@haex-space/vault-sdk 2.9.3 → 3.1.0

package/dist/index.mjs

@@ -539,7 +539,24 @@ var HAEXSPACE_MESSAGE_TYPES = {
   /** Debug message for development/troubleshooting */
   DEBUG: "haexspace:debug",
   /** Console forwarding from extension iframe */
-  CONSOLE_FORWARD: "console.forward"
+  CONSOLE_FORWARD: "console.forward",
+  /**
+   * Sent from main window to iframe on the shared window listener, carrying
+   * one `MessagePort` in `event.ports[0]`. Once received, the SDK switches
+   * to port-based messaging and never reads the window listener again.
+   *
+   * Payload: `{ type: PORT_INIT }` — no data. The port itself is the payload.
+   */
+  PORT_INIT: "haexspace:port:init",
+  /**
+   * Sent from SDK to main window *over the MessagePort* after the port is
+   * installed. Main uses this to mark the iframe as ready and flush any
+   * events buffered during the handshake window. Only valid on the port —
+   * a READY sent over window.postMessage is ignored.
+   *
+   * Payload: `{ type: PORT_READY }` — no data.
+   */
+  PORT_READY: "haexspace:port:ready"
 };
 
 // src/polyfills/debug.ts
@@ -1094,7 +1111,7 @@ var DatabaseAPI = class {
   }
   async transaction(statements) {
     await this.client.request(DATABASE_COMMANDS.transaction, {
-      statements
+      statements: statements.map((s) => [s.sql, s.params || []])
     });
   }
   async createTable(tableName, columns) {
@@ -2072,6 +2089,7 @@ function parseTableName(fullTableName) {
 }
 
 // src/client/init.ts
+var PORT_HANDSHAKE_TIMEOUT_MS = 1e4;
 function isInIframe() {
   return window.self !== window.top;
 }
@@ -2328,11 +2346,14 @@ async function initIframeMode(ctx, log, messageHandler, request) {
   if (!isInIframe()) {
     throw new HaexVaultSdkError("NOT_IN_IFRAME" /* NOT_IN_IFRAME */, "errors.not_in_iframe");
   }
+  const port = await waitForHostPortAsync(log);
   ctx.handlers.messageHandler = messageHandler;
-  window.addEventListener("message", messageHandler);
+  port.addEventListener("message", messageHandler);
+  port.start();
+  port.postMessage({ type: HAEXSPACE_MESSAGE_TYPES.PORT_READY });
   ctx.state.isNativeWindow = false;
   ctx.state.initialized = true;
-  log("HaexVault SDK initialized in iframe mode");
+  log("HaexVault SDK initialized in iframe mode (MessagePort transport)");
   if (ctx.config.manifest) {
     ctx.state.extensionInfo = {
       publicKey: ctx.config.manifest.publicKey,
@@ -2346,7 +2367,42 @@ async function initIframeMode(ctx, log, messageHandler, request) {
   const context = await request(EXTENSION_COMMANDS.getContext);
   ctx.state.context = context;
   log("Application context received:", context);
-  return { context };
+  return { context, port };
+}
+function waitForHostPortAsync(log) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const cleanup = () => {
+      window.removeEventListener("message", handler);
+    };
+    const timeoutId = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(
+        new HaexVaultSdkError(
+          "TIMEOUT" /* TIMEOUT */,
+          "errors.port_handshake_timeout",
+          { timeout: PORT_HANDSHAKE_TIMEOUT_MS }
+        )
+      );
+    }, PORT_HANDSHAKE_TIMEOUT_MS);
+    const handler = (event) => {
+      const type = event.data?.type;
+      if (type !== HAEXSPACE_MESSAGE_TYPES.PORT_INIT) return;
+      const port = event.ports[0];
+      if (!port) {
+        log("PORT_INIT received but event.ports is empty \u2014 ignoring");
+        return;
+      }
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutId);
+      cleanup();
+      resolve(port);
+    };
+    window.addEventListener("message", handler);
+  });
 }
 function sendDebugInfo(config) {
   if (!config.debug) return;
@@ -2370,7 +2426,15 @@ postMessage error: ${e}`);
 function generateRequestId(counter) {
   return `req_${counter}`;
 }
-function sendPostMessage(method, params, requestId, config, extensionInfo, pendingRequests) {
+function sendPostMessage(method, params, requestId, config, extensionInfo, pendingRequests, port) {
+  if (!port) {
+    return Promise.reject(
+      new HaexVaultSdkError(
+        "EXTENSION_NOT_INITIALIZED" /* EXTENSION_NOT_INITIALIZED */,
+        "errors.port_not_connected"
+      )
+    );
+  }
   const request = {
     method,
     params,
@@ -2386,17 +2450,16 @@ function sendPostMessage(method, params, requestId, config, extensionInfo, pendi
       );
     }, config.timeout);
     pendingRequests.set(requestId, { resolve, reject, timeout });
-    const targetOrigin = "*";
     if (config.debug) {
       console.log("[SDK Debug] ========== Sending Request ==========");
       console.log("[SDK Debug] Request ID:", requestId);
       console.log("[SDK Debug] Method:", request.method);
       console.log("[SDK Debug] Params:", request.params);
-      console.log("[SDK Debug] Target origin:", targetOrigin);
+      console.log("[SDK Debug] Transport: MessagePort");
       console.log("[SDK Debug] Extension info:", extensionInfo);
       console.log("[SDK Debug] ========================================");
     }
-    window.parent.postMessage({ id: requestId, ...request }, targetOrigin);
+    port.postMessage({ id: requestId, ...request });
   });
 }
 async function sendInvoke(method, params, config, _log) {
@@ -2415,11 +2478,6 @@ function createMessageHandler(config, pendingRequests, extensionInfo, onEvent) {
   return (event) => {
     if (config.debug) {
       console.log("[SDK Debug] ========== Message Received ==========");
-      console.log("[SDK Debug] Event origin:", event.origin);
-      console.log(
-        "[SDK Debug] Event source:",
-        event.source === window.parent ? "parent window" : "unknown"
-      );
       console.log("[SDK Debug] Event data:", event.data);
       console.log("[SDK Debug] Extension info loaded:", !!extensionInfo());
       console.log(
@@ -2427,12 +2485,6 @@ function createMessageHandler(config, pendingRequests, extensionInfo, onEvent) {
         pendingRequests.size
       );
     }
-    if (event.source !== window.parent) {
-      if (config.debug) {
-        console.error("[SDK Debug] \u274C REJECTED: Message not from parent window!");
-      }
-      return;
-    }
     const data = event.data;
     if ("id" in data && pendingRequests.has(data.id)) {
       if (config.debug) {
@@ -2654,6 +2706,13 @@ var HaexVaultSdk = class {
     this.reactiveSubscribers = /* @__PURE__ */ new Set();
     // Handlers
     this.messageHandler = null;
+    /**
+     * MessagePort obtained from the main window during iframe-mode handshake.
+     * `null` until `initIframe()` completes successfully. Every outbound
+     * request in iframe mode flows through this port; `sendPostMessage` rejects
+     * if called before the handshake finishes.
+     */
+    this.hostPort = null;
     this.setupPromise = null;
     this.setupHook = null;
     // Public APIs
@@ -2827,7 +2886,15 @@ var HaexVaultSdk = class {
       return sendInvoke(method, paramsWithCredentials, this.config, this.log.bind(this));
     }
     const requestId = generateRequestId(++this.requestCounter);
-    return sendPostMessage(method, resolvedParams, requestId, this.config, this._extensionInfo, this.pendingRequests);
+    return sendPostMessage(
+      method,
+      resolvedParams,
+      requestId,
+      this.config,
+      this._extensionInfo,
+      this.pendingRequests,
+      this.hostPort
+    );
   }
   // ==========================================================================
   // Private: Initialization
@@ -2894,7 +2961,7 @@ var HaexVaultSdk = class {
       () => this._extensionInfo,
       this.handleEvent.bind(this)
     );
-    const { context } = await initIframeMode(
+    const { context, port } = await initIframeMode(
       {
         config: this.config,
         state: {
@@ -2926,6 +2993,7 @@ var HaexVaultSdk = class {
       this.messageHandler,
       this.request.bind(this)
     );
+    this.hostPort = port;
     if (this.config.manifest) {
       this._extensionInfo = {
         publicKey: this.config.manifest.publicKey,