@oma3/omatrust 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/types-Dn0OwaNj.d.ts

@@ -0,0 +1,307 @@
+/**
+ * JWK and did:jwk Helpers — Phase 2
+ *
+ * Provides conversion between public JWKs and did:jwk DIDs,
+ * deterministic JWK comparison, and public JWK validation.
+ *
+ * did:jwk is the preferred durable DID representation for JWS/JWK public key
+ * material. It is immutable (the DID IS the key) and should be used as the
+ * controllerDid for authorization checks.
+ *
+ * Uses the `jose` library for base64url encoding/decoding and JWK thumbprints.
+ */
+/** Minimal public JWK structure */
+interface PublicJwk {
+    kty: string;
+    [key: string]: unknown;
+}
+/** Result of JWK validation */
+interface JwkValidationResult {
+    valid: boolean;
+    error?: string;
+}
+/**
+ * Validate that a JWK object is a well-formed public key.
+ *
+ * Requirements:
+ * - Must be a non-null object
+ * - Must have a valid `kty` (EC, OKP, RSA)
+ * - Must have required public key fields for its key type
+ * - Must NOT contain private key material (d, p, q, dp, dq, qi, oth)
+ */
+declare function validatePublicJwk(jwk: unknown): JwkValidationResult;
+/**
+ * Convert a public JWK to a did:jwk DID.
+ *
+ * Uses deterministic (sorted-key) JSON serialization and base64url encoding.
+ * Rejects JWKs containing private key material.
+ *
+ * @param jwk - A public JWK object
+ * @returns The did:jwk DID string
+ * @throws OmaTrustError if the JWK is invalid or contains private key material
+ */
+declare function jwkToDidJwk(jwk: unknown): string;
+/**
+ * Convert a did:jwk DID back to a public JWK object.
+ *
+ * Validates the DID structure, decodes the base64url payload,
+ * parses JSON, and validates the resulting JWK.
+ *
+ * @param didJwk - A did:jwk DID string
+ * @returns The decoded public JWK object
+ * @throws OmaTrustError if the DID is malformed or contains private key material
+ */
+declare function didJwkToJwk(didJwk: string): PublicJwk;
+/**
+ * Compare two public JWKs for equality.
+ *
+ * Compares only the public key material fields (kty, crv, x, y, n, e, etc.).
+ * Ignores property order, metadata fields (kid, use, alg, key_ops, ext),
+ * and rejects/strips private key fields before comparison.
+ *
+ * @param a - First public JWK
+ * @param b - Second public JWK
+ * @returns true if both JWKs represent the same public key
+ * @throws OmaTrustError if either JWK contains private key material
+ */
+declare function publicJwkEquals(a: unknown, b: unknown): boolean;
+/**
+ * Compute an RFC 7638 JWK Thumbprint for a public JWK.
+ *
+ * Returns the base64url-encoded SHA-256 thumbprint. This is a compact,
+ * deterministic fingerprint of the public key material.
+ *
+ * Used in OMATrust DNS TXT records as: `jkt=S256:<thumbprint>`
+ *
+ * @param jwk - A public JWK object
+ * @param digestAlgorithm - Hash algorithm (default: "sha256")
+ * @returns base64url-encoded thumbprint string
+ * @throws OmaTrustError if the JWK is invalid or contains private key material
+ */
+declare function computeJwkThumbprint(jwk: unknown, digestAlgorithm?: "sha256" | "sha384" | "sha512"): Promise<string>;
+/**
+ * Format a JWK thumbprint as an OMATrust DNS TXT `jkt` value.
+ *
+ * Format: `jkt=S256:<base64url-thumbprint>`
+ *
+ * @param jwk - A public JWK object
+ * @returns Formatted jkt string for DNS TXT records
+ */
+declare function formatJktValue(jwk: unknown): Promise<string>;
+
+/**
+ * DID URL Key Resolution — Phase 3
+ *
+ * Resolves DID URL key references (e.g. did:web:api.example.com#key-1) to
+ * public key material and derives durable did:jwk controller DIDs.
+ *
+ * DID URLs are mutable key references. This module resolves them to the
+ * actual public key material they currently point to, then converts that
+ * material into an immutable did:jwk for use as a controller DID.
+ */
+
+/** Result of resolving a DID URL to public key material */
+interface ResolvedPublicKey {
+    /** The original DID URL */
+    didUrl: string;
+    /** The base DID (without fragment) */
+    did: string;
+    /** The fragment identifier */
+    fragment: string | null;
+    /** The resolved public JWK */
+    publicKeyJwk: PublicJwk;
+    /** The verification method ID that matched */
+    verificationMethodId: string;
+}
+/** Result of resolving a DID URL to a durable controller DID */
+interface ResolvedControllerDid extends ResolvedPublicKey {
+    /** The durable did:jwk derived from the resolved public key */
+    controllerDid: string;
+}
+/** Options for DID URL key resolution */
+interface ResolveKeyOptions {
+    /**
+     * Custom DID document fetcher. If not provided, uses the shared
+     * fetchDidDocument which fetches from `/.well-known/did.json`.
+     */
+    fetchDidDocument?: (domain: string) => Promise<Record<string, unknown>>;
+}
+/**
+ * Resolve a DID URL to public key material.
+ *
+ * Currently supports:
+ * - did:web with fragment (e.g. did:web:api.example.com#key-1)
+ *
+ * Resolution steps:
+ * 1. Parse the DID URL
+ * 2. Resolve the base DID (fetch DID document)
+ * 3. Find the matching verification method
+ * 4. Extract and validate publicKeyJwk
+ *
+ * This function only obtains key material. It does not make authorization
+ * decisions or check Controller Witness / Key Binding records.
+ *
+ * @param didUrl - A DID URL string (e.g. "did:web:api.example.com#key-1")
+ * @param options - Optional configuration (custom fetcher, etc.)
+ * @returns Resolved public key information
+ * @throws OmaTrustError if resolution fails
+ */
+declare function resolveDidUrlToPublicKey(didUrl: string, options?: ResolveKeyOptions): Promise<ResolvedPublicKey>;
+/**
+ * Resolve a DID URL to a durable controller DID.
+ *
+ * This wraps resolveDidUrlToPublicKey and adds the did:jwk conversion step.
+ * The returned controllerDid is the durable DID that callers should pass
+ * to getControllerAuthorization.
+ *
+ * @param didUrl - A DID URL string (e.g. "did:web:api.example.com#key-1")
+ * @param options - Optional configuration (custom fetcher, etc.)
+ * @returns Resolved public key plus derived did:jwk controller DID
+ * @throws OmaTrustError if resolution fails
+ */
+declare function resolveDidUrlToControllerDid(didUrl: string, options?: ResolveKeyOptions): Promise<ResolvedControllerDid>;
+
+/**
+ * Identity Types — Phase 4
+ *
+ * Types for JWS verification results and authorization metadata.
+ * These define the contract between signature verification and
+ * downstream authorization checks via getControllerAuthorization.
+ */
+
+/** Source of the public key used for JWS signature verification */
+type PublicKeySource = "embedded-jwk" | "kid-resolution";
+/**
+ * Structured result of JWS signature verification.
+ *
+ * This result is NOT an authorization result. It does not determine whether
+ * the signing key was authorized to act for the service identified by resourceUrl.
+ *
+ * It provides enough information for callers to perform downstream authorization
+ * checks via getControllerAuthorization:
+ * - publicKeyDid (did:jwk) is the durable controller DID
+ * - resourceUrl identifies the service subject
+ * - issuedAt enables authorization-window checks for receipts
+ */
+interface JwsVerificationResult {
+    /** Whether the JWS signature is cryptographically valid */
+    valid: boolean;
+    /** Decoded JWS protected header */
+    header: Record<string, unknown>;
+    /** Decoded JWS payload */
+    payload: Record<string, unknown>;
+    /** kid from the JWS header (a key reference, NOT a controller DID) */
+    kid: string | null;
+    /** The public JWK used for signature verification */
+    publicKeyJwk: PublicJwk;
+    /** How the public key was obtained */
+    publicKeySource: PublicKeySource;
+    /**
+     * The durable did:jwk derived from the public key.
+     * This is the controller DID for downstream authorization checks.
+     * Pass this as controllerDid to getControllerAuthorization.
+     */
+    publicKeyDid: string;
+    /** Error details when valid is false */
+    error?: JwsVerificationError;
+}
+/** Error details for failed JWS verification */
+interface JwsVerificationError {
+    code: string;
+    message: string;
+}
+/**
+ * Failed JWS verification result.
+ * Returned when parsing, decoding, or signature verification fails.
+ */
+interface JwsVerificationFailure {
+    valid: false;
+    error: JwsVerificationError;
+    header?: Record<string, unknown>;
+    payload?: Record<string, unknown>;
+    kid?: string | null;
+    publicKeyJwk?: PublicJwk;
+    publicKeySource?: PublicKeySource;
+    publicKeyDid?: string;
+}
+/**
+ * Authorization metadata extracted from a verified x402 artifact.
+ *
+ * This is the information a caller needs to perform an authorization check
+ * after signature verification succeeds (JWS or EIP-712).
+ *
+ * Usage:
+ * 1. Verify artifact → get JwsVerificationResult or Eip712VerificationResult
+ * 2. Extract AuthorizationMetadata from the result
+ * 3. Call getControllerAuthorization({ subjectDid, controllerDid, purpose })
+ * 4. Evaluate the returned authorization window against policy
+ */
+interface AuthorizationMetadata {
+    /**
+     * The durable controller DID derived from the verified key material.
+     * - JWS: did:jwk derived from the public key
+     * - EIP-712: did:pkh:eip155:1:<signer-address>
+     * Pass this as controllerDid to getControllerAuthorization.
+     */
+    controllerDid: string;
+    /**
+     * The subject DID derived from resourceUrl.
+     * For x402 artifacts, this is typically did:web:<domain-from-resourceUrl>.
+     * Pass this as subjectDid to getControllerAuthorization.
+     */
+    subjectDid: string | null;
+    /**
+     * The resourceUrl from the signed payload.
+     * Identifies the service/resource the artifact is associated with.
+     */
+    resourceUrl: string | null;
+    /**
+     * The issuedAt timestamp from the signed payload (receipts).
+     * Used for authorization-window checks — was the controller authorized at this time?
+     * May be a string (ISO) or number (unix seconds) depending on the payload.
+     */
+    issuedAt: string | number | null;
+    /**
+     * The kid from the JWS header (mutable key reference).
+     * Useful for key-pinning lookups but NOT a controller DID.
+     * Null for EIP-712 artifacts.
+     */
+    kid: string | null;
+    /**
+     * The public JWK used for signature verification.
+     * Present for JWS artifacts, null for EIP-712.
+     */
+    publicKeyJwk: PublicJwk | null;
+    /**
+     * The recovered signer address (checksummed).
+     * Present for EIP-712 artifacts, null for JWS.
+     */
+    signer: string | null;
+}
+/**
+ * Input for extractAuthorizationMetadata.
+ * Accepts either a JwsVerificationResult or an Eip712VerificationResult.
+ */
+type VerificationResultInput = JwsVerificationResult | {
+    valid: true;
+    payload: Record<string, unknown>;
+    signer: string;
+    artifactType: string;
+};
+/**
+ * Extract authorization metadata from a successful verification result.
+ *
+ * Works with both JWS and EIP-712 verification results:
+ * - JWS: controllerDid is did:jwk, publicKeyJwk is populated, kid may be present
+ * - EIP-712: controllerDid is did:pkh:eip155:1:<signer>, signer is populated
+ *
+ * Derives the subject DID from resourceUrl when possible (assumes did:web
+ * for HTTPS URLs). Returns null for subjectDid if resourceUrl is missing
+ * or cannot be parsed.
+ *
+ * @param result - A successful verification result (valid === true)
+ * @returns Authorization metadata for downstream getControllerAuthorization calls
+ */
+declare function extractAuthorizationMetadata(result: VerificationResultInput): AuthorizationMetadata;
+
+export { type AuthorizationMetadata as A, type JwkValidationResult as J, type PublicJwk as P, type ResolveKeyOptions as R, type VerificationResultInput as V, type JwsVerificationError as a, type JwsVerificationFailure as b, type JwsVerificationResult as c, type PublicKeySource as d, type ResolvedControllerDid as e, type ResolvedPublicKey as f, computeJwkThumbprint as g, didJwkToJwk as h, extractAuthorizationMetadata as i, formatJktValue as j, jwkToDidJwk as k, resolveDidUrlToPublicKey as l, publicJwkEquals as p, resolveDidUrlToControllerDid as r, validatePublicJwk as v };

package/dist/widgets/index.cjs

@@ -7,35 +7,76 @@ var OMATRUST_SIGN_TYPED_DATA = "omatrust:signTypedData";
 var OMATRUST_SIGNATURE = "omatrust:signature";
 var OMATRUST_SIGNATURE_ERROR = "omatrust:signatureError";
 
-// src/widgets/trust-policy.ts
-var DEFAULT_TRUST_POLICY_URL = "https://api.omatrust.org/v1/trust-policy";
-var TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;
-var cachedPolicy = null;
+// src/shared/errors.ts
+var OmaTrustError = class extends Error {
+  code;
+  details;
+  constructor(code, message, details) {
+    super(message);
+    this.name = "OmaTrustError";
+    this.code = code;
+    this.details = details;
+  }
+};
+
+// src/shared/trust-anchors.ts
+var DEFAULT_TRUST_ANCHORS_URL = "https://api.omatrust.org/v1/trust-anchors";
+var TRUST_ANCHORS_URL = DEFAULT_TRUST_ANCHORS_URL;
+var cachedAnchors = null;
 var cacheTimestamp = 0;
 var CACHE_TTL_MS = 5 * 60 * 1e3;
-async function fetchTrustPolicy(url) {
+async function fetchTrustAnchors(url) {
   const now = Date.now();
-  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {
-    return cachedPolicy;
+  if (cachedAnchors && now - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedAnchors;
+  }
+  let res;
+  try {
+    res = await fetch(url ?? TRUST_ANCHORS_URL);
+  } catch (err) {
+    throw new OmaTrustError("NETWORK_ERROR", "Failed to fetch trust anchors", { err });
   }
-  const res = await fetch(url ?? TRUST_POLICY_URL);
   if (!res.ok) {
-    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);
+    throw new OmaTrustError("NETWORK_ERROR", `Failed to fetch trust anchors: ${res.status} ${res.statusText}`);
   }
-  const policy = await res.json();
-  if (!policy.version || !policy.chains || typeof policy.chains !== "object") {
-    throw new Error("Invalid trust policy format");
+  const anchors = await res.json();
+  if (!anchors.version || !anchors.chains || typeof anchors.chains !== "object") {
+    throw new OmaTrustError("INVALID_INPUT", "Invalid trust anchors format");
   }
-  cachedPolicy = policy;
+  cachedAnchors = anchors;
   cacheTimestamp = now;
-  return policy;
+  return anchors;
 }
-function extractAllowlists(policy) {
+function getChainAnchors(anchors, caip2) {
+  const chain = anchors.chains[caip2];
+  if (!chain) {
+    throw new OmaTrustError("UNSUPPORTED_CHAIN", `Chain ${caip2} is not in the trust anchors`, {
+      caip2,
+      supportedChains: Object.keys(anchors.chains)
+    });
+  }
+  return chain;
+}
+function getSchemaAnchor(anchors, caip2, schemaName) {
+  const chain = getChainAnchors(anchors, caip2);
+  const uid = chain.schemas[schemaName];
+  if (!uid) {
+    throw new OmaTrustError("INVALID_INPUT", `Schema "${schemaName}" not found in trust anchors for chain ${caip2}`, {
+      caip2,
+      schemaName,
+      availableSchemas: Object.keys(chain.schemas)
+    });
+  }
+  return uid;
+}
+function extractAllowlists(anchors) {
   const contracts = [];
   const schemas = [];
-  for (const chain of Object.values(policy.chains)) {
+  for (const chain of Object.values(anchors.chains)) {
     if (chain.easContract) contracts.push(chain.easContract);
-    if (chain.schemas) schemas.push(...chain.schemas);
+    if (chain.schemas && typeof chain.schemas === "object") {
+      schemas.push(...Object.values(chain.schemas));
+    }
   }
   return {
     allowedContracts: [...new Set(contracts)],
@@ -46,7 +87,7 @@ function extractAllowlists(policy) {
 // src/widgets/bridge.ts
 function getTrustedBaseDomain() {
   try {
-    const hostname = new URL(TRUST_POLICY_URL).hostname;
+    const hostname = new URL(TRUST_ANCHORS_URL).hostname;
     const parts = hostname.split(".");
     return parts.length >= 2 ? parts.slice(-2).join(".") : hostname;
   } catch {
@@ -89,7 +130,7 @@ function validateEasSigningRequest(data, allowedSchemas, allowedContracts) {
   }
   const contractLower = d.verifyingContract.toLowerCase();
   if (!allowedContracts.some((c) => c.toLowerCase() === contractLower)) {
-    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };
+    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust anchors` };
   }
   if (!types || typeof types !== "object") {
     return { valid: false, reason: "Missing types object" };
@@ -103,7 +144,7 @@ function validateEasSigningRequest(data, allowedSchemas, allowedContracts) {
   }
   const schemaLower = m.schema.toLowerCase();
   if (!allowedSchemas.some((s) => s.toLowerCase() === schemaLower)) {
-    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };
+    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust anchors` };
   }
   if (typeof m.attester !== "string" || !HEX_ADDRESS_RE.test(m.attester)) {
     return { valid: false, reason: `Invalid attester address: ${m.attester}` };
@@ -120,18 +161,18 @@ function validateEasSigningRequest(data, allowedSchemas, allowedContracts) {
 }
 async function createSigningBridge(options) {
   const { iframeId, signTypedData, devOriginOverride } = options;
-  const policy = await fetchTrustPolicy();
-  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);
+  const anchors = await fetchTrustAnchors();
+  const { allowedContracts, allowedSchemas } = extractAllowlists(anchors);
   if (allowedContracts.length === 0 || allowedSchemas.length === 0) {
-    throw new Error("Trust policy contains no allowed contracts or schemas");
+    throw new Error("Trust anchors contain no allowed contracts or schemas");
   }
   const baseDomain = getTrustedBaseDomain();
-  const policyOrigins = policy.widgetOrigins ?? [];
+  const anchorOrigins = anchors.widgetOrigins ?? [];
   async function handleMessage(event) {
     const data = event.data;
     if (!data || typeof data !== "object" || typeof data.type !== "string") return;
     if (!String(data.type).startsWith("omatrust:")) return;
-    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {
+    if (!isOriginTrusted(event.origin, baseDomain, anchorOrigins, devOriginOverride)) {
       return;
     }
     const iframe = document.getElementById(iframeId);
@@ -187,9 +228,11 @@ exports.OMATRUST_READY = OMATRUST_READY;
 exports.OMATRUST_SIGNATURE = OMATRUST_SIGNATURE;
 exports.OMATRUST_SIGNATURE_ERROR = OMATRUST_SIGNATURE_ERROR;
 exports.OMATRUST_SIGN_TYPED_DATA = OMATRUST_SIGN_TYPED_DATA;
-exports.TRUST_POLICY_URL = TRUST_POLICY_URL;
+exports.TRUST_ANCHORS_URL = TRUST_ANCHORS_URL;
 exports.createSigningBridge = createSigningBridge;
 exports.extractAllowlists = extractAllowlists;
-exports.fetchTrustPolicy = fetchTrustPolicy;
+exports.fetchTrustAnchors = fetchTrustAnchors;
+exports.getChainAnchors = getChainAnchors;
+exports.getSchemaAnchor = getSchemaAnchor;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/widgets/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/widgets/trust-policy.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";;;AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACVxC,IAAM,wBAAA,GAA2B,0CAAA;AAE1B,IAAM,gBAAA,GAAmB;AAehC,IAAI,YAAA,GAAmC,IAAA;AACvC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,iBAAiB,GAAA,EAAoC;AACzE,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,YAAA,IAAgB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACvD,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,gBAAgB,CAAA;AAC/C,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,MAAA,GAAsB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE3C,EAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,MAAA,IAAU,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU;AAC1E,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAEA,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,kBAAkB,MAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,EAAG;AAChD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,MAAM,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAM,OAAO,CAAA;AAAA,EAClD;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACRA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,QAAA;AAC3C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAEzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACnG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAeA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAGvD,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,MAAM,CAAA;AAErE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,aAAA,IAAiB,EAAC;AAE/C,EAAA,eAAe,cAAc,KAAA,EAAqB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAGhD,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ;AAGb,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAGrB,IAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,MAAA,IAAI;AAAE,QAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,MAAQ,CAAA,CAAA,MACnC;AAAE,QAAA,OAAO,GAAA;AAAA,MAAK;AAAA,IACtB,CAAA,GAAG;AAEH,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","/**\n * Trust policy: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * The bridge uses this to validate signing requests automatically.\n * Developers don't need to maintain their own allowlists.\n */\n\nconst DEFAULT_TRUST_POLICY_URL = \"https://api.omatrust.org/v1/trust-policy\";\n\nexport const TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;\n\nexport type ChainPolicy = {\n  name: string;\n  easContract: string;\n  schemas: string[];\n};\n\nexport type TrustPolicy = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  chains: Record<string, ChainPolicy>;\n};\n\nlet cachedPolicy: TrustPolicy | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust policy from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust policy URL (for testing or custom deployments)\n */\nexport async function fetchTrustPolicy(url?: string): Promise<TrustPolicy> {\n  const now = Date.now();\n  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedPolicy;\n  }\n\n  const res = await fetch(url ?? TRUST_POLICY_URL);\n  if (!res.ok) {\n    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);\n  }\n\n  const policy: TrustPolicy = await res.json();\n\n  if (!policy.version || !policy.chains || typeof policy.chains !== \"object\") {\n    throw new Error(\"Invalid trust policy format\");\n  }\n\n  cachedPolicy = policy;\n  cacheTimestamp = now;\n  return policy;\n}\n\n/**\n * Extract the allowed contracts and schemas from a trust policy.\n * Returns all contracts and schemas across all chains.\n */\nexport function extractAllowlists(policy: TrustPolicy): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(policy.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas) schemas.push(...chain.schemas);\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust policy before forwarding to the host's wallet.\n *\n * The bridge resolves the iframe element lazily by ID when messages arrive,\n * avoiding React ref timing issues with conditionally rendered iframes.\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframeId: \"omatrust-widget\",\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustPolicy, extractAllowlists, TRUST_POLICY_URL } from \"./trust-policy\";\n\nexport type SigningBridgeOptions = {\n  /**\n   * The ID of the iframe element containing the widget.\n   * The bridge looks up the element by ID when messages arrive,\n   * so the iframe doesn't need to exist when the bridge is created.\n   */\n  iframeId: string;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust policy domain\n   * (*.omatrust.org) plus any widgetOrigins in the policy.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_POLICY_URL).hostname;\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * The bridge resolves the iframe element by ID when messages arrive, not at\n * creation time. This avoids React ref timing issues — the bridge can be\n * created before the iframe is in the DOM.\n *\n * Fetches the OMA3 trust policy on creation. Fails closed if unavailable.\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframeId, signTypedData, devOriginOverride } = options;\n\n  // Fetch the trust policy — fail closed if unavailable\n  const policy = await fetchTrustPolicy();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust policy contains no allowed contracts or schemas\");\n  }\n\n  const baseDomain = getTrustedBaseDomain();\n  const policyOrigins = policy.widgetOrigins ?? [];\n\n  async function handleMessage(event: MessageEvent) {\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    // Origin check\n    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {\n      return;\n    }\n\n    // Resolve the iframe element lazily by ID.\n    // This works even if the iframe was mounted after the bridge was created.\n    const iframe = document.getElementById(iframeId) as HTMLIFrameElement | null;\n    if (!iframe) return;\n\n    // Source check — must come from this specific iframe\n    if (event.source !== iframe.contentWindow) {\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    // Determine reply origin from the iframe's current src\n    const replyOrigin = devOriginOverride ?? (() => {\n      try { return new URL(iframe.src).origin; }\n      catch { return \"*\"; }\n    })();\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/shared/errors.ts","../../src/shared/trust-anchors.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";;;AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACjBjC,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACA,OAAA;AAAA,EAEA,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF,CAAA;;;ACCA,IAAM,yBAAA,GAA4B,2CAAA;AAE3B,IAAM,iBAAA,GAAoB;AA8BjC,IAAI,aAAA,GAAqC,IAAA;AACzC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,kBAAkB,GAAA,EAAqC;AAC3E,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,aAAA,IAAiB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACxD,IAAA,OAAO,aAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,iBAAiB,CAAA;AAAA,EAC5C,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,+BAAA,EAAiC,EAAE,KAAK,CAAA;AAAA,EACnF;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,cAAc,eAAA,EAAiB,CAAA,+BAAA,EAAkC,IAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,OAAA,GAAwB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE7C,EAAA,IAAI,CAAC,QAAQ,OAAA,IAAW,CAAC,QAAQ,MAAA,IAAU,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AAC7E,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,8BAA8B,CAAA;AAAA,EACzE;AAEA,EAAA,aAAA,GAAgB,OAAA;AAChB,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,eAAA,CAAgB,SAAuB,KAAA,EAA6B;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AAClC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAA,CAAc,mBAAA,EAAqB,CAAA,MAAA,EAAS,KAAK,CAAA,4BAAA,CAAA,EAAgC;AAAA,MACzF,KAAA;AAAA,MACA,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,eAAA,CAAgB,OAAA,EAAuB,KAAA,EAAe,UAAA,EAA4B;AAChG,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,OAAA,EAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA;AACpC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,WAAW,UAAU,CAAA,uCAAA,EAA0C,KAAK,CAAA,CAAA,EAAI;AAAA,MAC/G,KAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,kBAAkB,OAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,OAAA,IAAW,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACtD,MAAA,OAAA,CAAQ,KAAK,GAAG,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACpEA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,iBAAiB,CAAA,CAAE,QAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAEzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACpG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACvF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAeA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAGvD,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AACxC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,OAAO,CAAA;AAEtE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,IAAiB,EAAC;AAEhD,EAAA,eAAe,cAAc,KAAA,EAAqB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAGhD,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ;AAGb,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAGrB,IAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,MAAA,IAAI;AAAE,QAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,MAAQ,CAAA,CAAA,MACnC;AAAE,QAAA,OAAO,GAAA;AAAA,MAAK;AAAA,IACtB,CAAA,GAAG;AAEH,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","export class OmaTrustError extends Error {\n  code: string;\n  details?: unknown;\n\n  constructor(code: string, message: string, details?: unknown) {\n    super(message);\n    this.name = \"OmaTrustError\";\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport function toOmaTrustError(\n  code: string,\n  message: string,\n  details?: unknown\n): OmaTrustError {\n  return new OmaTrustError(code, message, details);\n}\n","/**\n * Trust anchors: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * Used by the widget signing bridge for request validation and by the\n * reputation module for chain/contract resolution.\n *\n * Chain keys use CAIP-2 identifiers (e.g., \"eip155:66238\").\n */\n\nimport { OmaTrustError } from \"./errors\";\n\nconst DEFAULT_TRUST_ANCHORS_URL = \"https://api.omatrust.org/v1/trust-anchors\";\n\nexport const TRUST_ANCHORS_URL = DEFAULT_TRUST_ANCHORS_URL;\n\nexport type ChainAnchors = {\n  name: string;\n  easContract: string;\n  /** Schema name → schema UID mapping */\n  schemas: Record<string, string>;\n};\n\nexport type ApprovedIssuer = {\n  address: string;\n  label: string;\n  schemas: string[];\n  status: \"active\" | \"revoked\";\n  validFrom: string;\n  revokedAt?: string;\n};\n\nexport type TrustAnchors = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  /** CAIP-2 chain identifier → chain-specific trust anchors */\n  chains: Record<string, ChainAnchors>;\n  registries?: Array<{\n    type: \"approved-issuers\";\n    issuers: ApprovedIssuer[];\n  }>;\n};\n\nlet cachedAnchors: TrustAnchors | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust anchors from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust anchors URL (for testing or custom deployments)\n */\nexport async function fetchTrustAnchors(url?: string): Promise<TrustAnchors> {\n  const now = Date.now();\n  if (cachedAnchors && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedAnchors;\n  }\n\n  let res: Response;\n  try {\n    res = await fetch(url ?? TRUST_ANCHORS_URL);\n  } catch (err) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", \"Failed to fetch trust anchors\", { err });\n  }\n\n  if (!res.ok) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", `Failed to fetch trust anchors: ${res.status} ${res.statusText}`);\n  }\n\n  const anchors: TrustAnchors = await res.json();\n\n  if (!anchors.version || !anchors.chains || typeof anchors.chains !== \"object\") {\n    throw new OmaTrustError(\"INVALID_INPUT\", \"Invalid trust anchors format\");\n  }\n\n  cachedAnchors = anchors;\n  cacheTimestamp = now;\n  return anchors;\n}\n\n/**\n * Look up chain anchors by CAIP-2 identifier.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n */\nexport function getChainAnchors(anchors: TrustAnchors, caip2: string): ChainAnchors {\n  const chain = anchors.chains[caip2];\n  if (!chain) {\n    throw new OmaTrustError(\"UNSUPPORTED_CHAIN\", `Chain ${caip2} is not in the trust anchors`, {\n      caip2,\n      supportedChains: Object.keys(anchors.chains),\n    });\n  }\n  return chain;\n}\n\n/**\n * Look up a schema UID by name for a given chain.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n * Throws INVALID_INPUT if the schema is not deployed on this chain.\n */\nexport function getSchemaAnchor(anchors: TrustAnchors, caip2: string, schemaName: string): string {\n  const chain = getChainAnchors(anchors, caip2);\n  const uid = chain.schemas[schemaName];\n  if (!uid) {\n    throw new OmaTrustError(\"INVALID_INPUT\", `Schema \"${schemaName}\" not found in trust anchors for chain ${caip2}`, {\n      caip2,\n      schemaName,\n      availableSchemas: Object.keys(chain.schemas),\n    });\n  }\n  return uid;\n}\n\n/**\n * Extract the allowed contracts and schema UIDs from trust anchors.\n * Returns all contracts and schema UIDs across all chains.\n */\nexport function extractAllowlists(anchors: TrustAnchors): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(anchors.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas && typeof chain.schemas === \"object\") {\n      schemas.push(...Object.values(chain.schemas));\n    }\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust anchors before forwarding to the host's wallet.\n *\n * The bridge resolves the iframe element lazily by ID when messages arrive,\n * avoiding React ref timing issues with conditionally rendered iframes.\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframeId: \"omatrust-widget\",\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustAnchors, extractAllowlists, TRUST_ANCHORS_URL } from \"../shared/trust-anchors\";\n\nexport type SigningBridgeOptions = {\n  /**\n   * The ID of the iframe element containing the widget.\n   * The bridge looks up the element by ID when messages arrive,\n   * so the iframe doesn't need to exist when the bridge is created.\n   */\n  iframeId: string;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust anchors domain\n   * (*.omatrust.org) plus any widgetOrigins in the trust anchors.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_ANCHORS_URL).hostname;\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust anchors` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust anchors` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * The bridge resolves the iframe element by ID when messages arrive, not at\n * creation time. This avoids React ref timing issues — the bridge can be\n * created before the iframe is in the DOM.\n *\n * Fetches the OMA3 trust anchors on creation. Fails closed if unavailable.\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframeId, signTypedData, devOriginOverride } = options;\n\n  // Fetch the trust anchors: fail closed if unavailable.\n  const anchors = await fetchTrustAnchors();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(anchors);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust anchors contain no allowed contracts or schemas\");\n  }\n\n  const baseDomain = getTrustedBaseDomain();\n  const anchorOrigins = anchors.widgetOrigins ?? [];\n\n  async function handleMessage(event: MessageEvent) {\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    // Origin check\n    if (!isOriginTrusted(event.origin, baseDomain, anchorOrigins, devOriginOverride)) {\n      return;\n    }\n\n    // Resolve the iframe element lazily by ID.\n    // This works even if the iframe was mounted after the bridge was created.\n    const iframe = document.getElementById(iframeId) as HTMLIFrameElement | null;\n    if (!iframe) return;\n\n    // Source check — must come from this specific iframe\n    if (event.source !== iframe.contentWindow) {\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    // Determine reply origin from the iframe's current src\n    const replyOrigin = devOriginOverride ?? (() => {\n      try { return new URL(iframe.src).origin; }\n      catch { return \"*\"; }\n    })();\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}