@opendatalabs/vana-sdk 4.4.0 → 4.5.0

package/dist/connect/launcher.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Partner-side launcher for the Vana connect sheet.
+ *
+ * @remarks
+ * `connect.open({ clientId, appName, env, getRequest, onEvent, display? })` returns
+ * `{ close, setRequestStatus }`. Only launcher, chrome and message
+ * protocol live here. Identity, consent and signing live in the Vana-hosted
+ * iframe and Vana's servers; no token ever crosses into the partner page.
+ *
+ * Most apps should not call this directly: `createDirectConnectFlow` (and
+ * `useVanaConnect`) with `presentation: "sheet"` open it and wire it to the
+ * request, the status poll and the read.
+ *
+ * Ported from `@vana-unity/connect-embed` with two differences: the version
+ * handshake (`incompatible_version`), and no default Vana origin (pass `env`
+ * or `vanaOrigin`).
+ *
+ * `connected` means the person approved; it is not delivery. Treat the data
+ * as delivered only once your backend's status poll and read say so (the
+ * connect flow's `done`).
+ *
+ * @category Connect
+ * @module connect/launcher
+ */
+import { type CloseReason } from "./chrome.js";
+import { type ConnectCompletion, type ConnectDisplay, type ConnectProgressPhase, type ConnectRequest, type RequestStatus, type SheetErrorCode, type VanaConnectEnv } from "./protocol.js";
+/**
+ * What the launcher reports to `onEvent`.
+ *
+ * @remarks
+ * `connected` is approval, not delivery: data is delivered only when the
+ * partner's backend reads it. The sheet sends no terminal "delivered" event
+ * today; the connect flow settles from the status poll instead.
+ */
+export type ConnectEvent = {
+    type: "ready";
+} | {
+    type: "signed-in";
+} | {
+    completion: ConnectCompletion;
+    status: "approved";
+    type: "connected";
+} | {
+    phase: ConnectProgressPhase;
+    type: "progress";
+} | {
+    reason: ConnectCloseReason;
+    type: "close";
+} | {
+    code: SheetErrorCode | "request_failed";
+    type: "error";
+};
+/** Every close says why, so a sheet never disappears unexplained. */
+export type ConnectCloseReason = CloseReason | "api" | "escape" | "frame_blocked" | "incompatible_version" | "origin_not_registered" | "replaced" | "sheet";
+/**
+ * Which Vana Account serves the sheet: an environment, or an exact origin
+ * (resolve preview origins with `resolveVanaAccountOrigin`). Required, so a
+ * dev app never silently frames production.
+ */
+export type ConnectTarget = {
+    /** Vana deployment; the sheet comes from `VANA_ACCOUNT_ORIGINS[env]`. */
+    env: VanaConnectEnv;
+    vanaOrigin?: undefined;
+} | {
+    /** Vana Account origin. */
+    vanaOrigin: string;
+    env?: undefined;
+};
+/** Options for {@link open}, besides the {@link ConnectTarget}. */
+export interface ConnectOpenBaseOptions {
+    /** Chrome label only. Vana never trusts it; the sheet shows registered names. */
+    appName: string;
+    /** Registered embed client id. */
+    clientId: string;
+    /** Defaults to `document.body`. */
+    container?: HTMLElement;
+    /**
+     * `sheet` (the default) is a bottom sheet over your page. `fullscreen` fills
+     * this window, for a window that holds nothing else, such as a small popup
+     * you opened yourself: close that window on the `close` event.
+     */
+    display?: ConnectDisplay;
+    /**
+     * Called when the sheet asks for the request (after sign-in). The partner's
+     * backend creates the request or re-signs its short-lived read capability.
+     */
+    getRequest: () => Promise<ConnectRequest>;
+    onEvent?: (event: ConnectEvent) => void;
+    /**
+     * CSP-blocked frames still fire `load`, so only `vana:ready` proves the
+     * sheet runs. Without it by this deadline the sheet closes with
+     * `frame_blocked`.
+     */
+    readyTimeoutMs?: number;
+}
+/** Options for {@link open}. */
+export type ConnectOpenOptions = ConnectOpenBaseOptions & ConnectTarget;
+/** The open sheet. */
+export interface ConnectHandle {
+    /** Close the sheet; emits `close` with reason `"api"`. */
+    close(): void;
+    /** Report the request outcome the partner's backend observed. */
+    setRequestStatus(status: RequestStatus): void;
+}
+/**
+ * Open the Vana connect sheet over the page. One sheet exists at a time;
+ * opening another closes the first with reason `"replaced"`.
+ *
+ * @param options - Client id, app name, the request source and event sink.
+ * @remarks
+ * Alongside framing, it asks Vana (`GET /api/embed/connect/client`, no
+ * credentials, no cache) whether this page's origin is registered for the
+ * client id, and closes with `origin_not_registered` on a definite no. If
+ * that check cannot be answered, the ready deadline decides.
+ *
+ * @param options - Client id, app name, Vana target, the request source and
+ * event sink.
+ * @returns A handle to close the sheet and report status.
+ * @throws TypeError when neither (or both) of `env` and `vanaOrigin` is
+ * given, `vanaOrigin` is not an http(s) origin, or `display` is not a known
+ * display.
+ */
+export declare function open(options: ConnectOpenOptions): ConnectHandle;
+/** Alias of {@link open}, for call sites where `open` would be ambiguous. */
+export declare const openConnectSheet: typeof open;
+/** Namespace form: `connect.open(...)`. */
+export declare const connect: {
+    readonly open: typeof open;
+};

package/dist/connect/launcher.js

@@ -0,0 +1,220 @@
+import {
+  createSheetChrome
+} from "./chrome.js";
+import {
+  clientCheckUrl,
+  DEFAULT_CONNECT_DISPLAY,
+  MIN_SHEET_HEIGHT_PX,
+  normalizeOrigin,
+  PROTOCOL_VERSION,
+  parseClientCheck,
+  parseSheetMessage,
+  readConnectDisplay,
+  readIncompatibleVersion,
+  sheetUrl,
+  VANA_ACCOUNT_ORIGINS
+} from "./protocol.js";
+const DEFAULT_READY_TIMEOUT_MS = 1e4;
+let closeCurrent = null;
+function open(options) {
+  const vanaOrigin = resolveTarget(options);
+  const display = readConnectDisplay(
+    options.display ?? DEFAULT_CONNECT_DISPLAY
+  );
+  if (!display) {
+    throw new TypeError('display must be "sheet" or "fullscreen"');
+  }
+  closeCurrent?.("replaced");
+  const emit = (event) => options.onEvent?.(event);
+  const previousFocus = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+  const previousOverflow = document.body.style.overflow;
+  let closed = false;
+  let ready = false;
+  let pendingStatus = null;
+  let chrome = null;
+  const post = (message) => {
+    chrome?.iframe.contentWindow?.postMessage(message, vanaOrigin);
+  };
+  const close = (reason) => {
+    if (closed) {
+      return;
+    }
+    closed = true;
+    window.clearTimeout(readyTimer);
+    window.removeEventListener("message", onMessage);
+    document.removeEventListener("keydown", onKeyDown);
+    chrome?.remove();
+    document.body.style.overflow = previousOverflow;
+    previousFocus?.focus();
+    if (closeCurrent === close) {
+      closeCurrent = null;
+    }
+    emit({ reason, type: "close" });
+  };
+  const requestFromPartner = () => {
+    options.getRequest().then(
+      (request) => {
+        if (!closed) {
+          post({ request, type: "vana:request", v: PROTOCOL_VERSION });
+        }
+      },
+      () => {
+        if (!closed) {
+          emit({ code: "request_failed", type: "error" });
+        }
+      }
+    );
+  };
+  const handleSheetMessage = (message) => {
+    switch (message.type) {
+      case "vana:ready":
+        if (ready) {
+          return;
+        }
+        window.clearTimeout(readyTimer);
+        ready = true;
+        if (pendingStatus) {
+          post({
+            status: pendingStatus,
+            type: "vana:request-status",
+            v: PROTOCOL_VERSION
+          });
+          pendingStatus = null;
+        }
+        emit({ type: "ready" });
+        return;
+      case "vana:resize":
+        if (message.height >= MIN_SHEET_HEIGHT_PX) {
+          chrome?.setContentHeight(message.height);
+        }
+        return;
+      case "vana:signed-in":
+        emit({ type: "signed-in" });
+        return;
+      case "vana:request-needed":
+        requestFromPartner();
+        return;
+      case "vana:connected":
+        emit({
+          completion: message.completion,
+          status: message.status,
+          type: "connected"
+        });
+        return;
+      case "vana:progress":
+        emit({ phase: message.phase, type: "progress" });
+        return;
+      case "vana:close":
+        close("sheet");
+        return;
+      case "vana:error":
+        window.clearTimeout(readyTimer);
+        emit({ code: message.code, type: "error" });
+        return;
+      default:
+        return;
+    }
+  };
+  function onMessage(event) {
+    if (event.origin !== vanaOrigin || !chrome || event.source !== chrome.iframe.contentWindow) {
+      return;
+    }
+    if (readIncompatibleVersion(event.data) !== null) {
+      emit({ code: "incompatible_version", type: "error" });
+      close("incompatible_version");
+      return;
+    }
+    const message = parseSheetMessage(event.data);
+    if (message) {
+      handleSheetMessage(message);
+    }
+  }
+  function onKeyDown(event) {
+    if (event.key === "Escape") {
+      close("escape");
+    }
+  }
+  const handle = {
+    close: () => {
+      close("api");
+    },
+    setRequestStatus(status) {
+      if (!ready) {
+        pendingStatus = status;
+        return;
+      }
+      post({ status, type: "vana:request-status", v: PROTOCOL_VERSION });
+    }
+  };
+  window.addEventListener("message", onMessage);
+  document.addEventListener("keydown", onKeyDown);
+  const readyTimer = window.setTimeout(() => {
+    emit({ code: "frame_blocked", type: "error" });
+    close("frame_blocked");
+  }, options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS);
+  checkClient(
+    clientCheckUrl({
+      clientId: options.clientId,
+      partnerOrigin: window.location.origin,
+      vanaOrigin
+    }),
+    () => {
+      if (!(closed || ready)) {
+        emit({ code: "origin_not_registered", type: "error" });
+        close("origin_not_registered");
+      }
+    }
+  );
+  chrome = createSheetChrome({
+    ariaLabel: `${options.appName} uses Vana`,
+    container: options.container ?? document.body,
+    display,
+    onClose: close,
+    src: sheetUrl({
+      clientId: options.clientId,
+      display,
+      partnerOrigin: window.location.origin,
+      vanaOrigin
+    })
+  });
+  document.body.style.overflow = "hidden";
+  chrome.show();
+  chrome.iframe.focus();
+  closeCurrent = close;
+  return handle;
+}
+function resolveTarget(target) {
+  const { env, vanaOrigin } = target;
+  if (env === void 0 === (vanaOrigin === void 0)) {
+    throw new TypeError("Pass exactly one of env and vanaOrigin");
+  }
+  if (env !== void 0) {
+    if (env !== "production" && env !== "dev") {
+      throw new TypeError('env must be "production" or "dev"');
+    }
+    return VANA_ACCOUNT_ORIGINS[env];
+  }
+  const origin = typeof vanaOrigin === "string" ? normalizeOrigin(vanaOrigin) : null;
+  if (!origin) {
+    throw new TypeError("vanaOrigin must be an http(s) origin");
+  }
+  return origin;
+}
+function checkClient(url, onRefused) {
+  if (typeof fetch !== "function") {
+    return;
+  }
+  fetch(url, { cache: "no-store", credentials: "omit" }).then((response) => response.ok ? response.json() : null).then((body) => {
+    if (parseClientCheck(body)?.registered === false) {
+      onRefused();
+    }
+  }).catch(() => void 0);
+}
+const openConnectSheet = open;
+const connect = { open };
+export {
+  connect,
+  open,
+  openConnectSheet
+};
+//# sourceMappingURL=launcher.js.map

package/dist/connect/launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/connect/launcher.ts"],"sourcesContent":["/**\n * Partner-side launcher for the Vana connect sheet.\n *\n * @remarks\n * `connect.open({ clientId, appName, env, getRequest, onEvent, display? })` returns\n * `{ close, setRequestStatus }`. Only launcher, chrome and message\n * protocol live here. Identity, consent and signing live in the Vana-hosted\n * iframe and Vana's servers; no token ever crosses into the partner page.\n *\n * Most apps should not call this directly: `createDirectConnectFlow` (and\n * `useVanaConnect`) with `presentation: \"sheet\"` open it and wire it to the\n * request, the status poll and the read.\n *\n * Ported from `@vana-unity/connect-embed` with two differences: the version\n * handshake (`incompatible_version`), and no default Vana origin (pass `env`\n * or `vanaOrigin`).\n *\n * `connected` means the person approved; it is not delivery. Treat the data\n * as delivered only once your backend's status poll and read say so (the\n * connect flow's `done`).\n *\n * @category Connect\n * @module connect/launcher\n */\n\nimport {\n  type CloseReason,\n  createSheetChrome,\n  type SheetChrome,\n} from \"./chrome\";\nimport {\n  type ConnectCompletion,\n  type ConnectDisplay,\n  type ConnectProgressPhase,\n  type ConnectRequest,\n  clientCheckUrl,\n  DEFAULT_CONNECT_DISPLAY,\n  MIN_SHEET_HEIGHT_PX,\n  normalizeOrigin,\n  type PartnerMessage,\n  PROTOCOL_VERSION,\n  parseClientCheck,\n  parseSheetMessage,\n  readConnectDisplay,\n  readIncompatibleVersion,\n  type RequestStatus,\n  type SheetErrorCode,\n  type SheetMessage,\n  sheetUrl,\n  VANA_ACCOUNT_ORIGINS,\n  type VanaConnectEnv,\n} from \"./protocol\";\n\nconst DEFAULT_READY_TIMEOUT_MS = 10_000;\n\n/**\n * What the launcher reports to `onEvent`.\n *\n * @remarks\n * `connected` is approval, not delivery: data is delivered only when the\n * partner's backend reads it. The sheet sends no terminal \"delivered\" event\n * today; the connect flow settles from the status poll instead.\n */\nexport type ConnectEvent =\n  | { type: \"ready\" }\n  | { type: \"signed-in\" }\n  | { completion: ConnectCompletion; status: \"approved\"; type: \"connected\" }\n  | { phase: ConnectProgressPhase; type: \"progress\" }\n  | { reason: ConnectCloseReason; type: \"close\" }\n  | { code: SheetErrorCode | \"request_failed\"; type: \"error\" };\n\n/** Every close says why, so a sheet never disappears unexplained. */\nexport type ConnectCloseReason =\n  | CloseReason\n  | \"api\"\n  | \"escape\"\n  | \"frame_blocked\"\n  | \"incompatible_version\"\n  | \"origin_not_registered\"\n  | \"replaced\"\n  | \"sheet\";\n\n/**\n * Which Vana Account serves the sheet: an environment, or an exact origin\n * (resolve preview origins with `resolveVanaAccountOrigin`). Required, so a\n * dev app never silently frames production.\n */\nexport type ConnectTarget =\n  | {\n      /** Vana deployment; the sheet comes from `VANA_ACCOUNT_ORIGINS[env]`. */\n      env: VanaConnectEnv;\n      vanaOrigin?: undefined;\n    }\n  | {\n      /** Vana Account origin. */\n      vanaOrigin: string;\n      env?: undefined;\n    };\n\n/** Options for {@link open}, besides the {@link ConnectTarget}. */\nexport interface ConnectOpenBaseOptions {\n  /** Chrome label only. Vana never trusts it; the sheet shows registered names. */\n  appName: string;\n  /** Registered embed client id. */\n  clientId: string;\n  /** Defaults to `document.body`. */\n  container?: HTMLElement;\n  /**\n   * `sheet` (the default) is a bottom sheet over your page. `fullscreen` fills\n   * this window, for a window that holds nothing else, such as a small popup\n   * you opened yourself: close that window on the `close` event.\n   */\n  display?: ConnectDisplay;\n  /**\n   * Called when the sheet asks for the request (after sign-in). The partner's\n   * backend creates the request or re-signs its short-lived read capability.\n   */\n  getRequest: () => Promise<ConnectRequest>;\n  onEvent?: (event: ConnectEvent) => void;\n  /**\n   * CSP-blocked frames still fire `load`, so only `vana:ready` proves the\n   * sheet runs. Without it by this deadline the sheet closes with\n   * `frame_blocked`.\n   */\n  readyTimeoutMs?: number;\n}\n\n/** Options for {@link open}. */\nexport type ConnectOpenOptions = ConnectOpenBaseOptions & ConnectTarget;\n\n/** The open sheet. */\nexport interface ConnectHandle {\n  /** Close the sheet; emits `close` with reason `\"api\"`. */\n  close(): void;\n  /** Report the request outcome the partner's backend observed. */\n  setRequestStatus(status: RequestStatus): void;\n}\n\n/** Closes the open sheet, if any. One sheet at a time. */\nlet closeCurrent: ((reason: ConnectCloseReason) => void) | null = null;\n\n/**\n * Open the Vana connect sheet over the page. One sheet exists at a time;\n * opening another closes the first with reason `\"replaced\"`.\n *\n * @param options - Client id, app name, the request source and event sink.\n * @remarks\n * Alongside framing, it asks Vana (`GET /api/embed/connect/client`, no\n * credentials, no cache) whether this page's origin is registered for the\n * client id, and closes with `origin_not_registered` on a definite no. If\n * that check cannot be answered, the ready deadline decides.\n *\n * @param options - Client id, app name, Vana target, the request source and\n * event sink.\n * @returns A handle to close the sheet and report status.\n * @throws TypeError when neither (or both) of `env` and `vanaOrigin` is\n * given, `vanaOrigin` is not an http(s) origin, or `display` is not a known\n * display.\n */\nexport function open(options: ConnectOpenOptions): ConnectHandle {\n  const vanaOrigin = resolveTarget(options);\n  const display = readConnectDisplay(\n    options.display ?? DEFAULT_CONNECT_DISPLAY,\n  );\n  if (!display) {\n    throw new TypeError('display must be \"sheet\" or \"fullscreen\"');\n  }\n  closeCurrent?.(\"replaced\");\n\n  const emit = (event: ConnectEvent) => options.onEvent?.(event);\n  const previousFocus =\n    document.activeElement instanceof HTMLElement\n      ? document.activeElement\n      : null;\n  const previousOverflow = document.body.style.overflow;\n  let closed = false;\n  let ready = false;\n  /** Latest status reported before the sheet was ready, sent on ready. */\n  let pendingStatus: RequestStatus | null = null;\n  let chrome: SheetChrome | null = null;\n\n  const post = (message: PartnerMessage) => {\n    chrome?.iframe.contentWindow?.postMessage(message, vanaOrigin);\n  };\n\n  const close = (reason: ConnectCloseReason) => {\n    if (closed) {\n      return;\n    }\n    closed = true;\n    window.clearTimeout(readyTimer);\n    window.removeEventListener(\"message\", onMessage);\n    document.removeEventListener(\"keydown\", onKeyDown);\n    chrome?.remove();\n    document.body.style.overflow = previousOverflow;\n    previousFocus?.focus();\n    if (closeCurrent === close) {\n      closeCurrent = null;\n    }\n    emit({ reason, type: \"close\" });\n  };\n\n  const requestFromPartner = () => {\n    options.getRequest().then(\n      (request) => {\n        if (!closed) {\n          post({ request, type: \"vana:request\", v: PROTOCOL_VERSION });\n        }\n      },\n      () => {\n        if (!closed) {\n          emit({ code: \"request_failed\", type: \"error\" });\n        }\n      },\n    );\n  };\n\n  const handleSheetMessage = (message: SheetMessage) => {\n    switch (message.type) {\n      case \"vana:ready\":\n        // A sheet that mounts twice (strict-mode dev builds) says ready twice.\n        if (ready) {\n          return;\n        }\n        window.clearTimeout(readyTimer);\n        ready = true;\n        if (pendingStatus) {\n          post({\n            status: pendingStatus,\n            type: \"vana:request-status\",\n            v: PROTOCOL_VERSION,\n          });\n          pendingStatus = null;\n        }\n        emit({ type: \"ready\" });\n        return;\n      case \"vana:resize\":\n        if (message.height >= MIN_SHEET_HEIGHT_PX) {\n          chrome?.setContentHeight(message.height);\n        }\n        return;\n      case \"vana:signed-in\":\n        emit({ type: \"signed-in\" });\n        return;\n      case \"vana:request-needed\":\n        requestFromPartner();\n        return;\n      case \"vana:connected\":\n        emit({\n          completion: message.completion,\n          status: message.status,\n          type: \"connected\",\n        });\n        return;\n      case \"vana:progress\":\n        emit({ phase: message.phase, type: \"progress\" });\n        return;\n      case \"vana:close\":\n        close(\"sheet\");\n        return;\n      case \"vana:error\":\n        // The frame runs, so it is not blocked; the sheet stays open to say why.\n        window.clearTimeout(readyTimer);\n        emit({ code: message.code, type: \"error\" });\n        return;\n      default:\n        return;\n    }\n  };\n\n  function onMessage(event: MessageEvent) {\n    if (\n      event.origin !== vanaOrigin ||\n      !chrome ||\n      event.source !== chrome.iframe.contentWindow\n    ) {\n      return;\n    }\n    // A sheet at a version this launcher cannot speak is up but unusable:\n    // say so, rather than waiting out the ready timeout as \"frame_blocked\".\n    if (readIncompatibleVersion(event.data) !== null) {\n      emit({ code: \"incompatible_version\", type: \"error\" });\n      close(\"incompatible_version\");\n      return;\n    }\n    const message = parseSheetMessage(event.data);\n    if (message) {\n      handleSheetMessage(message);\n    }\n  }\n\n  function onKeyDown(event: KeyboardEvent) {\n    if (event.key === \"Escape\") {\n      close(\"escape\");\n    }\n  }\n\n  const handle: ConnectHandle = {\n    close: () => {\n      close(\"api\");\n    },\n    setRequestStatus(status) {\n      // Before ready the frame still holds about:blank; posting would be lost.\n      if (!ready) {\n        pendingStatus = status;\n        return;\n      }\n      post({ status, type: \"vana:request-status\", v: PROTOCOL_VERSION });\n    },\n  };\n\n  window.addEventListener(\"message\", onMessage);\n  document.addEventListener(\"keydown\", onKeyDown);\n  const readyTimer = window.setTimeout(() => {\n    emit({ code: \"frame_blocked\", type: \"error\" });\n    close(\"frame_blocked\");\n  }, options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS);\n\n  checkClient(\n    clientCheckUrl({\n      clientId: options.clientId,\n      partnerOrigin: window.location.origin,\n      vanaOrigin,\n    }),\n    () => {\n      if (!(closed || ready)) {\n        emit({ code: \"origin_not_registered\", type: \"error\" });\n        close(\"origin_not_registered\");\n      }\n    },\n  );\n\n  chrome = createSheetChrome({\n    ariaLabel: `${options.appName} uses Vana`,\n    container: options.container ?? document.body,\n    display,\n    onClose: close,\n    src: sheetUrl({\n      clientId: options.clientId,\n      display,\n      partnerOrigin: window.location.origin,\n      vanaOrigin,\n    }),\n  });\n  document.body.style.overflow = \"hidden\";\n  chrome.show();\n  chrome.iframe.focus();\n\n  closeCurrent = close;\n  return handle;\n}\n\nfunction resolveTarget(target: ConnectTarget): string {\n  const { env, vanaOrigin } = target as {\n    env?: unknown;\n    vanaOrigin?: unknown;\n  };\n  if ((env === undefined) === (vanaOrigin === undefined)) {\n    throw new TypeError(\"Pass exactly one of env and vanaOrigin\");\n  }\n  if (env !== undefined) {\n    if (env !== \"production\" && env !== \"dev\") {\n      throw new TypeError('env must be \"production\" or \"dev\"');\n    }\n    return VANA_ACCOUNT_ORIGINS[env];\n  }\n  const origin =\n    typeof vanaOrigin === \"string\" ? normalizeOrigin(vanaOrigin) : null;\n  if (!origin) {\n    throw new TypeError(\"vanaOrigin must be an http(s) origin\");\n  }\n  return origin;\n}\n\n/**\n * Ask Vana whether this page may frame the sheet, alongside framing it, and\n * call `onRefused` only on a definite no. Any failure to ask leaves the ready\n * deadline to decide, so the check can only end the sheet sooner.\n */\nfunction checkClient(url: string, onRefused: () => void): void {\n  if (typeof fetch !== \"function\") {\n    return;\n  }\n  fetch(url, { cache: \"no-store\", credentials: \"omit\" })\n    .then((response) => (response.ok ? response.json() : null))\n    .then((body: unknown) => {\n      if (parseClientCheck(body)?.registered === false) {\n        onRefused();\n      }\n    })\n    .catch(() => undefined);\n}\n\n/** Alias of {@link open}, for call sites where `open` would be ambiguous. */\nexport const openConnectSheet = open;\n\n/** Namespace form: `connect.open(...)`. */\nexport const connect = { open } as const;\n"],"mappings":"AAyBA;AAAA,EAEE;AAAA,OAEK;AACP;AAAA,EAKE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAIA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,2BAA2B;AAsFjC,IAAI,eAA8D;AAoB3D,SAAS,KAAK,SAA4C;AAC/D,QAAM,aAAa,cAAc,OAAO;AACxC,QAAM,UAAU;AAAA,IACd,QAAQ,WAAW;AAAA,EACrB;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,yCAAyC;AAAA,EAC/D;AACA,iBAAe,UAAU;AAEzB,QAAM,OAAO,CAAC,UAAwB,QAAQ,UAAU,KAAK;AAC7D,QAAM,gBACJ,SAAS,yBAAyB,cAC9B,SAAS,gBACT;AACN,QAAM,mBAAmB,SAAS,KAAK,MAAM;AAC7C,MAAI,SAAS;AACb,MAAI,QAAQ;AAEZ,MAAI,gBAAsC;AAC1C,MAAI,SAA6B;AAEjC,QAAM,OAAO,CAAC,YAA4B;AACxC,YAAQ,OAAO,eAAe,YAAY,SAAS,UAAU;AAAA,EAC/D;AAEA,QAAM,QAAQ,CAAC,WAA+B;AAC5C,QAAI,QAAQ;AACV;AAAA,IACF;AACA,aAAS;AACT,WAAO,aAAa,UAAU;AAC9B,WAAO,oBAAoB,WAAW,SAAS;AAC/C,aAAS,oBAAoB,WAAW,SAAS;AACjD,YAAQ,OAAO;AACf,aAAS,KAAK,MAAM,WAAW;AAC/B,mBAAe,MAAM;AACrB,QAAI,iBAAiB,OAAO;AAC1B,qBAAe;AAAA,IACjB;AACA,SAAK,EAAE,QAAQ,MAAM,QAAQ,CAAC;AAAA,EAChC;AAEA,QAAM,qBAAqB,MAAM;AAC/B,YAAQ,WAAW,EAAE;AAAA,MACnB,CAAC,YAAY;AACX,YAAI,CAAC,QAAQ;AACX,eAAK,EAAE,SAAS,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,MACA,MAAM;AACJ,YAAI,CAAC,QAAQ;AACX,eAAK,EAAE,MAAM,kBAAkB,MAAM,QAAQ,CAAC;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qBAAqB,CAAC,YAA0B;AACpD,YAAQ,QAAQ,MAAM;AAAA,MACpB,KAAK;AAEH,YAAI,OAAO;AACT;AAAA,QACF;AACA,eAAO,aAAa,UAAU;AAC9B,gBAAQ;AACR,YAAI,eAAe;AACjB,eAAK;AAAA,YACH,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,GAAG;AAAA,UACL,CAAC;AACD,0BAAgB;AAAA,QAClB;AACA,aAAK,EAAE,MAAM,QAAQ,CAAC;AACtB;AAAA,MACF,KAAK;AACH,YAAI,QAAQ,UAAU,qBAAqB;AACzC,kBAAQ,iBAAiB,QAAQ,MAAM;AAAA,QACzC;AACA;AAAA,MACF,KAAK;AACH,aAAK,EAAE,MAAM,YAAY,CAAC;AAC1B;AAAA,MACF,KAAK;AACH,2BAAmB;AACnB;AAAA,MACF,KAAK;AACH,aAAK;AAAA,UACH,YAAY,QAAQ;AAAA,UACpB,QAAQ,QAAQ;AAAA,UAChB,MAAM;AAAA,QACR,CAAC;AACD;AAAA,MACF,KAAK;AACH,aAAK,EAAE,OAAO,QAAQ,OAAO,MAAM,WAAW,CAAC;AAC/C;AAAA,MACF,KAAK;AACH,cAAM,OAAO;AACb;AAAA,MACF,KAAK;AAEH,eAAO,aAAa,UAAU;AAC9B,aAAK,EAAE,MAAM,QAAQ,MAAM,MAAM,QAAQ,CAAC;AAC1C;AAAA,MACF;AACE;AAAA,IACJ;AAAA,EACF;AAEA,WAAS,UAAU,OAAqB;AACtC,QACE,MAAM,WAAW,cACjB,CAAC,UACD,MAAM,WAAW,OAAO,OAAO,eAC/B;AACA;AAAA,IACF;AAGA,QAAI,wBAAwB,MAAM,IAAI,MAAM,MAAM;AAChD,WAAK,EAAE,MAAM,wBAAwB,MAAM,QAAQ,CAAC;AACpD,YAAM,sBAAsB;AAC5B;AAAA,IACF;AACA,UAAM,UAAU,kBAAkB,MAAM,IAAI;AAC5C,QAAI,SAAS;AACX,yBAAmB,OAAO;AAAA,IAC5B;AAAA,EACF;AAEA,WAAS,UAAU,OAAsB;AACvC,QAAI,MAAM,QAAQ,UAAU;AAC1B,YAAM,QAAQ;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAwB;AAAA,IAC5B,OAAO,MAAM;AACX,YAAM,KAAK;AAAA,IACb;AAAA,IACA,iBAAiB,QAAQ;AAEvB,UAAI,CAAC,OAAO;AACV,wBAAgB;AAChB;AAAA,MACF;AACA,WAAK,EAAE,QAAQ,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAAA,IACnE;AAAA,EACF;AAEA,SAAO,iBAAiB,WAAW,SAAS;AAC5C,WAAS,iBAAiB,WAAW,SAAS;AAC9C,QAAM,aAAa,OAAO,WAAW,MAAM;AACzC,SAAK,EAAE,MAAM,iBAAiB,MAAM,QAAQ,CAAC;AAC7C,UAAM,eAAe;AAAA,EACvB,GAAG,QAAQ,kBAAkB,wBAAwB;AAErD;AAAA,IACE,eAAe;AAAA,MACb,UAAU,QAAQ;AAAA,MAClB,eAAe,OAAO,SAAS;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,IACD,MAAM;AACJ,UAAI,EAAE,UAAU,QAAQ;AACtB,aAAK,EAAE,MAAM,yBAAyB,MAAM,QAAQ,CAAC;AACrD,cAAM,uBAAuB;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,WAAS,kBAAkB;AAAA,IACzB,WAAW,GAAG,QAAQ,OAAO;AAAA,IAC7B,WAAW,QAAQ,aAAa,SAAS;AAAA,IACzC;AAAA,IACA,SAAS;AAAA,IACT,KAAK,SAAS;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA,eAAe,OAAO,SAAS;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,WAAS,KAAK,MAAM,WAAW;AAC/B,SAAO,KAAK;AACZ,SAAO,OAAO,MAAM;AAEpB,iBAAe;AACf,SAAO;AACT;AAEA,SAAS,cAAc,QAA+B;AACpD,QAAM,EAAE,KAAK,WAAW,IAAI;AAI5B,MAAK,QAAQ,YAAgB,eAAe,SAAY;AACtD,UAAM,IAAI,UAAU,wCAAwC;AAAA,EAC9D;AACA,MAAI,QAAQ,QAAW;AACrB,QAAI,QAAQ,gBAAgB,QAAQ,OAAO;AACzC,YAAM,IAAI,UAAU,mCAAmC;AAAA,IACzD;AACA,WAAO,qBAAqB,GAAG;AAAA,EACjC;AACA,QAAM,SACJ,OAAO,eAAe,WAAW,gBAAgB,UAAU,IAAI;AACjE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,SAAO;AACT;AAOA,SAAS,YAAY,KAAa,WAA6B;AAC7D,MAAI,OAAO,UAAU,YAAY;AAC/B;AAAA,EACF;AACA,QAAM,KAAK,EAAE,OAAO,YAAY,aAAa,OAAO,CAAC,EAClD,KAAK,CAAC,aAAc,SAAS,KAAK,SAAS,KAAK,IAAI,IAAK,EACzD,KAAK,CAAC,SAAkB;AACvB,QAAI,iBAAiB,IAAI,GAAG,eAAe,OAAO;AAChD,gBAAU;AAAA,IACZ;AAAA,EACF,CAAC,EACA,MAAM,MAAM,MAAS;AAC1B;AAGO,MAAM,mBAAmB;AAGzB,MAAM,UAAU,EAAE,KAAK;","names":[]}

package/dist/connect/launcher.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/connect/protocol.cjs

@@ -0,0 +1,259 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var protocol_exports = {};
+__export(protocol_exports, {
+  CLIENT_CHECK_PATH: () => CLIENT_CHECK_PATH,
+  CONNECT_DISPLAYS: () => CONNECT_DISPLAYS,
+  DEFAULT_CONNECT_DISPLAY: () => DEFAULT_CONNECT_DISPLAY,
+  DEFAULT_VANA_ORIGIN: () => DEFAULT_VANA_ORIGIN,
+  MIN_PROTOCOL_VERSION: () => MIN_PROTOCOL_VERSION,
+  MIN_SHEET_HEIGHT_PX: () => MIN_SHEET_HEIGHT_PX,
+  PROTOCOL_VERSION: () => PROTOCOL_VERSION,
+  SHEET_PATH: () => SHEET_PATH,
+  SHEET_QUERY: () => SHEET_QUERY,
+  VANA_ACCOUNT_ORIGINS: () => VANA_ACCOUNT_ORIGINS,
+  clientCheckUrl: () => clientCheckUrl,
+  isRequestId: () => isRequestId,
+  normalizeOrigin: () => normalizeOrigin,
+  parseClientCheck: () => parseClientCheck,
+  parsePartnerMessage: () => parsePartnerMessage,
+  parseSheetMessage: () => parseSheetMessage,
+  readConnectDisplay: () => readConnectDisplay,
+  readConnectRequest: () => readConnectRequest,
+  readIncompatibleVersion: () => readIncompatibleVersion,
+  sheetUrl: () => sheetUrl,
+  vanaConnectCsp: () => vanaConnectCsp
+});
+module.exports = __toCommonJS(protocol_exports);
+const PROTOCOL_VERSION = 1;
+const MIN_PROTOCOL_VERSION = 1;
+const SHEET_PATH = "/embed/connect";
+const CLIENT_CHECK_PATH = "/api/embed/connect/client";
+const SHEET_QUERY = {
+  clientId: "client_id",
+  display: "display",
+  origin: "origin",
+  version: "v"
+};
+const CONNECT_DISPLAYS = ["sheet", "fullscreen"];
+const DEFAULT_CONNECT_DISPLAY = "sheet";
+function readConnectDisplay(value) {
+  return CONNECT_DISPLAYS.find((known) => known === value) ?? null;
+}
+const VANA_ACCOUNT_ORIGINS = {
+  production: "https://account.vana.org",
+  dev: "https://account-dev.vana.org"
+};
+const DEFAULT_VANA_ORIGIN = VANA_ACCOUNT_ORIGINS.production;
+const CONNECT_COMPLETIONS = [
+  "in_browser",
+  "remote_collect"
+];
+const PROGRESS_PHASES = [
+  "collecting",
+  "writing"
+];
+const MIN_SHEET_HEIGHT_PX = 80;
+const REQUEST_STATUSES = [
+  "pending",
+  "approved",
+  "completed",
+  "denied",
+  "expired"
+];
+const SHEET_ERROR_CODES = [
+  "frame_blocked",
+  "incompatible_version",
+  "origin_not_registered",
+  "personal_server_unsupported",
+  "request_unavailable",
+  "sheet_failed",
+  "vana_unavailable"
+];
+const HEX_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+const HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;
+const REQUEST_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const TIMESTAMP = /^[0-9]{10,16}$/;
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function isSupportedVersion(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_PROTOCOL_VERSION && value <= PROTOCOL_VERSION;
+}
+function isRequestId(value) {
+  return typeof value === "string" && REQUEST_ID.test(value);
+}
+function readAuthorization(value) {
+  const auth = record(value);
+  if (!auth) {
+    return null;
+  }
+  const { appAddress, signature, timestamp } = auth;
+  if (typeof appAddress !== "string" || !HEX_ADDRESS.test(appAddress) || typeof signature !== "string" || !HEX_SIGNATURE.test(signature) || typeof timestamp !== "string" || !TIMESTAMP.test(timestamp)) {
+    return null;
+  }
+  return {
+    appAddress,
+    signature,
+    timestamp
+  };
+}
+function readConnectRequest(value) {
+  const request = record(value);
+  if (!request || !isRequestId(request.id)) {
+    return null;
+  }
+  const authorization = readAuthorization(request.authorization);
+  return authorization ? { authorization, id: request.id } : null;
+}
+function readIncompatibleVersion(data) {
+  const message = record(data);
+  if (!message || message.type !== "vana:ready" && message.type !== "vana:error") {
+    return null;
+  }
+  const { v } = message;
+  if (typeof v !== "number" || !Number.isInteger(v) || isSupportedVersion(v)) {
+    return null;
+  }
+  return v;
+}
+function parseSheetMessage(data) {
+  const message = record(data);
+  if (!(message && isSupportedVersion(message.v))) {
+    return null;
+  }
+  const v = message.v;
+  switch (message.type) {
+    case "vana:ready":
+    case "vana:signed-in":
+    case "vana:request-needed":
+    case "vana:close":
+      return { type: message.type, v };
+    case "vana:resize": {
+      const { height } = message;
+      if (typeof height !== "number" || !Number.isFinite(height)) {
+        return null;
+      }
+      return { height, type: "vana:resize", v };
+    }
+    case "vana:connected": {
+      const completion = CONNECT_COMPLETIONS.find(
+        (known) => known === message.completion
+      );
+      return message.status === "approved" && completion ? { completion, status: "approved", type: "vana:connected", v } : null;
+    }
+    case "vana:progress": {
+      const phase = PROGRESS_PHASES.find((known) => known === message.phase);
+      return phase ? { phase, type: "vana:progress", v } : null;
+    }
+    case "vana:error": {
+      if (typeof message.code !== "string") {
+        return null;
+      }
+      const code = SHEET_ERROR_CODES.find((known) => known === message.code) ?? "sheet_failed";
+      return { code, type: "vana:error", v };
+    }
+    default:
+      return null;
+  }
+}
+function parsePartnerMessage(data) {
+  const message = record(data);
+  if (!(message && isSupportedVersion(message.v))) {
+    return null;
+  }
+  const v = message.v;
+  switch (message.type) {
+    case "vana:request": {
+      const request = readConnectRequest(message.request);
+      return request ? { request, type: "vana:request", v } : null;
+    }
+    case "vana:request-status": {
+      const status = REQUEST_STATUSES.find((known) => known === message.status);
+      return status ? { status, type: "vana:request-status", v } : null;
+    }
+    default:
+      return null;
+  }
+}
+function normalizeOrigin(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function clientCheckUrl(input) {
+  const url = new URL(CLIENT_CHECK_PATH, input.vanaOrigin);
+  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);
+  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);
+  return url.toString();
+}
+function parseClientCheck(data) {
+  const body = record(data);
+  return body && typeof body.registered === "boolean" ? { registered: body.registered } : null;
+}
+function sheetUrl(input) {
+  const url = new URL(SHEET_PATH, input.vanaOrigin);
+  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);
+  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);
+  url.searchParams.set(SHEET_QUERY.version, String(PROTOCOL_VERSION));
+  if (input.display && input.display !== DEFAULT_CONNECT_DISPLAY) {
+    url.searchParams.set(SHEET_QUERY.display, input.display);
+  }
+  return url.toString();
+}
+function vanaConnectCsp(target) {
+  const origin = target === "production" || target === "dev" ? VANA_ACCOUNT_ORIGINS[target] : typeof target === "object" && target !== null && typeof target.accountOrigin === "string" ? normalizeOrigin(target.accountOrigin) : null;
+  if (!origin) {
+    throw new TypeError(
+      'vanaConnectCsp needs "production", "dev" or an http(s) accountOrigin'
+    );
+  }
+  return { "connect-src": [origin], "frame-src": [origin] };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CLIENT_CHECK_PATH,
+  CONNECT_DISPLAYS,
+  DEFAULT_CONNECT_DISPLAY,
+  DEFAULT_VANA_ORIGIN,
+  MIN_PROTOCOL_VERSION,
+  MIN_SHEET_HEIGHT_PX,
+  PROTOCOL_VERSION,
+  SHEET_PATH,
+  SHEET_QUERY,
+  VANA_ACCOUNT_ORIGINS,
+  clientCheckUrl,
+  isRequestId,
+  normalizeOrigin,
+  parseClientCheck,
+  parsePartnerMessage,
+  parseSheetMessage,
+  readConnectDisplay,
+  readConnectRequest,
+  readIncompatibleVersion,
+  sheetUrl,
+  vanaConnectCsp
+});
+//# sourceMappingURL=protocol.cjs.map