@cowprotocol/widget-lib 2.3.0 → 3.1.1

package/IframeCowEventEmitter.d.ts

@@ -4,7 +4,7 @@ export declare class IframeCowEventEmitter {
     private eventEmitter;
     private listeners;
     private widgetListener;
-    constructor(contentWindow: Window, iframeOrigin: string, listeners?: CowWidgetEventListeners);
+    constructor(contentWindow: Window, iframeOrigin: string, iframeWindow: Window, listeners?: CowWidgetEventListeners);
     stopListeningIframe(): void;
     updateListeners(listeners?: CowWidgetEventListeners): void;
 }

package/README.md

@@ -6,11 +6,11 @@ look and much more!
 
 ## Live example
 
-See the widget in action in the [widget configurator](https://widget.cow.finance)
+See the widget in action in the [widget configurator](https://widget.cow.fi)
 
 ## Docs
 
-You can find a detailed description of all widget parameters in the [documentation](https://docs.cow.finance/cow-protocol/tutorials/widget)
+You can find a detailed description of all widget parameters in the [documentation](https://docs.cow.fi/cow-protocol/tutorials/widget)
 
 ## Quick start
 

package/const.d.ts

@@ -0,0 +1 @@
+export declare const COWSWAP_ORIGIN = "https://swap.cow.fi";

package/cowSwapWidget.constants.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Iframe sandbox allowlist for the embedded CoW Swap app.
+ * - allow-scripts + allow-same-origin: required for the SPA, storage, and same-origin API calls.
+ * - allow-forms: trade inputs and similar controls.
+ * - allow-popups + allow-popups-to-escape-sandbox: wallet connect / WalletConnect windows.
+ */
+export declare const WIDGET_IFRAME_SANDBOX = "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox";
+/** Limits referrer leakage when the widget is embedded on third-party origins. */
+export declare const WIDGET_IFRAME_REFERRER_POLICY = "strict-origin-when-cross-origin";
+/** Permissions policy features delegated to the widget iframe (see HTML `allow` attribute). */
+export declare const WIDGET_IFRAME_ALLOW = "clipboard-read; clipboard-write";

package/cowSwapWidget.d.ts

@@ -4,6 +4,7 @@ import { CowSwapWidgetParams, CowSwapWidgetProps, EthereumProvider } from './typ
  * Callback function signature for updating the CoW Swap Widget.
  */
 export interface CowSwapWidgetHandler {
+    iframe: HTMLIFrameElement;
     updateParams: (params: CowSwapWidgetParams) => void;
     updateListeners: (newListeners?: CowWidgetEventListeners) => void;
     updateProvider: (newProvider?: EthereumProvider) => void;

package/index.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const S=require("@cowprotocol/iframe-transport"),b=require("@cowprotocol/events");var c=(e=>(e.ACTIVATE="ACTIVATE",e.READY="READY",e.UPDATE_HEIGHT="UPDATE_HEIGHT",e.SET_FULL_HEIGHT="SET_FULL_HEIGHT",e.EMIT_COW_EVENT="EMIT_COW_EVENT",e.PROVIDER_RPC_REQUEST="PROVIDER_RPC_REQUEST",e.INTERCEPT_WINDOW_OPEN="INTERCEPT_WINDOW_OPEN",e.PROCESS_HOOK="PROCESS_HOOK",e))(c||{}),T=(e=>(e.UPDATE_PARAMS="UPDATE_PARAMS",e.UPDATE_APP_DATA="UPDATE_APP_DATA",e.PROVIDER_RPC_RESPONSE="PROVIDER_RPC_RESPONSE",e.PROVIDER_ON_EVENT="PROVIDER_ON_EVENT",e.HOOK_RESULT="HOOK_RESULT",e))(T||{}),E=(e=>(e.ON_BEFORE_APPROVAL="ON_BEFORE_APPROVAL",e.ON_BEFORE_TRADE="ON_BEFORE_TRADE",e.ON_BEFORE_WRAP_UNWRAP="ON_BEFORE_WRAP_UNWRAP",e.ON_BEFORE_ORDER_CANCEL="ON_BEFORE_ORDER_CANCEL",e.ON_BEFORE_ORDERS_CANCEL="ON_BEFORE_ORDERS_CANCEL",e))(E||{}),P=(e=>(e.SWAP="swap",e.LIMIT="limit",e.ADVANCED="advanced",e.YIELD="yield",e))(P||{});const U=["primary","background","paper","text","danger","warning","alert","info","success"],s=new S.IframeTransport("cowSwapWidget");class y{constructor(t,n,o=[]){this.contentWindow=t,this.updateListeners(o),this.widgetListener=s.listenToMessageFromWindow(this.contentWindow,c.EMIT_COW_EVENT,r=>this.eventEmitter.emit(r.event,r.payload),n)}eventEmitter=new b.SimpleCowEventEmitter;listeners=[];widgetListener;stopListeningIframe(){s.stopListeningWindowListener(this.contentWindow,this.widgetListener)}updateListeners(t){for(const n of this.listeners)this.eventEmitter.off(n);this.listeners=t||[];for(const n of this.listeners)this.eventEmitter.on(n)}}class H{constructor(t,n){this.appWindow=t,this.iframeWidow=n,this.forwardSdkMessage=o=>{F(o.data)&&(typeof window<"u"&&o.origin===window.location.origin||(B(o.data)?this.appWindow.parent.postMessage(o.data,"*"):M(o.data)&&this.iframeWidow.postMessage(o.data,"*")))},this.startListening()}forwardSdkMessage;startListening(){this.appWindow.addEventListener("message",this.forwardSdkMessage)}stopListening(){this.appWindow.removeEventListener("message",this.forwardSdkMessage)}}function F(e){return typeof e=="object"&&e!==null&&"id"in e&&typeof e.id=="string"}function B(e){return"method"in e&&typeof e.method=="string"&&"params"in e&&"env"in e&&typeof e.env=="object"&&e.env!==null&&"sdkVersion"in e.env}function M(e){return"success"in e&&typeof e.success=="boolean"&&"version"in e&&typeof e.version=="string"}function V(e="Default",t="#1c5dbf",...n){console.debug(`%c [COW][${e}]`,`font-weight: bold; color: ${t}`,...n)}function k(...e){V("Widget","#47aba8",...e)}function v(e){return!!(e&&typeof e=="object")}const C="_";function j(e){const t=typeof e.baseUrl=="string"?e.baseUrl:"https://swap.cow.finance",n=I(e);return t+"/#"+n+"?"+W(e)}function I(e){const{chainId:t=1,sell:n,buy:o,tradeType:r=P.SWAP}=e,a=[n?.asset||C,o?.asset||C].map(encodeURIComponent).join("/");return`/${t}/widget/${r}/${a}`}function W(e){const t=new URLSearchParams;return K($(Q(x(G(t,e),e),e),e),e)}function G(e,t){const{sell:n,buy:o}=t;return n?.amount&&e.append("sellAmount",n.amount),o?.amount&&e.append("buyAmount",o.amount),e}function x(e,t){const n=t.theme;return n?(v(n)?(e.append("palette",encodeURIComponent(JSON.stringify(n))),e.append("theme",n.baseTheme)):(e.append("palette","null"),e.append("theme",n)),e):(e.append("palette","null"),e)}function Q(e,t){return t.targetChainId&&e.append("targetChainId",t.targetChainId.toString()),e}function $(e,t){return t.locale&&e.append("lng",t.locale),e}function K(e,t){return Y(t.hooks)?e.append("hooksEnabled","true"):e.delete("hooksEnabled"),e}function Y(e){return!!e&&Object.values(e).some(Boolean)}const N="640px",J="450px",X=20,z={updateParams:()=>{},updateListeners:()=>{},updateProvider:()=>{},destroy:()=>{}};function Z(e,t){const{params:n,provider:o,listeners:r,onReady:a}=t;let f=o,w=n;if(typeof window>"u")return z;const d=q(n),i=ee(d);k("Resolved trusted iframe origin",{iframeOrigin:i});const p=[];a&&p.push(ne(d.contentWindow||window,i,a)),e.innerHTML="",e.appendChild(d);const{contentWindow:u}=d;if(!u)throw console.error("Iframe does not contain a window",d),new Error("Iframe does not contain a window!");p.push(te(u,i,n.appCode)),p.push(...se(d,i,n.height,n.maxHeight)),p.push(oe(i));let R=null;function A(){u&&(R&&window.removeEventListener("message",R),R=ue(u,i,w.hooks),p.push(R))}A();const g=new y(window,i,r);let h=m(u,i,null,f);d.addEventListener("load",()=>{L(u,i,w,f)});const D=new H(window,u);return{updateParams:l=>{w=l,L(u,i,w,f),A()},updateListeners:l=>g.updateListeners(l),updateProvider:l=>{f=l,h=m(u,i,h,l)},destroy:()=>{h.disconnect(),g.stopListeningIframe(),p.forEach(l=>window.removeEventListener("message",l)),D.stopListening(),e.removeChild(d)}}}function m(e,t,n,o){n&&n.disconnect();const r=n||new S.IframeRpcProviderBridge(e,t);return o&&r.onConnect(o),r}function q(e){const{width:t=J,height:n=N}=e,o=document.createElement("iframe");return o.src=j(e),o.width=t,o.height=n,o.style.border="0",o.allow="clipboard-read; clipboard-write",o}function ee(e){return new URL(e.src).origin}function L(e,t,n,o){const r=!!o,a=I(n),f=W(n).toString(),{theme:w,hooks:d,...i}=n;s.postMessageToWindow(e,T.UPDATE_PARAMS,{urlParams:{pathname:a,search:f},appParams:i,hasProvider:r},t)}function te(e,t,n){return s.listenToMessageFromWindow(window,c.ACTIVATE,()=>{s.postMessageToWindow(e,T.UPDATE_APP_DATA,{metaData:n?{appCode:n}:void 0},t)},t)}function ne(e,t,n){let o=!1;return s.listenToMessageFromWindow(window,c.READY,()=>{o||(o=!0,n())},t)}function oe(e){return s.listenToMessageFromWindow(window,c.INTERCEPT_WINDOW_OPEN,({href:t,rel:n,target:o})=>{const r=re(t.toString(),e);r&&ie(r)&&window.open(r,o,n)},e)}function re(e,t){const n=e.trim();if(!n)return null;try{return new URL(n,t).toString()}catch{return null}}function ie(e){try{const t=new URL(e).protocol;return t==="http:"||t==="https:"}catch{return!1}}function se(e,t,n=N,o){return[s.listenToMessageFromWindow(window,c.UPDATE_HEIGHT,r=>{const a=r.height?r.height+X:void 0;e.style.height=a?`${o?Math.min(a,o):a}px`:n},t),s.listenToMessageFromWindow(window,c.SET_FULL_HEIGHT,({isUpToSmall:r})=>{e.style.height=r?n:`${o||document.body.offsetHeight}px`},t)]}const ae={[E.ON_BEFORE_APPROVAL]:(e,t)=>t?.onBeforeApproval?t.onBeforeApproval(e):!0,[E.ON_BEFORE_TRADE]:(e,t)=>t?.onBeforeTrade?t.onBeforeTrade(e):!0,[E.ON_BEFORE_WRAP_UNWRAP]:(e,t)=>t?.onBeforeWrapOrUnwrap?t.onBeforeWrapOrUnwrap(e):!0,[E.ON_BEFORE_ORDER_CANCEL]:(e,t)=>t?.onBeforeOrderCancel?t.onBeforeOrderCancel(e):!0,[E.ON_BEFORE_ORDERS_CANCEL]:(e,t)=>t?.onBeforeOrdersCancel?t.onBeforeOrdersCancel(e):!0};function de(e,t){return ae[e.event](e.payload,t)}function ue(e,t,n){return s.listenToMessageFromWindow(window,c.PROCESS_HOOK,async o=>{let r=!1;try{r=await de(o,n)}catch{}s.postMessageToWindow(e,T.HOOK_RESULT,{id:o.id,result:r},t)},t)}const ce=Object.values(P);function le(e,t,n){if(_(e)){const o=e[n];return O(o)?o[t]:o}if(O(e)){const o=e[t];return _(o)?o[n]:o}return e}function _(e){return typeof e!="object"?!1:Object.keys(e).every(t=>ce.includes(t))}const Ee=/^\d+$/;function O(e){return typeof e!="object"?!1:Object.keys(e).every(t=>Ee.test(t))}function fe(e){return _(e)?Object.values(e).flatMap(t=>O(t)?Object.values(t):[t]):O(e)?Object.values(e).flatMap(t=>_(t)?Object.values(t):[t]):[e]}exports.TradeType=P;exports.WIDGET_PALETTE_COLORS=U;exports.WidgetHookEvents=E;exports.WidgetMethodsEmit=c;exports.WidgetMethodsListen=T;exports.createCowSwapWidget=Z;exports.isCowSwapWidgetPalette=v;exports.isPerNetworkConfig=O;exports.isPerTradeTypeConfig=_;exports.resolveFlexibleConfig=le;exports.resolveFlexibleConfigValues=fe;exports.widgetIframeTransport=s;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const S=require("@cowprotocol/iframe-transport"),G=require("@cowprotocol/events"),N="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox",v="strict-origin-when-cross-origin",U="clipboard-read; clipboard-write";var c=(e=>(e.ACTIVATE="ACTIVATE",e.READY="READY",e.UPDATE_HEIGHT="UPDATE_HEIGHT",e.SET_FULL_HEIGHT="SET_FULL_HEIGHT",e.EMIT_COW_EVENT="EMIT_COW_EVENT",e.PROVIDER_RPC_REQUEST="PROVIDER_RPC_REQUEST",e.INTERCEPT_WINDOW_OPEN="INTERCEPT_WINDOW_OPEN",e.PROCESS_HOOK="PROCESS_HOOK",e))(c||{}),O=(e=>(e.UPDATE_PARAMS="UPDATE_PARAMS",e.UPDATE_APP_DATA="UPDATE_APP_DATA",e.PROVIDER_RPC_RESPONSE="PROVIDER_RPC_RESPONSE",e.PROVIDER_ON_EVENT="PROVIDER_ON_EVENT",e.HOOK_RESULT="HOOK_RESULT",e))(O||{}),p=(e=>(e.ON_BEFORE_APPROVAL="ON_BEFORE_APPROVAL",e.ON_BEFORE_TRADE="ON_BEFORE_TRADE",e.ON_BEFORE_WRAP_UNWRAP="ON_BEFORE_WRAP_UNWRAP",e.ON_BEFORE_ORDER_CANCEL="ON_BEFORE_ORDER_CANCEL",e.ON_BEFORE_ORDERS_CANCEL="ON_BEFORE_ORDERS_CANCEL",e))(p||{}),h=(e=>(e.SWAP="swap",e.LIMIT="limit",e.ADVANCED="advanced",e.YIELD="yield",e))(h||{});const $=["primary","background","paper","text","danger","warning","alert","info","success"],d=new S.IframeTransport("cowSwapWidget");class j{constructor(t,n,o,r=[]){this.contentWindow=t,this.updateListeners(r),this.widgetListener=d.listenToMessageFromWindow(this.contentWindow,o,c.EMIT_COW_EVENT,i=>this.eventEmitter.emit(i.event,i.payload),n)}eventEmitter=new G.SimpleCowEventEmitter;listeners=[];widgetListener;stopListeningIframe(){d.stopListeningWindowListener(this.contentWindow,this.widgetListener)}updateListeners(t){for(const n of this.listeners)this.eventEmitter.off(n);this.listeners=t||[];for(const n of this.listeners)this.eventEmitter.on(n)}}class x{constructor(t,n){this.appWindow=t,this.iframeWidow=n,this.forwardSdkMessage=o=>{Q(o.data)&&(typeof window<"u"&&o.origin===window.location.origin||(K(o.data)?this.appWindow.parent.postMessage(o.data,"*"):Y(o.data)&&this.iframeWidow.postMessage(o.data,"*")))},this.startListening()}forwardSdkMessage;startListening(){this.appWindow.addEventListener("message",this.forwardSdkMessage)}stopListening(){this.appWindow.removeEventListener("message",this.forwardSdkMessage)}}function Q(e){return typeof e=="object"&&e!==null&&"id"in e&&typeof e.id=="string"}function K(e){return"method"in e&&typeof e.method=="string"&&"params"in e&&"env"in e&&typeof e.env=="object"&&e.env!==null&&"sdkVersion"in e.env}function Y(e){return"success"in e&&typeof e.success=="boolean"&&"version"in e&&typeof e.version=="string"}function X(e="Default",t="#1c5dbf",...n){console.debug(`%c [COW][${e}]`,`font-weight: bold; color: ${t}`,...n)}function z(...e){process.env.NODE_ENV!=="test"&&X("Widget","#47aba8",...e)}const F="https://swap.cow.fi";function b(e){return!!(e&&typeof e=="object")}const W="_",J="CoW Swap widget: invalid baseUrl.",H=!1;function Z(e){return e==="localhost"||e==="127.0.0.1"||e==="::1"||e.endsWith(".localhost")}function g(e,t){const n=`${J} ${e}`;if(t)throw new Error(n);return console.error("[CoW Widget]",n),F}function y(e,t=H){const n=typeof e=="string"?e.trim():"";if(!n)return F;let o;try{o=new URL(n)}catch{return g(`Not a valid URL: ${JSON.stringify(n)}`,t)}if(o.username||o.password)return g("Userinfo (username/password) in URL is not allowed.",t);const r=o.protocol==="https:",i=o.protocol==="http:"&&Z(o.hostname);if(!r&&!i)return g(`Use https, or http only on localhost / 127.0.0.1 / ::1 / *.localhost (got ${o.protocol}//${o.hostname}).`,t);const u=o.pathname==="/"||o.pathname===""?"":o.pathname.replace(/\/+$/,"");return`${o.origin}${u}`}function q(e){const t=y(e.baseUrl),n=B(e);return t+"/#"+n+"?"+M(e)}function B(e){const{chainId:t=1,sell:n,buy:o,tradeType:r=h.SWAP}=e,i=[n?.asset||W,o?.asset||W].map(encodeURIComponent).join("/");return`/${t}/widget/${r}/${i}`}function M(e){const t=new URLSearchParams;return re(oe(ne(te(ee(t,e),e),e),e),e)}function ee(e,t){const{sell:n,buy:o}=t;return n?.amount&&e.append("sellAmount",n.amount),o?.amount&&e.append("buyAmount",o.amount),e}function te(e,t){const n=t.theme;return n?(b(n)?(e.append("palette",encodeURIComponent(JSON.stringify(n))),e.append("theme",n.baseTheme)):(e.append("palette","null"),e.append("theme",n)),e):(e.append("palette","null"),e)}function ne(e,t){return t.targetChainId&&e.append("targetChainId",t.targetChainId.toString()),e}function oe(e,t){return t.locale&&e.append("lng",t.locale),e}function re(e,t){return ie(t.hooks)?e.append("hooksEnabled","true"):e.delete("hooksEnabled"),e}function ie(e){return!!e&&Object.values(e).some(Boolean)}const V="640px",se="450px",ae=20,de={iframe:document.createElement("iframe"),updateParams:()=>{},updateListeners:()=>{},updateProvider:()=>{},destroy:()=>{}};function le(e,t){const{params:n,provider:o,listeners:r,onReady:i}=t;let u=o,f=n;if(typeof window>"u")return de;const l=ce(n),s=ue(l);z("Resolved trusted iframe origin",{iframeOrigin:s});const w=[];i&&w.push(pe(l.contentWindow||window,s,i)),e.innerHTML="",e.appendChild(l);const{contentWindow:a}=l;if(!a)throw console.error("Iframe does not contain a window",l),new Error("Iframe does not contain a window!");w.push(Ee(a,s,n.appCode)),w.push(...Re(l,s,n.height,n.maxHeight));let T=null;function L(){a&&(T&&window.removeEventListener("message",T),!f.disableWindowOpen&&(T=fe(s,a),w.push(T)))}let A=null;function I(){a&&(A&&window.removeEventListener("message",A),A=Ae(a,s,f.hooks),w.push(A))}L(),I();const m=new j(window,s,a,r);let P=C(a,s,null,u);l.addEventListener("load",()=>{D(a,s,f,u)});const k=new x(window,a);return{iframe:l,updateParams:E=>{f=E,D(a,s,f,u),L(),I()},updateListeners:E=>m.updateListeners(E),updateProvider:E=>{u=E,P=C(a,s,P,E)},destroy:()=>{P.disconnect(),m.stopListeningIframe(),w.forEach(E=>window.removeEventListener("message",E)),k.stopListening(),e.removeChild(l)}}}function C(e,t,n,o){n&&n.disconnect();const r=n||new S.IframeRpcProviderBridge(e,t);return o&&r.onConnect(o),r}function ce(e){const{width:t=se,height:n=V}=e,o=document.createElement("iframe");return o.src=q(e),o.width=t,o.height=n,o.style.border="0",o.setAttribute("sandbox",N),o.referrerPolicy=v,o.allow=U,o}function ue(e){return new URL(e.src).origin}function D(e,t,n,o){const r=!!o,i=B(n),u=M(n).toString(),{theme:f,hooks:l,...s}=n;d.postMessageToWindow(e,O.UPDATE_PARAMS,{urlParams:{pathname:i,search:u},appParams:s,hasProvider:r},t)}function Ee(e,t,n){return d.listenToMessageFromWindow(window,e,c.ACTIVATE,()=>{d.postMessageToWindow(e,O.UPDATE_APP_DATA,{metaData:n?{appCode:n}:void 0},t)},t)}function pe(e,t,n){let o=!1;return d.listenToMessageFromWindow(window,e,c.READY,()=>{o||(o=!0,n())},t)}function fe(e,t){return d.listenToMessageFromWindow(window,t,c.INTERCEPT_WINDOW_OPEN,({href:n,rel:o,target:r})=>{const i=we(n.toString(),e);i&&_e(i)&&window.open(i,r,o)},e)}function we(e,t){const n=e.trim();if(!n)return null;try{return new URL(n,t).toString()}catch{return null}}function _e(e){try{const t=new URL(e).protocol;return t==="http:"||t==="https:"}catch{return!1}}function Re(e,t,n=V,o){return e.contentWindow?[d.listenToMessageFromWindow(window,e.contentWindow,c.UPDATE_HEIGHT,r=>{const i=r.height?r.height+ae:void 0;e.style.height=i?`${o?Math.min(i,o):i}px`:n},t),d.listenToMessageFromWindow(window,e.contentWindow,c.SET_FULL_HEIGHT,({isUpToSmall:r})=>{e.style.height=r?n:`${o||document.body.offsetHeight}px`},t)]:[]}const Oe={[p.ON_BEFORE_APPROVAL]:(e,t)=>t?.onBeforeApproval?t.onBeforeApproval(e):!0,[p.ON_BEFORE_TRADE]:(e,t)=>t?.onBeforeTrade?t.onBeforeTrade(e):!0,[p.ON_BEFORE_WRAP_UNWRAP]:(e,t)=>t?.onBeforeWrapOrUnwrap?t.onBeforeWrapOrUnwrap(e):!0,[p.ON_BEFORE_ORDER_CANCEL]:(e,t)=>t?.onBeforeOrderCancel?t.onBeforeOrderCancel(e):!0,[p.ON_BEFORE_ORDERS_CANCEL]:(e,t)=>t?.onBeforeOrdersCancel?t.onBeforeOrdersCancel(e):!0};function Te(e,t){return Oe[e.event](e.payload,t)}function Ae(e,t,n){return d.listenToMessageFromWindow(window,e,c.PROCESS_HOOK,async o=>{let r=!1;try{r=await Te(o,n)}catch{}d.postMessageToWindow(e,O.HOOK_RESULT,{id:o.id,result:r},t)},t)}const he=Object.values(h);function Pe(e,t,n){if(_(e)){const o=e[n];return R(o)?o[t]:o}if(R(e)){const o=e[t];return _(o)?o[n]:o}return e}function _(e){return typeof e!="object"?!1:Object.keys(e).every(t=>he.includes(t))}const ge=/^\d+$/;function R(e){return typeof e!="object"?!1:Object.keys(e).every(t=>ge.test(t))}function Le(e){return _(e)?Object.values(e).flatMap(t=>R(t)?Object.values(t):[t]):R(e)?Object.values(e).flatMap(t=>_(t)?Object.values(t):[t]):[e]}exports.SHOULD_THROW_IF_INVALID_URL=H;exports.TradeType=h;exports.WIDGET_IFRAME_ALLOW=U;exports.WIDGET_IFRAME_REFERRER_POLICY=v;exports.WIDGET_IFRAME_SANDBOX=N;exports.WIDGET_PALETTE_COLORS=$;exports.WidgetHookEvents=p;exports.WidgetMethodsEmit=c;exports.WidgetMethodsListen=O;exports.createCowSwapWidget=le;exports.isCowSwapWidgetPalette=b;exports.isPerNetworkConfig=R;exports.isPerTradeTypeConfig=_;exports.resolveFlexibleConfig=Pe;exports.resolveFlexibleConfigValues=Le;exports.sanitizeWidgetBaseUrl=y;exports.widgetIframeTransport=d;

package/index.d.ts

@@ -1,7 +1,9 @@
 export { createCowSwapWidget } from './cowSwapWidget';
+export { WIDGET_IFRAME_ALLOW, WIDGET_IFRAME_REFERRER_POLICY, WIDGET_IFRAME_SANDBOX } from './cowSwapWidget.constants';
 export { widgetIframeTransport } from './widgetIframeTransport';
 export type { CowSwapWidgetHandler } from './cowSwapWidget';
 export { resolveFlexibleConfigValues } from './resolveFlexibleConfigValues';
+export { sanitizeWidgetBaseUrl, SHOULD_THROW_IF_INVALID_URL } from './urlUtils';
 export * from './types';
 export * from './themeUtils';
 export * from './flexibleConfig';

package/index.js

@@ -1,29 +1,30 @@
-import { IframeTransport as D, IframeRpcProviderBridge as W } from "@cowprotocol/iframe-transport";
-import { SimpleCowEventEmitter as U } from "@cowprotocol/events";
-var l = /* @__PURE__ */ ((e) => (e.ACTIVATE = "ACTIVATE", e.READY = "READY", e.UPDATE_HEIGHT = "UPDATE_HEIGHT", e.SET_FULL_HEIGHT = "SET_FULL_HEIGHT", e.EMIT_COW_EVENT = "EMIT_COW_EVENT", e.PROVIDER_RPC_REQUEST = "PROVIDER_RPC_REQUEST", e.INTERCEPT_WINDOW_OPEN = "INTERCEPT_WINDOW_OPEN", e.PROCESS_HOOK = "PROCESS_HOOK", e))(l || {}), T = /* @__PURE__ */ ((e) => (e.UPDATE_PARAMS = "UPDATE_PARAMS", e.UPDATE_APP_DATA = "UPDATE_APP_DATA", e.PROVIDER_RPC_RESPONSE = "PROVIDER_RPC_RESPONSE", e.PROVIDER_ON_EVENT = "PROVIDER_ON_EVENT", e.HOOK_RESULT = "HOOK_RESULT", e))(T || {}), p = /* @__PURE__ */ ((e) => (e.ON_BEFORE_APPROVAL = "ON_BEFORE_APPROVAL", e.ON_BEFORE_TRADE = "ON_BEFORE_TRADE", e.ON_BEFORE_WRAP_UNWRAP = "ON_BEFORE_WRAP_UNWRAP", e.ON_BEFORE_ORDER_CANCEL = "ON_BEFORE_ORDER_CANCEL", e.ON_BEFORE_ORDERS_CANCEL = "ON_BEFORE_ORDERS_CANCEL", e))(p || {}), A = /* @__PURE__ */ ((e) => (e.SWAP = "swap", e.LIMIT = "limit", e.ADVANCED = "advanced", e.YIELD = "yield", e))(A || {});
-const fe = ["primary", "background", "paper", "text", "danger", "warning", "alert", "info", "success"], s = new D("cowSwapWidget");
-class b {
-  constructor(n, t, o = []) {
-    this.contentWindow = n, this.updateListeners(o), this.widgetListener = s.listenToMessageFromWindow(this.contentWindow, l.EMIT_COW_EVENT, (r) => this.eventEmitter.emit(r.event, r.payload), t);
+import { IframeTransport as b, IframeRpcProviderBridge as F } from "@cowprotocol/iframe-transport";
+import { SimpleCowEventEmitter as y } from "@cowprotocol/events";
+const B = "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox", M = "strict-origin-when-cross-origin", V = "clipboard-read; clipboard-write";
+var p = /* @__PURE__ */ ((e) => (e.ACTIVATE = "ACTIVATE", e.READY = "READY", e.UPDATE_HEIGHT = "UPDATE_HEIGHT", e.SET_FULL_HEIGHT = "SET_FULL_HEIGHT", e.EMIT_COW_EVENT = "EMIT_COW_EVENT", e.PROVIDER_RPC_REQUEST = "PROVIDER_RPC_REQUEST", e.INTERCEPT_WINDOW_OPEN = "INTERCEPT_WINDOW_OPEN", e.PROCESS_HOOK = "PROCESS_HOOK", e))(p || {}), h = /* @__PURE__ */ ((e) => (e.UPDATE_PARAMS = "UPDATE_PARAMS", e.UPDATE_APP_DATA = "UPDATE_APP_DATA", e.PROVIDER_RPC_RESPONSE = "PROVIDER_RPC_RESPONSE", e.PROVIDER_ON_EVENT = "PROVIDER_ON_EVENT", e.HOOK_RESULT = "HOOK_RESULT", e))(h || {}), w = /* @__PURE__ */ ((e) => (e.ON_BEFORE_APPROVAL = "ON_BEFORE_APPROVAL", e.ON_BEFORE_TRADE = "ON_BEFORE_TRADE", e.ON_BEFORE_WRAP_UNWRAP = "ON_BEFORE_WRAP_UNWRAP", e.ON_BEFORE_ORDER_CANCEL = "ON_BEFORE_ORDER_CANCEL", e.ON_BEFORE_ORDERS_CANCEL = "ON_BEFORE_ORDERS_CANCEL", e))(w || {}), m = /* @__PURE__ */ ((e) => (e.SWAP = "swap", e.LIMIT = "limit", e.ADVANCED = "advanced", e.YIELD = "yield", e))(m || {});
+const ge = ["primary", "background", "paper", "text", "danger", "warning", "alert", "info", "success"], d = new b("cowSwapWidget");
+class k {
+  constructor(t, n, o, r = []) {
+    this.contentWindow = t, this.updateListeners(r), this.widgetListener = d.listenToMessageFromWindow(this.contentWindow, o, p.EMIT_COW_EVENT, (i) => this.eventEmitter.emit(i.event, i.payload), n);
   }
-  eventEmitter = new U();
+  eventEmitter = new y();
   listeners = [];
   widgetListener;
   stopListeningIframe() {
-    s.stopListeningWindowListener(this.contentWindow, this.widgetListener);
+    d.stopListeningWindowListener(this.contentWindow, this.widgetListener);
   }
-  updateListeners(n) {
-    for (const t of this.listeners)
-      this.eventEmitter.off(t);
-    this.listeners = n || [];
-    for (const t of this.listeners)
-      this.eventEmitter.on(t);
+  updateListeners(t) {
+    for (const n of this.listeners)
+      this.eventEmitter.off(n);
+    this.listeners = t || [];
+    for (const n of this.listeners)
+      this.eventEmitter.on(n);
   }
 }
-class H {
-  constructor(n, t) {
-    this.appWindow = n, this.iframeWidow = t, this.forwardSdkMessage = (o) => {
-      y(o.data) && (typeof window < "u" && o.origin === window.location.origin || (B(o.data) ? this.appWindow.parent.postMessage(o.data, "*") : F(o.data) && this.iframeWidow.postMessage(o.data, "*")));
+class $ {
+  constructor(t, n) {
+    this.appWindow = t, this.iframeWidow = n, this.forwardSdkMessage = (o) => {
+      G(o.data) && (typeof window < "u" && o.origin === window.location.origin || (j(o.data) ? this.appWindow.parent.postMessage(o.data, "*") : x(o.data) && this.iframeWidow.postMessage(o.data, "*")));
     }, this.startListening();
   }
   forwardSdkMessage;
@@ -34,66 +35,95 @@ class H {
     this.appWindow.removeEventListener("message", this.forwardSdkMessage);
   }
 }
-function y(e) {
+function G(e) {
   return typeof e == "object" && e !== null && "id" in e && typeof e.id == "string";
 }
-function B(e) {
+function j(e) {
   return "method" in e && typeof e.method == "string" && "params" in e && "env" in e && typeof e.env == "object" && e.env !== null && "sdkVersion" in e.env;
 }
-function F(e) {
+function x(e) {
   return "success" in e && typeof e.success == "boolean" && "version" in e && typeof e.version == "string";
 }
-function M(e = "Default", n = "#1c5dbf", ...t) {
-  console.debug(`%c [COW][${e}]`, `font-weight: bold; color: ${n}`, ...t);
+function Q(e = "Default", t = "#1c5dbf", ...n) {
+  console.debug(`%c [COW][${e}]`, `font-weight: bold; color: ${t}`, ...n);
 }
-function V(...e) {
-  M("Widget", "#47aba8", ...e);
+function K(...e) {
+  process.env.NODE_ENV !== "test" && Q("Widget", "#47aba8", ...e);
 }
-function k(e) {
+const S = "https://swap.cow.fi";
+function Y(e) {
   return !!(e && typeof e == "object");
 }
-const C = "_";
-function j(e) {
-  const n = typeof e.baseUrl == "string" ? e.baseUrl : "https://swap.cow.finance", t = S(e);
-  return n + "/#" + t + "?" + I(e);
+const C = "_", X = "CoW Swap widget: invalid baseUrl.", J = !1;
+function z(e) {
+  return e === "localhost" || e === "127.0.0.1" || e === "::1" || e.endsWith(".localhost");
+}
+function P(e, t) {
+  const n = `${X} ${e}`;
+  if (t)
+    throw new Error(n);
+  return console.error("[CoW Widget]", n), S;
+}
+function Z(e, t = J) {
+  const n = typeof e == "string" ? e.trim() : "";
+  if (!n)
+    return S;
+  let o;
+  try {
+    o = new URL(n);
+  } catch {
+    return P(`Not a valid URL: ${JSON.stringify(n)}`, t);
+  }
+  if (o.username || o.password)
+    return P("Userinfo (username/password) in URL is not allowed.", t);
+  const r = o.protocol === "https:", i = o.protocol === "http:" && z(o.hostname);
+  if (!r && !i)
+    return P(`Use https, or http only on localhost / 127.0.0.1 / ::1 / *.localhost (got ${o.protocol}//${o.hostname}).`, t);
+  const l = o.pathname === "/" || o.pathname === "" ? "" : o.pathname.replace(/\/+$/, "");
+  return `${o.origin}${l}`;
 }
-function S(e) {
+function q(e) {
+  const t = Z(e.baseUrl), n = N(e);
+  return t + "/#" + n + "?" + v(e);
+}
+function N(e) {
   const {
-    chainId: n = 1,
-    sell: t,
+    chainId: t = 1,
+    sell: n,
     buy: o,
-    tradeType: r = A.SWAP
-  } = e, a = [t?.asset || C, o?.asset || C].map(encodeURIComponent).join("/");
-  return `/${n}/widget/${r}/${a}`;
+    tradeType: r = m.SWAP
+  } = e, i = [n?.asset || C, o?.asset || C].map(encodeURIComponent).join("/");
+  return `/${t}/widget/${r}/${i}`;
 }
-function I(e) {
-  const n = new URLSearchParams();
-  return K($(Q(x(G(n, e), e), e), e), e);
+function v(e) {
+  const t = new URLSearchParams();
+  return re(oe(ne(te(ee(t, e), e), e), e), e);
 }
-function G(e, n) {
+function ee(e, t) {
   const {
-    sell: t,
+    sell: n,
     buy: o
-  } = n;
-  return t?.amount && e.append("sellAmount", t.amount), o?.amount && e.append("buyAmount", o.amount), e;
+  } = t;
+  return n?.amount && e.append("sellAmount", n.amount), o?.amount && e.append("buyAmount", o.amount), e;
 }
-function x(e, n) {
-  const t = n.theme;
-  return t ? (k(t) ? (e.append("palette", encodeURIComponent(JSON.stringify(t))), e.append("theme", t.baseTheme)) : (e.append("palette", "null"), e.append("theme", t)), e) : (e.append("palette", "null"), e);
+function te(e, t) {
+  const n = t.theme;
+  return n ? (Y(n) ? (e.append("palette", encodeURIComponent(JSON.stringify(n))), e.append("theme", n.baseTheme)) : (e.append("palette", "null"), e.append("theme", n)), e) : (e.append("palette", "null"), e);
 }
-function Q(e, n) {
-  return n.targetChainId && e.append("targetChainId", n.targetChainId.toString()), e;
+function ne(e, t) {
+  return t.targetChainId && e.append("targetChainId", t.targetChainId.toString()), e;
 }
-function $(e, n) {
-  return n.locale && e.append("lng", n.locale), e;
+function oe(e, t) {
+  return t.locale && e.append("lng", t.locale), e;
 }
-function K(e, n) {
-  return Y(n.hooks) ? e.append("hooksEnabled", "true") : e.delete("hooksEnabled"), e;
+function re(e, t) {
+  return ie(t.hooks) ? e.append("hooksEnabled", "true") : e.delete("hooksEnabled"), e;
 }
-function Y(e) {
+function ie(e) {
   return !!e && Object.values(e).some(Boolean);
 }
-const N = "640px", J = "450px", X = 20, z = {
+const U = "640px", se = "450px", ae = 20, de = {
+  iframe: document.createElement("iframe"),
   updateParams: () => {
   },
   updateListeners: () => {
@@ -103,190 +133,200 @@ const N = "640px", J = "450px", X = 20, z = {
   destroy: () => {
   }
 };
-function pe(e, n) {
+function Le(e, t) {
   const {
-    params: t,
+    params: n,
     provider: o,
     listeners: r,
-    onReady: a
-  } = n;
-  let E = o, w = t;
-  if (typeof window > "u") return z;
-  const d = Z(t), i = q(d);
-  V("Resolved trusted iframe origin", {
-    iframeOrigin: i
+    onReady: i
+  } = t;
+  let l = o, E = n;
+  if (typeof window > "u") return de;
+  const c = ce(n), s = le(c);
+  K("Resolved trusted iframe origin", {
+    iframeOrigin: s
   });
   const f = [];
-  a && f.push(ne(d.contentWindow || window, i, a)), e.innerHTML = "", e.appendChild(d);
+  i && f.push(pe(c.contentWindow || window, s, i)), e.innerHTML = "", e.appendChild(c);
   const {
-    contentWindow: u
-  } = d;
-  if (!u)
-    throw console.error("Iframe does not contain a window", d), new Error("Iframe does not contain a window!");
-  f.push(ee(u, i, t.appCode)), f.push(...ie(d, i, t.height, t.maxHeight)), f.push(te(i));
+    contentWindow: a
+  } = c;
+  if (!a)
+    throw console.error("Iframe does not contain a window", c), new Error("Iframe does not contain a window!");
+  f.push(ue(a, s, n.appCode)), f.push(..._e(c, s, n.height, n.maxHeight));
   let _ = null;
-  function h() {
-    u && (_ && window.removeEventListener("message", _), _ = de(u, i, w.hooks), f.push(_));
+  function g() {
+    a && (_ && window.removeEventListener("message", _), !E.disableWindowOpen && (_ = Ee(s, a), f.push(_)));
   }
-  h();
-  const m = new b(window, i, r);
-  let P = g(u, i, null, E);
-  d.addEventListener("load", () => {
-    L(u, i, w, E);
+  let O = null;
+  function L() {
+    a && (O && window.removeEventListener("message", O), O = Te(a, s, E.hooks), f.push(O));
+  }
+  g(), L();
+  const I = new k(window, s, a, r);
+  let A = W(a, s, null, l);
+  c.addEventListener("load", () => {
+    D(a, s, E, l);
   });
-  const v = new H(window, u);
+  const H = new $(window, a);
   return {
-    updateParams: (c) => {
-      w = c, L(u, i, w, E), h();
+    iframe: c,
+    updateParams: (u) => {
+      E = u, D(a, s, E, l), g(), L();
     },
-    updateListeners: (c) => m.updateListeners(c),
-    updateProvider: (c) => {
-      E = c, P = g(u, i, P, c);
+    updateListeners: (u) => I.updateListeners(u),
+    updateProvider: (u) => {
+      l = u, A = W(a, s, A, u);
     },
     destroy: () => {
-      P.disconnect(), m.stopListeningIframe(), f.forEach((c) => window.removeEventListener("message", c)), v.stopListening(), e.removeChild(d);
+      A.disconnect(), I.stopListeningIframe(), f.forEach((u) => window.removeEventListener("message", u)), H.stopListening(), e.removeChild(c);
     }
   };
 }
-function g(e, n, t, o) {
-  t && t.disconnect();
-  const r = t || new W(e, n);
+function W(e, t, n, o) {
+  n && n.disconnect();
+  const r = n || new F(e, t);
   return o && r.onConnect(o), r;
 }
-function Z(e) {
+function ce(e) {
   const {
-    width: n = J,
-    height: t = N
+    width: t = se,
+    height: n = U
   } = e, o = document.createElement("iframe");
-  return o.src = j(e), o.width = n, o.height = t, o.style.border = "0", o.allow = "clipboard-read; clipboard-write", o;
+  return o.src = q(e), o.width = t, o.height = n, o.style.border = "0", o.setAttribute("sandbox", B), o.referrerPolicy = M, o.allow = V, o;
 }
-function q(e) {
+function le(e) {
   return new URL(e.src).origin;
 }
-function L(e, n, t, o) {
-  const r = !!o, a = S(t), E = I(t).toString(), {
-    theme: w,
-    hooks: d,
-    ...i
-  } = t;
-  s.postMessageToWindow(e, T.UPDATE_PARAMS, {
+function D(e, t, n, o) {
+  const r = !!o, i = N(n), l = v(n).toString(), {
+    theme: E,
+    hooks: c,
+    ...s
+  } = n;
+  d.postMessageToWindow(e, h.UPDATE_PARAMS, {
     urlParams: {
-      pathname: a,
-      search: E
+      pathname: i,
+      search: l
     },
-    appParams: i,
+    appParams: s,
     hasProvider: r
-  }, n);
+  }, t);
 }
-function ee(e, n, t) {
-  return s.listenToMessageFromWindow(window, l.ACTIVATE, () => {
-    s.postMessageToWindow(e, T.UPDATE_APP_DATA, {
-      metaData: t ? {
-        appCode: t
+function ue(e, t, n) {
+  return d.listenToMessageFromWindow(window, e, p.ACTIVATE, () => {
+    d.postMessageToWindow(e, h.UPDATE_APP_DATA, {
+      metaData: n ? {
+        appCode: n
       } : void 0
-    }, n);
-  }, n);
+    }, t);
+  }, t);
 }
-function ne(e, n, t) {
+function pe(e, t, n) {
   let o = !1;
-  return s.listenToMessageFromWindow(window, l.READY, () => {
-    o || (o = !0, t());
-  }, n);
+  return d.listenToMessageFromWindow(window, e, p.READY, () => {
+    o || (o = !0, n());
+  }, t);
 }
-function te(e) {
-  return s.listenToMessageFromWindow(window, l.INTERCEPT_WINDOW_OPEN, ({
+function Ee(e, t) {
+  return d.listenToMessageFromWindow(window, t, p.INTERCEPT_WINDOW_OPEN, ({
     href: n,
-    rel: t,
-    target: o
+    rel: o,
+    target: r
   }) => {
-    const r = oe(n.toString(), e);
-    r && re(r) && window.open(r, o, t);
+    const i = fe(n.toString(), e);
+    i && we(i) && window.open(i, r, o);
   }, e);
 }
-function oe(e, n) {
-  const t = e.trim();
-  if (!t)
+function fe(e, t) {
+  const n = e.trim();
+  if (!n)
     return null;
   try {
-    return new URL(t, n).toString();
+    return new URL(n, t).toString();
   } catch {
     return null;
   }
 }
-function re(e) {
+function we(e) {
   try {
-    const n = new URL(e).protocol;
-    return n === "http:" || n === "https:";
+    const t = new URL(e).protocol;
+    return t === "http:" || t === "https:";
   } catch {
     return !1;
   }
 }
-function ie(e, n, t = N, o) {
-  return [s.listenToMessageFromWindow(window, l.UPDATE_HEIGHT, (r) => {
-    const a = r.height ? r.height + X : void 0;
-    e.style.height = a ? `${o ? Math.min(a, o) : a}px` : t;
-  }, n), s.listenToMessageFromWindow(window, l.SET_FULL_HEIGHT, ({
+function _e(e, t, n = U, o) {
+  return e.contentWindow ? [d.listenToMessageFromWindow(window, e.contentWindow, p.UPDATE_HEIGHT, (r) => {
+    const i = r.height ? r.height + ae : void 0;
+    e.style.height = i ? `${o ? Math.min(i, o) : i}px` : n;
+  }, t), d.listenToMessageFromWindow(window, e.contentWindow, p.SET_FULL_HEIGHT, ({
     isUpToSmall: r
   }) => {
-    e.style.height = r ? t : `${o || document.body.offsetHeight}px`;
-  }, n)];
-}
-const se = {
-  [p.ON_BEFORE_APPROVAL]: (e, n) => n?.onBeforeApproval ? n.onBeforeApproval(e) : !0,
-  [p.ON_BEFORE_TRADE]: (e, n) => n?.onBeforeTrade ? n.onBeforeTrade(e) : !0,
-  [p.ON_BEFORE_WRAP_UNWRAP]: (e, n) => n?.onBeforeWrapOrUnwrap ? n.onBeforeWrapOrUnwrap(e) : !0,
-  [p.ON_BEFORE_ORDER_CANCEL]: (e, n) => n?.onBeforeOrderCancel ? n.onBeforeOrderCancel(e) : !0,
-  [p.ON_BEFORE_ORDERS_CANCEL]: (e, n) => n?.onBeforeOrdersCancel ? n.onBeforeOrdersCancel(e) : !0
+    e.style.height = r ? n : `${o || document.body.offsetHeight}px`;
+  }, t)] : [];
+}
+const Oe = {
+  [w.ON_BEFORE_APPROVAL]: (e, t) => t?.onBeforeApproval ? t.onBeforeApproval(e) : !0,
+  [w.ON_BEFORE_TRADE]: (e, t) => t?.onBeforeTrade ? t.onBeforeTrade(e) : !0,
+  [w.ON_BEFORE_WRAP_UNWRAP]: (e, t) => t?.onBeforeWrapOrUnwrap ? t.onBeforeWrapOrUnwrap(e) : !0,
+  [w.ON_BEFORE_ORDER_CANCEL]: (e, t) => t?.onBeforeOrderCancel ? t.onBeforeOrderCancel(e) : !0,
+  [w.ON_BEFORE_ORDERS_CANCEL]: (e, t) => t?.onBeforeOrdersCancel ? t.onBeforeOrdersCancel(e) : !0
 };
-function ae(e, n) {
-  return se[e.event](e.payload, n);
+function Re(e, t) {
+  return Oe[e.event](e.payload, t);
 }
-function de(e, n, t) {
-  return s.listenToMessageFromWindow(window, l.PROCESS_HOOK, async (o) => {
+function Te(e, t, n) {
+  return d.listenToMessageFromWindow(window, e, p.PROCESS_HOOK, async (o) => {
     let r = !1;
     try {
-      r = await ae(o, t);
+      r = await Re(o, n);
     } catch {
     }
-    s.postMessageToWindow(e, T.HOOK_RESULT, {
+    d.postMessageToWindow(e, h.HOOK_RESULT, {
       id: o.id,
       result: r
-    }, n);
-  }, n);
+    }, t);
+  }, t);
 }
-const ue = Object.values(A);
-function we(e, n, t) {
-  if (O(e)) {
-    const o = e[t];
-    return R(o) ? o[n] : o;
-  }
+const he = Object.values(m);
+function Ie(e, t, n) {
   if (R(e)) {
     const o = e[n];
-    return O(o) ? o[t] : o;
+    return T(o) ? o[t] : o;
+  }
+  if (T(e)) {
+    const o = e[t];
+    return R(o) ? o[n] : o;
   }
   return e;
 }
-function O(e) {
-  return typeof e != "object" ? !1 : Object.keys(e).every((n) => ue.includes(n));
-}
-const ce = /^\d+$/;
 function R(e) {
-  return typeof e != "object" ? !1 : Object.keys(e).every((n) => ce.test(n));
+  return typeof e != "object" ? !1 : Object.keys(e).every((t) => he.includes(t));
+}
+const Ae = /^\d+$/;
+function T(e) {
+  return typeof e != "object" ? !1 : Object.keys(e).every((t) => Ae.test(t));
 }
-function _e(e) {
-  return O(e) ? Object.values(e).flatMap((n) => R(n) ? Object.values(n) : [n]) : R(e) ? Object.values(e).flatMap((n) => O(n) ? Object.values(n) : [n]) : [e];
+function Ce(e) {
+  return R(e) ? Object.values(e).flatMap((t) => T(t) ? Object.values(t) : [t]) : T(e) ? Object.values(e).flatMap((t) => R(t) ? Object.values(t) : [t]) : [e];
 }
 export {
-  A as TradeType,
-  fe as WIDGET_PALETTE_COLORS,
-  p as WidgetHookEvents,
-  l as WidgetMethodsEmit,
-  T as WidgetMethodsListen,
-  pe as createCowSwapWidget,
-  k as isCowSwapWidgetPalette,
-  R as isPerNetworkConfig,
-  O as isPerTradeTypeConfig,
-  we as resolveFlexibleConfig,
-  _e as resolveFlexibleConfigValues,
-  s as widgetIframeTransport
+  J as SHOULD_THROW_IF_INVALID_URL,
+  m as TradeType,
+  V as WIDGET_IFRAME_ALLOW,
+  M as WIDGET_IFRAME_REFERRER_POLICY,
+  B as WIDGET_IFRAME_SANDBOX,
+  ge as WIDGET_PALETTE_COLORS,
+  w as WidgetHookEvents,
+  p as WidgetMethodsEmit,
+  h as WidgetMethodsListen,
+  Le as createCowSwapWidget,
+  Y as isCowSwapWidgetPalette,
+  T as isPerNetworkConfig,
+  R as isPerTradeTypeConfig,
+  Ie as resolveFlexibleConfig,
+  Ce as resolveFlexibleConfigValues,
+  Z as sanitizeWidgetBaseUrl,
+  d as widgetIframeTransport
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cowprotocol/widget-lib",
-  "version": "2.3.0",
+  "version": "3.1.1",
   "description": "CoW Swap Widget Library. Allows you to easily embed a CoW Swap widget on your website.",
   "repository": {
     "type": "git",
@@ -16,8 +16,8 @@
   },
   "dependencies": {
     "@cowprotocol/cow-sdk": "8.1.0",
-    "@cowprotocol/events": "^4.2.0",
-    "@cowprotocol/iframe-transport": "^2.1.0"
+    "@cowprotocol/events": "^4.2.1",
+    "@cowprotocol/iframe-transport": "^2.2.1"
   },
   "exports": {
     ".": {

package/types.d.ts

@@ -227,9 +227,19 @@ export interface CowSwapWidgetParams {
     /**
      * The base url of the widget implementation
      * The parameter can have the URL directly, or an object with the environment property,
-     * The base URL will default to the production environment if not specified, so it will use https://swap.cow.finance by default.
+     * The base URL will default to the production environment if not specified, so it will use https://swap.cow.fi by default.
+     *
+     * For security, values are validated before loading the iframe: only `https` origins are accepted,
+     * except `http` on local dev hosts (localhost, 127.0.0.1, ::1, *.localhost). Invalid URLs
+     * (unparsable, credentials, or disallowed scheme/host) either throw or log and fall back to the
+     * production host, depending on `SHOULD_THROW_IF_INVALID_URL` exported from `@cowprotocol/widget-lib`.
      */
     baseUrl?: string;
+    /**
+     * Overrides the origin trusted for postMessage communication with the widget iframe.
+     * Defaults to the origin derived from `baseUrl` / iframe src.
+     */
+    trustedOrigin?: string;
     /**
      * Sell token, and optionally the amount.
      */
@@ -290,6 +300,11 @@ export interface CowSwapWidgetParams {
      * Defaults to false.
      */
     disableToastMessages?: boolean;
+    /**
+     * When `true`, the host page will not use `window.open` to open links requested by the widget.
+     * Defaults to `false`.
+     */
+    disableWindowOpen?: boolean;
     /**
      * Option to hide the logo in the widget.
      */

package/urlUtils.d.ts

@@ -1,4 +1,18 @@
 import { CowSwapWidgetParams } from './types';
+/**
+ * When `true`, invalid `baseUrl` values throw and stop widget creation.
+ * When `false`, invalid values are reported with `console.error` and the iframe falls back to the production host.
+ */
+export declare const SHOULD_THROW_IF_INVALID_URL = false;
+/**
+ * Normalizes `baseUrl` for the widget iframe `src` and rejects unsafe values.
+ * - Omits or blank `baseUrl` → production default (https://swap.cow.fi).
+ * - Allows `https:` for any host (self-hosted / staging).
+ * - Allows `http:` only on local dev loopback hostnames.
+ * @param throwIfInvalid Overrides {@link SHOULD_THROW_IF_INVALID_URL} (e.g. for unit tests).
+ * @throws {Error} When validation fails and `throwIfInvalid` is true (see {@link SHOULD_THROW_IF_INVALID_URL}).
+ */
+export declare function sanitizeWidgetBaseUrl(baseUrl: string | undefined, throwIfInvalid?: boolean): string;
 export declare function buildWidgetUrl(params: Partial<CowSwapWidgetParams>): string;
 export declare function buildWidgetPath(params: Partial<CowSwapWidgetParams>): string;
 export declare function buildWidgetUrlQuery(params: Partial<CowSwapWidgetParams>): URLSearchParams;