@lympid/embed 0.0.0-stage → 1.0.0-rc.2

package/dist/cjs/types.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Public type contracts for `@lympid/embed`.
+ *
+ * Six flows as of this writing: `connect`/`sign-in` and `kyc` (Phase 1),
+ * `register` (in-widget account creation, a per-partner opt-in), and
+ * `invest`/`deposit`/`withdraw` (the embed financial flows plan, also
+ * per-partner opt-in gates via `PartnerEmbedFlow`). Two login models
+ * selected per partner on the Lympid side (`connected` and
+ * `lympid-code` — see `apps/partner-api/src/modules/embed-sessions/`),
+ * and the `getSessionCode` callback that lets a `connected` partner's
+ * session never visibly expire.
+ *
+ * Known gap: PRIIPs KID delivery for `invest` does not exist yet (see
+ * `docs/COMPLIANCE-BACKLOG.md`) — this is a deliberately tracked
+ * compliance gap, not an engineering oversight, and does not block this
+ * flag's existence or rollout.
+ */
+/**
+ * Widget flows.
+ *
+ * - `register` opens the in-widget account-creation flow — a one-time
+ *   confirm screen for the `connected` model (when `getSessionCode`'s
+ *   underlying handoff resolves to a not-yet-existing user) or a full
+ *   self-serve form for the `lympid-code` model.
+ * - `invest` opens the in-widget investment flow: the appropriateness
+ *   assessment (if none valid exists), the WARN/BLOCK consent gate (if
+ *   applicable), a step-up OTP confirmation, then the SEPA investment
+ *   itself.
+ * - `deposit` opens a simple SEPA deposit flow: amount entry, then
+ *   bank transfer instructions to display.
+ * - `withdraw` opens the SEPA withdrawal flow: amount, destination
+ *   IBAN, a step-up OTP confirmation, then submission.
+ */
+export type EmbedFlow = 'connect' | 'sign-in' | 'kyc' | 'register' | 'invest' | 'deposit' | 'withdraw';
+/**
+ * A structured lifecycle event the widget (the iframe content, i.e. the
+ * whitelabel app running in embed mode) reports back to the host page.
+ *
+ * `type` documents the known events for editor autocomplete, but
+ * intentionally also accepts any other string so the widget can
+ * introduce new event types without a synchronized SDK release — the
+ * host page should treat an unrecognised `type` as a no-op, not an
+ * error.
+ */
+export interface LympidEmbedEvent {
+    type: 'ready' | 'connected' | 'signed-in' | 'kyc-submitted' | 'kyc-approved' | 'kyc-rejected' | 'registered' | 'session-code-error' | 'session-expired' | 'invested' | 'invest-error' | 'deposit-pending' | 'deposit-settled' | 'deposit-error' | 'withdrawal-submitted' | 'withdrawal-settled' | 'withdrawal-error' | 'closed' | (string & Record<never, never>);
+    /** Event-specific extra fields. Deliberately untyped per-field —
+     * `type` is the only field callers should branch on. */
+    [key: string]: unknown;
+}
+/**
+ * Options passed to `LympidEmbedInstance.open()`.
+ */
+export interface OpenOptions {
+    /** Which flow to open inside the widget modal. */
+    flow: EmbedFlow;
+    /**
+     * Required when this partner's `embedLoginModel` is `connected`
+     * (Phase 1 plan §2). Called by the SDK whenever the widget needs a
+     * fresh session — on first open, and again silently in the
+     * background before the current in-memory access token expires, so
+     * the end user's session never visibly expires.
+     *
+     * Must resolve to a single-use handoff code minted by **the
+     * partner's own server** calling
+     * `POST /api/v1/embed-sessions` (behind `x-api-key` plus the
+     * partner's IP allowlist) — never call that endpoint from the
+     * browser. See
+     * `apps/partner-api/src/modules/embed-sessions/embed-sessions.service.ts`.
+     *
+     * Not required, and never called, when this partner uses the
+     * `lympid-code` model — the widget itself collects the end user's
+     * email/phone and one-time code in that case.
+     *
+     * May throw/reject; the widget surfaces the resulting
+     * `session-code-error` to the end user and keeps the modal open so
+     * they can retry.
+     */
+    getSessionCode?: () => string | Promise<string>;
+    /**
+     * Required when `flow` is `'invest'` — which RWA the investor is
+     * funding. Ignored for every other flow. The widget resolves this
+     * RWA's product category, minimum investment, remaining supply, and
+     * `professionalInvestorsOnly` flag itself; this option only
+     * identifies which one to open.
+     */
+    rwaId?: string;
+    /** Called for every widget lifecycle event (see `LympidEmbedEvent`). */
+    onEvent?: (event: LympidEmbedEvent) => void;
+    /** Called exactly once when the widget modal closes, for any reason
+     * (end user clicked close, the widget itself requested a close after
+     * completing a flow, or `LympidEmbedInstance.close()`/`destroy()` was
+     * called programmatically). */
+    onClose?: () => void;
+}
+/**
+ * Options passed to `init()`.
+ */
+export interface InitOptions {
+    /**
+     * The exact origin (scheme + host + optional port, **no path, no
+     * trailing slash**) of the partner's whitelabel deployment running in
+     * embed mode, e.g. `"https://invest.yourpartnerdomain.com"`.
+     *
+     * This MUST match what the partner-api `embedAllowedOrigins` config
+     * for this partner expects as the `postMessage` counterpart (see
+     * `docs/WHITELABEL-TENANTS.md`, "Lympid Embed" section) — every
+     * message exchanged with the iframe is validated against this exact
+     * origin in both directions.
+     */
+    baseUrl: string;
+    /**
+     * Your Lympid partner id. Required when `open()` is ever called with
+     * `flow: 'register'`; harmless to always pass.
+     *
+     * Before this field existed, the widget had no way to identify which
+     * partner it was serving until *after* a session already existed —
+     * `baseUrl` names a whitelabel deployment, which can serve any
+     * configured partner, and the iframe URL otherwise carried only
+     * `flow`. Registration happens before any session exists, so it needs
+     * this hint. It is exactly that — a hint, not a trust boundary: the
+     * API re-validates it against the widget's actual request origin and
+     * that partner's `embedAllowedOrigins` on every registration call.
+     */
+    partnerId?: string;
+    /**
+     * DOM node the modal overlay is appended to. Defaults to
+     * `document.body`. Mainly useful for scoping the overlay inside a
+     * specific container in tests or unusual page layouts.
+     */
+    container?: HTMLElement;
+}
+/**
+ * The handle returned by `init()`. One instance per `baseUrl`/partner
+ * configuration; call `open()` as many times as needed (each call
+ * replaces any currently-open modal).
+ */
+export interface LympidEmbedInstance {
+    /** Opens the widget modal for the given flow. Closes any
+     * already-open modal from this instance first. */
+    open(options: OpenOptions): void;
+    /** Closes the widget modal, if open, and fires the current
+     * `onClose` callback. No-op if nothing is open. */
+    close(): void;
+    /** Closes the modal (if open) and removes every DOM node and
+     * listener this instance created. Call when the host page is done
+     * with the widget entirely (e.g. unmounting a SPA route). The
+     * instance must not be reused after this. */
+    destroy(): void;
+}

package/dist/cjs/types.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Public type contracts for `@lympid/embed`.
+ *
+ * Six flows as of this writing: `connect`/`sign-in` and `kyc` (Phase 1),
+ * `register` (in-widget account creation, a per-partner opt-in), and
+ * `invest`/`deposit`/`withdraw` (the embed financial flows plan, also
+ * per-partner opt-in gates via `PartnerEmbedFlow`). Two login models
+ * selected per partner on the Lympid side (`connected` and
+ * `lympid-code` — see `apps/partner-api/src/modules/embed-sessions/`),
+ * and the `getSessionCode` callback that lets a `connected` partner's
+ * session never visibly expire.
+ *
+ * Known gap: PRIIPs KID delivery for `invest` does not exist yet (see
+ * `docs/COMPLIANCE-BACKLOG.md`) — this is a deliberately tracked
+ * compliance gap, not an engineering oversight, and does not block this
+ * flag's existence or rollout.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/esm/bridge.js

@@ -0,0 +1,42 @@
+import { HOST_TO_WIDGET_SOURCE, isWidgetToHostMessage, } from './protocol.js';
+/**
+ * @param iframe The widget iframe this bridge talks to.
+ * @param targetOrigin The exact origin the iframe was loaded from
+ *   (derived from `InitOptions.baseUrl`, never inferred from the
+ *   iframe's `src` string, which a compromised/misconfigured iframe
+ *   could have redirected away from).
+ * @param onMessage Called for every well-formed `WidgetToHostMessage`
+ *   received from exactly `targetOrigin`. Messages from any other
+ *   origin, or that don't match the `WidgetToHostMessage` shape, are
+ *   silently dropped.
+ */
+export function createBridge(iframe, targetOrigin, onMessage) {
+    const listener = (domEvent) => {
+        // Origin check FIRST, before touching `data` at all — this is the
+        // entire security boundary of the bridge. A mismatched origin is
+        // dropped unconditionally, regardless of how well-formed the
+        // payload looks.
+        if (domEvent.origin !== targetOrigin) {
+            return;
+        }
+        if (domEvent.source !== iframe.contentWindow) {
+            return;
+        }
+        if (!isWidgetToHostMessage(domEvent.data)) {
+            return;
+        }
+        onMessage(domEvent.data);
+    };
+    window.addEventListener('message', listener);
+    return {
+        send: (message) => {
+            if (!iframe.contentWindow) {
+                return;
+            }
+            iframe.contentWindow.postMessage({ ...message, source: HOST_TO_WIDGET_SOURCE }, targetOrigin);
+        },
+        teardown: () => {
+            window.removeEventListener('message', listener);
+        },
+    };
+}

package/dist/esm/embed.js

@@ -0,0 +1,151 @@
+import { createBridge } from './bridge.js';
+import { createModal } from './modal.js';
+import { HOST_TO_WIDGET_SOURCE } from './protocol.js';
+/** Normalises a configured `baseUrl` into a bare origin string
+ * (`"https://host:port"`, no path/trailing slash) suitable both for
+ * building the iframe `src` and for `postMessage` origin checks. Throws
+ * early — at `init()` time, not at `open()` time — on a malformed URL,
+ * since a bad `baseUrl` is a partner-integration mistake that should
+ * fail loudly immediately rather than silently drop every widget
+ * message later. */
+function normalizeOrigin(baseUrl) {
+    const url = new URL(baseUrl);
+    return url.origin;
+}
+function buildIframeSrc(origin, flow, partnerId, rwaId) {
+    const params = new URLSearchParams({ flow });
+    if (partnerId) {
+        params.set('partnerId', partnerId);
+    }
+    if (rwaId) {
+        params.set('rwaId', rwaId);
+    }
+    return `${origin}/embed?${params.toString()}`;
+}
+/**
+ * Creates a `LympidEmbedInstance` bound to one partner's whitelabel
+ * origin. See `InitOptions`/`OpenOptions` in `./types.ts` for the full
+ * contract, and `apps/whitelabel/src/app/embed/` (whitelabel-embed-mode)
+ * for the counterpart that runs inside the iframe.
+ */
+export function init(options) {
+    const origin = normalizeOrigin(options.baseUrl);
+    const container = options.container ?? document.body;
+    let current = null;
+    let destroyed = false;
+    /** Tears down the currently-open modal/bridge, if any, optionally
+     * firing the `onClose` callback that was passed to the `open()` call
+     * being torn down. */
+    function teardownCurrent(fireOnClose) {
+        if (!current) {
+            return;
+        }
+        const { modal, bridge, onClose } = current;
+        bridge.teardown();
+        modal.remove();
+        current = null;
+        if (fireOnClose && onClose) {
+            onClose();
+        }
+    }
+    function open(openOptions) {
+        if (destroyed) {
+            throw new Error('This LympidEmbedInstance has been destroyed and cannot be reused — call init() again.');
+        }
+        // Replace any already-open modal from this instance first — only
+        // one widget flow can sensibly be open at a time per instance.
+        teardownCurrent(true);
+        const src = buildIframeSrc(origin, openOptions.flow, options.partnerId, openOptions.rwaId);
+        const modal = createModal(container, src, () => teardownCurrent(true));
+        const bridge = createBridge(modal.iframe, origin, (message) => {
+            switch (message.type) {
+                case 'ready': {
+                    bridge.send({
+                        source: HOST_TO_WIDGET_SOURCE,
+                        type: 'init',
+                        flow: openOptions.flow,
+                        hasSessionCodeProvider: !!openOptions.getSessionCode,
+                        partnerId: options.partnerId,
+                        rwaId: openOptions.rwaId,
+                    });
+                    break;
+                }
+                case 'request-session-code': {
+                    void handleSessionCodeRequest(bridge, openOptions, message.requestId);
+                    break;
+                }
+                case 'resize': {
+                    modal.setHeight(message.height);
+                    break;
+                }
+                case 'event': {
+                    openOptions.onEvent?.(message.event);
+                    break;
+                }
+                case 'close': {
+                    teardownCurrent(true);
+                    break;
+                }
+                default:
+                    break;
+            }
+        });
+        current = { modal, bridge, onClose: openOptions.onClose };
+    }
+    function close() {
+        teardownCurrent(true);
+    }
+    function destroy() {
+        teardownCurrent(true);
+        destroyed = true;
+    }
+    return { open, close, destroy };
+}
+/**
+ * Resolves `openOptions.getSessionCode()` (if configured) and relays
+ * the result back to the widget as `session-code`/`session-code-error`.
+ * Extracted so `init()`'s `open()` switch stays a flat dispatch table.
+ *
+ * @param requestId Correlation id the widget attached to its
+ *   `request-session-code` message — echoed back unchanged so the
+ *   widget can match the response to the right in-flight request even
+ *   if several overlap.
+ */
+async function handleSessionCodeRequest(bridge, openOptions, requestId) {
+    const provider = openOptions.getSessionCode;
+    if (!provider) {
+        // The widget asked for a session code on a partner that never
+        // configured `getSessionCode` — this is an integration mistake
+        // (likely a `connected`-model partner whose host page forgot the
+        // callback). Surface it both as an event (for the host page's own
+        // logging/monitoring) and back to the widget (so it can show the
+        // end user a retry/contact-support state instead of hanging).
+        const error = 'getSessionCode was not provided to open()';
+        openOptions.onEvent?.({ type: 'session-code-error', requestId, error });
+        bridge.send({
+            source: HOST_TO_WIDGET_SOURCE,
+            type: 'session-code-error',
+            requestId,
+            error,
+        });
+        return;
+    }
+    try {
+        const code = await provider();
+        bridge.send({
+            source: HOST_TO_WIDGET_SOURCE,
+            type: 'session-code',
+            requestId,
+            code,
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        bridge.send({
+            source: HOST_TO_WIDGET_SOURCE,
+            type: 'session-code-error',
+            requestId,
+            error: errorMessage,
+        });
+    }
+}

package/dist/esm/index.js

@@ -0,0 +1,24 @@
+/**
+ * `@lympid/embed` — public entry point.
+ *
+ * ```ts
+ * import { init } from '@lympid/embed';
+ *
+ * const widget = init({ baseUrl: 'https://invest.yourpartnerdomain.com' });
+ *
+ * widget.open({
+ *   flow: 'connect',
+ *   // Only needed for partners using the "connected" login model —
+ *   // call YOUR OWN backend here, which in turn calls
+ *   // POST /api/v1/embed-sessions with your x-api-key.
+ *   getSessionCode: async () => {
+ *     const res = await fetch('/api/lympid/session-code', { method: 'POST' });
+ *     const { handoffCode } = await res.json();
+ *     return handoffCode;
+ *   },
+ *   onEvent: (event) => console.log('lympid event', event),
+ *   onClose: () => console.log('lympid widget closed'),
+ * });
+ * ```
+ */
+export { init } from './embed.js';

package/dist/esm/modal.js

@@ -0,0 +1,156 @@
+/**
+ * Modal overlay + iframe DOM construction for the widget.
+ *
+ * Deliberately framework-agnostic (no React) and dependency-free — a
+ * handful of inline-styled `div`/`iframe` nodes is simpler, smaller, and
+ * safer than reaching for a UI library inside a script a partner embeds
+ * on their own page (no risk of CSS/class-name collisions with the
+ * partner's own stylesheet).
+ */
+const Z_INDEX = 2147483000; // Comfortably above virtually any host-page UI.
+const DEFAULT_HEIGHT_PX = 600;
+/** Light/dark panel background, matching the whitelabel app's own
+ * `LEDGER_PAPER` surface token (`packages/shared-types/src/
+ * design-tokens.ts`) so the modal's own chrome doesn't flash a white
+ * box around a dark-themed widget. The host page has no visibility
+ * into the iframe's actual in-app theme setting (cross-origin, and the
+ * whitelabel app can toggle independently of OS preference), so this
+ * follows the OS-level `prefers-color-scheme` media query as the best
+ * available signal without a cross-origin theme-sync protocol. */
+const PANEL_BACKGROUND_LIGHT = '#ffffff';
+const PANEL_BACKGROUND_DARK = '#161B22';
+function prefersDarkColorScheme() {
+    return (typeof window !== 'undefined' &&
+        typeof window.matchMedia === 'function' &&
+        window.matchMedia('(prefers-color-scheme: dark)').matches);
+}
+/** Close glyph centered in the 32px button. Path matches
+ * `apps/whitelabel/src/assets/images/svg/24/close.svg`. */
+function createCloseIcon() {
+    const icon = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+    icon.setAttribute('viewBox', '0 0 24 24');
+    icon.setAttribute('width', '20');
+    icon.setAttribute('height', '20');
+    icon.setAttribute('fill', 'none');
+    icon.setAttribute('aria-hidden', 'true');
+    const path = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+    path.setAttribute('d', 'M17 7 7 17M7 7l10 10');
+    path.setAttribute('stroke', 'currentColor');
+    path.setAttribute('stroke-width', '1.3');
+    path.setAttribute('stroke-linecap', 'round');
+    path.setAttribute('stroke-linejoin', 'round');
+    icon.appendChild(path);
+    return icon;
+}
+/**
+ * Builds and appends the backdrop + iframe modal to `container`.
+ *
+ * @param container Parent node to append the overlay to.
+ * @param src The widget iframe's `src` URL (the partner's whitelabel
+ *   origin + `/embed` route + flow query param).
+ * @param onBackdropClick Called when the end user clicks the backdrop
+ *   or the close button — the caller decides whether that closes the
+ *   modal (it always should; kept as a callback so `embed.ts` stays
+ *   the single owner of close/`onClose` semantics).
+ */
+export function createModal(container, src, onBackdropClick) {
+    const overlay = document.createElement('div');
+    overlay.setAttribute('data-lympid-embed', 'overlay');
+    overlay.style.position = 'fixed';
+    overlay.style.inset = '0';
+    overlay.style.zIndex = String(Z_INDEX);
+    overlay.style.display = 'flex';
+    overlay.style.alignItems = 'center';
+    overlay.style.justifyContent = 'center';
+    overlay.style.backgroundColor = 'rgba(15, 23, 42, 0.6)';
+    const panel = document.createElement('div');
+    panel.setAttribute('data-lympid-embed', 'panel');
+    panel.style.position = 'relative';
+    panel.style.width = 'min(420px, calc(100vw - 32px))';
+    panel.style.height = `min(${DEFAULT_HEIGHT_PX}px, calc(100vh - 32px))`;
+    panel.style.maxHeight = 'calc(100vh - 32px)';
+    panel.style.borderRadius = '16px';
+    panel.style.overflow = 'hidden';
+    panel.style.boxShadow = '0 20px 60px rgba(0, 0, 0, 0.35)';
+    panel.style.backgroundColor = prefersDarkColorScheme()
+        ? PANEL_BACKGROUND_DARK
+        : PANEL_BACKGROUND_LIGHT;
+    panel.style.transition = 'height 0.2s ease';
+    // Keep the panel's background in step if the OS-level preference
+    // changes while the modal is open (e.g. a scheduled light/dark
+    // switch, or the user flips it in their OS settings mid-session).
+    let colorSchemeMedia = null;
+    let handleColorSchemeChange = null;
+    if (typeof window !== 'undefined' && typeof window.matchMedia === 'function') {
+        colorSchemeMedia = window.matchMedia('(prefers-color-scheme: dark)');
+        handleColorSchemeChange = (event) => {
+            panel.style.backgroundColor = event.matches
+                ? PANEL_BACKGROUND_DARK
+                : PANEL_BACKGROUND_LIGHT;
+        };
+        colorSchemeMedia.addEventListener('change', handleColorSchemeChange);
+    }
+    const closeButton = document.createElement('button');
+    closeButton.setAttribute('data-lympid-embed', 'close');
+    closeButton.setAttribute('aria-label', 'Close');
+    closeButton.type = 'button';
+    closeButton.style.position = 'absolute';
+    closeButton.style.top = '8px';
+    closeButton.style.right = '8px';
+    closeButton.style.zIndex = String(Z_INDEX + 1);
+    closeButton.style.display = 'flex';
+    closeButton.style.alignItems = 'center';
+    closeButton.style.justifyContent = 'center';
+    closeButton.style.width = '32px';
+    closeButton.style.height = '32px';
+    closeButton.style.margin = '0';
+    closeButton.style.padding = '0';
+    closeButton.style.border = 'none';
+    closeButton.style.borderRadius = '50%';
+    closeButton.style.backgroundColor = 'rgba(15, 23, 42, 0.06)';
+    closeButton.style.color = '#585858';
+    closeButton.style.cursor = 'pointer';
+    closeButton.style.appearance = 'none';
+    closeButton.style.setProperty('-webkit-appearance', 'none');
+    // Same stroke as the whitelabel `Icon` named `close`
+    // (`src/assets/images/svg/24/close.svg`), which every other modal
+    // uses. A text "×" sits on the font baseline, so it looks high, and
+    // a host `button { padding }` rule shifts it further. Flex + a reset
+    // padding keeps the glyph centered on the partner page.
+    closeButton.appendChild(createCloseIcon());
+    const iframe = document.createElement('iframe');
+    iframe.setAttribute('data-lympid-embed', 'iframe');
+    iframe.src = src;
+    iframe.style.width = '100%';
+    iframe.style.height = '100%';
+    iframe.style.border = 'none';
+    iframe.title = 'Lympid';
+    // Phase 1 flows (connect/sign-in, KYC) need neither top-level
+    // navigation nor same-origin escalation beyond what the whitelabel
+    // app itself needs to run (forms, scripts, camera for KYC).
+    iframe.setAttribute('allow', 'camera; microphone; clipboard-write');
+    iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms allow-popups');
+    closeButton.addEventListener('click', onBackdropClick);
+    overlay.addEventListener('click', (domEvent) => {
+        if (domEvent.target === overlay) {
+            onBackdropClick();
+        }
+    });
+    panel.appendChild(closeButton);
+    panel.appendChild(iframe);
+    overlay.appendChild(panel);
+    container.appendChild(overlay);
+    return {
+        iframe,
+        setHeight: (height) => {
+            const clamped = Math.max(240, Math.min(height, (typeof window !== 'undefined' ? window.innerHeight : height) - 32));
+            panel.style.height = `${clamped}px`;
+        },
+        remove: () => {
+            if (colorSchemeMedia && handleColorSchemeChange) {
+                colorSchemeMedia.removeEventListener('change', handleColorSchemeChange);
+            }
+            overlay.remove();
+        },
+    };
+}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/protocol.js

@@ -0,0 +1,26 @@
+/**
+ * `postMessage` wire protocol between the host page (this SDK) and the
+ * widget iframe (the whitelabel app running in embed mode — see
+ * `whitelabel-embed-mode` in the Phase 1 plan).
+ *
+ * Both directions are only ever accepted/sent against the exact origin
+ * configured via `InitOptions.baseUrl` — see `createBridge()` in
+ * `./bridge.ts`. This file only defines the message *shapes*; it has
+ * zero DOM/`window` dependencies so it can be unit-tested directly.
+ */
+/** Discriminator so a `postMessage` listener can cheaply ignore every
+ * unrelated message landing on the same `window` (browser extensions,
+ * other SDKs, etc.) before even checking the origin. */
+export const HOST_TO_WIDGET_SOURCE = 'lympid-embed-host';
+export const WIDGET_TO_HOST_SOURCE = 'lympid-embed-widget';
+/** Narrows an arbitrary `MessageEvent.data` payload to a
+ * `WidgetToHostMessage`, without throwing on malformed input — a
+ * `postMessage` listener must never crash the host page just because
+ * some unrelated script on the same window posted something shaped
+ * differently. */
+export function isWidgetToHostMessage(data) {
+    return (typeof data === 'object' &&
+        data !== null &&
+        data.source === WIDGET_TO_HOST_SOURCE &&
+        typeof data.type === 'string');
+}

package/dist/esm/types.js

@@ -0,0 +1,18 @@
+/**
+ * Public type contracts for `@lympid/embed`.
+ *
+ * Six flows as of this writing: `connect`/`sign-in` and `kyc` (Phase 1),
+ * `register` (in-widget account creation, a per-partner opt-in), and
+ * `invest`/`deposit`/`withdraw` (the embed financial flows plan, also
+ * per-partner opt-in gates via `PartnerEmbedFlow`). Two login models
+ * selected per partner on the Lympid side (`connected` and
+ * `lympid-code` — see `apps/partner-api/src/modules/embed-sessions/`),
+ * and the `getSessionCode` callback that lets a `connected` partner's
+ * session never visibly expire.
+ *
+ * Known gap: PRIIPs KID delivery for `invest` does not exist yet (see
+ * `docs/COMPLIANCE-BACKLOG.md`) — this is a deliberately tracked
+ * compliance gap, not an engineering oversight, and does not block this
+ * flag's existence or rollout.
+ */
+export {};

package/package.json

@@ -1,6 +1,61 @@
 {
   "name": "@lympid/embed",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0-rc.2",
+  "description": "Lympid Embed widget SDK — init/open/close/destroy for the Lympid-hosted modal iframe (connect/sign-in, KYC, and in-widget registration flows). apps/partner-api's embed login models (connected, lympid-code) plus apps/whitelabel's embed mode are the server/widget-content counterparts to this client-side script.",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xLympid/lympid-platform.git",
+    "directory": "packages/embed"
+  },
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/cjs/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/cjs/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": false
+  },
+  "scripts": {
+    "build": "yarn build:cjs && yarn build:esm && yarn build:browser",
+    "build:cjs": "tsc -p tsconfig.json",
+    "build:esm": "tsc -p tsconfig.esm.json && node scripts/fix-esm-extensions.mjs && node scripts/write-esm-package-json.mjs",
+    "build:browser": "node scripts/build-browser.mjs",
+    "verify:bundle": "node scripts/assert-no-leaks.mjs",
+    "prepublishOnly": "yarn clean && yarn build && yarn verify:bundle",
+    "type:check": "tsc --noEmit",
+    "lint": "eslint \"src/**/*.ts\"",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "clean": "rm -rf dist coverage"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@types/jest": "^30.0.0",
+    "esbuild": "^0.28.2",
+    "eslint": "^9.8.0",
+    "globals": "^16.0.0",
+    "jest": "^30.3.0",
+    "jest-environment-jsdom": "^30.3.0",
+    "semantic-release-monorepo": "^8.0.2",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.57.2"
+  }
+}