session, a URL on `http://localhost` or `http://127.0.0.1` also counts).
              *     When false the buyer is not sent to either
              */
             returnAllowed?: boolean;
@@ -2805,7 +2851,7 @@ export interface components {
                 "application/json": components["schemas"]["IapError"];
             };
         };
-        /** @description No wallet session */
+        /** @description `AUTHENTICATION_REQUIRED`: no credential at all. Sign in, or send the credential the operation names */
         IapUnauthorized: {
             headers: {
                 [name: string]: unknown;
@@ -2813,8 +2859,8 @@ export interface components {
             content: {
                 /**
                  * @example {
-                 *       "error": "sign in first",
-                 *       "code": "UNAUTHORIZED"
+                 *       "error": "authentication required",
+                 *       "code": "AUTHENTICATION_REQUIRED"
                  *     }
                  */
                 "application/json": components["schemas"]["IapError"];
@@ -4873,7 +4919,8 @@ export interface operations {
                     appAccountToken?: string;
                     /**
                      * @description The checkout session the buyer is paying. A buyer's session only: a store key gets 403
-                     *     `SESSION_REQUIRED`. 409 `CHECKOUT_SESSION_EXPIRED` or `CHECKOUT_SESSION_COMPLETE` when the
+                     *     `SESSION_REQUIRED` (a test store's key completes its own test session with
+                     *     `POST /api/v2/iap/checkout/sessions/{sessionId}/test-pay` instead). 409 `CHECKOUT_SESSION_EXPIRED` or `CHECKOUT_SESSION_COMPLETE` when the
                      *     session can no longer be paid; 403 `CHECKOUT_SESSION_WALLET` when it names another wallet.
                      *     A session takes one buyer at a time: 409 `CHECKOUT_SESSION_IN_USE` while another wallet has
                      *     an order for it that can still be paid, or is paid and being confirmed
@@ -4899,9 +4946,24 @@ export interface operations {
                 };
             };
             400: components["responses"]["IapBadRequest"];
+            /**
+             * @description `AUTHENTICATION_REQUIRED`: no credential at all. The buyer signs in, or your server sends a store key
+             *     (`Authorization: Bearer cd_iap_…`); an order for a checkout session is the signed-in buyer's only.
+             *     `INVALID_STORE_KEY`: the key is unknown or revoked
+             */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
             /**
              * @description Not allowed, the purchase rule is not met, or the store is not taking orders. `APP_ITEM_NOT_YOURS`: an
-             *     app asked for another app's item, or an app's item was asked for outside its app
+             *     app asked for another app's item, or an app's item was asked for outside its app. For a checkout
+             *     session: `SESSION_REQUIRED` (a store key tried to pay it) or `CHECKOUT_SESSION_WALLET` (the session
+             *     names another wallet)
              */
             403: {
                 headers: {
@@ -4911,12 +4973,26 @@ export interface operations {
                     "application/json": components["schemas"]["IapError"];
                 };
             };
+            /**
+             * @description `NOT_FOUND`: no such store, or no such checkout session. `SKU_NOT_FOR_SALE`: no such item in the store.
+             *     `CHECKOUT_SESSIONS_DISABLED`: the order names a checkout session where sessions are not switched on
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
             /**
              * @description Sold out, or the wallet has reached the SKU's per-wallet limit. For an app's item: `APP_TERMS_CHANGED`
              *     (its developer changed its terms and the page's owner has not accepted them yet), `APP_NOT_INSTALLED`,
              *     `APP_NOT_SELLING`, `APP_ORDER_LIMIT` (above the per-purchase limit) or `APP_DAILY_LIMIT` (the wallet
              *     reached what it may pay that app in 24 hours). For an app's item paid through a checkout session:
-             *     `APP_ITEM_NOT_SOLD_HERE`, with a `reason`
+             *     `APP_ITEM_NOT_SOLD_HERE`, with a `reason`. For any checkout session: `CHECKOUT_SESSION_EXPIRED`,
+             *     `CHECKOUT_SESSION_COMPLETE` (already paid) or `CHECKOUT_SESSION_IN_USE` (another wallet is paying it
+             *     right now)
              */
             409: {
                 headers: {
@@ -5077,7 +5153,9 @@ export interface operations {
                     }[];
                     /**
                      * Format: uri
-                     * @description Where the buyer returns after paying. `https`, on one of the coin's verified sites
+                     * @description Where the buyer returns after paying. `https`, on one of the coin's verified sites or a
+                     *     subdomain of one. With a test store's key it may also be `http://localhost` or
+                     *     `http://127.0.0.1`, on any port
                      */
                     successUrl: string;
                     /**
@@ -5125,8 +5203,10 @@ export interface operations {
                 };
             };
             /**
-             * @description `INVALID_REQUEST`, `IDEMPOTENCY_KEY_REQUIRED`, or `RETURN_URL_NOT_VERIFIED`: a return URL is not an
-             *     `https` page on one of the coin's verified sites
+             * @description `INVALID_REQUEST`, `IDEMPOTENCY_KEY_REQUIRED`, `IDEMPOTENCY_KEY_INVALID` (a key longer than 255
+             *     characters), or `RETURN_URL_NOT_VERIFIED`: a return URL is not an
+             *     `https` page on one of the coin's verified sites (nor, with a test store's key, `http://localhost` or
+             *     `http://127.0.0.1`). A live store's key is always refused a localhost URL
              */
             400: {
                 headers: {
@@ -5136,7 +5216,11 @@ export interface operations {
                     "application/json": components["schemas"]["IapError"];
                 };
             };
-            /** @description No store key, or one that is unknown or revoked (`INVALID_STORE_KEY`) */
+            /**
+             * @description `AUTHENTICATION_REQUIRED`: no credential at all; send the store key as
+             *     `Authorization: Bearer cd_iap_…`. `INVALID_STORE_KEY`: the key is unknown or revoked.
+             *     `TEST_MODE_DISABLED`: a test key where test mode is not available
+             */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5217,7 +5301,11 @@ export interface operations {
                     "application/json": components["schemas"]["IapCheckoutSession"];
                 };
             };
-            /** @description No store key, or one that is unknown or revoked */
+            /**
+             * @description `AUTHENTICATION_REQUIRED`: no credential at all; send the store key as
+             *     `Authorization: Bearer cd_iap_…`. `INVALID_STORE_KEY`: the key is unknown or revoked.
+             *     `TEST_MODE_DISABLED`: a test key where test mode is not available
+             */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5235,13 +5323,24 @@ export interface operations {
                     "application/json": components["schemas"]["IapError"];
                 };
             };
-            404: components["responses"]["IapNotFound"];
+            /**
+             * @description `NOT_FOUND`: no such session, or it belongs to another store. `CHECKOUT_SESSIONS_DISABLED`: checkout
+             *     sessions are not switched on here, or are open to test stores only and the key is a live store's
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
         };
     };
     getIapPublicCheckoutSession: {
         parameters: {
             query?: {
-                /** @description The origin of the page that opened the checkout, e.g. `https://example.com` */
+                /** @description The origin of the page that opened the checkout, e.g. `https://example.com` (or `http://localhost:3000` for a test store's session) */
                 origin?: string;
             };
             header?: never;
@@ -5262,7 +5361,147 @@ export interface operations {
                     "application/json": components["schemas"]["IapPublicCheckoutSession"];
                 };
             };
-            404: components["responses"]["IapNotFound"];
+            /**
+             * @description `NOT_FOUND`: no such session. `CHECKOUT_SESSIONS_DISABLED`: checkout sessions are not switched on
+             *     here, or are open to test stores only and the session is a live store's
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+        };
+    };
+    testPayIapCheckoutSession: {
+        parameters: {
+            query?: never;
+            header: {
+                /**
+                 * @description Required: a call without it answers 400 `IDEMPOTENCY_KEY_REQUIRED`. Send one value per attempt (a UUID,
+                 *     or an id of your own such as `cart-8842-attempt-1`), up to 255 characters. Retrying with the same key
+                 *     and the same request returns the first result and never sells, grants or consumes twice.
+                 */
+                "Idempotency-Key": components["parameters"]["IdempotencyKeyRequired"];
+            };
+            path: {
+                /** @description The checkout session's id, `cs_` followed by 48 hex characters */
+                sessionId: components["parameters"]["IapCheckoutSessionId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                /**
+                 * @example {
+                 *       "wallet": "0x00000000000000000000000000000000000000d4"
+                 *     }
+                 */
+                "application/json": {
+                    /**
+                     * @description The wallet the test items go to: an address on the store's chain. Required unless the
+                     *     session names a wallet; when it does, leave this out or send the same wallet
+                     */
+                    wallet?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description The session, complete, with the order that paid it and its receipt */
+            200: {
+                headers: {
+                    /** @description Present, and `true`, on a retry of a request already made under this `Idempotency-Key` */
+                    "Idempotent-Replayed"?: "true";
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapCheckoutSession"];
+                };
+            };
+            /**
+             * @description `IDEMPOTENCY_KEY_REQUIRED`, or `INVALID_REQUEST`: no `wallet` and the session names none, a `wallet`
+             *     that is not an address on the store's chain, or a body that is not the JSON above
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `AUTHENTICATION_REQUIRED`: no credential at all; send the test store's key as
+             *     `Authorization: Bearer cd_iap_test_…`. `INVALID_STORE_KEY`: the key is unknown or revoked
+             */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `STORE_KEY_REQUIRED`: called with a signed-in session instead of a store key. `SCOPE_REQUIRED`: the
+             *     key lacks `orders:write`. `CHECKOUT_SESSION_WALLET`: the session names another wallet.
+             *     `IAP_PLAN_REQUIRED` or `STORE_NOT_LIVE`: the store's plan lapsed or the store is paused.
+             *     `SESSION_REQUIRED`: the session's item belongs to an installed app
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `NOT_FOUND`: no such session, or it belongs to another store. `TEST_MODE_DISABLED`: test stores are
+             *     not available here. `CHECKOUT_SESSIONS_DISABLED`: checkout sessions are not switched on here
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `LIVE_ORDER`: the session belongs to a live store. `CHECKOUT_SESSION_COMPLETE`: it is already paid.
+             *     `CHECKOUT_SESSION_EXPIRED`: it expired; open a new one. `CHECKOUT_SESSION_IN_USE`: another wallet
+             *     has an unpaid order for it; use that wallet, or wait a few minutes past that order's deadline.
+             *     `ORDER_EXPIRED`: the order this `Idempotency-Key` made has lapsed; use a new key
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "this is a live checkout session: it is paid by the buyer on chaindaddy.io, and test-pay pays a test store's sessions only",
+                     *       "code": "LIVE_ORDER"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `IDEMPOTENCY_KEY_REUSED`: this `Idempotency-Key` already made an order for a different session or
+             *     wallet. Nothing is returned or created; use a new key
+             */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
         };
     };
     listWebhooks: {

package/dist/cd.js

@@ -1,4 +1,4 @@
-"use strict";(()=>{var S="0.3.2";function k(t){let e="";for(let i of t)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function f(){return k(crypto.getRandomValues(new Uint8Array(32)))}function R(t,e,i,s,o){let u=n=>{if(n&&typeof n=="object"&&n.type===t)try{i(n)}catch{}},l=n=>{n.origin===e&&(!o||n.source===o)&&u(n.data)};window.addEventListener("message",l);let a=null;if(s&&typeof BroadcastChannel=="function"&&e===location.origin)try{a=new BroadcastChannel(s),a.onmessage=n=>u(n.data)}catch{a=null}return()=>{window.removeEventListener("message",l),a?.close()}}var m={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var q="https://api.chaindaddy.io",V={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},w="cd-signin",T="cd:signin",y="cd.signin";async function F(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return k(new Uint8Array(e))}function G(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function K(t,e,i){let s=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:G(t.scope),state:e.state,nonce:e.nonce,code_challenge:await F(e.verifier),code_challenge_method:"S256"});return t.claims&&s.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${i}?${s}`}function U(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}function b(t){let e=(t.issuer??q).replace(/\/$/,""),i=t.authorizeUrl??V[e];if(!i)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let s={state:f(),nonce:f(),verifier:f(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};m.set(y,JSON.stringify(s));let o=window.open("",w,"popup,width=480,height=720");return(async()=>{let u=await K(t,s,i);if(!o)return location.assign(u),null;o.location.href=u;let l=new URL(t.redirectUri,location.href).origin;return new Promise((a,n)=>{let c=R(T,l,r=>{r.state===s.state&&(c(),m.remove(y),typeof r.error=="string"&&r.error?n(new Error(r.error)):r.iss!==e?n(new Error("the answer came from another issuer")):typeof r.code!="string"||!r.code?n(new Error("the answer carried no code")):a(U(s,r.code)))},w,o);t.signal?.addEventListener("abort",()=>{c(),n(new Error("aborted"))})})})()}async function _(){let t=new URLSearchParams(location.search),e={type:T,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===w){try{window.opener?.postMessage(e,location.origin)}catch{}try{let o=new BroadcastChannel(w);o.postMessage(e),o.close()}catch{}return window.close(),null}let i=m.get(y);m.remove(y);let s=i?JSON.parse(i):null;if(!s||e.state!==s.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==s.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return U(s,e.code)}async function A(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),i=await e.json();if(!e.ok)throw new Error(`${i.error??e.status}: ${i.error_description??""}`.trim());return i}var W='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',Y=`
+"use strict";(()=>{var R="0.3.4";function C(t){let e="";for(let i of t)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function w(){return C(crypto.getRandomValues(new Uint8Array(32)))}function T(t,e,i,o,r){let u=n=>{if(n&&typeof n=="object"&&n.type===t)try{i(n)}catch{}},l=n=>{n.origin===e&&(!r||n.source===r)&&u(n.data)};window.addEventListener("message",l);let a=null;if(o&&typeof BroadcastChannel=="function"&&e===location.origin)try{a=new BroadcastChannel(o),a.onmessage=n=>u(n.data)}catch{a=null}return()=>{window.removeEventListener("message",l),a?.close()}}var y={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var F="https://api.chaindaddy.io",G={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},b="cd-signin",U="cd:signin",v="cd.signin",_=300;async function K(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return C(new Uint8Array(e))}function W(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function Y(t,e,i){let o=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:W(t.scope),state:e.state,nonce:e.nonce,code_challenge:await K(e.verifier),code_challenge_method:"S256"});return t.claims&&o.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${i}?${o}`}function A(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}var m;function k(t){let e=(t.issuer??F).replace(/\/$/,""),i=t.authorizeUrl??G[e];if(!i)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));if(m&&!m.popup.closed)return m.popup.focus(),m.waiting;let o={state:w(),nonce:w(),verifier:w(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};y.set(v,JSON.stringify(o));let r=window.open("",b,"popup,width=480,height=720"),u=(async()=>{let l=await Y(t,o,i);if(!r)return location.assign(l),null;r.location.href=l;let a=new URL(t.redirectUri,location.href).origin;return new Promise((n,c)=>{let s,d=()=>{g(),clearInterval(h),clearTimeout(s)},g=T(U,a,p=>{p.state===o.state&&(d(),y.remove(v),typeof p.error=="string"&&p.error?c(new Error(p.error)):p.iss!==e?c(new Error("the answer came from another issuer")):typeof p.code!="string"||!p.code?c(new Error("the answer carried no code")):n(A(o,p.code)))},b,r),h=setInterval(()=>{r.closed&&(clearInterval(h),s=setTimeout(()=>{d(),c(new Error("closed"))},_))},_);t.signal?.addEventListener("abort",()=>{d(),c(new Error("aborted"))})})})();if(r){m={popup:r,waiting:u};let l=()=>{m&&m.popup===r&&(m=void 0)};u.then(l,l)}return u}async function L(){let t=new URLSearchParams(location.search),e={type:U,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===b){try{window.opener?.postMessage(e,location.origin)}catch{}try{let r=new BroadcastChannel(b);r.postMessage(e),r.close()}catch{}return window.close(),null}let i=y.get(v);y.remove(v);let o=i?JSON.parse(i):null;if(!o||e.state!==o.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==o.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return A(o,e.code)}async function M(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),i=await e.json();if(!e.ok)throw new Error(`${i.error??e.status}: ${i.error_description??""}`.trim());return i}var J='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',X=`
 :host { display: inline-block; }
 button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
   min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
@@ -7,16 +7,16 @@ button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #
 button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
 button:disabled { opacity: .6; cursor: default; }
 svg { flex: none; }
-`;function L(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let i=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",s=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${Y}</style><button type="button" part="button" data-theme="${s}">${W}<span></span></button>`;let o=this.root.querySelector("button");o.querySelector("span").textContent=i,o.addEventListener("click",()=>this.start())}start(){let i=s=>this.getAttribute(s)||void 0;b({clientId:i("client-id")??"",redirectUri:i("redirect-uri")??"",scope:i("scope"),claims:i("claims"),issuer:i("issuer"),authorizeUrl:i("authorize-url")}).then(s=>s&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:s,bubbles:!0,composed:!0})),s=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(s?.message??s)},bubbles:!0,composed:!0})))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var M="https://embed.chaindaddy.io",v="https://embed-staging.chaindaddy.io";var J="1500px 0px",X="docs.chaindaddy.io/token/apps-on-your-site#if-the-link-stays";var Q=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function O(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return v}catch{}return M}var Z=`
+`;function P(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let i=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",o=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${X}</style><button type="button" part="button" data-theme="${o}">${J}<span></span></button>`;let r=this.root.querySelector("button");r.querySelector("span").textContent=i,r.addEventListener("click",()=>this.start())}start(){let i=r=>this.getAttribute(r)||void 0,o=k({clientId:i("client-id")??"",redirectUri:i("redirect-uri")??"",scope:i("scope"),claims:i("claims"),issuer:i("issuer"),authorizeUrl:i("authorize-url")});o!==this.reporting&&(this.reporting=o,o.then(r=>r&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:r,bubbles:!0,composed:!0})),r=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(r?.message??r)},bubbles:!0,composed:!0}))))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var O="https://embed.chaindaddy.io",E="https://embed-staging.chaindaddy.io";var Q="1500px 0px",Z="docs.chaindaddy.io/token/apps-on-your-site#if-the-link-stays";var tt=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function $(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return E}catch{}return O}var et=`
 :host { display: block; }
 iframe { display: block; width: 100%; border: 0; height: 1px; opacity: 0; color-scheme: normal; }
 :host([data-cd-ready]) iframe { opacity: 1; }
 :host([data-cd-ready]) slot { display: none; }
 :host([data-cd-unavailable]) iframe { display: none; }
-`,tt=`
+`,nt=`
 :host { display: inline-block; }
 button { box-sizing: border-box; min-height: 40px; padding: 0 16px; border-radius: 10px; cursor: pointer;
   font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
   border: 1px solid var(--cd-border, #d0d5dd); background: var(--cd-accent, #f59e0b); color: var(--cd-text, #101828); }
 button:focus-visible { outline: 2px solid var(--cd-accent, #f59e0b); outline-offset: 2px; }
-`;function P(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===v?v:M;class i extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=n=>this.receive(n)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.watch?.disconnect()}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let n=(this.getAttribute("crown")??"").trim(),c=(this.getAttribute("chain")??"").trim(),r=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(n)||!c||this.kind==="app"&&!r)return null;let d=new URLSearchParams({crown:n,chain:c});return this.kind==="app"?d.set("app",r):d.set("kind","coin"),d.set("mode",this.mode()),d.set("v","1"),`${e}/v1/frame?${d.toString()}`}mode(){let n=this.getAttribute("mode");if(n==="light"||n==="dark")return n;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let n=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.watch?.disconnect(),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let c=this.src();if(!c){n.innerHTML="<slot></slot>",this.frame=null;return}n.innerHTML=`<style>${Z}</style><slot></slot>`;let r=document.createElement("iframe");r.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),r.setAttribute("allow","clipboard-write; fullscreen"),r.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),n.appendChild(r),this.frame=r,window.addEventListener("message",this.onMessage);let d=()=>{r.src=c,this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)};if(typeof IntersectionObserver>"u")return d();this.watch=new IntersectionObserver(g=>{g.some(h=>h.isIntersecting)&&(this.watch?.disconnect(),d())},{rootMargin:J}),this.watch.observe(this)}why(){try{let n=new URL(this.frame.src).searchParams,c=n.get("app");n.delete("mode"),n.delete("v"),fetch(`https://${e===v?"staging-api":"api"}.chaindaddy.io/api/v2/embed/status?${n}`,{credentials:"omit"}).then(r=>r.json()).then(r=>{let d=r.embeddable?r.interactive?"not a verified site of the coin":"not https, or the app did not start":r.reason;console.info(`[Chain Daddy] cd-${this.kind} ${c??""} cannot show here: ${d}. ${X}`)}).catch(()=>{})}catch{}}receive(n){try{if(n.origin!==e||!this.frame||!n.source||n.source!==this.frame.contentWindow)return;let c=n.data;if(!c||typeof c!="object")return;if(c.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(c.type==="cd:resize"){let r=Number(c.height);Number.isFinite(r)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(r)))}px`)}else c.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let n={},c=getComputedStyle(this);for(let r of Q){let d=c.getPropertyValue(r).trim();d&&(n[r]=d)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:n},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable")),this.why()}catch{}}}i.observedAttributes=["crown","chain","app","mode"];class s extends i{}class o extends i{constructor(){super(...arguments);this.kind="coin"}}class u extends HTMLElement{connectedCallback(){try{let a=this.querySelector("a[href]"),n=a?new URL(a.getAttribute("href")??"",document.baseURI):null;if(!n||n.protocol!=="https:")return;let c=this.shadowRoot??this.attachShadow({mode:"open"});c.innerHTML=`<style>${tt}</style><button type="button" part="button"></button>`;let r=c.querySelector("button");r.textContent=(a.textContent??"").trim()||"Buy on Chain Daddy",r.addEventListener("click",()=>{try{window.open(n.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(n.toString())}catch{}})}catch{}}}for(let[l,a]of[["cd-app",s],["cd-coin",o],["cd-buy",u]])customElements.get(l)||customElements.define(l,a)}catch{}}var et=["https://chaindaddy.io","https://staging.chaindaddy.io"],$=()=>"cd-checkout-"+f(),D="popup,width=480,height=820",H=300,nt=7;function E(t){if(typeof t!="string")return null;let e;try{e=new URL(t)}catch{return null}let i=/^\/_pay\/([\w-]+)$/.exec(e.pathname);return i&&et.includes(e.origin)&&!e.username&&!e.password?{href:e.origin+e.pathname,origin:e.origin,id:i[1]}:null}function C(t,e){if(typeof t!="string")return null;let i;try{i=new URL(t,location.href)}catch{return null}if(!/^https?:$/.test(i.protocol)||i.username||i.password)return null;let s=u=>{let l=u.split("=")[0];try{return decodeURIComponent(l.replace(/\+/g," "))}catch{return l}},o=i.search.slice(1).split("&").filter(u=>u&&s(u)!=="session_id");return o.push("session_id="+encodeURIComponent(e)),i.origin+i.pathname+"?"+o.join("&")+i.hash}var p;function N(t,e,i){return new Promise(s=>{let o=!1,u=0,l,a=d=>{clearInterval(r),clearTimeout(l),window.removeEventListener("message",n),i&&d.status==="completed"&&location.assign(i),s(d)},n=d=>{if(d.origin!==e.origin||d.source!==t)return;let g=d.data;if(!g||typeof g!="object")return;g.type==="cd:checkout.ready"&&(o=!0);let h=g.session;if(!(!h||typeof h!="object"||h.id!==e.id)){if(g.type==="cd:checkout.cancelled")a({status:"cancelled",session:{id:e.id}});else if(g.type==="cd:checkout.completed"&&(h.status==="complete"||h.status==="paid")){let x={id:e.id,status:h.status};typeof h.orderId=="string"&&/^[\w-]{1,128}$/.test(h.orderId)&&(x.orderId=h.orderId),a({status:"completed",session:x})}}},c=()=>{try{t.postMessage({type:"cd:checkout.hello"},e.origin)}catch{}},r=setInterval(()=>{t.closed?(clearInterval(r),l=setTimeout(()=>a({status:"closed"}),H)):(!o||++u%nt===0)&&c()},H);window.addEventListener("message",n),c()})}function I(t){let e=()=>new Error("checkout: url is not a Chain Daddy checkout session link"),i=(o,u,l)=>{p={popup:o,result:u,href:l};let a=()=>{p&&p.popup===o&&(p=void 0)};return u.then(a,a),u},s=o=>(location.assign(o.href),{status:"redirected"});try{let{url:o,successUrl:u}=t;if(u&&!C(u,""))throw new Error("checkout: successUrl is not a web address");let l=r=>u?C(u,r.id):null,a=typeof o=="function"?null:E(o);if(typeof o!="function"&&!a)throw e();if(p&&!p.popup.closed&&(!a||p.href===a.href))return p.popup.focus(),p.result;if(a){let r=window.open(a.href,$(),D);return r?i(r,N(r,a,l(a)),a.href):Promise.resolve(s(a))}let n=window.open("",$(),D),c=new Promise(r=>r(o())).then(r=>{let d=E(r);if(!d)throw n?.close(),e();return n?(n.location.href=d.href,N(n,d,l(d))):s(d)},r=>{throw n?.close(),r});return n?i(n,c):c}catch(o){return Promise.reject(o)}}var B=!1,z;function j(){B||typeof document>"u"||(B=!0,document.addEventListener("click",t=>{let e=t.target instanceof Element?t.target.closest("[data-cd-checkout]"):null;if(!e||t.defaultPrevented||t.button||t.metaKey||t.ctrlKey||t.shiftKey||t.altKey)return;let i=e.getAttribute("data-cd-checkout")||e.href,s=e.getAttribute("data-cd-success");if(!E(i)||s&&!C(s,""))return;t.preventDefault();let o=I({url:i,successUrl:s});o!==z&&(z=o,o.then(u=>void e.dispatchEvent(new CustomEvent("cd:checkout",{detail:u,bubbles:!0})),()=>{}))}))}var it={version:S,signIn:b,handleCallback:_,exchangeCode:A,checkout:I};window.ChainDaddy=Object.assign(window.ChainDaddy??{},it);L();P({origin:O(document.currentScript?.src)});j();})();
+`;function D(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===E?E:O;class i extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=n=>this.receive(n)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.watch?.disconnect()}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let n=(this.getAttribute("crown")??"").trim(),c=(this.getAttribute("chain")??"").trim(),s=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(n)||!c||this.kind==="app"&&!s)return null;let d=new URLSearchParams({crown:n,chain:c});return this.kind==="app"?d.set("app",s):d.set("kind","coin"),d.set("mode",this.mode()),d.set("v","1"),`${e}/v1/frame?${d.toString()}`}mode(){let n=this.getAttribute("mode");if(n==="light"||n==="dark")return n;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let n=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.watch?.disconnect(),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let c=this.src();if(!c){n.innerHTML="<slot></slot>",this.frame=null;return}n.innerHTML=`<style>${et}</style><slot></slot>`;let s=document.createElement("iframe");s.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),s.setAttribute("allow","clipboard-write; fullscreen"),s.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),n.appendChild(s),this.frame=s,window.addEventListener("message",this.onMessage);let d=()=>{s.src=c,this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)};if(typeof IntersectionObserver>"u")return d();this.watch=new IntersectionObserver(g=>{g.some(h=>h.isIntersecting)&&(this.watch?.disconnect(),d())},{rootMargin:Q}),this.watch.observe(this)}why(){try{let n=new URL(this.frame.src).searchParams,c=n.get("app");n.delete("mode"),n.delete("v"),fetch(`https://${e===E?"staging-api":"api"}.chaindaddy.io/api/v2/embed/status?${n}`,{credentials:"omit"}).then(s=>s.json()).then(s=>{let d=s.embeddable?s.interactive?"not a verified site of the coin":"not https, or the app did not start":s.reason;console.info(`[Chain Daddy] cd-${this.kind} ${c??""} cannot show here: ${d}. ${Z}`)}).catch(()=>{})}catch{}}receive(n){try{if(n.origin!==e||!this.frame||!n.source||n.source!==this.frame.contentWindow)return;let c=n.data;if(!c||typeof c!="object")return;if(c.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(c.type==="cd:resize"){let s=Number(c.height);Number.isFinite(s)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(s)))}px`)}else c.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let n={},c=getComputedStyle(this);for(let s of tt){let d=c.getPropertyValue(s).trim();d&&(n[s]=d)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:n},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable")),this.why()}catch{}}}i.observedAttributes=["crown","chain","app","mode"];class o extends i{}class r extends i{constructor(){super(...arguments);this.kind="coin"}}class u extends HTMLElement{connectedCallback(){try{let a=this.querySelector("a[href]"),n=a?new URL(a.getAttribute("href")??"",document.baseURI):null;if(!n||n.protocol!=="https:")return;let c=this.shadowRoot??this.attachShadow({mode:"open"});c.innerHTML=`<style>${nt}</style><button type="button" part="button"></button>`;let s=c.querySelector("button");s.textContent=(a.textContent??"").trim()||"Buy on Chain Daddy",s.addEventListener("click",()=>{try{window.open(n.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(n.toString())}catch{}})}catch{}}}for(let[l,a]of[["cd-app",o],["cd-coin",r],["cd-buy",u]])customElements.get(l)||customElements.define(l,a)}catch{}}var it=["https://chaindaddy.io","https://staging.chaindaddy.io"],H=()=>"cd-checkout-"+w(),N="popup,width=480,height=820",B=300,rt=7;function I(t){if(typeof t!="string")return null;let e;try{e=new URL(t)}catch{return null}let i=/^\/_pay\/([\w-]+)$/.exec(e.pathname);return i&&it.includes(e.origin)&&!e.username&&!e.password?{href:e.origin+e.pathname,origin:e.origin,id:i[1]}:null}function x(t,e){if(typeof t!="string")return null;let i;try{i=new URL(t,location.href)}catch{return null}if(!/^https?:$/.test(i.protocol)||i.username||i.password)return null;let o=u=>{let l=u.split("=")[0];try{return decodeURIComponent(l.replace(/\+/g," "))}catch{return l}},r=i.search.slice(1).split("&").filter(u=>u&&o(u)!=="session_id");return r.push("session_id="+encodeURIComponent(e)),i.origin+i.pathname+"?"+r.join("&")+i.hash}var f;function z(t,e,i){return new Promise(o=>{let r=!1,u=0,l,a=d=>{clearInterval(s),clearTimeout(l),window.removeEventListener("message",n),i&&d.status==="completed"&&location.assign(i),o(d)},n=d=>{if(d.origin!==e.origin||d.source!==t)return;let g=d.data;if(!g||typeof g!="object")return;g.type==="cd:checkout.ready"&&(r=!0);let h=g.session;if(!(!h||typeof h!="object"||h.id!==e.id)){if(g.type==="cd:checkout.cancelled")a({status:"cancelled",session:{id:e.id}});else if(g.type==="cd:checkout.completed"&&(h.status==="complete"||h.status==="paid")){let p={id:e.id,status:h.status};typeof h.orderId=="string"&&/^[\w-]{1,128}$/.test(h.orderId)&&(p.orderId=h.orderId),typeof h.livemode=="boolean"&&(p.livemode=h.livemode),a({status:"completed",session:p})}}},c=()=>{try{t.postMessage({type:"cd:checkout.hello"},e.origin)}catch{}},s=setInterval(()=>{t.closed?(clearInterval(s),l=setTimeout(()=>a({status:"closed"}),B)):(!r||++u%rt===0)&&c()},B);window.addEventListener("message",n),c()})}function S(t){let e=()=>new Error("checkout: url is not a Chain Daddy checkout session link"),i=(r,u,l)=>{f={popup:r,result:u,href:l};let a=()=>{f&&f.popup===r&&(f=void 0)};return u.then(a,a),u},o=r=>(location.assign(r.href),{status:"redirected"});try{let{url:r,successUrl:u}=t;if(u&&!x(u,""))throw new Error("checkout: successUrl is not a web address");let l=s=>u?x(u,s.id):null,a=typeof r=="function"?null:I(r);if(typeof r!="function"&&!a)throw e();if(f&&!f.popup.closed&&(!a||f.href===a.href))return f.popup.focus(),f.result;if(a){let s=window.open(a.href,H(),N);return s?i(s,z(s,a,l(a)),a.href):Promise.resolve(o(a))}let n=window.open("",H(),N),c=new Promise(s=>s(r())).then(s=>{let d=I(s);if(!d)throw n?.close(),e();return n?(n.location.href=d.href,z(n,d,l(d))):o(d)},s=>{throw n?.close(),s});return n?i(n,c):c}catch(r){return Promise.reject(r)}}var j=!1,q;function V(){j||typeof document>"u"||(j=!0,document.addEventListener("click",t=>{let e=t.target instanceof Element?t.target.closest("[data-cd-checkout]"):null;if(!e||t.defaultPrevented||t.button||t.metaKey||t.ctrlKey||t.shiftKey||t.altKey)return;let i=e.getAttribute("data-cd-checkout")||e.href,o=e.getAttribute("data-cd-success");if(!I(i)||o&&!x(o,""))return;t.preventDefault();let r=S({url:i,successUrl:o});r!==q&&(q=r,r.then(u=>void e.dispatchEvent(new CustomEvent("cd:checkout",{detail:u,bubbles:!0})),()=>{}))}))}var st={version:R,signIn:k,handleCallback:L,exchangeCode:M,checkout:S};window.ChainDaddy=Object.assign(window.ChainDaddy??{},st);P();D({origin:$(document.currentScript?.src)});V();})();

package/dist/cd.js.sri

@@ -1 +1 @@
-sha384-fJEKHZn2Glw6r/O/phO2IcSENkiPJsnY5wmjK3psuPFMg86hzPzk7/Mvq07tNiGP
+sha384-Skwsv/FQCtenMYT3zex2SCnlERwJPOsytod8T05hRGAb8yUoTlD/nF2tx+0d590b

package/dist/checkout.d.ts

@@ -13,13 +13,17 @@ export interface CheckoutOptions {
     successUrl?: string | null;
 }
 export type CheckoutResult = 
-/** The buyer paid. `session.status` is "complete" (confirmed) or "paid" (sent, still confirming). */
+/**
+ * The buyer paid. `session.status` is "complete" (confirmed) or "paid" (sent, still confirming).
+ * `session.livemode` is false for a test store's session, where nothing was charged.
+ */
 {
     status: 'completed';
     session: {
         id: string;
         status: 'complete' | 'paid';
         orderId?: string;
+        livemode?: boolean;
     };
 }
 /** The buyer left the checkout without paying. */

package/dist/checkout.js

@@ -70,6 +70,7 @@ function wait(popup, target, success) {
       else if (data.type === "cd:checkout.completed" && (s.status === "complete" || s.status === "paid")) {
         const session = { id: target.id, status: s.status };
         if (typeof s.orderId === "string" && /^[\w-]{1,128}$/.test(s.orderId)) session.orderId = s.orderId;
+        if (typeof s.livemode === "boolean") session.livemode = s.livemode;
         done({ status: "completed", session });
       }
     };

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/core.ts
-var VERSION = true ? "0.3.2" : "0.0.0";
+var VERSION = true ? "0.3.4" : "0.0.0";
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -66,6 +66,7 @@ var AUTHORIZE = {
 var POPUP_NAME = "cd-signin";
 var MESSAGE = "cd:signin";
 var STORAGE_KEY = "cd.signin";
+var TICK_MS = 300;
 async function challengeFor(verifier) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
   return b64url(new Uint8Array(digest));
@@ -91,15 +92,20 @@ async function authorizeURL(o, p, authorize) {
 function result(p, code) {
   return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
 }
+var current;
 function signIn(o) {
   const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
   const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
   if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
   if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  if (current && !current.popup.closed) {
+    current.popup.focus();
+    return current.waiting;
+  }
   const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
   store.set(STORAGE_KEY, JSON.stringify(p));
   const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
-  return (async () => {
+  const waiting = (async () => {
     const url = await authorizeURL(o, p, authorize);
     if (!popup) {
       location.assign(url);
@@ -108,21 +114,43 @@ function signIn(o) {
     popup.location.href = url;
     const callbackOrigin = new URL(o.redirectUri, location.href).origin;
     return new Promise((resolve, reject) => {
+      let last;
+      const end = () => {
+        stop();
+        clearInterval(timer);
+        clearTimeout(last);
+      };
       const stop = listen(MESSAGE, callbackOrigin, (m) => {
         if (m.state !== p.state) return;
-        stop();
+        end();
         store.remove(STORAGE_KEY);
         if (typeof m.error === "string" && m.error) reject(new Error(m.error));
         else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
         else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
         else resolve(result(p, m.code));
       }, POPUP_NAME, popup);
+      const timer = setInterval(() => {
+        if (!popup.closed) return;
+        clearInterval(timer);
+        last = setTimeout(() => {
+          end();
+          reject(new Error("closed"));
+        }, TICK_MS);
+      }, TICK_MS);
       o.signal?.addEventListener("abort", () => {
-        stop();
+        end();
         reject(new Error("aborted"));
       });
     });
   })();
+  if (popup) {
+    current = { popup, waiting };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    waiting.then(over, over);
+  }
+  return waiting;
 }
 async function handleCallback() {
   const q = new URLSearchParams(location.search);
@@ -196,14 +224,17 @@ function defineSignInButton() {
     }
     start() {
       const attr = (n) => this.getAttribute(n) || void 0;
-      signIn({
+      const visit = signIn({
         clientId: attr("client-id") ?? "",
         redirectUri: attr("redirect-uri") ?? "",
         scope: attr("scope"),
         claims: attr("claims"),
         issuer: attr("issuer"),
         authorizeUrl: attr("authorize-url")
-      }).then(
+      });
+      if (visit === this.reporting) return;
+      this.reporting = visit;
+      visit.then(
         (r) => r && this.dispatchEvent(new CustomEvent("cd-signin", { detail: r, bubbles: true, composed: true })),
         (e) => this.dispatchEvent(new CustomEvent("cd-signin-error", { detail: { message: String(e?.message ?? e) }, bubbles: true, composed: true }))
       );
@@ -433,7 +464,7 @@ function defineEmbedElements(options = {}) {
 var ORIGINS = ["https://chaindaddy.io", "https://staging.chaindaddy.io"];
 var windowName = () => "cd-checkout-" + randomToken();
 var FEATURES = "popup,width=480,height=820";
-var TICK_MS = 300;
+var TICK_MS2 = 300;
 var QUIET_TICKS = 7;
 function parseCheckoutUrl(url) {
   if (typeof url !== "string") return null;
@@ -467,7 +498,7 @@ function successTarget(successUrl, id) {
   pairs.push("session_id=" + encodeURIComponent(id));
   return u.origin + u.pathname + "?" + pairs.join("&") + u.hash;
 }
-var current;
+var current2;
 function wait(popup, target, success) {
   return new Promise((resolve) => {
     let ready = false;
@@ -491,6 +522,7 @@ function wait(popup, target, success) {
       else if (data.type === "cd:checkout.completed" && (s.status === "complete" || s.status === "paid")) {
         const session = { id: target.id, status: s.status };
         if (typeof s.orderId === "string" && /^[\w-]{1,128}$/.test(s.orderId)) session.orderId = s.orderId;
+        if (typeof s.livemode === "boolean") session.livemode = s.livemode;
         done({ status: "completed", session });
       }
     };
@@ -503,9 +535,9 @@ function wait(popup, target, success) {
     const timer = setInterval(() => {
       if (popup.closed) {
         clearInterval(timer);
-        last = setTimeout(() => done({ status: "closed" }), TICK_MS);
+        last = setTimeout(() => done({ status: "closed" }), TICK_MS2);
       } else if (!ready || ++quiet % QUIET_TICKS === 0) hello();
-    }, TICK_MS);
+    }, TICK_MS2);
     window.addEventListener("message", onMessage);
     hello();
   });
@@ -513,9 +545,9 @@ function wait(popup, target, success) {
 function checkout(o) {
   const refused = () => new Error("checkout: url is not a Chain Daddy checkout session link");
   const track = (popup, result2, href) => {
-    current = { popup, result: result2, href };
+    current2 = { popup, result: result2, href };
     const over = () => {
-      if (current && current.popup === popup) current = void 0;
+      if (current2 && current2.popup === popup) current2 = void 0;
     };
     result2.then(over, over);
     return result2;
@@ -530,9 +562,9 @@ function checkout(o) {
     const success = (t) => successUrl ? successTarget(successUrl, t.id) : null;
     const target = typeof url === "function" ? null : parseCheckoutUrl(url);
     if (typeof url !== "function" && !target) throw refused();
-    if (current && !current.popup.closed && (!target || current.href === target.href)) {
-      current.popup.focus();
-      return current.result;
+    if (current2 && !current2.popup.closed && (!target || current2.href === target.href)) {
+      current2.popup.focus();
+      return current2.result;
     }
     if (target) {
       const popup2 = window.open(target.href, windowName(), FEATURES);

package/dist/signin.d.ts

@@ -12,7 +12,7 @@ export interface SignInOptions {
     issuer?: string;
     /** The consent page; derived from the issuer for Chain Daddy's own. */
     authorizeUrl?: string;
-    /** Stops waiting. Closing the popup does not: a closed-looking popup is not a cancel. */
+    /** Stops waiting: the call rejects "aborted". */
     signal?: AbortSignal;
 }
 /** What your server exchanges at the token endpoint (or exchangeCode does here). */
@@ -32,8 +32,9 @@ export declare function challengeFor(verifier: string): Promise<string>;
  * before anything is awaited, or a browser blocks it. Resolves with the code
  * once the visitor approves; resolves null when the popup was blocked and the
  * page is redirecting instead (your callback page then calls handleCallback).
- * Rejects when they cancel (access_denied) or the answer is not for this
- * request.
+ * Rejects when they cancel (access_denied), when they close the popup without
+ * answering (closed), or when the answer is not for this request. While one
+ * sign-in is open, another call shows its popup and returns the same promise.
  */
 export declare function signIn(o: SignInOptions): Promise<SignInResult | null>;
 /**

package/dist/signin.js

@@ -65,6 +65,7 @@ var AUTHORIZE = {
 var POPUP_NAME = "cd-signin";
 var MESSAGE = "cd:signin";
 var STORAGE_KEY = "cd.signin";
+var TICK_MS = 300;
 async function challengeFor(verifier) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
   return b64url(new Uint8Array(digest));
@@ -90,15 +91,20 @@ async function authorizeURL(o, p, authorize) {
 function result(p, code) {
   return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
 }
+var current;
 function signIn(o) {
   const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
   const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
   if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
   if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  if (current && !current.popup.closed) {
+    current.popup.focus();
+    return current.waiting;
+  }
   const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
   store.set(STORAGE_KEY, JSON.stringify(p));
   const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
-  return (async () => {
+  const waiting = (async () => {
     const url = await authorizeURL(o, p, authorize);
     if (!popup) {
       location.assign(url);
@@ -107,21 +113,43 @@ function signIn(o) {
     popup.location.href = url;
     const callbackOrigin = new URL(o.redirectUri, location.href).origin;
     return new Promise((resolve, reject) => {
+      let last;
+      const end = () => {
+        stop();
+        clearInterval(timer);
+        clearTimeout(last);
+      };
       const stop = listen(MESSAGE, callbackOrigin, (m) => {
         if (m.state !== p.state) return;
-        stop();
+        end();
         store.remove(STORAGE_KEY);
         if (typeof m.error === "string" && m.error) reject(new Error(m.error));
         else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
         else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
         else resolve(result(p, m.code));
       }, POPUP_NAME, popup);
+      const timer = setInterval(() => {
+        if (!popup.closed) return;
+        clearInterval(timer);
+        last = setTimeout(() => {
+          end();
+          reject(new Error("closed"));
+        }, TICK_MS);
+      }, TICK_MS);
       o.signal?.addEventListener("abort", () => {
-        stop();
+        end();
         reject(new Error("aborted"));
       });
     });
   })();
+  if (popup) {
+    current = { popup, waiting };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    waiting.then(over, over);
+  }
+  return waiting;
 }
 async function handleCallback() {
   const q = new URLSearchParams(location.search);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaindaddy/js",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), a coin's apps on its own site (<cd-app>), checkout for a coin's store in a popup, and a server-side check that a store order was paid on chain",
   "homepage": "https://docs.chaindaddy.io/developer/javascript-sdk",
   "repository": {