@oma3/omatrust 0.1.0-alpha.11 → 0.1.0-alpha.12

package/dist/{types-dpYxRq8N.d.cts → types-Dn0OwaNj.d.cts}

@@ -225,20 +225,22 @@ interface JwsVerificationFailure {
     publicKeyDid?: string;
 }
 /**
- * Authorization metadata extracted from a verified JWS artifact.
+ * Authorization metadata extracted from a verified x402 artifact.
  *
  * This is the information a caller needs to perform an authorization check
- * after JWS signature verification succeeds.
+ * after signature verification succeeds (JWS or EIP-712).
  *
  * Usage:
- * 1. Verify JWS → get JwsVerificationResult
+ * 1. Verify artifact → get JwsVerificationResult or Eip712VerificationResult
  * 2. Extract AuthorizationMetadata from the result
  * 3. Call getControllerAuthorization({ subjectDid, controllerDid, purpose })
  * 4. Evaluate the returned authorization window against policy
  */
 interface AuthorizationMetadata {
     /**
-     * The durable controller DID (did:jwk) derived from the verified public key.
+     * The durable controller DID derived from the verified key material.
+     * - JWS: did:jwk derived from the public key
+     * - EIP-712: did:pkh:eip155:1:<signer-address>
      * Pass this as controllerDid to getControllerAuthorization.
      */
     controllerDid: string;
@@ -256,26 +258,50 @@ interface AuthorizationMetadata {
     /**
      * The issuedAt timestamp from the signed payload (receipts).
      * Used for authorization-window checks — was the controller authorized at this time?
+     * May be a string (ISO) or number (unix seconds) depending on the payload.
      */
-    issuedAt: string | null;
+    issuedAt: string | number | null;
     /**
      * The kid from the JWS header (mutable key reference).
      * Useful for key-pinning lookups but NOT a controller DID.
+     * Null for EIP-712 artifacts.
      */
     kid: string | null;
-    /** The public JWK used for signature verification */
-    publicKeyJwk: PublicJwk;
+    /**
+     * The public JWK used for signature verification.
+     * Present for JWS artifacts, null for EIP-712.
+     */
+    publicKeyJwk: PublicJwk | null;
+    /**
+     * The recovered signer address (checksummed).
+     * Present for EIP-712 artifacts, null for JWS.
+     */
+    signer: string | null;
 }
 /**
- * Extract authorization metadata from a successful JWS verification result.
+ * Input for extractAuthorizationMetadata.
+ * Accepts either a JwsVerificationResult or an Eip712VerificationResult.
+ */
+type VerificationResultInput = JwsVerificationResult | {
+    valid: true;
+    payload: Record<string, unknown>;
+    signer: string;
+    artifactType: string;
+};
+/**
+ * Extract authorization metadata from a successful verification result.
+ *
+ * Works with both JWS and EIP-712 verification results:
+ * - JWS: controllerDid is did:jwk, publicKeyJwk is populated, kid may be present
+ * - EIP-712: controllerDid is did:pkh:eip155:1:<signer>, signer is populated
  *
  * Derives the subject DID from resourceUrl when possible (assumes did:web
  * for HTTPS URLs). Returns null for subjectDid if resourceUrl is missing
  * or cannot be parsed.
  *
- * @param result - A successful JwsVerificationResult (valid === true)
+ * @param result - A successful verification result (valid === true)
  * @returns Authorization metadata for downstream getControllerAuthorization calls
  */
-declare function extractAuthorizationMetadata(result: JwsVerificationResult): AuthorizationMetadata;
+declare function extractAuthorizationMetadata(result: VerificationResultInput): AuthorizationMetadata;
 
-export { type AuthorizationMetadata as A, type JwkValidationResult as J, type PublicJwk as P, type ResolveKeyOptions as R, type JwsVerificationError as a, type JwsVerificationFailure as b, type JwsVerificationResult as c, type PublicKeySource as d, type ResolvedControllerDid as e, type ResolvedPublicKey as f, computeJwkThumbprint as g, didJwkToJwk as h, extractAuthorizationMetadata as i, formatJktValue as j, jwkToDidJwk as k, resolveDidUrlToPublicKey as l, publicJwkEquals as p, resolveDidUrlToControllerDid as r, validatePublicJwk as v };
+export { type AuthorizationMetadata as A, type JwkValidationResult as J, type PublicJwk as P, type ResolveKeyOptions as R, type VerificationResultInput as V, type JwsVerificationError as a, type JwsVerificationFailure as b, type JwsVerificationResult as c, type PublicKeySource as d, type ResolvedControllerDid as e, type ResolvedPublicKey as f, computeJwkThumbprint as g, didJwkToJwk as h, extractAuthorizationMetadata as i, formatJktValue as j, jwkToDidJwk as k, resolveDidUrlToPublicKey as l, publicJwkEquals as p, resolveDidUrlToControllerDid as r, validatePublicJwk as v };

package/dist/{types-dpYxRq8N.d.ts → types-Dn0OwaNj.d.ts}

@@ -225,20 +225,22 @@ interface JwsVerificationFailure {
     publicKeyDid?: string;
 }
 /**
- * Authorization metadata extracted from a verified JWS artifact.
+ * Authorization metadata extracted from a verified x402 artifact.
  *
  * This is the information a caller needs to perform an authorization check
- * after JWS signature verification succeeds.
+ * after signature verification succeeds (JWS or EIP-712).
  *
  * Usage:
- * 1. Verify JWS → get JwsVerificationResult
+ * 1. Verify artifact → get JwsVerificationResult or Eip712VerificationResult
  * 2. Extract AuthorizationMetadata from the result
  * 3. Call getControllerAuthorization({ subjectDid, controllerDid, purpose })
  * 4. Evaluate the returned authorization window against policy
  */
 interface AuthorizationMetadata {
     /**
-     * The durable controller DID (did:jwk) derived from the verified public key.
+     * The durable controller DID derived from the verified key material.
+     * - JWS: did:jwk derived from the public key
+     * - EIP-712: did:pkh:eip155:1:<signer-address>
      * Pass this as controllerDid to getControllerAuthorization.
      */
     controllerDid: string;
@@ -256,26 +258,50 @@ interface AuthorizationMetadata {
     /**
      * The issuedAt timestamp from the signed payload (receipts).
      * Used for authorization-window checks — was the controller authorized at this time?
+     * May be a string (ISO) or number (unix seconds) depending on the payload.
      */
-    issuedAt: string | null;
+    issuedAt: string | number | null;
     /**
      * The kid from the JWS header (mutable key reference).
      * Useful for key-pinning lookups but NOT a controller DID.
+     * Null for EIP-712 artifacts.
      */
     kid: string | null;
-    /** The public JWK used for signature verification */
-    publicKeyJwk: PublicJwk;
+    /**
+     * The public JWK used for signature verification.
+     * Present for JWS artifacts, null for EIP-712.
+     */
+    publicKeyJwk: PublicJwk | null;
+    /**
+     * The recovered signer address (checksummed).
+     * Present for EIP-712 artifacts, null for JWS.
+     */
+    signer: string | null;
 }
 /**
- * Extract authorization metadata from a successful JWS verification result.
+ * Input for extractAuthorizationMetadata.
+ * Accepts either a JwsVerificationResult or an Eip712VerificationResult.
+ */
+type VerificationResultInput = JwsVerificationResult | {
+    valid: true;
+    payload: Record<string, unknown>;
+    signer: string;
+    artifactType: string;
+};
+/**
+ * Extract authorization metadata from a successful verification result.
+ *
+ * Works with both JWS and EIP-712 verification results:
+ * - JWS: controllerDid is did:jwk, publicKeyJwk is populated, kid may be present
+ * - EIP-712: controllerDid is did:pkh:eip155:1:<signer>, signer is populated
  *
  * Derives the subject DID from resourceUrl when possible (assumes did:web
  * for HTTPS URLs). Returns null for subjectDid if resourceUrl is missing
  * or cannot be parsed.
  *
- * @param result - A successful JwsVerificationResult (valid === true)
+ * @param result - A successful verification result (valid === true)
  * @returns Authorization metadata for downstream getControllerAuthorization calls
  */
-declare function extractAuthorizationMetadata(result: JwsVerificationResult): AuthorizationMetadata;
+declare function extractAuthorizationMetadata(result: VerificationResultInput): AuthorizationMetadata;
 
-export { type AuthorizationMetadata as A, type JwkValidationResult as J, type PublicJwk as P, type ResolveKeyOptions as R, type JwsVerificationError as a, type JwsVerificationFailure as b, type JwsVerificationResult as c, type PublicKeySource as d, type ResolvedControllerDid as e, type ResolvedPublicKey as f, computeJwkThumbprint as g, didJwkToJwk as h, extractAuthorizationMetadata as i, formatJktValue as j, jwkToDidJwk as k, resolveDidUrlToPublicKey as l, publicJwkEquals as p, resolveDidUrlToControllerDid as r, validatePublicJwk as v };
+export { type AuthorizationMetadata as A, type JwkValidationResult as J, type PublicJwk as P, type ResolveKeyOptions as R, type VerificationResultInput as V, type JwsVerificationError as a, type JwsVerificationFailure as b, type JwsVerificationResult as c, type PublicKeySource as d, type ResolvedControllerDid as e, type ResolvedPublicKey as f, computeJwkThumbprint as g, didJwkToJwk as h, extractAuthorizationMetadata as i, formatJktValue as j, jwkToDidJwk as k, resolveDidUrlToPublicKey as l, publicJwkEquals as p, resolveDidUrlToControllerDid as r, validatePublicJwk as v };

package/dist/widgets/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/shared/errors.ts","../../src/shared/trust-anchors.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";;;AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACjBjC,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACA,OAAA;AAAA,EAEA,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF,CAAA;;;ACCA,IAAM,yBAAA,GAA4B,2CAAA;AAE3B,IAAM,iBAAA,GAAoB;AA2BjC,IAAI,aAAA,GAAqC,IAAA;AACzC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,kBAAkB,GAAA,EAAqC;AAC3E,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,aAAA,IAAiB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACxD,IAAA,OAAO,aAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,iBAAiB,CAAA;AAAA,EAC5C,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,+BAAA,EAAiC,EAAE,KAAK,CAAA;AAAA,EACnF;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,cAAc,eAAA,EAAiB,CAAA,+BAAA,EAAkC,IAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,OAAA,GAAwB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE7C,EAAA,IAAI,CAAC,QAAQ,OAAA,IAAW,CAAC,QAAQ,MAAA,IAAU,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AAC7E,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,8BAA8B,CAAA;AAAA,EACzE;AAEA,EAAA,aAAA,GAAgB,OAAA;AAChB,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,eAAA,CAAgB,SAAuB,KAAA,EAA6B;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AAClC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAA,CAAc,mBAAA,EAAqB,CAAA,MAAA,EAAS,KAAK,CAAA,4BAAA,CAAA,EAAgC;AAAA,MACzF,KAAA;AAAA,MACA,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,eAAA,CAAgB,OAAA,EAAuB,KAAA,EAAe,UAAA,EAA4B;AAChG,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,OAAA,EAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA;AACpC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,WAAW,UAAU,CAAA,uCAAA,EAA0C,KAAK,CAAA,CAAA,EAAI;AAAA,MAC/G,KAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,kBAAkB,OAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,OAAA,IAAW,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACtD,MAAA,OAAA,CAAQ,KAAK,GAAG,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACjEA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,iBAAiB,CAAA,CAAE,QAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAEzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACpG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACvF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAeA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAGvD,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AACxC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,OAAO,CAAA;AAEtE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,IAAiB,EAAC;AAEhD,EAAA,eAAe,cAAc,KAAA,EAAqB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAGhD,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ;AAGb,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAGrB,IAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,MAAA,IAAI;AAAE,QAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,MAAQ,CAAA,CAAA,MACnC;AAAE,QAAA,OAAO,GAAA;AAAA,MAAK;AAAA,IACtB,CAAA,GAAG;AAEH,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","export class OmaTrustError extends Error {\n  code: string;\n  details?: unknown;\n\n  constructor(code: string, message: string, details?: unknown) {\n    super(message);\n    this.name = \"OmaTrustError\";\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport function toOmaTrustError(\n  code: string,\n  message: string,\n  details?: unknown\n): OmaTrustError {\n  return new OmaTrustError(code, message, details);\n}\n","/**\n * Trust anchors: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * Used by the widget signing bridge for request validation and by the\n * reputation module for chain/contract resolution.\n *\n * Chain keys use CAIP-2 identifiers (e.g., \"eip155:66238\").\n */\n\nimport { OmaTrustError } from \"./errors\";\n\nconst DEFAULT_TRUST_ANCHORS_URL = \"https://api.omatrust.org/v1/trust-anchors\";\n\nexport const TRUST_ANCHORS_URL = DEFAULT_TRUST_ANCHORS_URL;\n\nexport type ChainAnchors = {\n  name: string;\n  easContract: string;\n  /** Schema name → schema UID mapping */\n  schemas: Record<string, string>;\n};\n\nexport type ApprovedIssuer = {\n  address: string;\n  label: string;\n  schemas: string[];\n};\n\nexport type TrustAnchors = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  /** CAIP-2 chain identifier → chain-specific trust anchors */\n  chains: Record<string, ChainAnchors>;\n  registries?: Array<{\n    type: \"approved-issuers\";\n    issuers: ApprovedIssuer[];\n  }>;\n};\n\nlet cachedAnchors: TrustAnchors | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust anchors from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust anchors URL (for testing or custom deployments)\n */\nexport async function fetchTrustAnchors(url?: string): Promise<TrustAnchors> {\n  const now = Date.now();\n  if (cachedAnchors && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedAnchors;\n  }\n\n  let res: Response;\n  try {\n    res = await fetch(url ?? TRUST_ANCHORS_URL);\n  } catch (err) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", \"Failed to fetch trust anchors\", { err });\n  }\n\n  if (!res.ok) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", `Failed to fetch trust anchors: ${res.status} ${res.statusText}`);\n  }\n\n  const anchors: TrustAnchors = await res.json();\n\n  if (!anchors.version || !anchors.chains || typeof anchors.chains !== \"object\") {\n    throw new OmaTrustError(\"INVALID_INPUT\", \"Invalid trust anchors format\");\n  }\n\n  cachedAnchors = anchors;\n  cacheTimestamp = now;\n  return anchors;\n}\n\n/**\n * Look up chain anchors by CAIP-2 identifier.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n */\nexport function getChainAnchors(anchors: TrustAnchors, caip2: string): ChainAnchors {\n  const chain = anchors.chains[caip2];\n  if (!chain) {\n    throw new OmaTrustError(\"UNSUPPORTED_CHAIN\", `Chain ${caip2} is not in the trust anchors`, {\n      caip2,\n      supportedChains: Object.keys(anchors.chains),\n    });\n  }\n  return chain;\n}\n\n/**\n * Look up a schema UID by name for a given chain.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n * Throws INVALID_INPUT if the schema is not deployed on this chain.\n */\nexport function getSchemaAnchor(anchors: TrustAnchors, caip2: string, schemaName: string): string {\n  const chain = getChainAnchors(anchors, caip2);\n  const uid = chain.schemas[schemaName];\n  if (!uid) {\n    throw new OmaTrustError(\"INVALID_INPUT\", `Schema \"${schemaName}\" not found in trust anchors for chain ${caip2}`, {\n      caip2,\n      schemaName,\n      availableSchemas: Object.keys(chain.schemas),\n    });\n  }\n  return uid;\n}\n\n/**\n * Extract the allowed contracts and schema UIDs from trust anchors.\n * Returns all contracts and schema UIDs across all chains.\n */\nexport function extractAllowlists(anchors: TrustAnchors): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(anchors.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas && typeof chain.schemas === \"object\") {\n      schemas.push(...Object.values(chain.schemas));\n    }\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust anchors before forwarding to the host's wallet.\n *\n * The bridge resolves the iframe element lazily by ID when messages arrive,\n * avoiding React ref timing issues with conditionally rendered iframes.\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframeId: \"omatrust-widget\",\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustAnchors, extractAllowlists, TRUST_ANCHORS_URL } from \"../shared/trust-anchors\";\n\nexport type SigningBridgeOptions = {\n  /**\n   * The ID of the iframe element containing the widget.\n   * The bridge looks up the element by ID when messages arrive,\n   * so the iframe doesn't need to exist when the bridge is created.\n   */\n  iframeId: string;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust anchors domain\n   * (*.omatrust.org) plus any widgetOrigins in the trust anchors.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_ANCHORS_URL).hostname;\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust anchors` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust anchors` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * The bridge resolves the iframe element by ID when messages arrive, not at\n * creation time. This avoids React ref timing issues — the bridge can be\n * created before the iframe is in the DOM.\n *\n * Fetches the OMA3 trust anchors on creation. Fails closed if unavailable.\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframeId, signTypedData, devOriginOverride } = options;\n\n  // Fetch the trust anchors: fail closed if unavailable.\n  const anchors = await fetchTrustAnchors();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(anchors);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust anchors contain no allowed contracts or schemas\");\n  }\n\n  const baseDomain = getTrustedBaseDomain();\n  const anchorOrigins = anchors.widgetOrigins ?? [];\n\n  async function handleMessage(event: MessageEvent) {\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    // Origin check\n    if (!isOriginTrusted(event.origin, baseDomain, anchorOrigins, devOriginOverride)) {\n      return;\n    }\n\n    // Resolve the iframe element lazily by ID.\n    // This works even if the iframe was mounted after the bridge was created.\n    const iframe = document.getElementById(iframeId) as HTMLIFrameElement | null;\n    if (!iframe) return;\n\n    // Source check — must come from this specific iframe\n    if (event.source !== iframe.contentWindow) {\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    // Determine reply origin from the iframe's current src\n    const replyOrigin = devOriginOverride ?? (() => {\n      try { return new URL(iframe.src).origin; }\n      catch { return \"*\"; }\n    })();\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/shared/errors.ts","../../src/shared/trust-anchors.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";;;AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACjBjC,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACA,OAAA;AAAA,EAEA,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF,CAAA;;;ACCA,IAAM,yBAAA,GAA4B,2CAAA;AAE3B,IAAM,iBAAA,GAAoB;AA8BjC,IAAI,aAAA,GAAqC,IAAA;AACzC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,kBAAkB,GAAA,EAAqC;AAC3E,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,aAAA,IAAiB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACxD,IAAA,OAAO,aAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,iBAAiB,CAAA;AAAA,EAC5C,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,+BAAA,EAAiC,EAAE,KAAK,CAAA;AAAA,EACnF;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,cAAc,eAAA,EAAiB,CAAA,+BAAA,EAAkC,IAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,OAAA,GAAwB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE7C,EAAA,IAAI,CAAC,QAAQ,OAAA,IAAW,CAAC,QAAQ,MAAA,IAAU,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AAC7E,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,8BAA8B,CAAA;AAAA,EACzE;AAEA,EAAA,aAAA,GAAgB,OAAA;AAChB,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,eAAA,CAAgB,SAAuB,KAAA,EAA6B;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AAClC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAA,CAAc,mBAAA,EAAqB,CAAA,MAAA,EAAS,KAAK,CAAA,4BAAA,CAAA,EAAgC;AAAA,MACzF,KAAA;AAAA,MACA,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,eAAA,CAAgB,OAAA,EAAuB,KAAA,EAAe,UAAA,EAA4B;AAChG,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,OAAA,EAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA;AACpC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,WAAW,UAAU,CAAA,uCAAA,EAA0C,KAAK,CAAA,CAAA,EAAI;AAAA,MAC/G,KAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,kBAAkB,OAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,OAAA,IAAW,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACtD,MAAA,OAAA,CAAQ,KAAK,GAAG,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACpEA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,iBAAiB,CAAA,CAAE,QAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAEzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACpG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACvF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAeA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAGvD,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AACxC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,OAAO,CAAA;AAEtE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,IAAiB,EAAC;AAEhD,EAAA,eAAe,cAAc,KAAA,EAAqB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAGhD,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ;AAGb,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAGrB,IAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,MAAA,IAAI;AAAE,QAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,MAAQ,CAAA,CAAA,MACnC;AAAE,QAAA,OAAO,GAAA;AAAA,MAAK;AAAA,IACtB,CAAA,GAAG;AAEH,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","export class OmaTrustError extends Error {\n  code: string;\n  details?: unknown;\n\n  constructor(code: string, message: string, details?: unknown) {\n    super(message);\n    this.name = \"OmaTrustError\";\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport function toOmaTrustError(\n  code: string,\n  message: string,\n  details?: unknown\n): OmaTrustError {\n  return new OmaTrustError(code, message, details);\n}\n","/**\n * Trust anchors: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * Used by the widget signing bridge for request validation and by the\n * reputation module for chain/contract resolution.\n *\n * Chain keys use CAIP-2 identifiers (e.g., \"eip155:66238\").\n */\n\nimport { OmaTrustError } from \"./errors\";\n\nconst DEFAULT_TRUST_ANCHORS_URL = \"https://api.omatrust.org/v1/trust-anchors\";\n\nexport const TRUST_ANCHORS_URL = DEFAULT_TRUST_ANCHORS_URL;\n\nexport type ChainAnchors = {\n  name: string;\n  easContract: string;\n  /** Schema name → schema UID mapping */\n  schemas: Record<string, string>;\n};\n\nexport type ApprovedIssuer = {\n  address: string;\n  label: string;\n  schemas: string[];\n  status: \"active\" | \"revoked\";\n  validFrom: string;\n  revokedAt?: string;\n};\n\nexport type TrustAnchors = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  /** CAIP-2 chain identifier → chain-specific trust anchors */\n  chains: Record<string, ChainAnchors>;\n  registries?: Array<{\n    type: \"approved-issuers\";\n    issuers: ApprovedIssuer[];\n  }>;\n};\n\nlet cachedAnchors: TrustAnchors | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust anchors from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust anchors URL (for testing or custom deployments)\n */\nexport async function fetchTrustAnchors(url?: string): Promise<TrustAnchors> {\n  const now = Date.now();\n  if (cachedAnchors && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedAnchors;\n  }\n\n  let res: Response;\n  try {\n    res = await fetch(url ?? TRUST_ANCHORS_URL);\n  } catch (err) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", \"Failed to fetch trust anchors\", { err });\n  }\n\n  if (!res.ok) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", `Failed to fetch trust anchors: ${res.status} ${res.statusText}`);\n  }\n\n  const anchors: TrustAnchors = await res.json();\n\n  if (!anchors.version || !anchors.chains || typeof anchors.chains !== \"object\") {\n    throw new OmaTrustError(\"INVALID_INPUT\", \"Invalid trust anchors format\");\n  }\n\n  cachedAnchors = anchors;\n  cacheTimestamp = now;\n  return anchors;\n}\n\n/**\n * Look up chain anchors by CAIP-2 identifier.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n */\nexport function getChainAnchors(anchors: TrustAnchors, caip2: string): ChainAnchors {\n  const chain = anchors.chains[caip2];\n  if (!chain) {\n    throw new OmaTrustError(\"UNSUPPORTED_CHAIN\", `Chain ${caip2} is not in the trust anchors`, {\n      caip2,\n      supportedChains: Object.keys(anchors.chains),\n    });\n  }\n  return chain;\n}\n\n/**\n * Look up a schema UID by name for a given chain.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n * Throws INVALID_INPUT if the schema is not deployed on this chain.\n */\nexport function getSchemaAnchor(anchors: TrustAnchors, caip2: string, schemaName: string): string {\n  const chain = getChainAnchors(anchors, caip2);\n  const uid = chain.schemas[schemaName];\n  if (!uid) {\n    throw new OmaTrustError(\"INVALID_INPUT\", `Schema \"${schemaName}\" not found in trust anchors for chain ${caip2}`, {\n      caip2,\n      schemaName,\n      availableSchemas: Object.keys(chain.schemas),\n    });\n  }\n  return uid;\n}\n\n/**\n * Extract the allowed contracts and schema UIDs from trust anchors.\n * Returns all contracts and schema UIDs across all chains.\n */\nexport function extractAllowlists(anchors: TrustAnchors): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(anchors.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas && typeof chain.schemas === \"object\") {\n      schemas.push(...Object.values(chain.schemas));\n    }\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust anchors before forwarding to the host's wallet.\n *\n * The bridge resolves the iframe element lazily by ID when messages arrive,\n * avoiding React ref timing issues with conditionally rendered iframes.\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframeId: \"omatrust-widget\",\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustAnchors, extractAllowlists, TRUST_ANCHORS_URL } from \"../shared/trust-anchors\";\n\nexport type SigningBridgeOptions = {\n  /**\n   * The ID of the iframe element containing the widget.\n   * The bridge looks up the element by ID when messages arrive,\n   * so the iframe doesn't need to exist when the bridge is created.\n   */\n  iframeId: string;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust anchors domain\n   * (*.omatrust.org) plus any widgetOrigins in the trust anchors.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_ANCHORS_URL).hostname;\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust anchors` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust anchors` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * The bridge resolves the iframe element by ID when messages arrive, not at\n * creation time. This avoids React ref timing issues — the bridge can be\n * created before the iframe is in the DOM.\n *\n * Fetches the OMA3 trust anchors on creation. Fails closed if unavailable.\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframeId, signTypedData, devOriginOverride } = options;\n\n  // Fetch the trust anchors: fail closed if unavailable.\n  const anchors = await fetchTrustAnchors();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(anchors);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust anchors contain no allowed contracts or schemas\");\n  }\n\n  const baseDomain = getTrustedBaseDomain();\n  const anchorOrigins = anchors.widgetOrigins ?? [];\n\n  async function handleMessage(event: MessageEvent) {\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    // Origin check\n    if (!isOriginTrusted(event.origin, baseDomain, anchorOrigins, devOriginOverride)) {\n      return;\n    }\n\n    // Resolve the iframe element lazily by ID.\n    // This works even if the iframe was mounted after the bridge was created.\n    const iframe = document.getElementById(iframeId) as HTMLIFrameElement | null;\n    if (!iframe) return;\n\n    // Source check — must come from this specific iframe\n    if (event.source !== iframe.contentWindow) {\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    // Determine reply origin from the iframe's current src\n    const replyOrigin = devOriginOverride ?? (() => {\n      try { return new URL(iframe.src).origin; }\n      catch { return \"*\"; }\n    })();\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}

package/dist/widgets/index.d.cts

@@ -74,6 +74,9 @@ type ApprovedIssuer = {
     address: string;
     label: string;
     schemas: string[];
+    status: "active" | "revoked";
+    validFrom: string;
+    revokedAt?: string;
 };
 type TrustAnchors = {
     version: number;

package/dist/widgets/index.d.ts

@@ -74,6 +74,9 @@ type ApprovedIssuer = {
     address: string;
     label: string;
     schemas: string[];
+    status: "active" | "revoked";
+    validFrom: string;
+    revokedAt?: string;
 };
 type TrustAnchors = {
     version: number;

package/dist/widgets/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/shared/errors.ts","../../src/shared/trust-anchors.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACjBjC,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACA,OAAA;AAAA,EAEA,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF,CAAA;;;ACCA,IAAM,yBAAA,GAA4B,2CAAA;AAE3B,IAAM,iBAAA,GAAoB;AA2BjC,IAAI,aAAA,GAAqC,IAAA;AACzC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,kBAAkB,GAAA,EAAqC;AAC3E,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,aAAA,IAAiB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACxD,IAAA,OAAO,aAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,iBAAiB,CAAA;AAAA,EAC5C,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,+BAAA,EAAiC,EAAE,KAAK,CAAA;AAAA,EACnF;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,cAAc,eAAA,EAAiB,CAAA,+BAAA,EAAkC,IAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,OAAA,GAAwB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE7C,EAAA,IAAI,CAAC,QAAQ,OAAA,IAAW,CAAC,QAAQ,MAAA,IAAU,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AAC7E,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,8BAA8B,CAAA;AAAA,EACzE;AAEA,EAAA,aAAA,GAAgB,OAAA;AAChB,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,eAAA,CAAgB,SAAuB,KAAA,EAA6B;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AAClC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAA,CAAc,mBAAA,EAAqB,CAAA,MAAA,EAAS,KAAK,CAAA,4BAAA,CAAA,EAAgC;AAAA,MACzF,KAAA;AAAA,MACA,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,eAAA,CAAgB,OAAA,EAAuB,KAAA,EAAe,UAAA,EAA4B;AAChG,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,OAAA,EAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA;AACpC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,WAAW,UAAU,CAAA,uCAAA,EAA0C,KAAK,CAAA,CAAA,EAAI;AAAA,MAC/G,KAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,kBAAkB,OAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,OAAA,IAAW,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACtD,MAAA,OAAA,CAAQ,KAAK,GAAG,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACjEA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,iBAAiB,CAAA,CAAE,QAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAEzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACpG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACvF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAeA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAGvD,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AACxC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,OAAO,CAAA;AAEtE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,IAAiB,EAAC;AAEhD,EAAA,eAAe,cAAc,KAAA,EAAqB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAGhD,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ;AAGb,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAGrB,IAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,MAAA,IAAI;AAAE,QAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,MAAQ,CAAA,CAAA,MACnC;AAAE,QAAA,OAAO,GAAA;AAAA,MAAK;AAAA,IACtB,CAAA,GAAG;AAEH,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","export class OmaTrustError extends Error {\n  code: string;\n  details?: unknown;\n\n  constructor(code: string, message: string, details?: unknown) {\n    super(message);\n    this.name = \"OmaTrustError\";\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport function toOmaTrustError(\n  code: string,\n  message: string,\n  details?: unknown\n): OmaTrustError {\n  return new OmaTrustError(code, message, details);\n}\n","/**\n * Trust anchors: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * Used by the widget signing bridge for request validation and by the\n * reputation module for chain/contract resolution.\n *\n * Chain keys use CAIP-2 identifiers (e.g., \"eip155:66238\").\n */\n\nimport { OmaTrustError } from \"./errors\";\n\nconst DEFAULT_TRUST_ANCHORS_URL = \"https://api.omatrust.org/v1/trust-anchors\";\n\nexport const TRUST_ANCHORS_URL = DEFAULT_TRUST_ANCHORS_URL;\n\nexport type ChainAnchors = {\n  name: string;\n  easContract: string;\n  /** Schema name → schema UID mapping */\n  schemas: Record<string, string>;\n};\n\nexport type ApprovedIssuer = {\n  address: string;\n  label: string;\n  schemas: string[];\n};\n\nexport type TrustAnchors = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  /** CAIP-2 chain identifier → chain-specific trust anchors */\n  chains: Record<string, ChainAnchors>;\n  registries?: Array<{\n    type: \"approved-issuers\";\n    issuers: ApprovedIssuer[];\n  }>;\n};\n\nlet cachedAnchors: TrustAnchors | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust anchors from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust anchors URL (for testing or custom deployments)\n */\nexport async function fetchTrustAnchors(url?: string): Promise<TrustAnchors> {\n  const now = Date.now();\n  if (cachedAnchors && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedAnchors;\n  }\n\n  let res: Response;\n  try {\n    res = await fetch(url ?? TRUST_ANCHORS_URL);\n  } catch (err) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", \"Failed to fetch trust anchors\", { err });\n  }\n\n  if (!res.ok) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", `Failed to fetch trust anchors: ${res.status} ${res.statusText}`);\n  }\n\n  const anchors: TrustAnchors = await res.json();\n\n  if (!anchors.version || !anchors.chains || typeof anchors.chains !== \"object\") {\n    throw new OmaTrustError(\"INVALID_INPUT\", \"Invalid trust anchors format\");\n  }\n\n  cachedAnchors = anchors;\n  cacheTimestamp = now;\n  return anchors;\n}\n\n/**\n * Look up chain anchors by CAIP-2 identifier.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n */\nexport function getChainAnchors(anchors: TrustAnchors, caip2: string): ChainAnchors {\n  const chain = anchors.chains[caip2];\n  if (!chain) {\n    throw new OmaTrustError(\"UNSUPPORTED_CHAIN\", `Chain ${caip2} is not in the trust anchors`, {\n      caip2,\n      supportedChains: Object.keys(anchors.chains),\n    });\n  }\n  return chain;\n}\n\n/**\n * Look up a schema UID by name for a given chain.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n * Throws INVALID_INPUT if the schema is not deployed on this chain.\n */\nexport function getSchemaAnchor(anchors: TrustAnchors, caip2: string, schemaName: string): string {\n  const chain = getChainAnchors(anchors, caip2);\n  const uid = chain.schemas[schemaName];\n  if (!uid) {\n    throw new OmaTrustError(\"INVALID_INPUT\", `Schema \"${schemaName}\" not found in trust anchors for chain ${caip2}`, {\n      caip2,\n      schemaName,\n      availableSchemas: Object.keys(chain.schemas),\n    });\n  }\n  return uid;\n}\n\n/**\n * Extract the allowed contracts and schema UIDs from trust anchors.\n * Returns all contracts and schema UIDs across all chains.\n */\nexport function extractAllowlists(anchors: TrustAnchors): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(anchors.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas && typeof chain.schemas === \"object\") {\n      schemas.push(...Object.values(chain.schemas));\n    }\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust anchors before forwarding to the host's wallet.\n *\n * The bridge resolves the iframe element lazily by ID when messages arrive,\n * avoiding React ref timing issues with conditionally rendered iframes.\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframeId: \"omatrust-widget\",\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustAnchors, extractAllowlists, TRUST_ANCHORS_URL } from \"../shared/trust-anchors\";\n\nexport type SigningBridgeOptions = {\n  /**\n   * The ID of the iframe element containing the widget.\n   * The bridge looks up the element by ID when messages arrive,\n   * so the iframe doesn't need to exist when the bridge is created.\n   */\n  iframeId: string;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust anchors domain\n   * (*.omatrust.org) plus any widgetOrigins in the trust anchors.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_ANCHORS_URL).hostname;\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust anchors` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust anchors` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * The bridge resolves the iframe element by ID when messages arrive, not at\n * creation time. This avoids React ref timing issues — the bridge can be\n * created before the iframe is in the DOM.\n *\n * Fetches the OMA3 trust anchors on creation. Fails closed if unavailable.\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframeId, signTypedData, devOriginOverride } = options;\n\n  // Fetch the trust anchors: fail closed if unavailable.\n  const anchors = await fetchTrustAnchors();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(anchors);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust anchors contain no allowed contracts or schemas\");\n  }\n\n  const baseDomain = getTrustedBaseDomain();\n  const anchorOrigins = anchors.widgetOrigins ?? [];\n\n  async function handleMessage(event: MessageEvent) {\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    // Origin check\n    if (!isOriginTrusted(event.origin, baseDomain, anchorOrigins, devOriginOverride)) {\n      return;\n    }\n\n    // Resolve the iframe element lazily by ID.\n    // This works even if the iframe was mounted after the bridge was created.\n    const iframe = document.getElementById(iframeId) as HTMLIFrameElement | null;\n    if (!iframe) return;\n\n    // Source check — must come from this specific iframe\n    if (event.source !== iframe.contentWindow) {\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    // Determine reply origin from the iframe's current src\n    const replyOrigin = devOriginOverride ?? (() => {\n      try { return new URL(iframe.src).origin; }\n      catch { return \"*\"; }\n    })();\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/shared/errors.ts","../../src/shared/trust-anchors.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACjBjC,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,IAAA;AAAA,EACA,OAAA;AAAA,EAEA,WAAA,CAAY,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmB;AAC5D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF,CAAA;;;ACCA,IAAM,yBAAA,GAA4B,2CAAA;AAE3B,IAAM,iBAAA,GAAoB;AA8BjC,IAAI,aAAA,GAAqC,IAAA;AACzC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,kBAAkB,GAAA,EAAqC;AAC3E,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,aAAA,IAAiB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACxD,IAAA,OAAO,aAAA;AAAA,EACT;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,iBAAiB,CAAA;AAAA,EAC5C,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,+BAAA,EAAiC,EAAE,KAAK,CAAA;AAAA,EACnF;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,cAAc,eAAA,EAAiB,CAAA,+BAAA,EAAkC,IAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,OAAA,GAAwB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE7C,EAAA,IAAI,CAAC,QAAQ,OAAA,IAAW,CAAC,QAAQ,MAAA,IAAU,OAAO,OAAA,CAAQ,MAAA,KAAW,QAAA,EAAU;AAC7E,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,8BAA8B,CAAA;AAAA,EACzE;AAEA,EAAA,aAAA,GAAgB,OAAA;AAChB,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,eAAA,CAAgB,SAAuB,KAAA,EAA6B;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA;AAClC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,aAAA,CAAc,mBAAA,EAAqB,CAAA,MAAA,EAAS,KAAK,CAAA,4BAAA,CAAA,EAAgC;AAAA,MACzF,KAAA;AAAA,MACA,eAAA,EAAiB,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAOO,SAAS,eAAA,CAAgB,OAAA,EAAuB,KAAA,EAAe,UAAA,EAA4B;AAChG,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,OAAA,EAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA;AACpC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,aAAA,CAAc,eAAA,EAAiB,WAAW,UAAU,CAAA,uCAAA,EAA0C,KAAK,CAAA,CAAA,EAAI;AAAA,MAC/G,KAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA,EAAkB,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,OAAO;AAAA,KAC5C,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,kBAAkB,OAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,KAAA,CAAM,OAAA,IAAW,OAAO,KAAA,CAAM,YAAY,QAAA,EAAU;AACtD,MAAA,OAAA,CAAQ,KAAK,GAAG,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,IAC9C;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACpEA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,iBAAiB,CAAA,CAAE,QAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAEzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACpG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,iCAAA,CAAA,EAAoC;AAAA,EACvF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAeA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,QAAA,EAAU,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAGvD,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AACxC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,OAAO,CAAA;AAEtE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,aAAA,IAAiB,EAAC;AAEhD,EAAA,eAAe,cAAc,KAAA,EAAqB;AAChD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAGhD,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ;AAGb,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAGrB,IAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,MAAA,IAAI;AAAE,QAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,MAAQ,CAAA,CAAA,MACnC;AAAE,QAAA,OAAO,GAAA;AAAA,MAAK;AAAA,IACtB,CAAA,GAAG;AAEH,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","export class OmaTrustError extends Error {\n  code: string;\n  details?: unknown;\n\n  constructor(code: string, message: string, details?: unknown) {\n    super(message);\n    this.name = \"OmaTrustError\";\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport function toOmaTrustError(\n  code: string,\n  message: string,\n  details?: unknown\n): OmaTrustError {\n  return new OmaTrustError(code, message, details);\n}\n","/**\n * Trust anchors: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * Used by the widget signing bridge for request validation and by the\n * reputation module for chain/contract resolution.\n *\n * Chain keys use CAIP-2 identifiers (e.g., \"eip155:66238\").\n */\n\nimport { OmaTrustError } from \"./errors\";\n\nconst DEFAULT_TRUST_ANCHORS_URL = \"https://api.omatrust.org/v1/trust-anchors\";\n\nexport const TRUST_ANCHORS_URL = DEFAULT_TRUST_ANCHORS_URL;\n\nexport type ChainAnchors = {\n  name: string;\n  easContract: string;\n  /** Schema name → schema UID mapping */\n  schemas: Record<string, string>;\n};\n\nexport type ApprovedIssuer = {\n  address: string;\n  label: string;\n  schemas: string[];\n  status: \"active\" | \"revoked\";\n  validFrom: string;\n  revokedAt?: string;\n};\n\nexport type TrustAnchors = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  /** CAIP-2 chain identifier → chain-specific trust anchors */\n  chains: Record<string, ChainAnchors>;\n  registries?: Array<{\n    type: \"approved-issuers\";\n    issuers: ApprovedIssuer[];\n  }>;\n};\n\nlet cachedAnchors: TrustAnchors | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust anchors from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust anchors URL (for testing or custom deployments)\n */\nexport async function fetchTrustAnchors(url?: string): Promise<TrustAnchors> {\n  const now = Date.now();\n  if (cachedAnchors && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedAnchors;\n  }\n\n  let res: Response;\n  try {\n    res = await fetch(url ?? TRUST_ANCHORS_URL);\n  } catch (err) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", \"Failed to fetch trust anchors\", { err });\n  }\n\n  if (!res.ok) {\n    throw new OmaTrustError(\"NETWORK_ERROR\", `Failed to fetch trust anchors: ${res.status} ${res.statusText}`);\n  }\n\n  const anchors: TrustAnchors = await res.json();\n\n  if (!anchors.version || !anchors.chains || typeof anchors.chains !== \"object\") {\n    throw new OmaTrustError(\"INVALID_INPUT\", \"Invalid trust anchors format\");\n  }\n\n  cachedAnchors = anchors;\n  cacheTimestamp = now;\n  return anchors;\n}\n\n/**\n * Look up chain anchors by CAIP-2 identifier.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n */\nexport function getChainAnchors(anchors: TrustAnchors, caip2: string): ChainAnchors {\n  const chain = anchors.chains[caip2];\n  if (!chain) {\n    throw new OmaTrustError(\"UNSUPPORTED_CHAIN\", `Chain ${caip2} is not in the trust anchors`, {\n      caip2,\n      supportedChains: Object.keys(anchors.chains),\n    });\n  }\n  return chain;\n}\n\n/**\n * Look up a schema UID by name for a given chain.\n * Throws UNSUPPORTED_CHAIN if the chain is not in the trust anchors.\n * Throws INVALID_INPUT if the schema is not deployed on this chain.\n */\nexport function getSchemaAnchor(anchors: TrustAnchors, caip2: string, schemaName: string): string {\n  const chain = getChainAnchors(anchors, caip2);\n  const uid = chain.schemas[schemaName];\n  if (!uid) {\n    throw new OmaTrustError(\"INVALID_INPUT\", `Schema \"${schemaName}\" not found in trust anchors for chain ${caip2}`, {\n      caip2,\n      schemaName,\n      availableSchemas: Object.keys(chain.schemas),\n    });\n  }\n  return uid;\n}\n\n/**\n * Extract the allowed contracts and schema UIDs from trust anchors.\n * Returns all contracts and schema UIDs across all chains.\n */\nexport function extractAllowlists(anchors: TrustAnchors): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(anchors.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas && typeof chain.schemas === \"object\") {\n      schemas.push(...Object.values(chain.schemas));\n    }\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust anchors before forwarding to the host's wallet.\n *\n * The bridge resolves the iframe element lazily by ID when messages arrive,\n * avoiding React ref timing issues with conditionally rendered iframes.\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframeId: \"omatrust-widget\",\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustAnchors, extractAllowlists, TRUST_ANCHORS_URL } from \"../shared/trust-anchors\";\n\nexport type SigningBridgeOptions = {\n  /**\n   * The ID of the iframe element containing the widget.\n   * The bridge looks up the element by ID when messages arrive,\n   * so the iframe doesn't need to exist when the bridge is created.\n   */\n  iframeId: string;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust anchors domain\n   * (*.omatrust.org) plus any widgetOrigins in the trust anchors.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_ANCHORS_URL).hostname;\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust anchors` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust anchors` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * The bridge resolves the iframe element by ID when messages arrive, not at\n * creation time. This avoids React ref timing issues — the bridge can be\n * created before the iframe is in the DOM.\n *\n * Fetches the OMA3 trust anchors on creation. Fails closed if unavailable.\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframeId, signTypedData, devOriginOverride } = options;\n\n  // Fetch the trust anchors: fail closed if unavailable.\n  const anchors = await fetchTrustAnchors();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(anchors);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust anchors contain no allowed contracts or schemas\");\n  }\n\n  const baseDomain = getTrustedBaseDomain();\n  const anchorOrigins = anchors.widgetOrigins ?? [];\n\n  async function handleMessage(event: MessageEvent) {\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    // Origin check\n    if (!isOriginTrusted(event.origin, baseDomain, anchorOrigins, devOriginOverride)) {\n      return;\n    }\n\n    // Resolve the iframe element lazily by ID.\n    // This works even if the iframe was mounted after the bridge was created.\n    const iframe = document.getElementById(iframeId) as HTMLIFrameElement | null;\n    if (!iframe) return;\n\n    // Source check — must come from this specific iframe\n    if (event.source !== iframe.contentWindow) {\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    // Determine reply origin from the iframe's current src\n    const replyOrigin = devOriginOverride ?? (() => {\n      try { return new URL(iframe.src).origin; }\n      catch { return \"*\"; }\n    })();\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oma3/omatrust",
-  "version": "0.1.0-alpha.11",
+  "version": "0.1.0-alpha.12",
   "description": "Framework-agnostic TypeScript SDK for OMATrust",
   "license": "MIT",
   "type": "module",
@@ -65,11 +65,13 @@
     "clean": "rm -rf dist",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "test:ci": "npm run typecheck && npm run test"
   },
   "dependencies": {
     "canonicalize": "^2.1.0",
-    "jose": "^6.2.3"
+    "jose": "^6.2.3",
+    "multiformats": "^13.4.2"
   },
   "peerDependencies": {
     "@ethereum-attestation-service/eas-sdk": "^2.4.0",