@oma3/omatrust 0.1.0-alpha.0 → 0.1.0-alpha.10

package/dist/subject-ownership-CXvzEjpH.d.ts

@@ -0,0 +1,434 @@
+type Hex = `0x${string}`;
+type Did = string;
+type ProofType = "pop-jws" | "pop-eip712" | "x402-receipt" | "evidence-pointer" | "tx-encoded-value" | "tx-interaction" | "x402-offer";
+type ProofPurpose = "shared-control" | "commercial-tx";
+type SchemaField = {
+    name: string;
+    type: string;
+    value?: unknown;
+};
+type AttestationValidationError = {
+    schemaFieldName: string;
+    expectedType: string;
+    providedType: string;
+    providedValue: unknown;
+};
+type AttestationQueryResult = {
+    uid: Hex;
+    schema: Hex;
+    attester: Hex;
+    recipient: Hex;
+    txHash?: Hex;
+    revocable: boolean;
+    revocationTime: bigint;
+    expirationTime: bigint;
+    time: bigint;
+    refUID: Hex;
+    data: Record<string, unknown>;
+    raw?: Hex;
+};
+type ProofWrapper = {
+    proofType: ProofType;
+    proofObject: unknown;
+    proofPurpose?: ProofPurpose;
+    version?: number;
+    issuedAt?: number;
+    expiresAt?: number;
+};
+type TxEncodedValueProof = ProofWrapper & {
+    proofType: "tx-encoded-value";
+    proofPurpose: ProofPurpose;
+    proofObject: {
+        chainId: string;
+        txHash: Hex;
+    };
+};
+type TxInteractionProof = ProofWrapper & {
+    proofType: "tx-interaction";
+    proofPurpose: "commercial-tx";
+    proofObject: {
+        chainId: string;
+        txHash: Hex;
+    };
+};
+type PopEip712Proof = ProofWrapper & {
+    proofType: "pop-eip712";
+    proofObject: {
+        domain: {
+            name: string;
+            version: string;
+            chainId: number;
+            verifyingContract?: Hex;
+        };
+        message: {
+            signer: string;
+            authorizedEntity: string;
+            signingPurpose: string;
+            creationTimestamp: number;
+            expirationTimestamp: number;
+            randomValue: Hex;
+            statement: string;
+        };
+        signature: Hex;
+    };
+};
+type PopJwsProof = ProofWrapper & {
+    proofType: "pop-jws";
+    proofObject: string;
+};
+type X402ReceiptProof = ProofWrapper & {
+    proofType: "x402-receipt";
+    proofPurpose: "commercial-tx";
+    proofObject: Record<string, unknown>;
+};
+type X402OfferProof = ProofWrapper & {
+    proofType: "x402-offer";
+    proofPurpose: "commercial-tx";
+    proofObject: Record<string, unknown>;
+};
+type EvidencePointerProof = ProofWrapper & {
+    proofType: "evidence-pointer";
+    proofPurpose: "shared-control";
+    proofObject: {
+        url: string;
+    };
+};
+type ChainConstants = {
+    base: bigint;
+    range: bigint;
+    decimals: number;
+    nativeSymbol: string;
+};
+type SubmitAttestationParams = {
+    signer: unknown;
+    chainId: number;
+    easContractAddress: Hex;
+    schemaUid: Hex;
+    schema: SchemaField[] | string;
+    data: Record<string, unknown>;
+    revocable?: boolean;
+    expirationTime?: bigint | number;
+    refUid?: Hex;
+    value?: bigint | number;
+};
+type SubmitAttestationResult = {
+    uid: Hex;
+    txHash: Hex;
+    receipt?: unknown;
+};
+type RevokeAttestationParams = {
+    signer: unknown;
+    easContractAddress: Hex;
+    schemaUid: Hex;
+    uid: Hex;
+    value?: bigint | number;
+};
+type RevokeAttestationResult = {
+    txHash: Hex;
+    receipt?: unknown;
+};
+type PrepareDelegatedAttestationParams = {
+    chainId: number;
+    easContractAddress: Hex;
+    schemaUid: Hex;
+    schema: SchemaField[] | string;
+    data: Record<string, unknown>;
+    attester: Hex;
+    nonce: bigint | number;
+    revocable?: boolean;
+    expirationTime?: bigint | number;
+    refUid?: Hex;
+    value?: bigint | number;
+    deadline?: bigint | number;
+};
+type PrepareDelegatedAttestationResult = {
+    delegatedRequest: Record<string, unknown>;
+    typedData: {
+        domain: Record<string, unknown>;
+        types: Record<string, unknown>;
+        message: Record<string, unknown>;
+    };
+};
+type BuildDelegatedTypedDataFromEncodedParams = {
+    chainId: number;
+    easContractAddress: Hex;
+    schemaUid: Hex;
+    encodedData: Hex;
+    recipient: Hex;
+    attester: Hex;
+    nonce: bigint | number;
+    revocable?: boolean;
+    expirationTime?: bigint | number;
+    refUid?: Hex;
+    value?: bigint | number;
+    deadline?: bigint | number;
+};
+type SubmitDelegatedAttestationParams = {
+    relayUrl: string;
+    prepared: PrepareDelegatedAttestationResult;
+    signature: Hex | string;
+    attester?: Hex;
+};
+type SubmitDelegatedAttestationResult = {
+    uid: Hex;
+    txHash?: Hex;
+    status: "submitted" | "confirmed";
+};
+type GetAttestationParams = {
+    uid: Hex;
+    provider: unknown;
+    easContractAddress: Hex;
+    schema?: SchemaField[] | string;
+};
+type ListAttestationsParams = {
+    did: Did;
+    provider: unknown;
+    easContractAddress: Hex;
+    schemas?: Hex[];
+    limit?: number;
+    fromBlock?: number;
+    toBlock?: number;
+};
+type GetAttestationsByAttesterParams = {
+    attester: Hex;
+    provider: unknown;
+    easContractAddress: Hex;
+    schemas?: Hex[];
+    limit?: number;
+    fromBlock?: number;
+    toBlock?: number;
+};
+type VerifyAttestationParams = {
+    attestation: AttestationQueryResult;
+    provider?: unknown;
+    checks?: ProofType[];
+    context?: Record<string, unknown>;
+};
+type VerifyAttestationResult = {
+    valid: boolean;
+    checks: Record<string, boolean>;
+    reasons: string[];
+};
+type CallControllerWitnessParams = {
+    gatewayUrl: string;
+    attestationUid: Hex;
+    chainId: number;
+    easContract: Hex;
+    schemaUid: Hex;
+    subject: Did;
+    controller: Did;
+    timeoutMs?: number;
+};
+type CallControllerWitnessResult = {
+    ok: boolean;
+    method: "dns-txt" | "did-json";
+    details?: unknown;
+};
+type VerifyProofParams = {
+    proof: ProofWrapper;
+    provider?: unknown;
+    expectedSubject?: Did;
+    expectedController?: Did;
+};
+type VerifyProofResult = {
+    valid: boolean;
+    proofType: ProofType;
+    reason?: string;
+};
+
+declare function submitAttestation(params: SubmitAttestationParams): Promise<SubmitAttestationResult>;
+
+declare function revokeAttestation(params: RevokeAttestationParams): Promise<RevokeAttestationResult>;
+
+declare function buildDelegatedAttestationTypedData(params: PrepareDelegatedAttestationParams): {
+    domain: Record<string, unknown>;
+    types: Record<string, unknown>;
+    message: Record<string, unknown>;
+};
+declare function buildDelegatedTypedDataFromEncoded(params: BuildDelegatedTypedDataFromEncodedParams): {
+    domain: Record<string, unknown>;
+    types: Record<string, unknown>;
+    message: Record<string, unknown>;
+};
+declare function splitSignature(signature: Hex | string): {
+    v: number;
+    r: Hex;
+    s: Hex;
+};
+declare function prepareDelegatedAttestation(params: PrepareDelegatedAttestationParams): Promise<PrepareDelegatedAttestationResult>;
+declare function submitDelegatedAttestation(params: SubmitDelegatedAttestationParams): Promise<SubmitDelegatedAttestationResult>;
+
+declare function getAttestation(params: GetAttestationParams): Promise<AttestationQueryResult>;
+declare function getAttestationsForDid(params: ListAttestationsParams): Promise<AttestationQueryResult[]>;
+declare function getAttestationsByAttester(params: GetAttestationsByAttesterParams): Promise<AttestationQueryResult[]>;
+declare function listAttestations(params: ListAttestationsParams): Promise<AttestationQueryResult[]>;
+type GetLatestAttestationsParams = {
+    provider: unknown;
+    easContractAddress: Hex;
+    schemas?: Hex[];
+    limit?: number;
+    fromBlock?: number;
+};
+declare function getLatestAttestations(params: GetLatestAttestationsParams): Promise<AttestationQueryResult[]>;
+declare function deduplicateReviews(attestations: AttestationQueryResult[]): AttestationQueryResult[];
+declare function calculateAverageUserReviewRating(attestations: AttestationQueryResult[]): number;
+declare function getMajorVersion(version: string): number;
+
+declare function verifyProof(params: VerifyProofParams): Promise<VerifyProofResult>;
+declare function verifyAttestation(params: VerifyAttestationParams): Promise<VerifyAttestationResult>;
+
+declare function normalizeSchema(schema: SchemaField[] | string): SchemaField[];
+declare function schemaToString(schema: SchemaField[] | string): string;
+declare function encodeAttestationData(schema: SchemaField[] | string, data: Record<string, unknown>): Hex;
+declare function validateAttestationData(schema: SchemaField[] | string, data: Record<string, unknown>): AttestationValidationError[];
+declare function decodeAttestationData(schema: SchemaField[] | string, encodedData: Hex): Record<string, unknown>;
+declare function extractExpirationTime(data: Record<string, unknown>): bigint | number | undefined;
+
+declare function verifySchemaExists(schemaRegistry: unknown, schemaUid: Hex): Promise<boolean>;
+declare function getSchemaDetails(schemaRegistry: unknown, schemaUid: Hex): Promise<{
+    uid: Hex;
+    schema: string;
+    resolver: Hex;
+    revocable: boolean;
+}>;
+declare function formatSchemaUid(schemaUid: string): Hex;
+
+declare function callControllerWitness(params: CallControllerWitnessParams): Promise<CallControllerWitnessResult>;
+
+declare function getSupportedChainIds(): number[];
+declare function isChainSupported(chainId: number): boolean;
+declare function getChainConstants(chainId: number, purpose: ProofPurpose): ChainConstants;
+declare function constructSeed(subjectDidHash: Hex, counterpartyDidHash: Hex, purpose: ProofPurpose): Uint8Array;
+declare function hashSeed(seedBytes: Uint8Array, chainId: number): Hex;
+declare function calculateTransferAmount(subject: string, counterparty: string, chainId: number, purpose: ProofPurpose): bigint;
+declare function calculateTransferAmountFromAddresses(subjectAddress: string, counterpartyAddress: string, chainId: number, purpose: ProofPurpose): bigint;
+declare function createTxEncodedValueProof(chainId: number, txHash: Hex, purpose: ProofPurpose): TxEncodedValueProof;
+declare function formatTransferAmount(amount: bigint | number, chainId: number): string;
+declare function getExplorerTxUrl(chainId: number, txHash: Hex): string;
+declare function getExplorerAddressUrl(chainId: number, address: string): string;
+
+declare function createTxInteractionProof(chainId: number, txHash: Hex): TxInteractionProof;
+
+type CreatePopEip712ProofParams = {
+    signer: string;
+    authorizedEntity: string;
+    signingPurpose: ProofPurpose;
+    chainId: number;
+    creationTimestamp?: number;
+    expirationTimestamp?: number;
+    randomValue?: Hex;
+    statement?: string;
+};
+declare function createPopEip712Proof(params: CreatePopEip712ProofParams, signFn: (typedData: Record<string, unknown>) => Promise<Hex>): Promise<PopEip712Proof>;
+
+type CreatePopJwsProofParams = {
+    issuer: Did;
+    audience: Did;
+    purpose: ProofPurpose;
+    issuedAt?: number;
+    expiresAt?: number;
+    nonce?: string;
+};
+declare function createPopJwsProof(params: CreatePopJwsProofParams, signFn: (payload: Record<string, unknown>, header: Record<string, unknown>) => Promise<string>): Promise<PopJwsProof>;
+
+declare function createX402ReceiptProof(receipt: Record<string, unknown>): X402ReceiptProof;
+declare function createX402OfferProof(offer: Record<string, unknown>): X402OfferProof;
+
+declare function createEvidencePointerProof(url: string): EvidencePointerProof;
+
+declare function parseDnsTxtRecord(record: string): {
+    version?: string;
+    controller?: Did;
+    [key: string]: string | undefined;
+};
+declare function buildDnsTxtRecord(controllerDid: Did): string;
+
+declare function fetchDidDocument(domain: string): Promise<Record<string, unknown>>;
+interface VerifyDidJsonControllerDidOptions {
+    fetchDidDocument?: (domain: string) => Promise<Record<string, unknown>>;
+}
+declare function extractAddressesFromDidDocument(didDocument: Record<string, unknown>): string[];
+declare function verifyDidDocumentControllerDid(didDocument: Record<string, unknown>, expectedControllerDid: Did): {
+    valid: boolean;
+    reason?: string;
+};
+declare function verifyDidJsonControllerDid(domain: string, expectedControllerDid: Did, options?: VerifyDidJsonControllerDidOptions): Promise<{
+    valid: boolean;
+    reason?: string;
+}>;
+
+declare function buildEip712Domain(name: string, version: string, chainId: number, verifyingContract: Hex): {
+    name: string;
+    version: string;
+    chainId: number;
+    verifyingContract: Hex;
+};
+declare function getOmaTrustProofEip712Types(): {
+    primaryType: string;
+    types: Record<string, Array<{
+        name: string;
+        type: string;
+    }>>;
+};
+declare function verifyEip712Signature(typedData: {
+    domain: Record<string, unknown>;
+    types: Record<string, unknown>;
+    message: Record<string, unknown>;
+}, signature: Hex | string): {
+    valid: boolean;
+    signer?: string;
+};
+
+interface VerifyDnsTxtControllerDidOptions {
+    resolveTxt?: (host: string) => Promise<string[][]>;
+    recordPrefix?: string;
+}
+
+type SubjectOwnershipVerificationMethod = "dns" | "did-document" | "wallet" | "contract" | "minting-wallet" | "transfer";
+interface SubjectOwnershipVerificationResult {
+    valid: boolean;
+    method?: SubjectOwnershipVerificationMethod;
+    reason?: string;
+    details?: string;
+    subjectDid: Did;
+    connectedWalletDid: Did;
+    controllingWalletDid?: Did;
+}
+interface EvmOwnershipProvider {
+    call(transaction: {
+        to: string;
+        data: string;
+    }): Promise<string>;
+    getCode(address: string): Promise<string>;
+    getStorage(address: string, slot: string): Promise<string>;
+    getTransaction(hash: string): Promise<{
+        from?: string | null;
+        to?: string | null;
+        value?: bigint | string | number | null;
+        blockNumber?: number | null;
+    } | null>;
+    getTransactionReceipt(hash: string): Promise<{
+        blockNumber: number;
+    } | null>;
+    getBlockNumber(): Promise<number>;
+    getBlock(blockNumber: number): Promise<{
+        timestamp: number;
+    } | null>;
+}
+interface VerifyDidWebOwnershipParams extends VerifyDnsTxtControllerDidOptions {
+    subjectDid: Did;
+    connectedWalletDid: Did;
+    fetchDidDocument?: (domain: string) => Promise<Record<string, unknown>>;
+}
+interface VerifyDidPkhOwnershipParams {
+    subjectDid: Did;
+    connectedWalletDid: Did;
+    provider: EvmOwnershipProvider;
+    txHash?: Hex | string;
+}
+type VerifySubjectOwnershipParams = VerifyDidWebOwnershipParams | (VerifyDidPkhOwnershipParams & VerifyDnsTxtControllerDidOptions);
+declare function verifyDidWebOwnership(params: VerifyDidWebOwnershipParams): Promise<SubjectOwnershipVerificationResult>;
+declare function verifyDidPkhOwnership(params: VerifyDidPkhOwnershipParams): Promise<SubjectOwnershipVerificationResult>;
+declare function verifySubjectOwnership(params: VerifySubjectOwnershipParams): Promise<SubjectOwnershipVerificationResult>;
+
+export { createEvidencePointerProof as $, type AttestationQueryResult as A, type BuildDelegatedTypedDataFromEncodedParams as B, type CallControllerWitnessParams as C, type Did as D, type EvidencePointerProof as E, type VerifyProofParams as F, type GetAttestationParams as G, type Hex as H, type VerifyProofResult as I, type VerifySubjectOwnershipParams as J, type X402ReceiptProof as K, type ListAttestationsParams as L, buildDelegatedAttestationTypedData as M, buildDelegatedTypedDataFromEncoded as N, buildDnsTxtRecord as O, type PopEip712Proof as P, buildEip712Domain as Q, type RevokeAttestationParams as R, type SchemaField as S, type TxEncodedValueProof as T, calculateAverageUserReviewRating as U, type VerifyAttestationParams as V, calculateTransferAmount as W, type X402OfferProof as X, calculateTransferAmountFromAddresses as Y, callControllerWitness as Z, constructSeed as _, type AttestationValidationError as a, createPopEip712Proof as a0, createPopJwsProof as a1, createTxEncodedValueProof as a2, createTxInteractionProof as a3, createX402OfferProof as a4, createX402ReceiptProof as a5, decodeAttestationData as a6, deduplicateReviews as a7, encodeAttestationData as a8, extractAddressesFromDidDocument as a9, validateAttestationData as aA, verifyAttestation as aB, verifyDidDocumentControllerDid as aC, verifyDidJsonControllerDid as aD, verifyDidPkhOwnership as aE, verifyDidWebOwnership as aF, verifyEip712Signature as aG, verifyProof as aH, verifySchemaExists as aI, verifySubjectOwnership as aJ, extractExpirationTime as aa, fetchDidDocument as ab, formatSchemaUid as ac, formatTransferAmount as ad, getAttestation as ae, getAttestationsByAttester as af, getAttestationsForDid as ag, getChainConstants as ah, getExplorerAddressUrl as ai, getExplorerTxUrl as aj, getLatestAttestations as ak, getMajorVersion as al, getOmaTrustProofEip712Types as am, getSchemaDetails as an, getSupportedChainIds as ao, hashSeed as ap, isChainSupported as aq, listAttestations as ar, normalizeSchema as as, parseDnsTxtRecord as at, prepareDelegatedAttestation as au, revokeAttestation as av, schemaToString as aw, splitSignature as ax, submitAttestation as ay, submitDelegatedAttestation as az, type CallControllerWitnessResult as b, type ChainConstants as c, type CreatePopEip712ProofParams as d, type CreatePopJwsProofParams as e, type EvmOwnershipProvider as f, type GetAttestationsByAttesterParams as g, type GetLatestAttestationsParams as h, type PopJwsProof as i, type PrepareDelegatedAttestationParams as j, type PrepareDelegatedAttestationResult as k, type ProofPurpose as l, type ProofType as m, type ProofWrapper as n, type RevokeAttestationResult as o, type SubjectOwnershipVerificationMethod as p, type SubjectOwnershipVerificationResult as q, type SubmitAttestationParams as r, type SubmitAttestationResult as s, type SubmitDelegatedAttestationParams as t, type SubmitDelegatedAttestationResult as u, type TxInteractionProof as v, type VerifyAttestationResult as w, type VerifyDidJsonControllerDidOptions as x, type VerifyDidPkhOwnershipParams as y, type VerifyDidWebOwnershipParams as z };

package/dist/widgets/index.cjs

@@ -0,0 +1,195 @@
+'use strict';
+
+// src/widgets/protocol.ts
+var OMATRUST_READY = "omatrust:ready";
+var OMATRUST_HOST_READY = "omatrust:hostReady";
+var OMATRUST_SIGN_TYPED_DATA = "omatrust:signTypedData";
+var OMATRUST_SIGNATURE = "omatrust:signature";
+var OMATRUST_SIGNATURE_ERROR = "omatrust:signatureError";
+
+// src/widgets/trust-policy.ts
+var DEFAULT_TRUST_POLICY_URL = "https://api.omatrust.org/v1/trust-policy";
+var TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;
+var cachedPolicy = null;
+var cacheTimestamp = 0;
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+async function fetchTrustPolicy(url) {
+  const now = Date.now();
+  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedPolicy;
+  }
+  const res = await fetch(url ?? TRUST_POLICY_URL);
+  if (!res.ok) {
+    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);
+  }
+  const policy = await res.json();
+  if (!policy.version || !policy.chains || typeof policy.chains !== "object") {
+    throw new Error("Invalid trust policy format");
+  }
+  cachedPolicy = policy;
+  cacheTimestamp = now;
+  return policy;
+}
+function extractAllowlists(policy) {
+  const contracts = [];
+  const schemas = [];
+  for (const chain of Object.values(policy.chains)) {
+    if (chain.easContract) contracts.push(chain.easContract);
+    if (chain.schemas) schemas.push(...chain.schemas);
+  }
+  return {
+    allowedContracts: [...new Set(contracts)],
+    allowedSchemas: [...new Set(schemas)]
+  };
+}
+
+// src/widgets/bridge.ts
+function getTrustedBaseDomain() {
+  try {
+    const hostname = new URL(TRUST_POLICY_URL).hostname;
+    const parts = hostname.split(".");
+    return parts.length >= 2 ? parts.slice(-2).join(".") : hostname;
+  } catch {
+    return "omatrust.org";
+  }
+}
+function isOriginTrusted(messageOrigin, baseDomain, policyOrigins, devOverride) {
+  if (devOverride && messageOrigin === devOverride) return true;
+  try {
+    const hostname = new URL(messageOrigin).hostname;
+    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;
+  } catch {
+  }
+  if (policyOrigins.includes(messageOrigin)) return true;
+  return false;
+}
+var HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
+var BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;
+function validateEasSigningRequest(data, allowedSchemas, allowedContracts) {
+  const { id, domain, types, message } = data;
+  if (!id || typeof id !== "string") {
+    return { valid: false, reason: "Missing or invalid request id" };
+  }
+  if (!domain || typeof domain !== "object") {
+    return { valid: false, reason: "Missing domain object" };
+  }
+  const d = domain;
+  if (d.name !== "EAS") {
+    return { valid: false, reason: `Unexpected domain name: "${d.name}" (expected "EAS")` };
+  }
+  if (d.version !== "1.4.0") {
+    return { valid: false, reason: `Unexpected domain version: "${d.version}" (expected "1.4.0")` };
+  }
+  const chainId = Number(d.chainId);
+  if (!Number.isInteger(chainId) || chainId <= 0) {
+    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };
+  }
+  if (typeof d.verifyingContract !== "string" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {
+    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };
+  }
+  const contractLower = d.verifyingContract.toLowerCase();
+  if (!allowedContracts.some((c) => c.toLowerCase() === contractLower)) {
+    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };
+  }
+  if (!types || typeof types !== "object") {
+    return { valid: false, reason: "Missing types object" };
+  }
+  if (!message || typeof message !== "object") {
+    return { valid: false, reason: "Missing message object" };
+  }
+  const m = message;
+  if (typeof m.schema !== "string" || !BYTES32_RE.test(m.schema)) {
+    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };
+  }
+  const schemaLower = m.schema.toLowerCase();
+  if (!allowedSchemas.some((s) => s.toLowerCase() === schemaLower)) {
+    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };
+  }
+  if (typeof m.attester !== "string" || !HEX_ADDRESS_RE.test(m.attester)) {
+    return { valid: false, reason: `Invalid attester address: ${m.attester}` };
+  }
+  const deadline = Number(m.deadline);
+  if (!Number.isFinite(deadline) || deadline <= 0) {
+    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (deadline <= now) {
+    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };
+  }
+  return { valid: true };
+}
+async function createSigningBridge(options) {
+  const { iframeId, signTypedData, devOriginOverride } = options;
+  const policy = await fetchTrustPolicy();
+  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);
+  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {
+    throw new Error("Trust policy contains no allowed contracts or schemas");
+  }
+  const baseDomain = getTrustedBaseDomain();
+  const policyOrigins = policy.widgetOrigins ?? [];
+  async function handleMessage(event) {
+    const data = event.data;
+    if (!data || typeof data !== "object" || typeof data.type !== "string") return;
+    if (!String(data.type).startsWith("omatrust:")) return;
+    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {
+      return;
+    }
+    const iframe = document.getElementById(iframeId);
+    if (!iframe) return;
+    if (event.source !== iframe.contentWindow) {
+      return;
+    }
+    const source = event.source;
+    const replyOrigin = devOriginOverride ?? (() => {
+      try {
+        return new URL(iframe.src).origin;
+      } catch {
+        return "*";
+      }
+    })();
+    function reply(msg) {
+      source.postMessage(msg, replyOrigin);
+    }
+    if (data.type === OMATRUST_READY) {
+      reply({ type: OMATRUST_HOST_READY });
+      return;
+    }
+    if (data.type === OMATRUST_SIGN_TYPED_DATA) {
+      const { id, domain, types, message } = data;
+      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);
+      if (!validation.valid) {
+        reply({
+          type: OMATRUST_SIGNATURE_ERROR,
+          id: id ?? "unknown",
+          error: `Signing request rejected: ${validation.reason}`
+        });
+        return;
+      }
+      try {
+        const signature = await signTypedData(domain, types, message);
+        reply({ type: OMATRUST_SIGNATURE, id, signature });
+      } catch (err) {
+        const error = err instanceof Error ? err.message : "Signing failed";
+        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });
+      }
+    }
+  }
+  window.addEventListener("message", handleMessage);
+  return {
+    destroy() {
+      window.removeEventListener("message", handleMessage);
+    }
+  };
+}
+
+exports.OMATRUST_HOST_READY = OMATRUST_HOST_READY;
+exports.OMATRUST_READY = OMATRUST_READY;
+exports.OMATRUST_SIGNATURE = OMATRUST_SIGNATURE;
+exports.OMATRUST_SIGNATURE_ERROR = OMATRUST_SIGNATURE_ERROR;
+exports.OMATRUST_SIGN_TYPED_DATA = OMATRUST_SIGN_TYPED_DATA;
+exports.TRUST_POLICY_URL = TRUST_POLICY_URL;
+exports.createSigningBridge = createSigningBridge;
+exports.extractAllowlists = extractAllowlists;
+exports.fetchTrustPolicy = fetchTrustPolicy;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/widgets/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/widgets/trust-policy.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";;;AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACVxC,IAAM,wBAAA,GAA2B,0CAAA;AAE1B,IAAM,gBAAA,GAAmB;AAehC,IAAI,YAAA,GAAmC,IAAA;AACvC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,iBAAiB,GAAA,EAAoC;AACzE,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,YAAA,IAAgB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACvD,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,gBAAgB,CAAA;AAC/C,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,MAAA,GAAsB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE3C,EAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,MAAA,IAAU,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU;AAC1E,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAEA,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,kBAAkB,MAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,EAAG;AAChD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,MAAM,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAM,OAAO,CAAA;AAAA,EAClD;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACRA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,QAAA;AAC3C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAEzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACnG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAeA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAGvD,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,MAAM,CAAA;AAErE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,aAAA,IAAiB,EAAC;AAE/C,EAAA,eAAe,cAAc,KAAA,EAAqB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAGhD,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ;AAGb,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAGrB,IAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,MAAA,IAAI;AAAE,QAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,MAAQ,CAAA,CAAA,MACnC;AAAE,QAAA,OAAO,GAAA;AAAA,MAAK;AAAA,IACtB,CAAA,GAAG;AAEH,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","/**\n * Trust policy: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * The bridge uses this to validate signing requests automatically.\n * Developers don't need to maintain their own allowlists.\n */\n\nconst DEFAULT_TRUST_POLICY_URL = \"https://api.omatrust.org/v1/trust-policy\";\n\nexport const TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;\n\nexport type ChainPolicy = {\n  name: string;\n  easContract: string;\n  schemas: string[];\n};\n\nexport type TrustPolicy = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  chains: Record<string, ChainPolicy>;\n};\n\nlet cachedPolicy: TrustPolicy | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust policy from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust policy URL (for testing or custom deployments)\n */\nexport async function fetchTrustPolicy(url?: string): Promise<TrustPolicy> {\n  const now = Date.now();\n  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedPolicy;\n  }\n\n  const res = await fetch(url ?? TRUST_POLICY_URL);\n  if (!res.ok) {\n    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);\n  }\n\n  const policy: TrustPolicy = await res.json();\n\n  if (!policy.version || !policy.chains || typeof policy.chains !== \"object\") {\n    throw new Error(\"Invalid trust policy format\");\n  }\n\n  cachedPolicy = policy;\n  cacheTimestamp = now;\n  return policy;\n}\n\n/**\n * Extract the allowed contracts and schemas from a trust policy.\n * Returns all contracts and schemas across all chains.\n */\nexport function extractAllowlists(policy: TrustPolicy): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(policy.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas) schemas.push(...chain.schemas);\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust policy before forwarding to the host's wallet.\n *\n * The bridge resolves the iframe element lazily by ID when messages arrive,\n * avoiding React ref timing issues with conditionally rendered iframes.\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframeId: \"omatrust-widget\",\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustPolicy, extractAllowlists, TRUST_POLICY_URL } from \"./trust-policy\";\n\nexport type SigningBridgeOptions = {\n  /**\n   * The ID of the iframe element containing the widget.\n   * The bridge looks up the element by ID when messages arrive,\n   * so the iframe doesn't need to exist when the bridge is created.\n   */\n  iframeId: string;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust policy domain\n   * (*.omatrust.org) plus any widgetOrigins in the policy.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_POLICY_URL).hostname;\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * The bridge resolves the iframe element by ID when messages arrive, not at\n * creation time. This avoids React ref timing issues — the bridge can be\n * created before the iframe is in the DOM.\n *\n * Fetches the OMA3 trust policy on creation. Fails closed if unavailable.\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframeId, signTypedData, devOriginOverride } = options;\n\n  // Fetch the trust policy — fail closed if unavailable\n  const policy = await fetchTrustPolicy();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust policy contains no allowed contracts or schemas\");\n  }\n\n  const baseDomain = getTrustedBaseDomain();\n  const policyOrigins = policy.widgetOrigins ?? [];\n\n  async function handleMessage(event: MessageEvent) {\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    // Origin check\n    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {\n      return;\n    }\n\n    // Resolve the iframe element lazily by ID.\n    // This works even if the iframe was mounted after the bridge was created.\n    const iframe = document.getElementById(iframeId) as HTMLIFrameElement | null;\n    if (!iframe) return;\n\n    // Source check — must come from this specific iframe\n    if (event.source !== iframe.contentWindow) {\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    // Determine reply origin from the iframe's current src\n    const replyOrigin = devOriginOverride ?? (() => {\n      try { return new URL(iframe.src).origin; }\n      catch { return \"*\"; }\n    })();\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}