@nevermined-io/ui-widgets 0.5.11 → 0.5.13

package/dist/event-emitter.d.ts

@@ -0,0 +1,11 @@
+type EventHandler<T> = (payload: T) => void;
+export declare class TypedEventEmitter<Events extends object> {
+    private listeners;
+    on<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
+    off<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
+    once<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
+    removeAllListeners(event?: keyof Events): this;
+    emit<K extends keyof Events>(event: K, payload: Events[K]): void;
+}
+export {};
+//# sourceMappingURL=event-emitter.d.ts.map

package/dist/event-emitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-emitter.d.ts","sourceRoot":"","sources":["../src/event-emitter.ts"],"names":[],"mappings":"AAAA,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,CAAA;AAE3C,qBAAa,iBAAiB,CAAC,MAAM,SAAS,MAAM;IAClD,OAAO,CAAC,SAAS,CAAsD;IAEvE,EAAE,CAAC,CAAC,SAAS,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAO5E,GAAG,CAAC,CAAC,SAAS,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAS7E,IAAI,CAAC,CAAC,SAAS,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAS9E,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI;IAS9C,IAAI,CAAC,CAAC,SAAS,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI;CAWjE"}

package/dist/iframe-manager.d.ts

@@ -0,0 +1,44 @@
+import { type WidgetMessage } from './messages.js';
+export interface IframeOptions {
+    container?: HTMLElement;
+    style?: Partial<CSSStyleDeclaration>;
+    /**
+     * Fixed CSS width for inline (container) mode. #1668: the widget renders
+     * as a fixed-size box, like a Privy UI component, so the integrator can
+     * place it predictably on their page. Clamped to
+     * `[INLINE_MIN_WIDTH, INLINE_MAX_WIDTH]`. Default: `INLINE_DEFAULT_WIDTH`
+     * — the constants are the single source of truth, so future re-tunings
+     * don't require touching this JSDoc. Ignored in fullscreen overlay mode.
+     */
+    width?: number;
+    /**
+     * Fixed CSS height for inline mode. Clamped to
+     * `[INLINE_MIN_HEIGHT, INLINE_MAX_HEIGHT]`. Default: `INLINE_DEFAULT_HEIGHT`.
+     * The embed content uses responsive CSS to adapt to the dimensions the
+     * integrator picks — within the clamped range — without distorting (no
+     * CSS transform scale). Ignored in fullscreen overlay mode.
+     */
+    height?: number;
+}
+export declare const INLINE_MIN_WIDTH = 440;
+export declare const INLINE_MAX_WIDTH = 720;
+export declare const INLINE_DEFAULT_WIDTH = 480;
+export declare const INLINE_MIN_HEIGHT = 640;
+export declare const INLINE_MAX_HEIGHT = 960;
+export declare const INLINE_DEFAULT_HEIGHT = 720;
+export declare class IframeManager {
+    private expectedOrigin;
+    private iframe;
+    private messageHandlers;
+    private protocolErrorHandlers;
+    private messageListener;
+    private destroyed;
+    constructor(expectedOrigin: string);
+    create(url: string, options?: IframeOptions): HTMLIFrameElement;
+    destroy(): void;
+    postMessage(msg: WidgetMessage): void;
+    onMessage(handler: (msg: WidgetMessage) => void): () => void;
+    onProtocolError(handler: (reason: string) => void): () => void;
+    private ensureListener;
+}
+//# sourceMappingURL=iframe-manager.d.ts.map

package/dist/iframe-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframe-manager.d.ts","sourceRoot":"","sources":["../src/iframe-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AAEhE,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACpC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AASD,eAAO,MAAM,gBAAgB,MAAM,CAAA;AACnC,eAAO,MAAM,gBAAgB,MAAM,CAAA;AACnC,eAAO,MAAM,oBAAoB,MAAM,CAAA;AACvC,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAMxC,qBAAa,aAAa;IAOZ,OAAO,CAAC,cAAc;IANlC,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,eAAe,CAA0C;IACjE,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,eAAe,CAA+C;IACtE,OAAO,CAAC,SAAS,CAAQ;gBAEL,cAAc,EAAE,MAAM;IAQ1C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,iBAAiB;IAiD/D,OAAO,IAAI,IAAI;IAYf,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI;IAKrC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI;IAO5D,eAAe,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAO9D,OAAO,CAAC,cAAc;CAiCvB"}

package/dist/index.d.ts

@@ -1,580 +1,14 @@
-/**
- * Emitted (via the per-widget `onAuthMismatch` callback) when the iframe
- * detects a live host Privy session whose email does not match the email
- * the widget session was minted for. The iframe renders a two-button prompt
- * (continue as the host identity, or switch to the widget-session identity
- * by signing out of Privy inside the iframe) and the host page is informed
- * so it can mirror that affordance on its own UI. The widget is effectively
- * halted until either button is clicked or the host re-mints a widget
- * session via the action below.
- */
-export declare interface AuthMismatchDetail {
-    /** Email the widget session was minted for (normalized — trimmed, lower-cased). */
-    expectedEmail: string;
-}
-
-/**
- * Emitted (via the per-widget `onAuthSwitchRequest` callback) when the user
- * picks "Continue as <hostEmail>" on the mismatch prompt. The host page is
- * expected to re-mint a widget session bound to `requestedEmail` and reopen
- * the widget; the iframe stays on the prompt until that happens.
- *
- * **Security note for integrators:** the SDK posts this event to the host
- * via `window.postMessage`, but the host's `window.addEventListener('message',
- * ...)` listens to ALL frames on the page. Validate `event.origin === <your
- * widget host>` (e.g. `https://app.nevermined.io`) before re-minting a
- * session — otherwise a malicious sub-frame could spoof this event and
- * trick your backend into minting a session for an attacker-supplied email.
- */
-export declare interface AuthSwitchRequestDetail {
-    /** Email the user wants the widget to operate under (their live Privy identity). */
-    requestedEmail: string;
-    /** Email the original widget session was minted for, for reference / telemetry. */
-    expectedEmail: string;
-}
-
-export declare interface CardAction {
-    /**
-     * `delegate` — the user asked to create a delegation for this card (host
-     * should mount `createDelegation`). `revoked` — the user removed this card
-     * inline; the list iframe stays open so this is an intra-flow event, not
-     * flow completion (which is why it is NOT an `nvm:success`). See #1411.
-     */
-    action: 'delegate' | 'revoked';
-    paymentMethodId: string;
-}
-
-export declare interface CheckoutOptions {
-    did: string;
-    planId?: string;
-    container?: HTMLElement;
-    /**
-     * Fixed iframe width in pixels. Clamped by the SDK to a supported range
-     * (see `INLINE_MIN_WIDTH` / `INLINE_MAX_WIDTH` / `INLINE_DEFAULT_WIDTH`
-     * in `iframe-manager`). Ignored in fullscreen overlay mode (no container).
-     */
-    width?: number;
-    /**
-     * Fixed iframe height in pixels. Clamped by the SDK to a supported range
-     * (see `INLINE_MIN_HEIGHT` / `INLINE_MAX_HEIGHT` / `INLINE_DEFAULT_HEIGHT`
-     * in `iframe-manager`). Ignored in fullscreen overlay mode.
-     */
-    height?: number;
-    onBooted?: () => void;
-    onReady?: () => void;
-    /**
-     * Fires when the iframe posts `nvm:success`. The widget stays mounted in
-     * its success state — the integrator dismisses it via `event.handle.close()`
-     * when their own post-success flow is ready. There is no auto-dismiss.
-     */
-    onSuccess?: (event: WidgetSuccessEvent<CheckoutResult>) => void;
-    onError?: (error: EmbedError) => void;
-    /**
-     * Fires when the iframe detects that the live host Privy session belongs
-     * to a different account than the email the widget session was minted for.
-     * The iframe stays mounted on a two-button prompt; the host can mirror that
-     * affordance on its own UI. See `AuthMismatchDetail`.
-     */
-    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
-    /**
-     * Fires when, on the mismatch prompt, the user picks "Continue as
-     * <hostEmail>". The host should re-mint a widget session bound to
-     * `requestedEmail` and reopen the widget. The iframe stays on the prompt
-     * until then. See `AuthSwitchRequestDetail`.
-     */
-    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
-    onClose?: () => void;
-}
-
-export declare interface CheckoutResult {
-    did: string;
-    planId?: string;
-    txHash?: string;
-}
-
-/**
- * Checkout widget.
- *
- * Lifecycle note for SDK consumers: when the iframe sends `nvm:close` the
- * widget instance auto-calls `destroy()` and becomes terminal — any
- * subsequent `start()` call throws. If the host page needs to re-show the
- * checkout after a close, construct a new `CheckoutWidget` (typically via
- * `nvm.checkout`) and call `start()` on the fresh instance.
- */
-export declare class CheckoutWidget {
-    private readonly session;
-    private readonly webappBase;
-    private manager;
-    private destroyed;
-    constructor(session: SessionManager, webappBase: string);
-    /**
-     * Mounts the checkout iframe into `options.container`.
-     * Throws if called after `destroy()` (including the implicit destroy on
-     * `nvm:close` — see class JSDoc).
-     */
-    start(options: CheckoutOptions): void;
-    /**
-     * Mounts a plan-only checkout iframe (no agent DID required).
-     * Throws if called after `destroy()` (including the implicit destroy on
-     * `nvm:close` — see class JSDoc).
-     */
-    startPlan(options: PlanCheckoutOptions): void;
-    destroy(): void;
-    /**
-     * Shared close path for `handle.close()` (integrator-driven) and
-     * `nvm:close` (iframe-driven). Idempotent — multiple calls collapse to a
-     * single `onClose` + destroy, which matters because `handle.close()`
-     * could race with a `nvm:close` from the iframe if the integrator's
-     * post-success UI happens to mount instantly.
-     *
-     * `manager` is the IframeManager this close was bound to when the handle
-     * was minted. A stale handle from a previous mount (the instance was
-     * remounted via a second `start()` without an intervening close) must NOT
-     * tear down the now-live iframe, so we bail once it no longer owns
-     * `this.manager`.
-     *
-     * Ordering is load-bearing: `destroy()` runs before `onClose()` so a
-     * throwing `onClose` cannot leak a second close — `destroyed` is already
-     * true by the time the callback runs.
-     */
-    private closeFromIframe;
-    private buildSuccessHandle;
-    private mount;
-    private handleMessage;
-}
-
-export declare interface CreateDelegationOptions {
-    paymentMethodId: string;
-    container?: HTMLElement;
-    /** See `CheckoutOptions.width`. */
-    width?: number;
-    /** See `CheckoutOptions.height`. */
-    height?: number;
-    onBooted?: () => void;
-    onReady?: () => void;
-    /** See `CheckoutOptions.onSuccess`. */
-    onSuccess?: (event: WidgetSuccessEvent<CreateDelegationResult>) => void;
-    onError?: (error: EmbedError) => void;
-    /** See `CheckoutOptions.onAuthMismatch`. */
-    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
-    /** See `CheckoutOptions.onAuthSwitchRequest`. */
-    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
-    onClose?: () => void;
-}
-
-export declare interface CreateDelegationResult {
-    delegationId: string;
-    paymentMethodId: string;
-}
-
-export declare function createMessage<T>(type: WidgetMessageType, payload?: T): WidgetMessage<T>;
-
-/**
- * Card and delegation management widget.
- *
- * Surfaces three iframe-based flows (enrollment, listing, delegation creation)
- * and two SDK-direct revocations. The three iframe flows share the single
- * `manager` slot — calling any of them destroys the previously-mounted iframe
- * (same semantics as calling `enrollCard()` twice). Once any iframe is closed
- * by the user (`nvm:close`), the instance is implicitly destroyed and any
- * subsequent iframe call throws. Construct a fresh widget (via
- * `nvm.delegations`) to mount another flow after a close.
- *
- * The two `revoke*` methods do NOT use an iframe — they hit the
- * `/api/v1/widgets/...` endpoints directly with the widget session token.
- * They exist because the SDK consumer on the host page only holds the widget
- * session token; the apiKeyHash that gates the standard delegation/payment
- * endpoints never leaves the embedded iframe.
- */
-export declare class DelegationsWidget {
-    private readonly session;
-    private readonly webappBase;
-    private readonly apiBase;
-    private manager;
-    private destroyed;
-    constructor(session: SessionManager, webappBase: string, apiBase: string);
-    /**
-     * Mounts the enrollment iframe at `/embed/cards/enroll`.
-     * Throws if called after `destroy()` (including the implicit destroy on
-     * `nvm:close` — see class JSDoc).
-     */
-    enrollCard(options: EnrollCardOptions): void;
-    /**
-     * Mounts the cards-list iframe at `/embed/cards/list`. Per-row actions
-     * ("Create Delegation" → `'delegate'`, "Remove Card" → `'revoked'`) are
-     * forwarded via `onCardAction` so the host can react (mount a follow-up
-     * widget, refresh its own list, etc.). See `CardAction`.
-     */
-    listCards(options: ListCardsOptions): void;
-    /**
-     * Mounts the delegation creation iframe at `/embed/cards/delegate` for a
-     * specific payment method. The `paymentMethodId` is required and is passed
-     * as a search param so the embed route can scope the form to that card.
-     */
-    createDelegation(options: CreateDelegationOptions): void;
-    /**
-     * Revoke (detach) a payment method via the widget-prefixed API endpoint.
-     * Resolves on 2xx; throws `WidgetApiError` on any other response or
-     * network failure.
-     */
-    revokeCard(paymentMethodId: string): Promise<void>;
-    /**
-     * Revoke a delegation via the widget-prefixed API endpoint.
-     * Resolves on 2xx; throws `WidgetApiError` on any other response or
-     * network failure.
-     */
-    revokeDelegation(delegationId: string): Promise<void>;
-    destroy(): void;
-    private assertAlive;
-    private mountIframe;
-    private postInitOnBooted;
-    private handleEnrollMessage;
-    private handleListMessage;
-    private handleCreateDelegationMessage;
-    /**
-     * #1668: shared close path for `handle.close()` (integrator-driven) and
-     * `nvm:close` (iframe-driven). Idempotent so a race between the
-     * integrator dismissing the widget and the iframe emitting CLOSE
-     * collapses to a single `onClose` + destroy. Generic over the three
-     * options shapes — only `onClose` is referenced.
-     *
-     * `manager` is the IframeManager this close was bound to when the handle
-     * was minted. The three iframe flows share the single `manager` slot, so a
-     * stale handle from an earlier flow (e.g. an uncalled `enrollCard` success
-     * handle held past a later `createDelegation`) must NOT tear down the
-     * now-live iframe — we bail once it no longer owns `this.manager`.
-     *
-     * Ordering is load-bearing: `destroy()` runs before `onClose()` so a
-     * throwing `onClose` cannot leak a second close — `destroyed` is already
-     * true by the time the callback runs.
-     */
-    private closeFromIframe;
-    private buildSuccessHandle;
-    private deleteWithSession;
-}
-
-export declare interface EmbedError {
-    code: 'UNAUTHORIZED' | 'NETWORK' | 'PAYMENT_NOT_CONFIRMED' | 'UNKNOWN';
-    /**
-     * Raw, host-facing message. Carries the underlying detail (e.g. the backend
-     * `NVMException.message`) and is what the SDK forwards over the `nvm:error`
-     * postMessage for the integrator to log. May contain operational/technical
-     * text, so it is NOT safe to render in an end-user surface verbatim.
-     */
-    message: string;
-    /**
-     * Safe, user-facing message. Generic per-`code` copy with no operational
-     * detail — render this (falling back to `message`) in any UI shown to the
-     * end user, such as the widgets' terminal error panels. Optional and
-     * additive: existing host integrations that only read `message` are
-     * unaffected.
-     */
-    userMessage?: string;
-    status?: number;
-    apiCode?: string;
-}
-
-export declare interface EnrollCardOptions {
-    container?: HTMLElement;
-    /** See `CheckoutOptions.width`. */
-    width?: number;
-    /** See `CheckoutOptions.height`. */
-    height?: number;
-    /** See `EnrollCardProvider`. Defaults to `'stripe'`. */
-    provider?: EnrollCardProvider;
-    onBooted?: () => void;
-    onReady?: () => void;
-    /** See `CheckoutOptions.onSuccess`. */
-    onSuccess?: (event: WidgetSuccessEvent<EnrollCardResult>) => void;
-    onError?: (error: EmbedError) => void;
-    /** See `CheckoutOptions.onAuthMismatch`. */
-    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
-    /** See `CheckoutOptions.onAuthSwitchRequest`. */
-    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
-    onClose?: () => void;
-}
-
-/**
- * #1668 sub-task 2: which tokenization flow renders inside the embedded
- * enrol-card iframe.
- *
- * - `'stripe'` (default): Stripe Elements + SetupIntent. The existing flow.
- * - `'braintree'`: Braintree Drop-in (PayPal vault).
- * - `'visa'`: Visa Agentic Tokens via VGS Collect → CMP. **Requires an
- *   HTTPS parent page** — the Visa VTS iframe enforces
- *   `frame-ancestors 'self' https:` so a non-HTTPS host (e.g. plain
- *   `http://localhost`) cannot embed this provider.
- */
-export declare type EnrollCardProvider = 'stripe' | 'braintree' | 'visa';
-
-export declare interface EnrollCardResult {
-    paymentMethodId: string;
-}
-
-export declare type Environment = (typeof ENVIRONMENTS)[number];
-
-declare const ENVIRONMENTS: readonly ["local", "sandbox", "live", "staging_sandbox", "staging_live"];
-
-declare type EventHandler<T> = (payload: T) => void;
-
-export declare class IframeManager {
-    private expectedOrigin;
-    private iframe;
-    private messageHandlers;
-    private protocolErrorHandlers;
-    private messageListener;
-    private destroyed;
-    constructor(expectedOrigin: string);
-    create(url: string, options?: IframeOptions): HTMLIFrameElement;
-    destroy(): void;
-    postMessage(msg: WidgetMessage): void;
-    onMessage(handler: (msg: WidgetMessage) => void): () => void;
-    onProtocolError(handler: (reason: string) => void): () => void;
-    private ensureListener;
-}
-
-export declare interface IframeOptions {
-    container?: HTMLElement;
-    style?: Partial<CSSStyleDeclaration>;
-    /**
-     * Fixed CSS width for inline (container) mode. #1668: the widget renders
-     * as a fixed-size box, like a Privy UI component, so the integrator can
-     * place it predictably on their page. Clamped to
-     * `[INLINE_MIN_WIDTH, INLINE_MAX_WIDTH]`. Default: `INLINE_DEFAULT_WIDTH`
-     * — the constants are the single source of truth, so future re-tunings
-     * don't require touching this JSDoc. Ignored in fullscreen overlay mode.
-     */
-    width?: number;
-    /**
-     * Fixed CSS height for inline mode. Clamped to
-     * `[INLINE_MIN_HEIGHT, INLINE_MAX_HEIGHT]`. Default: `INLINE_DEFAULT_HEIGHT`.
-     * The embed content uses responsive CSS to adapt to the dimensions the
-     * integrator picks — within the clamped range — without distorting (no
-     * CSS transform scale). Ignored in fullscreen overlay mode.
-     */
-    height?: number;
-}
-
-export declare interface ListCardsOptions {
-    container?: HTMLElement;
-    /** See `CheckoutOptions.width`. */
-    width?: number;
-    /** See `CheckoutOptions.height`. */
-    height?: number;
-    onBooted?: () => void;
-    onReady?: () => void;
-    onCardAction?: (action: CardAction) => void;
-    onError?: (error: EmbedError) => void;
-    /** See `CheckoutOptions.onAuthMismatch`. */
-    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
-    /** See `CheckoutOptions.onAuthSwitchRequest`. */
-    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
-    onClose?: () => void;
-}
-
-export declare class NeverminedWidgets {
-    private readonly sessionManager;
-    private readonly _account;
-    private readonly environment;
-    private _checkout;
-    private _delegations;
-    private readonly events;
-    private constructor();
-    static initialize(config: WidgetConfig): Promise<NeverminedWidgets>;
-    private refreshSession;
-    on<K extends keyof NeverminedWidgetsEvents>(event: K, handler: (payload: NeverminedWidgetsEvents[K]) => void): this;
-    off<K extends keyof NeverminedWidgetsEvents>(event: K, handler: (payload: NeverminedWidgetsEvents[K]) => void): this;
-    get account(): WidgetAccount;
-    get hasValidSession(): boolean;
-    getSessionToken(): string;
-    get checkout(): CheckoutWidget;
-    get delegations(): DelegationsWidget;
-    /**
-     * Resets the parent widget container: tears down any live child widget (e.g.
-     * the checkout widget) and clears the internal cache. This is a reset, not a
-     * terminal state — accessing `widget.checkout` after `destroy()` lazily
-     * creates a fresh `CheckoutWidget` instance. If you need a terminal "this
-     * widget can no longer be used" semantics, call `destroy()` on the child
-     * widget directly (e.g. `widget.checkout.destroy()`), which flips its
-     * internal `destroyed` flag and makes subsequent `start()` calls throw.
-     */
-    destroy(): void;
-}
-
-declare interface NeverminedWidgetsEvents {
-    'session-expired': void;
-}
-
-export declare function parseMessage(data: unknown): ParseResult;
-
-export declare type ParseResult<T = unknown> = {
-    ok: true;
-    message: WidgetMessage<T>;
-} | {
-    ok: false;
-    reason: string;
-};
-
-declare interface PlanCheckoutOptions {
-    planId: string;
-    container?: HTMLElement;
-    width?: number;
-    height?: number;
-    onBooted?: () => void;
-    onReady?: () => void;
-    onSuccess?: (event: WidgetSuccessEvent<PlanCheckoutResult>) => void;
-    onError?: (error: EmbedError) => void;
-    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
-    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
-    onClose?: () => void;
-}
-
-declare interface PlanCheckoutResult {
-    planId: string;
-    txHash?: string;
-}
-
-export declare class SessionManager {
-    private session;
-    private expiresMs;
-    private timer;
-    constructor(session: WidgetSession);
-    isValid(): boolean;
-    getToken(): string;
-    getSession(): WidgetSession;
-    startAutoRefresh(refreshFn: () => Promise<WidgetSession>, onExpired: () => void): void;
-    stopAutoRefresh(): void;
-}
-
-export declare class TypedEventEmitter<Events extends object> {
-    private listeners;
-    on<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
-    off<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
-    once<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
-    removeAllListeners(event?: keyof Events): this;
-    emit<K extends keyof Events>(event: K, payload: Events[K]): void;
-}
-
-declare const WIDGET_ERRORS: {
-    readonly MISSING_SESSION: {
-        readonly numericCode: "WDG.0001";
-        readonly message: "session is required — pass the WidgetSession returned by createWidgetSession on the backend";
-    };
-    readonly INVALID_ENVIRONMENT: {
-        readonly numericCode: "WDG.0002";
-        readonly message: "environment must be one of: sandbox, live, staging_sandbox, staging_live, local";
-    };
-    readonly INVALID_SESSION: {
-        readonly numericCode: "WDG.0003";
-        readonly message: "session is missing required fields";
-    };
-    readonly SESSION_EXPIRED: {
-        readonly numericCode: "WDG.0006";
-        readonly message: "Widget session has expired";
-    };
-};
-
-export declare const WIDGET_MESSAGE_VERSION: "1";
-
-export declare interface WidgetAccount {
-    userId: string;
-    userWallet: `0x${string}`;
-}
-
-/**
- * Thrown by SDK methods that hit the API directly (no iframe), e.g.
- * `delegations.revokeCard()` / `delegations.revokeDelegation()`. Carries the
- * HTTP status and the optional BCK error code so consumers can branch on
- * 401/403/etc. without parsing the message.
- */
-export declare class WidgetApiError extends Error {
-    readonly status?: number | undefined;
-    readonly apiCode?: string | undefined;
-    constructor(message: string, status?: number | undefined, apiCode?: string | undefined);
-}
-
-export declare interface WidgetConfig {
-    /**
-     * Widget session minted server-to-server by the integrator backend
-     * (typically via `@nevermined-io/ui-widgets-server.createWidgetSession`).
-     * Forward the response object verbatim — the SDK never holds the widget
-     * key `rawSecret`.
-     */
-    session: WidgetSession;
-    environment: Environment;
-}
-
-declare type WidgetErrorCode = keyof typeof WIDGET_ERRORS;
-
-export declare class WidgetInitError extends Error {
-    readonly code: WidgetErrorCode;
-    constructor(code: WidgetErrorCode, message?: string, cause?: unknown);
-}
-
-export declare interface WidgetMessage<T = unknown> {
-    type: WidgetMessageType;
-    version: '1';
-    payload?: T;
-}
-
-export declare enum WidgetMessageType {
-    INIT = "nvm:init",
-    CLOSE = "nvm:close",
-    BOOTED = "nvm:booted",
-    READY = "nvm:ready",
-    RESIZE = "nvm:resize",
-    SUCCESS = "nvm:success",
-    ERROR = "nvm:error",
-    CARD_ACTION = "nvm:card-action",
-    AUTH_MISMATCH = "nvm:auth-mismatch",
-    AUTH_SWITCH_REQUEST = "nvm:auth-switch-request"
-}
-
-export declare interface WidgetSession {
-    sessionToken: string;
-    userId: string;
-    userWallet: `0x${string}`;
-    /**
-     * Hash of the NVM API key bound to this widget session user. Returned by
-     * `POST /api/v1/widgets/session` so host pages that want to call user-scoped
-     * endpoints directly (outside the iframe) have the bearer token to do so.
-     * The embedded iframe flow consumes it via the session JWT claims rather
-     * than this field.
-     */
-    apiKeyHash: string;
-    expiresAt: string;
-}
-
-export declare class WidgetSessionExpiredError extends Error {
-    readonly code: "SESSION_EXPIRED";
-    constructor();
-}
-
-/**
- * Payload shape passed to every widget's `onSuccess` callback. `result`
- * is the per-widget data (paymentMethodId, delegationId, etc.); `handle`
- * lets the integrator dismiss the widget on their own schedule.
- */
-export declare interface WidgetSuccessEvent<T> {
-    result: T;
-    handle: WidgetSuccessHandle;
-}
-
-/**
- * Control surface passed to every widget's `onSuccess` callback (#1668
- * sub-tasks 3 + 4). The iframe stays mounted indefinitely after a
- * successful action so the integrator can show their own post-action UI
- * (toast, next-step prompt, etc.) while the success state remains visible
- * inside the widget. The integrator dismisses the widget by calling
- * `handle.close()` — which destroys the iframe and invokes `onClose` —
- * whenever their own flow is ready.
- */
-export declare interface WidgetSuccessHandle {
-    /**
-     * Destroys the iframe and invokes the widget's `onClose` callback.
-     * Idempotent: calling close on an already-closed widget is a no-op.
-     */
-    close(): void;
-}
-
-export { }
+export { NeverminedWidgets } from './nevermined-widgets.js';
+export { SessionManager } from './session.js';
+export { IframeManager } from './iframe-manager.js';
+export { CheckoutWidget } from './widgets/checkout.js';
+export { DelegationsWidget } from './widgets/delegations.js';
+export { TypedEventEmitter } from './event-emitter.js';
+export { WidgetMessageType, WIDGET_MESSAGE_VERSION, createMessage, parseMessage, } from './messages.js';
+export { WidgetApiError, WidgetInitError, WidgetSessionExpiredError } from './utils/errors.js';
+export type { WidgetConfig, WidgetSession, WidgetAccount, Environment, EmbedError, WidgetSuccessHandle, WidgetSuccessEvent, } from './types.js';
+export type { IframeOptions } from './iframe-manager.js';
+export type { CheckoutOptions, CheckoutResult } from './widgets/checkout.js';
+export type { CardAction, CreateDelegationOptions, CreateDelegationResult, EnrollCardOptions, EnrollCardProvider, EnrollCardResult, ListCardsOptions, } from './widgets/delegations.js';
+export type { WidgetMessage, ParseResult } from './messages.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAC9F,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC5E,YAAY,EACV,UAAU,EACV,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA"}