@enbox/browser 0.3.38 → 0.3.40

package/dist/types/dweb-connect-wallet.d.ts

@@ -0,0 +1,101 @@
+/**
+ * DWeb Connect wallet transport — the wallet side of the popup/postMessage
+ * connect flow, exported for wallet apps (e.g. the Enbox web wallet).
+ *
+ * A wallet's `/dweb-connect` page creates one transport per session:
+ *
+ * 1. `create()` generates a fresh ephemeral X25519 key pair and emits the
+ *    `loaded` beacon (public key + wallet origin) to the opener window with a
+ *    pinned `targetOrigin`.
+ * 2. `awaitRequest()` receives the sealed request ciphertext and opens it via
+ *    the `@enbox/connect` kernel (`ConnectProvider.openRequest`), which
+ *    value-checks the `apv` origin binding against this wallet's origin.
+ * 3. After the consent ceremony, the wallet posts the sealed response JWE via
+ *    `sendResponse()` — or the deny token via `deny()` — back to the opener,
+ *    again with a pinned `targetOrigin`.
+ *
+ * The dapp origin is never assumed: it is taken from an explicit option or
+ * derived from `document.referrer`, and `create()` fails when neither is
+ * available. `'*'` is never used as a `targetOrigin`.
+ *
+ * @module
+ */
+import type { ConnectRequest } from '@enbox/connect';
+/** Options for creating a {@link WalletPostMessageTransport}. */
+export type WalletPostMessageTransportOptions = {
+    /**
+     * Origin of the dapp that opened this wallet popup. When omitted, it is
+     * derived from `document.referrer`; creation fails when neither is
+     * available — the transport never falls back to `'*'`.
+     */
+    dappOrigin?: string;
+    /**
+     * The dapp window to exchange messages with.
+     * @default window.opener
+     */
+    dappWindow?: Window;
+    /**
+     * Budget in milliseconds for awaiting the dapp's sealed request.
+     * @default 300_000 (5 minutes)
+     */
+    timeoutMs?: number;
+};
+/**
+ * Wallet-side postMessage transport for the DWeb Connect popup flow.
+ *
+ * Security properties:
+ * - `targetOrigin` of every outbound `postMessage` (beacon and response) is
+ *   pinned to the dapp origin — never `'*'`.
+ * - Inbound messages are dropped unless `event.origin` equals the pinned dapp
+ *   origin AND `event.source` is the dapp window.
+ * - The ephemeral X25519 private key never leaves the transport; the request
+ *   JWE is opened by the kernel with the `apv` header value-checked against
+ *   this wallet's own origin.
+ */
+export declare class WalletPostMessageTransport {
+    private readonly _dappOrigin;
+    private readonly _dappWindow;
+    private readonly _recipientPrivateKey;
+    private _requestReceived;
+    private _timeoutId?;
+    private _messageListener?;
+    private readonly _requestPromise;
+    private _resolveRequest?;
+    private _rejectRequest?;
+    private constructor();
+    /**
+     * Creates the transport for one connect session: resolves and pins the dapp
+     * origin, generates a fresh ephemeral X25519 key pair, starts listening for
+     * the sealed request, and emits the `loaded` beacon to the dapp window.
+     *
+     * @throws If not in a browser, if no dapp window is available, or if the
+     *         dapp origin can neither be supplied nor derived from the referrer.
+     */
+    static create(options?: WalletPostMessageTransportOptions): Promise<WalletPostMessageTransport>;
+    /** The pinned origin of the dapp this transport exchanges messages with. */
+    get dappOrigin(): string;
+    /**
+     * Awaits the dapp's sealed request and opens it via the kernel: ECDH-ES
+     * decryption with this session's ephemeral key, `apv` value-checked against
+     * this wallet's origin, JWT signature verification, and payload shape
+     * assertion. Rejects on timeout, on an unopenable request, or when the
+     * request does not use the `post_message` reply mode.
+     */
+    awaitRequest(): Promise<ConnectRequest>;
+    /**
+     * Posts the sealed response JWE (or the deny token) back to the dapp window
+     * with the `targetOrigin` pinned to the dapp origin, then closes the
+     * transport.
+     *
+     * @param idToken - The sealed response JWE, or the literal deny token.
+     */
+    sendResponse(idToken: string): void;
+    /** Posts the deny token back to the dapp — the user rejected the request. */
+    deny(): void;
+    /** Stops listening and releases the session's timers. Idempotent. */
+    close(): void;
+    private onMessage;
+    private openRequest;
+    private settleRequest;
+}
+//# sourceMappingURL=dweb-connect-wallet.d.ts.map

package/dist/types/dweb-connect-wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dweb-connect-wallet.d.ts","sourceRoot":"","sources":["../../src/dweb-connect-wallet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAgBrD,iEAAiE;AACjE,MAAM,MAAM,iCAAiC,GAAG;IAC9C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAM;IAE3C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,UAAU,CAAC,CAAgC;IACnD,OAAO,CAAC,gBAAgB,CAAC,CAAgC;IAEzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,eAAe,CAAC,CAAoC;IAC5D,OAAO,CAAC,cAAc,CAAC,CAAyB;IAEhD,OAAO;IAsBP;;;;;;;OAOG;WACiB,MAAM,CAAC,OAAO,GAAE,iCAAsC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAgChH,4EAA4E;IAC5E,IAAW,UAAU,IAAI,MAAM,CAE9B;IAED;;;;;;OAMG;IACU,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC;IAIpD;;;;;;OAMG;IACI,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ1C,6EAA6E;IACtE,IAAI,IAAI,IAAI;IAInB,qEAAqE;IAC9D,KAAK,IAAI,IAAI;IAQpB,OAAO,CAAC,SAAS;YAeH,WAAW;IAsBzB,OAAO,CAAC,aAAa;CAStB"}

package/dist/types/index.d.ts

@@ -27,12 +27,16 @@ export { Enbox, defineProtocol, repository, } from '@enbox/api';
 export type { EnboxAnonymousOptions, EnboxConnectOptions, EnboxConnectResult, EnboxParams, EnboxSessionParams, } from '@enbox/api';
 export { AuthManager, AuthSession, normalizeProtocolRequests, WalletConnect, } from '@enbox/auth/browser';
 export type { AuthEvent, AuthEventHandler, AuthManagerOptions, AuthState, ConnectHandler, ConnectOptions, ConnectResult, DisconnectOptions, HandlerConnectOptions, ImportFromPortableOptions, VaultConnectOptions, Permission, PortableIdentity, ProtocolRequest, RegistrationOptions, StorageAdapter, SyncOption, WalletConnectOptions, } from '@enbox/auth/browser';
+export { CONNECT_DENIED_TOKEN, ConnectProvider } from '@enbox/connect';
+export type { ConnectApproval, ConnectPermissionRequest, ConnectRequest } from '@enbox/connect';
 export * from './web-features.js';
 export { BrowserConnectHandler, DEFAULT_WALLETS } from './browser-connect-handler.js';
 export type { BrowserConnectHandlerOptions, WalletOption } from './browser-connect-handler.js';
-export { DWebConnect } from './dweb-connect-client.js';
-export type { DWebConnectClientOptions } from './dweb-connect-client.js';
+export { connectViaPopup, PopupClientTransport, PopupWindowClosedError } from './dweb-connect-client.js';
+export type { PopupClientTransportOptions, PopupConnectOptions } from './dweb-connect-client.js';
+export { WalletPostMessageTransport } from './dweb-connect-wallet.js';
+export type { WalletPostMessageTransportOptions } from './dweb-connect-wallet.js';
+export { DWEB_CONNECT_LOADED_MESSAGE_TYPE, DWEB_CONNECT_PATH, DWEB_CONNECT_REQUEST_MESSAGE_TYPE, DWEB_CONNECT_RESPONSE_MESSAGE_TYPE, } from './dweb-connect-messages.js';
+export type { DWebConnectLoadedMessage, DWebConnectRequestMessage, DWebConnectResponseMessage, } from './dweb-connect-messages.js';
 export { showWalletSelector } from './ui/wallet-selector.js';
-export { encryptPostMessagePayload, generateEphemeralKeyPair } from './dweb-connect-crypto.js';
-export type { EncryptedPostMessagePayload } from './dweb-connect-crypto.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,OAAO,EACL,KAAK,EACL,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAMpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAM7B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACtF,YAAY,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,YAAY,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,OAAO,EACL,KAAK,EACL,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAMpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAMhG,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACtF,YAAY,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACzG,YAAY,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACjG,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,YAAY,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EACL,gCAAgC,EAChC,iBAAiB,EACjB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/types/ui/wallet-selector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-selector.d.ts","sourceRoot":"","sources":["../../../src/ui/wallet-selector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAElE,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+K3E"}
+{"version":3,"file":"wallet-selector.d.ts","sourceRoot":"","sources":["../../../src/ui/wallet-selector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAElE,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoL3E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enbox/browser",
-  "version": "0.3.38",
+  "version": "0.3.40",
   "description": "Enbox tools and features to use in the browser",
   "type": "module",
   "main": "./dist/esm/index.js",
@@ -11,7 +11,7 @@
   "scripts": {
     "clean": "rm -rf dist",
     "build:esm": "rm -rf dist/esm dist/types && bun tsc -p tsconfig.json",
-    "build:browser": "rm -rf dist/browser.mjs && bun ../../build/browser-bundle.js --metafile --external @enbox/agent --external @enbox/api --external @enbox/auth --external @enbox/auth/browser --external @enbox/dids",
+    "build:browser": "rm -rf dist/browser.mjs && bun ../../build/browser-bundle.js --metafile --external @enbox/agent --external @enbox/api --external @enbox/auth --external @enbox/auth/browser --external @enbox/common --external @enbox/connect --external @enbox/crypto --external @enbox/dids",
     "build": "bun run clean && bun run build:esm && bun run build:browser",
     "lint": "eslint . --max-warnings 0",
     "lint:fix": "eslint . --fix",
@@ -66,10 +66,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@enbox/agent": "0.8.14",
-    "@enbox/api": "0.6.52",
-    "@enbox/auth": "0.6.60",
-    "@enbox/dids": "0.1.3"
+    "@enbox/agent": "0.8.16",
+    "@enbox/api": "0.6.54",
+    "@enbox/auth": "0.6.62",
+    "@enbox/common": "0.1.3",
+    "@enbox/connect": "0.1.1",
+    "@enbox/crypto": "0.1.5",
+    "@enbox/dids": "0.1.5"
   },
   "devDependencies": {
     "@typescript-eslint/eslint-plugin": "8.32.1",

package/src/browser-connect-handler.ts

@@ -7,10 +7,10 @@
  * @module
  */
 
-import type { ConnectPermissionRequest } from '@enbox/agent';
+import type { ConnectPermissionRequest } from '@enbox/connect';
 import type { ConnectHandler, ConnectResult } from '@enbox/auth';
 
-import { DWebConnect } from './dweb-connect-client.js';
+import { connectViaPopup } from './dweb-connect-client.js';
 import { showWalletSelector } from './ui/wallet-selector.js';
 
 /** A wallet entry shown in the wallet selector modal. */
@@ -121,8 +121,8 @@ export function BrowserConnectHandler(
         walletUrl = await showWalletSelector(wallets);
       }
 
-      // 2. Run the DWeb Connect popup flow.
-      return DWebConnect.initClient({
+      // 2. Run the DWeb Connect popup flow over the connect kernel.
+      return connectViaPopup({
         walletUrl,
         permissionRequests: params.permissionRequests,
         timeout,