@goflowstate/widget-sdk 0.1.0

package/dist/index.mjs

@@ -0,0 +1,453 @@
+// @goflowstate/widget-sdk v0.1.0
+// https://github.com/starteryllp/goflowstate-sdk
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/service.ts
+function createServiceClient(opts) {
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
+  const baseUrl = opts.baseUrl.replace(/\/+$/, "");
+  async function call(path, init, token) {
+    const url = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${token}`);
+    if (init.body && !headers.has("content-type")) {
+      headers.set("content-type", "application/json");
+    }
+    return fetchImpl(url, { ...init, headers });
+  }
+  return {
+    async fetch(path, init = {}) {
+      let token = await opts.getJwt(false);
+      let res = await call(path, init, token);
+      if (res.status === 401) {
+        token = await opts.getJwt(true);
+        res = await call(path, init, token);
+      }
+      if (!res.ok) {
+        let body = {};
+        try {
+          body = await res.json();
+        } catch {
+        }
+        throw new Error(`Widget service request failed (${res.status}): ${body.message ?? ""}`);
+      }
+      return await res.json();
+    }
+  };
+}
+
+// src/sdk.ts
+var PROTOCOL = "canvas-widget-v1";
+var DEV_MODE_TOKEN = "dev-mode-skip";
+var INIT_TIMEOUT_MS = 5e3;
+var cachedKey = null;
+async function getHmacKey(secret) {
+  if (cachedKey && cachedKey.secret === secret) return cachedKey.key;
+  const encoded = new TextEncoder().encode(secret);
+  const buf = new ArrayBuffer(encoded.byteLength);
+  new Uint8Array(buf).set(encoded);
+  const key = await crypto.subtle.importKey("raw", buf, { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  cachedKey = { secret, key };
+  return key;
+}
+async function signToken(secret, type, widgetId, nonce, timestamp) {
+  const key = await getHmacKey(secret);
+  const data = new TextEncoder().encode(`${type}:${widgetId}:${nonce}:${timestamp}`);
+  const buf = new ArrayBuffer(data.byteLength);
+  new Uint8Array(buf).set(data);
+  const sig = await crypto.subtle.sign("HMAC", key, buf);
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var CanvasWidgetSDKImpl = class {
+  constructor(init) {
+    __publicField(this, "_widgetId");
+    __publicField(this, "_state");
+    __publicField(this, "_hmacSecret");
+    __publicField(this, "_user");
+    __publicField(this, "_widgetApiUrl");
+    __publicField(this, "_widgetApiToken");
+    __publicField(this, "_installationId");
+    __publicField(this, "_pendingConsents", /* @__PURE__ */ new Map());
+    __publicField(this, "_cachedJwt", null);
+    __publicField(this, "_stateListeners", []);
+    __publicField(this, "_displayState", "collapsed");
+    __publicField(this, "_displayStateCallbacks", []);
+    __publicField(this, "_focused", false);
+    __publicField(this, "_focusCallbacks", []);
+    __publicField(this, "_settingsRemoteListeners", []);
+    __publicField(this, "_eventListeners", /* @__PURE__ */ new Map());
+    __publicField(this, "_settings");
+    __publicField(this, "_messageHandler");
+    /** Authenticated HTTP client scoped to the widget's declared service URL. Undefined when no service is declared. */
+    __publicField(this, "service");
+    this._widgetId = init.widgetId;
+    this._state = init.state;
+    this._hmacSecret = init.hmacSecret;
+    this._user = init.user;
+    this._widgetApiUrl = init.widgetApiUrl;
+    this._widgetApiToken = init.widgetApiToken ?? null;
+    this._installationId = init.installationId;
+    this._settings = init.settings ?? {};
+    if (init.serviceUrl) {
+      this.service = createServiceClient({
+        baseUrl: init.serviceUrl,
+        getJwt: (forceRefresh) => this.getJwt(forceRefresh)
+      });
+    }
+    this._messageHandler = this.handleMessage.bind(this);
+    window.addEventListener("message", this._messageHandler);
+  }
+  /** The unique identifier for this widget instance on the canvas. */
+  get widgetId() {
+    return this._widgetId;
+  }
+  /** The current display state of the widget (collapsed, expanding, expanded, collapsing). */
+  get state() {
+    return this._state;
+  }
+  /** The authenticated user context, or null when user data access has not been granted. */
+  get user() {
+    return this._user;
+  }
+  /** Subscribe to display state changes; returns an unsubscribe function. */
+  onStateChange(cb) {
+    this._stateListeners.push(cb);
+    return () => {
+      const idx = this._stateListeners.indexOf(cb);
+      if (idx !== -1) this._stateListeners.splice(idx, 1);
+    };
+  }
+  /** Ask the canvas host to expand this widget into its modal view. */
+  requestExpand() {
+    this.send("EXPAND_REQUEST", {});
+  }
+  /** Ask the canvas host to collapse this widget back to its tile view. */
+  requestCollapse() {
+    this.send("COLLAPSE_REQUEST", {});
+  }
+  /** Get the current display state */
+  getDisplayState() {
+    return this._displayState;
+  }
+  /** Register a callback for display state changes */
+  onDisplayStateChange(callback) {
+    this._displayStateCallbacks.push(callback);
+    return () => {
+      this._displayStateCallbacks = this._displayStateCallbacks.filter((cb) => cb !== callback);
+    };
+  }
+  /** Is this widget the user's current focus? Updates via FOCUS_CHANGE. */
+  isFocused() {
+    return this._focused;
+  }
+  /** Subscribe to focus transitions. Returns an unsubscribe function. */
+  onFocusChange(callback) {
+    this._focusCallbacks.push(callback);
+    return () => {
+      this._focusCallbacks = this._focusCallbacks.filter((cb) => cb !== callback);
+    };
+  }
+  /** Request promotion to fullscreen from partial */
+  requestFullscreen() {
+    this.send("FULLSCREEN_REQUEST", {});
+  }
+  /** Broadcast an event on the given topic to all subscribed widgets on the canvas. */
+  emit(topic, payload) {
+    this.send("EVENT_EMIT", { topic, payload });
+  }
+  /** Subscribe to events on the given topic; returns an unsubscribe function. */
+  subscribe(topic, cb) {
+    const list = this._eventListeners.get(topic) ?? [];
+    list.push(cb);
+    this._eventListeners.set(topic, list);
+    return () => {
+      const current = this._eventListeners.get(topic);
+      if (!current) return;
+      const idx = current.indexOf(cb);
+      if (idx !== -1) current.splice(idx, 1);
+    };
+  }
+  /** Send a structured log entry to the canvas host for centralized debugging. */
+  log(level, message, data) {
+    this.send("LOG", { level, message, data: data ?? null });
+  }
+  /** Request user consent for a named data scope; resolves with the consent decision. */
+  async requestConsent(scope, reason) {
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        this._pendingConsents.delete(scope);
+        reject(new Error("Consent request timed out"));
+      }, 6e4);
+      this._pendingConsents.set(scope, {
+        resolve: (r) => {
+          clearTimeout(timeout);
+          resolve(r);
+        },
+        reject: (e) => {
+          clearTimeout(timeout);
+          reject(e);
+        }
+      });
+      this.send("CONSENT_REQUEST", { scope, reason });
+    });
+  }
+  /** Return the cached JWT for authenticating requests to external APIs; throws if no token is available. Pass forceRefresh=true to bypass the cache. */
+  async getJwt(forceRefresh) {
+    if (!forceRefresh && this._cachedJwt && Date.now() < this._cachedJwt.expiresAt - 3e4) {
+      return this._cachedJwt.token;
+    }
+    throw new Error("No cached JWT \u2014 widget must use OAuth flow for token refresh");
+  }
+  /** Persistent key-value storage scoped to this widget installation. */
+  get storage() {
+    return {
+      get: (key) => this.storageRequest("GET", key),
+      set: (key, value) => this.storageRequest("PUT", key, value).then(() => {
+      }),
+      delete: (key) => this.storageRequest("DELETE", key).then(() => {
+      })
+    };
+  }
+  /** Ad-hoc collections/records backend scoped to the canvas/room. */
+  get db() {
+    const req = (path, method, body) => this.widgetApiRequest(path, method, body);
+    return {
+      collection(name) {
+        const base = `/widget-api/db/${encodeURIComponent(name)}`;
+        return {
+          create: (data) => req(base, "POST", data),
+          get: (id) => req(`${base}/${encodeURIComponent(id)}`, "GET"),
+          list: (opts) => {
+            const qs = new URLSearchParams();
+            if (opts?.limit != null) qs.set("limit", String(opts.limit));
+            if (opts?.cursor) qs.set("cursor", opts.cursor);
+            if (opts?.sort) qs.set("sort", opts.sort);
+            if (opts?.mine) qs.set("mine", "true");
+            const suffix = qs.toString() ? `?${qs.toString()}` : "";
+            return req(`${base}${suffix}`, "GET");
+          },
+          update: (id, patch) => req(`${base}/${encodeURIComponent(id)}`, "PATCH", patch),
+          delete: (id) => req(`${base}/${encodeURIComponent(id)}`, "DELETE").then(() => {
+          })
+        };
+      }
+    };
+  }
+  /** Widget configuration settings persisted by the canvas host. */
+  get settings() {
+    return {
+      get: () => ({ ...this._settings }),
+      set: (newSettings) => {
+        this._settings = { ...this._settings, ...newSettings };
+        this.send("SETTINGS_WRITE", { settings: this._settings });
+      },
+      onRemoteChange: (cb) => {
+        this._settingsRemoteListeners.push(cb);
+        return () => {
+          this._settingsRemoteListeners = this._settingsRemoteListeners.filter((fn) => fn !== cb);
+        };
+      }
+    };
+  }
+  /** Display a toast notification in the canvas host UI. */
+  async notify(message, opts) {
+    this.send("NOTIFICATION", {
+      message,
+      level: opts?.level ?? "info",
+      duration: opts?.duration ?? 5e3
+    });
+  }
+  // ── Private ─────────────────────────────────────────────────
+  async widgetApiRequest(path, method, body) {
+    if (!this._widgetApiUrl) {
+      throw new Error("Widget API Gateway URL not available");
+    }
+    const url = `${this._widgetApiUrl}${path}`;
+    const headers = { "Content-Type": "application/json" };
+    if (this._widgetApiToken) {
+      headers["Authorization"] = `Bearer ${this._widgetApiToken}`;
+    }
+    const opts = { method, headers };
+    if (body !== void 0 && method !== "GET" && method !== "DELETE") {
+      opts.body = JSON.stringify(body);
+    }
+    const response = await fetch(url, opts);
+    if (!response.ok) {
+      const err = await response.json().catch(() => ({}));
+      throw new Error(err.message ?? `Request ${method} ${path} failed`);
+    }
+    if (method === "GET" || method === "POST" || method === "PATCH") {
+      const result = await response.json();
+      return result.data;
+    }
+    return void 0;
+  }
+  storageRequest(method, key, value) {
+    return this.widgetApiRequest(`/widget-api/storage/${encodeURIComponent(key)}`, method, value);
+  }
+  handleMessage(event) {
+    const msg = event.data;
+    if (!msg || typeof msg !== "object" || msg.protocol !== PROTOCOL) return;
+    switch (msg.type) {
+      case "STATE_CHANGE": {
+        const payload = msg.payload;
+        this._state = payload.state;
+        for (const listener of this._stateListeners) {
+          listener(payload.state);
+        }
+        break;
+      }
+      case "EVENT_BROADCAST": {
+        const payload = msg.payload;
+        const listeners = this._eventListeners.get(payload.topic);
+        if (listeners) {
+          const evt = {
+            topic: payload.topic,
+            payload: payload.payload,
+            emittedAt: payload.emittedAt
+          };
+          for (const listener of listeners) {
+            listener(evt);
+          }
+        }
+        break;
+      }
+      case "CONSENT_RESULT": {
+        const payload = msg.payload;
+        const pending = this._pendingConsents.get(payload.scope);
+        if (pending) {
+          this._pendingConsents.delete(payload.scope);
+          pending.resolve({
+            scope: payload.scope,
+            granted: payload.granted,
+            grantToken: payload.grantToken,
+            expiresIn: payload.expiresIn
+          });
+        }
+        break;
+      }
+      case "AUTH_TOKEN_REFRESH": {
+        const payload = msg.payload;
+        this._cachedJwt = {
+          token: payload.token,
+          expiresAt: Date.now() + payload.expiresIn * 1e3
+        };
+        break;
+      }
+      case "DISPLAY_STATE_CHANGE": {
+        const newState = msg.payload?.displayState;
+        if (newState) {
+          this._displayState = newState;
+          this._displayStateCallbacks.forEach((cb) => cb(newState));
+        }
+        break;
+      }
+      case "FOCUS_CHANGE": {
+        const next = !!msg.payload?.focused;
+        if (next !== this._focused) {
+          this._focused = next;
+          this._focusCallbacks.forEach((cb) => cb(next));
+        }
+        break;
+      }
+      case "SETTINGS_REMOTE_UPDATE": {
+        const p = msg.payload;
+        this._settings = { ...p.settings };
+        for (const fn of this._settingsRemoteListeners) {
+          try {
+            fn({ ...this._settings });
+          } catch {
+          }
+        }
+        break;
+      }
+      case "USER_CONTEXT":
+      case "CANVAS_CONTEXT":
+        break;
+    }
+  }
+  send(type, payload) {
+    this.buildMessage(type, payload).then((msg) => {
+      window.parent.postMessage(msg, "*");
+    });
+  }
+  async buildMessage(type, payload) {
+    const nonce = crypto.randomUUID();
+    const timestamp = Date.now();
+    let token;
+    if (this._hmacSecret) {
+      token = await signToken(this._hmacSecret, type, this._widgetId, nonce, timestamp);
+    } else {
+      token = DEV_MODE_TOKEN;
+    }
+    return {
+      protocol: PROTOCOL,
+      type,
+      widgetId: this._widgetId,
+      nonce,
+      timestamp,
+      token,
+      payload
+    };
+  }
+  /** Tear down the SDK instance, remove all listeners, and reject pending consent requests. */
+  destroy() {
+    window.removeEventListener("message", this._messageHandler);
+    this._stateListeners.length = 0;
+    this._eventListeners.clear();
+    for (const [, pending] of this._pendingConsents) {
+      pending.reject(new Error("Widget destroyed"));
+    }
+    this._pendingConsents.clear();
+  }
+};
+var CanvasWidget = {
+  /**
+   * Initialize the SDK and establish communication with the canvas host.
+   *
+   * Sends a READY message to the host and waits for an INIT response.
+   * Resolves with a fully initialized {@link CanvasWidgetSDK} instance.
+   * Rejects after 5 seconds if no INIT is received from the host.
+   */
+  init() {
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        window.removeEventListener("message", handler);
+        reject(new Error("CanvasWidget.init() timed out \u2014 no INIT received from host within 5s"));
+      }, INIT_TIMEOUT_MS);
+      const handler = (event) => {
+        const msg = event.data;
+        if (!msg || typeof msg !== "object" || msg.protocol !== PROTOCOL) return;
+        if (msg.type !== "INIT") return;
+        clearTimeout(timeout);
+        window.removeEventListener("message", handler);
+        const payload = msg.payload;
+        const sdk = new CanvasWidgetSDKImpl(payload);
+        resolve(sdk);
+      };
+      window.addEventListener("message", handler);
+      const readyMsg = {
+        protocol: PROTOCOL,
+        type: "READY",
+        widgetId: "",
+        // Not yet known — host identifies us by iframe source
+        nonce: crypto.randomUUID(),
+        timestamp: Date.now(),
+        token: DEV_MODE_TOKEN,
+        // READY is always allowed, token doesn't matter
+        payload: { manifestVersion: "1" }
+      };
+      window.parent.postMessage(readyMsg, "*");
+    });
+  }
+};
+export {
+  CanvasWidget,
+  createServiceClient
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/service.ts", "../src/sdk.ts"],
+  "sourcesContent": ["// packages/widget-sdk/src/service.ts\n\nimport type { WidgetServiceClient } from './types';\n\nexport interface CreateServiceClientOptions {\n  baseUrl: string;\n  getJwt: (forceRefresh?: boolean) => Promise<string>;\n  fetchImpl?: typeof fetch;\n}\n\nexport function createServiceClient(opts: CreateServiceClientOptions): WidgetServiceClient {\n  const fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);\n  const baseUrl = opts.baseUrl.replace(/\\/+$/, '');\n\n  async function call(path: string, init: RequestInit, token: string): Promise<Response> {\n    const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;\n    const headers = new Headers(init.headers);\n    headers.set('authorization', `Bearer ${token}`);\n    if (init.body && !headers.has('content-type')) {\n      headers.set('content-type', 'application/json');\n    }\n    return fetchImpl(url, { ...init, headers });\n  }\n\n  return {\n    async fetch<T = unknown>(path: string, init: RequestInit = {}): Promise<T> {\n      let token = await opts.getJwt(false);\n      let res = await call(path, init, token);\n\n      if (res.status === 401) {\n        token = await opts.getJwt(true);\n        res = await call(path, init, token);\n      }\n\n      if (!res.ok) {\n        let body: { message?: string } = {};\n        try {\n          body = (await res.json()) as { message?: string };\n        } catch {\n          // non-JSON body \u2014 ignore\n        }\n        throw new Error(`Widget service request failed (${res.status}): ${body.message ?? ''}`);\n      }\n      return (await res.json()) as T;\n    },\n  };\n}\n", "// ============================================\n// Canvas Widget SDK \u2014 runs inside widget iframes\n// ============================================\n//\n// Usage in a widget:\n//   <script src=\"canvas-widget-sdk.js\"></script>\n//   <script>\n//     const widget = await CanvasWidget.init();\n//     widget.onStateChange(state => { ... });\n//   </script>\n\nimport type {\n  CanvasWidgetSDK,\n  WidgetDisplayState,\n  WidgetEvent,\n  InitPayload,\n  StateChangePayload,\n  EventBroadcastPayload,\n  ConsentResult,\n  ConsentResultPayload,\n  UserContext,\n  StorageAPI,\n  SettingsAPI,\n  WidgetServiceClient,\n  DbAPI,\n  DbCollection,\n  DbRecord,\n  DbListOptions,\n} from './types';\nimport { createServiceClient } from './service';\n\nconst PROTOCOL = 'canvas-widget-v1';\nconst DEV_MODE_TOKEN = 'dev-mode-skip';\nconst INIT_TIMEOUT_MS = 5000;\n\ninterface CanvasMessage {\n  protocol: string;\n  type: string;\n  widgetId: string;\n  nonce: string;\n  timestamp: number;\n  token: string;\n  payload: Record<string, unknown>;\n}\n\n// ============================================\n// HMAC utilities (mirrored from host side)\n// ============================================\n\nlet cachedKey: { secret: string; key: CryptoKey } | null = null;\n\nasync function getHmacKey(secret: string): Promise<CryptoKey> {\n  if (cachedKey && cachedKey.secret === secret) return cachedKey.key;\n\n  const encoded = new TextEncoder().encode(secret);\n  const buf = new ArrayBuffer(encoded.byteLength);\n  new Uint8Array(buf).set(encoded);\n\n  const key = await crypto.subtle.importKey('raw', buf, { name: 'HMAC', hash: 'SHA-256' }, false, [\n    'sign',\n  ]);\n\n  cachedKey = { secret, key };\n  return key;\n}\n\nasync function signToken(\n  secret: string,\n  type: string,\n  widgetId: string,\n  nonce: string,\n  timestamp: number\n): Promise<string> {\n  const key = await getHmacKey(secret);\n  const data = new TextEncoder().encode(`${type}:${widgetId}:${nonce}:${timestamp}`);\n  const buf = new ArrayBuffer(data.byteLength);\n  new Uint8Array(buf).set(data);\n  const sig = await crypto.subtle.sign('HMAC', key, buf);\n  return Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\n// ============================================\n// SDK Implementation\n// ============================================\n\n/** Internal SDK implementation \u2014 not exposed directly to widget authors. */\nexport class CanvasWidgetSDKImpl implements CanvasWidgetSDK {\n  private _widgetId: string;\n  private _state: WidgetDisplayState;\n  private _hmacSecret: string | null;\n  private _user: UserContext | null;\n  private _widgetApiUrl: string | null;\n  private _widgetApiToken: string | null;\n  private _installationId: string;\n  private _pendingConsents = new Map<\n    string,\n    { resolve: (r: ConsentResult) => void; reject: (e: Error) => void }\n  >();\n  private _cachedJwt: { token: string; expiresAt: number } | null = null;\n  private _stateListeners: Array<(state: WidgetDisplayState) => void> = [];\n  private _displayState: WidgetDisplayState = 'collapsed';\n  private _displayStateCallbacks: Array<(state: WidgetDisplayState) => void> = [];\n  private _focused = false;\n  private _focusCallbacks: Array<(focused: boolean) => void> = [];\n  private _settingsRemoteListeners: Array<(settings: Record<string, unknown>) => void> = [];\n  private _eventListeners = new Map<string, Array<(event: WidgetEvent) => void>>();\n  private _settings: Record<string, unknown>;\n  private _messageHandler: (event: MessageEvent) => void;\n\n  /** Authenticated HTTP client scoped to the widget's declared service URL. Undefined when no service is declared. */\n  readonly service: WidgetServiceClient | undefined;\n\n  constructor(init: InitPayload) {\n    this._widgetId = init.widgetId;\n    this._state = init.state;\n    this._hmacSecret = init.hmacSecret;\n    this._user = init.user;\n    this._widgetApiUrl = init.widgetApiUrl;\n    this._widgetApiToken = init.widgetApiToken ?? null;\n    this._installationId = init.installationId;\n    this._settings = init.settings ?? {};\n\n    // Wire sdk.service when the host provides a service URL from the manifest\n    if (init.serviceUrl) {\n      this.service = createServiceClient({\n        baseUrl: init.serviceUrl,\n        getJwt: (forceRefresh?: boolean) => this.getJwt(forceRefresh),\n      });\n    }\n\n    this._messageHandler = this.handleMessage.bind(this);\n    window.addEventListener('message', this._messageHandler);\n  }\n\n  /** The unique identifier for this widget instance on the canvas. */\n  get widgetId(): string {\n    return this._widgetId;\n  }\n\n  /** The current display state of the widget (collapsed, expanding, expanded, collapsing). */\n  get state(): WidgetDisplayState {\n    return this._state;\n  }\n\n  /** The authenticated user context, or null when user data access has not been granted. */\n  get user(): UserContext | null {\n    return this._user;\n  }\n\n  /** Subscribe to display state changes; returns an unsubscribe function. */\n  onStateChange(cb: (state: WidgetDisplayState) => void): () => void {\n    this._stateListeners.push(cb);\n    return () => {\n      const idx = this._stateListeners.indexOf(cb);\n      if (idx !== -1) this._stateListeners.splice(idx, 1);\n    };\n  }\n\n  /** Ask the canvas host to expand this widget into its modal view. */\n  requestExpand(): void {\n    this.send('EXPAND_REQUEST', {});\n  }\n\n  /** Ask the canvas host to collapse this widget back to its tile view. */\n  requestCollapse(): void {\n    this.send('COLLAPSE_REQUEST', {});\n  }\n\n  /** Get the current display state */\n  getDisplayState(): WidgetDisplayState {\n    return this._displayState;\n  }\n\n  /** Register a callback for display state changes */\n  onDisplayStateChange(callback: (state: WidgetDisplayState) => void): () => void {\n    this._displayStateCallbacks.push(callback);\n    return () => {\n      this._displayStateCallbacks = this._displayStateCallbacks.filter((cb) => cb !== callback);\n    };\n  }\n\n  /** Is this widget the user's current focus? Updates via FOCUS_CHANGE. */\n  isFocused(): boolean {\n    return this._focused;\n  }\n\n  /** Subscribe to focus transitions. Returns an unsubscribe function. */\n  onFocusChange(callback: (focused: boolean) => void): () => void {\n    this._focusCallbacks.push(callback);\n    return () => {\n      this._focusCallbacks = this._focusCallbacks.filter((cb) => cb !== callback);\n    };\n  }\n\n  /** Request promotion to fullscreen from partial */\n  requestFullscreen(): void {\n    this.send('FULLSCREEN_REQUEST', {});\n  }\n\n  /** Broadcast an event on the given topic to all subscribed widgets on the canvas. */\n  emit(topic: string, payload: unknown): void {\n    this.send('EVENT_EMIT', { topic, payload });\n  }\n\n  /** Subscribe to events on the given topic; returns an unsubscribe function. */\n  subscribe(topic: string, cb: (event: WidgetEvent) => void): () => void {\n    const list = this._eventListeners.get(topic) ?? [];\n    list.push(cb);\n    this._eventListeners.set(topic, list);\n    return () => {\n      const current = this._eventListeners.get(topic);\n      if (!current) return;\n      const idx = current.indexOf(cb);\n      if (idx !== -1) current.splice(idx, 1);\n    };\n  }\n\n  /** Send a structured log entry to the canvas host for centralized debugging. */\n  log(level: 'info' | 'warn' | 'error', message: string, data?: unknown): void {\n    this.send('LOG', { level, message, data: data ?? null });\n  }\n\n  /** Request user consent for a named data scope; resolves with the consent decision. */\n  async requestConsent(scope: string, reason: string): Promise<ConsentResult> {\n    return new Promise<ConsentResult>((resolve, reject) => {\n      const timeout = setTimeout(() => {\n        this._pendingConsents.delete(scope);\n        reject(new Error('Consent request timed out'));\n      }, 60000);\n\n      this._pendingConsents.set(scope, {\n        resolve: (r: ConsentResult) => {\n          clearTimeout(timeout);\n          resolve(r);\n        },\n        reject: (e: Error) => {\n          clearTimeout(timeout);\n          reject(e);\n        },\n      });\n\n      this.send('CONSENT_REQUEST', { scope, reason });\n    });\n  }\n\n  /** Return the cached JWT for authenticating requests to external APIs; throws if no token is available. Pass forceRefresh=true to bypass the cache. */\n  async getJwt(forceRefresh?: boolean): Promise<string> {\n    if (!forceRefresh && this._cachedJwt && Date.now() < this._cachedJwt.expiresAt - 30000) {\n      return this._cachedJwt.token;\n    }\n    throw new Error('No cached JWT \u2014 widget must use OAuth flow for token refresh');\n  }\n\n  /** Persistent key-value storage scoped to this widget installation. */\n  get storage(): StorageAPI {\n    return {\n      get: (key: string) => this.storageRequest('GET', key),\n      set: (key: string, value: unknown) => this.storageRequest('PUT', key, value).then(() => {}),\n      delete: (key: string) => this.storageRequest('DELETE', key).then(() => {}),\n    };\n  }\n\n  /** Ad-hoc collections/records backend scoped to the canvas/room. */\n  get db(): DbAPI {\n    const req = (path: string, method: string, body?: unknown) => this.widgetApiRequest(path, method, body);\n    return {\n      collection(name: string): DbCollection {\n        const base = `/widget-api/db/${encodeURIComponent(name)}`;\n        return {\n          create: (data) => req(base, 'POST', data) as Promise<DbRecord>,\n          get: (id) => req(`${base}/${encodeURIComponent(id)}`, 'GET') as Promise<DbRecord>,\n          list: (opts?: DbListOptions) => {\n            const qs = new URLSearchParams();\n            if (opts?.limit != null) qs.set('limit', String(opts.limit));\n            if (opts?.cursor) qs.set('cursor', opts.cursor);\n            if (opts?.sort) qs.set('sort', opts.sort);\n            if (opts?.mine) qs.set('mine', 'true');\n            const suffix = qs.toString() ? `?${qs.toString()}` : '';\n            return req(`${base}${suffix}`, 'GET') as Promise<DbRecord[]>;\n          },\n          update: (id, patch) => req(`${base}/${encodeURIComponent(id)}`, 'PATCH', patch) as Promise<DbRecord>,\n          delete: (id) => (req(`${base}/${encodeURIComponent(id)}`, 'DELETE') as Promise<unknown>).then(() => {}),\n        };\n      },\n    };\n  }\n\n  /** Widget configuration settings persisted by the canvas host. */\n  get settings(): SettingsAPI {\n    return {\n      get: () => ({ ...this._settings }),\n      set: (newSettings: Record<string, unknown>) => {\n        this._settings = { ...this._settings, ...newSettings };\n        this.send('SETTINGS_WRITE', { settings: this._settings });\n      },\n      onRemoteChange: (cb: (settings: Record<string, unknown>) => void) => {\n        this._settingsRemoteListeners.push(cb);\n        return () => {\n          this._settingsRemoteListeners = this._settingsRemoteListeners.filter((fn) => fn !== cb);\n        };\n      },\n    };\n  }\n\n  /** Display a toast notification in the canvas host UI. */\n  async notify(message: string, opts?: { level?: string; duration?: number }): Promise<void> {\n    this.send('NOTIFICATION', {\n      message,\n      level: opts?.level ?? 'info',\n      duration: opts?.duration ?? 5000,\n    });\n  }\n\n  // \u2500\u2500 Private \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private async widgetApiRequest(path: string, method: string, body?: unknown): Promise<unknown> {\n    if (!this._widgetApiUrl) {\n      throw new Error('Widget API Gateway URL not available');\n    }\n    const url = `${this._widgetApiUrl}${path}`;\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n    if (this._widgetApiToken) {\n      headers['Authorization'] = `Bearer ${this._widgetApiToken}`;\n    }\n    const opts: RequestInit = { method, headers };\n    if (body !== undefined && method !== 'GET' && method !== 'DELETE') {\n      opts.body = JSON.stringify(body);\n    }\n    const response = await fetch(url, opts);\n    if (!response.ok) {\n      const err = await response.json().catch(() => ({}));\n      throw new Error((err as Record<string, string>).message ?? `Request ${method} ${path} failed`);\n    }\n    if (method === 'GET' || method === 'POST' || method === 'PATCH') {\n      const result = await response.json();\n      return (result as Record<string, unknown>).data;\n    }\n    return undefined;\n  }\n\n  private storageRequest(method: string, key: string, value?: unknown): Promise<unknown> {\n    return this.widgetApiRequest(`/widget-api/storage/${encodeURIComponent(key)}`, method, value);\n  }\n\n  private handleMessage(event: MessageEvent): void {\n    const msg = event.data;\n    if (!msg || typeof msg !== 'object' || msg.protocol !== PROTOCOL) return;\n\n    switch (msg.type) {\n      case 'STATE_CHANGE': {\n        const payload = msg.payload as StateChangePayload;\n        this._state = payload.state;\n        for (const listener of this._stateListeners) {\n          listener(payload.state);\n        }\n        break;\n      }\n      case 'EVENT_BROADCAST': {\n        const payload = msg.payload as EventBroadcastPayload;\n        const listeners = this._eventListeners.get(payload.topic);\n        if (listeners) {\n          const evt: WidgetEvent = {\n            topic: payload.topic,\n            payload: payload.payload,\n            emittedAt: payload.emittedAt,\n          };\n          for (const listener of listeners) {\n            listener(evt);\n          }\n        }\n        break;\n      }\n      case 'CONSENT_RESULT': {\n        const payload = msg.payload as ConsentResultPayload;\n        const pending = this._pendingConsents.get(payload.scope);\n        if (pending) {\n          this._pendingConsents.delete(payload.scope);\n          pending.resolve({\n            scope: payload.scope,\n            granted: payload.granted,\n            grantToken: payload.grantToken,\n            expiresIn: payload.expiresIn,\n          });\n        }\n        break;\n      }\n      case 'AUTH_TOKEN_REFRESH': {\n        const payload = msg.payload as { token: string; expiresIn: number };\n        this._cachedJwt = {\n          token: payload.token,\n          expiresAt: Date.now() + payload.expiresIn * 1000,\n        };\n        break;\n      }\n      case 'DISPLAY_STATE_CHANGE': {\n        const newState = msg.payload?.displayState as WidgetDisplayState;\n        if (newState) {\n          this._displayState = newState;\n          this._displayStateCallbacks.forEach((cb) => cb(newState));\n        }\n        break;\n      }\n      case 'FOCUS_CHANGE': {\n        const next = !!msg.payload?.focused;\n        if (next !== this._focused) {\n          this._focused = next;\n          this._focusCallbacks.forEach((cb) => cb(next));\n        }\n        break;\n      }\n      case 'SETTINGS_REMOTE_UPDATE': {\n        const p = msg.payload as { settings: Record<string, unknown> };\n        this._settings = { ...p.settings };\n        for (const fn of this._settingsRemoteListeners) {\n          try {\n            fn({ ...this._settings });\n          } catch {\n            // a listener throwing must not break message handling\n          }\n        }\n        break;\n      }\n      case 'USER_CONTEXT':\n      case 'CANVAS_CONTEXT':\n        // Phase 3+ \u2014 reserved for future use\n        break;\n    }\n  }\n\n  private send(type: string, payload: Record<string, unknown>): void {\n    // Fire and forget \u2014 sign is async but we don't need to await delivery\n    this.buildMessage(type, payload).then((msg) => {\n      window.parent.postMessage(msg, '*');\n    });\n  }\n\n  private async buildMessage(\n    type: string,\n    payload: Record<string, unknown>\n  ): Promise<CanvasMessage> {\n    const nonce = crypto.randomUUID();\n    const timestamp = Date.now();\n\n    let token: string;\n    if (this._hmacSecret) {\n      token = await signToken(this._hmacSecret, type, this._widgetId, nonce, timestamp);\n    } else {\n      token = DEV_MODE_TOKEN;\n    }\n\n    return {\n      protocol: PROTOCOL,\n      type,\n      widgetId: this._widgetId,\n      nonce,\n      timestamp,\n      token,\n      payload,\n    };\n  }\n\n  /** Tear down the SDK instance, remove all listeners, and reject pending consent requests. */\n  destroy(): void {\n    window.removeEventListener('message', this._messageHandler);\n    this._stateListeners.length = 0;\n    this._eventListeners.clear();\n    for (const [, pending] of this._pendingConsents) {\n      pending.reject(new Error('Widget destroyed'));\n    }\n    this._pendingConsents.clear();\n  }\n}\n\n// ============================================\n// Public API: CanvasWidget.init()\n// ============================================\n\n/**\n * Entry point for the Flowstate Canvas Widget SDK.\n *\n * Usage:\n * ```ts\n * import { CanvasWidget } from '@goflowstate/widget-sdk';\n * const widget = await CanvasWidget.init();\n * ```\n */\nexport const CanvasWidget = {\n  /**\n   * Initialize the SDK and establish communication with the canvas host.\n   *\n   * Sends a READY message to the host and waits for an INIT response.\n   * Resolves with a fully initialized {@link CanvasWidgetSDK} instance.\n   * Rejects after 5 seconds if no INIT is received from the host.\n   */\n  init(): Promise<CanvasWidgetSDK> {\n    return new Promise<CanvasWidgetSDK>((resolve, reject) => {\n      const timeout = setTimeout(() => {\n        window.removeEventListener('message', handler);\n        reject(new Error('CanvasWidget.init() timed out \u2014 no INIT received from host within 5s'));\n      }, INIT_TIMEOUT_MS);\n\n      const handler = (event: MessageEvent) => {\n        const msg = event.data;\n        if (!msg || typeof msg !== 'object' || msg.protocol !== PROTOCOL) return;\n        if (msg.type !== 'INIT') return;\n\n        clearTimeout(timeout);\n        window.removeEventListener('message', handler);\n\n        const payload = msg.payload as InitPayload;\n        const sdk = new CanvasWidgetSDKImpl(payload);\n        resolve(sdk);\n      };\n\n      window.addEventListener('message', handler);\n\n      // Send READY to host \u2014 the host will respond with INIT\n      const readyMsg: CanvasMessage = {\n        protocol: PROTOCOL,\n        type: 'READY',\n        widgetId: '', // Not yet known \u2014 host identifies us by iframe source\n        nonce: crypto.randomUUID(),\n        timestamp: Date.now(),\n        token: DEV_MODE_TOKEN, // READY is always allowed, token doesn't matter\n        payload: { manifestVersion: '1' },\n      };\n\n      window.parent.postMessage(readyMsg, '*');\n    });\n  },\n};\n"],
+  "mappings": ";;;;;;;;AAUO,SAAS,oBAAoB,MAAuD;AACzF,QAAM,YAAY,KAAK,aAAa,WAAW,MAAM,KAAK,UAAU;AACpE,QAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAE/C,iBAAe,KAAK,MAAc,MAAmB,OAAkC;AACrF,UAAM,MAAM,GAAG,OAAO,GAAG,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI,EAAE;AACjE,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,YAAQ,IAAI,iBAAiB,UAAU,KAAK,EAAE;AAC9C,QAAI,KAAK,QAAQ,CAAC,QAAQ,IAAI,cAAc,GAAG;AAC7C,cAAQ,IAAI,gBAAgB,kBAAkB;AAAA,IAChD;AACA,WAAO,UAAU,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,EAC5C;AAEA,SAAO;AAAA,IACL,MAAM,MAAmB,MAAc,OAAoB,CAAC,GAAe;AACzE,UAAI,QAAQ,MAAM,KAAK,OAAO,KAAK;AACnC,UAAI,MAAM,MAAM,KAAK,MAAM,MAAM,KAAK;AAEtC,UAAI,IAAI,WAAW,KAAK;AACtB,gBAAQ,MAAM,KAAK,OAAO,IAAI;AAC9B,cAAM,MAAM,KAAK,MAAM,MAAM,KAAK;AAAA,MACpC;AAEA,UAAI,CAAC,IAAI,IAAI;AACX,YAAI,OAA6B,CAAC;AAClC,YAAI;AACF,iBAAQ,MAAM,IAAI,KAAK;AAAA,QACzB,QAAQ;AAAA,QAER;AACA,cAAM,IAAI,MAAM,kCAAkC,IAAI,MAAM,MAAM,KAAK,WAAW,EAAE,EAAE;AAAA,MACxF;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB;AAAA,EACF;AACF;;;ACfA,IAAM,WAAW;AACjB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAgBxB,IAAI,YAAuD;AAE3D,eAAe,WAAW,QAAoC;AAC5D,MAAI,aAAa,UAAU,WAAW,OAAQ,QAAO,UAAU;AAE/D,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,MAAM;AAC/C,QAAM,MAAM,IAAI,YAAY,QAAQ,UAAU;AAC9C,MAAI,WAAW,GAAG,EAAE,IAAI,OAAO;AAE/B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,KAAK,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO;AAAA,IAC9F;AAAA,EACF,CAAC;AAED,cAAY,EAAE,QAAQ,IAAI;AAC1B,SAAO;AACT;AAEA,eAAe,UACb,QACA,MACA,UACA,OACA,WACiB;AACjB,QAAM,MAAM,MAAM,WAAW,MAAM;AACnC,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI,SAAS,EAAE;AACjF,QAAM,MAAM,IAAI,YAAY,KAAK,UAAU;AAC3C,MAAI,WAAW,GAAG,EAAE,IAAI,IAAI;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,GAAG;AACrD,SAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAOO,IAAM,sBAAN,MAAqD;AAAA,EA0B1D,YAAY,MAAmB;AAzB/B,wBAAQ;AACR,wBAAQ;AACR,wBAAQ;AACR,wBAAQ;AACR,wBAAQ;AACR,wBAAQ;AACR,wBAAQ;AACR,wBAAQ,oBAAmB,oBAAI,IAG7B;AACF,wBAAQ,cAA0D;AAClE,wBAAQ,mBAA8D,CAAC;AACvE,wBAAQ,iBAAoC;AAC5C,wBAAQ,0BAAqE,CAAC;AAC9E,wBAAQ,YAAW;AACnB,wBAAQ,mBAAqD,CAAC;AAC9D,wBAAQ,4BAA+E,CAAC;AACxF,wBAAQ,mBAAkB,oBAAI,IAAiD;AAC/E,wBAAQ;AACR,wBAAQ;AAGR;AAAA,wBAAS;AAGP,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,cAAc,KAAK;AACxB,SAAK,QAAQ,KAAK;AAClB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,kBAAkB,KAAK,kBAAkB;AAC9C,SAAK,kBAAkB,KAAK;AAC5B,SAAK,YAAY,KAAK,YAAY,CAAC;AAGnC,QAAI,KAAK,YAAY;AACnB,WAAK,UAAU,oBAAoB;AAAA,QACjC,SAAS,KAAK;AAAA,QACd,QAAQ,CAAC,iBAA2B,KAAK,OAAO,YAAY;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,SAAK,kBAAkB,KAAK,cAAc,KAAK,IAAI;AACnD,WAAO,iBAAiB,WAAW,KAAK,eAAe;AAAA,EACzD;AAAA;AAAA,EAGA,IAAI,WAAmB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,IAAI,QAA4B;AAC9B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,IAAI,OAA2B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,cAAc,IAAqD;AACjE,SAAK,gBAAgB,KAAK,EAAE;AAC5B,WAAO,MAAM;AACX,YAAM,MAAM,KAAK,gBAAgB,QAAQ,EAAE;AAC3C,UAAI,QAAQ,GAAI,MAAK,gBAAgB,OAAO,KAAK,CAAC;AAAA,IACpD;AAAA,EACF;AAAA;AAAA,EAGA,gBAAsB;AACpB,SAAK,KAAK,kBAAkB,CAAC,CAAC;AAAA,EAChC;AAAA;AAAA,EAGA,kBAAwB;AACtB,SAAK,KAAK,oBAAoB,CAAC,CAAC;AAAA,EAClC;AAAA;AAAA,EAGA,kBAAsC;AACpC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,qBAAqB,UAA2D;AAC9E,SAAK,uBAAuB,KAAK,QAAQ;AACzC,WAAO,MAAM;AACX,WAAK,yBAAyB,KAAK,uBAAuB,OAAO,CAAC,OAAO,OAAO,QAAQ;AAAA,IAC1F;AAAA,EACF;AAAA;AAAA,EAGA,YAAqB;AACnB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,cAAc,UAAkD;AAC9D,SAAK,gBAAgB,KAAK,QAAQ;AAClC,WAAO,MAAM;AACX,WAAK,kBAAkB,KAAK,gBAAgB,OAAO,CAAC,OAAO,OAAO,QAAQ;AAAA,IAC5E;AAAA,EACF;AAAA;AAAA,EAGA,oBAA0B;AACxB,SAAK,KAAK,sBAAsB,CAAC,CAAC;AAAA,EACpC;AAAA;AAAA,EAGA,KAAK,OAAe,SAAwB;AAC1C,SAAK,KAAK,cAAc,EAAE,OAAO,QAAQ,CAAC;AAAA,EAC5C;AAAA;AAAA,EAGA,UAAU,OAAe,IAA8C;AACrE,UAAM,OAAO,KAAK,gBAAgB,IAAI,KAAK,KAAK,CAAC;AACjD,SAAK,KAAK,EAAE;AACZ,SAAK,gBAAgB,IAAI,OAAO,IAAI;AACpC,WAAO,MAAM;AACX,YAAM,UAAU,KAAK,gBAAgB,IAAI,KAAK;AAC9C,UAAI,CAAC,QAAS;AACd,YAAM,MAAM,QAAQ,QAAQ,EAAE;AAC9B,UAAI,QAAQ,GAAI,SAAQ,OAAO,KAAK,CAAC;AAAA,IACvC;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,OAAkC,SAAiB,MAAsB;AAC3E,SAAK,KAAK,OAAO,EAAE,OAAO,SAAS,MAAM,QAAQ,KAAK,CAAC;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,eAAe,OAAe,QAAwC;AAC1E,WAAO,IAAI,QAAuB,CAAC,SAAS,WAAW;AACrD,YAAM,UAAU,WAAW,MAAM;AAC/B,aAAK,iBAAiB,OAAO,KAAK;AAClC,eAAO,IAAI,MAAM,2BAA2B,CAAC;AAAA,MAC/C,GAAG,GAAK;AAER,WAAK,iBAAiB,IAAI,OAAO;AAAA,QAC/B,SAAS,CAAC,MAAqB;AAC7B,uBAAa,OAAO;AACpB,kBAAQ,CAAC;AAAA,QACX;AAAA,QACA,QAAQ,CAAC,MAAa;AACpB,uBAAa,OAAO;AACpB,iBAAO,CAAC;AAAA,QACV;AAAA,MACF,CAAC;AAED,WAAK,KAAK,mBAAmB,EAAE,OAAO,OAAO,CAAC;AAAA,IAChD,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,OAAO,cAAyC;AACpD,QAAI,CAAC,gBAAgB,KAAK,cAAc,KAAK,IAAI,IAAI,KAAK,WAAW,YAAY,KAAO;AACtF,aAAO,KAAK,WAAW;AAAA,IACzB;AACA,UAAM,IAAI,MAAM,mEAA8D;AAAA,EAChF;AAAA;AAAA,EAGA,IAAI,UAAsB;AACxB,WAAO;AAAA,MACL,KAAK,CAAC,QAAgB,KAAK,eAAe,OAAO,GAAG;AAAA,MACpD,KAAK,CAAC,KAAa,UAAmB,KAAK,eAAe,OAAO,KAAK,KAAK,EAAE,KAAK,MAAM;AAAA,MAAC,CAAC;AAAA,MAC1F,QAAQ,CAAC,QAAgB,KAAK,eAAe,UAAU,GAAG,EAAE,KAAK,MAAM;AAAA,MAAC,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,KAAY;AACd,UAAM,MAAM,CAAC,MAAc,QAAgB,SAAmB,KAAK,iBAAiB,MAAM,QAAQ,IAAI;AACtG,WAAO;AAAA,MACL,WAAW,MAA4B;AACrC,cAAM,OAAO,kBAAkB,mBAAmB,IAAI,CAAC;AACvD,eAAO;AAAA,UACL,QAAQ,CAAC,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,UACxC,KAAK,CAAC,OAAO,IAAI,GAAG,IAAI,IAAI,mBAAmB,EAAE,CAAC,IAAI,KAAK;AAAA,UAC3D,MAAM,CAAC,SAAyB;AAC9B,kBAAM,KAAK,IAAI,gBAAgB;AAC/B,gBAAI,MAAM,SAAS,KAAM,IAAG,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC3D,gBAAI,MAAM,OAAQ,IAAG,IAAI,UAAU,KAAK,MAAM;AAC9C,gBAAI,MAAM,KAAM,IAAG,IAAI,QAAQ,KAAK,IAAI;AACxC,gBAAI,MAAM,KAAM,IAAG,IAAI,QAAQ,MAAM;AACrC,kBAAM,SAAS,GAAG,SAAS,IAAI,IAAI,GAAG,SAAS,CAAC,KAAK;AACrD,mBAAO,IAAI,GAAG,IAAI,GAAG,MAAM,IAAI,KAAK;AAAA,UACtC;AAAA,UACA,QAAQ,CAAC,IAAI,UAAU,IAAI,GAAG,IAAI,IAAI,mBAAmB,EAAE,CAAC,IAAI,SAAS,KAAK;AAAA,UAC9E,QAAQ,CAAC,OAAQ,IAAI,GAAG,IAAI,IAAI,mBAAmB,EAAE,CAAC,IAAI,QAAQ,EAAuB,KAAK,MAAM;AAAA,UAAC,CAAC;AAAA,QACxG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,WAAwB;AAC1B,WAAO;AAAA,MACL,KAAK,OAAO,EAAE,GAAG,KAAK,UAAU;AAAA,MAChC,KAAK,CAAC,gBAAyC;AAC7C,aAAK,YAAY,EAAE,GAAG,KAAK,WAAW,GAAG,YAAY;AACrD,aAAK,KAAK,kBAAkB,EAAE,UAAU,KAAK,UAAU,CAAC;AAAA,MAC1D;AAAA,MACA,gBAAgB,CAAC,OAAoD;AACnE,aAAK,yBAAyB,KAAK,EAAE;AACrC,eAAO,MAAM;AACX,eAAK,2BAA2B,KAAK,yBAAyB,OAAO,CAAC,OAAO,OAAO,EAAE;AAAA,QACxF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAO,SAAiB,MAA6D;AACzF,SAAK,KAAK,gBAAgB;AAAA,MACxB;AAAA,MACA,OAAO,MAAM,SAAS;AAAA,MACtB,UAAU,MAAM,YAAY;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA;AAAA,EAIA,MAAc,iBAAiB,MAAc,QAAgB,MAAkC;AAC7F,QAAI,CAAC,KAAK,eAAe;AACvB,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AACA,UAAM,MAAM,GAAG,KAAK,aAAa,GAAG,IAAI;AACxC,UAAM,UAAkC,EAAE,gBAAgB,mBAAmB;AAC7E,QAAI,KAAK,iBAAiB;AACxB,cAAQ,eAAe,IAAI,UAAU,KAAK,eAAe;AAAA,IAC3D;AACA,UAAM,OAAoB,EAAE,QAAQ,QAAQ;AAC5C,QAAI,SAAS,UAAa,WAAW,SAAS,WAAW,UAAU;AACjE,WAAK,OAAO,KAAK,UAAU,IAAI;AAAA,IACjC;AACA,UAAM,WAAW,MAAM,MAAM,KAAK,IAAI;AACtC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,MAAM,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAClD,YAAM,IAAI,MAAO,IAA+B,WAAW,WAAW,MAAM,IAAI,IAAI,SAAS;AAAA,IAC/F;AACA,QAAI,WAAW,SAAS,WAAW,UAAU,WAAW,SAAS;AAC/D,YAAM,SAAS,MAAM,SAAS,KAAK;AACnC,aAAQ,OAAmC;AAAA,IAC7C;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe,QAAgB,KAAa,OAAmC;AACrF,WAAO,KAAK,iBAAiB,uBAAuB,mBAAmB,GAAG,CAAC,IAAI,QAAQ,KAAK;AAAA,EAC9F;AAAA,EAEQ,cAAc,OAA2B;AAC/C,UAAM,MAAM,MAAM;AAClB,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,IAAI,aAAa,SAAU;AAElE,YAAQ,IAAI,MAAM;AAAA,MAChB,KAAK,gBAAgB;AACnB,cAAM,UAAU,IAAI;AACpB,aAAK,SAAS,QAAQ;AACtB,mBAAW,YAAY,KAAK,iBAAiB;AAC3C,mBAAS,QAAQ,KAAK;AAAA,QACxB;AACA;AAAA,MACF;AAAA,MACA,KAAK,mBAAmB;AACtB,cAAM,UAAU,IAAI;AACpB,cAAM,YAAY,KAAK,gBAAgB,IAAI,QAAQ,KAAK;AACxD,YAAI,WAAW;AACb,gBAAM,MAAmB;AAAA,YACvB,OAAO,QAAQ;AAAA,YACf,SAAS,QAAQ;AAAA,YACjB,WAAW,QAAQ;AAAA,UACrB;AACA,qBAAW,YAAY,WAAW;AAChC,qBAAS,GAAG;AAAA,UACd;AAAA,QACF;AACA;AAAA,MACF;AAAA,MACA,KAAK,kBAAkB;AACrB,cAAM,UAAU,IAAI;AACpB,cAAM,UAAU,KAAK,iBAAiB,IAAI,QAAQ,KAAK;AACvD,YAAI,SAAS;AACX,eAAK,iBAAiB,OAAO,QAAQ,KAAK;AAC1C,kBAAQ,QAAQ;AAAA,YACd,OAAO,QAAQ;AAAA,YACf,SAAS,QAAQ;AAAA,YACjB,YAAY,QAAQ;AAAA,YACpB,WAAW,QAAQ;AAAA,UACrB,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAAA,MACA,KAAK,sBAAsB;AACzB,cAAM,UAAU,IAAI;AACpB,aAAK,aAAa;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,WAAW,KAAK,IAAI,IAAI,QAAQ,YAAY;AAAA,QAC9C;AACA;AAAA,MACF;AAAA,MACA,KAAK,wBAAwB;AAC3B,cAAM,WAAW,IAAI,SAAS;AAC9B,YAAI,UAAU;AACZ,eAAK,gBAAgB;AACrB,eAAK,uBAAuB,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC;AAAA,QAC1D;AACA;AAAA,MACF;AAAA,MACA,KAAK,gBAAgB;AACnB,cAAM,OAAO,CAAC,CAAC,IAAI,SAAS;AAC5B,YAAI,SAAS,KAAK,UAAU;AAC1B,eAAK,WAAW;AAChB,eAAK,gBAAgB,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;AAAA,QAC/C;AACA;AAAA,MACF;AAAA,MACA,KAAK,0BAA0B;AAC7B,cAAM,IAAI,IAAI;AACd,aAAK,YAAY,EAAE,GAAG,EAAE,SAAS;AACjC,mBAAW,MAAM,KAAK,0BAA0B;AAC9C,cAAI;AACF,eAAG,EAAE,GAAG,KAAK,UAAU,CAAC;AAAA,UAC1B,QAAQ;AAAA,UAER;AAAA,QACF;AACA;AAAA,MACF;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAEH;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,KAAK,MAAc,SAAwC;AAEjE,SAAK,aAAa,MAAM,OAAO,EAAE,KAAK,CAAC,QAAQ;AAC7C,aAAO,OAAO,YAAY,KAAK,GAAG;AAAA,IACpC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,aACZ,MACA,SACwB;AACxB,UAAM,QAAQ,OAAO,WAAW;AAChC,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI;AACJ,QAAI,KAAK,aAAa;AACpB,cAAQ,MAAM,UAAU,KAAK,aAAa,MAAM,KAAK,WAAW,OAAO,SAAS;AAAA,IAClF,OAAO;AACL,cAAQ;AAAA,IACV;AAEA,WAAO;AAAA,MACL,UAAU;AAAA,MACV;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,UAAgB;AACd,WAAO,oBAAoB,WAAW,KAAK,eAAe;AAC1D,SAAK,gBAAgB,SAAS;AAC9B,SAAK,gBAAgB,MAAM;AAC3B,eAAW,CAAC,EAAE,OAAO,KAAK,KAAK,kBAAkB;AAC/C,cAAQ,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,IAC9C;AACA,SAAK,iBAAiB,MAAM;AAAA,EAC9B;AACF;AAeO,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ1B,OAAiC;AAC/B,WAAO,IAAI,QAAyB,CAAC,SAAS,WAAW;AACvD,YAAM,UAAU,WAAW,MAAM;AAC/B,eAAO,oBAAoB,WAAW,OAAO;AAC7C,eAAO,IAAI,MAAM,2EAAsE,CAAC;AAAA,MAC1F,GAAG,eAAe;AAElB,YAAM,UAAU,CAAC,UAAwB;AACvC,cAAM,MAAM,MAAM;AAClB,YAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,IAAI,aAAa,SAAU;AAClE,YAAI,IAAI,SAAS,OAAQ;AAEzB,qBAAa,OAAO;AACpB,eAAO,oBAAoB,WAAW,OAAO;AAE7C,cAAM,UAAU,IAAI;AACpB,cAAM,MAAM,IAAI,oBAAoB,OAAO;AAC3C,gBAAQ,GAAG;AAAA,MACb;AAEA,aAAO,iBAAiB,WAAW,OAAO;AAG1C,YAAM,WAA0B;AAAA,QAC9B,UAAU;AAAA,QACV,MAAM;AAAA,QACN,UAAU;AAAA;AAAA,QACV,OAAO,OAAO,WAAW;AAAA,QACzB,WAAW,KAAK,IAAI;AAAA,QACpB,OAAO;AAAA;AAAA,QACP,SAAS,EAAE,iBAAiB,IAAI;AAAA,MAClC;AAEA,aAAO,OAAO,YAAY,UAAU,GAAG;AAAA,IACzC,CAAC;AAAA,EACH;AACF;",
+  "names": []
+}

package/dist/sdk.d.ts

@@ -0,0 +1,95 @@
+import type { CanvasWidgetSDK, WidgetDisplayState, WidgetEvent, InitPayload, ConsentResult, UserContext, StorageAPI, SettingsAPI, WidgetServiceClient, DbAPI } from './types';
+/** Internal SDK implementation — not exposed directly to widget authors. */
+export declare class CanvasWidgetSDKImpl implements CanvasWidgetSDK {
+    private _widgetId;
+    private _state;
+    private _hmacSecret;
+    private _user;
+    private _widgetApiUrl;
+    private _widgetApiToken;
+    private _installationId;
+    private _pendingConsents;
+    private _cachedJwt;
+    private _stateListeners;
+    private _displayState;
+    private _displayStateCallbacks;
+    private _focused;
+    private _focusCallbacks;
+    private _settingsRemoteListeners;
+    private _eventListeners;
+    private _settings;
+    private _messageHandler;
+    /** Authenticated HTTP client scoped to the widget's declared service URL. Undefined when no service is declared. */
+    readonly service: WidgetServiceClient | undefined;
+    constructor(init: InitPayload);
+    /** The unique identifier for this widget instance on the canvas. */
+    get widgetId(): string;
+    /** The current display state of the widget (collapsed, expanding, expanded, collapsing). */
+    get state(): WidgetDisplayState;
+    /** The authenticated user context, or null when user data access has not been granted. */
+    get user(): UserContext | null;
+    /** Subscribe to display state changes; returns an unsubscribe function. */
+    onStateChange(cb: (state: WidgetDisplayState) => void): () => void;
+    /** Ask the canvas host to expand this widget into its modal view. */
+    requestExpand(): void;
+    /** Ask the canvas host to collapse this widget back to its tile view. */
+    requestCollapse(): void;
+    /** Get the current display state */
+    getDisplayState(): WidgetDisplayState;
+    /** Register a callback for display state changes */
+    onDisplayStateChange(callback: (state: WidgetDisplayState) => void): () => void;
+    /** Is this widget the user's current focus? Updates via FOCUS_CHANGE. */
+    isFocused(): boolean;
+    /** Subscribe to focus transitions. Returns an unsubscribe function. */
+    onFocusChange(callback: (focused: boolean) => void): () => void;
+    /** Request promotion to fullscreen from partial */
+    requestFullscreen(): void;
+    /** Broadcast an event on the given topic to all subscribed widgets on the canvas. */
+    emit(topic: string, payload: unknown): void;
+    /** Subscribe to events on the given topic; returns an unsubscribe function. */
+    subscribe(topic: string, cb: (event: WidgetEvent) => void): () => void;
+    /** Send a structured log entry to the canvas host for centralized debugging. */
+    log(level: 'info' | 'warn' | 'error', message: string, data?: unknown): void;
+    /** Request user consent for a named data scope; resolves with the consent decision. */
+    requestConsent(scope: string, reason: string): Promise<ConsentResult>;
+    /** Return the cached JWT for authenticating requests to external APIs; throws if no token is available. Pass forceRefresh=true to bypass the cache. */
+    getJwt(forceRefresh?: boolean): Promise<string>;
+    /** Persistent key-value storage scoped to this widget installation. */
+    get storage(): StorageAPI;
+    /** Ad-hoc collections/records backend scoped to the canvas/room. */
+    get db(): DbAPI;
+    /** Widget configuration settings persisted by the canvas host. */
+    get settings(): SettingsAPI;
+    /** Display a toast notification in the canvas host UI. */
+    notify(message: string, opts?: {
+        level?: string;
+        duration?: number;
+    }): Promise<void>;
+    private widgetApiRequest;
+    private storageRequest;
+    private handleMessage;
+    private send;
+    private buildMessage;
+    /** Tear down the SDK instance, remove all listeners, and reject pending consent requests. */
+    destroy(): void;
+}
+/**
+ * Entry point for the Flowstate Canvas Widget SDK.
+ *
+ * Usage:
+ * ```ts
+ * import { CanvasWidget } from '@goflowstate/widget-sdk';
+ * const widget = await CanvasWidget.init();
+ * ```
+ */
+export declare const CanvasWidget: {
+    /**
+     * Initialize the SDK and establish communication with the canvas host.
+     *
+     * Sends a READY message to the host and waits for an INIT response.
+     * Resolves with a fully initialized {@link CanvasWidgetSDK} instance.
+     * Rejects after 5 seconds if no INIT is received from the host.
+     */
+    init(): Promise<CanvasWidgetSDK>;
+};
+//# sourceMappingURL=sdk.d.ts.map

package/dist/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,WAAW,EAGX,aAAa,EAEb,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,KAAK,EAIN,MAAM,SAAS,CAAC;AA2DjB,4EAA4E;AAC5E,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,eAAe,CAAgB;IACvC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,gBAAgB,CAGpB;IACJ,OAAO,CAAC,UAAU,CAAqD;IACvE,OAAO,CAAC,eAAe,CAAkD;IACzE,OAAO,CAAC,aAAa,CAAmC;IACxD,OAAO,CAAC,sBAAsB,CAAkD;IAChF,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,wBAAwB,CAA0D;IAC1F,OAAO,CAAC,eAAe,CAA0D;IACjF,OAAO,CAAC,SAAS,CAA0B;IAC3C,OAAO,CAAC,eAAe,CAAgC;IAEvD,oHAAoH;IACpH,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,SAAS,CAAC;gBAEtC,IAAI,EAAE,WAAW;IAsB7B,oEAAoE;IACpE,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,4FAA4F;IAC5F,IAAI,KAAK,IAAI,kBAAkB,CAE9B;IAED,0FAA0F;IAC1F,IAAI,IAAI,IAAI,WAAW,GAAG,IAAI,CAE7B;IAED,2EAA2E;IAC3E,aAAa,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,GAAG,MAAM,IAAI;IAQlE,qEAAqE;IACrE,aAAa,IAAI,IAAI;IAIrB,yEAAyE;IACzE,eAAe,IAAI,IAAI;IAIvB,oCAAoC;IACpC,eAAe,IAAI,kBAAkB;IAIrC,oDAAoD;IACpD,oBAAoB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,GAAG,MAAM,IAAI;IAO/E,yEAAyE;IACzE,SAAS,IAAI,OAAO;IAIpB,uEAAuE;IACvE,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAO/D,mDAAmD;IACnD,iBAAiB,IAAI,IAAI;IAIzB,qFAAqF;IACrF,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IAI3C,+EAA+E;IAC/E,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI;IAYtE,gFAAgF;IAChF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI;IAI5E,uFAAuF;IACjF,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAsB3E,uJAAuJ;IACjJ,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAOrD,uEAAuE;IACvE,IAAI,OAAO,IAAI,UAAU,CAMxB;IAED,oEAAoE;IACpE,IAAI,EAAE,IAAI,KAAK,CAsBd;IAED,kEAAkE;IAClE,IAAI,QAAQ,IAAI,WAAW,CAc1B;IAED,0DAA0D;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAU5E,gBAAgB;IAyB9B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,aAAa;IAqFrB,OAAO,CAAC,IAAI;YAOE,YAAY;IAyB1B,6FAA6F;IAC7F,OAAO,IAAI,IAAI;CAShB;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY;IACvB;;;;;;OAMG;YACK,OAAO,CAAC,eAAe,CAAC;CAoCjC,CAAC"}

package/dist/sdk.focus.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sdk.focus.test.d.ts.map

package/dist/sdk.focus.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.focus.test.d.ts","sourceRoot":"","sources":["../src/sdk.focus.test.ts"],"names":[],"mappings":""}

package/dist/service.d.ts

@@ -0,0 +1,8 @@
+import type { WidgetServiceClient } from './types';
+export interface CreateServiceClientOptions {
+    baseUrl: string;
+    getJwt: (forceRefresh?: boolean) => Promise<string>;
+    fetchImpl?: typeof fetch;
+}
+export declare function createServiceClient(opts: CreateServiceClientOptions): WidgetServiceClient;
+//# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,mBAAmB,CAoCzF"}

package/dist/service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service.test.d.ts.map

package/dist/service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.test.d.ts","sourceRoot":"","sources":["../src/service.test.ts"],"names":[],"mappings":""}