@cimplify/sdk 0.67.0 → 0.68.0

package/dist/{chunk-QQMDEGAK.mjs → chunk-SOV4H6PQ.mjs}

@@ -2270,6 +2270,17 @@ var MESSAGE_TYPES = {
   ORDER_TYPE_CHANGED: "order_type_changed",
   REQUEST_SUBMIT: "request_submit"
 };
+var ELEMENTS_AUTH_CONTACT_TYPES = {
+  EMAIL: "email",
+  PHONE: "phone"
+};
+var ELEMENTS_AUTH_PROMPTS = {
+  LOGIN: "login"
+};
+var ELEMENTS_AUTH_MODES = {
+  CHECKOUT: "checkout",
+  DEFAULT: "default"
+};
 var EVENT_TYPES = {
   READY: "ready",
   AUTHENTICATED: "authenticated",
@@ -2404,6 +2415,119 @@ function openModalIframe(opts) {
 
 // src/sign-in.ts
 var DEFAULT_SCOPE = "openid email phone profile";
+var DEFAULT_SILENT_TIMEOUT_MS = 900;
+var RESPONSE_TYPE_CODE = "code";
+var RESPONSE_MODE_WEB_MESSAGE = "web_message";
+var RESPONSE_MODE_QUERY = "query";
+var PROMPT_NONE = "none";
+var AUTHORIZATION_RESPONSE_MESSAGE_TYPE = "authorization_response";
+var ERROR_STATE_MISMATCH = "state_mismatch";
+var ERROR_CALLBACK_FAILED = "callback_failed";
+var ERROR_CALLBACK_EXCEPTION = "callback_exception";
+var ERROR_CANCELLED = "cancelled";
+var ERROR_LOGIN_REQUIRED = "login_required";
+var ERROR_CONSENT_REQUIRED = "consent_required";
+var ERROR_INTERACTION_REQUIRED = "interaction_required";
+var INTERACTIVE_AUTH_ERRORS = /* @__PURE__ */ new Set([
+  ERROR_LOGIN_REQUIRED,
+  ERROR_CONSENT_REQUIRED,
+  ERROR_INTERACTION_REQUIRED
+]);
+function buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, urlOpts) {
+  const params = new URLSearchParams({
+    response_type: RESPONSE_TYPE_CODE,
+    response_mode: urlOpts.responseMode,
+    client_id: opts.clientId,
+    redirect_uri: opts.redirectUri,
+    scope: opts.scope ?? DEFAULT_SCOPE,
+    state,
+    code_challenge: pkce.challenge,
+    code_challenge_method: pkce.method
+  });
+  if (opts.loginHint) params.set("login_hint", opts.loginHint);
+  if (urlOpts.prompt) params.set("prompt", urlOpts.prompt);
+  if (opts.uiMode) params.set("ui_mode", opts.uiMode);
+  return `${authorizeEndpoint}?${params.toString()}`;
+}
+async function exchangeAuthorizationCode(callbackUri, pkce, state, code) {
+  const res = await fetch(callbackUri, {
+    method: "POST",
+    credentials: "include",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, codeVerifier: pkce.verifier, state })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw { error: ERROR_CALLBACK_FAILED, description: body };
+  }
+  const payload = await res.json().catch(() => ({}));
+  return {
+    accessToken: payload.accessToken ?? payload.access_token,
+    expiresIn: payload.expiresIn ?? payload.expires_in,
+    scope: payload.scope
+  };
+}
+async function trySilentModalSignIn(opts, authorizeEndpoint, callbackUri, pkce, state) {
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
+  const iframe = document.createElement("iframe");
+  iframe.style.display = "none";
+  iframe.setAttribute("aria-hidden", "true");
+  iframe.setAttribute("sandbox", "allow-scripts allow-same-origin");
+  iframe.src = buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_WEB_MESSAGE,
+    prompt: PROMPT_NONE
+  });
+  return new Promise((resolve) => {
+    let settled = false;
+    let handler = () => {
+    };
+    const timeout = setTimeout(() => finish(false), opts.silentTimeoutMs ?? DEFAULT_SILENT_TIMEOUT_MS);
+    const cleanup = () => {
+      window.removeEventListener("message", handler);
+      iframe.remove();
+      clearTimeout(timeout);
+    };
+    const finish = (handled) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(handled);
+    };
+    handler = async (event) => {
+      if (event.origin !== expectedOrigin) return;
+      const data = event.data;
+      if (!data || typeof data !== "object" || data.type !== AUTHORIZATION_RESPONSE_MESSAGE_TYPE) return;
+      const response = data.response;
+      if (response.error) {
+        if (INTERACTIVE_AUTH_ERRORS.has(response.error)) {
+          finish(false);
+          return;
+        }
+        opts.onError?.({ error: response.error, description: response.error_description });
+        finish(true);
+        return;
+      }
+      if (!response.code) return;
+      if (response.state !== state) {
+        opts.onError?.({ error: ERROR_STATE_MISMATCH });
+        finish(true);
+        return;
+      }
+      try {
+        opts.onSuccess?.(await exchangeAuthorizationCode(callbackUri, pkce, state, response.code));
+      } catch (e) {
+        const err2 = e;
+        opts.onError?.({
+          error: err2.error ?? ERROR_CALLBACK_EXCEPTION,
+          description: err2.description ?? String(e)
+        });
+      }
+      finish(true);
+    };
+    window.addEventListener("message", handler);
+    document.body.appendChild(iframe);
+  });
+}
 function resolveAuthorizeEndpoint(opts) {
   if (opts.authUrl) {
     return Promise.resolve(`${opts.authUrl.replace(/\/$/, "")}/oauth/authorize`);
@@ -2419,64 +2543,59 @@ async function startSignIn(opts) {
     startRedirectSignIn(opts, authorizeEndpoint, pkce, state);
     return;
   }
-  const params = new URLSearchParams({
-    response_type: "code",
-    response_mode: "web_message",
-    client_id: opts.clientId,
-    redirect_uri: opts.redirectUri,
-    scope: opts.scope ?? DEFAULT_SCOPE,
-    state,
-    code_challenge: pkce.challenge,
-    code_challenge_method: pkce.method
+  if (opts.silentFirst && !opts.prompt) {
+    const handledSilently = await trySilentModalSignIn(opts, authorizeEndpoint, callbackUri, pkce, state);
+    if (handledSilently) {
+      return;
+    }
+  }
+  const src = buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_WEB_MESSAGE,
+    prompt: opts.prompt
   });
-  if (opts.loginHint) params.set("login_hint", opts.loginHint);
-  if (opts.prompt) params.set("prompt", opts.prompt);
-  const src = `${authorizeEndpoint}?${params.toString()}`;
   const expectedOrigin = new URL(authorizeEndpoint).origin;
+  let completed = false;
+  let handler = () => {
+  };
   const modal = openModalIframe({
     src,
     onClose: () => {
       window.removeEventListener("message", handler);
+      if (!completed) {
+        opts.onError?.({ error: ERROR_CANCELLED });
+      }
     }
   });
-  const handler = async (event) => {
+  handler = async (event) => {
     if (event.origin !== expectedOrigin) return;
     const data = event.data;
-    if (!data || typeof data !== "object" || data.type !== "authorization_response") return;
+    if (!data || typeof data !== "object" || data.type !== AUTHORIZATION_RESPONSE_MESSAGE_TYPE) return;
     const response = data.response;
     if (response.error) {
+      completed = true;
       modal.close();
       opts.onError?.({ error: response.error, description: response.error_description });
       return;
     }
     if (!response.code) return;
     if (response.state !== state) {
+      completed = true;
       modal.close();
-      opts.onError?.({ error: "state_mismatch" });
+      opts.onError?.({ error: ERROR_STATE_MISMATCH });
       return;
     }
     try {
-      const res = await fetch(callbackUri, {
-        method: "POST",
-        credentials: "include",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ code: response.code, codeVerifier: pkce.verifier, state })
-      });
-      if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        opts.onError?.({ error: "callback_failed", description: body });
-        modal.close();
-        return;
-      }
-      const payload = await res.json().catch(() => ({}));
+      const result = await exchangeAuthorizationCode(callbackUri, pkce, state, response.code);
+      completed = true;
       modal.close();
-      opts.onSuccess?.({
-        accessToken: payload.accessToken ?? payload.access_token,
-        expiresIn: payload.expiresIn ?? payload.expires_in,
-        scope: payload.scope
-      });
+      opts.onSuccess?.(result);
     } catch (e) {
-      opts.onError?.({ error: "callback_exception", description: String(e) });
+      const err2 = e;
+      completed = true;
+      opts.onError?.({
+        error: err2.error ?? ERROR_CALLBACK_EXCEPTION,
+        description: err2.description ?? String(e)
+      });
       modal.close();
     }
   };
@@ -2487,19 +2606,10 @@ function startRedirectSignIn(opts, authorizeEndpoint, pkce, state) {
   const cookieValue = encodePkceState({ verifier: pkce.verifier, state, returnTo });
   const secure = window.location.protocol === "https:" ? "; Secure" : "";
   document.cookie = `${PKCE_COOKIE}=${cookieValue}; Path=${PKCE_COOKIE_PATH}; Max-Age=${PKCE_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax${secure}`;
-  const params = new URLSearchParams({
-    response_type: "code",
-    response_mode: "query",
-    client_id: opts.clientId,
-    redirect_uri: opts.redirectUri,
-    scope: opts.scope ?? DEFAULT_SCOPE,
-    state,
-    code_challenge: pkce.challenge,
-    code_challenge_method: pkce.method
-  });
-  if (opts.loginHint) params.set("login_hint", opts.loginHint);
-  if (opts.prompt) params.set("prompt", opts.prompt);
-  window.location.assign(`${authorizeEndpoint}?${params.toString()}`);
+  window.location.assign(buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_QUERY,
+    prompt: opts.prompt
+  }));
 }
 
 // src/elements.ts
@@ -2517,6 +2627,9 @@ function toCheckoutError(code, message, recoverable) {
   };
 }
 var DEFAULT_LINK_URL = "https://link.cimplify.io";
+var AUTH_CONTACT_TYPES = new Set(Object.values(ELEMENTS_AUTH_CONTACT_TYPES));
+var AUTH_MODES = new Set(Object.values(ELEMENTS_AUTH_MODES));
+var AUTH_PROMPTS = new Set(Object.values(ELEMENTS_AUTH_PROMPTS));
 function generateNonce() {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID().replace(/-/g, "").slice(0, 16);
@@ -2584,6 +2697,16 @@ function parseIframeMessage(data) {
   }
   switch (record.type) {
     case MESSAGE_TYPES.AUTH_REQUESTED:
+      if (record.loginHint !== void 0 && typeof record.loginHint !== "string") return null;
+      if (record.contactType !== void 0 && (typeof record.contactType !== "string" || !AUTH_CONTACT_TYPES.has(record.contactType))) {
+        return null;
+      }
+      if (record.mode !== void 0 && (typeof record.mode !== "string" || !AUTH_MODES.has(record.mode))) {
+        return null;
+      }
+      if (record.prompt !== void 0 && (typeof record.prompt !== "string" || !AUTH_PROMPTS.has(record.prompt))) {
+        return null;
+      }
       break;
     case MESSAGE_TYPES.ADDRESS_CHANGED:
     case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -2941,7 +3064,7 @@ var CimplifyElements = class {
       element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
     });
   }
-  startEmbeddedAuth(sourceElement) {
+  startEmbeddedAuth(sourceElement, request) {
     if (this.authInProgress) return;
     const auth = this.options.auth ?? {};
     const clientId = auth.clientId ?? readPublicEnv("NEXT_PUBLIC_CIMPLIFY_CLIENT_ID");
@@ -2961,7 +3084,11 @@ var CimplifyElements = class {
       scope: auth.scope,
       issuer: auth.issuer,
       authUrl: auth.authUrl,
+      loginHint: request.loginHint,
+      prompt: request.prompt,
+      uiMode: request.mode,
       mode: "modal",
+      silentFirst: request.mode === ELEMENTS_AUTH_MODES.CHECKOUT && request.prompt !== ELEMENTS_AUTH_PROMPTS.LOGIN,
       onSuccess: async ({ accessToken }) => {
         this.authInProgress = false;
         if (!accessToken) {
@@ -3000,7 +3127,7 @@ var CimplifyElements = class {
     if (!sourceElement) return;
     switch (message.type) {
       case MESSAGE_TYPES.AUTH_REQUESTED:
-        this.startEmbeddedAuth(sourceElement);
+        this.startEmbeddedAuth(sourceElement, message);
         break;
       case MESSAGE_TYPES.ADDRESS_CHANGED:
       case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -3296,4 +3423,4 @@ function createElements(client, businessId, options) {
   return new CimplifyElements(client, businessId, options);
 }
 
-export { AUTHORIZATION_TYPE, AUTH_MUTATION, AuthService, BusinessService, CHECKOUT_MODE, CHECKOUT_MUTATION, CHECKOUT_STEP, CONTACT_TYPE, CartOperations, CatalogueQueries, CheckoutService, CimplifyElement, CimplifyElements, DEFAULT_COUNTRY, DEFAULT_CURRENCY, DEFAULT_ISSUER, DEVICE_TYPE, ELEMENT_TYPES, EVENT_TYPES, FxService, InventoryService, LINK_MUTATION, LINK_QUERY, LinkService, LiteService, MESSAGE_TYPES, MOBILE_MONEY_PROVIDER, ORDER_MUTATION, ORDER_TYPE, OrderQueries, PAYMENT_METHOD, PAYMENT_MUTATION, PAYMENT_STATE, PICKUP_TIME_TYPE, PKCE_COOKIE, PKCE_COOKIE_PATH, SchedulingService, combine, combineObject, createElements, decodePkceState, err, flatMap, fromPromise, generateIdempotencyKey, generatePkce, generateState, getAuthorizationEndpoint, getOrElse, isErr, isOk, mapError, mapResult, ok, safe, startSignIn, toNullable, tryCatch, unwrap };
+export { AUTHORIZATION_TYPE, AUTH_MUTATION, AuthService, BusinessService, CHECKOUT_MODE, CHECKOUT_MUTATION, CHECKOUT_STEP, CONTACT_TYPE, CartOperations, CatalogueQueries, CheckoutService, CimplifyElement, CimplifyElements, DEFAULT_COUNTRY, DEFAULT_CURRENCY, DEFAULT_ISSUER, DEVICE_TYPE, ELEMENTS_AUTH_CONTACT_TYPES, ELEMENTS_AUTH_MODES, ELEMENTS_AUTH_PROMPTS, ELEMENT_TYPES, EVENT_TYPES, FxService, InventoryService, LINK_MUTATION, LINK_QUERY, LinkService, LiteService, MESSAGE_TYPES, MOBILE_MONEY_PROVIDER, ORDER_MUTATION, ORDER_TYPE, OrderQueries, PAYMENT_METHOD, PAYMENT_MUTATION, PAYMENT_STATE, PICKUP_TIME_TYPE, PKCE_COOKIE, PKCE_COOKIE_PATH, SchedulingService, combine, combineObject, createElements, decodePkceState, err, flatMap, fromPromise, generateIdempotencyKey, generatePkce, generateState, getAuthorizationEndpoint, getOrElse, isErr, isOk, mapError, mapResult, ok, safe, startSignIn, toNullable, tryCatch, unwrap };

package/dist/{chunk-FNK6UZOE.mjs → chunk-TAKORJP4.mjs}

@@ -1,5 +1,5 @@
 import { createMockApp } from './chunk-FVGVJ4TC.mjs';
-import { createCimplifyClient } from './chunk-JAPCAZN4.mjs';
+import { createCimplifyClient } from './chunk-KNPE4WCQ.mjs';
 import { z } from 'zod';
 
 var cimplifyRegistry = z.registry();

package/dist/{chunk-3QSW33RG.js → chunk-WCSAZRNC.js}

@@ -2272,6 +2272,17 @@ var MESSAGE_TYPES = {
   ORDER_TYPE_CHANGED: "order_type_changed",
   REQUEST_SUBMIT: "request_submit"
 };
+var ELEMENTS_AUTH_CONTACT_TYPES = {
+  EMAIL: "email",
+  PHONE: "phone"
+};
+var ELEMENTS_AUTH_PROMPTS = {
+  LOGIN: "login"
+};
+var ELEMENTS_AUTH_MODES = {
+  CHECKOUT: "checkout",
+  DEFAULT: "default"
+};
 var EVENT_TYPES = {
   READY: "ready",
   AUTHENTICATED: "authenticated",
@@ -2406,6 +2417,119 @@ function openModalIframe(opts) {
 
 // src/sign-in.ts
 var DEFAULT_SCOPE = "openid email phone profile";
+var DEFAULT_SILENT_TIMEOUT_MS = 900;
+var RESPONSE_TYPE_CODE = "code";
+var RESPONSE_MODE_WEB_MESSAGE = "web_message";
+var RESPONSE_MODE_QUERY = "query";
+var PROMPT_NONE = "none";
+var AUTHORIZATION_RESPONSE_MESSAGE_TYPE = "authorization_response";
+var ERROR_STATE_MISMATCH = "state_mismatch";
+var ERROR_CALLBACK_FAILED = "callback_failed";
+var ERROR_CALLBACK_EXCEPTION = "callback_exception";
+var ERROR_CANCELLED = "cancelled";
+var ERROR_LOGIN_REQUIRED = "login_required";
+var ERROR_CONSENT_REQUIRED = "consent_required";
+var ERROR_INTERACTION_REQUIRED = "interaction_required";
+var INTERACTIVE_AUTH_ERRORS = /* @__PURE__ */ new Set([
+  ERROR_LOGIN_REQUIRED,
+  ERROR_CONSENT_REQUIRED,
+  ERROR_INTERACTION_REQUIRED
+]);
+function buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, urlOpts) {
+  const params = new URLSearchParams({
+    response_type: RESPONSE_TYPE_CODE,
+    response_mode: urlOpts.responseMode,
+    client_id: opts.clientId,
+    redirect_uri: opts.redirectUri,
+    scope: opts.scope ?? DEFAULT_SCOPE,
+    state,
+    code_challenge: pkce.challenge,
+    code_challenge_method: pkce.method
+  });
+  if (opts.loginHint) params.set("login_hint", opts.loginHint);
+  if (urlOpts.prompt) params.set("prompt", urlOpts.prompt);
+  if (opts.uiMode) params.set("ui_mode", opts.uiMode);
+  return `${authorizeEndpoint}?${params.toString()}`;
+}
+async function exchangeAuthorizationCode(callbackUri, pkce, state, code) {
+  const res = await fetch(callbackUri, {
+    method: "POST",
+    credentials: "include",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, codeVerifier: pkce.verifier, state })
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw { error: ERROR_CALLBACK_FAILED, description: body };
+  }
+  const payload = await res.json().catch(() => ({}));
+  return {
+    accessToken: payload.accessToken ?? payload.access_token,
+    expiresIn: payload.expiresIn ?? payload.expires_in,
+    scope: payload.scope
+  };
+}
+async function trySilentModalSignIn(opts, authorizeEndpoint, callbackUri, pkce, state) {
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
+  const iframe = document.createElement("iframe");
+  iframe.style.display = "none";
+  iframe.setAttribute("aria-hidden", "true");
+  iframe.setAttribute("sandbox", "allow-scripts allow-same-origin");
+  iframe.src = buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_WEB_MESSAGE,
+    prompt: PROMPT_NONE
+  });
+  return new Promise((resolve) => {
+    let settled = false;
+    let handler = () => {
+    };
+    const timeout = setTimeout(() => finish(false), opts.silentTimeoutMs ?? DEFAULT_SILENT_TIMEOUT_MS);
+    const cleanup = () => {
+      window.removeEventListener("message", handler);
+      iframe.remove();
+      clearTimeout(timeout);
+    };
+    const finish = (handled) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(handled);
+    };
+    handler = async (event) => {
+      if (event.origin !== expectedOrigin) return;
+      const data = event.data;
+      if (!data || typeof data !== "object" || data.type !== AUTHORIZATION_RESPONSE_MESSAGE_TYPE) return;
+      const response = data.response;
+      if (response.error) {
+        if (INTERACTIVE_AUTH_ERRORS.has(response.error)) {
+          finish(false);
+          return;
+        }
+        opts.onError?.({ error: response.error, description: response.error_description });
+        finish(true);
+        return;
+      }
+      if (!response.code) return;
+      if (response.state !== state) {
+        opts.onError?.({ error: ERROR_STATE_MISMATCH });
+        finish(true);
+        return;
+      }
+      try {
+        opts.onSuccess?.(await exchangeAuthorizationCode(callbackUri, pkce, state, response.code));
+      } catch (e) {
+        const err2 = e;
+        opts.onError?.({
+          error: err2.error ?? ERROR_CALLBACK_EXCEPTION,
+          description: err2.description ?? String(e)
+        });
+      }
+      finish(true);
+    };
+    window.addEventListener("message", handler);
+    document.body.appendChild(iframe);
+  });
+}
 function resolveAuthorizeEndpoint(opts) {
   if (opts.authUrl) {
     return Promise.resolve(`${opts.authUrl.replace(/\/$/, "")}/oauth/authorize`);
@@ -2421,64 +2545,59 @@ async function startSignIn(opts) {
     startRedirectSignIn(opts, authorizeEndpoint, pkce, state);
     return;
   }
-  const params = new URLSearchParams({
-    response_type: "code",
-    response_mode: "web_message",
-    client_id: opts.clientId,
-    redirect_uri: opts.redirectUri,
-    scope: opts.scope ?? DEFAULT_SCOPE,
-    state,
-    code_challenge: pkce.challenge,
-    code_challenge_method: pkce.method
+  if (opts.silentFirst && !opts.prompt) {
+    const handledSilently = await trySilentModalSignIn(opts, authorizeEndpoint, callbackUri, pkce, state);
+    if (handledSilently) {
+      return;
+    }
+  }
+  const src = buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_WEB_MESSAGE,
+    prompt: opts.prompt
   });
-  if (opts.loginHint) params.set("login_hint", opts.loginHint);
-  if (opts.prompt) params.set("prompt", opts.prompt);
-  const src = `${authorizeEndpoint}?${params.toString()}`;
   const expectedOrigin = new URL(authorizeEndpoint).origin;
+  let completed = false;
+  let handler = () => {
+  };
   const modal = openModalIframe({
     src,
     onClose: () => {
       window.removeEventListener("message", handler);
+      if (!completed) {
+        opts.onError?.({ error: ERROR_CANCELLED });
+      }
     }
   });
-  const handler = async (event) => {
+  handler = async (event) => {
     if (event.origin !== expectedOrigin) return;
     const data = event.data;
-    if (!data || typeof data !== "object" || data.type !== "authorization_response") return;
+    if (!data || typeof data !== "object" || data.type !== AUTHORIZATION_RESPONSE_MESSAGE_TYPE) return;
     const response = data.response;
     if (response.error) {
+      completed = true;
       modal.close();
       opts.onError?.({ error: response.error, description: response.error_description });
       return;
     }
     if (!response.code) return;
     if (response.state !== state) {
+      completed = true;
       modal.close();
-      opts.onError?.({ error: "state_mismatch" });
+      opts.onError?.({ error: ERROR_STATE_MISMATCH });
       return;
     }
     try {
-      const res = await fetch(callbackUri, {
-        method: "POST",
-        credentials: "include",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ code: response.code, codeVerifier: pkce.verifier, state })
-      });
-      if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        opts.onError?.({ error: "callback_failed", description: body });
-        modal.close();
-        return;
-      }
-      const payload = await res.json().catch(() => ({}));
+      const result = await exchangeAuthorizationCode(callbackUri, pkce, state, response.code);
+      completed = true;
       modal.close();
-      opts.onSuccess?.({
-        accessToken: payload.accessToken ?? payload.access_token,
-        expiresIn: payload.expiresIn ?? payload.expires_in,
-        scope: payload.scope
-      });
+      opts.onSuccess?.(result);
     } catch (e) {
-      opts.onError?.({ error: "callback_exception", description: String(e) });
+      const err2 = e;
+      completed = true;
+      opts.onError?.({
+        error: err2.error ?? ERROR_CALLBACK_EXCEPTION,
+        description: err2.description ?? String(e)
+      });
       modal.close();
     }
   };
@@ -2489,19 +2608,10 @@ function startRedirectSignIn(opts, authorizeEndpoint, pkce, state) {
   const cookieValue = encodePkceState({ verifier: pkce.verifier, state, returnTo });
   const secure = window.location.protocol === "https:" ? "; Secure" : "";
   document.cookie = `${PKCE_COOKIE}=${cookieValue}; Path=${PKCE_COOKIE_PATH}; Max-Age=${PKCE_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax${secure}`;
-  const params = new URLSearchParams({
-    response_type: "code",
-    response_mode: "query",
-    client_id: opts.clientId,
-    redirect_uri: opts.redirectUri,
-    scope: opts.scope ?? DEFAULT_SCOPE,
-    state,
-    code_challenge: pkce.challenge,
-    code_challenge_method: pkce.method
-  });
-  if (opts.loginHint) params.set("login_hint", opts.loginHint);
-  if (opts.prompt) params.set("prompt", opts.prompt);
-  window.location.assign(`${authorizeEndpoint}?${params.toString()}`);
+  window.location.assign(buildAuthorizeUrl(opts, authorizeEndpoint, pkce, state, {
+    responseMode: RESPONSE_MODE_QUERY,
+    prompt: opts.prompt
+  }));
 }
 
 // src/elements.ts
@@ -2519,6 +2629,9 @@ function toCheckoutError(code, message, recoverable) {
   };
 }
 var DEFAULT_LINK_URL = "https://link.cimplify.io";
+var AUTH_CONTACT_TYPES = new Set(Object.values(ELEMENTS_AUTH_CONTACT_TYPES));
+var AUTH_MODES = new Set(Object.values(ELEMENTS_AUTH_MODES));
+var AUTH_PROMPTS = new Set(Object.values(ELEMENTS_AUTH_PROMPTS));
 function generateNonce() {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID().replace(/-/g, "").slice(0, 16);
@@ -2586,6 +2699,16 @@ function parseIframeMessage(data) {
   }
   switch (record.type) {
     case MESSAGE_TYPES.AUTH_REQUESTED:
+      if (record.loginHint !== void 0 && typeof record.loginHint !== "string") return null;
+      if (record.contactType !== void 0 && (typeof record.contactType !== "string" || !AUTH_CONTACT_TYPES.has(record.contactType))) {
+        return null;
+      }
+      if (record.mode !== void 0 && (typeof record.mode !== "string" || !AUTH_MODES.has(record.mode))) {
+        return null;
+      }
+      if (record.prompt !== void 0 && (typeof record.prompt !== "string" || !AUTH_PROMPTS.has(record.prompt))) {
+        return null;
+      }
       break;
     case MESSAGE_TYPES.ADDRESS_CHANGED:
     case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -2943,7 +3066,7 @@ var CimplifyElements = class {
       element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
     });
   }
-  startEmbeddedAuth(sourceElement) {
+  startEmbeddedAuth(sourceElement, request) {
     if (this.authInProgress) return;
     const auth = this.options.auth ?? {};
     const clientId = auth.clientId ?? readPublicEnv("NEXT_PUBLIC_CIMPLIFY_CLIENT_ID");
@@ -2963,7 +3086,11 @@ var CimplifyElements = class {
       scope: auth.scope,
       issuer: auth.issuer,
       authUrl: auth.authUrl,
+      loginHint: request.loginHint,
+      prompt: request.prompt,
+      uiMode: request.mode,
       mode: "modal",
+      silentFirst: request.mode === ELEMENTS_AUTH_MODES.CHECKOUT && request.prompt !== ELEMENTS_AUTH_PROMPTS.LOGIN,
       onSuccess: async ({ accessToken }) => {
         this.authInProgress = false;
         if (!accessToken) {
@@ -3002,7 +3129,7 @@ var CimplifyElements = class {
     if (!sourceElement) return;
     switch (message.type) {
       case MESSAGE_TYPES.AUTH_REQUESTED:
-        this.startEmbeddedAuth(sourceElement);
+        this.startEmbeddedAuth(sourceElement, message);
         break;
       case MESSAGE_TYPES.ADDRESS_CHANGED:
       case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -3315,6 +3442,9 @@ exports.DEFAULT_COUNTRY = DEFAULT_COUNTRY;
 exports.DEFAULT_CURRENCY = DEFAULT_CURRENCY;
 exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.DEVICE_TYPE = DEVICE_TYPE;
+exports.ELEMENTS_AUTH_CONTACT_TYPES = ELEMENTS_AUTH_CONTACT_TYPES;
+exports.ELEMENTS_AUTH_MODES = ELEMENTS_AUTH_MODES;
+exports.ELEMENTS_AUTH_PROMPTS = ELEMENTS_AUTH_PROMPTS;
 exports.ELEMENT_TYPES = ELEMENT_TYPES;
 exports.EVENT_TYPES = EVENT_TYPES;
 exports.FxService = FxService;

package/dist/{client-Dd82KQ_G.d.mts → client-CBE7ksYC.d.mts}

@@ -1,4 +1,4 @@
-import { ac as CimplifyClient } from './client-ByI_3jfL.mjs';
+import { ac as CimplifyClient } from './client-Dyo3dvNy.mjs';
 import { A as AppHandle, C as CreateAppOptions } from './server-D8rwqZQ6.mjs';
 
 /**