@machinemetrics/mm-react-embeddable 1.4.0-3 → 1.4.0-5

package/dist/mm-react-embeddable.es.js

@@ -1,214 +1,307 @@
-import f, { createContext as J, useContext as _, useState as I, useRef as x, useCallback as h, useEffect as g, useMemo as Y } from "react";
-import w from "prop-types";
-import Z from "styled-components";
-const H = J(null), D = J({
+import h, { createContext as oe, useContext as H, useState as C, useRef as R, useCallback as m, useEffect as k, useMemo as ue } from "react";
+import T from "prop-types";
+import D from "styled-components";
+const Y = oe(null), J = oe({
   pending: [],
   authorize: () => {
   },
+  approve: () => {
+  },
+  complete: () => {
+  },
   dismiss: () => {
   },
   originEpochs: {},
   credentials: {},
   unsupported: {}
-}), N = 2e4, j = (n) => {
+}), le = "access_token", te = (r) => r ? r.kind ? r : r.accessToken ? {
+  kind: le,
+  accessToken: r.accessToken,
+  expiresAt: r.expiresAt || null
+} : null : null, ae = /* @__PURE__ */ new Set(["host_not_allowed", "invalid_token", "provider_unavailable"]), X = typeof window != "undefined" && window.location.protocol === "https:", de = 8e3, Q = (r) => {
   try {
-    return new URL(n).origin;
+    return new URL(r).origin;
   } catch {
     return null;
   }
-}, V = (n) => {
-  if (!n || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(n) || n.includes(":"))
-    return n;
-  const o = n.split(".");
-  return o.length <= 2 ? n : o.slice(-2).join(".");
-}, ee = (n, o) => {
+}, ne = (r, i) => {
+  const c = i == null ? void 0 : i.origin;
+  return !c || Q(r == null ? void 0 : r.authUrl) !== c ? null : c;
+}, re = (r) => {
+  if (!r || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(r) || r.includes(":"))
+    return r;
+  const i = r.split(".");
+  return i.length <= 2 ? r : i.slice(-2).join(".");
+}, fe = (r, i) => {
   try {
-    const s = new URL(n), a = new URL(o);
-    return s.protocol !== a.protocol ? !0 : V(s.hostname) !== V(a.hostname);
+    const c = new URL(r), d = new URL(i);
+    return c.protocol !== d.protocol ? !0 : re(c.hostname) !== re(d.hostname);
   } catch {
     return !0;
   }
-}, te = (n, { onBlocked: o, onClosed: s }) => {
-  const a = window.open(
-    n.authUrl,
+}, pe = (r, { onBlocked: i, onClosed: c }) => {
+  const d = window.open(
+    r.authUrl,
     "mm-embed-auth",
     "popup,width=600,height=700"
   );
-  if (!a)
-    return o(), () => {
+  if (!d)
+    return i(), () => {
     };
-  const m = setInterval(() => {
-    a.closed && (clearInterval(m), s());
+  const g = setInterval(() => {
+    d.closed && (clearInterval(g), c());
   }, 1e3);
-  return () => clearInterval(m);
-}, Q = ({ children: n, launcher: o }) => {
-  const s = _(H), [a, m] = I({}), [R, T] = I({}), [k, L] = I({}), [q, y] = I({}), F = x(k);
-  F.current = k;
-  const b = x(null), U = x({}), P = x({}), z = h((e) => {
-    const t = P.current[e];
+  return () => clearInterval(g);
+}, ie = ({ children: r, launcher: i, broker: c }) => {
+  const d = H(Y), [g, w] = C({}), [P, U] = C({}), [z, M] = C({}), [L, A] = C({}), q = R(z);
+  q.current = z;
+  const f = R(null), v = R({}), $ = R({}), B = R({}), y = R(c);
+  y.current = c;
+  const O = m((e) => {
+    const t = $.current[e];
     if (!t)
       return;
-    const r = (d) => !d[e] || d[e].clientId ? d : { ...d, [e]: { ...d[e], clientId: t } };
-    m(r), y(r);
-  }, []), A = h(
+    const n = (l) => !l[e] || l[e].clientId ? l : { ...l, [e]: { ...l[e], clientId: t } };
+    w(n), A(n);
+  }, []), j = m(
     (e, t) => {
-      const r = j(e == null ? void 0 : e.authUrl);
-      r && (y((d) => d[r] ? d : {
-        ...d,
-        [r]: { origin: r, reason: t, clientId: P.current[r] || null }
-      }), z(r));
+      e && (A((n) => n[e] ? n : {
+        ...n,
+        [e]: { origin: e, reason: t, clientId: $.current[e] || null }
+      }), O(e));
     },
-    [z]
-  ), O = h(
-    (e, { v2: t = !1 } = {}) => {
-      const r = j(e == null ? void 0 : e.authUrl);
-      r && (t && F.current[r] || (m((d) => d[r] ? d : {
-        ...d,
-        [r]: {
-          origin: r,
+    [O]
+  ), s = m(
+    (e, { v2: t = !1, origin: n = null } = {}) => {
+      n && (t && q.current[n] || (w((l) => l[n] ? l : {
+        ...l,
+        [n]: {
+          origin: n,
           authUrl: e.authUrl,
           silentUrl: e.silentUrl || null,
-          // v2 entries try the invisible silent resolver first; legacy
-          // signals go straight to the host's interactive UI.
-          status: t && e.silentUrl ? "silent" : "interactive",
+          // v2 entries try the invisible silent resolver first — but only on a host that can
+          // frame login (https). Otherwise (and for legacy signals) go straight to interactive,
+          // so an http host doesn't wait out a silent frame that can never load login.
+          status: t && y.current ? "broker" : t && e.silentUrl && X ? "silent" : "interactive",
           v2: t,
+          // v1.9: the scope the guest asked for; forwarded verbatim to the broker.
+          scope: e.scope || null,
+          acceptsCredentials: B.current[n] || null,
+          consent: null,
+          error: null,
           // clientId from the request payload (v2) or the cached init (legacy);
           // the host resolves the display name from it.
-          clientId: e.clientId || P.current[r] || null,
+          clientId: e.clientId || $.current[n] || null,
           popupBlocked: !1
         }
-      }), z(r)));
+      }), O(n)));
     },
-    [z]
-  ), C = h((e) => {
-    m((t) => {
+    [O]
+  ), u = m((e) => {
+    w((t) => {
       if (!t[e])
         return t;
-      const r = { ...t };
-      return delete r[e], r;
+      const n = { ...t };
+      return delete n[e], n;
     });
-  }, []), i = h(
+  }, []), o = m(
     (e) => {
-      e && (C(e), T((t) => ({
+      e && (u(e), U((t) => ({
         ...t,
         [e]: (t[e] || 0) + 1
       })));
     },
-    [C]
-  ), u = h((e) => {
-    m((t) => !t[e] || t[e].status === "interactive" ? t : {
+    [u]
+  ), a = m((e) => {
+    w((t) => !t[e] || t[e].status === "interactive" ? t : {
       ...t,
       [e]: { ...t[e], status: "interactive" }
     });
-  }, []), c = h(
+  }, []), b = m(
     (e) => {
-      C(e.origin);
+      u(e.origin);
     },
-    [C]
-  ), l = h(
-    (e) => {
-      const t = j(e == null ? void 0 : e.authUrl);
-      if (t && ee(t, window.location.origin)) {
-        A(e, "cross-site-legacy");
-        return;
+    [u]
+  ), E = m(
+    (e, t) => {
+      const n = ne(e, t);
+      if (n) {
+        if (fe(n, window.location.origin)) {
+          j(n, "cross-site-legacy");
+          return;
+        }
+        s(e, { origin: n });
       }
-      O(e);
     },
-    [O, A]
+    [s, j]
   );
-  g(() => {
-    if (!s)
+  k(() => {
+    if (!d)
       return;
     const e = [
-      // `init` carries the app's OAuth clientId. Cache it by app origin and
-      // attach it to any entry already showing. `init` is posted before the
-      // authorize/login/credential-request signals, so it is usually cached by
-      // the time an entry is created. The host resolves the display name from
-      // the clientId.
-      s.addListener("*", "init", (t) => {
-        t != null && t.origin && t.clientId && (P.current[t.origin] = t.clientId, z(t.origin));
+      // `init` carries the app's OAuth clientId. Cache it by the ATTESTED app
+      // origin (payload `origin` is ignored) and attach it to any entry already
+      // showing. `init` is posted before the authorize/login/credential-request
+      // signals, so it is usually cached by the time an entry is created. The
+      // clientId is only a lookup key: the host resolves the display name from
+      // it, and a broker binds it to the attested origin server-side.
+      d.addListener("*", "init", (t, n) => {
+        n != null && n.origin && (t != null && t.clientId) && ($.current[n.origin] = t.clientId, O(n.origin)), n != null && n.origin && Array.isArray(t == null ? void 0 : t.acceptsCredentials) && (B.current[n.origin] = t.acceptsCredentials);
       }),
-      s.addListener("*", "authorize", l),
-      s.addListener("*", "login", l),
-      s.addListener(
+      d.addListener("*", "authorize", E),
+      d.addListener("*", "login", E),
+      d.addListener(
         "*",
         "credential-request",
-        (t) => O(t, { v2: !0 })
-      ),
-      s.addListener("*", "authorized", (t) => {
-        t != null && t.accessToken || i(j(t == null ? void 0 : t.authUrl));
-      })
+        (t, n) => s(t, { v2: !0, origin: ne(t, n) })
+      )
     ];
     return () => e.forEach((t) => t());
-  }, [s, l, O, i, z]), g(() => {
+  }, [d, E, s, O]), k(() => {
     const e = (t) => {
-      const r = t == null ? void 0 : t.data;
-      if (!r || r.type !== "authorized" && r.type !== "authorize-failed")
+      const n = t == null ? void 0 : t.data;
+      if (!n || n.type !== "authorized" && n.type !== "authorize-failed")
         return;
-      const d = j(r.authUrl);
-      if (!(!d || t.origin !== d)) {
-        if (r.type === "authorized" && r.accessToken) {
-          L((M) => ({
-            ...M,
-            [d]: { accessToken: r.accessToken }
-          })), C(d);
+      const l = Q(n.authUrl);
+      if (!(!l || t.origin !== l)) {
+        if (n.type === "authorized") {
+          n.accessToken ? (M((p) => ({
+            ...p,
+            [l]: te({ accessToken: n.accessToken })
+          })), u(l)) : o(l);
           return;
         }
-        r.type === "authorize-failed" && u(d);
+        a(l);
       }
     };
     return window.addEventListener("message", e), () => window.removeEventListener("message", e);
-  }, [C, u]), g(() => {
-    const e = U.current;
-    Object.values(a).forEach((t) => {
+  }, [u, o, a]);
+  const _ = m(
+    (e, t) => {
+      const n = e == null ? void 0 : e.origin, l = te(t);
+      !n || !l || (M((p) => ({ ...p, [n]: l })), u(n));
+    },
+    [u]
+  ), x = m((e, t) => {
+    w((n) => n[e] ? { ...n, [e]: { ...n[e], ...t } } : n);
+  }, []), I = m(
+    async (e, { approve: t } = {}) => {
+      const n = y.current, { origin: l } = e;
+      let p;
+      try {
+        p = await n(
+          { origin: l, clientId: e.clientId, scope: e.scope, authUrl: e.authUrl },
+          { approve: t }
+        );
+      } catch {
+        t ? x(l, { error: { reason: "broker_unavailable" } }) : x(l, {
+          status: e.silentUrl && X ? "silent" : "interactive"
+        });
+        return;
+      }
+      if ((p == null ? void 0 : p.status) === 200 && p.credential) {
+        _(e, p.credential);
+        return;
+      }
+      if ((p == null ? void 0 : p.status) === 409 && p.consentRequired) {
+        x(l, {
+          status: "interactive",
+          consent: {
+            client: p.client || null,
+            stepUp: !!p.stepUp,
+            scope: p.scope || e.scope
+          },
+          error: null
+        });
+        return;
+      }
+      const G = (p == null ? void 0 : p.error) || "broker_error";
+      if (!t && ae.has(G)) {
+        x(l, {
+          status: e.silentUrl && X ? "silent" : "interactive"
+        });
+        return;
+      }
+      if (t && G === "consent_denied") {
+        x(l, { error: null });
+        return;
+      }
+      u(l), A((ee) => ({
+        ...ee,
+        [l]: {
+          origin: l,
+          reason: `broker:${G}`,
+          detail: p || null,
+          clientId: e.clientId || $.current[l] || null
+        }
+      }));
+    },
+    [_, x, u]
+  ), F = R({});
+  k(() => {
+    Object.values(g).forEach((e) => {
+      e.status !== "broker" || F.current[e.origin] || (F.current[e.origin] = !0, I(e).finally(() => {
+        delete F.current[e.origin];
+      }));
+    });
+  }, [g, I]);
+  const W = m(
+    (e) => !y.current || !(e != null && e.consent) ? Promise.resolve() : I(e, { approve: !0 }),
+    [I]
+  );
+  k(() => {
+    const e = v.current;
+    Object.values(g).forEach((t) => {
       t.status === "silent" && !e[t.origin] && (e[t.origin] = setTimeout(() => {
-        delete e[t.origin], u(t.origin);
-      }, N));
+        delete e[t.origin], a(t.origin);
+      }, de));
     }), Object.keys(e).forEach((t) => {
-      (!a[t] || a[t].status !== "silent") && (clearTimeout(e[t]), delete e[t]);
+      (!g[t] || g[t].status !== "silent") && (clearTimeout(e[t]), delete e[t]);
     });
-  }, [a, u]), g(() => () => {
-    b.current && b.current(), Object.values(U.current).forEach(clearTimeout);
+  }, [g, a]), k(() => () => {
+    f.current && f.current(), Object.values(v.current).forEach(clearTimeout);
   }, []);
-  const E = h(
+  const S = m(
     (e) => {
-      b.current && (b.current(), b.current = null);
-      const t = o || te;
-      b.current = t(e, {
+      f.current && (f.current(), f.current = null);
+      const t = i || pe;
+      f.current = t(e, {
         onBlocked: () => {
-          m((r) => r[e.origin] ? {
-            ...r,
-            [e.origin]: { ...r[e.origin], popupBlocked: !0 }
-          } : r);
+          w((n) => n[e.origin] ? {
+            ...n,
+            [e.origin]: { ...n[e.origin], popupBlocked: !0 }
+          } : n);
         },
         onClosed: () => {
           if (e.v2) {
-            m((r) => !r[e.origin] || !r[e.origin].silentUrl ? r : {
-              ...r,
-              [e.origin]: { ...r[e.origin], status: "silent" }
+            X && w((n) => !n[e.origin] || !n[e.origin].silentUrl ? n : {
+              ...n,
+              [e.origin]: { ...n[e.origin], status: "silent" }
             });
             return;
           }
-          i(e.origin);
+          o(e.origin);
         }
       });
     },
-    [o, i]
-  ), p = {
+    [i, o]
+  ), Z = {
     // Hosts render UI for interactive entries only; silent resolution is
     // invisible by design.
-    pending: Object.values(a).filter(
+    pending: Object.values(g).filter(
       (e) => e.status === "interactive"
     ),
-    authorize: E,
-    dismiss: c,
-    originEpochs: R,
-    credentials: k,
-    unsupported: q
-  }, $ = Object.values(a).filter(
+    authorize: S,
+    approve: W,
+    complete: _,
+    dismiss: b,
+    originEpochs: P,
+    credentials: z,
+    unsupported: L
+  }, K = Object.values(g).filter(
     (e) => e.status === "silent" && e.silentUrl
   );
-  return /* @__PURE__ */ f.createElement(D.Provider, { value: p }, n, $.map((e) => /* @__PURE__ */ f.createElement(
+  return /* @__PURE__ */ h.createElement(J.Provider, { value: Z }, r, K.map((e) => /* @__PURE__ */ h.createElement(
     "iframe",
     {
       key: `mm-silent-auth-${e.origin}`,
@@ -220,159 +313,177 @@ const H = J(null), D = J({
     }
   )));
 };
-Q.propTypes = {
-  children: w.node,
-  launcher: w.func
+ie.propTypes = {
+  children: T.node,
+  launcher: T.func,
+  /**
+   * `async (request, { approve }) => result` where request =
+   * `{ origin, clientId, scope, authUrl }` (origin is the zone-attested frame origin) and result
+   * mirrors the authorization server's broker response: `{ status: 200, credential, scope,
+   * client }`, `{ status: 409, consentRequired: true, client: { name, hostname }, stepUp }`, or
+   * `{ status, error }`. Provided only by hosts that are themselves first-party clients.
+   */
+  broker: T.func
 };
-const ne = () => _(D), re = (n) => {
-  const { originEpochs: o } = _(D), s = j(n);
-  return s && o[s] || 0;
-}, se = (n) => {
-  const { credentials: o } = _(D), s = j(n);
-  return s && o[s] || null;
-}, ie = (n) => {
-  const { unsupported: o } = _(D), s = j(n);
-  return s && o[s] || null;
-}, oe = ({ children: n, authorizationLauncher: o }) => {
-  const [s, a] = I({}), [m, R] = I({}), T = x({}), k = x({}), L = x({}), q = h((i, u) => {
-    var c;
-    return !!((c = L.current[i]) != null && c.has(u));
-  }, []), y = h((i, u, c) => {
-    a((l) => ({ ...l, [i]: { origin: u, frameRef: c } }));
-  }, []), F = h((i) => {
-    a((u) => {
-      const c = { ...u };
-      return delete c[i], c;
-    }), R((u) => {
-      const c = { ...u };
-      return delete c[i], c;
-    }), delete L.current[i];
+const ge = () => H(J), me = (r) => {
+  const { originEpochs: i } = H(J), c = Q(r);
+  return c && i[c] || 0;
+}, he = (r) => {
+  const { credentials: i } = H(J), c = Q(r);
+  return c && i[c] || null;
+}, be = (r) => {
+  const { unsupported: i } = H(J), c = Q(r);
+  return c && i[c] || null;
+}, Ee = ({ children: r, authorizationLauncher: i, credentialBroker: c }) => {
+  const [d, g] = C({}), [w, P] = C({}), U = R({}), z = R({}), M = R({}), L = m((s, u) => {
+    var o;
+    return !!((o = M.current[s]) != null && o.has(u));
+  }, []), A = m((s, u, o) => {
+    g((a) => ({ ...a, [s]: { origin: u, frameRef: o } }));
+  }, []), q = m((s) => {
+    g((u) => {
+      const o = { ...u };
+      return delete o[s], o;
+    }), P((u) => {
+      const o = { ...u };
+      return delete o[s], o;
+    }), delete M.current[s];
   }, []);
-  g(() => {
-    const i = (c = [], l) => {
-      c.forEach((E) => E(l));
-    }, u = (c) => {
-      var $, e, t, r, d;
-      if (!(($ = c == null ? void 0 : c.data) != null && $.instanceId))
+  k(() => {
+    const s = (o = [], a, b) => {
+      o.forEach((E) => E(a, b));
+    }, u = (o) => {
+      var F, W, S, Z, K, e, t;
+      if (!((F = o == null ? void 0 : o.data) != null && F.instanceId))
+        return;
+      const { instanceId: a, type: b } = o.data, E = d[a], _ = (S = (W = E == null ? void 0 : E.frameRef) == null ? void 0 : W.current) == null ? void 0 : S.contentWindow;
+      if (!_ || o.source !== _ || o.origin !== E.origin)
         return;
-      const { instanceId: l, type: E } = c.data, p = T.current;
-      if (E === "response") {
-        const { callbackId: M, response: B, error: W } = c.data, S = k.current[M];
-        S && (S(B, W), delete k.current[M]);
+      const x = { origin: o.origin }, I = U.current;
+      if (b === "response") {
+        const { callbackId: n, response: l, error: p } = o.data, G = z.current[n];
+        G && (G(l, p), delete z.current[n]);
         return;
       }
-      if (E === "mark-registered") {
-        const { requestType: M } = c.data;
-        L.current[l] || (L.current[l] = /* @__PURE__ */ new Set()), L.current[l].add(M);
+      if (b === "mark-registered") {
+        const { requestType: n } = o.data;
+        M.current[a] || (M.current[a] = /* @__PURE__ */ new Set()), M.current[a].add(n);
         return;
       }
-      E === "ready" && R((M) => ({ ...M, [l]: !0 })), i((e = p[l]) == null ? void 0 : e[E], c.data), i((t = p["*"]) == null ? void 0 : t[E], c.data), i((r = p[l]) == null ? void 0 : r["*"], c.data), i((d = p["*"]) == null ? void 0 : d["*"], c.data);
+      b === "ready" && P((n) => ({ ...n, [a]: !0 })), s((Z = I[a]) == null ? void 0 : Z[b], o.data, x), s((K = I["*"]) == null ? void 0 : K[b], o.data, x), s((e = I[a]) == null ? void 0 : e["*"], o.data, x), s((t = I["*"]) == null ? void 0 : t["*"], o.data, x);
     };
     return window.addEventListener("message", u), () => {
       window.removeEventListener("message", u);
     };
-  }, [s]);
-  const b = h(
-    (i, u, c) => {
-      var E, p;
-      const l = s[i];
-      if (!l) {
-        console.warn(`Origin not set for id: ${i}. Unable to send message.`);
+  }, [d]);
+  const f = m(
+    (s, u, o) => {
+      var b, E;
+      const a = d[s];
+      if (!a) {
+        console.warn(`Origin not set for id: ${s}. Unable to send message.`);
         return;
       }
-      (p = (E = l == null ? void 0 : l.frameRef) == null ? void 0 : E.current) != null && p.contentWindow && l.frameRef.current.contentWindow.postMessage(
-        { type: u, ...c, instanceId: i },
-        l.origin
+      (E = (b = a == null ? void 0 : a.frameRef) == null ? void 0 : b.current) != null && E.contentWindow && a.frameRef.current.contentWindow.postMessage(
+        { type: u, ...o, instanceId: s },
+        a.origin
       );
     },
-    [s]
-  ), U = x(0), P = h(() => `${Date.now()}-${++U.current}`, []), z = h(
-    async (i, u, c = {}) => new Promise((l, E) => {
-      const p = P(), $ = (e, t) => {
-        delete k.current[p], t ? E(t) : l(e);
+    [d]
+  ), v = R(0), $ = m(() => `${Date.now()}-${++v.current}`, []), B = m(
+    async (s, u, o = {}) => new Promise((a, b) => {
+      const E = $(), _ = (x, I) => {
+        delete z.current[E], I ? b(I) : a(x);
       };
-      k.current[p] = $, b(i, "request", { callbackId: p, requestType: u, data: c });
+      z.current[E] = _, f(s, "request", { callbackId: E, requestType: u, data: o });
     }),
-    [b]
-  ), A = h(
-    (i, u) => {
-      b(i, "load-options", u);
+    [f]
+  ), y = m(
+    (s, u) => {
+      f(s, "load-options", u);
     },
-    [b]
-  ), O = h(
-    (i, u) => {
-      b(i, "validate", u);
+    [f]
+  ), O = m(
+    (s, u) => {
+      f(s, "validate", u);
     },
-    [b]
-  ), C = Y(
+    [f]
+  ), j = ue(
     () => ({
-      registerFrame: y,
-      unregisterFrame: F,
-      sendMessage: b,
-      sendRequest: z,
-      loadOptions: A,
+      registerFrame: A,
+      unregisterFrame: q,
+      sendMessage: f,
+      sendRequest: B,
+      loadOptions: y,
       validate: O,
-      hasHandler: q,
-      readyFrames: m,
-      addListener: (i, u, c) => (T.current[i] || (T.current[i] = {}), T.current[i][u] || (T.current[i][u] = []), T.current[i][u].push(c), () => {
-        T.current[i][u] = T.current[i][u].filter((l) => l !== c);
+      hasHandler: L,
+      readyFrames: w,
+      addListener: (s, u, o) => (U.current[s] || (U.current[s] = {}), U.current[s][u] || (U.current[s][u] = []), U.current[s][u].push(o), () => {
+        U.current[s][u] = U.current[s][u].filter((a) => a !== o);
       })
     }),
     [
-      y,
-      F,
-      b,
-      z,
       A,
-      O,
       q,
-      m
+      f,
+      B,
+      y,
+      O,
+      L,
+      w
     ]
   );
-  return /* @__PURE__ */ f.createElement(H.Provider, { value: C }, /* @__PURE__ */ f.createElement(Q, { launcher: o }, n));
-}, v = (n, o, s) => {
-  const a = _(H);
-  if (a === null)
+  return /* @__PURE__ */ h.createElement(Y.Provider, { value: j }, /* @__PURE__ */ h.createElement(ie, { launcher: i, broker: c }, r));
+}, V = (r, i, c) => {
+  const d = H(Y);
+  if (d === null)
     throw new Error(
       "useEmbeddedEffect must be used within a MMEmbeddableZoneProvider"
     );
-  const m = x(s);
-  g(() => {
-    m.current = s;
-  }, [s]), g(() => {
-    if (!(!n || !o)) {
-      if (o.startsWith("key:")) {
-        const R = o.substring(4);
-        return a.readyFrames[n] && a.sendMessage(n, "subscribe-key", { keyChord: R }), a.addListener(
-          n,
-          `key-pressed:${R}`,
-          (...k) => m.current(...k)
+  const g = R(c);
+  k(() => {
+    g.current = c;
+  }, [c]), k(() => {
+    if (!(!r || !i)) {
+      if (i.startsWith("key:")) {
+        const w = i.substring(4);
+        return d.readyFrames[r] && d.sendMessage(r, "subscribe-key", { keyChord: w }), d.addListener(
+          r,
+          `key-pressed:${w}`,
+          (...U) => g.current(...U)
         );
       }
-      return a.addListener(
-        n,
-        o,
-        (...R) => m.current(...R)
+      return d.addListener(
+        r,
+        i,
+        (...w) => g.current(...w)
       );
     }
-  }, [a, n, o]);
+  }, [d, r, i]);
 };
-oe.propTypes = {
-  children: w.node.isRequired,
+Ee.propTypes = {
+  children: T.node.isRequired,
   /**
    * Optional interactive-step launcher for embedded authorizations,
    * `(entry, { onBlocked, onClosed }) => cleanup`. Defaults to a top-level
    * popup. Hosts that cannot open windows (Android WebView shells) drive
    * their own UI from useEmbeddedAuthorizations() instead.
    */
-  authorizationLauncher: w.func
+  authorizationLauncher: T.func,
+  /**
+   * Optional credential broker for hosts that are first-party MachineMetrics clients
+   * (`async (request, { approve }) => result`, see EmbeddedAuthorizationManager). When present,
+   * v2 credential requests are brokered server-side (no popup, no hidden frame) and consent is
+   * rendered natively by the host from the broker's `client` identity.
+   */
+  credentialBroker: T.func
 };
-const K = Z.default || Z, ce = 1e4, ue = "credentials", G = (n, o) => `${n}/mm-embedded-interop?id=${o}&origin=${window.location.origin}&caps=${ue}`, le = K.iframe`
+const N = D.default || D, we = 1e4, ke = "credentials", se = (r, i) => `${r}/mm-embedded-interop?id=${i}&origin=${window.location.origin}&caps=${ke}`, Re = N.iframe`
   width: 100%;
   height: 100%;
   border: none;
-  visibility: ${(n) => n.$isReady ? "visible" : "hidden"};
-`, ae = K.div`
+  visibility: ${(r) => r.$isReady ? "visible" : "hidden"};
+`, xe = N.div`
   width: 100%;
   height: 100%;
   display: flex;
@@ -385,132 +496,140 @@ const K = Z.default || Z, ce = 1e4, ue = "credentials", G = (n, o) => `${n}/mm-e
   text-align: center;
   color: #555;
   font-size: 14px;
-`, X = ({ entry: n }) => /* @__PURE__ */ f.createElement(ae, null, /* @__PURE__ */ f.createElement("div", { style: { fontWeight: 600 } }, n && n.origin || "This app", " can’t be embedded here"), /* @__PURE__ */ f.createElement("div", { style: { fontSize: 12, color: "#888" } }, "It needs an update to support embedding from a different domain."));
-X.propTypes = {
-  entry: w.shape({
-    origin: w.string,
-    name: w.string,
-    reason: w.string
+`, ce = ({ entry: r }) => /* @__PURE__ */ h.createElement(xe, null, /* @__PURE__ */ h.createElement("div", { style: { fontWeight: 600 } }, r && r.origin || "This app", " can’t be embedded here"), /* @__PURE__ */ h.createElement("div", { style: { fontSize: 12, color: "#888" } }, "It needs an update to support embedding from a different domain."));
+ce.propTypes = {
+  entry: T.shape({
+    origin: T.string,
+    name: T.string,
+    reason: T.string
   })
 };
-const de = K.div`
+const Te = N.div`
   height: 100%;
   display: flex;
   flex: 1;
   align-items: center;
   justify-content: center;
-`, fe = () => /* @__PURE__ */ f.createElement(de, null, /* @__PURE__ */ f.createElement("div", { style: { textAlign: "center" } }, "This app couldn’t be loaded as an embeddable widget.")), me = ({
-  id: n,
-  src: o,
-  path: s,
-  onInit: a = () => {
+`, Ie = () => /* @__PURE__ */ h.createElement(Te, null, /* @__PURE__ */ h.createElement("div", { style: { textAlign: "center" } }, "This app couldn’t be loaded as an embeddable widget.")), Ue = ({
+  id: r,
+  src: i,
+  path: c,
+  onInit: d = () => {
   },
-  onTimeout: m,
-  context: R = {},
-  params: T = {},
-  renderUnsupported: k,
-  renderTimeout: L,
-  ...q
+  onTimeout: g,
+  context: w = {},
+  params: P = {},
+  renderUnsupported: U,
+  renderTimeout: z,
+  ...M
 }) => {
-  if ("isConfiguring" in q)
+  if ("isConfiguring" in M)
     return console.error(
       "isConfiguring must be passed via the params prop to MMEmbeddableZone"
     ), null;
-  if ("colorMode" in R)
+  if ("colorMode" in w)
     return console.error(
       "colorMode must be passed via the params prop to MMEmbeddableZone"
     ), null;
-  if ("isFullScreen" in R)
+  if ("isFullScreen" in w)
     return console.error(
       "isFullScreen must be passed via the params prop to MMEmbeddableZone"
     ), null;
-  const y = x(), [F, b] = I(), [U, P] = I(0), [z, A] = I(!1), [O, C] = I(!1), i = re(o), u = se(o), c = ie(o);
-  g(() => {
-    i > 0 && P(0);
-  }, [i]);
-  const { registerFrame: l, unregisterFrame: E, sendMessage: p } = _(
-    H
-  ), [$, e] = I(), t = x(), r = x(m), d = x(a), M = x(!1);
-  g(() => {
-    r.current = m;
-  }, [m]), g(() => {
-    d.current = a;
-  }, [a]), g(() => {
-    U && p(n, "set-context", {
+  const L = R(), [A, q] = C(), [f, v] = C(0), [$, B] = C(!1), [y, O] = C(!1), j = me(i), s = he(i), u = be(i);
+  k(() => {
+    j > 0 && v(0);
+  }, [j]);
+  const { registerFrame: o, unregisterFrame: a, sendMessage: b } = H(
+    Y
+  ), [E, _] = C(), x = R(), I = R(g), F = R(d), W = R(!1);
+  k(() => {
+    I.current = g;
+  }, [g]), k(() => {
+    F.current = d;
+  }, [d]), k(() => {
+    f && b(r, "set-context", {
       context: {
-        ...R
+        ...w
       }
     });
-  }, [R, n, U]), g(() => {
-    U && p(n, "set-params", { params: T });
-  }, [T, n, U]), g(() => {
-    s !== void 0 && e((s == null ? void 0 : s.indexOf("/")) === 0 ? s : `/${s}`);
-  }, [s]), g(() => {
-    $ === void 0 || !U || p(n, "navigate", { path: $ });
-  }, [$, U, n, p]), g(() => {
-    if (!o || !n || !y)
+  }, [w, r, f]), k(() => {
+    f && b(r, "set-params", { params: P });
+  }, [P, r, f]), k(() => {
+    c !== void 0 && _((c == null ? void 0 : c.indexOf("/")) === 0 ? c : `/${c}`);
+  }, [c]), k(() => {
+    E === void 0 || !f || b(r, "navigate", { path: E });
+  }, [E, f, r, b]), k(() => {
+    if (!i || !r || !L)
       return;
-    const S = new URL(o);
-    return l(n, S.origin, y), d.current(), b(G(S.origin, n)), () => {
-      E(n);
+    const t = new URL(i);
+    return o(r, t.origin, L), F.current(), q(se(t.origin, r)), () => {
+      a(r);
     };
-  }, [o, n, l, y]), g(() => {
-    if (!(!F || M.current))
-      return t.current = setTimeout(() => {
-        A(!0), r.current && r.current();
-      }, ce), () => clearTimeout(t.current);
-  }, [F]);
-  const B = h(() => {
-    M.current = !0, clearTimeout(t.current), A(!1);
-  }, []);
-  v(n, "init", B), v(n, "authorize", B), v(n, "login", B), v(n, "credential-request", () => {
-    B(), C(!0);
-  }), g(() => {
-    !O || !u || p(n, "credential", { accessToken: u.accessToken });
-  }, [O, u, n, p]), v(n, "ready", () => {
-    B(), P((S) => S + 1);
+  }, [i, r, o, L]), k(() => {
+    if (!(!A || W.current))
+      return x.current = setTimeout(() => {
+        B(!0), I.current && I.current();
+      }, we), () => clearTimeout(x.current);
+  }, [A]);
+  const S = m(() => {
+    W.current = !0, clearTimeout(x.current), B(!1);
+  }, []), [Z, K] = C(null);
+  V(r, "init", (t) => {
+    S(), Array.isArray(t == null ? void 0 : t.acceptsCredentials) && K(t.acceptsCredentials);
+  }), V(r, "authorize", S), V(r, "login", S), V(r, "credential-request", () => {
+    S(), O(!0);
+  }), k(() => {
+    if (!y || !s)
+      return;
+    const t = Z;
+    if (Array.isArray(t) && !t.includes(s.kind))
+      return;
+    const n = s.kind === "access_token" ? { accessToken: s.accessToken } : {};
+    b(r, "credential", { ...n, credential: s });
+  }, [y, s, Z, r, b]), V(r, "ready", () => {
+    S(), v((t) => t + 1);
   });
-  const W = x();
-  return v(n, "heartbeat", () => {
-    W.current && clearTimeout(W.current), W.current = setTimeout(() => {
-      if (y.current) {
-        const S = new URL(o);
-        y.current.src = G(S.origin, n);
+  const e = R();
+  return V(r, "heartbeat", () => {
+    e.current && clearTimeout(e.current), e.current = setTimeout(() => {
+      if (L.current) {
+        const t = new URL(i);
+        L.current.src = se(t.origin, r);
       }
     }, 6e3);
-  }), g(() => () => {
-    W.current && clearTimeout(W.current);
-  }, []), c ? k ? k(c) : /* @__PURE__ */ f.createElement(X, { entry: c }) : z && !U ? L ? L() : /* @__PURE__ */ f.createElement(fe, null) : /* @__PURE__ */ f.createElement(
-    le,
+  }), k(() => () => {
+    e.current && clearTimeout(e.current);
+  }, []), u ? U ? U(u) : /* @__PURE__ */ h.createElement(ce, { entry: u }) : $ && !f ? z ? z() : /* @__PURE__ */ h.createElement(Ie, null) : /* @__PURE__ */ h.createElement(
+    Re,
     {
-      key: `auth-epoch-${i}`,
-      $isReady: U,
-      ref: y,
-      src: F,
-      ...q
+      key: `auth-epoch-${j}`,
+      $isReady: f,
+      ref: L,
+      src: A,
+      ...M
     }
   );
 };
-me.propTypes = {
-  id: w.string,
-  src: w.string.isRequired,
-  path: w.string,
-  onInit: w.func,
-  onTimeout: w.func,
+Ue.propTypes = {
+  id: T.string,
+  src: T.string.isRequired,
+  path: T.string,
+  onInit: T.func,
+  onTimeout: T.func,
   /**
    * Optional host-styled renderer for the structurally-unsupported embed
    * state (legacy app on a cross-site origin), `(entry) => ReactNode`. Falls
    * back to a minimal built-in placeholder.
    */
-  renderUnsupported: w.func,
+  renderUnsupported: T.func,
   /**
    * Optional host-styled renderer for the handshake-timeout failure state
    * (the app is not embeddable / could not load), `() => ReactNode`. Falls
    * back to a minimal centered message.
    */
-  renderTimeout: w.func
+  renderTimeout: T.func
 };
-const pe = Z.div`
+const Ce = D.div`
   position: fixed;
   inset: 0;
   background: rgba(0, 0, 0, 0.45);
@@ -518,7 +637,7 @@ const pe = Z.div`
   align-items: center;
   justify-content: center;
   z-index: 10000;
-`, ge = Z.div`
+`, ze = D.div`
   background: #fff;
   border-radius: 8px;
   box-shadow: 0 4px 24px rgba(0, 0, 0, 0.2);
@@ -527,13 +646,13 @@ const pe = Z.div`
   max-width: calc(100vw - 32px);
   font-family: sans-serif;
   color: #222;
-`, he = Z.div`
+`, Me = D.div`
   display: flex;
   align-items: center;
   justify-content: space-between;
   padding: 10px 0;
   gap: 16px;
-`, be = Z.button`
+`, Le = D.button`
   background: #16a500;
   color: #fff;
   border: none;
@@ -542,25 +661,27 @@ const pe = Z.div`
   font-size: 14px;
   cursor: pointer;
   white-space: nowrap;
-`, Ee = Z.p`
+`, Oe = D.p`
   color: #b3261e;
   font-size: 13px;
   margin: 4px 0 0;
-`, Te = () => {
-  const { pending: n, authorize: o } = ne();
-  return n.length === 0 ? null : /* @__PURE__ */ f.createElement(pe, null, /* @__PURE__ */ f.createElement(ge, null, /* @__PURE__ */ f.createElement("h3", { style: { margin: "0 0 8px" } }, "Authorization Required"), /* @__PURE__ */ f.createElement("p", { style: { margin: "0 0 12px", fontSize: 14, color: "#555" } }, "The following apps need you to sign in and authorize them before they can load."), n.map((s) => /* @__PURE__ */ f.createElement("div", { key: s.origin }, /* @__PURE__ */ f.createElement(he, null, /* @__PURE__ */ f.createElement("div", null, /* @__PURE__ */ f.createElement("div", { style: { fontWeight: 600 } }, s.origin)), /* @__PURE__ */ f.createElement(be, { onClick: () => o(s) }, "Authorize")), s.popupBlocked && /* @__PURE__ */ f.createElement(Ee, null, "The sign-in window was blocked. Allow popups for this site, then try again.")))));
+`, Se = () => {
+  const { pending: r, authorize: i } = ge();
+  return r.length === 0 ? null : /* @__PURE__ */ h.createElement(Ce, null, /* @__PURE__ */ h.createElement(ze, null, /* @__PURE__ */ h.createElement("h3", { style: { margin: "0 0 8px" } }, "Authorization Required"), /* @__PURE__ */ h.createElement("p", { style: { margin: "0 0 12px", fontSize: 14, color: "#555" } }, "The following apps need you to sign in and authorize them before they can load."), r.map((c) => /* @__PURE__ */ h.createElement("div", { key: c.origin }, /* @__PURE__ */ h.createElement(Me, null, /* @__PURE__ */ h.createElement("div", null, /* @__PURE__ */ h.createElement("div", { style: { fontWeight: 600 } }, c.origin)), /* @__PURE__ */ h.createElement(Le, { onClick: () => i(c) }, "Authorize")), c.popupBlocked && /* @__PURE__ */ h.createElement(Oe, null, "The sign-in window was blocked. Allow popups for this site, then try again.")))));
 };
 export {
-  D as EmbeddedAuthorizationContext,
-  Te as EmbeddedAuthorizationPrompt,
-  me as MMEmbeddableZone,
-  H as MMEmbeddableZoneContext,
-  oe as MMEmbeddableZoneProvider,
-  ee as isCrossSite,
-  te as popupAuthorizationLauncher,
-  ne as useEmbeddedAuthorizations,
-  se as useEmbeddedCredential,
-  v as useEmbeddedEffect,
-  re as useEmbeddedOriginEpoch,
-  ie as useEmbeddedUnsupported
+  le as CREDENTIAL_KIND_ACCESS_TOKEN,
+  J as EmbeddedAuthorizationContext,
+  Se as EmbeddedAuthorizationPrompt,
+  Ue as MMEmbeddableZone,
+  Y as MMEmbeddableZoneContext,
+  Ee as MMEmbeddableZoneProvider,
+  fe as isCrossSite,
+  te as normalizeCredential,
+  pe as popupAuthorizationLauncher,
+  ge as useEmbeddedAuthorizations,
+  he as useEmbeddedCredential,
+  V as useEmbeddedEffect,
+  me as useEmbeddedOriginEpoch,
+  be as useEmbeddedUnsupported
 };