@enbox/browser 0.3.39 → 0.3.40

package/dist/esm/dweb-connect-wallet.js

@@ -0,0 +1,209 @@
+/**
+ * DWeb Connect wallet transport — the wallet side of the popup/postMessage
+ * connect flow, exported for wallet apps (e.g. the Enbox web wallet).
+ *
+ * A wallet's `/dweb-connect` page creates one transport per session:
+ *
+ * 1. `create()` generates a fresh ephemeral X25519 key pair and emits the
+ *    `loaded` beacon (public key + wallet origin) to the opener window with a
+ *    pinned `targetOrigin`.
+ * 2. `awaitRequest()` receives the sealed request ciphertext and opens it via
+ *    the `@enbox/connect` kernel (`ConnectProvider.openRequest`), which
+ *    value-checks the `apv` origin binding against this wallet's origin.
+ * 3. After the consent ceremony, the wallet posts the sealed response JWE via
+ *    `sendResponse()` — or the deny token via `deny()` — back to the opener,
+ *    again with a pinned `targetOrigin`.
+ *
+ * The dapp origin is never assumed: it is taken from an explicit option or
+ * derived from `document.referrer`, and `create()` fails when neither is
+ * available. `'*'` is never used as a `targetOrigin`.
+ *
+ * @module
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { X25519 } from '@enbox/crypto';
+import { CONNECT_DENIED_TOKEN, ConnectProvider } from '@enbox/connect';
+import { DWEB_CONNECT_LOADED_MESSAGE_TYPE, DWEB_CONNECT_REQUEST_MESSAGE_TYPE, DWEB_CONNECT_RESPONSE_MESSAGE_TYPE, getTrustedMessage, } from './dweb-connect-messages.js';
+/** Default budget for awaiting the dapp's sealed request. */
+const DEFAULT_REQUEST_TIMEOUT_MS = 300000;
+/**
+ * Wallet-side postMessage transport for the DWeb Connect popup flow.
+ *
+ * Security properties:
+ * - `targetOrigin` of every outbound `postMessage` (beacon and response) is
+ *   pinned to the dapp origin — never `'*'`.
+ * - Inbound messages are dropped unless `event.origin` equals the pinned dapp
+ *   origin AND `event.source` is the dapp window.
+ * - The ephemeral X25519 private key never leaves the transport; the request
+ *   JWE is opened by the kernel with the `apv` header value-checked against
+ *   this wallet's own origin.
+ */
+export class WalletPostMessageTransport {
+    constructor(params) {
+        this._requestReceived = false;
+        this._dappOrigin = params.dappOrigin;
+        this._dappWindow = params.dappWindow;
+        this._recipientPrivateKey = params.recipientPrivateKey;
+        this._requestPromise = new Promise((resolve, reject) => {
+            this._resolveRequest = resolve;
+            this._rejectRequest = reject;
+        });
+        // Mark early rejections (timeout before `awaitRequest()` is called) as
+        // handled until the wallet attaches its own handlers.
+        this._requestPromise.catch(() => undefined);
+        this._messageListener = (event) => { this.onMessage(event); };
+        window.addEventListener('message', this._messageListener);
+        this._timeoutId = setTimeout(() => {
+            var _a;
+            this.close();
+            (_a = this._rejectRequest) === null || _a === void 0 ? void 0 : _a.call(this, new Error('[@enbox/browser] Timed out waiting for the connect request from the dapp.'));
+        }, params.timeoutMs);
+    }
+    /**
+     * Creates the transport for one connect session: resolves and pins the dapp
+     * origin, generates a fresh ephemeral X25519 key pair, starts listening for
+     * the sealed request, and emits the `loaded` beacon to the dapp window.
+     *
+     * @throws If not in a browser, if no dapp window is available, or if the
+     *         dapp origin can neither be supplied nor derived from the referrer.
+     */
+    static create() {
+        return __awaiter(this, arguments, void 0, function* (options = {}) {
+            var _a, _b;
+            if (typeof window === 'undefined') {
+                throw new Error('[@enbox/browser] WalletPostMessageTransport is only available in browser environments.');
+            }
+            const dappWindow = (_a = options.dappWindow) !== null && _a !== void 0 ? _a : window.opener;
+            if (!dappWindow) {
+                throw new Error('[@enbox/browser] No opener window: the DWeb Connect page must be opened as a popup by the dapp.');
+            }
+            const dappOrigin = resolveDappOrigin(options.dappOrigin);
+            const recipientPrivateKey = yield X25519.generateKey();
+            const walletEpk = { kty: 'OKP', crv: 'X25519', x: recipientPrivateKey.x };
+            const transport = new WalletPostMessageTransport({
+                dappOrigin,
+                dappWindow,
+                recipientPrivateKey,
+                timeoutMs: (_b = options.timeoutMs) !== null && _b !== void 0 ? _b : DEFAULT_REQUEST_TIMEOUT_MS,
+            });
+            // The listener is registered, so the beacon cannot race the request.
+            dappWindow.postMessage({
+                type: DWEB_CONNECT_LOADED_MESSAGE_TYPE,
+                walletEpk,
+                walletOrigin: globalThis.location.origin,
+            }, dappOrigin);
+            return transport;
+        });
+    }
+    /** The pinned origin of the dapp this transport exchanges messages with. */
+    get dappOrigin() {
+        return this._dappOrigin;
+    }
+    /**
+     * Awaits the dapp's sealed request and opens it via the kernel: ECDH-ES
+     * decryption with this session's ephemeral key, `apv` value-checked against
+     * this wallet's origin, JWT signature verification, and payload shape
+     * assertion. Rejects on timeout, on an unopenable request, or when the
+     * request does not use the `post_message` reply mode.
+     */
+    awaitRequest() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this._requestPromise;
+        });
+    }
+    /**
+     * Posts the sealed response JWE (or the deny token) back to the dapp window
+     * with the `targetOrigin` pinned to the dapp origin, then closes the
+     * transport.
+     *
+     * @param idToken - The sealed response JWE, or the literal deny token.
+     */
+    sendResponse(idToken) {
+        this._dappWindow.postMessage({
+            type: DWEB_CONNECT_RESPONSE_MESSAGE_TYPE,
+            payload: idToken,
+        }, this._dappOrigin);
+        this.close();
+    }
+    /** Posts the deny token back to the dapp — the user rejected the request. */
+    deny() {
+        this.sendResponse(CONNECT_DENIED_TOKEN);
+    }
+    /** Stops listening and releases the session's timers. Idempotent. */
+    close() {
+        clearTimeout(this._timeoutId);
+        if (this._messageListener !== undefined) {
+            window.removeEventListener('message', this._messageListener);
+            this._messageListener = undefined;
+        }
+    }
+    onMessage(event) {
+        const message = getTrustedMessage(event, this._dappOrigin, this._dappWindow);
+        if (message === undefined) {
+            return;
+        }
+        if (message.type !== DWEB_CONNECT_REQUEST_MESSAGE_TYPE || this._requestReceived) {
+            return;
+        }
+        this._requestReceived = true;
+        if (typeof message.jwe !== 'string') {
+            this.settleRequest(new Error('[@enbox/browser] Connect request message did not carry a ciphertext payload.'));
+            return;
+        }
+        void this.openRequest(message.jwe);
+    }
+    openRequest(jwe) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const request = yield ConnectProvider.openRequest({
+                    jwe,
+                    decryption: {
+                        mode: 'ecdh-es',
+                        recipientPrivateKey: this._recipientPrivateKey,
+                        walletOrigin: globalThis.location.origin,
+                    },
+                });
+                if (request.reply.mode !== 'post_message') {
+                    this.settleRequest(new Error('[@enbox/browser] Connect request over the popup channel must use the `post_message` reply mode.'));
+                    return;
+                }
+                this.settleRequest(request);
+            }
+            catch (error) {
+                this.settleRequest(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
+    }
+    settleRequest(outcome) {
+        var _a, _b;
+        clearTimeout(this._timeoutId);
+        if (outcome instanceof Error) {
+            this.close();
+            (_a = this._rejectRequest) === null || _a === void 0 ? void 0 : _a.call(this, outcome);
+            return;
+        }
+        (_b = this._resolveRequest) === null || _b === void 0 ? void 0 : _b.call(this, outcome);
+    }
+}
+/**
+ * Resolves the dapp origin to pin: the explicit option when provided,
+ * otherwise the origin of `document.referrer`. Never falls back to `'*'`.
+ */
+function resolveDappOrigin(explicitOrigin) {
+    if (explicitOrigin !== undefined) {
+        return new URL(explicitOrigin).origin;
+    }
+    if (document.referrer) {
+        return new URL(document.referrer).origin;
+    }
+    throw new Error('[@enbox/browser] Unable to determine the dapp origin: no `dappOrigin` option was provided and `document.referrer` is empty.');
+}
+//# sourceMappingURL=dweb-connect-wallet.js.map

package/dist/esm/dweb-connect-wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dweb-connect-wallet.js","sourceRoot":"","sources":["../../src/dweb-connect-wallet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EACL,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,6DAA6D;AAC7D,MAAM,0BAA0B,GAAG,MAAO,CAAC;AAwB3C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,0BAA0B;IAarC,YAAoB,MAA+F;QAR3G,qBAAgB,GAAG,KAAK,CAAC;QAS/B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAEvD,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAQ,EAAE;YAC3E,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;YAC/B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,SAAS,CAAC,CAAC;QAEvD,IAAI,CAAC,gBAAgB,GAAG,CAAC,KAAmB,EAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE1D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAS,EAAE;;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAA,IAAI,CAAC,cAAc,qDAAG,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC,CAAC;QAChH,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAO,MAAM;6DAAC,UAA6C,EAAE;;YACxE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;YAC5G,CAAC;YAED,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,MAAM,CAAC,MAAuB,CAAC;YACxE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;YACrH,CAAC;YAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAEzD,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YACvD,MAAM,SAAS,GAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAE/E,MAAM,SAAS,GAAG,IAAI,0BAA0B,CAAC;gBAC/C,UAAU;gBACV,UAAU;gBACV,mBAAmB;gBACnB,SAAS,EAAE,MAAA,OAAO,CAAC,SAAS,mCAAI,0BAA0B;aAC3D,CAAC,CAAC;YAEH,qEAAqE;YACrE,UAAU,CAAC,WAAW,CAAC;gBACrB,IAAI,EAAW,gCAAgC;gBAC/C,SAAS;gBACT,YAAY,EAAG,UAAU,CAAC,QAAQ,CAAC,MAAM;aAC1C,EAAE,UAAU,CAAC,CAAC;YAEf,OAAO,SAAS,CAAC;QACnB,CAAC;KAAA;IAED,4EAA4E;IAC5E,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACU,YAAY;;YACvB,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC;QACpC,CAAC;KAAA;IAED;;;;;;OAMG;IACI,YAAY,CAAC,OAAe;QACjC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;YAC3B,IAAI,EAAM,kCAAkC;YAC5C,OAAO,EAAG,OAAO;SAClB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,6EAA6E;IACtE,IAAI;QACT,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IAED,qEAAqE;IAC9D,KAAK;QACV,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7D,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAmB;QACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAEtC,IAAI,OAAO,CAAC,IAAI,KAAK,iCAAiC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5F,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE7B,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC,CAAC;YAC9G,OAAO;QACT,CAAC;QAED,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAEa,WAAW,CAAC,GAAW;;YACnC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC;oBAChD,GAAG;oBACH,UAAU,EAAE;wBACV,IAAI,EAAkB,SAAS;wBAC/B,mBAAmB,EAAG,IAAI,CAAC,oBAAoB;wBAC/C,YAAY,EAAU,UAAU,CAAC,QAAQ,CAAC,MAAM;qBACjD;iBACF,CAAC,CAAC;gBAEH,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAC1C,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC,CAAC;oBACjI,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;KAAA;IAEO,aAAa,CAAC,OAA+B;;QACnD,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAA,IAAI,CAAC,cAAc,qDAAG,OAAO,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,MAAA,IAAI,CAAC,eAAe,qDAAG,OAAO,CAAC,CAAC;IAClC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,cAAkC;IAC3D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;IACxC,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,KAAK,CACb,6HAA6H,CAC9H,CAAC;AACJ,CAAC"}

package/dist/esm/index.js

@@ -31,12 +31,18 @@ export { Enbox, defineProtocol, repository, } from '@enbox/api';
 //
 // Authentication lifecycle, session management, connect handlers.
 export { AuthManager, AuthSession, normalizeProtocolRequests, WalletConnect, } from '@enbox/auth/browser';
+// ─── Re-exports from @enbox/connect ─────────────────────────────
+//
+// The connect kernel pieces wallet apps need alongside the popup
+// transports: opening/sealing envelopes and the deny token.
+export { CONNECT_DENIED_TOKEN, ConnectProvider } from '@enbox/connect';
 // ─── Browser-specific exports ───────────────────────────────────
 //
-// DWeb Connect, wallet selector, DRL polyfills.
+// DWeb Connect popup transports, wallet selector, DRL polyfills.
 export * from './web-features.js';
 export { BrowserConnectHandler, DEFAULT_WALLETS } from './browser-connect-handler.js';
-export { DWebConnect } from './dweb-connect-client.js';
+export { connectViaPopup, PopupClientTransport, PopupWindowClosedError } from './dweb-connect-client.js';
+export { WalletPostMessageTransport } from './dweb-connect-wallet.js';
+export { DWEB_CONNECT_LOADED_MESSAGE_TYPE, DWEB_CONNECT_PATH, DWEB_CONNECT_REQUEST_MESSAGE_TYPE, DWEB_CONNECT_RESPONSE_MESSAGE_TYPE, } from './dweb-connect-messages.js';
 export { showWalletSelector } from './ui/wallet-selector.js';
-export { encryptPostMessagePayload, generateEphemeralKeyPair } from './dweb-connect-crypto.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mEAAmE;AACnE,EAAE;AACF,kEAAkE;AAElE,OAAO,EACL,KAAK,EACL,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAC;AAUpB,mEAAmE;AACnE,EAAE;AACF,kEAAkE;AAElE,OAAO,EACL,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAuB7B,mEAAmE;AACnE,EAAE;AACF,gDAAgD;AAEhD,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEtF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,mEAAmE;AACnE,EAAE;AACF,kEAAkE;AAElE,OAAO,EACL,KAAK,EACL,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAC;AAUpB,mEAAmE;AACnE,EAAE;AACF,kEAAkE;AAElE,OAAO,EACL,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAuB7B,mEAAmE;AACnE,EAAE;AACF,iEAAiE;AACjE,4DAA4D;AAE5D,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGvE,mEAAmE;AACnE,EAAE;AACF,iEAAiE;AAEjE,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEzG,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EACL,gCAAgC,EAChC,iBAAiB,EACjB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/types/dweb-connect-client.d.ts

@@ -1,82 +1,146 @@
 /**
- * DWeb Connect client — initiates the popup/postMessage connect flow.
+ * DWeb Connect client — the dapp side of the popup/postMessage connect flow.
  *
- * This is the dapp-side counterpart to the wallet's `/dweb-connect` page.
- * The wallet is opened as a popup window, and communication happens via
- * `window.postMessage`. No relay server, QR codes, or PINs are needed.
+ * {@link PopupClientTransport} implements the `@enbox/connect` kernel's
+ * `ConnectTransport` over a wallet popup:
+ *
+ * 1. The dapp opens `${walletUrl}/dweb-connect` as a popup window.
+ * 2. The wallet emits a `loaded` beacon carrying a fresh ephemeral X25519
+ *    public key and its origin.
+ * 3. The kernel seals the signed connect request to that key (ECDH-ES,
+ *    `apv` bound to the wallet origin) and the transport posts the
+ *    ciphertext to the popup.
+ * 4. The wallet posts back the sealed response JWE (or the deny token),
+ *    which the kernel opens and value-checks.
+ *
+ * Only ciphertext crosses the postMessage channel. Every message is checked
+ * against the wallet origin derived from the configured wallet URL (never
+ * `'*'`), and against the popup window as `event.source`.
  *
  * @module
  */
-import type { ConnectPermissionRequest } from '@enbox/agent';
-import type { ConnectResult, PortableIdentity } from '@enbox/auth';
-/** Options for initiating a DWeb Connect flow via popup. */
-export interface DWebConnectClientOptions {
-    /** Base URL of the wallet app (e.g. "https://enbox-wallet.pages.dev"). */
+import type { ConnectPermissionRequest, ConnectRequestProfile, ConnectResult, ConnectTransport } from '@enbox/connect';
+/**
+ * Thrown when the user closes the wallet popup before the wallet finished
+ * loading (i.e. before its `loaded` beacon arrived). Callers typically treat
+ * this the same as a user denial.
+ */
+export declare class PopupWindowClosedError extends Error {
+    constructor();
+}
+/** Options for constructing a {@link PopupClientTransport}. */
+export type PopupClientTransportOptions = {
+    /** Base URL of the wallet app (e.g. `https://enbox-wallet.pages.dev`). */
     walletUrl: string;
-    /** The DID to pre-select in the wallet's identity picker. */
-    did?: string;
     /**
-     * Protocol permission requests to send to the wallet.
-     * Each entry contains a `protocolDefinition` and `permissionScopes`.
+     * Total budget in milliseconds for the popup handshake. The popup is closed
+     * and the handshake rejected when the wallet has not responded in time.
+     * @default 300_000 (5 minutes)
+     */
+    timeoutMs?: number;
+};
+/**
+ * Popup/postMessage {@link ConnectTransport} for browser dapps.
+ *
+ * Single-use: construct a new transport per handshake. The **constructor**
+ * opens the wallet popup synchronously — so `window.open` runs inside the user
+ * gesture, ahead of the kernel's awaited key generation, and survives strict
+ * popup blockers; `requestProfile()` then awaits the wallet's `loaded` beacon;
+ * `deliverRequest()` posts the sealed request ciphertext; `awaitResponse()`
+ * resolves with the sealed response JWE, or the deny token when the user denies
+ * or closes the popup after the handshake was established.
+ *
+ * Security properties:
+ * - `targetOrigin` of every outbound `postMessage` is pinned to the origin
+ *   derived from `walletUrl` — never `'*'`.
+ * - Inbound messages are dropped unless `event.origin` equals the pinned
+ *   wallet origin AND `event.source` is the popup window this transport opened.
+ * - The beacon's `walletOrigin` field must equal the pinned origin, and its
+ *   `walletEpk` must be a public-only X25519 JWK; a malformed beacon from the
+ *   genuine popup fails the handshake closed.
+ */
+export declare class PopupClientTransport implements ConnectTransport {
+    /** {@inheritDoc ConnectTransport.requiresPin} */
+    readonly requiresPin: boolean;
+    private readonly _walletOrigin;
+    private readonly _timeoutMs;
+    private readonly _popup;
+    private _settled;
+    private _walletEpkReceived;
+    private _timeoutId?;
+    private _closedPollId?;
+    private _messageListener?;
+    private readonly _walletEpkPromise;
+    private _resolveWalletEpk?;
+    private _rejectWalletEpk?;
+    private readonly _responsePromise;
+    private _resolveResponse?;
+    private _rejectResponse?;
+    constructor(options: PopupClientTransportOptions);
+    /**
+     * Awaits the already-open popup's `loaded` beacon, then returns the popup
+     * channel profile: ECDH-ES encryption to the beacon's ephemeral key with the
+     * pinned wallet origin as the `apv` binding, a `post_message` reply
+     * descriptor, and the client-supplied `state` correlator.
+     *
+     * The popup was opened synchronously at construction, so this method only
+     * awaits the beacon — it never issues the blocker-sensitive `window.open`.
+     *
+     * @param state - The handshake correlator minted by the {@link ConnectClient}.
+     * @throws If the user closes the popup before the beacon arrives
+     *         ({@link PopupWindowClosedError}), the beacon is malformed, or on
+     *         timeout.
+     */
+    requestProfile(state: string): Promise<ConnectRequestProfile>;
+    /**
+     * Posts the sealed request ciphertext to the wallet popup with the
+     * `targetOrigin` pinned to the wallet origin.
+     */
+    deliverRequest(jwe: string): Promise<void>;
+    /**
+     * Awaits the wallet's response ciphertext: the sealed response JWE, or the
+     * deny token when the user denies in the wallet or closes the popup.
+     * Rejects on timeout.
      */
+    awaitResponse(): Promise<string>;
+    private onMessage;
+    private onLoadedBeacon;
+    private onResponseMessage;
+    private onClosedPoll;
+    private fail;
+    private cleanup;
+}
+/** Options for a one-shot {@link connectViaPopup} flow. */
+export type PopupConnectOptions = {
+    /** Base URL of the wallet app (e.g. `https://enbox-wallet.pages.dev`). */
+    walletUrl: string;
+    /** DWN protocols and permission scopes to request from the wallet. */
     permissionRequests: ConnectPermissionRequest[];
     /**
-     * Timeout in milliseconds. The popup is closed and an error thrown
-     * if the wallet doesn't respond within this time.
+     * Timeout in milliseconds for the popup handshake.
      * @default 300_000 (5 minutes)
      */
     timeout?: number;
     /**
-     * Display name of the requesting application.
-     * Shown in the wallet's permission consent screen.
+     * Display name of the requesting application, shown in the wallet's
+     * consent screen. Defaults to the dapp's host.
      */
     appName?: string;
     /**
-     * Icon URL of the requesting application.
-     * Shown alongside the app name in the wallet's consent screen.
+     * Icon URL of the requesting application, shown alongside the app name in
+     * the wallet's consent screen.
      */
     appIcon?: string;
-    /**
-     * A portable identity to transfer to the wallet for import.
-     *
-     * When provided, the wallet imports this identity and creates
-     * delegate grants for the dapp, allowing the dapp to transition
-     * from local-DID mode to delegate mode while keeping the same DID.
-     */
-    portableIdentity?: PortableIdentity;
-}
-/**
- * Open a wallet popup and run the DWeb Connect postMessage flow.
- *
- * Protocol:
- * 1. Dapp opens `${walletUrl}/dweb-connect` as a popup.
- * 2. Wallet sends `{ type: 'dweb-connect-loaded' }` when ready.
- * 3. Dapp sends `{ type: 'dweb-connect-authorization-request', did, permissions,
- *    appName?, appIcon?, portableIdentity? }`.
- * 4. Wallet shows consent UI, then sends back
- *    `{ type: 'dweb-connect-authorization-response', delegateDid, grants }`.
- * 5. Popup closes.
- *
- * @returns The delegate credentials, or `undefined` if the user denied.
- * @throws If the popup is blocked, times out, or the wallet returns an error.
- */
-declare function initClient(options: DWebConnectClientOptions): Promise<ConnectResult | undefined>;
+};
 /**
- * Probe whether a wallet supports a specific DID via a hidden iframe.
+ * Runs one DWeb Connect popup handshake end-to-end: opens the wallet popup,
+ * drives the `@enbox/connect` kernel client over a {@link PopupClientTransport},
+ * and returns the delegated credentials.
  *
- * Sends a `dweb-connect-support-request` message to the wallet and
- * waits for a `dweb-connect-support-response`. Useful for checking
- * multiple wallet URLs to find the one that manages a given DID.
- *
- * @param walletUrl - Base URL of the wallet to probe.
- * @param did - The DID to check.
- * @param timeout - Probe timeout in ms. Default: 5_000 (5 seconds).
- * @returns `true` if the wallet manages the DID, `false` otherwise.
+ * @returns The delegate credentials, or `undefined` when the user denied the
+ *          request or closed the popup.
+ * @throws If the popup is blocked, the handshake times out, or the wallet
+ *         returns an invalid response.
  */
-declare function probeWalletSupport(walletUrl: string, did: string, timeout?: number): Promise<boolean>;
-export declare const DWebConnect: {
-    initClient: typeof initClient;
-    probeWalletSupport: typeof probeWalletSupport;
-};
-export {};
+export declare function connectViaPopup(options: PopupConnectOptions): Promise<ConnectResult | undefined>;
 //# sourceMappingURL=dweb-connect-client.d.ts.map

package/dist/types/dweb-connect-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dweb-connect-client.d.ts","sourceRoot":"","sources":["../../src/dweb-connect-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAyB,wBAAwB,EAAqC,MAAM,cAAc,CAAC;AACvH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKnE,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAElB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAkBD;;;;;;;;;;;;;;GAcG;AACH,iBAAe,UAAU,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA+I/F;AAED;;;;;;;;;;;GAWG;AACH,iBAAe,kBAAkB,CAC/B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,OAAO,SAAQ,GACd,OAAO,CAAC,OAAO,CAAC,CA+ClB;AAED,eAAO,MAAM,WAAW;;;CAAqC,CAAC"}
+{"version":3,"file":"dweb-connect-client.d.ts","sourceRoot":"","sources":["../../src/dweb-connect-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAEV,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AA+BxB;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAKhD;AAED,+DAA+D;AAC/D,MAAM,MAAM,2BAA2B,GAAG;IACxC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,oBAAqB,YAAW,gBAAgB;IAC3D,iDAAiD;IACjD,SAAgB,WAAW,EAAE,OAAO,CAAS;IAE7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,UAAU,CAAC,CAAgC;IACnD,OAAO,CAAC,aAAa,CAAC,CAAiC;IACvD,OAAO,CAAC,gBAAgB,CAAC,CAAgC;IAEzD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAe;IACjD,OAAO,CAAC,iBAAiB,CAAC,CAA2B;IACrD,OAAO,CAAC,gBAAgB,CAAC,CAAyB;IAElD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IACnD,OAAO,CAAC,gBAAgB,CAAC,CAA4B;IACrD,OAAO,CAAC,eAAe,CAAC,CAAyB;gBAErC,OAAO,EAAE,2BAA2B;IA8ChD;;;;;;;;;;;;;OAaG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAU1E;;;OAGG;IACU,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD;;;;OAIG;IACU,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,cAAc;IAwBtB,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,OAAO;CAQhB;AAED,2DAA2D;AAC3D,MAAM,MAAM,mBAAmB,GAAG;IAChC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAElB,sEAAsE;IACtE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;IAE/C;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAmBF;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAqBtG"}

package/dist/types/dweb-connect-messages.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Wire shapes for the DWeb Connect popup/postMessage channel.
+ *
+ * The dapp and the wallet exchange exactly three message kinds over
+ * `window.postMessage`:
+ *
+ * 1. `loaded` beacon (wallet → dapp): announces the wallet page is ready and
+ *    carries a fresh ephemeral X25519 public key plus the wallet's origin.
+ * 2. `request` (dapp → wallet): the sealed connect request JWE — ciphertext
+ *    only, encrypted to the beacon key with ECDH-ES and the wallet origin
+ *    bound into the JWE `apv` header.
+ * 3. `response` (wallet → dapp): the sealed connect response JWE, or the
+ *    literal deny token — again ciphertext only.
+ *
+ * Plaintext never crosses the channel, and both sides pin `targetOrigin`
+ * and verify `event.origin` / `event.source` on every message.
+ *
+ * @module
+ */
+import type { Jwk } from '@enbox/crypto';
+/** Path of the wallet's DWeb Connect page, opened as a popup by the dapp. */
+export declare const DWEB_CONNECT_PATH = "/dweb-connect";
+/** Message type of the wallet's `loaded` beacon (wallet → dapp). */
+export declare const DWEB_CONNECT_LOADED_MESSAGE_TYPE = "enbox-connect-loaded";
+/** Message type carrying the sealed connect request JWE (dapp → wallet). */
+export declare const DWEB_CONNECT_REQUEST_MESSAGE_TYPE = "enbox-connect-request";
+/** Message type carrying the sealed connect response JWE or deny token (wallet → dapp). */
+export declare const DWEB_CONNECT_RESPONSE_MESSAGE_TYPE = "enbox-connect-response";
+/**
+ * The wallet's readiness beacon. Emitted to `window.opener` once the wallet's
+ * DWeb Connect page has generated its per-session ephemeral X25519 key.
+ */
+export type DWebConnectLoadedMessage = {
+    type: typeof DWEB_CONNECT_LOADED_MESSAGE_TYPE;
+    /** Fresh ephemeral X25519 public JWK the dapp seals the request to. */
+    walletEpk: Jwk;
+    /** The wallet's own origin; must match the origin the dapp has pinned. */
+    walletOrigin: string;
+};
+/** The dapp's sealed connect request, posted to the wallet popup. */
+export type DWebConnectRequestMessage = {
+    type: typeof DWEB_CONNECT_REQUEST_MESSAGE_TYPE;
+    /** The sealed connect request as a Compact JWE string. */
+    jwe: string;
+};
+/** The wallet's sealed connect response, posted back to the opener. */
+export type DWebConnectResponseMessage = {
+    type: typeof DWEB_CONNECT_RESPONSE_MESSAGE_TYPE;
+    /** The sealed connect response JWE, or the literal `CONNECT_DENIED_TOKEN`. */
+    payload: string;
+};
+/**
+ * Applies the shared inbound-message trust filter for the popup channel:
+ * pins the message to the expected `event.origin`, pins its `event.source` to
+ * the expected window, and requires a non-null object payload.
+ *
+ * Returns the payload cast to a plain record when every check passes, or
+ * `undefined` when the message must be dropped. Both the dapp-side and
+ * wallet-side transports early-return on `undefined` before inspecting any
+ * message field — this is the security-critical filter that keeps hostile
+ * origins and stray windows off the channel.
+ */
+export declare function getTrustedMessage(event: MessageEvent, expectedOrigin: string, expectedSource: Window | undefined): Record<string, unknown> | undefined;
+//# sourceMappingURL=dweb-connect-messages.d.ts.map

package/dist/types/dweb-connect-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dweb-connect-messages.d.ts","sourceRoot":"","sources":["../../src/dweb-connect-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEzC,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,oEAAoE;AACpE,eAAO,MAAM,gCAAgC,yBAAyB,CAAC;AAEvE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC,0BAA0B,CAAC;AAEzE,2FAA2F;AAC3F,eAAO,MAAM,kCAAkC,2BAA2B,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,OAAO,gCAAgC,CAAC;IAE9C,uEAAuE;IACvE,SAAS,EAAE,GAAG,CAAC;IAEf,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,OAAO,iCAAiC,CAAC;IAE/C,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,OAAO,kCAAkC,CAAC;IAEhD,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,YAAY,EACnB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAWrC"}

package/dist/types/dweb-connect-wallet.d.ts

@@ -0,0 +1,101 @@
+/**
+ * DWeb Connect wallet transport — the wallet side of the popup/postMessage
+ * connect flow, exported for wallet apps (e.g. the Enbox web wallet).
+ *
+ * A wallet's `/dweb-connect` page creates one transport per session:
+ *
+ * 1. `create()` generates a fresh ephemeral X25519 key pair and emits the
+ *    `loaded` beacon (public key + wallet origin) to the opener window with a
+ *    pinned `targetOrigin`.
+ * 2. `awaitRequest()` receives the sealed request ciphertext and opens it via
+ *    the `@enbox/connect` kernel (`ConnectProvider.openRequest`), which
+ *    value-checks the `apv` origin binding against this wallet's origin.
+ * 3. After the consent ceremony, the wallet posts the sealed response JWE via
+ *    `sendResponse()` — or the deny token via `deny()` — back to the opener,
+ *    again with a pinned `targetOrigin`.
+ *
+ * The dapp origin is never assumed: it is taken from an explicit option or
+ * derived from `document.referrer`, and `create()` fails when neither is
+ * available. `'*'` is never used as a `targetOrigin`.
+ *
+ * @module
+ */
+import type { ConnectRequest } from '@enbox/connect';
+/** Options for creating a {@link WalletPostMessageTransport}. */
+export type WalletPostMessageTransportOptions = {
+    /**
+     * Origin of the dapp that opened this wallet popup. When omitted, it is
+     * derived from `document.referrer`; creation fails when neither is
+     * available — the transport never falls back to `'*'`.
+     */
+    dappOrigin?: string;
+    /**
+     * The dapp window to exchange messages with.
+     * @default window.opener
+     */
+    dappWindow?: Window;
+    /**
+     * Budget in milliseconds for awaiting the dapp's sealed request.
+     * @default 300_000 (5 minutes)
+     */
+    timeoutMs?: number;
+};
+/**
+ * Wallet-side postMessage transport for the DWeb Connect popup flow.
+ *
+ * Security properties:
+ * - `targetOrigin` of every outbound `postMessage` (beacon and response) is
+ *   pinned to the dapp origin — never `'*'`.
+ * - Inbound messages are dropped unless `event.origin` equals the pinned dapp
+ *   origin AND `event.source` is the dapp window.
+ * - The ephemeral X25519 private key never leaves the transport; the request
+ *   JWE is opened by the kernel with the `apv` header value-checked against
+ *   this wallet's own origin.
+ */
+export declare class WalletPostMessageTransport {
+    private readonly _dappOrigin;
+    private readonly _dappWindow;
+    private readonly _recipientPrivateKey;
+    private _requestReceived;
+    private _timeoutId?;
+    private _messageListener?;
+    private readonly _requestPromise;
+    private _resolveRequest?;
+    private _rejectRequest?;
+    private constructor();
+    /**
+     * Creates the transport for one connect session: resolves and pins the dapp
+     * origin, generates a fresh ephemeral X25519 key pair, starts listening for
+     * the sealed request, and emits the `loaded` beacon to the dapp window.
+     *
+     * @throws If not in a browser, if no dapp window is available, or if the
+     *         dapp origin can neither be supplied nor derived from the referrer.
+     */
+    static create(options?: WalletPostMessageTransportOptions): Promise<WalletPostMessageTransport>;
+    /** The pinned origin of the dapp this transport exchanges messages with. */
+    get dappOrigin(): string;
+    /**
+     * Awaits the dapp's sealed request and opens it via the kernel: ECDH-ES
+     * decryption with this session's ephemeral key, `apv` value-checked against
+     * this wallet's origin, JWT signature verification, and payload shape
+     * assertion. Rejects on timeout, on an unopenable request, or when the
+     * request does not use the `post_message` reply mode.
+     */
+    awaitRequest(): Promise<ConnectRequest>;
+    /**
+     * Posts the sealed response JWE (or the deny token) back to the dapp window
+     * with the `targetOrigin` pinned to the dapp origin, then closes the
+     * transport.
+     *
+     * @param idToken - The sealed response JWE, or the literal deny token.
+     */
+    sendResponse(idToken: string): void;
+    /** Posts the deny token back to the dapp — the user rejected the request. */
+    deny(): void;
+    /** Stops listening and releases the session's timers. Idempotent. */
+    close(): void;
+    private onMessage;
+    private openRequest;
+    private settleRequest;
+}
+//# sourceMappingURL=dweb-connect-wallet.d.ts.map

package/dist/types/dweb-connect-wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dweb-connect-wallet.d.ts","sourceRoot":"","sources":["../../src/dweb-connect-wallet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAgBrD,iEAAiE;AACjE,MAAM,MAAM,iCAAiC,GAAG;IAC9C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAM;IAE3C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,UAAU,CAAC,CAAgC;IACnD,OAAO,CAAC,gBAAgB,CAAC,CAAgC;IAEzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,eAAe,CAAC,CAAoC;IAC5D,OAAO,CAAC,cAAc,CAAC,CAAyB;IAEhD,OAAO;IAsBP;;;;;;;OAOG;WACiB,MAAM,CAAC,OAAO,GAAE,iCAAsC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAgChH,4EAA4E;IAC5E,IAAW,UAAU,IAAI,MAAM,CAE9B;IAED;;;;;;OAMG;IACU,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC;IAIpD;;;;;;OAMG;IACI,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ1C,6EAA6E;IACtE,IAAI,IAAI,IAAI;IAInB,qEAAqE;IAC9D,KAAK,IAAI,IAAI;IAQpB,OAAO,CAAC,SAAS;YAeH,WAAW;IAsBzB,OAAO,CAAC,aAAa;CAStB"}