@nevermined-io/ui-widgets 0.5.9 → 0.5.11

package/dist/index.d.ts

@@ -1,14 +1,580 @@
-export { NeverminedWidgets } from './nevermined-widgets.js';
-export { SessionManager } from './session.js';
-export { IframeManager } from './iframe-manager.js';
-export { CheckoutWidget } from './widgets/checkout.js';
-export { DelegationsWidget } from './widgets/delegations.js';
-export { TypedEventEmitter } from './event-emitter.js';
-export { WidgetMessageType, WIDGET_MESSAGE_VERSION, createMessage, parseMessage, } from './messages.js';
-export { WidgetApiError, WidgetInitError, WidgetSessionExpiredError } from './utils/errors.js';
-export type { WidgetConfig, WidgetSession, WidgetAccount, Environment, EmbedError, AuthMismatchDetail, AuthSwitchRequestDetail, WidgetSuccessHandle, WidgetSuccessEvent, } from './types.js';
-export type { IframeOptions } from './iframe-manager.js';
-export type { CheckoutOptions, CheckoutResult } from './widgets/checkout.js';
-export type { CardAction, CreateDelegationOptions, CreateDelegationResult, EnrollCardOptions, EnrollCardProvider, EnrollCardResult, ListCardsOptions, } from './widgets/delegations.js';
-export type { WidgetMessage, ParseResult } from './messages.js';
-//# sourceMappingURL=index.d.ts.map
+/**
+ * Emitted (via the per-widget `onAuthMismatch` callback) when the iframe
+ * detects a live host Privy session whose email does not match the email
+ * the widget session was minted for. The iframe renders a two-button prompt
+ * (continue as the host identity, or switch to the widget-session identity
+ * by signing out of Privy inside the iframe) and the host page is informed
+ * so it can mirror that affordance on its own UI. The widget is effectively
+ * halted until either button is clicked or the host re-mints a widget
+ * session via the action below.
+ */
+export declare interface AuthMismatchDetail {
+    /** Email the widget session was minted for (normalized — trimmed, lower-cased). */
+    expectedEmail: string;
+}
+
+/**
+ * Emitted (via the per-widget `onAuthSwitchRequest` callback) when the user
+ * picks "Continue as <hostEmail>" on the mismatch prompt. The host page is
+ * expected to re-mint a widget session bound to `requestedEmail` and reopen
+ * the widget; the iframe stays on the prompt until that happens.
+ *
+ * **Security note for integrators:** the SDK posts this event to the host
+ * via `window.postMessage`, but the host's `window.addEventListener('message',
+ * ...)` listens to ALL frames on the page. Validate `event.origin === <your
+ * widget host>` (e.g. `https://app.nevermined.io`) before re-minting a
+ * session — otherwise a malicious sub-frame could spoof this event and
+ * trick your backend into minting a session for an attacker-supplied email.
+ */
+export declare interface AuthSwitchRequestDetail {
+    /** Email the user wants the widget to operate under (their live Privy identity). */
+    requestedEmail: string;
+    /** Email the original widget session was minted for, for reference / telemetry. */
+    expectedEmail: string;
+}
+
+export declare interface CardAction {
+    /**
+     * `delegate` — the user asked to create a delegation for this card (host
+     * should mount `createDelegation`). `revoked` — the user removed this card
+     * inline; the list iframe stays open so this is an intra-flow event, not
+     * flow completion (which is why it is NOT an `nvm:success`). See #1411.
+     */
+    action: 'delegate' | 'revoked';
+    paymentMethodId: string;
+}
+
+export declare interface CheckoutOptions {
+    did: string;
+    planId?: string;
+    container?: HTMLElement;
+    /**
+     * Fixed iframe width in pixels. Clamped by the SDK to a supported range
+     * (see `INLINE_MIN_WIDTH` / `INLINE_MAX_WIDTH` / `INLINE_DEFAULT_WIDTH`
+     * in `iframe-manager`). Ignored in fullscreen overlay mode (no container).
+     */
+    width?: number;
+    /**
+     * Fixed iframe height in pixels. Clamped by the SDK to a supported range
+     * (see `INLINE_MIN_HEIGHT` / `INLINE_MAX_HEIGHT` / `INLINE_DEFAULT_HEIGHT`
+     * in `iframe-manager`). Ignored in fullscreen overlay mode.
+     */
+    height?: number;
+    onBooted?: () => void;
+    onReady?: () => void;
+    /**
+     * Fires when the iframe posts `nvm:success`. The widget stays mounted in
+     * its success state — the integrator dismisses it via `event.handle.close()`
+     * when their own post-success flow is ready. There is no auto-dismiss.
+     */
+    onSuccess?: (event: WidgetSuccessEvent<CheckoutResult>) => void;
+    onError?: (error: EmbedError) => void;
+    /**
+     * Fires when the iframe detects that the live host Privy session belongs
+     * to a different account than the email the widget session was minted for.
+     * The iframe stays mounted on a two-button prompt; the host can mirror that
+     * affordance on its own UI. See `AuthMismatchDetail`.
+     */
+    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
+    /**
+     * Fires when, on the mismatch prompt, the user picks "Continue as
+     * <hostEmail>". The host should re-mint a widget session bound to
+     * `requestedEmail` and reopen the widget. The iframe stays on the prompt
+     * until then. See `AuthSwitchRequestDetail`.
+     */
+    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
+    onClose?: () => void;
+}
+
+export declare interface CheckoutResult {
+    did: string;
+    planId?: string;
+    txHash?: string;
+}
+
+/**
+ * Checkout widget.
+ *
+ * Lifecycle note for SDK consumers: when the iframe sends `nvm:close` the
+ * widget instance auto-calls `destroy()` and becomes terminal — any
+ * subsequent `start()` call throws. If the host page needs to re-show the
+ * checkout after a close, construct a new `CheckoutWidget` (typically via
+ * `nvm.checkout`) and call `start()` on the fresh instance.
+ */
+export declare class CheckoutWidget {
+    private readonly session;
+    private readonly webappBase;
+    private manager;
+    private destroyed;
+    constructor(session: SessionManager, webappBase: string);
+    /**
+     * Mounts the checkout iframe into `options.container`.
+     * Throws if called after `destroy()` (including the implicit destroy on
+     * `nvm:close` — see class JSDoc).
+     */
+    start(options: CheckoutOptions): void;
+    /**
+     * Mounts a plan-only checkout iframe (no agent DID required).
+     * Throws if called after `destroy()` (including the implicit destroy on
+     * `nvm:close` — see class JSDoc).
+     */
+    startPlan(options: PlanCheckoutOptions): void;
+    destroy(): void;
+    /**
+     * Shared close path for `handle.close()` (integrator-driven) and
+     * `nvm:close` (iframe-driven). Idempotent — multiple calls collapse to a
+     * single `onClose` + destroy, which matters because `handle.close()`
+     * could race with a `nvm:close` from the iframe if the integrator's
+     * post-success UI happens to mount instantly.
+     *
+     * `manager` is the IframeManager this close was bound to when the handle
+     * was minted. A stale handle from a previous mount (the instance was
+     * remounted via a second `start()` without an intervening close) must NOT
+     * tear down the now-live iframe, so we bail once it no longer owns
+     * `this.manager`.
+     *
+     * Ordering is load-bearing: `destroy()` runs before `onClose()` so a
+     * throwing `onClose` cannot leak a second close — `destroyed` is already
+     * true by the time the callback runs.
+     */
+    private closeFromIframe;
+    private buildSuccessHandle;
+    private mount;
+    private handleMessage;
+}
+
+export declare interface CreateDelegationOptions {
+    paymentMethodId: string;
+    container?: HTMLElement;
+    /** See `CheckoutOptions.width`. */
+    width?: number;
+    /** See `CheckoutOptions.height`. */
+    height?: number;
+    onBooted?: () => void;
+    onReady?: () => void;
+    /** See `CheckoutOptions.onSuccess`. */
+    onSuccess?: (event: WidgetSuccessEvent<CreateDelegationResult>) => void;
+    onError?: (error: EmbedError) => void;
+    /** See `CheckoutOptions.onAuthMismatch`. */
+    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
+    /** See `CheckoutOptions.onAuthSwitchRequest`. */
+    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
+    onClose?: () => void;
+}
+
+export declare interface CreateDelegationResult {
+    delegationId: string;
+    paymentMethodId: string;
+}
+
+export declare function createMessage<T>(type: WidgetMessageType, payload?: T): WidgetMessage<T>;
+
+/**
+ * Card and delegation management widget.
+ *
+ * Surfaces three iframe-based flows (enrollment, listing, delegation creation)
+ * and two SDK-direct revocations. The three iframe flows share the single
+ * `manager` slot — calling any of them destroys the previously-mounted iframe
+ * (same semantics as calling `enrollCard()` twice). Once any iframe is closed
+ * by the user (`nvm:close`), the instance is implicitly destroyed and any
+ * subsequent iframe call throws. Construct a fresh widget (via
+ * `nvm.delegations`) to mount another flow after a close.
+ *
+ * The two `revoke*` methods do NOT use an iframe — they hit the
+ * `/api/v1/widgets/...` endpoints directly with the widget session token.
+ * They exist because the SDK consumer on the host page only holds the widget
+ * session token; the apiKeyHash that gates the standard delegation/payment
+ * endpoints never leaves the embedded iframe.
+ */
+export declare class DelegationsWidget {
+    private readonly session;
+    private readonly webappBase;
+    private readonly apiBase;
+    private manager;
+    private destroyed;
+    constructor(session: SessionManager, webappBase: string, apiBase: string);
+    /**
+     * Mounts the enrollment iframe at `/embed/cards/enroll`.
+     * Throws if called after `destroy()` (including the implicit destroy on
+     * `nvm:close` — see class JSDoc).
+     */
+    enrollCard(options: EnrollCardOptions): void;
+    /**
+     * Mounts the cards-list iframe at `/embed/cards/list`. Per-row actions
+     * ("Create Delegation" → `'delegate'`, "Remove Card" → `'revoked'`) are
+     * forwarded via `onCardAction` so the host can react (mount a follow-up
+     * widget, refresh its own list, etc.). See `CardAction`.
+     */
+    listCards(options: ListCardsOptions): void;
+    /**
+     * Mounts the delegation creation iframe at `/embed/cards/delegate` for a
+     * specific payment method. The `paymentMethodId` is required and is passed
+     * as a search param so the embed route can scope the form to that card.
+     */
+    createDelegation(options: CreateDelegationOptions): void;
+    /**
+     * Revoke (detach) a payment method via the widget-prefixed API endpoint.
+     * Resolves on 2xx; throws `WidgetApiError` on any other response or
+     * network failure.
+     */
+    revokeCard(paymentMethodId: string): Promise<void>;
+    /**
+     * Revoke a delegation via the widget-prefixed API endpoint.
+     * Resolves on 2xx; throws `WidgetApiError` on any other response or
+     * network failure.
+     */
+    revokeDelegation(delegationId: string): Promise<void>;
+    destroy(): void;
+    private assertAlive;
+    private mountIframe;
+    private postInitOnBooted;
+    private handleEnrollMessage;
+    private handleListMessage;
+    private handleCreateDelegationMessage;
+    /**
+     * #1668: shared close path for `handle.close()` (integrator-driven) and
+     * `nvm:close` (iframe-driven). Idempotent so a race between the
+     * integrator dismissing the widget and the iframe emitting CLOSE
+     * collapses to a single `onClose` + destroy. Generic over the three
+     * options shapes — only `onClose` is referenced.
+     *
+     * `manager` is the IframeManager this close was bound to when the handle
+     * was minted. The three iframe flows share the single `manager` slot, so a
+     * stale handle from an earlier flow (e.g. an uncalled `enrollCard` success
+     * handle held past a later `createDelegation`) must NOT tear down the
+     * now-live iframe — we bail once it no longer owns `this.manager`.
+     *
+     * Ordering is load-bearing: `destroy()` runs before `onClose()` so a
+     * throwing `onClose` cannot leak a second close — `destroyed` is already
+     * true by the time the callback runs.
+     */
+    private closeFromIframe;
+    private buildSuccessHandle;
+    private deleteWithSession;
+}
+
+export declare interface EmbedError {
+    code: 'UNAUTHORIZED' | 'NETWORK' | 'PAYMENT_NOT_CONFIRMED' | 'UNKNOWN';
+    /**
+     * Raw, host-facing message. Carries the underlying detail (e.g. the backend
+     * `NVMException.message`) and is what the SDK forwards over the `nvm:error`
+     * postMessage for the integrator to log. May contain operational/technical
+     * text, so it is NOT safe to render in an end-user surface verbatim.
+     */
+    message: string;
+    /**
+     * Safe, user-facing message. Generic per-`code` copy with no operational
+     * detail — render this (falling back to `message`) in any UI shown to the
+     * end user, such as the widgets' terminal error panels. Optional and
+     * additive: existing host integrations that only read `message` are
+     * unaffected.
+     */
+    userMessage?: string;
+    status?: number;
+    apiCode?: string;
+}
+
+export declare interface EnrollCardOptions {
+    container?: HTMLElement;
+    /** See `CheckoutOptions.width`. */
+    width?: number;
+    /** See `CheckoutOptions.height`. */
+    height?: number;
+    /** See `EnrollCardProvider`. Defaults to `'stripe'`. */
+    provider?: EnrollCardProvider;
+    onBooted?: () => void;
+    onReady?: () => void;
+    /** See `CheckoutOptions.onSuccess`. */
+    onSuccess?: (event: WidgetSuccessEvent<EnrollCardResult>) => void;
+    onError?: (error: EmbedError) => void;
+    /** See `CheckoutOptions.onAuthMismatch`. */
+    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
+    /** See `CheckoutOptions.onAuthSwitchRequest`. */
+    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
+    onClose?: () => void;
+}
+
+/**
+ * #1668 sub-task 2: which tokenization flow renders inside the embedded
+ * enrol-card iframe.
+ *
+ * - `'stripe'` (default): Stripe Elements + SetupIntent. The existing flow.
+ * - `'braintree'`: Braintree Drop-in (PayPal vault).
+ * - `'visa'`: Visa Agentic Tokens via VGS Collect → CMP. **Requires an
+ *   HTTPS parent page** — the Visa VTS iframe enforces
+ *   `frame-ancestors 'self' https:` so a non-HTTPS host (e.g. plain
+ *   `http://localhost`) cannot embed this provider.
+ */
+export declare type EnrollCardProvider = 'stripe' | 'braintree' | 'visa';
+
+export declare interface EnrollCardResult {
+    paymentMethodId: string;
+}
+
+export declare type Environment = (typeof ENVIRONMENTS)[number];
+
+declare const ENVIRONMENTS: readonly ["local", "sandbox", "live", "staging_sandbox", "staging_live"];
+
+declare type EventHandler<T> = (payload: T) => void;
+
+export declare class IframeManager {
+    private expectedOrigin;
+    private iframe;
+    private messageHandlers;
+    private protocolErrorHandlers;
+    private messageListener;
+    private destroyed;
+    constructor(expectedOrigin: string);
+    create(url: string, options?: IframeOptions): HTMLIFrameElement;
+    destroy(): void;
+    postMessage(msg: WidgetMessage): void;
+    onMessage(handler: (msg: WidgetMessage) => void): () => void;
+    onProtocolError(handler: (reason: string) => void): () => void;
+    private ensureListener;
+}
+
+export declare interface IframeOptions {
+    container?: HTMLElement;
+    style?: Partial<CSSStyleDeclaration>;
+    /**
+     * Fixed CSS width for inline (container) mode. #1668: the widget renders
+     * as a fixed-size box, like a Privy UI component, so the integrator can
+     * place it predictably on their page. Clamped to
+     * `[INLINE_MIN_WIDTH, INLINE_MAX_WIDTH]`. Default: `INLINE_DEFAULT_WIDTH`
+     * — the constants are the single source of truth, so future re-tunings
+     * don't require touching this JSDoc. Ignored in fullscreen overlay mode.
+     */
+    width?: number;
+    /**
+     * Fixed CSS height for inline mode. Clamped to
+     * `[INLINE_MIN_HEIGHT, INLINE_MAX_HEIGHT]`. Default: `INLINE_DEFAULT_HEIGHT`.
+     * The embed content uses responsive CSS to adapt to the dimensions the
+     * integrator picks — within the clamped range — without distorting (no
+     * CSS transform scale). Ignored in fullscreen overlay mode.
+     */
+    height?: number;
+}
+
+export declare interface ListCardsOptions {
+    container?: HTMLElement;
+    /** See `CheckoutOptions.width`. */
+    width?: number;
+    /** See `CheckoutOptions.height`. */
+    height?: number;
+    onBooted?: () => void;
+    onReady?: () => void;
+    onCardAction?: (action: CardAction) => void;
+    onError?: (error: EmbedError) => void;
+    /** See `CheckoutOptions.onAuthMismatch`. */
+    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
+    /** See `CheckoutOptions.onAuthSwitchRequest`. */
+    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
+    onClose?: () => void;
+}
+
+export declare class NeverminedWidgets {
+    private readonly sessionManager;
+    private readonly _account;
+    private readonly environment;
+    private _checkout;
+    private _delegations;
+    private readonly events;
+    private constructor();
+    static initialize(config: WidgetConfig): Promise<NeverminedWidgets>;
+    private refreshSession;
+    on<K extends keyof NeverminedWidgetsEvents>(event: K, handler: (payload: NeverminedWidgetsEvents[K]) => void): this;
+    off<K extends keyof NeverminedWidgetsEvents>(event: K, handler: (payload: NeverminedWidgetsEvents[K]) => void): this;
+    get account(): WidgetAccount;
+    get hasValidSession(): boolean;
+    getSessionToken(): string;
+    get checkout(): CheckoutWidget;
+    get delegations(): DelegationsWidget;
+    /**
+     * Resets the parent widget container: tears down any live child widget (e.g.
+     * the checkout widget) and clears the internal cache. This is a reset, not a
+     * terminal state — accessing `widget.checkout` after `destroy()` lazily
+     * creates a fresh `CheckoutWidget` instance. If you need a terminal "this
+     * widget can no longer be used" semantics, call `destroy()` on the child
+     * widget directly (e.g. `widget.checkout.destroy()`), which flips its
+     * internal `destroyed` flag and makes subsequent `start()` calls throw.
+     */
+    destroy(): void;
+}
+
+declare interface NeverminedWidgetsEvents {
+    'session-expired': void;
+}
+
+export declare function parseMessage(data: unknown): ParseResult;
+
+export declare type ParseResult<T = unknown> = {
+    ok: true;
+    message: WidgetMessage<T>;
+} | {
+    ok: false;
+    reason: string;
+};
+
+declare interface PlanCheckoutOptions {
+    planId: string;
+    container?: HTMLElement;
+    width?: number;
+    height?: number;
+    onBooted?: () => void;
+    onReady?: () => void;
+    onSuccess?: (event: WidgetSuccessEvent<PlanCheckoutResult>) => void;
+    onError?: (error: EmbedError) => void;
+    onAuthMismatch?: (detail: AuthMismatchDetail) => void;
+    onAuthSwitchRequest?: (detail: AuthSwitchRequestDetail) => void;
+    onClose?: () => void;
+}
+
+declare interface PlanCheckoutResult {
+    planId: string;
+    txHash?: string;
+}
+
+export declare class SessionManager {
+    private session;
+    private expiresMs;
+    private timer;
+    constructor(session: WidgetSession);
+    isValid(): boolean;
+    getToken(): string;
+    getSession(): WidgetSession;
+    startAutoRefresh(refreshFn: () => Promise<WidgetSession>, onExpired: () => void): void;
+    stopAutoRefresh(): void;
+}
+
+export declare class TypedEventEmitter<Events extends object> {
+    private listeners;
+    on<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
+    off<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
+    once<K extends keyof Events>(event: K, handler: EventHandler<Events[K]>): this;
+    removeAllListeners(event?: keyof Events): this;
+    emit<K extends keyof Events>(event: K, payload: Events[K]): void;
+}
+
+declare const WIDGET_ERRORS: {
+    readonly MISSING_SESSION: {
+        readonly numericCode: "WDG.0001";
+        readonly message: "session is required — pass the WidgetSession returned by createWidgetSession on the backend";
+    };
+    readonly INVALID_ENVIRONMENT: {
+        readonly numericCode: "WDG.0002";
+        readonly message: "environment must be one of: sandbox, live, staging_sandbox, staging_live, local";
+    };
+    readonly INVALID_SESSION: {
+        readonly numericCode: "WDG.0003";
+        readonly message: "session is missing required fields";
+    };
+    readonly SESSION_EXPIRED: {
+        readonly numericCode: "WDG.0006";
+        readonly message: "Widget session has expired";
+    };
+};
+
+export declare const WIDGET_MESSAGE_VERSION: "1";
+
+export declare interface WidgetAccount {
+    userId: string;
+    userWallet: `0x${string}`;
+}
+
+/**
+ * Thrown by SDK methods that hit the API directly (no iframe), e.g.
+ * `delegations.revokeCard()` / `delegations.revokeDelegation()`. Carries the
+ * HTTP status and the optional BCK error code so consumers can branch on
+ * 401/403/etc. without parsing the message.
+ */
+export declare class WidgetApiError extends Error {
+    readonly status?: number | undefined;
+    readonly apiCode?: string | undefined;
+    constructor(message: string, status?: number | undefined, apiCode?: string | undefined);
+}
+
+export declare interface WidgetConfig {
+    /**
+     * Widget session minted server-to-server by the integrator backend
+     * (typically via `@nevermined-io/ui-widgets-server.createWidgetSession`).
+     * Forward the response object verbatim — the SDK never holds the widget
+     * key `rawSecret`.
+     */
+    session: WidgetSession;
+    environment: Environment;
+}
+
+declare type WidgetErrorCode = keyof typeof WIDGET_ERRORS;
+
+export declare class WidgetInitError extends Error {
+    readonly code: WidgetErrorCode;
+    constructor(code: WidgetErrorCode, message?: string, cause?: unknown);
+}
+
+export declare interface WidgetMessage<T = unknown> {
+    type: WidgetMessageType;
+    version: '1';
+    payload?: T;
+}
+
+export declare enum WidgetMessageType {
+    INIT = "nvm:init",
+    CLOSE = "nvm:close",
+    BOOTED = "nvm:booted",
+    READY = "nvm:ready",
+    RESIZE = "nvm:resize",
+    SUCCESS = "nvm:success",
+    ERROR = "nvm:error",
+    CARD_ACTION = "nvm:card-action",
+    AUTH_MISMATCH = "nvm:auth-mismatch",
+    AUTH_SWITCH_REQUEST = "nvm:auth-switch-request"
+}
+
+export declare interface WidgetSession {
+    sessionToken: string;
+    userId: string;
+    userWallet: `0x${string}`;
+    /**
+     * Hash of the NVM API key bound to this widget session user. Returned by
+     * `POST /api/v1/widgets/session` so host pages that want to call user-scoped
+     * endpoints directly (outside the iframe) have the bearer token to do so.
+     * The embedded iframe flow consumes it via the session JWT claims rather
+     * than this field.
+     */
+    apiKeyHash: string;
+    expiresAt: string;
+}
+
+export declare class WidgetSessionExpiredError extends Error {
+    readonly code: "SESSION_EXPIRED";
+    constructor();
+}
+
+/**
+ * Payload shape passed to every widget's `onSuccess` callback. `result`
+ * is the per-widget data (paymentMethodId, delegationId, etc.); `handle`
+ * lets the integrator dismiss the widget on their own schedule.
+ */
+export declare interface WidgetSuccessEvent<T> {
+    result: T;
+    handle: WidgetSuccessHandle;
+}
+
+/**
+ * Control surface passed to every widget's `onSuccess` callback (#1668
+ * sub-tasks 3 + 4). The iframe stays mounted indefinitely after a
+ * successful action so the integrator can show their own post-action UI
+ * (toast, next-step prompt, etc.) while the success state remains visible
+ * inside the widget. The integrator dismisses the widget by calling
+ * `handle.close()` — which destroys the iframe and invokes `onClose` —
+ * whenever their own flow is ready.
+ */
+export declare interface WidgetSuccessHandle {
+    /**
+     * Destroys the iframe and invokes the widget's `onClose` callback.
+     * Idempotent: calling close on an already-closed widget is a no-op.
+     */
+    close(): void;
+}
+
+export { }

package/dist/index.js

@@ -1 +1 @@
-(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports):typeof define==`function`&&define.amd?define([`exports`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e.NeverminedWidgets={}))})(this,function(e){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var t=[`local`,`sandbox`,`live`,`staging_sandbox`,`staging_live`],n={local:`http://localhost:3001`,sandbox:`https://api.sandbox.nevermined.app`,live:`https://api.live.nevermined.app`,staging_sandbox:`https://api.sandbox.nevermined.dev`,staging_live:`https://api.live.nevermined.dev`},r={local:`http://localhost:4200`,sandbox:`https://nevermined.app`,live:`https://nevermined.app`,staging_sandbox:`https://nevermined.dev`,staging_live:`https://nevermined.dev`};function i(e){return n[e]}function a(e){return r[e]}var o={MISSING_SESSION:{numericCode:`WDG.0001`,message:`session is required — pass the WidgetSession returned by createWidgetSession on the backend`},INVALID_ENVIRONMENT:{numericCode:`WDG.0002`,message:`environment must be one of: sandbox, live, staging_sandbox, staging_live, local`},INVALID_SESSION:{numericCode:`WDG.0003`,message:`session is missing required fields`},SESSION_EXPIRED:{numericCode:`WDG.0006`,message:`Widget session has expired`}},s=class extends Error{code;constructor(e,t,n){super(t??o[e].message,{cause:n}),this.code=e,this.name=`WidgetInitError`}},c=class extends Error{code=`SESSION_EXPIRED`;constructor(){super(o.SESSION_EXPIRED.message),this.name=`WidgetSessionExpiredError`}},l=class extends Error{status;apiCode;constructor(e,t,n){super(e),this.status=t,this.apiCode=n,this.name=`WidgetApiError`}},u=.8,d=class{session;expiresMs;timer=null;constructor(e){this.session=e,this.expiresMs=new Date(e.expiresAt).getTime(),Number.isNaN(this.expiresMs)&&console.warn(`[SessionManager] malformed expiresAt, session will be treated as expired:`,e.expiresAt)}isValid(){return!Number.isNaN(this.expiresMs)&&this.expiresMs>Date.now()}getToken(){return this.session.sessionToken}getSession(){return this.session}startAutoRefresh(e,t){if(this.stopAutoRefresh(),!this.isValid()){t();return}let n=Math.max(0,Math.floor((this.expiresMs-Date.now())*u));this.timer=setTimeout(()=>{this.timer=null,e().then(n=>{if(this.session=n,this.expiresMs=new Date(n.expiresAt).getTime(),!this.isValid()){t();return}this.startAutoRefresh(e,t)},e=>{console.error(`[SessionManager] session refresh failed:`,e),t()})},n)}stopAutoRefresh(){this.timer!==null&&(clearTimeout(this.timer),this.timer=null)}},f=class{listeners=new Map;on(e,t){let n=this.listeners.get(e)??new Set;return n.add(t),this.listeners.set(e,n),this}off(e,t){let n=this.listeners.get(e);return n?(n.delete(t),n.size===0&&this.listeners.delete(e),this):this}once(e,t){let n=r=>{this.off(e,n),t(r)};return this.on(e,n)}removeAllListeners(e){return e===void 0?this.listeners.clear():this.listeners.delete(e),this}emit(e,t){let n=this.listeners.get(e);n&&[...n].forEach(e=>{try{e(t)}catch(e){console.error(`[TypedEventEmitter] Handler threw:`,e)}})}},p=function(e){return e.INIT=`nvm:init`,e.CLOSE=`nvm:close`,e.BOOTED=`nvm:booted`,e.READY=`nvm:ready`,e.RESIZE=`nvm:resize`,e.SUCCESS=`nvm:success`,e.ERROR=`nvm:error`,e.CARD_ACTION=`nvm:card-action`,e.AUTH_MISMATCH=`nvm:auth-mismatch`,e.AUTH_SWITCH_REQUEST=`nvm:auth-switch-request`,e}({}),m=`1`,h=`1`;function g(e){return typeof e==`string`&&Object.values(p).includes(e)}function _(e,t){return{type:e,version:h,payload:t}}function v(e){if(typeof e!=`object`||!e)return{ok:!1,reason:`not an object`};let t=e;return g(t.type)?t.version===h?{ok:!0,message:{type:t.type,version:t.version,payload:t.payload}}:{ok:!1,reason:`version mismatch: received "${t.version}", expected "${h}"`}:{ok:!1,reason:typeof t.type==`string`&&t.type.startsWith(`nvm:`)?`unknown nvm: type "${t.type}"`:`missing or unknown type`}}function y(e,t,n){return Math.max(t,Math.min(n,Math.round(e)))}var b=class{expectedOrigin;iframe=null;messageHandlers=new Set;protocolErrorHandlers=new Set;messageListener=null;destroyed=!1;constructor(e){if(this.expectedOrigin=e,e===`*`)throw Error(`[IframeManager] Wildcard origin "*" is not allowed — pass an explicit origin`)}create(e,t){this.iframe?.remove();let n=document.createElement(`iframe`);if(n.src=e,n.style.display=`block`,n.setAttribute(`sandbox`,`allow-scripts allow-same-origin allow-forms`),!t?.container)n.style.width=`100%`,n.style.height=`100%`,n.style.border=`none`,n.style.position=`fixed`,n.style.top=`0`,n.style.left=`0`,n.style.right=`0`,n.style.bottom=`0`,n.style.zIndex=`9999`;else{let e=y(t.width??480,440,720),r=y(t.height??720,640,960);n.style.width=`${e}px`,n.style.height=`${r}px`,n.style.border=`1px solid #e5e7eb`,n.style.borderRadius=`8px`,n.style.boxSizing=`border-box`}return t?.style&&Object.assign(n.style,t.style),(t?.container??document.body).appendChild(n),this.iframe=n,n}destroy(){this.destroyed=!0,this.messageListener&&=(window.removeEventListener(`message`,this.messageListener),null),this.messageHandlers.clear(),this.protocolErrorHandlers.clear(),this.iframe?.remove(),this.iframe=null}postMessage(e){this.destroyed||this.iframe?.contentWindow?.postMessage(e,this.expectedOrigin)}onMessage(e){return this.destroyed?()=>void 0:(this.messageHandlers.add(e),this.ensureListener(),()=>this.messageHandlers.delete(e))}onProtocolError(e){return this.destroyed?()=>void 0:(this.protocolErrorHandlers.add(e),this.ensureListener(),()=>this.protocolErrorHandlers.delete(e))}ensureListener(){this.messageListener||(this.messageListener=e=>{if(e.origin!==this.expectedOrigin)return;let t=v(e.data);if(!t.ok){console.warn(`[IframeManager] Discarding message from ${this.expectedOrigin}: ${t.reason}`),this.protocolErrorHandlers.forEach(e=>{try{e(t.reason)}catch(e){console.error(`[IframeManager] Protocol error handler threw:`,e)}});return}this.messageHandlers.forEach(e=>{try{e(t.message)}catch(e){console.error(`[IframeManager] Message handler threw:`,e)}})},window.addEventListener(`message`,this.messageListener))}},x={code:`UNKNOWN`,message:`Unknown widget error`},S=class{session;webappBase;manager=null;destroyed=!1;constructor(e,t){this.session=e,this.webappBase=t}start(e){if(this.destroyed)throw Error(`[CheckoutWidget] cannot start: instance has been destroyed`);if(!e.did||typeof e.did!=`string`)throw Error(`[CheckoutWidget] did is required`);this.manager?.destroy();let t=new URL(this.webappBase).origin,n=window.location.origin,r=new URL(`/embed/checkout/${encodeURIComponent(e.did)}`,this.webappBase);r.searchParams.set(`parentOrigin`,n),e.planId&&r.searchParams.set(`planId`,e.planId);let i=new b(t);this.manager=i,i.create(r.toString(),{container:e.container,width:e.width,height:e.height}),i.onMessage(t=>this.handleMessage(t,e,i))}destroy(){this.destroyed=!0,this.manager?.destroy(),this.manager=null}closeFromIframe(e,t){this.destroyed||this.manager!==t||(this.destroy(),e.onClose?.())}buildSuccessHandle(e,t){return{close:()=>this.closeFromIframe(e,t)}}handleMessage(e,t,n){if(!T(e,t))switch(e.type){case p.BOOTED:this.manager?.postMessage(_(p.INIT,{sessionToken:this.session.getToken()})),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.SUCCESS:{let r=e.payload??{},i={did:r.did??t.did,planId:r.planId??t.planId,txHash:r.txHash};t.onSuccess?.({result:i,handle:this.buildSuccessHandle(t,n)});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??x);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}};function C(e){if(typeof e!=`object`||!e)return null;let t=e.expectedEmail;return typeof t!=`string`||t.length===0?null:{expectedEmail:t}}function w(e){if(typeof e!=`object`||!e)return null;let t=e.requestedEmail,n=e.expectedEmail;return typeof t!=`string`||t.length===0||typeof n!=`string`||n.length===0?null:{requestedEmail:t,expectedEmail:n}}function T(e,t){if(e.type===p.AUTH_MISMATCH){let n=C(e.payload);return n&&t.onAuthMismatch?.(n),!0}if(e.type===p.AUTH_SWITCH_REQUEST){let n=w(e.payload);return n&&t.onAuthSwitchRequest?.(n),!0}return!1}var E={code:`UNKNOWN`,message:`Unknown widget error`},D={code:`UNKNOWN`,message:`Malformed nvm:success payload — paymentMethodId missing or invalid`},O={code:`UNKNOWN`,message:`Malformed nvm:success payload — delegationId missing or invalid`},k=class{session;webappBase;apiBase;manager=null;destroyed=!1;constructor(e,t,n){this.session=e,this.webappBase=t,this.apiBase=n}enrollCard(e){this.assertAlive(`enrollCard`);let t=e.provider??`stripe`,n=this.mountIframe(`/embed/cards/enroll`,e.container,{provider:t},{width:e.width,height:e.height});n.onMessage(t=>this.handleEnrollMessage(t,e,n))}listCards(e){this.assertAlive(`listCards`);let t=this.mountIframe(`/embed/cards/list`,e.container,void 0,{width:e.width,height:e.height});t.onMessage(n=>this.handleListMessage(n,e,t))}createDelegation(e){if(this.assertAlive(`createDelegation`),typeof e.paymentMethodId!=`string`||e.paymentMethodId.length===0)throw Error(`[DelegationsWidget] createDelegation: paymentMethodId is required`);let t=this.mountIframe(`/embed/cards/delegate`,e.container,{paymentMethodId:e.paymentMethodId},{width:e.width,height:e.height});t.onMessage(n=>this.handleCreateDelegationMessage(n,e,t))}async revokeCard(e){if(typeof e!=`string`||e.length===0)throw Error(`[DelegationsWidget] revokeCard: paymentMethodId is required`);await this.deleteWithSession(`${this.apiBase}/api/v1/widgets/payment-methods/${encodeURIComponent(e)}`,`Failed to revoke payment method`)}async revokeDelegation(e){if(typeof e!=`string`||e.length===0)throw Error(`[DelegationsWidget] revokeDelegation: delegationId is required`);await this.deleteWithSession(`${this.apiBase}/api/v1/widgets/delegation/${encodeURIComponent(e)}`,`Failed to revoke delegation`)}destroy(){this.destroyed=!0,this.manager?.destroy(),this.manager=null}assertAlive(e){if(this.destroyed)throw Error(`[DelegationsWidget] cannot ${e}: instance has been destroyed`)}mountIframe(e,t,n={},r={}){this.manager?.destroy();let i=new URL(this.webappBase).origin,a=window.location.origin,o=new URL(e,this.webappBase);o.searchParams.set(`parentOrigin`,a);for(let[e,t]of Object.entries(n))o.searchParams.set(e,t);let s=new b(i);return this.manager=s,s.create(o.toString(),{container:t,width:r.width,height:r.height}),s}postInitOnBooted(){this.manager?.postMessage(_(p.INIT,{sessionToken:this.session.getToken()}))}handleEnrollMessage(e,t,n){if(!T(e,t))switch(e.type){case p.BOOTED:this.postInitOnBooted(),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.SUCCESS:{let r=(e.payload??{}).paymentMethodId;if(typeof r!=`string`||r.length===0){t.onError?.(D);return}t.onSuccess?.({result:{paymentMethodId:r},handle:this.buildSuccessHandle(t,n)});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??E);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}handleListMessage(e,t,n){if(!T(e,t))switch(e.type){case p.BOOTED:this.postInitOnBooted(),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.CARD_ACTION:{let n=e.payload??{};if(n.action!==`delegate`&&n.action!==`revoked`||typeof n.paymentMethodId!=`string`||n.paymentMethodId.length===0)return;t.onCardAction?.({action:n.action,paymentMethodId:n.paymentMethodId});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??E);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}handleCreateDelegationMessage(e,t,n){if(!T(e,t))switch(e.type){case p.BOOTED:this.postInitOnBooted(),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.SUCCESS:{let r=(e.payload??{}).delegationId;if(typeof r!=`string`||r.length===0){t.onError?.(O);return}t.onSuccess?.({result:{delegationId:r,paymentMethodId:t.paymentMethodId},handle:this.buildSuccessHandle(t,n)});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??E);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}closeFromIframe(e,t){this.destroyed||this.manager!==t||(this.destroy(),e.onClose?.())}buildSuccessHandle(e,t){return{close:()=>this.closeFromIframe(e,t)}}async deleteWithSession(e,t){let n;try{n=await fetch(e,{method:`DELETE`,headers:{Authorization:`Bearer ${this.session.getToken()}`,Accept:`application/json`}})}catch(e){throw new l(e instanceof Error&&e.message?e.message:t)}if(n.ok)return;let r,i=t;try{let e=await n.json();typeof e?.message==`string`&&e.message.length>0&&(i=e.message),typeof e?.code==`string`&&(r=e.code)}catch{}throw new l(i,n.status,r)}};function A(e){if(typeof e!=`object`||!e)return!1;let t=e;return[`sessionToken`,`userId`,`expiresAt`,`apiKeyHash`].every(e=>typeof t[e]==`string`)&&typeof t.userWallet==`string`&&t.userWallet.startsWith(`0x`)}var j=class e{sessionManager;_account;environment;_checkout=null;_delegations=null;events=new f;constructor(e,t,n){this.sessionManager=e,this._account=t,this.environment=n}static async initialize(n){let{session:r,environment:i}=n;if(!r||typeof r!=`object`)throw new s(`MISSING_SESSION`);if(!i||!t.includes(i))throw new s(`INVALID_ENVIRONMENT`);if(!A(r))throw new s(`INVALID_SESSION`);let a=new d(r),o=new e(a,{userId:r.userId,userWallet:r.userWallet},i);return a.startAutoRefresh(()=>o.refreshSession(),()=>o.events.emit(`session-expired`,void 0)),o}async refreshSession(){let e=await fetch(`${i(this.environment)}/api/v1/widgets/session/refresh`,{method:`POST`,headers:{Authorization:`Bearer ${this.sessionManager.getToken()}`}});if(!e.ok)throw Error(`Session refresh failed with status ${e.status}`);let t=await e.json();if(!A(t))throw Error(`Session refresh returned an invalid response`);return t}on(e,t){return this.events.on(e,t),this}off(e,t){return this.events.off(e,t),this}get account(){return this._account}get hasValidSession(){return this.sessionManager.isValid()}getSessionToken(){if(!this.sessionManager.isValid())throw new c;return this.sessionManager.getToken()}get checkout(){return this._checkout||=new S(this.sessionManager,a(this.environment)),this._checkout}get delegations(){return this._delegations||=new k(this.sessionManager,a(this.environment),i(this.environment)),this._delegations}destroy(){this.sessionManager.stopAutoRefresh(),this._checkout?.destroy(),this._checkout=null,this._delegations?.destroy(),this._delegations=null,this.events.removeAllListeners()}};e.CheckoutWidget=S,e.DelegationsWidget=k,e.IframeManager=b,e.NeverminedWidgets=j,e.SessionManager=d,e.TypedEventEmitter=f,e.WIDGET_MESSAGE_VERSION=m,e.WidgetApiError=l,e.WidgetInitError=s,e.WidgetMessageType=p,e.WidgetSessionExpiredError=c,e.createMessage=_,e.parseMessage=v});
+(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports):typeof define==`function`&&define.amd?define([`exports`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e.NeverminedWidgets={}))})(this,function(e){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var t=[`local`,`sandbox`,`live`,`staging_sandbox`,`staging_live`],n={local:`http://localhost:3001`,sandbox:`https://api.sandbox.nevermined.app`,live:`https://api.live.nevermined.app`,staging_sandbox:`https://api.sandbox.nevermined.dev`,staging_live:`https://api.live.nevermined.dev`},r={local:`http://localhost:4200`,sandbox:`https://nevermined.app`,live:`https://nevermined.app`,staging_sandbox:`https://nevermined.dev`,staging_live:`https://nevermined.dev`};function i(e){return n[e]}function a(e){return r[e]}var o={MISSING_SESSION:{numericCode:`WDG.0001`,message:`session is required — pass the WidgetSession returned by createWidgetSession on the backend`},INVALID_ENVIRONMENT:{numericCode:`WDG.0002`,message:`environment must be one of: sandbox, live, staging_sandbox, staging_live, local`},INVALID_SESSION:{numericCode:`WDG.0003`,message:`session is missing required fields`},SESSION_EXPIRED:{numericCode:`WDG.0006`,message:`Widget session has expired`}},s=class extends Error{code;constructor(e,t,n){super(t??o[e].message,{cause:n}),this.code=e,this.name=`WidgetInitError`}},c=class extends Error{code=`SESSION_EXPIRED`;constructor(){super(o.SESSION_EXPIRED.message),this.name=`WidgetSessionExpiredError`}},l=class extends Error{status;apiCode;constructor(e,t,n){super(e),this.status=t,this.apiCode=n,this.name=`WidgetApiError`}},u=.8,d=class{session;expiresMs;timer=null;constructor(e){this.session=e,this.expiresMs=new Date(e.expiresAt).getTime(),Number.isNaN(this.expiresMs)&&console.warn(`[SessionManager] malformed expiresAt, session will be treated as expired:`,e.expiresAt)}isValid(){return!Number.isNaN(this.expiresMs)&&this.expiresMs>Date.now()}getToken(){return this.session.sessionToken}getSession(){return this.session}startAutoRefresh(e,t){if(this.stopAutoRefresh(),!this.isValid()){t();return}let n=Math.max(0,Math.floor((this.expiresMs-Date.now())*u));this.timer=setTimeout(()=>{this.timer=null,e().then(n=>{if(this.session=n,this.expiresMs=new Date(n.expiresAt).getTime(),!this.isValid()){t();return}this.startAutoRefresh(e,t)},e=>{console.error(`[SessionManager] session refresh failed:`,e),t()})},n)}stopAutoRefresh(){this.timer!==null&&(clearTimeout(this.timer),this.timer=null)}},f=class{listeners=new Map;on(e,t){let n=this.listeners.get(e)??new Set;return n.add(t),this.listeners.set(e,n),this}off(e,t){let n=this.listeners.get(e);return n?(n.delete(t),n.size===0&&this.listeners.delete(e),this):this}once(e,t){let n=r=>{this.off(e,n),t(r)};return this.on(e,n)}removeAllListeners(e){return e===void 0?this.listeners.clear():this.listeners.delete(e),this}emit(e,t){let n=this.listeners.get(e);n&&[...n].forEach(e=>{try{e(t)}catch(e){console.error(`[TypedEventEmitter] Handler threw:`,e)}})}},p=function(e){return e.INIT=`nvm:init`,e.CLOSE=`nvm:close`,e.BOOTED=`nvm:booted`,e.READY=`nvm:ready`,e.RESIZE=`nvm:resize`,e.SUCCESS=`nvm:success`,e.ERROR=`nvm:error`,e.CARD_ACTION=`nvm:card-action`,e.AUTH_MISMATCH=`nvm:auth-mismatch`,e.AUTH_SWITCH_REQUEST=`nvm:auth-switch-request`,e}({}),m=`1`,h=`1`;function g(e){return typeof e==`string`&&Object.values(p).includes(e)}function _(e,t){return{type:e,version:h,payload:t}}function v(e){if(typeof e!=`object`||!e)return{ok:!1,reason:`not an object`};let t=e;return g(t.type)?t.version===h?{ok:!0,message:{type:t.type,version:t.version,payload:t.payload}}:{ok:!1,reason:`version mismatch: received "${t.version}", expected "${h}"`}:{ok:!1,reason:typeof t.type==`string`&&t.type.startsWith(`nvm:`)?`unknown nvm: type "${t.type}"`:`missing or unknown type`}}function y(e,t,n){return Math.max(t,Math.min(n,Math.round(e)))}var b=class{expectedOrigin;iframe=null;messageHandlers=new Set;protocolErrorHandlers=new Set;messageListener=null;destroyed=!1;constructor(e){if(this.expectedOrigin=e,e===`*`)throw Error(`[IframeManager] Wildcard origin "*" is not allowed — pass an explicit origin`)}create(e,t){this.iframe?.remove();let n=document.createElement(`iframe`);if(n.src=e,n.style.display=`block`,n.setAttribute(`sandbox`,`allow-scripts allow-same-origin allow-forms`),!t?.container)n.style.width=`100%`,n.style.height=`100%`,n.style.border=`none`,n.style.position=`fixed`,n.style.top=`0`,n.style.left=`0`,n.style.right=`0`,n.style.bottom=`0`,n.style.zIndex=`9999`;else{let e=y(t.width??480,440,720),r=y(t.height??720,640,960);n.style.width=`${e}px`,n.style.height=`${r}px`,n.style.border=`1px solid #e5e7eb`,n.style.borderRadius=`8px`,n.style.boxSizing=`border-box`}return t?.style&&Object.assign(n.style,t.style),(t?.container??document.body).appendChild(n),this.iframe=n,n}destroy(){this.destroyed=!0,this.messageListener&&=(window.removeEventListener(`message`,this.messageListener),null),this.messageHandlers.clear(),this.protocolErrorHandlers.clear(),this.iframe?.remove(),this.iframe=null}postMessage(e){this.destroyed||this.iframe?.contentWindow?.postMessage(e,this.expectedOrigin)}onMessage(e){return this.destroyed?()=>void 0:(this.messageHandlers.add(e),this.ensureListener(),()=>this.messageHandlers.delete(e))}onProtocolError(e){return this.destroyed?()=>void 0:(this.protocolErrorHandlers.add(e),this.ensureListener(),()=>this.protocolErrorHandlers.delete(e))}ensureListener(){this.messageListener||(this.messageListener=e=>{if(e.origin!==this.expectedOrigin)return;let t=v(e.data);if(!t.ok){console.warn(`[IframeManager] Discarding message from ${this.expectedOrigin}: ${t.reason}`),this.protocolErrorHandlers.forEach(e=>{try{e(t.reason)}catch(e){console.error(`[IframeManager] Protocol error handler threw:`,e)}});return}this.messageHandlers.forEach(e=>{try{e(t.message)}catch(e){console.error(`[IframeManager] Message handler threw:`,e)}})},window.addEventListener(`message`,this.messageListener))}},x={code:`UNKNOWN`,message:`Unknown widget error`},S=class{session;webappBase;manager=null;destroyed=!1;constructor(e,t){this.session=e,this.webappBase=t}start(e){if(this.destroyed)throw Error(`[CheckoutWidget] cannot start: instance has been destroyed`);if(!e.did||typeof e.did!=`string`)throw Error(`[CheckoutWidget] did is required`);let t=new URL(`/embed/checkout/${encodeURIComponent(e.did)}`,this.webappBase);e.planId&&t.searchParams.set(`planId`,e.planId),this.mount(t,e,t=>({did:t.did??e.did,planId:t.planId??e.planId,txHash:t.txHash}),e.onSuccess)}startPlan(e){if(this.destroyed)throw Error(`[CheckoutWidget] cannot start: instance has been destroyed`);if(!e.planId||typeof e.planId!=`string`)throw Error(`[CheckoutWidget] planId is required`);let t=new URL(`/embed/checkout/plan/${encodeURIComponent(e.planId)}`,this.webappBase);this.mount(t,e,t=>({planId:t.planId??e.planId,txHash:t.txHash}),e.onSuccess)}destroy(){this.destroyed=!0,this.manager?.destroy(),this.manager=null}closeFromIframe(e,t){this.destroyed||this.manager!==t||(this.destroy(),e.onClose?.())}buildSuccessHandle(e,t){return{close:()=>this.closeFromIframe(e,t)}}mount(e,t,n,r){this.manager?.destroy();let i=new URL(this.webappBase).origin;e.searchParams.set(`parentOrigin`,window.location.origin);let a=new b(i);this.manager=a,a.create(e.toString(),{container:t.container,width:t.width,height:t.height}),a.onMessage(e=>this.handleMessage(e,t,a,n,r))}handleMessage(e,t,n,r,i){if(!T(e,t))switch(e.type){case p.BOOTED:this.manager?.postMessage(_(p.INIT,{sessionToken:this.session.getToken()})),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.SUCCESS:{let a=r(e.payload!=null&&typeof e.payload==`object`?e.payload:{});i?.({result:a,handle:this.buildSuccessHandle(t,n)});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??x);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}};function C(e){if(typeof e!=`object`||!e)return null;let t=e.expectedEmail;return typeof t!=`string`||t.length===0?null:{expectedEmail:t}}function w(e){if(typeof e!=`object`||!e)return null;let t=e.requestedEmail,n=e.expectedEmail;return typeof t!=`string`||t.length===0||typeof n!=`string`||n.length===0?null:{requestedEmail:t,expectedEmail:n}}function T(e,t){if(e.type===p.AUTH_MISMATCH){let n=C(e.payload);return n&&t.onAuthMismatch?.(n),!0}if(e.type===p.AUTH_SWITCH_REQUEST){let n=w(e.payload);return n&&t.onAuthSwitchRequest?.(n),!0}return!1}var E={code:`UNKNOWN`,message:`Unknown widget error`},D={code:`UNKNOWN`,message:`Malformed nvm:success payload — paymentMethodId missing or invalid`},O={code:`UNKNOWN`,message:`Malformed nvm:success payload — delegationId missing or invalid`},k=class{session;webappBase;apiBase;manager=null;destroyed=!1;constructor(e,t,n){this.session=e,this.webappBase=t,this.apiBase=n}enrollCard(e){this.assertAlive(`enrollCard`);let t=e.provider??`stripe`,n=this.mountIframe(`/embed/cards/enroll`,e.container,{provider:t},{width:e.width,height:e.height});n.onMessage(t=>this.handleEnrollMessage(t,e,n))}listCards(e){this.assertAlive(`listCards`);let t=this.mountIframe(`/embed/cards/list`,e.container,void 0,{width:e.width,height:e.height});t.onMessage(n=>this.handleListMessage(n,e,t))}createDelegation(e){if(this.assertAlive(`createDelegation`),typeof e.paymentMethodId!=`string`||e.paymentMethodId.length===0)throw Error(`[DelegationsWidget] createDelegation: paymentMethodId is required`);let t=this.mountIframe(`/embed/cards/delegate`,e.container,{paymentMethodId:e.paymentMethodId},{width:e.width,height:e.height});t.onMessage(n=>this.handleCreateDelegationMessage(n,e,t))}async revokeCard(e){if(typeof e!=`string`||e.length===0)throw Error(`[DelegationsWidget] revokeCard: paymentMethodId is required`);await this.deleteWithSession(`${this.apiBase}/api/v1/widgets/payment-methods/${encodeURIComponent(e)}`,`Failed to revoke payment method`)}async revokeDelegation(e){if(typeof e!=`string`||e.length===0)throw Error(`[DelegationsWidget] revokeDelegation: delegationId is required`);await this.deleteWithSession(`${this.apiBase}/api/v1/widgets/delegation/${encodeURIComponent(e)}`,`Failed to revoke delegation`)}destroy(){this.destroyed=!0,this.manager?.destroy(),this.manager=null}assertAlive(e){if(this.destroyed)throw Error(`[DelegationsWidget] cannot ${e}: instance has been destroyed`)}mountIframe(e,t,n={},r={}){this.manager?.destroy();let i=new URL(this.webappBase).origin,a=window.location.origin,o=new URL(e,this.webappBase);o.searchParams.set(`parentOrigin`,a);for(let[e,t]of Object.entries(n))o.searchParams.set(e,t);let s=new b(i);return this.manager=s,s.create(o.toString(),{container:t,width:r.width,height:r.height}),s}postInitOnBooted(){this.manager?.postMessage(_(p.INIT,{sessionToken:this.session.getToken()}))}handleEnrollMessage(e,t,n){if(!T(e,t))switch(e.type){case p.BOOTED:this.postInitOnBooted(),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.SUCCESS:{let r=(e.payload??{}).paymentMethodId;if(typeof r!=`string`||r.length===0){t.onError?.(D);return}t.onSuccess?.({result:{paymentMethodId:r},handle:this.buildSuccessHandle(t,n)});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??E);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}handleListMessage(e,t,n){if(!T(e,t))switch(e.type){case p.BOOTED:this.postInitOnBooted(),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.CARD_ACTION:{let n=e.payload??{};if(n.action!==`delegate`&&n.action!==`revoked`||typeof n.paymentMethodId!=`string`||n.paymentMethodId.length===0)return;t.onCardAction?.({action:n.action,paymentMethodId:n.paymentMethodId});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??E);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}handleCreateDelegationMessage(e,t,n){if(!T(e,t))switch(e.type){case p.BOOTED:this.postInitOnBooted(),t.onBooted?.();return;case p.READY:t.onReady?.();return;case p.SUCCESS:{let r=(e.payload??{}).delegationId;if(typeof r!=`string`||r.length===0){t.onError?.(O);return}t.onSuccess?.({result:{delegationId:r,paymentMethodId:t.paymentMethodId},handle:this.buildSuccessHandle(t,n)});return}case p.ERROR:{let n=e.payload;t.onError?.(n?.error??E);return}case p.CLOSE:this.closeFromIframe(t,n);return;default:return}}closeFromIframe(e,t){this.destroyed||this.manager!==t||(this.destroy(),e.onClose?.())}buildSuccessHandle(e,t){return{close:()=>this.closeFromIframe(e,t)}}async deleteWithSession(e,t){let n;try{n=await fetch(e,{method:`DELETE`,headers:{Authorization:`Bearer ${this.session.getToken()}`,Accept:`application/json`}})}catch(e){throw new l(e instanceof Error&&e.message?e.message:t)}if(n.ok)return;let r,i=t;try{let e=await n.json();typeof e?.message==`string`&&e.message.length>0&&(i=e.message),typeof e?.code==`string`&&(r=e.code)}catch{}throw new l(i,n.status,r)}};function A(e){if(typeof e!=`object`||!e)return!1;let t=e;return[`sessionToken`,`userId`,`expiresAt`,`apiKeyHash`].every(e=>typeof t[e]==`string`)&&typeof t.userWallet==`string`&&t.userWallet.startsWith(`0x`)}var j=class e{sessionManager;_account;environment;_checkout=null;_delegations=null;events=new f;constructor(e,t,n){this.sessionManager=e,this._account=t,this.environment=n}static async initialize(n){let{session:r,environment:i}=n;if(!r||typeof r!=`object`)throw new s(`MISSING_SESSION`);if(!i||!t.includes(i))throw new s(`INVALID_ENVIRONMENT`);if(!A(r))throw new s(`INVALID_SESSION`);let a=new d(r),o=new e(a,{userId:r.userId,userWallet:r.userWallet},i);return a.startAutoRefresh(()=>o.refreshSession(),()=>o.events.emit(`session-expired`,void 0)),o}async refreshSession(){let e=await fetch(`${i(this.environment)}/api/v1/widgets/session/refresh`,{method:`POST`,headers:{Authorization:`Bearer ${this.sessionManager.getToken()}`}});if(!e.ok)throw Error(`Session refresh failed with status ${e.status}`);let t=await e.json();if(!A(t))throw Error(`Session refresh returned an invalid response`);return t}on(e,t){return this.events.on(e,t),this}off(e,t){return this.events.off(e,t),this}get account(){return this._account}get hasValidSession(){return this.sessionManager.isValid()}getSessionToken(){if(!this.sessionManager.isValid())throw new c;return this.sessionManager.getToken()}get checkout(){return this._checkout||=new S(this.sessionManager,a(this.environment)),this._checkout}get delegations(){return this._delegations||=new k(this.sessionManager,a(this.environment),i(this.environment)),this._delegations}destroy(){this.sessionManager.stopAutoRefresh(),this._checkout?.destroy(),this._checkout=null,this._delegations?.destroy(),this._delegations=null,this.events.removeAllListeners()}};e.CheckoutWidget=S,e.DelegationsWidget=k,e.IframeManager=b,e.NeverminedWidgets=j,e.SessionManager=d,e.TypedEventEmitter=f,e.WIDGET_MESSAGE_VERSION=m,e.WidgetApiError=l,e.WidgetInitError=s,e.WidgetMessageType=p,e.WidgetSessionExpiredError=c,e.createMessage=_,e.parseMessage=v});