@oma3/omatrust 0.1.0-alpha.7 → 0.1.0-alpha.8

package/dist/widgets/index.cjs

@@ -0,0 +1,207 @@
+'use strict';
+
+// src/widgets/protocol.ts
+var OMATRUST_READY = "omatrust:ready";
+var OMATRUST_HOST_READY = "omatrust:hostReady";
+var OMATRUST_SIGN_TYPED_DATA = "omatrust:signTypedData";
+var OMATRUST_SIGNATURE = "omatrust:signature";
+var OMATRUST_SIGNATURE_ERROR = "omatrust:signatureError";
+
+// src/widgets/trust-policy.ts
+var DEFAULT_TRUST_POLICY_URL = "https://api.omatrust.org/v1/trust-policy";
+var TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;
+var cachedPolicy = null;
+var cacheTimestamp = 0;
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+async function fetchTrustPolicy(url) {
+  const now = Date.now();
+  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedPolicy;
+  }
+  const res = await fetch(url ?? TRUST_POLICY_URL);
+  if (!res.ok) {
+    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);
+  }
+  const policy = await res.json();
+  if (!policy.version || !policy.chains || typeof policy.chains !== "object") {
+    throw new Error("Invalid trust policy format");
+  }
+  cachedPolicy = policy;
+  cacheTimestamp = now;
+  return policy;
+}
+function extractAllowlists(policy) {
+  const contracts = [];
+  const schemas = [];
+  for (const chain of Object.values(policy.chains)) {
+    if (chain.easContract) contracts.push(chain.easContract);
+    if (chain.schemas) schemas.push(...chain.schemas);
+  }
+  return {
+    allowedContracts: [...new Set(contracts)],
+    allowedSchemas: [...new Set(schemas)]
+  };
+}
+
+// src/widgets/bridge.ts
+function getTrustedBaseDomain() {
+  try {
+    const hostname = new URL(TRUST_POLICY_URL).hostname;
+    const parts = hostname.split(".");
+    return parts.length >= 2 ? parts.slice(-2).join(".") : hostname;
+  } catch {
+    return "omatrust.org";
+  }
+}
+function isOriginTrusted(messageOrigin, baseDomain, policyOrigins, devOverride) {
+  if (devOverride && messageOrigin === devOverride) return true;
+  try {
+    const hostname = new URL(messageOrigin).hostname;
+    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;
+  } catch {
+  }
+  if (policyOrigins.includes(messageOrigin)) return true;
+  return false;
+}
+var HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
+var BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;
+function validateEasSigningRequest(data, allowedSchemas, allowedContracts) {
+  const { id, domain, types, message } = data;
+  if (!id || typeof id !== "string") {
+    return { valid: false, reason: "Missing or invalid request id" };
+  }
+  if (!domain || typeof domain !== "object") {
+    return { valid: false, reason: "Missing domain object" };
+  }
+  const d = domain;
+  if (d.name !== "EAS") {
+    return { valid: false, reason: `Unexpected domain name: "${d.name}" (expected "EAS")` };
+  }
+  if (d.version !== "1.4.0") {
+    return { valid: false, reason: `Unexpected domain version: "${d.version}" (expected "1.4.0")` };
+  }
+  const chainId = Number(d.chainId);
+  if (!Number.isInteger(chainId) || chainId <= 0) {
+    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };
+  }
+  if (typeof d.verifyingContract !== "string" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {
+    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };
+  }
+  const contractLower = d.verifyingContract.toLowerCase();
+  if (!allowedContracts.some((c) => c.toLowerCase() === contractLower)) {
+    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };
+  }
+  if (!types || typeof types !== "object") {
+    return { valid: false, reason: "Missing types object" };
+  }
+  if (!message || typeof message !== "object") {
+    return { valid: false, reason: "Missing message object" };
+  }
+  const m = message;
+  if (typeof m.schema !== "string" || !BYTES32_RE.test(m.schema)) {
+    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };
+  }
+  const schemaLower = m.schema.toLowerCase();
+  if (!allowedSchemas.some((s) => s.toLowerCase() === schemaLower)) {
+    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };
+  }
+  if (typeof m.attester !== "string" || !HEX_ADDRESS_RE.test(m.attester)) {
+    return { valid: false, reason: `Invalid attester address: ${m.attester}` };
+  }
+  const deadline = Number(m.deadline);
+  if (!Number.isFinite(deadline) || deadline <= 0) {
+    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (deadline <= now) {
+    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };
+  }
+  return { valid: true };
+}
+async function createSigningBridge(options) {
+  const { iframe, signTypedData, devOriginOverride } = options;
+  const debug = typeof window !== "undefined" && window.__OMATRUST_DEBUG === true;
+  if (debug) console.log("[omatrust-bridge] fetching trust policy...");
+  const policy = await fetchTrustPolicy();
+  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);
+  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {
+    throw new Error("Trust policy contains no allowed contracts or schemas");
+  }
+  const baseDomain = getTrustedBaseDomain();
+  const policyOrigins = policy.widgetOrigins ?? [];
+  if (debug) {
+    console.log("[omatrust-bridge] trust policy loaded:", {
+      contracts: allowedContracts.length,
+      schemas: allowedSchemas.length,
+      baseDomain,
+      policyOrigins,
+      devOriginOverride
+    });
+  }
+  const replyOrigin = devOriginOverride ?? (() => {
+    try {
+      return new URL(iframe.src).origin;
+    } catch {
+      return "*";
+    }
+  })();
+  async function handleMessage(event) {
+    const data = event.data;
+    if (!data || typeof data !== "object" || typeof data.type !== "string") return;
+    if (!String(data.type).startsWith("omatrust:")) return;
+    if (debug) console.log("[omatrust-bridge] message:", data.type, "origin:", event.origin);
+    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {
+      if (debug) console.log("[omatrust-bridge] rejected: untrusted origin", event.origin);
+      return;
+    }
+    if (event.source !== iframe.contentWindow) {
+      if (debug) console.log("[omatrust-bridge] rejected: source !== iframe.contentWindow");
+      return;
+    }
+    const source = event.source;
+    function reply(msg) {
+      source.postMessage(msg, replyOrigin);
+    }
+    if (data.type === OMATRUST_READY) {
+      reply({ type: OMATRUST_HOST_READY });
+      return;
+    }
+    if (data.type === OMATRUST_SIGN_TYPED_DATA) {
+      const { id, domain, types, message } = data;
+      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);
+      if (!validation.valid) {
+        reply({
+          type: OMATRUST_SIGNATURE_ERROR,
+          id: id ?? "unknown",
+          error: `Signing request rejected: ${validation.reason}`
+        });
+        return;
+      }
+      try {
+        const signature = await signTypedData(domain, types, message);
+        reply({ type: OMATRUST_SIGNATURE, id, signature });
+      } catch (err) {
+        const error = err instanceof Error ? err.message : "Signing failed";
+        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });
+      }
+    }
+  }
+  window.addEventListener("message", handleMessage);
+  return {
+    destroy() {
+      window.removeEventListener("message", handleMessage);
+    }
+  };
+}
+
+exports.OMATRUST_HOST_READY = OMATRUST_HOST_READY;
+exports.OMATRUST_READY = OMATRUST_READY;
+exports.OMATRUST_SIGNATURE = OMATRUST_SIGNATURE;
+exports.OMATRUST_SIGNATURE_ERROR = OMATRUST_SIGNATURE_ERROR;
+exports.OMATRUST_SIGN_TYPED_DATA = OMATRUST_SIGN_TYPED_DATA;
+exports.TRUST_POLICY_URL = TRUST_POLICY_URL;
+exports.createSigningBridge = createSigningBridge;
+exports.extractAllowlists = extractAllowlists;
+exports.fetchTrustPolicy = fetchTrustPolicy;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/widgets/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/widgets/trust-policy.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";;;AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACVxC,IAAM,wBAAA,GAA2B,0CAAA;AAE1B,IAAM,gBAAA,GAAmB;AAehC,IAAI,YAAA,GAAmC,IAAA;AACvC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,iBAAiB,GAAA,EAAoC;AACzE,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,YAAA,IAAgB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACvD,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,gBAAgB,CAAA;AAC/C,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,MAAA,GAAsB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE3C,EAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,MAAA,IAAU,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU;AAC1E,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAEA,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,kBAAkB,MAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,EAAG;AAChD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,MAAM,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAM,OAAO,CAAA;AAAA,EAClD;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACHA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,QAAA;AAE3C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAUA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AAET,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAGzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACnG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAaA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAErD,EAAA,MAAM,KAAA,GAAQ,OAAO,MAAA,KAAW,WAAA,IAAgB,OAA8C,gBAAA,KAAqB,IAAA;AAGnH,EAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,4CAA4C,CAAA;AACnE,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,MAAM,CAAA;AAErE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAGA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,aAAA,IAAiB,EAAC;AAE/C,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAA,CAAQ,IAAI,wCAAA,EAA0C;AAAA,MACpD,WAAW,gBAAA,CAAiB,MAAA;AAAA,MAC5B,SAAS,cAAA,CAAe,MAAA;AAAA,MACxB,UAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,IAAA,IAAI;AACF,MAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,EACF,CAAA,GAAG;AAEH,EAAA,eAAe,cAAc,KAAA,EAAqB;AAEhD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAEhD,IAAA,IAAI,KAAA,UAAe,GAAA,CAAI,4BAAA,EAA8B,KAAK,IAAA,EAAM,SAAA,EAAW,MAAM,MAAM,CAAA;AAGvF,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,8CAAA,EAAgD,MAAM,MAAM,CAAA;AACnF,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,6DAA6D,CAAA;AACpF,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAErB,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","/**\n * Trust policy: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * The bridge uses this to validate signing requests automatically.\n * Developers don't need to maintain their own allowlists.\n */\n\nconst DEFAULT_TRUST_POLICY_URL = \"https://api.omatrust.org/v1/trust-policy\";\n\nexport const TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;\n\nexport type ChainPolicy = {\n  name: string;\n  easContract: string;\n  schemas: string[];\n};\n\nexport type TrustPolicy = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  chains: Record<string, ChainPolicy>;\n};\n\nlet cachedPolicy: TrustPolicy | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust policy from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust policy URL (for testing or custom deployments)\n */\nexport async function fetchTrustPolicy(url?: string): Promise<TrustPolicy> {\n  const now = Date.now();\n  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedPolicy;\n  }\n\n  const res = await fetch(url ?? TRUST_POLICY_URL);\n  if (!res.ok) {\n    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);\n  }\n\n  const policy: TrustPolicy = await res.json();\n\n  if (!policy.version || !policy.chains || typeof policy.chains !== \"object\") {\n    throw new Error(\"Invalid trust policy format\");\n  }\n\n  cachedPolicy = policy;\n  cacheTimestamp = now;\n  return policy;\n}\n\n/**\n * Extract the allowed contracts and schemas from a trust policy.\n * Returns all contracts and schemas across all chains.\n */\nexport function extractAllowlists(policy: TrustPolicy): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(policy.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas) schemas.push(...chain.schemas);\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust policy before forwarding to the host's wallet.\n *\n * Security model:\n * - Trust policy: fetched from api.omatrust.org on bridge creation.\n *   Only contracts and schemas in the policy are accepted for signing.\n * - Origin check: derived from the trust policy domain (*.omatrust.org)\n *   plus any additional origins listed in the policy's widgetOrigins field.\n * - Source check: messages must come from the specific iframe's contentWindow\n * - EAS validation: domain, schema, attester, deadline are all checked\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframe: document.getElementById(\"omatrust-widget\"),\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustPolicy, extractAllowlists, TRUST_POLICY_URL } from \"./trust-policy\";\n\nexport type SigningBridgeOptions = {\n  /** The iframe element containing the widget. */\n  iframe: HTMLIFrameElement;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust policy domain\n   * (*.omatrust.org) plus any widgetOrigins in the policy.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\n/**\n * Derive the trusted base domain from the trust policy URL.\n * e.g., \"https://api.omatrust.org/v1/trust-policy\" → \"omatrust.org\"\n */\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_POLICY_URL).hostname;\n    // Extract the registrable domain (last two parts)\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\n/**\n * Check if a message origin is trusted.\n *\n * @param messageOrigin - The origin from event.origin (set by the browser)\n * @param baseDomain - The registrable domain of the trust policy (e.g., \"omatrust.org\")\n * @param policyOrigins - Additional origins from the trust policy's widgetOrigins field\n * @param devOverride - Optional dev-only origin (e.g., \"http://localhost:3000\")\n */\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  // 1. Dev override — allows localhost during development\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  // 2. Subdomain of the trust policy domain (e.g., *.omatrust.org)\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  // 3. Explicitly listed in the trust policy\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * Fetches the OMA3 trust policy on creation to determine which contracts,\n * schemas, and origins are allowed. The bridge will not start if the trust\n * policy cannot be fetched (fail closed).\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframe, signTypedData, devOriginOverride } = options;\n\n  const debug = typeof window !== \"undefined\" && (window as unknown as Record<string, unknown>).__OMATRUST_DEBUG === true;\n\n  // Fetch the trust policy — fail closed if unavailable\n  if (debug) console.log(\"[omatrust-bridge] fetching trust policy...\");\n  const policy = await fetchTrustPolicy();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust policy contains no allowed contracts or schemas\");\n  }\n\n  // Resolve trusted origins\n  const baseDomain = getTrustedBaseDomain();\n  const policyOrigins = policy.widgetOrigins ?? [];\n\n  if (debug) {\n    console.log(\"[omatrust-bridge] trust policy loaded:\", {\n      contracts: allowedContracts.length,\n      schemas: allowedSchemas.length,\n      baseDomain,\n      policyOrigins,\n      devOriginOverride,\n    });\n  }\n\n  // Determine the target origin for replies\n  const replyOrigin = devOriginOverride ?? (() => {\n    try {\n      return new URL(iframe.src).origin;\n    } catch {\n      return \"*\";\n    }\n  })();\n\n  async function handleMessage(event: MessageEvent) {\n    // Only look at omatrust messages\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    if (debug) console.log(\"[omatrust-bridge] message:\", data.type, \"origin:\", event.origin);\n\n    // Origin check — must be a trusted origin\n    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {\n      if (debug) console.log(\"[omatrust-bridge] rejected: untrusted origin\", event.origin);\n      return;\n    }\n\n    // Source check — must come from the specific iframe's contentWindow\n    if (event.source !== iframe.contentWindow) {\n      if (debug) console.log(\"[omatrust-bridge] rejected: source !== iframe.contentWindow\");\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}

package/dist/widgets/index.d.cts

@@ -0,0 +1,133 @@
+/**
+ * Host-side signing bridge for OMATrust widget iframes.
+ *
+ * Handles the postMessage protocol between a host page and an embedded
+ * OMATrust widget. Validates incoming EAS signing requests against the
+ * OMA3 trust policy before forwarding to the host's wallet.
+ *
+ * Security model:
+ * - Trust policy: fetched from api.omatrust.org on bridge creation.
+ *   Only contracts and schemas in the policy are accepted for signing.
+ * - Origin check: derived from the trust policy domain (*.omatrust.org)
+ *   plus any additional origins listed in the policy's widgetOrigins field.
+ * - Source check: messages must come from the specific iframe's contentWindow
+ * - EAS validation: domain, schema, attester, deadline are all checked
+ *
+ * Usage:
+ *   import { createSigningBridge } from "@oma3/omatrust/widgets";
+ *
+ *   const bridge = await createSigningBridge({
+ *     iframe: document.getElementById("omatrust-widget"),
+ *     signTypedData: async (domain, types, message) => {
+ *       return await signer.signTypedData(domain, types, message);
+ *     },
+ *   });
+ *
+ *   bridge.destroy();
+ */
+type SigningBridgeOptions = {
+    /** The iframe element containing the widget. */
+    iframe: HTMLIFrameElement;
+    /**
+     * Callback to sign EIP-712 typed data using the host's wallet.
+     * Must return the hex-encoded signature string.
+     */
+    signTypedData: (domain: Record<string, unknown>, types: Record<string, unknown>, message: Record<string, unknown>) => Promise<string>;
+    /**
+     * Override the allowed widget origin for local development.
+     * In production, the origin is derived from the trust policy domain
+     * (*.omatrust.org) plus any widgetOrigins in the policy.
+     * Only set this for local dev (e.g., "http://localhost:3000").
+     */
+    devOriginOverride?: string;
+};
+type SigningBridge = {
+    /** Remove all event listeners and stop the bridge. */
+    destroy: () => void;
+};
+/**
+ * Create a signing bridge between the host page and an OMATrust widget iframe.
+ *
+ * Fetches the OMA3 trust policy on creation to determine which contracts,
+ * schemas, and origins are allowed. The bridge will not start if the trust
+ * policy cannot be fetched (fail closed).
+ */
+declare function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge>;
+
+/**
+ * Trust policy: fetches the OMA3 allowlist of EAS contracts and schemas.
+ *
+ * The bridge uses this to validate signing requests automatically.
+ * Developers don't need to maintain their own allowlists.
+ */
+declare const TRUST_POLICY_URL = "https://api.omatrust.org/v1/trust-policy";
+type ChainPolicy = {
+    name: string;
+    easContract: string;
+    schemas: string[];
+};
+type TrustPolicy = {
+    version: number;
+    updatedAt: string;
+    widgetOrigins?: string[];
+    chains: Record<string, ChainPolicy>;
+};
+/**
+ * Fetch the trust policy from the OMA3 API gateway.
+ * Caches the result for 5 minutes.
+ *
+ * @param url Override the trust policy URL (for testing or custom deployments)
+ */
+declare function fetchTrustPolicy(url?: string): Promise<TrustPolicy>;
+/**
+ * Extract the allowed contracts and schemas from a trust policy.
+ * Returns all contracts and schemas across all chains.
+ */
+declare function extractAllowlists(policy: TrustPolicy): {
+    allowedContracts: string[];
+    allowedSchemas: string[];
+};
+
+/**
+ * postMessage protocol constants and types for the OMATrust widget bridge.
+ *
+ * Widget (iframe) → Host:
+ *   omatrust:ready           — widget loaded, requesting handshake
+ *   omatrust:signTypedData   — widget requests EIP-712 signature
+ *
+ * Host → Widget (iframe):
+ *   omatrust:hostReady        — host acknowledges the widget
+ *   omatrust:signature        — host returns a signature
+ *   omatrust:signatureError   — host reports a signing failure
+ */
+declare const OMATRUST_READY: "omatrust:ready";
+declare const OMATRUST_HOST_READY: "omatrust:hostReady";
+declare const OMATRUST_SIGN_TYPED_DATA: "omatrust:signTypedData";
+declare const OMATRUST_SIGNATURE: "omatrust:signature";
+declare const OMATRUST_SIGNATURE_ERROR: "omatrust:signatureError";
+type OmaTrustReadyMessage = {
+    type: typeof OMATRUST_READY;
+};
+type OmaTrustHostReadyMessage = {
+    type: typeof OMATRUST_HOST_READY;
+};
+type OmaTrustSignTypedDataMessage = {
+    type: typeof OMATRUST_SIGN_TYPED_DATA;
+    id: string;
+    domain: Record<string, unknown>;
+    types: Record<string, unknown>;
+    message: Record<string, unknown>;
+};
+type OmaTrustSignatureMessage = {
+    type: typeof OMATRUST_SIGNATURE;
+    id: string;
+    signature: string;
+};
+type OmaTrustSignatureErrorMessage = {
+    type: typeof OMATRUST_SIGNATURE_ERROR;
+    id: string;
+    error: string;
+};
+type OmaTrustMessage = OmaTrustReadyMessage | OmaTrustHostReadyMessage | OmaTrustSignTypedDataMessage | OmaTrustSignatureMessage | OmaTrustSignatureErrorMessage;
+
+export { type ChainPolicy, OMATRUST_HOST_READY, OMATRUST_READY, OMATRUST_SIGNATURE, OMATRUST_SIGNATURE_ERROR, OMATRUST_SIGN_TYPED_DATA, type OmaTrustHostReadyMessage, type OmaTrustMessage, type OmaTrustReadyMessage, type OmaTrustSignTypedDataMessage, type OmaTrustSignatureErrorMessage, type OmaTrustSignatureMessage, type SigningBridge, type SigningBridgeOptions, TRUST_POLICY_URL, type TrustPolicy, createSigningBridge, extractAllowlists, fetchTrustPolicy };

package/dist/widgets/index.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Host-side signing bridge for OMATrust widget iframes.
+ *
+ * Handles the postMessage protocol between a host page and an embedded
+ * OMATrust widget. Validates incoming EAS signing requests against the
+ * OMA3 trust policy before forwarding to the host's wallet.
+ *
+ * Security model:
+ * - Trust policy: fetched from api.omatrust.org on bridge creation.
+ *   Only contracts and schemas in the policy are accepted for signing.
+ * - Origin check: derived from the trust policy domain (*.omatrust.org)
+ *   plus any additional origins listed in the policy's widgetOrigins field.
+ * - Source check: messages must come from the specific iframe's contentWindow
+ * - EAS validation: domain, schema, attester, deadline are all checked
+ *
+ * Usage:
+ *   import { createSigningBridge } from "@oma3/omatrust/widgets";
+ *
+ *   const bridge = await createSigningBridge({
+ *     iframe: document.getElementById("omatrust-widget"),
+ *     signTypedData: async (domain, types, message) => {
+ *       return await signer.signTypedData(domain, types, message);
+ *     },
+ *   });
+ *
+ *   bridge.destroy();
+ */
+type SigningBridgeOptions = {
+    /** The iframe element containing the widget. */
+    iframe: HTMLIFrameElement;
+    /**
+     * Callback to sign EIP-712 typed data using the host's wallet.
+     * Must return the hex-encoded signature string.
+     */
+    signTypedData: (domain: Record<string, unknown>, types: Record<string, unknown>, message: Record<string, unknown>) => Promise<string>;
+    /**
+     * Override the allowed widget origin for local development.
+     * In production, the origin is derived from the trust policy domain
+     * (*.omatrust.org) plus any widgetOrigins in the policy.
+     * Only set this for local dev (e.g., "http://localhost:3000").
+     */
+    devOriginOverride?: string;
+};
+type SigningBridge = {
+    /** Remove all event listeners and stop the bridge. */
+    destroy: () => void;
+};
+/**
+ * Create a signing bridge between the host page and an OMATrust widget iframe.
+ *
+ * Fetches the OMA3 trust policy on creation to determine which contracts,
+ * schemas, and origins are allowed. The bridge will not start if the trust
+ * policy cannot be fetched (fail closed).
+ */
+declare function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge>;
+
+/**
+ * Trust policy: fetches the OMA3 allowlist of EAS contracts and schemas.
+ *
+ * The bridge uses this to validate signing requests automatically.
+ * Developers don't need to maintain their own allowlists.
+ */
+declare const TRUST_POLICY_URL = "https://api.omatrust.org/v1/trust-policy";
+type ChainPolicy = {
+    name: string;
+    easContract: string;
+    schemas: string[];
+};
+type TrustPolicy = {
+    version: number;
+    updatedAt: string;
+    widgetOrigins?: string[];
+    chains: Record<string, ChainPolicy>;
+};
+/**
+ * Fetch the trust policy from the OMA3 API gateway.
+ * Caches the result for 5 minutes.
+ *
+ * @param url Override the trust policy URL (for testing or custom deployments)
+ */
+declare function fetchTrustPolicy(url?: string): Promise<TrustPolicy>;
+/**
+ * Extract the allowed contracts and schemas from a trust policy.
+ * Returns all contracts and schemas across all chains.
+ */
+declare function extractAllowlists(policy: TrustPolicy): {
+    allowedContracts: string[];
+    allowedSchemas: string[];
+};
+
+/**
+ * postMessage protocol constants and types for the OMATrust widget bridge.
+ *
+ * Widget (iframe) → Host:
+ *   omatrust:ready           — widget loaded, requesting handshake
+ *   omatrust:signTypedData   — widget requests EIP-712 signature
+ *
+ * Host → Widget (iframe):
+ *   omatrust:hostReady        — host acknowledges the widget
+ *   omatrust:signature        — host returns a signature
+ *   omatrust:signatureError   — host reports a signing failure
+ */
+declare const OMATRUST_READY: "omatrust:ready";
+declare const OMATRUST_HOST_READY: "omatrust:hostReady";
+declare const OMATRUST_SIGN_TYPED_DATA: "omatrust:signTypedData";
+declare const OMATRUST_SIGNATURE: "omatrust:signature";
+declare const OMATRUST_SIGNATURE_ERROR: "omatrust:signatureError";
+type OmaTrustReadyMessage = {
+    type: typeof OMATRUST_READY;
+};
+type OmaTrustHostReadyMessage = {
+    type: typeof OMATRUST_HOST_READY;
+};
+type OmaTrustSignTypedDataMessage = {
+    type: typeof OMATRUST_SIGN_TYPED_DATA;
+    id: string;
+    domain: Record<string, unknown>;
+    types: Record<string, unknown>;
+    message: Record<string, unknown>;
+};
+type OmaTrustSignatureMessage = {
+    type: typeof OMATRUST_SIGNATURE;
+    id: string;
+    signature: string;
+};
+type OmaTrustSignatureErrorMessage = {
+    type: typeof OMATRUST_SIGNATURE_ERROR;
+    id: string;
+    error: string;
+};
+type OmaTrustMessage = OmaTrustReadyMessage | OmaTrustHostReadyMessage | OmaTrustSignTypedDataMessage | OmaTrustSignatureMessage | OmaTrustSignatureErrorMessage;
+
+export { type ChainPolicy, OMATRUST_HOST_READY, OMATRUST_READY, OMATRUST_SIGNATURE, OMATRUST_SIGNATURE_ERROR, OMATRUST_SIGN_TYPED_DATA, type OmaTrustHostReadyMessage, type OmaTrustMessage, type OmaTrustReadyMessage, type OmaTrustSignTypedDataMessage, type OmaTrustSignatureErrorMessage, type OmaTrustSignatureMessage, type SigningBridge, type SigningBridgeOptions, TRUST_POLICY_URL, type TrustPolicy, createSigningBridge, extractAllowlists, fetchTrustPolicy };

package/dist/widgets/index.js

@@ -0,0 +1,197 @@
+// src/widgets/protocol.ts
+var OMATRUST_READY = "omatrust:ready";
+var OMATRUST_HOST_READY = "omatrust:hostReady";
+var OMATRUST_SIGN_TYPED_DATA = "omatrust:signTypedData";
+var OMATRUST_SIGNATURE = "omatrust:signature";
+var OMATRUST_SIGNATURE_ERROR = "omatrust:signatureError";
+
+// src/widgets/trust-policy.ts
+var DEFAULT_TRUST_POLICY_URL = "https://api.omatrust.org/v1/trust-policy";
+var TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;
+var cachedPolicy = null;
+var cacheTimestamp = 0;
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+async function fetchTrustPolicy(url) {
+  const now = Date.now();
+  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {
+    return cachedPolicy;
+  }
+  const res = await fetch(url ?? TRUST_POLICY_URL);
+  if (!res.ok) {
+    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);
+  }
+  const policy = await res.json();
+  if (!policy.version || !policy.chains || typeof policy.chains !== "object") {
+    throw new Error("Invalid trust policy format");
+  }
+  cachedPolicy = policy;
+  cacheTimestamp = now;
+  return policy;
+}
+function extractAllowlists(policy) {
+  const contracts = [];
+  const schemas = [];
+  for (const chain of Object.values(policy.chains)) {
+    if (chain.easContract) contracts.push(chain.easContract);
+    if (chain.schemas) schemas.push(...chain.schemas);
+  }
+  return {
+    allowedContracts: [...new Set(contracts)],
+    allowedSchemas: [...new Set(schemas)]
+  };
+}
+
+// src/widgets/bridge.ts
+function getTrustedBaseDomain() {
+  try {
+    const hostname = new URL(TRUST_POLICY_URL).hostname;
+    const parts = hostname.split(".");
+    return parts.length >= 2 ? parts.slice(-2).join(".") : hostname;
+  } catch {
+    return "omatrust.org";
+  }
+}
+function isOriginTrusted(messageOrigin, baseDomain, policyOrigins, devOverride) {
+  if (devOverride && messageOrigin === devOverride) return true;
+  try {
+    const hostname = new URL(messageOrigin).hostname;
+    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;
+  } catch {
+  }
+  if (policyOrigins.includes(messageOrigin)) return true;
+  return false;
+}
+var HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
+var BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;
+function validateEasSigningRequest(data, allowedSchemas, allowedContracts) {
+  const { id, domain, types, message } = data;
+  if (!id || typeof id !== "string") {
+    return { valid: false, reason: "Missing or invalid request id" };
+  }
+  if (!domain || typeof domain !== "object") {
+    return { valid: false, reason: "Missing domain object" };
+  }
+  const d = domain;
+  if (d.name !== "EAS") {
+    return { valid: false, reason: `Unexpected domain name: "${d.name}" (expected "EAS")` };
+  }
+  if (d.version !== "1.4.0") {
+    return { valid: false, reason: `Unexpected domain version: "${d.version}" (expected "1.4.0")` };
+  }
+  const chainId = Number(d.chainId);
+  if (!Number.isInteger(chainId) || chainId <= 0) {
+    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };
+  }
+  if (typeof d.verifyingContract !== "string" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {
+    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };
+  }
+  const contractLower = d.verifyingContract.toLowerCase();
+  if (!allowedContracts.some((c) => c.toLowerCase() === contractLower)) {
+    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };
+  }
+  if (!types || typeof types !== "object") {
+    return { valid: false, reason: "Missing types object" };
+  }
+  if (!message || typeof message !== "object") {
+    return { valid: false, reason: "Missing message object" };
+  }
+  const m = message;
+  if (typeof m.schema !== "string" || !BYTES32_RE.test(m.schema)) {
+    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };
+  }
+  const schemaLower = m.schema.toLowerCase();
+  if (!allowedSchemas.some((s) => s.toLowerCase() === schemaLower)) {
+    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };
+  }
+  if (typeof m.attester !== "string" || !HEX_ADDRESS_RE.test(m.attester)) {
+    return { valid: false, reason: `Invalid attester address: ${m.attester}` };
+  }
+  const deadline = Number(m.deadline);
+  if (!Number.isFinite(deadline) || deadline <= 0) {
+    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (deadline <= now) {
+    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };
+  }
+  return { valid: true };
+}
+async function createSigningBridge(options) {
+  const { iframe, signTypedData, devOriginOverride } = options;
+  const debug = typeof window !== "undefined" && window.__OMATRUST_DEBUG === true;
+  if (debug) console.log("[omatrust-bridge] fetching trust policy...");
+  const policy = await fetchTrustPolicy();
+  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);
+  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {
+    throw new Error("Trust policy contains no allowed contracts or schemas");
+  }
+  const baseDomain = getTrustedBaseDomain();
+  const policyOrigins = policy.widgetOrigins ?? [];
+  if (debug) {
+    console.log("[omatrust-bridge] trust policy loaded:", {
+      contracts: allowedContracts.length,
+      schemas: allowedSchemas.length,
+      baseDomain,
+      policyOrigins,
+      devOriginOverride
+    });
+  }
+  const replyOrigin = devOriginOverride ?? (() => {
+    try {
+      return new URL(iframe.src).origin;
+    } catch {
+      return "*";
+    }
+  })();
+  async function handleMessage(event) {
+    const data = event.data;
+    if (!data || typeof data !== "object" || typeof data.type !== "string") return;
+    if (!String(data.type).startsWith("omatrust:")) return;
+    if (debug) console.log("[omatrust-bridge] message:", data.type, "origin:", event.origin);
+    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {
+      if (debug) console.log("[omatrust-bridge] rejected: untrusted origin", event.origin);
+      return;
+    }
+    if (event.source !== iframe.contentWindow) {
+      if (debug) console.log("[omatrust-bridge] rejected: source !== iframe.contentWindow");
+      return;
+    }
+    const source = event.source;
+    function reply(msg) {
+      source.postMessage(msg, replyOrigin);
+    }
+    if (data.type === OMATRUST_READY) {
+      reply({ type: OMATRUST_HOST_READY });
+      return;
+    }
+    if (data.type === OMATRUST_SIGN_TYPED_DATA) {
+      const { id, domain, types, message } = data;
+      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);
+      if (!validation.valid) {
+        reply({
+          type: OMATRUST_SIGNATURE_ERROR,
+          id: id ?? "unknown",
+          error: `Signing request rejected: ${validation.reason}`
+        });
+        return;
+      }
+      try {
+        const signature = await signTypedData(domain, types, message);
+        reply({ type: OMATRUST_SIGNATURE, id, signature });
+      } catch (err) {
+        const error = err instanceof Error ? err.message : "Signing failed";
+        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });
+      }
+    }
+  }
+  window.addEventListener("message", handleMessage);
+  return {
+    destroy() {
+      window.removeEventListener("message", handleMessage);
+    }
+  };
+}
+
+export { OMATRUST_HOST_READY, OMATRUST_READY, OMATRUST_SIGNATURE, OMATRUST_SIGNATURE_ERROR, OMATRUST_SIGN_TYPED_DATA, TRUST_POLICY_URL, createSigningBridge, extractAllowlists, fetchTrustPolicy };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/widgets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/widgets/protocol.ts","../../src/widgets/trust-policy.ts","../../src/widgets/bridge.ts"],"names":[],"mappings":";AAaO,IAAM,cAAA,GAAiB;AACvB,IAAM,mBAAA,GAAsB;AAC5B,IAAM,wBAAA,GAA2B;AACjC,IAAM,kBAAA,GAAqB;AAC3B,IAAM,wBAAA,GAA2B;;;ACVxC,IAAM,wBAAA,GAA2B,0CAAA;AAE1B,IAAM,gBAAA,GAAmB;AAehC,IAAI,YAAA,GAAmC,IAAA;AACvC,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAQ9B,eAAsB,iBAAiB,GAAA,EAAoC;AACzE,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,YAAA,IAAgB,GAAA,GAAM,cAAA,GAAiB,YAAA,EAAc;AACvD,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,IAAO,gBAAgB,CAAA;AAC/C,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACjF;AAEA,EAAA,MAAM,MAAA,GAAsB,MAAM,GAAA,CAAI,IAAA,EAAK;AAE3C,EAAA,IAAI,CAAC,OAAO,OAAA,IAAW,CAAC,OAAO,MAAA,IAAU,OAAO,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU;AAC1E,IAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,EAC/C;AAEA,EAAA,YAAA,GAAe,MAAA;AACf,EAAA,cAAA,GAAiB,GAAA;AACjB,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,kBAAkB,MAAA,EAGhC;AACA,EAAA,MAAM,YAAsB,EAAC;AAC7B,EAAA,MAAM,UAAoB,EAAC;AAE3B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,EAAG;AAChD,IAAA,IAAI,KAAA,CAAM,WAAA,EAAa,SAAA,CAAU,IAAA,CAAK,MAAM,WAAW,CAAA;AACvD,IAAA,IAAI,MAAM,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,GAAG,MAAM,OAAO,CAAA;AAAA,EAClD;AAEA,EAAA,OAAO;AAAA,IACL,kBAAkB,CAAC,GAAG,IAAI,GAAA,CAAI,SAAS,CAAC,CAAA;AAAA,IACxC,gBAAgB,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC;AAAA,GACtC;AACF;;;ACHA,SAAS,oBAAA,GAA+B;AACtC,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,QAAA;AAE3C,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAChC,IAAA,OAAO,KAAA,CAAM,UAAU,CAAA,GAAI,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,QAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AAUA,SAAS,eAAA,CACP,aAAA,EACA,UAAA,EACA,aAAA,EACA,WAAA,EACS;AAET,EAAA,IAAI,WAAA,IAAe,aAAA,KAAkB,WAAA,EAAa,OAAO,IAAA;AAGzD,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAa,CAAA,CAAE,QAAA;AACxC,IAAA,IAAI,QAAA,KAAa,cAAc,QAAA,CAAS,QAAA,CAAS,IAAI,UAAU,CAAA,CAAE,GAAG,OAAO,IAAA;AAAA,EAC7E,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,IAAI,aAAA,CAAc,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,cAAA,GAAiB,qBAAA;AACvB,IAAM,UAAA,GAAa,qBAAA;AAMnB,SAAS,yBAAA,CACP,IAAA,EACA,cAAA,EACA,gBAAA,EACkB;AAClB,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,EAAA,IAAI,CAAC,EAAA,IAAM,OAAO,EAAA,KAAO,QAAA,EAAU;AACjC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,+BAAA,EAAgC;AAAA,EACjE;AACA,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,uBAAA,EAAwB;AAAA,EACzD;AAEA,EAAA,MAAM,CAAA,GAAI,MAAA;AAEV,EAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,yBAAA,EAA4B,CAAA,CAAE,IAAI,CAAA,kBAAA,CAAA,EAAqB;AAAA,EACxF;AACA,EAAA,IAAI,CAAA,CAAE,YAAY,OAAA,EAAS;AACzB,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,4BAAA,EAA+B,CAAA,CAAE,OAAO,CAAA,oBAAA,CAAA,EAAuB;AAAA,EAChG;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,CAAA,CAAE,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,WAAW,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,wBAAA,EAA2B,CAAA,CAAE,OAAO,CAAA,CAAA,EAAG;AAAA,EACxE;AACA,EAAA,IAAI,OAAO,EAAE,iBAAA,KAAsB,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,iBAAiB,CAAA,EAAG;AACxF,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,2BAAA,EAA8B,CAAA,CAAE,iBAAiB,CAAA,CAAA,EAAG;AAAA,EACrF;AAEA,EAAA,MAAM,aAAA,GAAiB,CAAA,CAAE,iBAAA,CAA6B,WAAA,EAAY;AAClE,EAAA,IAAI,CAAC,iBAAiB,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,aAAa,CAAA,EAAG;AAClE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,SAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACnG;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EACxD;AACA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAAyB;AAAA,EAC1D;AAEA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,oBAAA,EAAuB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAG;AAAA,EACnE;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,MAAA,CAAO,WAAA,EAAY;AACzC,EAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,WAAA,EAAY,KAAM,WAAW,CAAA,EAAG;AAC9D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,OAAA,EAAU,CAAA,CAAE,MAAM,CAAA,gCAAA,CAAA,EAAmC;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,EAAE,QAAA,KAAa,QAAA,IAAY,CAAC,cAAA,CAAe,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,EAAG;AACtE,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,0BAAA,EAA6B,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EAC3E;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAA,CAAE,QAAQ,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,YAAY,CAAA,EAAG;AAC/C,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAQ,CAAA,kBAAA,EAAqB,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAG;AAAA,EACnE;AACA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,IAAI,YAAY,GAAA,EAAK;AACnB,IAAA,OAAO,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,wBAAwB,QAAQ,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,EAAG;AAAA,EAC9E;AAEA,EAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AACvB;AAaA,eAAsB,oBAAoB,OAAA,EAAuD;AAC/F,EAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,iBAAA,EAAkB,GAAI,OAAA;AAErD,EAAA,MAAM,KAAA,GAAQ,OAAO,MAAA,KAAW,WAAA,IAAgB,OAA8C,gBAAA,KAAqB,IAAA;AAGnH,EAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,4CAA4C,CAAA;AACnE,EAAA,MAAM,MAAA,GAAS,MAAM,gBAAA,EAAiB;AACtC,EAAA,MAAM,EAAE,gBAAA,EAAkB,cAAA,EAAe,GAAI,kBAAkB,MAAM,CAAA;AAErE,EAAA,IAAI,gBAAA,CAAiB,MAAA,KAAW,CAAA,IAAK,cAAA,CAAe,WAAW,CAAA,EAAG;AAChE,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AAGA,EAAA,MAAM,aAAa,oBAAA,EAAqB;AACxC,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,aAAA,IAAiB,EAAC;AAE/C,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAA,CAAQ,IAAI,wCAAA,EAA0C;AAAA,MACpD,WAAW,gBAAA,CAAiB,MAAA;AAAA,MAC5B,SAAS,cAAA,CAAe,MAAA;AAAA,MACxB,UAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,WAAA,GAAc,sBAAsB,MAAM;AAC9C,IAAA,IAAI;AACF,MAAA,OAAO,IAAI,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,EACF,CAAA,GAAG;AAEH,EAAA,eAAe,cAAc,KAAA,EAAqB;AAEhD,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,SAAS,QAAA,EAAU;AACxE,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,CAAW,WAAW,CAAA,EAAG;AAEhD,IAAA,IAAI,KAAA,UAAe,GAAA,CAAI,4BAAA,EAA8B,KAAK,IAAA,EAAM,SAAA,EAAW,MAAM,MAAM,CAAA;AAGvF,IAAA,IAAI,CAAC,eAAA,CAAgB,KAAA,CAAM,QAAQ,UAAA,EAAY,aAAA,EAAe,iBAAiB,CAAA,EAAG;AAChF,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,8CAAA,EAAgD,MAAM,MAAM,CAAA;AACnF,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,aAAA,EAAe;AACzC,MAAA,IAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,6DAA6D,CAAA;AACpF,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AAErB,IAAA,SAAS,MAAM,GAAA,EAA8B;AAC3C,MAAA,MAAA,CAAO,WAAA,CAAY,KAAK,WAAW,CAAA;AAAA,IACrC;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,KAAA,CAAM,EAAE,IAAA,EAAM,mBAAA,EAAqB,CAAA;AACnC,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,wBAAA,EAA0B;AAC1C,MAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAQ,KAAA,EAAO,SAAQ,GAAI,IAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,IAAA,EAAM,cAAA,EAAgB,gBAAgB,CAAA;AACnF,MAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,QAAA,KAAA,CAAM;AAAA,UACJ,IAAA,EAAM,wBAAA;AAAA,UACN,IAAI,EAAA,IAAM,SAAA;AAAA,UACV,KAAA,EAAO,CAAA,0BAAA,EAA6B,UAAA,CAAW,MAAM,CAAA;AAAA,SACtD,CAAA;AACD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC5D,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAI,WAAW,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,KAAA,GAAQ,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,gBAAA;AACnD,QAAA,KAAA,CAAM,EAAE,IAAA,EAAM,wBAAA,EAA0B,EAAA,EAAI,OAAO,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,aAAa,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,OAAA,GAAU;AACR,MAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,aAAa,CAAA;AAAA,IACrD;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/**\n * postMessage protocol constants and types for the OMATrust widget bridge.\n *\n * Widget (iframe) → Host:\n *   omatrust:ready           — widget loaded, requesting handshake\n *   omatrust:signTypedData   — widget requests EIP-712 signature\n *\n * Host → Widget (iframe):\n *   omatrust:hostReady        — host acknowledges the widget\n *   omatrust:signature        — host returns a signature\n *   omatrust:signatureError   — host reports a signing failure\n */\n\nexport const OMATRUST_READY = \"omatrust:ready\" as const;\nexport const OMATRUST_HOST_READY = \"omatrust:hostReady\" as const;\nexport const OMATRUST_SIGN_TYPED_DATA = \"omatrust:signTypedData\" as const;\nexport const OMATRUST_SIGNATURE = \"omatrust:signature\" as const;\nexport const OMATRUST_SIGNATURE_ERROR = \"omatrust:signatureError\" as const;\n\nexport type OmaTrustReadyMessage = {\n  type: typeof OMATRUST_READY;\n};\n\nexport type OmaTrustHostReadyMessage = {\n  type: typeof OMATRUST_HOST_READY;\n};\n\nexport type OmaTrustSignTypedDataMessage = {\n  type: typeof OMATRUST_SIGN_TYPED_DATA;\n  id: string;\n  domain: Record<string, unknown>;\n  types: Record<string, unknown>;\n  message: Record<string, unknown>;\n};\n\nexport type OmaTrustSignatureMessage = {\n  type: typeof OMATRUST_SIGNATURE;\n  id: string;\n  signature: string;\n};\n\nexport type OmaTrustSignatureErrorMessage = {\n  type: typeof OMATRUST_SIGNATURE_ERROR;\n  id: string;\n  error: string;\n};\n\nexport type OmaTrustMessage =\n  | OmaTrustReadyMessage\n  | OmaTrustHostReadyMessage\n  | OmaTrustSignTypedDataMessage\n  | OmaTrustSignatureMessage\n  | OmaTrustSignatureErrorMessage;\n","/**\n * Trust policy: fetches the OMA3 allowlist of EAS contracts and schemas.\n *\n * The bridge uses this to validate signing requests automatically.\n * Developers don't need to maintain their own allowlists.\n */\n\nconst DEFAULT_TRUST_POLICY_URL = \"https://api.omatrust.org/v1/trust-policy\";\n\nexport const TRUST_POLICY_URL = DEFAULT_TRUST_POLICY_URL;\n\nexport type ChainPolicy = {\n  name: string;\n  easContract: string;\n  schemas: string[];\n};\n\nexport type TrustPolicy = {\n  version: number;\n  updatedAt: string;\n  widgetOrigins?: string[];\n  chains: Record<string, ChainPolicy>;\n};\n\nlet cachedPolicy: TrustPolicy | null = null;\nlet cacheTimestamp = 0;\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\n/**\n * Fetch the trust policy from the OMA3 API gateway.\n * Caches the result for 5 minutes.\n *\n * @param url Override the trust policy URL (for testing or custom deployments)\n */\nexport async function fetchTrustPolicy(url?: string): Promise<TrustPolicy> {\n  const now = Date.now();\n  if (cachedPolicy && now - cacheTimestamp < CACHE_TTL_MS) {\n    return cachedPolicy;\n  }\n\n  const res = await fetch(url ?? TRUST_POLICY_URL);\n  if (!res.ok) {\n    throw new Error(`Failed to fetch trust policy: ${res.status} ${res.statusText}`);\n  }\n\n  const policy: TrustPolicy = await res.json();\n\n  if (!policy.version || !policy.chains || typeof policy.chains !== \"object\") {\n    throw new Error(\"Invalid trust policy format\");\n  }\n\n  cachedPolicy = policy;\n  cacheTimestamp = now;\n  return policy;\n}\n\n/**\n * Extract the allowed contracts and schemas from a trust policy.\n * Returns all contracts and schemas across all chains.\n */\nexport function extractAllowlists(policy: TrustPolicy): {\n  allowedContracts: string[];\n  allowedSchemas: string[];\n} {\n  const contracts: string[] = [];\n  const schemas: string[] = [];\n\n  for (const chain of Object.values(policy.chains)) {\n    if (chain.easContract) contracts.push(chain.easContract);\n    if (chain.schemas) schemas.push(...chain.schemas);\n  }\n\n  return {\n    allowedContracts: [...new Set(contracts)],\n    allowedSchemas: [...new Set(schemas)],\n  };\n}\n","/**\n * Host-side signing bridge for OMATrust widget iframes.\n *\n * Handles the postMessage protocol between a host page and an embedded\n * OMATrust widget. Validates incoming EAS signing requests against the\n * OMA3 trust policy before forwarding to the host's wallet.\n *\n * Security model:\n * - Trust policy: fetched from api.omatrust.org on bridge creation.\n *   Only contracts and schemas in the policy are accepted for signing.\n * - Origin check: derived from the trust policy domain (*.omatrust.org)\n *   plus any additional origins listed in the policy's widgetOrigins field.\n * - Source check: messages must come from the specific iframe's contentWindow\n * - EAS validation: domain, schema, attester, deadline are all checked\n *\n * Usage:\n *   import { createSigningBridge } from \"@oma3/omatrust/widgets\";\n *\n *   const bridge = await createSigningBridge({\n *     iframe: document.getElementById(\"omatrust-widget\"),\n *     signTypedData: async (domain, types, message) => {\n *       return await signer.signTypedData(domain, types, message);\n *     },\n *   });\n *\n *   bridge.destroy();\n */\n\nimport {\n  OMATRUST_READY,\n  OMATRUST_HOST_READY,\n  OMATRUST_SIGN_TYPED_DATA,\n  OMATRUST_SIGNATURE,\n  OMATRUST_SIGNATURE_ERROR,\n} from \"./protocol\";\nimport { fetchTrustPolicy, extractAllowlists, TRUST_POLICY_URL } from \"./trust-policy\";\n\nexport type SigningBridgeOptions = {\n  /** The iframe element containing the widget. */\n  iframe: HTMLIFrameElement;\n\n  /**\n   * Callback to sign EIP-712 typed data using the host's wallet.\n   * Must return the hex-encoded signature string.\n   */\n  signTypedData: (\n    domain: Record<string, unknown>,\n    types: Record<string, unknown>,\n    message: Record<string, unknown>\n  ) => Promise<string>;\n\n  /**\n   * Override the allowed widget origin for local development.\n   * In production, the origin is derived from the trust policy domain\n   * (*.omatrust.org) plus any widgetOrigins in the policy.\n   * Only set this for local dev (e.g., \"http://localhost:3000\").\n   */\n  devOriginOverride?: string;\n};\n\nexport type SigningBridge = {\n  /** Remove all event listeners and stop the bridge. */\n  destroy: () => void;\n};\n\n// ---------------------------------------------------------------------------\n// Origin resolution\n// ---------------------------------------------------------------------------\n\n/**\n * Derive the trusted base domain from the trust policy URL.\n * e.g., \"https://api.omatrust.org/v1/trust-policy\" → \"omatrust.org\"\n */\nfunction getTrustedBaseDomain(): string {\n  try {\n    const hostname = new URL(TRUST_POLICY_URL).hostname;\n    // Extract the registrable domain (last two parts)\n    const parts = hostname.split(\".\");\n    return parts.length >= 2 ? parts.slice(-2).join(\".\") : hostname;\n  } catch {\n    return \"omatrust.org\";\n  }\n}\n\n/**\n * Check if a message origin is trusted.\n *\n * @param messageOrigin - The origin from event.origin (set by the browser)\n * @param baseDomain - The registrable domain of the trust policy (e.g., \"omatrust.org\")\n * @param policyOrigins - Additional origins from the trust policy's widgetOrigins field\n * @param devOverride - Optional dev-only origin (e.g., \"http://localhost:3000\")\n */\nfunction isOriginTrusted(\n  messageOrigin: string,\n  baseDomain: string,\n  policyOrigins: string[],\n  devOverride?: string\n): boolean {\n  // 1. Dev override — allows localhost during development\n  if (devOverride && messageOrigin === devOverride) return true;\n\n  // 2. Subdomain of the trust policy domain (e.g., *.omatrust.org)\n  try {\n    const hostname = new URL(messageOrigin).hostname;\n    if (hostname === baseDomain || hostname.endsWith(`.${baseDomain}`)) return true;\n  } catch {\n    // Invalid origin\n  }\n\n  // 3. Explicitly listed in the trust policy\n  if (policyOrigins.includes(messageOrigin)) return true;\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// EAS request validation\n// ---------------------------------------------------------------------------\n\nconst HEX_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;\nconst BYTES32_RE = /^0x[a-fA-F0-9]{64}$/;\n\ntype ValidationResult =\n  | { valid: true }\n  | { valid: false; reason: string };\n\nfunction validateEasSigningRequest(\n  data: Record<string, unknown>,\n  allowedSchemas: string[],\n  allowedContracts: string[]\n): ValidationResult {\n  const { id, domain, types, message } = data;\n\n  if (!id || typeof id !== \"string\") {\n    return { valid: false, reason: \"Missing or invalid request id\" };\n  }\n  if (!domain || typeof domain !== \"object\") {\n    return { valid: false, reason: \"Missing domain object\" };\n  }\n\n  const d = domain as Record<string, unknown>;\n\n  if (d.name !== \"EAS\") {\n    return { valid: false, reason: `Unexpected domain name: \"${d.name}\" (expected \"EAS\")` };\n  }\n  if (d.version !== \"1.4.0\") {\n    return { valid: false, reason: `Unexpected domain version: \"${d.version}\" (expected \"1.4.0\")` };\n  }\n  const chainId = Number(d.chainId);\n  if (!Number.isInteger(chainId) || chainId <= 0) {\n    return { valid: false, reason: `Invalid domain chainId: ${d.chainId}` };\n  }\n  if (typeof d.verifyingContract !== \"string\" || !HEX_ADDRESS_RE.test(d.verifyingContract)) {\n    return { valid: false, reason: `Invalid verifyingContract: ${d.verifyingContract}` };\n  }\n\n  const contractLower = (d.verifyingContract as string).toLowerCase();\n  if (!allowedContracts.some(c => c.toLowerCase() === contractLower)) {\n    return { valid: false, reason: `Contract ${d.verifyingContract} is not in the OMA3 trust policy` };\n  }\n\n  if (!types || typeof types !== \"object\") {\n    return { valid: false, reason: \"Missing types object\" };\n  }\n  if (!message || typeof message !== \"object\") {\n    return { valid: false, reason: \"Missing message object\" };\n  }\n\n  const m = message as Record<string, unknown>;\n\n  if (typeof m.schema !== \"string\" || !BYTES32_RE.test(m.schema)) {\n    return { valid: false, reason: `Invalid schema UID: ${m.schema}` };\n  }\n\n  const schemaLower = m.schema.toLowerCase();\n  if (!allowedSchemas.some(s => s.toLowerCase() === schemaLower)) {\n    return { valid: false, reason: `Schema ${m.schema} is not in the OMA3 trust policy` };\n  }\n\n  if (typeof m.attester !== \"string\" || !HEX_ADDRESS_RE.test(m.attester)) {\n    return { valid: false, reason: `Invalid attester address: ${m.attester}` };\n  }\n\n  const deadline = Number(m.deadline);\n  if (!Number.isFinite(deadline) || deadline <= 0) {\n    return { valid: false, reason: `Invalid deadline: ${m.deadline}` };\n  }\n  const now = Math.floor(Date.now() / 1000);\n  if (deadline <= now) {\n    return { valid: false, reason: `Deadline has passed: ${deadline} <= ${now}` };\n  }\n\n  return { valid: true };\n}\n\n// ---------------------------------------------------------------------------\n// Bridge implementation\n// ---------------------------------------------------------------------------\n\n/**\n * Create a signing bridge between the host page and an OMATrust widget iframe.\n *\n * Fetches the OMA3 trust policy on creation to determine which contracts,\n * schemas, and origins are allowed. The bridge will not start if the trust\n * policy cannot be fetched (fail closed).\n */\nexport async function createSigningBridge(options: SigningBridgeOptions): Promise<SigningBridge> {\n  const { iframe, signTypedData, devOriginOverride } = options;\n\n  const debug = typeof window !== \"undefined\" && (window as unknown as Record<string, unknown>).__OMATRUST_DEBUG === true;\n\n  // Fetch the trust policy — fail closed if unavailable\n  if (debug) console.log(\"[omatrust-bridge] fetching trust policy...\");\n  const policy = await fetchTrustPolicy();\n  const { allowedContracts, allowedSchemas } = extractAllowlists(policy);\n\n  if (allowedContracts.length === 0 || allowedSchemas.length === 0) {\n    throw new Error(\"Trust policy contains no allowed contracts or schemas\");\n  }\n\n  // Resolve trusted origins\n  const baseDomain = getTrustedBaseDomain();\n  const policyOrigins = policy.widgetOrigins ?? [];\n\n  if (debug) {\n    console.log(\"[omatrust-bridge] trust policy loaded:\", {\n      contracts: allowedContracts.length,\n      schemas: allowedSchemas.length,\n      baseDomain,\n      policyOrigins,\n      devOriginOverride,\n    });\n  }\n\n  // Determine the target origin for replies\n  const replyOrigin = devOriginOverride ?? (() => {\n    try {\n      return new URL(iframe.src).origin;\n    } catch {\n      return \"*\";\n    }\n  })();\n\n  async function handleMessage(event: MessageEvent) {\n    // Only look at omatrust messages\n    const data = event.data;\n    if (!data || typeof data !== \"object\" || typeof data.type !== \"string\") return;\n    if (!String(data.type).startsWith(\"omatrust:\")) return;\n\n    if (debug) console.log(\"[omatrust-bridge] message:\", data.type, \"origin:\", event.origin);\n\n    // Origin check — must be a trusted origin\n    if (!isOriginTrusted(event.origin, baseDomain, policyOrigins, devOriginOverride)) {\n      if (debug) console.log(\"[omatrust-bridge] rejected: untrusted origin\", event.origin);\n      return;\n    }\n\n    // Source check — must come from the specific iframe's contentWindow\n    if (event.source !== iframe.contentWindow) {\n      if (debug) console.log(\"[omatrust-bridge] rejected: source !== iframe.contentWindow\");\n      return;\n    }\n\n    const source = event.source as WindowProxy;\n\n    function reply(msg: Record<string, unknown>) {\n      source.postMessage(msg, replyOrigin);\n    }\n\n    // Handshake\n    if (data.type === OMATRUST_READY) {\n      reply({ type: OMATRUST_HOST_READY });\n      return;\n    }\n\n    // Signing request\n    if (data.type === OMATRUST_SIGN_TYPED_DATA) {\n      const { id, domain, types, message } = data;\n\n      const validation = validateEasSigningRequest(data, allowedSchemas, allowedContracts);\n      if (!validation.valid) {\n        reply({\n          type: OMATRUST_SIGNATURE_ERROR,\n          id: id ?? \"unknown\",\n          error: `Signing request rejected: ${validation.reason}`,\n        });\n        return;\n      }\n\n      try {\n        const signature = await signTypedData(domain, types, message);\n        reply({ type: OMATRUST_SIGNATURE, id, signature });\n      } catch (err) {\n        const error = err instanceof Error ? err.message : \"Signing failed\";\n        reply({ type: OMATRUST_SIGNATURE_ERROR, id, error });\n      }\n    }\n  }\n\n  window.addEventListener(\"message\", handleMessage);\n\n  return {\n    destroy() {\n      window.removeEventListener(\"message\", handleMessage);\n    },\n  };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oma3/omatrust",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.8",
   "description": "Framework-agnostic TypeScript SDK for OMATrust",
   "license": "MIT",
   "type": "module",
@@ -44,6 +44,14 @@
       "import": "./dist/app-registry/index.js",
       "require": "./dist/app-registry/index.cjs"
     },
+    "./widgets": {
+      "types": {
+        "import": "./dist/widgets/index.d.ts",
+        "require": "./dist/widgets/index.d.cts"
+      },
+      "import": "./dist/widgets/index.js",
+      "require": "./dist/widgets/index.cjs"
+    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -56,7 +64,8 @@
     "build": "tsup",
     "clean": "rm -rf dist",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "test:ci": "npm run typecheck && npm run test"
   },
   "dependencies": {
     "canonicalize": "^2.1.0"
@@ -73,6 +82,7 @@
   "devDependencies": {
     "@ethereum-attestation-service/eas-sdk": "^2.9.0",
     "@types/node": "^22.10.2",
+    "@vitest/coverage-v8": "^2.1.9",
     "ethers": "^6.16.0",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",