@machinemetrics/mm-react-embeddable 1.4.0-4 → 1.4.0-5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/mm-react-embeddable.cjs.js +10 -10
  2. package/dist/mm-react-embeddable.es.js +456 -336
  3. package/dist/mm-react-embeddable.umd.js +10 -10
  4. package/package.json +1 -1
package/dist/mm-react-embeddable.es.js CHANGED
@@ -1,215 +1,307 @@
1
- import f, { createContext as Q, useContext as Z, useState as I, useRef as x, useCallback as h, useEffect as g, useMemo as N } from "react";
2
- import w from "prop-types";
3
- import W from "styled-components";
4
- const H = Q(null), D = Q({
1
+ import h, { createContext as oe, useContext as H, useState as C, useRef as R, useCallback as m, useEffect as k, useMemo as ue } from "react";
2
+ import T from "prop-types";
3
+ import D from "styled-components";
4
+ const Y = oe(null), J = oe({
5
5
  pending: [],
6
6
  authorize: () => {
7
7
  },
8
+ approve: () => {
9
+ },
10
+ complete: () => {
11
+ },
8
12
  dismiss: () => {
9
13
  },
10
14
  originEpochs: {},
11
15
  credentials: {},
12
16
  unsupported: {}
13
- }), V = typeof window != "undefined" && window.location.protocol === "https:", ee = 8e3, j = (n) => {
17
+ }), le = "access_token", te = (r) => r ? r.kind ? r : r.accessToken ? {
18
+ kind: le,
19
+ accessToken: r.accessToken,
20
+ expiresAt: r.expiresAt || null
21
+ } : null : null, ae = /* @__PURE__ */ new Set(["host_not_allowed", "invalid_token", "provider_unavailable"]), X = typeof window != "undefined" && window.location.protocol === "https:", de = 8e3, Q = (r) => {
14
22
  try {
15
- return new URL(n).origin;
23
+ return new URL(r).origin;
16
24
  } catch {
17
25
  return null;
18
26
  }
19
- }, G = (n) => {
20
- if (!n || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(n) || n.includes(":"))
21
- return n;
22
- const o = n.split(".");
23
- return o.length <= 2 ? n : o.slice(-2).join(".");
24
- }, te = (n, o) => {
27
+ }, ne = (r, i) => {
28
+ const c = i == null ? void 0 : i.origin;
29
+ return !c || Q(r == null ? void 0 : r.authUrl) !== c ? null : c;
30
+ }, re = (r) => {
31
+ if (!r || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(r) || r.includes(":"))
32
+ return r;
33
+ const i = r.split(".");
34
+ return i.length <= 2 ? r : i.slice(-2).join(".");
35
+ }, fe = (r, i) => {
25
36
  try {
26
- const s = new URL(n), a = new URL(o);
27
- return s.protocol !== a.protocol ? !0 : G(s.hostname) !== G(a.hostname);
37
+ const c = new URL(r), d = new URL(i);
38
+ return c.protocol !== d.protocol ? !0 : re(c.hostname) !== re(d.hostname);
28
39
  } catch {
29
40
  return !0;
30
41
  }
31
- }, ne = (n, { onBlocked: o, onClosed: s }) => {
32
- const a = window.open(
33
- n.authUrl,
42
+ }, pe = (r, { onBlocked: i, onClosed: c }) => {
43
+ const d = window.open(
44
+ r.authUrl,
34
45
  "mm-embed-auth",
35
46
  "popup,width=600,height=700"
36
47
  );
37
- if (!a)
38
- return o(), () => {
48
+ if (!d)
49
+ return i(), () => {
39
50
  };
40
- const p = setInterval(() => {
41
- a.closed && (clearInterval(p), s());
51
+ const g = setInterval(() => {
52
+ d.closed && (clearInterval(g), c());
42
53
  }, 1e3);
43
- return () => clearInterval(p);
44
- }, X = ({ children: n, launcher: o }) => {
45
- const s = Z(H), [a, p] = I({}), [R, T] = I({}), [k, L] = I({}), [q, U] = I({}), S = x(k);
46
- S.current = k;
47
- const b = x(null), y = x({}), F = x({}), z = h((e) => {
48
- const t = F.current[e];
54
+ return () => clearInterval(g);
55
+ }, ie = ({ children: r, launcher: i, broker: c }) => {
56
+ const d = H(Y), [g, w] = C({}), [P, U] = C({}), [z, M] = C({}), [L, A] = C({}), q = R(z);
57
+ q.current = z;
58
+ const f = R(null), v = R({}), $ = R({}), B = R({}), y = R(c);
59
+ y.current = c;
60
+ const O = m((e) => {
61
+ const t = $.current[e];
49
62
  if (!t)
50
63
  return;
51
- const r = (d) => !d[e] || d[e].clientId ? d : { ...d, [e]: { ...d[e], clientId: t } };
52
- p(r), U(r);
53
- }, []), A = h(
64
+ const n = (l) => !l[e] || l[e].clientId ? l : { ...l, [e]: { ...l[e], clientId: t } };
65
+ w(n), A(n);
66
+ }, []), j = m(
54
67
  (e, t) => {
55
- const r = j(e == null ? void 0 : e.authUrl);
56
- r && (U((d) => d[r] ? d : {
57
- ...d,
58
- [r]: { origin: r, reason: t, clientId: F.current[r] || null }
59
- }), z(r));
68
+ e && (A((n) => n[e] ? n : {
69
+ ...n,
70
+ [e]: { origin: e, reason: t, clientId: $.current[e] || null }
71
+ }), O(e));
60
72
  },
61
- [z]
62
- ), O = h(
63
- (e, { v2: t = !1 } = {}) => {
64
- const r = j(e == null ? void 0 : e.authUrl);
65
- r && (t && S.current[r] || (p((d) => d[r] ? d : {
66
- ...d,
67
- [r]: {
68
- origin: r,
73
+ [O]
74
+ ), s = m(
75
+ (e, { v2: t = !1, origin: n = null } = {}) => {
76
+ n && (t && q.current[n] || (w((l) => l[n] ? l : {
77
+ ...l,
78
+ [n]: {
79
+ origin: n,
69
80
  authUrl: e.authUrl,
70
81
  silentUrl: e.silentUrl || null,
71
82
  // v2 entries try the invisible silent resolver first — but only on a host that can
72
83
  // frame login (https). Otherwise (and for legacy signals) go straight to interactive,
73
84
  // so an http host doesn't wait out a silent frame that can never load login.
74
- status: t && e.silentUrl && V ? "silent" : "interactive",
85
+ status: t && y.current ? "broker" : t && e.silentUrl && X ? "silent" : "interactive",
75
86
  v2: t,
87
+ // v1.9: the scope the guest asked for; forwarded verbatim to the broker.
88
+ scope: e.scope || null,
89
+ acceptsCredentials: B.current[n] || null,
90
+ consent: null,
91
+ error: null,
76
92
  // clientId from the request payload (v2) or the cached init (legacy);
77
93
  // the host resolves the display name from it.
78
- clientId: e.clientId || F.current[r] || null,
94
+ clientId: e.clientId || $.current[n] || null,
79
95
  popupBlocked: !1
80
96
  }
81
- }), z(r)));
97
+ }), O(n)));
82
98
  },
83
- [z]
84
- ), C = h((e) => {
85
- p((t) => {
99
+ [O]
100
+ ), u = m((e) => {
101
+ w((t) => {
86
102
  if (!t[e])
87
103
  return t;
88
- const r = { ...t };
89
- return delete r[e], r;
104
+ const n = { ...t };
105
+ return delete n[e], n;
90
106
  });
91
- }, []), i = h(
107
+ }, []), o = m(
92
108
  (e) => {
93
- e && (C(e), T((t) => ({
109
+ e && (u(e), U((t) => ({
94
110
  ...t,
95
111
  [e]: (t[e] || 0) + 1
96
112
  })));
97
113
  },
98
- [C]
99
- ), u = h((e) => {
100
- p((t) => !t[e] || t[e].status === "interactive" ? t : {
114
+ [u]
115
+ ), a = m((e) => {
116
+ w((t) => !t[e] || t[e].status === "interactive" ? t : {
101
117
  ...t,
102
118
  [e]: { ...t[e], status: "interactive" }
103
119
  });
104
- }, []), c = h(
120
+ }, []), b = m(
105
121
  (e) => {
106
- C(e.origin);
122
+ u(e.origin);
107
123
  },
108
- [C]
109
- ), l = h(
110
- (e) => {
111
- const t = j(e == null ? void 0 : e.authUrl);
112
- if (t && te(t, window.location.origin)) {
113
- A(e, "cross-site-legacy");
114
- return;
124
+ [u]
125
+ ), E = m(
126
+ (e, t) => {
127
+ const n = ne(e, t);
128
+ if (n) {
129
+ if (fe(n, window.location.origin)) {
130
+ j(n, "cross-site-legacy");
131
+ return;
132
+ }
133
+ s(e, { origin: n });
115
134
  }
116
- O(e);
117
135
  },
118
- [O, A]
136
+ [s, j]
119
137
  );
120
- g(() => {
121
- if (!s)
138
+ k(() => {
139
+ if (!d)
122
140
  return;
123
141
  const e = [
124
- // `init` carries the app's OAuth clientId. Cache it by app origin and
125
- // attach it to any entry already showing. `init` is posted before the
126
- // authorize/login/credential-request signals, so it is usually cached by
127
- // the time an entry is created. The host resolves the display name from
128
- // the clientId.
129
- s.addListener("*", "init", (t) => {
130
- t != null && t.origin && t.clientId && (F.current[t.origin] = t.clientId, z(t.origin));
142
+ // `init` carries the app's OAuth clientId. Cache it by the ATTESTED app
143
+ // origin (payload `origin` is ignored) and attach it to any entry already
144
+ // showing. `init` is posted before the authorize/login/credential-request
145
+ // signals, so it is usually cached by the time an entry is created. The
146
+ // clientId is only a lookup key: the host resolves the display name from
147
+ // it, and a broker binds it to the attested origin server-side.
148
+ d.addListener("*", "init", (t, n) => {
149
+ n != null && n.origin && (t != null && t.clientId) && ($.current[n.origin] = t.clientId, O(n.origin)), n != null && n.origin && Array.isArray(t == null ? void 0 : t.acceptsCredentials) && (B.current[n.origin] = t.acceptsCredentials);
131
150
  }),
132
- s.addListener("*", "authorize", l),
133
- s.addListener("*", "login", l),
134
- s.addListener(
151
+ d.addListener("*", "authorize", E),
152
+ d.addListener("*", "login", E),
153
+ d.addListener(
135
154
  "*",
136
155
  "credential-request",
137
- (t) => O(t, { v2: !0 })
138
- ),
139
- s.addListener("*", "authorized", (t) => {
140
- t != null && t.accessToken || i(j(t == null ? void 0 : t.authUrl));
141
- })
156
+ (t, n) => s(t, { v2: !0, origin: ne(t, n) })
157
+ )
142
158
  ];
143
159
  return () => e.forEach((t) => t());
144
- }, [s, l, O, i, z]), g(() => {
160
+ }, [d, E, s, O]), k(() => {
145
161
  const e = (t) => {
146
- const r = t == null ? void 0 : t.data;
147
- if (!r || r.type !== "authorized" && r.type !== "authorize-failed")
162
+ const n = t == null ? void 0 : t.data;
163
+ if (!n || n.type !== "authorized" && n.type !== "authorize-failed")
148
164
  return;
149
- const d = j(r.authUrl);
150
- if (!(!d || t.origin !== d)) {
151
- if (r.type === "authorized" && r.accessToken) {
152
- L((M) => ({
153
- ...M,
154
- [d]: { accessToken: r.accessToken }
155
- })), C(d);
165
+ const l = Q(n.authUrl);
166
+ if (!(!l || t.origin !== l)) {
167
+ if (n.type === "authorized") {
168
+ n.accessToken ? (M((p) => ({
169
+ ...p,
170
+ [l]: te({ accessToken: n.accessToken })
171
+ })), u(l)) : o(l);
156
172
  return;
157
173
  }
158
- r.type === "authorize-failed" && u(d);
174
+ a(l);
159
175
  }
160
176
  };
161
177
  return window.addEventListener("message", e), () => window.removeEventListener("message", e);
162
- }, [C, u]), g(() => {
163
- const e = y.current;
164
- Object.values(a).forEach((t) => {
178
+ }, [u, o, a]);
179
+ const _ = m(
180
+ (e, t) => {
181
+ const n = e == null ? void 0 : e.origin, l = te(t);
182
+ !n || !l || (M((p) => ({ ...p, [n]: l })), u(n));
183
+ },
184
+ [u]
185
+ ), x = m((e, t) => {
186
+ w((n) => n[e] ? { ...n, [e]: { ...n[e], ...t } } : n);
187
+ }, []), I = m(
188
+ async (e, { approve: t } = {}) => {
189
+ const n = y.current, { origin: l } = e;
190
+ let p;
191
+ try {
192
+ p = await n(
193
+ { origin: l, clientId: e.clientId, scope: e.scope, authUrl: e.authUrl },
194
+ { approve: t }
195
+ );
196
+ } catch {
197
+ t ? x(l, { error: { reason: "broker_unavailable" } }) : x(l, {
198
+ status: e.silentUrl && X ? "silent" : "interactive"
199
+ });
200
+ return;
201
+ }
202
+ if ((p == null ? void 0 : p.status) === 200 && p.credential) {
203
+ _(e, p.credential);
204
+ return;
205
+ }
206
+ if ((p == null ? void 0 : p.status) === 409 && p.consentRequired) {
207
+ x(l, {
208
+ status: "interactive",
209
+ consent: {
210
+ client: p.client || null,
211
+ stepUp: !!p.stepUp,
212
+ scope: p.scope || e.scope
213
+ },
214
+ error: null
215
+ });
216
+ return;
217
+ }
218
+ const G = (p == null ? void 0 : p.error) || "broker_error";
219
+ if (!t && ae.has(G)) {
220
+ x(l, {
221
+ status: e.silentUrl && X ? "silent" : "interactive"
222
+ });
223
+ return;
224
+ }
225
+ if (t && G === "consent_denied") {
226
+ x(l, { error: null });
227
+ return;
228
+ }
229
+ u(l), A((ee) => ({
230
+ ...ee,
231
+ [l]: {
232
+ origin: l,
233
+ reason: `broker:${G}`,
234
+ detail: p || null,
235
+ clientId: e.clientId || $.current[l] || null
236
+ }
237
+ }));
238
+ },
239
+ [_, x, u]
240
+ ), F = R({});
241
+ k(() => {
242
+ Object.values(g).forEach((e) => {
243
+ e.status !== "broker" || F.current[e.origin] || (F.current[e.origin] = !0, I(e).finally(() => {
244
+ delete F.current[e.origin];
245
+ }));
246
+ });
247
+ }, [g, I]);
248
+ const W = m(
249
+ (e) => !y.current || !(e != null && e.consent) ? Promise.resolve() : I(e, { approve: !0 }),
250
+ [I]
251
+ );
252
+ k(() => {
253
+ const e = v.current;
254
+ Object.values(g).forEach((t) => {
165
255
  t.status === "silent" && !e[t.origin] && (e[t.origin] = setTimeout(() => {
166
- delete e[t.origin], u(t.origin);
167
- }, ee));
256
+ delete e[t.origin], a(t.origin);
257
+ }, de));
168
258
  }), Object.keys(e).forEach((t) => {
169
- (!a[t] || a[t].status !== "silent") && (clearTimeout(e[t]), delete e[t]);
259
+ (!g[t] || g[t].status !== "silent") && (clearTimeout(e[t]), delete e[t]);
170
260
  });
171
- }, [a, u]), g(() => () => {
172
- b.current && b.current(), Object.values(y.current).forEach(clearTimeout);
261
+ }, [g, a]), k(() => () => {
262
+ f.current && f.current(), Object.values(v.current).forEach(clearTimeout);
173
263
  }, []);
174
- const E = h(
264
+ const S = m(
175
265
  (e) => {
176
- b.current && (b.current(), b.current = null);
177
- const t = o || ne;
178
- b.current = t(e, {
266
+ f.current && (f.current(), f.current = null);
267
+ const t = i || pe;
268
+ f.current = t(e, {
179
269
  onBlocked: () => {
180
- p((r) => r[e.origin] ? {
181
- ...r,
182
- [e.origin]: { ...r[e.origin], popupBlocked: !0 }
183
- } : r);
270
+ w((n) => n[e.origin] ? {
271
+ ...n,
272
+ [e.origin]: { ...n[e.origin], popupBlocked: !0 }
273
+ } : n);
184
274
  },
185
275
  onClosed: () => {
186
276
  if (e.v2) {
187
- V && p((r) => !r[e.origin] || !r[e.origin].silentUrl ? r : {
188
- ...r,
189
- [e.origin]: { ...r[e.origin], status: "silent" }
277
+ X && w((n) => !n[e.origin] || !n[e.origin].silentUrl ? n : {
278
+ ...n,
279
+ [e.origin]: { ...n[e.origin], status: "silent" }
190
280
  });
191
281
  return;
192
282
  }
193
- i(e.origin);
283
+ o(e.origin);
194
284
  }
195
285
  });
196
286
  },
197
- [o, i]
198
- ), m = {
287
+ [i, o]
288
+ ), Z = {
199
289
  // Hosts render UI for interactive entries only; silent resolution is
200
290
  // invisible by design.
201
- pending: Object.values(a).filter(
291
+ pending: Object.values(g).filter(
202
292
  (e) => e.status === "interactive"
203
293
  ),
204
- authorize: E,
205
- dismiss: c,
206
- originEpochs: R,
207
- credentials: k,
208
- unsupported: q
209
- }, $ = Object.values(a).filter(
294
+ authorize: S,
295
+ approve: W,
296
+ complete: _,
297
+ dismiss: b,
298
+ originEpochs: P,
299
+ credentials: z,
300
+ unsupported: L
301
+ }, K = Object.values(g).filter(
210
302
  (e) => e.status === "silent" && e.silentUrl
211
303
  );
212
- return /* @__PURE__ */ f.createElement(D.Provider, { value: m }, n, $.map((e) => /* @__PURE__ */ f.createElement(
304
+ return /* @__PURE__ */ h.createElement(J.Provider, { value: Z }, r, K.map((e) => /* @__PURE__ */ h.createElement(
213
305
  "iframe",
214
306
  {
215
307
  key: `mm-silent-auth-${e.origin}`,
@@ -221,159 +313,177 @@ const H = Q(null), D = Q({
221
313
  }
222
314
  )));
223
315
  };
224
- X.propTypes = {
225
- children: w.node,
226
- launcher: w.func
316
+ ie.propTypes = {
317
+ children: T.node,
318
+ launcher: T.func,
319
+ /**
320
+ * `async (request, { approve }) => result` where request =
321
+ * `{ origin, clientId, scope, authUrl }` (origin is the zone-attested frame origin) and result
322
+ * mirrors the authorization server's broker response: `{ status: 200, credential, scope,
323
+ * client }`, `{ status: 409, consentRequired: true, client: { name, hostname }, stepUp }`, or
324
+ * `{ status, error }`. Provided only by hosts that are themselves first-party clients.
325
+ */
326
+ broker: T.func
227
327
  };
228
- const re = () => Z(D), se = (n) => {
229
- const { originEpochs: o } = Z(D), s = j(n);
230
- return s && o[s] || 0;
231
- }, ie = (n) => {
232
- const { credentials: o } = Z(D), s = j(n);
233
- return s && o[s] || null;
234
- }, oe = (n) => {
235
- const { unsupported: o } = Z(D), s = j(n);
236
- return s && o[s] || null;
237
- }, ce = ({ children: n, authorizationLauncher: o }) => {
238
- const [s, a] = I({}), [p, R] = I({}), T = x({}), k = x({}), L = x({}), q = h((i, u) => {
239
- var c;
240
- return !!((c = L.current[i]) != null && c.has(u));
241
- }, []), U = h((i, u, c) => {
242
- a((l) => ({ ...l, [i]: { origin: u, frameRef: c } }));
243
- }, []), S = h((i) => {
244
- a((u) => {
245
- const c = { ...u };
246
- return delete c[i], c;
247
- }), R((u) => {
248
- const c = { ...u };
249
- return delete c[i], c;
250
- }), delete L.current[i];
328
+ const ge = () => H(J), me = (r) => {
329
+ const { originEpochs: i } = H(J), c = Q(r);
330
+ return c && i[c] || 0;
331
+ }, he = (r) => {
332
+ const { credentials: i } = H(J), c = Q(r);
333
+ return c && i[c] || null;
334
+ }, be = (r) => {
335
+ const { unsupported: i } = H(J), c = Q(r);
336
+ return c && i[c] || null;
337
+ }, Ee = ({ children: r, authorizationLauncher: i, credentialBroker: c }) => {
338
+ const [d, g] = C({}), [w, P] = C({}), U = R({}), z = R({}), M = R({}), L = m((s, u) => {
339
+ var o;
340
+ return !!((o = M.current[s]) != null && o.has(u));
341
+ }, []), A = m((s, u, o) => {
342
+ g((a) => ({ ...a, [s]: { origin: u, frameRef: o } }));
343
+ }, []), q = m((s) => {
344
+ g((u) => {
345
+ const o = { ...u };
346
+ return delete o[s], o;
347
+ }), P((u) => {
348
+ const o = { ...u };
349
+ return delete o[s], o;
350
+ }), delete M.current[s];
251
351
  }, []);
252
- g(() => {
253
- const i = (c = [], l) => {
254
- c.forEach((E) => E(l));
255
- }, u = (c) => {
256
- var $, e, t, r, d;
257
- if (!(($ = c == null ? void 0 : c.data) != null && $.instanceId))
352
+ k(() => {
353
+ const s = (o = [], a, b) => {
354
+ o.forEach((E) => E(a, b));
355
+ }, u = (o) => {
356
+ var F, W, S, Z, K, e, t;
357
+ if (!((F = o == null ? void 0 : o.data) != null && F.instanceId))
358
+ return;
359
+ const { instanceId: a, type: b } = o.data, E = d[a], _ = (S = (W = E == null ? void 0 : E.frameRef) == null ? void 0 : W.current) == null ? void 0 : S.contentWindow;
360
+ if (!_ || o.source !== _ || o.origin !== E.origin)
258
361
  return;
259
- const { instanceId: l, type: E } = c.data, m = T.current;
260
- if (E === "response") {
261
- const { callbackId: M, response: B, error: _ } = c.data, P = k.current[M];
262
- P && (P(B, _), delete k.current[M]);
362
+ const x = { origin: o.origin }, I = U.current;
363
+ if (b === "response") {
364
+ const { callbackId: n, response: l, error: p } = o.data, G = z.current[n];
365
+ G && (G(l, p), delete z.current[n]);
263
366
  return;
264
367
  }
265
- if (E === "mark-registered") {
266
- const { requestType: M } = c.data;
267
- L.current[l] || (L.current[l] = /* @__PURE__ */ new Set()), L.current[l].add(M);
368
+ if (b === "mark-registered") {
369
+ const { requestType: n } = o.data;
370
+ M.current[a] || (M.current[a] = /* @__PURE__ */ new Set()), M.current[a].add(n);
268
371
  return;
269
372
  }
270
- E === "ready" && R((M) => ({ ...M, [l]: !0 })), i((e = m[l]) == null ? void 0 : e[E], c.data), i((t = m["*"]) == null ? void 0 : t[E], c.data), i((r = m[l]) == null ? void 0 : r["*"], c.data), i((d = m["*"]) == null ? void 0 : d["*"], c.data);
373
+ b === "ready" && P((n) => ({ ...n, [a]: !0 })), s((Z = I[a]) == null ? void 0 : Z[b], o.data, x), s((K = I["*"]) == null ? void 0 : K[b], o.data, x), s((e = I[a]) == null ? void 0 : e["*"], o.data, x), s((t = I["*"]) == null ? void 0 : t["*"], o.data, x);
271
374
  };
272
375
  return window.addEventListener("message", u), () => {
273
376
  window.removeEventListener("message", u);
274
377
  };
275
- }, [s]);
276
- const b = h(
277
- (i, u, c) => {
278
- var E, m;
279
- const l = s[i];
280
- if (!l) {
281
- console.warn(`Origin not set for id: ${i}. Unable to send message.`);
378
+ }, [d]);
379
+ const f = m(
380
+ (s, u, o) => {
381
+ var b, E;
382
+ const a = d[s];
383
+ if (!a) {
384
+ console.warn(`Origin not set for id: ${s}. Unable to send message.`);
282
385
  return;
283
386
  }
284
- (m = (E = l == null ? void 0 : l.frameRef) == null ? void 0 : E.current) != null && m.contentWindow && l.frameRef.current.contentWindow.postMessage(
285
- { type: u, ...c, instanceId: i },
286
- l.origin
387
+ (E = (b = a == null ? void 0 : a.frameRef) == null ? void 0 : b.current) != null && E.contentWindow && a.frameRef.current.contentWindow.postMessage(
388
+ { type: u, ...o, instanceId: s },
389
+ a.origin
287
390
  );
288
391
  },
289
- [s]
290
- ), y = x(0), F = h(() => `${Date.now()}-${++y.current}`, []), z = h(
291
- async (i, u, c = {}) => new Promise((l, E) => {
292
- const m = F(), $ = (e, t) => {
293
- delete k.current[m], t ? E(t) : l(e);
392
+ [d]
393
+ ), v = R(0), $ = m(() => `${Date.now()}-${++v.current}`, []), B = m(
394
+ async (s, u, o = {}) => new Promise((a, b) => {
395
+ const E = $(), _ = (x, I) => {
396
+ delete z.current[E], I ? b(I) : a(x);
294
397
  };
295
- k.current[m] = $, b(i, "request", { callbackId: m, requestType: u, data: c });
398
+ z.current[E] = _, f(s, "request", { callbackId: E, requestType: u, data: o });
296
399
  }),
297
- [b]
298
- ), A = h(
299
- (i, u) => {
300
- b(i, "load-options", u);
400
+ [f]
401
+ ), y = m(
402
+ (s, u) => {
403
+ f(s, "load-options", u);
301
404
  },
302
- [b]
303
- ), O = h(
304
- (i, u) => {
305
- b(i, "validate", u);
405
+ [f]
406
+ ), O = m(
407
+ (s, u) => {
408
+ f(s, "validate", u);
306
409
  },
307
- [b]
308
- ), C = N(
410
+ [f]
411
+ ), j = ue(
309
412
  () => ({
310
- registerFrame: U,
311
- unregisterFrame: S,
312
- sendMessage: b,
313
- sendRequest: z,
314
- loadOptions: A,
413
+ registerFrame: A,
414
+ unregisterFrame: q,
415
+ sendMessage: f,
416
+ sendRequest: B,
417
+ loadOptions: y,
315
418
  validate: O,
316
- hasHandler: q,
317
- readyFrames: p,
318
- addListener: (i, u, c) => (T.current[i] || (T.current[i] = {}), T.current[i][u] || (T.current[i][u] = []), T.current[i][u].push(c), () => {
319
- T.current[i][u] = T.current[i][u].filter((l) => l !== c);
419
+ hasHandler: L,
420
+ readyFrames: w,
421
+ addListener: (s, u, o) => (U.current[s] || (U.current[s] = {}), U.current[s][u] || (U.current[s][u] = []), U.current[s][u].push(o), () => {
422
+ U.current[s][u] = U.current[s][u].filter((a) => a !== o);
320
423
  })
321
424
  }),
322
425
  [
323
- U,
324
- S,
325
- b,
326
- z,
327
426
  A,
328
- O,
329
427
  q,
330
- p
428
+ f,
429
+ B,
430
+ y,
431
+ O,
432
+ L,
433
+ w
331
434
  ]
332
435
  );
333
- return /* @__PURE__ */ f.createElement(H.Provider, { value: C }, /* @__PURE__ */ f.createElement(X, { launcher: o }, n));
334
- }, v = (n, o, s) => {
335
- const a = Z(H);
336
- if (a === null)
436
+ return /* @__PURE__ */ h.createElement(Y.Provider, { value: j }, /* @__PURE__ */ h.createElement(ie, { launcher: i, broker: c }, r));
437
+ }, V = (r, i, c) => {
438
+ const d = H(Y);
439
+ if (d === null)
337
440
  throw new Error(
338
441
  "useEmbeddedEffect must be used within a MMEmbeddableZoneProvider"
339
442
  );
340
- const p = x(s);
341
- g(() => {
342
- p.current = s;
343
- }, [s]), g(() => {
344
- if (!(!n || !o)) {
345
- if (o.startsWith("key:")) {
346
- const R = o.substring(4);
347
- return a.readyFrames[n] && a.sendMessage(n, "subscribe-key", { keyChord: R }), a.addListener(
348
- n,
349
- `key-pressed:${R}`,
350
- (...k) => p.current(...k)
443
+ const g = R(c);
444
+ k(() => {
445
+ g.current = c;
446
+ }, [c]), k(() => {
447
+ if (!(!r || !i)) {
448
+ if (i.startsWith("key:")) {
449
+ const w = i.substring(4);
450
+ return d.readyFrames[r] && d.sendMessage(r, "subscribe-key", { keyChord: w }), d.addListener(
451
+ r,
452
+ `key-pressed:${w}`,
453
+ (...U) => g.current(...U)
351
454
  );
352
455
  }
353
- return a.addListener(
354
- n,
355
- o,
356
- (...R) => p.current(...R)
456
+ return d.addListener(
457
+ r,
458
+ i,
459
+ (...w) => g.current(...w)
357
460
  );
358
461
  }
359
- }, [a, n, o]);
462
+ }, [d, r, i]);
360
463
  };
361
- ce.propTypes = {
362
- children: w.node.isRequired,
464
+ Ee.propTypes = {
465
+ children: T.node.isRequired,
363
466
  /**
364
467
  * Optional interactive-step launcher for embedded authorizations,
365
468
  * `(entry, { onBlocked, onClosed }) => cleanup`. Defaults to a top-level
366
469
  * popup. Hosts that cannot open windows (Android WebView shells) drive
367
470
  * their own UI from useEmbeddedAuthorizations() instead.
368
471
  */
369
- authorizationLauncher: w.func
472
+ authorizationLauncher: T.func,
473
+ /**
474
+ * Optional credential broker for hosts that are first-party MachineMetrics clients
475
+ * (`async (request, { approve }) => result`, see EmbeddedAuthorizationManager). When present,
476
+ * v2 credential requests are brokered server-side (no popup, no hidden frame) and consent is
477
+ * rendered natively by the host from the broker's `client` identity.
478
+ */
479
+ credentialBroker: T.func
370
480
  };
371
- const K = W.default || W, ue = 1e4, le = "credentials", J = (n, o) => `${n}/mm-embedded-interop?id=${o}&origin=${window.location.origin}&caps=${le}`, ae = K.iframe`
481
+ const N = D.default || D, we = 1e4, ke = "credentials", se = (r, i) => `${r}/mm-embedded-interop?id=${i}&origin=${window.location.origin}&caps=${ke}`, Re = N.iframe`
372
482
  width: 100%;
373
483
  height: 100%;
374
484
  border: none;
375
- visibility: ${(n) => n.$isReady ? "visible" : "hidden"};
376
- `, de = K.div`
485
+ visibility: ${(r) => r.$isReady ? "visible" : "hidden"};
486
+ `, xe = N.div`
377
487
  width: 100%;
378
488
  height: 100%;
379
489
  display: flex;
@@ -386,132 +496,140 @@ const K = W.default || W, ue = 1e4, le = "credentials", J = (n, o) => `${n}/mm-e
386
496
  text-align: center;
387
497
  color: #555;
388
498
  font-size: 14px;
389
- `, Y = ({ entry: n }) => /* @__PURE__ */ f.createElement(de, null, /* @__PURE__ */ f.createElement("div", { style: { fontWeight: 600 } }, n && n.origin || "This app", " can’t be embedded here"), /* @__PURE__ */ f.createElement("div", { style: { fontSize: 12, color: "#888" } }, "It needs an update to support embedding from a different domain."));
390
- Y.propTypes = {
391
- entry: w.shape({
392
- origin: w.string,
393
- name: w.string,
394
- reason: w.string
499
+ `, ce = ({ entry: r }) => /* @__PURE__ */ h.createElement(xe, null, /* @__PURE__ */ h.createElement("div", { style: { fontWeight: 600 } }, r && r.origin || "This app", " can’t be embedded here"), /* @__PURE__ */ h.createElement("div", { style: { fontSize: 12, color: "#888" } }, "It needs an update to support embedding from a different domain."));
500
+ ce.propTypes = {
501
+ entry: T.shape({
502
+ origin: T.string,
503
+ name: T.string,
504
+ reason: T.string
395
505
  })
396
506
  };
397
- const fe = K.div`
507
+ const Te = N.div`
398
508
  height: 100%;
399
509
  display: flex;
400
510
  flex: 1;
401
511
  align-items: center;
402
512
  justify-content: center;
403
- `, pe = () => /* @__PURE__ */ f.createElement(fe, null, /* @__PURE__ */ f.createElement("div", { style: { textAlign: "center" } }, "This app couldn’t be loaded as an embeddable widget.")), me = ({
404
- id: n,
405
- src: o,
406
- path: s,
407
- onInit: a = () => {
513
+ `, Ie = () => /* @__PURE__ */ h.createElement(Te, null, /* @__PURE__ */ h.createElement("div", { style: { textAlign: "center" } }, "This app couldn’t be loaded as an embeddable widget.")), Ue = ({
514
+ id: r,
515
+ src: i,
516
+ path: c,
517
+ onInit: d = () => {
408
518
  },
409
- onTimeout: p,
410
- context: R = {},
411
- params: T = {},
412
- renderUnsupported: k,
413
- renderTimeout: L,
414
- ...q
519
+ onTimeout: g,
520
+ context: w = {},
521
+ params: P = {},
522
+ renderUnsupported: U,
523
+ renderTimeout: z,
524
+ ...M
415
525
  }) => {
416
- if ("isConfiguring" in q)
526
+ if ("isConfiguring" in M)
417
527
  return console.error(
418
528
  "isConfiguring must be passed via the params prop to MMEmbeddableZone"
419
529
  ), null;
420
- if ("colorMode" in R)
530
+ if ("colorMode" in w)
421
531
  return console.error(
422
532
  "colorMode must be passed via the params prop to MMEmbeddableZone"
423
533
  ), null;
424
- if ("isFullScreen" in R)
534
+ if ("isFullScreen" in w)
425
535
  return console.error(
426
536
  "isFullScreen must be passed via the params prop to MMEmbeddableZone"
427
537
  ), null;
428
- const U = x(), [S, b] = I(), [y, F] = I(0), [z, A] = I(!1), [O, C] = I(!1), i = se(o), u = ie(o), c = oe(o);
429
- g(() => {
430
- i > 0 && F(0);
431
- }, [i]);
432
- const { registerFrame: l, unregisterFrame: E, sendMessage: m } = Z(
433
- H
434
- ), [$, e] = I(), t = x(), r = x(p), d = x(a), M = x(!1);
435
- g(() => {
436
- r.current = p;
437
- }, [p]), g(() => {
438
- d.current = a;
439
- }, [a]), g(() => {
440
- y && m(n, "set-context", {
538
+ const L = R(), [A, q] = C(), [f, v] = C(0), [$, B] = C(!1), [y, O] = C(!1), j = me(i), s = he(i), u = be(i);
539
+ k(() => {
540
+ j > 0 && v(0);
541
+ }, [j]);
542
+ const { registerFrame: o, unregisterFrame: a, sendMessage: b } = H(
543
+ Y
544
+ ), [E, _] = C(), x = R(), I = R(g), F = R(d), W = R(!1);
545
+ k(() => {
546
+ I.current = g;
547
+ }, [g]), k(() => {
548
+ F.current = d;
549
+ }, [d]), k(() => {
550
+ f && b(r, "set-context", {
441
551
  context: {
442
- ...R
552
+ ...w
443
553
  }
444
554
  });
445
- }, [R, n, y]), g(() => {
446
- y && m(n, "set-params", { params: T });
447
- }, [T, n, y]), g(() => {
448
- s !== void 0 && e((s == null ? void 0 : s.indexOf("/")) === 0 ? s : `/${s}`);
449
- }, [s]), g(() => {
450
- $ === void 0 || !y || m(n, "navigate", { path: $ });
451
- }, [$, y, n, m]), g(() => {
452
- if (!o || !n || !U)
555
+ }, [w, r, f]), k(() => {
556
+ f && b(r, "set-params", { params: P });
557
+ }, [P, r, f]), k(() => {
558
+ c !== void 0 && _((c == null ? void 0 : c.indexOf("/")) === 0 ? c : `/${c}`);
559
+ }, [c]), k(() => {
560
+ E === void 0 || !f || b(r, "navigate", { path: E });
561
+ }, [E, f, r, b]), k(() => {
562
+ if (!i || !r || !L)
453
563
  return;
454
- const P = new URL(o);
455
- return l(n, P.origin, U), d.current(), b(J(P.origin, n)), () => {
456
- E(n);
564
+ const t = new URL(i);
565
+ return o(r, t.origin, L), F.current(), q(se(t.origin, r)), () => {
566
+ a(r);
457
567
  };
458
- }, [o, n, l, U]), g(() => {
459
- if (!(!S || M.current))
460
- return t.current = setTimeout(() => {
461
- A(!0), r.current && r.current();
462
- }, ue), () => clearTimeout(t.current);
463
- }, [S]);
464
- const B = h(() => {
465
- M.current = !0, clearTimeout(t.current), A(!1);
466
- }, []);
467
- v(n, "init", B), v(n, "authorize", B), v(n, "login", B), v(n, "credential-request", () => {
468
- B(), C(!0);
469
- }), g(() => {
470
- !O || !u || m(n, "credential", { accessToken: u.accessToken });
471
- }, [O, u, n, m]), v(n, "ready", () => {
472
- B(), F((P) => P + 1);
568
+ }, [i, r, o, L]), k(() => {
569
+ if (!(!A || W.current))
570
+ return x.current = setTimeout(() => {
571
+ B(!0), I.current && I.current();
572
+ }, we), () => clearTimeout(x.current);
573
+ }, [A]);
574
+ const S = m(() => {
575
+ W.current = !0, clearTimeout(x.current), B(!1);
576
+ }, []), [Z, K] = C(null);
577
+ V(r, "init", (t) => {
578
+ S(), Array.isArray(t == null ? void 0 : t.acceptsCredentials) && K(t.acceptsCredentials);
579
+ }), V(r, "authorize", S), V(r, "login", S), V(r, "credential-request", () => {
580
+ S(), O(!0);
581
+ }), k(() => {
582
+ if (!y || !s)
583
+ return;
584
+ const t = Z;
585
+ if (Array.isArray(t) && !t.includes(s.kind))
586
+ return;
587
+ const n = s.kind === "access_token" ? { accessToken: s.accessToken } : {};
588
+ b(r, "credential", { ...n, credential: s });
589
+ }, [y, s, Z, r, b]), V(r, "ready", () => {
590
+ S(), v((t) => t + 1);
473
591
  });
474
- const _ = x();
475
- return v(n, "heartbeat", () => {
476
- _.current && clearTimeout(_.current), _.current = setTimeout(() => {
477
- if (U.current) {
478
- const P = new URL(o);
479
- U.current.src = J(P.origin, n);
592
+ const e = R();
593
+ return V(r, "heartbeat", () => {
594
+ e.current && clearTimeout(e.current), e.current = setTimeout(() => {
595
+ if (L.current) {
596
+ const t = new URL(i);
597
+ L.current.src = se(t.origin, r);
480
598
  }
481
599
  }, 6e3);
482
- }), g(() => () => {
483
- _.current && clearTimeout(_.current);
484
- }, []), c ? k ? k(c) : /* @__PURE__ */ f.createElement(Y, { entry: c }) : z && !y ? L ? L() : /* @__PURE__ */ f.createElement(pe, null) : /* @__PURE__ */ f.createElement(
485
- ae,
600
+ }), k(() => () => {
601
+ e.current && clearTimeout(e.current);
602
+ }, []), u ? U ? U(u) : /* @__PURE__ */ h.createElement(ce, { entry: u }) : $ && !f ? z ? z() : /* @__PURE__ */ h.createElement(Ie, null) : /* @__PURE__ */ h.createElement(
603
+ Re,
486
604
  {
487
- key: `auth-epoch-${i}`,
488
- $isReady: y,
489
- ref: U,
490
- src: S,
491
- ...q
605
+ key: `auth-epoch-${j}`,
606
+ $isReady: f,
607
+ ref: L,
608
+ src: A,
609
+ ...M
492
610
  }
493
611
  );
494
612
  };
495
- me.propTypes = {
496
- id: w.string,
497
- src: w.string.isRequired,
498
- path: w.string,
499
- onInit: w.func,
500
- onTimeout: w.func,
613
+ Ue.propTypes = {
614
+ id: T.string,
615
+ src: T.string.isRequired,
616
+ path: T.string,
617
+ onInit: T.func,
618
+ onTimeout: T.func,
501
619
  /**
502
620
  * Optional host-styled renderer for the structurally-unsupported embed
503
621
  * state (legacy app on a cross-site origin), `(entry) => ReactNode`. Falls
504
622
  * back to a minimal built-in placeholder.
505
623
  */
506
- renderUnsupported: w.func,
624
+ renderUnsupported: T.func,
507
625
  /**
508
626
  * Optional host-styled renderer for the handshake-timeout failure state
509
627
  * (the app is not embeddable / could not load), `() => ReactNode`. Falls
510
628
  * back to a minimal centered message.
511
629
  */
512
- renderTimeout: w.func
630
+ renderTimeout: T.func
513
631
  };
514
- const ge = W.div`
632
+ const Ce = D.div`
515
633
  position: fixed;
516
634
  inset: 0;
517
635
  background: rgba(0, 0, 0, 0.45);
@@ -519,7 +637,7 @@ const ge = W.div`
519
637
  align-items: center;
520
638
  justify-content: center;
521
639
  z-index: 10000;
522
- `, he = W.div`
640
+ `, ze = D.div`
523
641
  background: #fff;
524
642
  border-radius: 8px;
525
643
  box-shadow: 0 4px 24px rgba(0, 0, 0, 0.2);
@@ -528,13 +646,13 @@ const ge = W.div`
528
646
  max-width: calc(100vw - 32px);
529
647
  font-family: sans-serif;
530
648
  color: #222;
531
- `, be = W.div`
649
+ `, Me = D.div`
532
650
  display: flex;
533
651
  align-items: center;
534
652
  justify-content: space-between;
535
653
  padding: 10px 0;
536
654
  gap: 16px;
537
- `, Ee = W.button`
655
+ `, Le = D.button`
538
656
  background: #16a500;
539
657
  color: #fff;
540
658
  border: none;
@@ -543,25 +661,27 @@ const ge = W.div`
543
661
  font-size: 14px;
544
662
  cursor: pointer;
545
663
  white-space: nowrap;
546
- `, we = W.p`
664
+ `, Oe = D.p`
547
665
  color: #b3261e;
548
666
  font-size: 13px;
549
667
  margin: 4px 0 0;
550
- `, ke = () => {
551
- const { pending: n, authorize: o } = re();
552
- return n.length === 0 ? null : /* @__PURE__ */ f.createElement(ge, null, /* @__PURE__ */ f.createElement(he, null, /* @__PURE__ */ f.createElement("h3", { style: { margin: "0 0 8px" } }, "Authorization Required"), /* @__PURE__ */ f.createElement("p", { style: { margin: "0 0 12px", fontSize: 14, color: "#555" } }, "The following apps need you to sign in and authorize them before they can load."), n.map((s) => /* @__PURE__ */ f.createElement("div", { key: s.origin }, /* @__PURE__ */ f.createElement(be, null, /* @__PURE__ */ f.createElement("div", null, /* @__PURE__ */ f.createElement("div", { style: { fontWeight: 600 } }, s.origin)), /* @__PURE__ */ f.createElement(Ee, { onClick: () => o(s) }, "Authorize")), s.popupBlocked && /* @__PURE__ */ f.createElement(we, null, "The sign-in window was blocked. Allow popups for this site, then try again.")))));
668
+ `, Se = () => {
669
+ const { pending: r, authorize: i } = ge();
670
+ return r.length === 0 ? null : /* @__PURE__ */ h.createElement(Ce, null, /* @__PURE__ */ h.createElement(ze, null, /* @__PURE__ */ h.createElement("h3", { style: { margin: "0 0 8px" } }, "Authorization Required"), /* @__PURE__ */ h.createElement("p", { style: { margin: "0 0 12px", fontSize: 14, color: "#555" } }, "The following apps need you to sign in and authorize them before they can load."), r.map((c) => /* @__PURE__ */ h.createElement("div", { key: c.origin }, /* @__PURE__ */ h.createElement(Me, null, /* @__PURE__ */ h.createElement("div", null, /* @__PURE__ */ h.createElement("div", { style: { fontWeight: 600 } }, c.origin)), /* @__PURE__ */ h.createElement(Le, { onClick: () => i(c) }, "Authorize")), c.popupBlocked && /* @__PURE__ */ h.createElement(Oe, null, "The sign-in window was blocked. Allow popups for this site, then try again.")))));
553
671
  };
554
672
  export {
555
- D as EmbeddedAuthorizationContext,
556
- ke as EmbeddedAuthorizationPrompt,
557
- me as MMEmbeddableZone,
558
- H as MMEmbeddableZoneContext,
559
- ce as MMEmbeddableZoneProvider,
560
- te as isCrossSite,
561
- ne as popupAuthorizationLauncher,
562
- re as useEmbeddedAuthorizations,
563
- ie as useEmbeddedCredential,
564
- v as useEmbeddedEffect,
565
- se as useEmbeddedOriginEpoch,
566
- oe as useEmbeddedUnsupported
673
+ le as CREDENTIAL_KIND_ACCESS_TOKEN,
674
+ J as EmbeddedAuthorizationContext,
675
+ Se as EmbeddedAuthorizationPrompt,
676
+ Ue as MMEmbeddableZone,
677
+ Y as MMEmbeddableZoneContext,
678
+ Ee as MMEmbeddableZoneProvider,
679
+ fe as isCrossSite,
680
+ te as normalizeCredential,
681
+ pe as popupAuthorizationLauncher,
682
+ ge as useEmbeddedAuthorizations,
683
+ he as useEmbeddedCredential,
684
+ V as useEmbeddedEffect,
685
+ me as useEmbeddedOriginEpoch,
686
+ be as useEmbeddedUnsupported
567
687
  };