@openkey/sdk 0.0.1 → 0.0.2

package/README.md

@@ -0,0 +1,227 @@
+# @openkey/sdk
+
+The official JavaScript/TypeScript SDK for [OpenKey](https://openkey.so) - secure key management powered by passkeys.
+
+## What is OpenKey?
+
+OpenKey provides secure cryptographic key management using passkeys (WebAuthn). Instead of managing seed phrases or private keys directly, OpenKey stores your keys securely and lets you authorize operations with biometric authentication (Face ID, Touch ID, etc.).
+
+**Key features:**
+- **Passkey-secured keys** - Keys are protected by WebAuthn, not passwords
+- **No seed phrases** - Never worry about losing or exposing recovery phrases
+- **Popup-based signing** - Clean UX with authorization popups
+- **EIP-1193 compatible** - Works with ethers.js, viem, and other web3 libraries
+
+## Installation
+
+```bash
+npm install @openkey/sdk
+# or
+yarn add @openkey/sdk
+# or
+bun add @openkey/sdk
+```
+
+## Quick Start
+
+```typescript
+import { OpenKey } from '@openkey/sdk';
+
+// Initialize the SDK
+const openkey = new OpenKey({
+  host: 'https://openkey.so', // Production
+  // host: 'http://localhost:5173', // Development
+});
+
+// Connect to OpenKey (opens popup for user to select/create a key)
+const { address, keyId } = await openkey.connect();
+console.log('Connected:', address);
+
+// Sign a message (opens popup for user approval)
+const signature = await openkey.signMessage({
+  message: 'Hello, OpenKey!',
+  keyId,
+});
+console.log('Signature:', signature);
+```
+
+## API Reference
+
+### `new OpenKey(options)`
+
+Create a new OpenKey instance.
+
+```typescript
+const openkey = new OpenKey({
+  host: 'https://openkey.so', // OpenKey server URL
+});
+```
+
+**Options:**
+- `host` (string): The OpenKey server URL. Use `https://openkey.so` for production.
+
+### `openkey.connect()`
+
+Opens the OpenKey popup for the user to authenticate and select a key.
+
+```typescript
+const { address, keyId } = await openkey.connect();
+```
+
+**Returns:**
+- `address` (string): The Ethereum address of the selected key
+- `keyId` (string): The unique identifier for the key (used in signing operations)
+
+### `openkey.signMessage(params)`
+
+Sign a message with the user's key. Opens a popup for user approval.
+
+```typescript
+const signature = await openkey.signMessage({
+  message: 'Hello, World!',
+  keyId: 'key-id-from-connect',
+});
+```
+
+**Parameters:**
+- `message` (string): The message to sign
+- `keyId` (string): The key ID from `connect()`
+
+**Returns:**
+- `signature` (string): The hex-encoded signature
+
+### `openkey.signTypedData(params)`
+
+Sign EIP-712 typed data with the user's key.
+
+```typescript
+const signature = await openkey.signTypedData({
+  domain: {
+    name: 'My App',
+    version: '1',
+    chainId: 1,
+  },
+  types: {
+    Message: [{ name: 'content', type: 'string' }],
+  },
+  primaryType: 'Message',
+  message: {
+    content: 'Hello!',
+  },
+  keyId: 'key-id-from-connect',
+});
+```
+
+## Integration with ethers.js
+
+OpenKey can be used as an EIP-1193 provider with ethers.js:
+
+```typescript
+import { OpenKey } from '@openkey/sdk';
+import { BrowserProvider } from 'ethers';
+
+// Create OpenKey instance
+const openkey = new OpenKey({ host: 'https://openkey.so' });
+
+// Connect and get the address
+const { address, keyId } = await openkey.connect();
+
+// Create an EIP-1193 compatible provider
+const eip1193Provider = {
+  async request({ method, params }: { method: string; params?: any[] }) {
+    switch (method) {
+      case 'eth_accounts':
+      case 'eth_requestAccounts':
+        return [address];
+      case 'eth_chainId':
+        return '0x1'; // Mainnet
+      case 'personal_sign': {
+        const message = hexToString(params![0]);
+        const result = await openkey.signMessage({ message, keyId });
+        return result.signature;
+      }
+      default:
+        throw new Error(`Unsupported method: ${method}`);
+    }
+  },
+};
+
+// Use with ethers
+const provider = new BrowserProvider(eip1193Provider);
+const signer = await provider.getSigner();
+```
+
+## Integration with TinyCloud
+
+OpenKey works seamlessly with [TinyCloud](https://tinycloud.xyz) for decentralized storage:
+
+```typescript
+import { OpenKey } from '@openkey/sdk';
+import { TinyCloudWeb } from '@tinycloud/web-sdk';
+import { BrowserProvider } from 'ethers';
+
+// Setup OpenKey
+const openkey = new OpenKey({ host: 'https://openkey.so' });
+const { address, keyId } = await openkey.connect();
+
+// Create EIP-1193 provider (see above)
+const eip1193Provider = createOpenKeyProvider(openkey, address, keyId);
+const ethersProvider = new BrowserProvider(eip1193Provider);
+
+// Initialize TinyCloud with OpenKey as the signer
+const tcw = new TinyCloudWeb({
+  providers: {
+    web3: {
+      driver: ethersProvider,
+    },
+  },
+});
+
+// Sign in to TinyCloud (uses OpenKey for SIWE signature)
+await tcw.signIn();
+
+// Now you can use TinyCloud storage
+await tcw.kv.put('hello', 'world');
+const result = await tcw.kv.get('hello');
+```
+
+## Development
+
+For local development, point the SDK to your local OpenKey instance:
+
+```typescript
+const openkey = new OpenKey({
+  host: 'http://localhost:5173',
+});
+```
+
+You can also enable dev mode in your app to use local OpenKey:
+
+```javascript
+localStorage.setItem('__DEV_MODE__', 'true');
+```
+
+## Browser Support
+
+OpenKey requires WebAuthn support:
+- Chrome 67+
+- Firefox 60+
+- Safari 13+
+- Edge 79+
+
+## Security
+
+- Keys never leave the OpenKey TEE (Trusted Execution Environment)
+- All signing operations require explicit user approval via passkey
+- No seed phrases or private keys to manage or lose
+
+## Links
+
+- [OpenKey Website](https://openkey.so)
+- [Documentation](https://docs.openkey.so)
+- [GitHub](https://github.com/AstroX11/openkey)
+- [TinyCloud Integration](https://tinycloud.xyz)
+
+## License
+
+MIT

package/dist/index.cjs

@@ -1,4 +1,4 @@
-"use strict";var l=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var T=Object.getOwnPropertyNames;var f=Object.prototype.hasOwnProperty;var E=(o,e)=>{for(var n in e)l(o,n,{get:e[n],enumerable:!0})},k=(o,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of T(e))!f.call(o,s)&&s!==n&&l(o,s,{get:()=>e[s],enumerable:!(i=m(e,s))||i.enumerable});return o};var P=o=>k(l({},"__esModule",{value:!0}),o);var U={};E(U,{OpenKey:()=>c,default:()=>I,getOpenKey:()=>O});module.exports=P(U);var w="https://openkey.so";var c=class{host;appName;usePopup;popup=null;iframe=null;constructor(e={}){this.host=e.host||w,this.appName=e.appName||window.location.hostname,this.usePopup=e.usePopup??!0}async connect(){return this.openFlow("connect",{type:"openkey:auth:request",appName:this.appName})}async signMessage(e){return this.openFlow("sign",{type:"openkey:sign:request",message:e.message,keyId:e.keyId})}async signTypedData(e){return this.openFlow("sign-typed-data",{type:"openkey:signTypedData:request",data:e})}async isConnected(){try{let e=await fetch(`${this.host}/api/auth/session`,{credentials:"include"});return e.ok?!!(await e.json()).user:!1}catch{return!1}}async openFlow(e,n){return new Promise((i,s)=>{let a=`${this.host}/widget/${e}?origin=${encodeURIComponent(window.location.origin)}`;this.usePopup?this.openPopup(a,n,i,s):this.openIframe(a,n,i,s)})}openPopup(e,n,i,s){let a=window.screenX+(window.outerWidth-400)/2,u=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(e,"openkey",`width=400,height=600,left=${a},top=${u},popup=true`),!this.popup){s({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups for this site."});return}let p=()=>{window.removeEventListener("message",d),clearInterval(g),clearTimeout(y)},g=setInterval(()=>{this.popup?.closed&&(p(),s({code:"USER_CANCELLED",message:"User closed the popup"}))},500),y=setTimeout(()=>{p(),this.popup?.close(),s({code:"TIMEOUT",message:"Request timed out"})},3e5),d=t=>{if(t.origin!==this.host)return;let r=t.data;if(r.type==="openkey:ready"){this.popup?.postMessage(n,this.host);return}if(r.type==="openkey:close"){p(),this.popup?.close(),s({code:"USER_CANCELLED",message:"User cancelled the request"});return}(r.type==="openkey:auth:response"||r.type==="openkey:sign:response"||r.type==="openkey:signTypedData:response")&&(p(),this.popup?.close(),r.success?r.type==="openkey:auth:response"?i({address:r.address,keyId:r.keyId}):i({signature:r.signature,address:r.address}):s(r.error))};window.addEventListener("message",d)}openIframe(e,n,i,s){let a=document.createElement("div");a.style.cssText=`
+"use strict";var y=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var O=Object.getOwnPropertyNames;var U=Object.prototype.hasOwnProperty;var k=(o,e)=>{for(var s in e)y(o,s,{get:e[s],enumerable:!0})},I=(o,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of O(e))!U.call(o,r)&&r!==s&&y(o,r,{get:()=>e[r],enumerable:!(n=E(e,r))||n.enumerable});return o};var _=o=>I(y({},"__esModule",{value:!0}),o);var L={};k(L,{OpenKey:()=>l,default:()=>C,getOpenKey:()=>D});module.exports=_(L);var A="https://openkey.so";var h="openkey_oauth";function f(o){return btoa(String.fromCharCode(...o)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function v(){let o=new Uint8Array(32);return crypto.getRandomValues(o),f(o)}async function R(o){let s=new TextEncoder().encode(o),n=await crypto.subtle.digest("SHA-256",s);return f(new Uint8Array(n))}function S(){let o=new Uint8Array(16);return crypto.getRandomValues(o),f(o)}var l=class{host;appName;usePopup;popup=null;iframe=null;constructor(e={}){this.host=e.host||A,this.appName=e.appName||window.location.hostname,this.usePopup=e.usePopup??!0}async connect(){return this.openFlow("connect",{type:"openkey:auth:request",appName:this.appName})}async signMessage(e){return this.openFlow("sign",{type:"openkey:sign:request",message:e.message,keyId:e.keyId})}async signTypedData(e){return this.openFlow("sign-typed-data",{type:"openkey:signTypedData:request",data:e})}async isConnected(){try{let e=await fetch(`${this.host}/api/auth/session`,{credentials:"include"});return e.ok?!!(await e.json()).user:!1}catch{return!1}}oauth={connect:async e=>{let s=await v(),n=await R(s),r=e.state||S();sessionStorage.setItem(h,JSON.stringify({verifier:s,state:r}));let t=new URL(`${this.host}/api/auth/oauth2/authorize`);return t.searchParams.set("client_id",e.clientId),t.searchParams.set("redirect_uri",e.redirectUri),t.searchParams.set("response_type","code"),t.searchParams.set("scope","openid"),t.searchParams.set("state",r),t.searchParams.set("code_challenge",n),t.searchParams.set("code_challenge_method","S256"),this.openOAuthFlow(t.toString(),r,e.redirectUri)},exchangeCode:async(e,s)=>{let n=sessionStorage.getItem(h);if(!n)throw new Error("No PKCE verifier found. Start a new OAuth flow.");let{verifier:r}=JSON.parse(n),t=await fetch(`${this.host}/api/auth/oauth2/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e,redirect_uri:s.redirectUri,client_id:s.clientId,code_verifier:r})});if(sessionStorage.removeItem(h),!t.ok){let d=await t.json();throw new Error(d.error_description||"Token exchange failed")}return t.json()},verifyState:e=>{let s=sessionStorage.getItem(h);if(!s)return!1;let{state:n}=JSON.parse(s);return n===e},parseCallback:e=>{let s=new URL(e||window.location.href),n=s.searchParams.get("error");if(n)return{error:n,errorDescription:s.searchParams.get("error_description")||void 0};let r=s.searchParams.get("code"),t=s.searchParams.get("state");return!r||!t?{error:"missing_params",errorDescription:"Missing code or state parameter"}:{code:r,state:t}}};openOAuthFlow(e,s,n){return new Promise((r,t)=>{this.usePopup?this.openOAuthPopup(e,s,n,r,t):window.location.href=e})}openOAuthPopup(e,s,n,r,t){let d=window.screenX+(window.outerWidth-400)/2,p=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(e,"openkey-oauth",`width=400,height=600,left=${d},top=${p},popup=true`),!this.popup){t({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups or use redirect mode."});return}let g=new URL(n).origin,u=setInterval(()=>{try{if(this.popup?.closed){clearInterval(u),clearTimeout(c),t({code:"USER_CANCELLED",message:"User closed the popup"});return}let i=this.popup?.location?.href;if(i&&i.startsWith(g)){clearInterval(u),clearTimeout(c);let a=new URL(i),P=a.searchParams.get("code"),T=a.searchParams.get("state"),w=a.searchParams.get("error");if(this.popup?.close(),w){t({code:"UNAUTHORIZED",message:a.searchParams.get("error_description")||w});return}if(T!==s){t({code:"STATE_MISMATCH",message:"State mismatch - possible CSRF attack"});return}P?r({code:P,state:T}):t({code:"UNAUTHORIZED",message:"Authorization failed - no code returned"})}}catch{}},100),c=setTimeout(()=>{clearInterval(u),this.popup?.close(),t({code:"TIMEOUT",message:"OAuth flow timed out"})},3e5)}async openFlow(e,s){return new Promise((n,r)=>{let t=`${this.host}/widget/${e}?origin=${encodeURIComponent(window.location.origin)}`;this.usePopup?this.openPopup(t,s,n,r):this.openIframe(t,s,n,r)})}openPopup(e,s,n,r){let t=window.screenX+(window.outerWidth-400)/2,d=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(e,"openkey",`width=400,height=600,left=${t},top=${d},popup=true`),!this.popup){r({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups for this site."});return}let p=()=>{window.removeEventListener("message",c),clearInterval(g),clearTimeout(u)},g=setInterval(()=>{this.popup?.closed&&(p(),r({code:"USER_CANCELLED",message:"User closed the popup"}))},500),u=setTimeout(()=>{p(),this.popup?.close(),r({code:"TIMEOUT",message:"Request timed out"})},3e5),c=i=>{if(i.origin!==this.host)return;let a=i.data;if(a.type==="openkey:ready"){this.popup?.postMessage(s,this.host);return}if(a.type==="openkey:close"){p(),this.popup?.close(),r({code:"USER_CANCELLED",message:"User cancelled the request"});return}(a.type==="openkey:auth:response"||a.type==="openkey:sign:response"||a.type==="openkey:signTypedData:response")&&(p(),this.popup?.close(),a.success?a.type==="openkey:auth:response"?n({address:a.address,keyId:a.keyId}):n({signature:a.signature,address:a.address}):r(a.error))};window.addEventListener("message",c)}openIframe(e,s,n,r){let t=document.createElement("div");t.style.cssText=`
       position: fixed;
       inset: 0;
       background: rgba(0, 0, 0, 0.5);
@@ -6,7 +6,7 @@
       align-items: center;
       justify-content: center;
       z-index: 999999;
-    `;let u=document.createElement("div");u.style.cssText=`
+    `;let d=document.createElement("div");d.style.cssText=`
       width: 400px;
       height: 600px;
       background: #1a1a1a;
@@ -17,5 +17,5 @@
       width: 100%;
       height: 100%;
       border: none;
-    `,u.appendChild(this.iframe),a.appendChild(u),document.body.appendChild(a);let p=()=>{window.removeEventListener("message",y),clearTimeout(g),a.remove(),this.iframe=null};a.addEventListener("click",d=>{d.target===a&&(p(),s({code:"USER_CANCELLED",message:"User cancelled the request"}))});let g=setTimeout(()=>{p(),s({code:"TIMEOUT",message:"Request timed out"})},3e5),y=d=>{if(d.origin!==this.host)return;let t=d.data;if(t.type==="openkey:ready"){this.iframe?.contentWindow?.postMessage(n,this.host);return}if(t.type==="openkey:close"){p(),s({code:"USER_CANCELLED",message:"User cancelled the request"});return}(t.type==="openkey:auth:response"||t.type==="openkey:sign:response"||t.type==="openkey:signTypedData:response")&&(p(),t.success?t.type==="openkey:auth:response"?i({address:t.address,keyId:t.keyId}):i({signature:t.signature,address:t.address}):s(t.error))};window.addEventListener("message",y)}disconnect(){this.popup?.close(),this.popup=null,this.iframe?.parentElement?.parentElement?.remove(),this.iframe=null}},I=c,h=null;function O(o){return(!h||o)&&(h=new c(o)),h}0&&(module.exports={OpenKey,getOpenKey});
+    `,d.appendChild(this.iframe),t.appendChild(d),document.body.appendChild(t);let p=()=>{window.removeEventListener("message",u),clearTimeout(g),t.remove(),this.iframe=null};t.addEventListener("click",c=>{c.target===t&&(p(),r({code:"USER_CANCELLED",message:"User cancelled the request"}))});let g=setTimeout(()=>{p(),r({code:"TIMEOUT",message:"Request timed out"})},3e5),u=c=>{if(c.origin!==this.host)return;let i=c.data;if(i.type==="openkey:ready"){this.iframe?.contentWindow?.postMessage(s,this.host);return}if(i.type==="openkey:close"){p(),r({code:"USER_CANCELLED",message:"User cancelled the request"});return}(i.type==="openkey:auth:response"||i.type==="openkey:sign:response"||i.type==="openkey:signTypedData:response")&&(p(),i.success?i.type==="openkey:auth:response"?n({address:i.address,keyId:i.keyId}):n({signature:i.signature,address:i.address}):r(i.error))};window.addEventListener("message",u)}disconnect(){this.popup?.close(),this.popup=null,this.iframe?.parentElement?.parentElement?.remove(),this.iframe=null}},C=l,m=null;function D(o){return(!m||o)&&(m=new l(o)),m}0&&(module.exports={OpenKey,getOpenKey});
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// OpenKey SDK - Browser client for third-party apps\n// Provides \"Sign with OpenKey\" functionality via popup or iframe\n\nexport interface OpenKeyConfig {\n  /** OpenKey host URL (default: https://openkey.so) */\n  host?: string;\n  /** App identifier for display */\n  appName?: string;\n  /** Use popup instead of iframe (default: true) */\n  usePopup?: boolean;\n}\n\nexport interface SignMessageRequest {\n  message: string;\n  keyId?: string; // If not provided, user selects\n}\n\nexport interface SignTypedDataRequest {\n  domain: {\n    name?: string;\n    version?: string;\n    chainId?: number;\n    verifyingContract?: string;\n  };\n  types: Record<string, Array<{ name: string; type: string }>>;\n  primaryType: string;\n  message: Record<string, unknown>;\n  keyId?: string;\n}\n\nexport interface SignResult {\n  signature: string;\n  address: string;\n}\n\nexport interface AuthResult {\n  address: string;\n  keyId: string;\n}\n\nexport interface OpenKeyError {\n  code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN';\n  message: string;\n}\n\ntype MessageType =\n  | { type: 'openkey:auth:request'; appName: string }\n  | { type: 'openkey:auth:response'; success: true; address: string; keyId: string }\n  | { type: 'openkey:auth:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:sign:request'; message: string; keyId?: string }\n  | { type: 'openkey:sign:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:sign:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:signTypedData:request'; data: SignTypedDataRequest }\n  | { type: 'openkey:signTypedData:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:signTypedData:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:ready' }\n  | { type: 'openkey:close' };\n\nconst DEFAULT_HOST = 'https://openkey.so';\nconst POPUP_WIDTH = 400;\nconst POPUP_HEIGHT = 600;\nconst DEFAULT_TIMEOUT = 5 * 60 * 1000; // 5 minutes\n\nexport class OpenKey {\n  private host: string;\n  private appName: string;\n  private usePopup: boolean;\n  private popup: Window | null = null;\n  private iframe: HTMLIFrameElement | null = null;\n\n  constructor(config: OpenKeyConfig = {}) {\n    this.host = config.host || DEFAULT_HOST;\n    this.appName = config.appName || window.location.hostname;\n    this.usePopup = config.usePopup ?? true;\n  }\n\n  /**\n   * Connect to OpenKey and get user's wallet address\n   * Opens auth flow for user to select/create a key\n   */\n  async connect(): Promise<AuthResult> {\n    return this.openFlow<AuthResult>('connect', {\n      type: 'openkey:auth:request',\n      appName: this.appName,\n    });\n  }\n\n  /**\n   * Sign a message with the user's OpenKey wallet\n   */\n  async signMessage(request: SignMessageRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign', {\n      type: 'openkey:sign:request',\n      message: request.message,\n      keyId: request.keyId,\n    });\n  }\n\n  /**\n   * Sign typed data (EIP-712) with the user's OpenKey wallet\n   */\n  async signTypedData(request: SignTypedDataRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign-typed-data', {\n      type: 'openkey:signTypedData:request',\n      data: request,\n    });\n  }\n\n  /**\n   * Check if user is already authenticated\n   */\n  async isConnected(): Promise<boolean> {\n    // Check for existing session via API\n    try {\n      const res = await fetch(`${this.host}/api/auth/session`, {\n        credentials: 'include',\n      });\n      if (!res.ok) return false;\n      const data = await res.json();\n      return !!data.user;\n    } catch {\n      return false;\n    }\n  }\n\n  private async openFlow<T>(action: string, message: object): Promise<T> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.host}/widget/${action}?origin=${encodeURIComponent(window.location.origin)}`;\n\n      if (this.usePopup) {\n        this.openPopup(url, message, resolve, reject);\n      } else {\n        this.openIframe(url, message, resolve, reject);\n      }\n    });\n  }\n\n  private openPopup<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Calculate popup position\n    const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;\n    const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;\n\n    this.popup = window.open(\n      url,\n      'openkey',\n      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`\n    );\n\n    if (!this.popup) {\n      reject({\n        code: 'POPUP_BLOCKED',\n        message: 'Popup was blocked. Please allow popups for this site.',\n      });\n      return;\n    }\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearInterval(pollClosed);\n      clearTimeout(timeout);\n    };\n\n    // Poll to detect popup close\n    const pollClosed = setInterval(() => {\n      if (this.popup?.closed) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User closed the popup',\n        });\n      }\n    }, 500);\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      this.popup?.close();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        // Widget is ready, send our request\n        this.popup?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        this.popup?.close();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n        this.popup?.close();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  private openIframe<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Create overlay\n    const overlay = document.createElement('div');\n    overlay.style.cssText = `\n      position: fixed;\n      inset: 0;\n      background: rgba(0, 0, 0, 0.5);\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      z-index: 999999;\n    `;\n\n    // Create iframe container\n    const container = document.createElement('div');\n    container.style.cssText = `\n      width: ${POPUP_WIDTH}px;\n      height: ${POPUP_HEIGHT}px;\n      background: #1a1a1a;\n      border-radius: 12px;\n      overflow: hidden;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n    `;\n\n    // Create iframe\n    this.iframe = document.createElement('iframe');\n    this.iframe.src = url;\n    this.iframe.style.cssText = `\n      width: 100%;\n      height: 100%;\n      border: none;\n    `;\n\n    container.appendChild(this.iframe);\n    overlay.appendChild(container);\n    document.body.appendChild(overlay);\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearTimeout(timeout);\n      overlay.remove();\n      this.iframe = null;\n    };\n\n    // Close on overlay click\n    overlay.addEventListener('click', (e) => {\n      if (e.target === overlay) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n      }\n    });\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        this.iframe?.contentWindow?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  /**\n   * Disconnect and close any open flows\n   */\n  disconnect() {\n    this.popup?.close();\n    this.popup = null;\n    this.iframe?.parentElement?.parentElement?.remove();\n    this.iframe = null;\n  }\n}\n\n// Default export for convenience\nexport default OpenKey;\n\n// Create singleton instance\nlet defaultInstance: OpenKey | null = null;\n\nexport function getOpenKey(config?: OpenKeyConfig): OpenKey {\n  if (!defaultInstance || config) {\n    defaultInstance = new OpenKey(config);\n  }\n  return defaultInstance;\n}\n"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,aAAAE,EAAA,YAAAC,EAAA,eAAAC,IAAA,eAAAC,EAAAL,GA0DA,IAAMM,EAAe,qBAKd,IAAMC,EAAN,KAAc,CACX,KACA,QACA,SACA,MAAuB,KACvB,OAAmC,KAE3C,YAAYC,EAAwB,CAAC,EAAG,CACtC,KAAK,KAAOA,EAAO,MAAQC,EAC3B,KAAK,QAAUD,EAAO,SAAW,OAAO,SAAS,SACjD,KAAK,SAAWA,EAAO,UAAY,EACrC,CAMA,MAAM,SAA+B,CACnC,OAAO,KAAK,SAAqB,UAAW,CAC1C,KAAM,uBACN,QAAS,KAAK,OAChB,CAAC,CACH,CAKA,MAAM,YAAYE,EAAkD,CAClE,OAAO,KAAK,SAAqB,OAAQ,CACvC,KAAM,uBACN,QAASA,EAAQ,QACjB,MAAOA,EAAQ,KACjB,CAAC,CACH,CAKA,MAAM,cAAcA,EAAoD,CACtE,OAAO,KAAK,SAAqB,kBAAmB,CAClD,KAAM,gCACN,KAAMA,CACR,CAAC,CACH,CAKA,MAAM,aAAgC,CAEpC,GAAI,CACF,IAAMC,EAAM,MAAM,MAAM,GAAG,KAAK,IAAI,oBAAqB,CACvD,YAAa,SACf,CAAC,EACD,OAAKA,EAAI,GAEF,CAAC,EADK,MAAMA,EAAI,KAAK,GACd,KAFM,EAGtB,MAAQ,CACN,MAAO,EACT,CACF,CAEA,MAAc,SAAYC,EAAgBC,EAA6B,CACrE,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACtC,IAAMC,EAAM,GAAG,KAAK,IAAI,WAAWJ,CAAM,WAAW,mBAAmB,OAAO,SAAS,MAAM,CAAC,GAE1F,KAAK,SACP,KAAK,UAAUI,EAAKH,EAASC,EAASC,CAAM,EAE5C,KAAK,WAAWC,EAAKH,EAASC,EAASC,CAAM,CAEjD,CAAC,CACH,CAEQ,UACNC,EACAH,EACAC,EACAC,EACA,CAEA,IAAME,EAAO,OAAO,SAAW,OAAO,WAAa,KAAe,EAC5DC,EAAM,OAAO,SAAW,OAAO,YAAc,KAAgB,EAQnE,GANA,KAAK,MAAQ,OAAO,KAClBF,EACA,UACA,6BAAoDC,CAAI,QAAQC,CAAG,aACrE,EAEI,CAAC,KAAK,MAAO,CACfH,EAAO,CACL,KAAM,gBACN,QAAS,uDACX,CAAC,EACD,MACF,CAEA,IAAMI,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,cAAcC,CAAU,EACxB,aAAaC,CAAO,CACtB,EAGMD,EAAa,YAAY,IAAM,CAC/B,KAAK,OAAO,SACdF,EAAQ,EACRJ,EAAO,CACL,KAAM,iBACN,QAAS,uBACX,CAAC,EAEL,EAAG,GAAG,EAGAO,EAAU,WAAW,IAAM,CAC/BH,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBJ,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZK,EAAiBG,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMC,EAAOD,EAAM,KAEnB,GAAIC,EAAK,OAAS,gBAAiB,CAEjC,KAAK,OAAO,YAAYX,EAAS,KAAK,IAAI,EAC1C,MACF,CAEA,GAAIW,EAAK,OAAS,gBAAiB,CACjCL,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBJ,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIES,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEdL,EAAQ,EACR,KAAK,OAAO,MAAM,EAEdK,EAAK,QACHA,EAAK,OAAS,wBAChBV,EAAQ,CAAE,QAASU,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDV,EAAQ,CAAE,UAAWU,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnET,EAAOS,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAWJ,CAAa,CAClD,CAEQ,WACNJ,EACAH,EACAC,EACAC,EACA,CAEA,IAAMU,EAAU,SAAS,cAAc,KAAK,EAC5CA,EAAQ,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWxB,IAAMC,EAAY,SAAS,cAAc,KAAK,EAC9CA,EAAU,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAU1B,KAAK,OAAS,SAAS,cAAc,QAAQ,EAC7C,KAAK,OAAO,IAAMV,EAClB,KAAK,OAAO,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA,MAM5BU,EAAU,YAAY,KAAK,MAAM,EACjCD,EAAQ,YAAYC,CAAS,EAC7B,SAAS,KAAK,YAAYD,CAAO,EAEjC,IAAMN,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,aAAaE,CAAO,EACpBG,EAAQ,OAAO,EACf,KAAK,OAAS,IAChB,EAGAA,EAAQ,iBAAiB,QAAUE,GAAM,CACnCA,EAAE,SAAWF,IACfN,EAAQ,EACRJ,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EAEL,CAAC,EAGD,IAAMO,EAAU,WAAW,IAAM,CAC/BH,EAAQ,EACRJ,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZK,EAAiBG,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMC,EAAOD,EAAM,KAEnB,GAAIC,EAAK,OAAS,gBAAiB,CACjC,KAAK,QAAQ,eAAe,YAAYX,EAAS,KAAK,IAAI,EAC1D,MACF,CAEA,GAAIW,EAAK,OAAS,gBAAiB,CACjCL,EAAQ,EACRJ,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIES,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEdL,EAAQ,EAEJK,EAAK,QACHA,EAAK,OAAS,wBAChBV,EAAQ,CAAE,QAASU,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDV,EAAQ,CAAE,UAAWU,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnET,EAAOS,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAWJ,CAAa,CAClD,CAKA,YAAa,CACX,KAAK,OAAO,MAAM,EAClB,KAAK,MAAQ,KACb,KAAK,QAAQ,eAAe,eAAe,OAAO,EAClD,KAAK,OAAS,IAChB,CACF,EAGOQ,EAAQrB,EAGXsB,EAAkC,KAE/B,SAASC,EAAWtB,EAAiC,CAC1D,OAAI,CAACqB,GAAmBrB,KACtBqB,EAAkB,IAAItB,EAAQC,CAAM,GAE/BqB,CACT","names":["index_exports","__export","OpenKey","index_default","getOpenKey","__toCommonJS","DEFAULT_HOST","OpenKey","config","DEFAULT_HOST","request","res","action","message","resolve","reject","url","left","top","cleanup","handleMessage","pollClosed","timeout","event","data","overlay","container","e","index_default","defaultInstance","getOpenKey"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// OpenKey SDK - Browser client for third-party apps\n// Provides \"Sign with OpenKey\" functionality via popup or iframe\n\nexport interface OpenKeyConfig {\n  /** OpenKey host URL (default: https://openkey.so) */\n  host?: string;\n  /** App identifier for display */\n  appName?: string;\n  /** Use popup instead of iframe (default: true) */\n  usePopup?: boolean;\n}\n\nexport interface SignMessageRequest {\n  message: string;\n  keyId?: string; // If not provided, user selects\n}\n\nexport interface SignTypedDataRequest {\n  domain: {\n    name?: string;\n    version?: string;\n    chainId?: number;\n    verifyingContract?: string;\n  };\n  types: Record<string, Array<{ name: string; type: string }>>;\n  primaryType: string;\n  message: Record<string, unknown>;\n  keyId?: string;\n}\n\nexport interface SignResult {\n  signature: string;\n  address: string;\n}\n\nexport interface AuthResult {\n  address: string;\n  keyId: string;\n}\n\nexport interface OpenKeyError {\n  code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';\n  message: string;\n}\n\n// ======= OAuth 2.1 Types =======\n\n/** OAuth configuration for third-party apps */\nexport interface OAuthConfig {\n  /** OAuth client_id (registered with OpenKey) */\n  clientId: string;\n  /** Redirect URI (must match registered URI) */\n  redirectUri: string;\n  /** State parameter for CSRF protection (auto-generated if not provided) */\n  state?: string;\n}\n\n/** Result from OAuth authorization */\nexport interface OAuthResult {\n  /** Authorization code (exchange for tokens) */\n  code: string;\n  /** State parameter (verify matches request) */\n  state: string;\n}\n\n/** Response from token exchange */\nexport interface OAuthTokenResponse {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  id_token: string;\n  scope: string;\n  refresh_token?: string;\n}\n\ntype MessageType =\n  | { type: 'openkey:auth:request'; appName: string }\n  | { type: 'openkey:auth:response'; success: true; address: string; keyId: string }\n  | { type: 'openkey:auth:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:sign:request'; message: string; keyId?: string }\n  | { type: 'openkey:sign:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:sign:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:signTypedData:request'; data: SignTypedDataRequest }\n  | { type: 'openkey:signTypedData:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:signTypedData:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:ready' }\n  | { type: 'openkey:close' };\n\nconst DEFAULT_HOST = 'https://openkey.so';\nconst POPUP_WIDTH = 400;\nconst POPUP_HEIGHT = 600;\nconst DEFAULT_TIMEOUT = 5 * 60 * 1000; // 5 minutes\nconst OAUTH_STORAGE_KEY = 'openkey_oauth';\n\n// ======= PKCE Utilities =======\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n  const base64 = btoa(String.fromCharCode(...buffer));\n  return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(16);\n  crypto.getRandomValues(array);\n  return base64UrlEncode(array);\n}\n\nexport class OpenKey {\n  private host: string;\n  private appName: string;\n  private usePopup: boolean;\n  private popup: Window | null = null;\n  private iframe: HTMLIFrameElement | null = null;\n\n  constructor(config: OpenKeyConfig = {}) {\n    this.host = config.host || DEFAULT_HOST;\n    this.appName = config.appName || window.location.hostname;\n    this.usePopup = config.usePopup ?? true;\n  }\n\n  /**\n   * Connect to OpenKey and get user's wallet address\n   * Opens auth flow for user to select/create a key\n   */\n  async connect(): Promise<AuthResult> {\n    return this.openFlow<AuthResult>('connect', {\n      type: 'openkey:auth:request',\n      appName: this.appName,\n    });\n  }\n\n  /**\n   * Sign a message with the user's OpenKey wallet\n   */\n  async signMessage(request: SignMessageRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign', {\n      type: 'openkey:sign:request',\n      message: request.message,\n      keyId: request.keyId,\n    });\n  }\n\n  /**\n   * Sign typed data (EIP-712) with the user's OpenKey wallet\n   */\n  async signTypedData(request: SignTypedDataRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign-typed-data', {\n      type: 'openkey:signTypedData:request',\n      data: request,\n    });\n  }\n\n  /**\n   * Check if user is already authenticated\n   */\n  async isConnected(): Promise<boolean> {\n    // Check for existing session via API\n    try {\n      const res = await fetch(`${this.host}/api/auth/session`, {\n        credentials: 'include',\n      });\n      if (!res.ok) return false;\n      const data = await res.json();\n      return !!data.user;\n    } catch {\n      return false;\n    }\n  }\n\n  // ======= OAuth 2.1 Provider Methods =======\n\n  /**\n   * OAuth 2.1 methods for third-party app authentication\n   * Use this when your app has registered OAuth client credentials with OpenKey\n   */\n  oauth = {\n    /**\n     * Start OAuth authorization flow\n     * Opens popup/redirect to OpenKey authorization endpoint\n     * @returns Promise that resolves with authorization code after user consent\n     */\n    connect: async (config: OAuthConfig): Promise<OAuthResult> => {\n      // Generate PKCE values\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n      const state = config.state || generateState();\n\n      // Store for later token exchange\n      sessionStorage.setItem(\n        OAUTH_STORAGE_KEY,\n        JSON.stringify({ verifier, state })\n      );\n\n      // Build authorization URL\n      const authUrl = new URL(`${this.host}/api/auth/oauth2/authorize`);\n      authUrl.searchParams.set('client_id', config.clientId);\n      authUrl.searchParams.set('redirect_uri', config.redirectUri);\n      authUrl.searchParams.set('response_type', 'code');\n      authUrl.searchParams.set('scope', 'openid');\n      authUrl.searchParams.set('state', state);\n      authUrl.searchParams.set('code_challenge', challenge);\n      authUrl.searchParams.set('code_challenge_method', 'S256');\n\n      return this.openOAuthFlow(authUrl.toString(), state, config.redirectUri);\n    },\n\n    /**\n     * Exchange authorization code for tokens\n     * Call this after receiving the callback with authorization code\n     * @param code - Authorization code from callback URL\n     * @param config - Same config used for connect()\n     * @returns Promise that resolves with access_token, id_token, etc.\n     */\n    exchangeCode: async (\n      code: string,\n      config: OAuthConfig\n    ): Promise<OAuthTokenResponse> => {\n      const stored = sessionStorage.getItem(OAUTH_STORAGE_KEY);\n      if (!stored) {\n        throw new Error('No PKCE verifier found. Start a new OAuth flow.');\n      }\n\n      const { verifier } = JSON.parse(stored);\n\n      const response = await fetch(`${this.host}/api/auth/oauth2/token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'authorization_code',\n          code,\n          redirect_uri: config.redirectUri,\n          client_id: config.clientId,\n          code_verifier: verifier,\n        }),\n      });\n\n      // Clear stored verifier\n      sessionStorage.removeItem(OAUTH_STORAGE_KEY);\n\n      if (!response.ok) {\n        const error = await response.json();\n        throw new Error(error.error_description || 'Token exchange failed');\n      }\n\n      return response.json();\n    },\n\n    /**\n     * Verify state parameter from callback\n     * Call this before exchangeCode to prevent CSRF attacks\n     * @param receivedState - State parameter from callback URL\n     * @returns true if state matches, false otherwise\n     */\n    verifyState: (receivedState: string): boolean => {\n      const stored = sessionStorage.getItem(OAUTH_STORAGE_KEY);\n      if (!stored) return false;\n      const { state } = JSON.parse(stored);\n      return state === receivedState;\n    },\n\n    /**\n     * Parse authorization response from callback URL\n     * @param url - Callback URL (defaults to current window.location.href)\n     * @returns Parsed code and state, or error\n     */\n    parseCallback: (\n      url?: string\n    ): { code: string; state: string } | { error: string; errorDescription?: string } => {\n      const urlObj = new URL(url || window.location.href);\n      const error = urlObj.searchParams.get('error');\n\n      if (error) {\n        return {\n          error,\n          errorDescription: urlObj.searchParams.get('error_description') || undefined,\n        };\n      }\n\n      const code = urlObj.searchParams.get('code');\n      const state = urlObj.searchParams.get('state');\n\n      if (!code || !state) {\n        return { error: 'missing_params', errorDescription: 'Missing code or state parameter' };\n      }\n\n      return { code, state };\n    },\n  };\n\n  private openOAuthFlow(\n    url: string,\n    state: string,\n    redirectUri: string\n  ): Promise<OAuthResult> {\n    return new Promise((resolve, reject) => {\n      if (this.usePopup) {\n        this.openOAuthPopup(url, state, redirectUri, resolve, reject);\n      } else {\n        // Full page redirect - won't resolve, page navigates away\n        window.location.href = url;\n      }\n    });\n  }\n\n  private openOAuthPopup(\n    url: string,\n    state: string,\n    redirectUri: string,\n    resolve: (value: OAuthResult) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;\n    const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;\n\n    this.popup = window.open(\n      url,\n      'openkey-oauth',\n      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`\n    );\n\n    if (!this.popup) {\n      reject({\n        code: 'POPUP_BLOCKED',\n        message: 'Popup was blocked. Please allow popups or use redirect mode.',\n      });\n      return;\n    }\n\n    const redirectHost = new URL(redirectUri).origin;\n\n    // Poll for redirect back with code\n    const pollInterval = setInterval(() => {\n      try {\n        if (this.popup?.closed) {\n          clearInterval(pollInterval);\n          clearTimeout(timeout);\n          reject({\n            code: 'USER_CANCELLED',\n            message: 'User closed the popup',\n          });\n          return;\n        }\n\n        // Check if redirected to callback URL\n        const popupUrl = this.popup?.location?.href;\n        if (popupUrl && popupUrl.startsWith(redirectHost)) {\n          clearInterval(pollInterval);\n          clearTimeout(timeout);\n\n          const urlObj = new URL(popupUrl);\n          const code = urlObj.searchParams.get('code');\n          const returnedState = urlObj.searchParams.get('state');\n          const error = urlObj.searchParams.get('error');\n\n          this.popup?.close();\n\n          if (error) {\n            reject({\n              code: 'UNAUTHORIZED',\n              message: urlObj.searchParams.get('error_description') || error,\n            });\n            return;\n          }\n\n          if (returnedState !== state) {\n            reject({\n              code: 'STATE_MISMATCH',\n              message: 'State mismatch - possible CSRF attack',\n            });\n            return;\n          }\n\n          if (code) {\n            resolve({ code, state: returnedState });\n          } else {\n            reject({\n              code: 'UNAUTHORIZED',\n              message: 'Authorization failed - no code returned',\n            });\n          }\n        }\n      } catch {\n        // Cross-origin - popup still on OpenKey domain, continue polling\n      }\n    }, 100);\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      clearInterval(pollInterval);\n      this.popup?.close();\n      reject({\n        code: 'TIMEOUT',\n        message: 'OAuth flow timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n  }\n\n  private async openFlow<T>(action: string, message: object): Promise<T> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.host}/widget/${action}?origin=${encodeURIComponent(window.location.origin)}`;\n\n      if (this.usePopup) {\n        this.openPopup(url, message, resolve, reject);\n      } else {\n        this.openIframe(url, message, resolve, reject);\n      }\n    });\n  }\n\n  private openPopup<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Calculate popup position\n    const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;\n    const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;\n\n    this.popup = window.open(\n      url,\n      'openkey',\n      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`\n    );\n\n    if (!this.popup) {\n      reject({\n        code: 'POPUP_BLOCKED',\n        message: 'Popup was blocked. Please allow popups for this site.',\n      });\n      return;\n    }\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearInterval(pollClosed);\n      clearTimeout(timeout);\n    };\n\n    // Poll to detect popup close\n    const pollClosed = setInterval(() => {\n      if (this.popup?.closed) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User closed the popup',\n        });\n      }\n    }, 500);\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      this.popup?.close();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        // Widget is ready, send our request\n        this.popup?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        this.popup?.close();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n        this.popup?.close();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  private openIframe<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Create overlay\n    const overlay = document.createElement('div');\n    overlay.style.cssText = `\n      position: fixed;\n      inset: 0;\n      background: rgba(0, 0, 0, 0.5);\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      z-index: 999999;\n    `;\n\n    // Create iframe container\n    const container = document.createElement('div');\n    container.style.cssText = `\n      width: ${POPUP_WIDTH}px;\n      height: ${POPUP_HEIGHT}px;\n      background: #1a1a1a;\n      border-radius: 12px;\n      overflow: hidden;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n    `;\n\n    // Create iframe\n    this.iframe = document.createElement('iframe');\n    this.iframe.src = url;\n    this.iframe.style.cssText = `\n      width: 100%;\n      height: 100%;\n      border: none;\n    `;\n\n    container.appendChild(this.iframe);\n    overlay.appendChild(container);\n    document.body.appendChild(overlay);\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearTimeout(timeout);\n      overlay.remove();\n      this.iframe = null;\n    };\n\n    // Close on overlay click\n    overlay.addEventListener('click', (e) => {\n      if (e.target === overlay) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n      }\n    });\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        this.iframe?.contentWindow?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  /**\n   * Disconnect and close any open flows\n   */\n  disconnect() {\n    this.popup?.close();\n    this.popup = null;\n    this.iframe?.parentElement?.parentElement?.remove();\n    this.iframe = null;\n  }\n}\n\n// Default export for convenience\nexport default OpenKey;\n\n// Create singleton instance\nlet defaultInstance: OpenKey | null = null;\n\nexport function getOpenKey(config?: OpenKeyConfig): OpenKey {\n  if (!defaultInstance || config) {\n    defaultInstance = new OpenKey(config);\n  }\n  return defaultInstance;\n}\n"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,aAAAE,EAAA,YAAAC,EAAA,eAAAC,IAAA,eAAAC,EAAAL,GAwFA,IAAMM,EAAe,qBAIrB,IAAMC,EAAoB,gBAI1B,SAASC,EAAgBC,EAA4B,CAEnD,OADe,KAAK,OAAO,aAAa,GAAGA,CAAM,CAAC,EACpC,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,KAAM,EAAE,CACxE,CAEA,eAAeC,GAAwC,CACrD,IAAMC,EAAQ,IAAI,WAAW,EAAE,EAC/B,cAAO,gBAAgBA,CAAK,EACrBH,EAAgBG,CAAK,CAC9B,CAEA,eAAeC,EAAsBC,EAAmC,CAEtE,IAAMC,EADU,IAAI,YAAY,EACX,OAAOD,CAAQ,EAC9BE,EAAS,MAAM,OAAO,OAAO,OAAO,UAAWD,CAAI,EACzD,OAAON,EAAgB,IAAI,WAAWO,CAAM,CAAC,CAC/C,CAEA,SAASC,GAAwB,CAC/B,IAAML,EAAQ,IAAI,WAAW,EAAE,EAC/B,cAAO,gBAAgBA,CAAK,EACrBH,EAAgBG,CAAK,CAC9B,CAEO,IAAMM,EAAN,KAAc,CACX,KACA,QACA,SACA,MAAuB,KACvB,OAAmC,KAE3C,YAAYC,EAAwB,CAAC,EAAG,CACtC,KAAK,KAAOA,EAAO,MAAQC,EAC3B,KAAK,QAAUD,EAAO,SAAW,OAAO,SAAS,SACjD,KAAK,SAAWA,EAAO,UAAY,EACrC,CAMA,MAAM,SAA+B,CACnC,OAAO,KAAK,SAAqB,UAAW,CAC1C,KAAM,uBACN,QAAS,KAAK,OAChB,CAAC,CACH,CAKA,MAAM,YAAYE,EAAkD,CAClE,OAAO,KAAK,SAAqB,OAAQ,CACvC,KAAM,uBACN,QAASA,EAAQ,QACjB,MAAOA,EAAQ,KACjB,CAAC,CACH,CAKA,MAAM,cAAcA,EAAoD,CACtE,OAAO,KAAK,SAAqB,kBAAmB,CAClD,KAAM,gCACN,KAAMA,CACR,CAAC,CACH,CAKA,MAAM,aAAgC,CAEpC,GAAI,CACF,IAAMC,EAAM,MAAM,MAAM,GAAG,KAAK,IAAI,oBAAqB,CACvD,YAAa,SACf,CAAC,EACD,OAAKA,EAAI,GAEF,CAAC,EADK,MAAMA,EAAI,KAAK,GACd,KAFM,EAGtB,MAAQ,CACN,MAAO,EACT,CACF,CAQA,MAAQ,CAMN,QAAS,MAAOH,GAA8C,CAE5D,IAAML,EAAW,MAAMH,EAAqB,EACtCY,EAAY,MAAMV,EAAsBC,CAAQ,EAChDU,EAAQL,EAAO,OAASF,EAAc,EAG5C,eAAe,QACbT,EACA,KAAK,UAAU,CAAE,SAAAM,EAAU,MAAAU,CAAM,CAAC,CACpC,EAGA,IAAMC,EAAU,IAAI,IAAI,GAAG,KAAK,IAAI,4BAA4B,EAChE,OAAAA,EAAQ,aAAa,IAAI,YAAaN,EAAO,QAAQ,EACrDM,EAAQ,aAAa,IAAI,eAAgBN,EAAO,WAAW,EAC3DM,EAAQ,aAAa,IAAI,gBAAiB,MAAM,EAChDA,EAAQ,aAAa,IAAI,QAAS,QAAQ,EAC1CA,EAAQ,aAAa,IAAI,QAASD,CAAK,EACvCC,EAAQ,aAAa,IAAI,iBAAkBF,CAAS,EACpDE,EAAQ,aAAa,IAAI,wBAAyB,MAAM,EAEjD,KAAK,cAAcA,EAAQ,SAAS,EAAGD,EAAOL,EAAO,WAAW,CACzE,EASA,aAAc,MACZO,EACAP,IACgC,CAChC,IAAMQ,EAAS,eAAe,QAAQnB,CAAiB,EACvD,GAAI,CAACmB,EACH,MAAM,IAAI,MAAM,iDAAiD,EAGnE,GAAM,CAAE,SAAAb,CAAS,EAAI,KAAK,MAAMa,CAAM,EAEhCC,EAAW,MAAM,MAAM,GAAG,KAAK,IAAI,yBAA0B,CACjE,OAAQ,OACR,QAAS,CACP,eAAgB,mCAClB,EACA,KAAM,IAAI,gBAAgB,CACxB,WAAY,qBACZ,KAAAF,EACA,aAAcP,EAAO,YACrB,UAAWA,EAAO,SAClB,cAAeL,CACjB,CAAC,CACH,CAAC,EAKD,GAFA,eAAe,WAAWN,CAAiB,EAEvC,CAACoB,EAAS,GAAI,CAChB,IAAMC,EAAQ,MAAMD,EAAS,KAAK,EAClC,MAAM,IAAI,MAAMC,EAAM,mBAAqB,uBAAuB,CACpE,CAEA,OAAOD,EAAS,KAAK,CACvB,EAQA,YAAcE,GAAmC,CAC/C,IAAMH,EAAS,eAAe,QAAQnB,CAAiB,EACvD,GAAI,CAACmB,EAAQ,MAAO,GACpB,GAAM,CAAE,MAAAH,CAAM,EAAI,KAAK,MAAMG,CAAM,EACnC,OAAOH,IAAUM,CACnB,EAOA,cACEC,GACmF,CACnF,IAAMC,EAAS,IAAI,IAAID,GAAO,OAAO,SAAS,IAAI,EAC5CF,EAAQG,EAAO,aAAa,IAAI,OAAO,EAE7C,GAAIH,EACF,MAAO,CACL,MAAAA,EACA,iBAAkBG,EAAO,aAAa,IAAI,mBAAmB,GAAK,MACpE,EAGF,IAAMN,EAAOM,EAAO,aAAa,IAAI,MAAM,EACrCR,EAAQQ,EAAO,aAAa,IAAI,OAAO,EAE7C,MAAI,CAACN,GAAQ,CAACF,EACL,CAAE,MAAO,iBAAkB,iBAAkB,iCAAkC,EAGjF,CAAE,KAAAE,EAAM,MAAAF,CAAM,CACvB,CACF,EAEQ,cACNO,EACAP,EACAS,EACsB,CACtB,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CAClC,KAAK,SACP,KAAK,eAAeJ,EAAKP,EAAOS,EAAaC,EAASC,CAAM,EAG5D,OAAO,SAAS,KAAOJ,CAE3B,CAAC,CACH,CAEQ,eACNA,EACAP,EACAS,EACAC,EACAC,EACA,CACA,IAAMC,EAAO,OAAO,SAAW,OAAO,WAAa,KAAe,EAC5DC,EAAM,OAAO,SAAW,OAAO,YAAc,KAAgB,EAQnE,GANA,KAAK,MAAQ,OAAO,KAClBN,EACA,gBACA,6BAAoDK,CAAI,QAAQC,CAAG,aACrE,EAEI,CAAC,KAAK,MAAO,CACfF,EAAO,CACL,KAAM,gBACN,QAAS,8DACX,CAAC,EACD,MACF,CAEA,IAAMG,EAAe,IAAI,IAAIL,CAAW,EAAE,OAGpCM,EAAe,YAAY,IAAM,CACrC,GAAI,CACF,GAAI,KAAK,OAAO,OAAQ,CACtB,cAAcA,CAAY,EAC1B,aAAaC,CAAO,EACpBL,EAAO,CACL,KAAM,iBACN,QAAS,uBACX,CAAC,EACD,MACF,CAGA,IAAMM,EAAW,KAAK,OAAO,UAAU,KACvC,GAAIA,GAAYA,EAAS,WAAWH,CAAY,EAAG,CACjD,cAAcC,CAAY,EAC1B,aAAaC,CAAO,EAEpB,IAAMR,EAAS,IAAI,IAAIS,CAAQ,EACzBf,EAAOM,EAAO,aAAa,IAAI,MAAM,EACrCU,EAAgBV,EAAO,aAAa,IAAI,OAAO,EAC/CH,EAAQG,EAAO,aAAa,IAAI,OAAO,EAI7C,GAFA,KAAK,OAAO,MAAM,EAEdH,EAAO,CACTM,EAAO,CACL,KAAM,eACN,QAASH,EAAO,aAAa,IAAI,mBAAmB,GAAKH,CAC3D,CAAC,EACD,MACF,CAEA,GAAIa,IAAkBlB,EAAO,CAC3BW,EAAO,CACL,KAAM,iBACN,QAAS,uCACX,CAAC,EACD,MACF,CAEIT,EACFQ,EAAQ,CAAE,KAAAR,EAAM,MAAOgB,CAAc,CAAC,EAEtCP,EAAO,CACL,KAAM,eACN,QAAS,yCACX,CAAC,CAEL,CACF,MAAQ,CAER,CACF,EAAG,GAAG,EAGAK,EAAU,WAAW,IAAM,CAC/B,cAAcD,CAAY,EAC1B,KAAK,OAAO,MAAM,EAClBJ,EAAO,CACL,KAAM,UACN,QAAS,sBACX,CAAC,CACH,EAAG,GAAe,CACpB,CAEA,MAAc,SAAYQ,EAAgBC,EAA6B,CACrE,OAAO,IAAI,QAAQ,CAACV,EAASC,IAAW,CACtC,IAAMJ,EAAM,GAAG,KAAK,IAAI,WAAWY,CAAM,WAAW,mBAAmB,OAAO,SAAS,MAAM,CAAC,GAE1F,KAAK,SACP,KAAK,UAAUZ,EAAKa,EAASV,EAASC,CAAM,EAE5C,KAAK,WAAWJ,EAAKa,EAASV,EAASC,CAAM,CAEjD,CAAC,CACH,CAEQ,UACNJ,EACAa,EACAV,EACAC,EACA,CAEA,IAAMC,EAAO,OAAO,SAAW,OAAO,WAAa,KAAe,EAC5DC,EAAM,OAAO,SAAW,OAAO,YAAc,KAAgB,EAQnE,GANA,KAAK,MAAQ,OAAO,KAClBN,EACA,UACA,6BAAoDK,CAAI,QAAQC,CAAG,aACrE,EAEI,CAAC,KAAK,MAAO,CACfF,EAAO,CACL,KAAM,gBACN,QAAS,uDACX,CAAC,EACD,MACF,CAEA,IAAMU,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,cAAcC,CAAU,EACxB,aAAaP,CAAO,CACtB,EAGMO,EAAa,YAAY,IAAM,CAC/B,KAAK,OAAO,SACdF,EAAQ,EACRV,EAAO,CACL,KAAM,iBACN,QAAS,uBACX,CAAC,EAEL,EAAG,GAAG,EAGAK,EAAU,WAAW,IAAM,CAC/BK,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBV,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZW,EAAiBE,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMjC,EAAOiC,EAAM,KAEnB,GAAIjC,EAAK,OAAS,gBAAiB,CAEjC,KAAK,OAAO,YAAY6B,EAAS,KAAK,IAAI,EAC1C,MACF,CAEA,GAAI7B,EAAK,OAAS,gBAAiB,CACjC8B,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBV,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIEpB,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEd8B,EAAQ,EACR,KAAK,OAAO,MAAM,EAEd9B,EAAK,QACHA,EAAK,OAAS,wBAChBmB,EAAQ,CAAE,QAASnB,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDmB,EAAQ,CAAE,UAAWnB,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnEoB,EAAOpB,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAW+B,CAAa,CAClD,CAEQ,WACNf,EACAa,EACAV,EACAC,EACA,CAEA,IAAMc,EAAU,SAAS,cAAc,KAAK,EAC5CA,EAAQ,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWxB,IAAMC,EAAY,SAAS,cAAc,KAAK,EAC9CA,EAAU,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAU1B,KAAK,OAAS,SAAS,cAAc,QAAQ,EAC7C,KAAK,OAAO,IAAMnB,EAClB,KAAK,OAAO,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA,MAM5BmB,EAAU,YAAY,KAAK,MAAM,EACjCD,EAAQ,YAAYC,CAAS,EAC7B,SAAS,KAAK,YAAYD,CAAO,EAEjC,IAAMJ,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,aAAaN,CAAO,EACpBS,EAAQ,OAAO,EACf,KAAK,OAAS,IAChB,EAGAA,EAAQ,iBAAiB,QAAUE,GAAM,CACnCA,EAAE,SAAWF,IACfJ,EAAQ,EACRV,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EAEL,CAAC,EAGD,IAAMK,EAAU,WAAW,IAAM,CAC/BK,EAAQ,EACRV,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZW,EAAiBE,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMjC,EAAOiC,EAAM,KAEnB,GAAIjC,EAAK,OAAS,gBAAiB,CACjC,KAAK,QAAQ,eAAe,YAAY6B,EAAS,KAAK,IAAI,EAC1D,MACF,CAEA,GAAI7B,EAAK,OAAS,gBAAiB,CACjC8B,EAAQ,EACRV,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIEpB,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEd8B,EAAQ,EAEJ9B,EAAK,QACHA,EAAK,OAAS,wBAChBmB,EAAQ,CAAE,QAASnB,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDmB,EAAQ,CAAE,UAAWnB,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnEoB,EAAOpB,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAW+B,CAAa,CAClD,CAKA,YAAa,CACX,KAAK,OAAO,MAAM,EAClB,KAAK,MAAQ,KACb,KAAK,QAAQ,eAAe,eAAe,OAAO,EAClD,KAAK,OAAS,IAChB,CACF,EAGOM,EAAQlC,EAGXmC,EAAkC,KAE/B,SAASC,EAAWnC,EAAiC,CAC1D,OAAI,CAACkC,GAAmBlC,KACtBkC,EAAkB,IAAInC,EAAQC,CAAM,GAE/BkC,CACT","names":["index_exports","__export","OpenKey","index_default","getOpenKey","__toCommonJS","DEFAULT_HOST","OAUTH_STORAGE_KEY","base64UrlEncode","buffer","generateCodeVerifier","array","generateCodeChallenge","verifier","data","digest","generateState","OpenKey","config","DEFAULT_HOST","request","res","challenge","state","authUrl","code","stored","response","error","receivedState","url","urlObj","redirectUri","resolve","reject","left","top","redirectHost","pollInterval","timeout","popupUrl","returnedState","action","message","cleanup","handleMessage","pollClosed","event","overlay","container","e","index_default","defaultInstance","getOpenKey"]}

package/dist/index.d.cts

@@ -34,9 +34,34 @@ interface AuthResult {
     keyId: string;
 }
 interface OpenKeyError {
-    code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN';
+    code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';
     message: string;
 }
+/** OAuth configuration for third-party apps */
+interface OAuthConfig {
+    /** OAuth client_id (registered with OpenKey) */
+    clientId: string;
+    /** Redirect URI (must match registered URI) */
+    redirectUri: string;
+    /** State parameter for CSRF protection (auto-generated if not provided) */
+    state?: string;
+}
+/** Result from OAuth authorization */
+interface OAuthResult {
+    /** Authorization code (exchange for tokens) */
+    code: string;
+    /** State parameter (verify matches request) */
+    state: string;
+}
+/** Response from token exchange */
+interface OAuthTokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    id_token: string;
+    scope: string;
+    refresh_token?: string;
+}
 declare class OpenKey {
     private host;
     private appName;
@@ -61,6 +86,47 @@ declare class OpenKey {
      * Check if user is already authenticated
      */
     isConnected(): Promise<boolean>;
+    /**
+     * OAuth 2.1 methods for third-party app authentication
+     * Use this when your app has registered OAuth client credentials with OpenKey
+     */
+    oauth: {
+        /**
+         * Start OAuth authorization flow
+         * Opens popup/redirect to OpenKey authorization endpoint
+         * @returns Promise that resolves with authorization code after user consent
+         */
+        connect: (config: OAuthConfig) => Promise<OAuthResult>;
+        /**
+         * Exchange authorization code for tokens
+         * Call this after receiving the callback with authorization code
+         * @param code - Authorization code from callback URL
+         * @param config - Same config used for connect()
+         * @returns Promise that resolves with access_token, id_token, etc.
+         */
+        exchangeCode: (code: string, config: OAuthConfig) => Promise<OAuthTokenResponse>;
+        /**
+         * Verify state parameter from callback
+         * Call this before exchangeCode to prevent CSRF attacks
+         * @param receivedState - State parameter from callback URL
+         * @returns true if state matches, false otherwise
+         */
+        verifyState: (receivedState: string) => boolean;
+        /**
+         * Parse authorization response from callback URL
+         * @param url - Callback URL (defaults to current window.location.href)
+         * @returns Parsed code and state, or error
+         */
+        parseCallback: (url?: string) => {
+            code: string;
+            state: string;
+        } | {
+            error: string;
+            errorDescription?: string;
+        };
+    };
+    private openOAuthFlow;
+    private openOAuthPopup;
     private openFlow;
     private openPopup;
     private openIframe;
@@ -72,4 +138,4 @@ declare class OpenKey {
 
 declare function getOpenKey(config?: OpenKeyConfig): OpenKey;
 
-export { type AuthResult, OpenKey, type OpenKeyConfig, type OpenKeyError, type SignMessageRequest, type SignResult, type SignTypedDataRequest, OpenKey as default, getOpenKey };
+export { type AuthResult, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, type OpenKeyError, type SignMessageRequest, type SignResult, type SignTypedDataRequest, OpenKey as default, getOpenKey };

package/dist/index.d.ts

@@ -34,9 +34,34 @@ interface AuthResult {
     keyId: string;
 }
 interface OpenKeyError {
-    code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN';
+    code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';
     message: string;
 }
+/** OAuth configuration for third-party apps */
+interface OAuthConfig {
+    /** OAuth client_id (registered with OpenKey) */
+    clientId: string;
+    /** Redirect URI (must match registered URI) */
+    redirectUri: string;
+    /** State parameter for CSRF protection (auto-generated if not provided) */
+    state?: string;
+}
+/** Result from OAuth authorization */
+interface OAuthResult {
+    /** Authorization code (exchange for tokens) */
+    code: string;
+    /** State parameter (verify matches request) */
+    state: string;
+}
+/** Response from token exchange */
+interface OAuthTokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    id_token: string;
+    scope: string;
+    refresh_token?: string;
+}
 declare class OpenKey {
     private host;
     private appName;
@@ -61,6 +86,47 @@ declare class OpenKey {
      * Check if user is already authenticated
      */
     isConnected(): Promise<boolean>;
+    /**
+     * OAuth 2.1 methods for third-party app authentication
+     * Use this when your app has registered OAuth client credentials with OpenKey
+     */
+    oauth: {
+        /**
+         * Start OAuth authorization flow
+         * Opens popup/redirect to OpenKey authorization endpoint
+         * @returns Promise that resolves with authorization code after user consent
+         */
+        connect: (config: OAuthConfig) => Promise<OAuthResult>;
+        /**
+         * Exchange authorization code for tokens
+         * Call this after receiving the callback with authorization code
+         * @param code - Authorization code from callback URL
+         * @param config - Same config used for connect()
+         * @returns Promise that resolves with access_token, id_token, etc.
+         */
+        exchangeCode: (code: string, config: OAuthConfig) => Promise<OAuthTokenResponse>;
+        /**
+         * Verify state parameter from callback
+         * Call this before exchangeCode to prevent CSRF attacks
+         * @param receivedState - State parameter from callback URL
+         * @returns true if state matches, false otherwise
+         */
+        verifyState: (receivedState: string) => boolean;
+        /**
+         * Parse authorization response from callback URL
+         * @param url - Callback URL (defaults to current window.location.href)
+         * @returns Parsed code and state, or error
+         */
+        parseCallback: (url?: string) => {
+            code: string;
+            state: string;
+        } | {
+            error: string;
+            errorDescription?: string;
+        };
+    };
+    private openOAuthFlow;
+    private openOAuthPopup;
     private openFlow;
     private openPopup;
     private openIframe;
@@ -72,4 +138,4 @@ declare class OpenKey {
 
 declare function getOpenKey(config?: OpenKeyConfig): OpenKey;
 
-export { type AuthResult, OpenKey, type OpenKeyConfig, type OpenKeyError, type SignMessageRequest, type SignResult, type SignTypedDataRequest, OpenKey as default, getOpenKey };
+export { type AuthResult, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, type OpenKeyError, type SignMessageRequest, type SignResult, type SignTypedDataRequest, OpenKey as default, getOpenKey };

package/dist/index.js

@@ -1,4 +1,4 @@
-var h="https://openkey.so";var c=class{host;appName;usePopup;popup=null;iframe=null;constructor(e={}){this.host=e.host||h,this.appName=e.appName||window.location.hostname,this.usePopup=e.usePopup??!0}async connect(){return this.openFlow("connect",{type:"openkey:auth:request",appName:this.appName})}async signMessage(e){return this.openFlow("sign",{type:"openkey:sign:request",message:e.message,keyId:e.keyId})}async signTypedData(e){return this.openFlow("sign-typed-data",{type:"openkey:signTypedData:request",data:e})}async isConnected(){try{let e=await fetch(`${this.host}/api/auth/session`,{credentials:"include"});return e.ok?!!(await e.json()).user:!1}catch{return!1}}async openFlow(e,a){return new Promise((i,t)=>{let r=`${this.host}/widget/${e}?origin=${encodeURIComponent(window.location.origin)}`;this.usePopup?this.openPopup(r,a,i,t):this.openIframe(r,a,i,t)})}openPopup(e,a,i,t){let r=window.screenX+(window.outerWidth-400)/2,d=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(e,"openkey",`width=400,height=600,left=${r},top=${d},popup=true`),!this.popup){t({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups for this site."});return}let o=()=>{window.removeEventListener("message",p),clearInterval(g),clearTimeout(u)},g=setInterval(()=>{this.popup?.closed&&(o(),t({code:"USER_CANCELLED",message:"User closed the popup"}))},500),u=setTimeout(()=>{o(),this.popup?.close(),t({code:"TIMEOUT",message:"Request timed out"})},3e5),p=s=>{if(s.origin!==this.host)return;let n=s.data;if(n.type==="openkey:ready"){this.popup?.postMessage(a,this.host);return}if(n.type==="openkey:close"){o(),this.popup?.close(),t({code:"USER_CANCELLED",message:"User cancelled the request"});return}(n.type==="openkey:auth:response"||n.type==="openkey:sign:response"||n.type==="openkey:signTypedData:response")&&(o(),this.popup?.close(),n.success?n.type==="openkey:auth:response"?i({address:n.address,keyId:n.keyId}):i({signature:n.signature,address:n.address}):t(n.error))};window.addEventListener("message",p)}openIframe(e,a,i,t){let r=document.createElement("div");r.style.cssText=`
+var w="https://openkey.so";var l="openkey_oauth";function m(a){return btoa(String.fromCharCode(...a)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function E(){let a=new Uint8Array(32);return crypto.getRandomValues(a),m(a)}async function O(a){let s=new TextEncoder().encode(a),n=await crypto.subtle.digest("SHA-256",s);return m(new Uint8Array(n))}function U(){let a=new Uint8Array(16);return crypto.getRandomValues(a),m(a)}var h=class{host;appName;usePopup;popup=null;iframe=null;constructor(t={}){this.host=t.host||w,this.appName=t.appName||window.location.hostname,this.usePopup=t.usePopup??!0}async connect(){return this.openFlow("connect",{type:"openkey:auth:request",appName:this.appName})}async signMessage(t){return this.openFlow("sign",{type:"openkey:sign:request",message:t.message,keyId:t.keyId})}async signTypedData(t){return this.openFlow("sign-typed-data",{type:"openkey:signTypedData:request",data:t})}async isConnected(){try{let t=await fetch(`${this.host}/api/auth/session`,{credentials:"include"});return t.ok?!!(await t.json()).user:!1}catch{return!1}}oauth={connect:async t=>{let s=await E(),n=await O(s),r=t.state||U();sessionStorage.setItem(l,JSON.stringify({verifier:s,state:r}));let e=new URL(`${this.host}/api/auth/oauth2/authorize`);return e.searchParams.set("client_id",t.clientId),e.searchParams.set("redirect_uri",t.redirectUri),e.searchParams.set("response_type","code"),e.searchParams.set("scope","openid"),e.searchParams.set("state",r),e.searchParams.set("code_challenge",n),e.searchParams.set("code_challenge_method","S256"),this.openOAuthFlow(e.toString(),r,t.redirectUri)},exchangeCode:async(t,s)=>{let n=sessionStorage.getItem(l);if(!n)throw new Error("No PKCE verifier found. Start a new OAuth flow.");let{verifier:r}=JSON.parse(n),e=await fetch(`${this.host}/api/auth/oauth2/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t,redirect_uri:s.redirectUri,client_id:s.clientId,code_verifier:r})});if(sessionStorage.removeItem(l),!e.ok){let d=await e.json();throw new Error(d.error_description||"Token exchange failed")}return e.json()},verifyState:t=>{let s=sessionStorage.getItem(l);if(!s)return!1;let{state:n}=JSON.parse(s);return n===t},parseCallback:t=>{let s=new URL(t||window.location.href),n=s.searchParams.get("error");if(n)return{error:n,errorDescription:s.searchParams.get("error_description")||void 0};let r=s.searchParams.get("code"),e=s.searchParams.get("state");return!r||!e?{error:"missing_params",errorDescription:"Missing code or state parameter"}:{code:r,state:e}}};openOAuthFlow(t,s,n){return new Promise((r,e)=>{this.usePopup?this.openOAuthPopup(t,s,n,r,e):window.location.href=t})}openOAuthPopup(t,s,n,r,e){let d=window.screenX+(window.outerWidth-400)/2,p=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(t,"openkey-oauth",`width=400,height=600,left=${d},top=${p},popup=true`),!this.popup){e({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups or use redirect mode."});return}let g=new URL(n).origin,u=setInterval(()=>{try{if(this.popup?.closed){clearInterval(u),clearTimeout(c),e({code:"USER_CANCELLED",message:"User closed the popup"});return}let o=this.popup?.location?.href;if(o&&o.startsWith(g)){clearInterval(u),clearTimeout(c);let i=new URL(o),f=i.searchParams.get("code"),P=i.searchParams.get("state"),T=i.searchParams.get("error");if(this.popup?.close(),T){e({code:"UNAUTHORIZED",message:i.searchParams.get("error_description")||T});return}if(P!==s){e({code:"STATE_MISMATCH",message:"State mismatch - possible CSRF attack"});return}f?r({code:f,state:P}):e({code:"UNAUTHORIZED",message:"Authorization failed - no code returned"})}}catch{}},100),c=setTimeout(()=>{clearInterval(u),this.popup?.close(),e({code:"TIMEOUT",message:"OAuth flow timed out"})},3e5)}async openFlow(t,s){return new Promise((n,r)=>{let e=`${this.host}/widget/${t}?origin=${encodeURIComponent(window.location.origin)}`;this.usePopup?this.openPopup(e,s,n,r):this.openIframe(e,s,n,r)})}openPopup(t,s,n,r){let e=window.screenX+(window.outerWidth-400)/2,d=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(t,"openkey",`width=400,height=600,left=${e},top=${d},popup=true`),!this.popup){r({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups for this site."});return}let p=()=>{window.removeEventListener("message",c),clearInterval(g),clearTimeout(u)},g=setInterval(()=>{this.popup?.closed&&(p(),r({code:"USER_CANCELLED",message:"User closed the popup"}))},500),u=setTimeout(()=>{p(),this.popup?.close(),r({code:"TIMEOUT",message:"Request timed out"})},3e5),c=o=>{if(o.origin!==this.host)return;let i=o.data;if(i.type==="openkey:ready"){this.popup?.postMessage(s,this.host);return}if(i.type==="openkey:close"){p(),this.popup?.close(),r({code:"USER_CANCELLED",message:"User cancelled the request"});return}(i.type==="openkey:auth:response"||i.type==="openkey:sign:response"||i.type==="openkey:signTypedData:response")&&(p(),this.popup?.close(),i.success?i.type==="openkey:auth:response"?n({address:i.address,keyId:i.keyId}):n({signature:i.signature,address:i.address}):r(i.error))};window.addEventListener("message",c)}openIframe(t,s,n,r){let e=document.createElement("div");e.style.cssText=`
       position: fixed;
       inset: 0;
       background: rgba(0, 0, 0, 0.5);
@@ -13,9 +13,9 @@ var h="https://openkey.so";var c=class{host;appName;usePopup;popup=null;iframe=n
       border-radius: 12px;
       overflow: hidden;
       box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
-    `,this.iframe=document.createElement("iframe"),this.iframe.src=e,this.iframe.style.cssText=`
+    `,this.iframe=document.createElement("iframe"),this.iframe.src=t,this.iframe.style.cssText=`
       width: 100%;
       height: 100%;
       border: none;
-    `,d.appendChild(this.iframe),r.appendChild(d),document.body.appendChild(r);let o=()=>{window.removeEventListener("message",u),clearTimeout(g),r.remove(),this.iframe=null};r.addEventListener("click",p=>{p.target===r&&(o(),t({code:"USER_CANCELLED",message:"User cancelled the request"}))});let g=setTimeout(()=>{o(),t({code:"TIMEOUT",message:"Request timed out"})},3e5),u=p=>{if(p.origin!==this.host)return;let s=p.data;if(s.type==="openkey:ready"){this.iframe?.contentWindow?.postMessage(a,this.host);return}if(s.type==="openkey:close"){o(),t({code:"USER_CANCELLED",message:"User cancelled the request"});return}(s.type==="openkey:auth:response"||s.type==="openkey:sign:response"||s.type==="openkey:signTypedData:response")&&(o(),s.success?s.type==="openkey:auth:response"?i({address:s.address,keyId:s.keyId}):i({signature:s.signature,address:s.address}):t(s.error))};window.addEventListener("message",u)}disconnect(){this.popup?.close(),this.popup=null,this.iframe?.parentElement?.parentElement?.remove(),this.iframe=null}},m=c,l=null;function T(y){return(!l||y)&&(l=new c(y)),l}export{c as OpenKey,m as default,T as getOpenKey};
+    `,d.appendChild(this.iframe),e.appendChild(d),document.body.appendChild(e);let p=()=>{window.removeEventListener("message",u),clearTimeout(g),e.remove(),this.iframe=null};e.addEventListener("click",c=>{c.target===e&&(p(),r({code:"USER_CANCELLED",message:"User cancelled the request"}))});let g=setTimeout(()=>{p(),r({code:"TIMEOUT",message:"Request timed out"})},3e5),u=c=>{if(c.origin!==this.host)return;let o=c.data;if(o.type==="openkey:ready"){this.iframe?.contentWindow?.postMessage(s,this.host);return}if(o.type==="openkey:close"){p(),r({code:"USER_CANCELLED",message:"User cancelled the request"});return}(o.type==="openkey:auth:response"||o.type==="openkey:sign:response"||o.type==="openkey:signTypedData:response")&&(p(),o.success?o.type==="openkey:auth:response"?n({address:o.address,keyId:o.keyId}):n({signature:o.signature,address:o.address}):r(o.error))};window.addEventListener("message",u)}disconnect(){this.popup?.close(),this.popup=null,this.iframe?.parentElement?.parentElement?.remove(),this.iframe=null}},k=h,y=null;function I(a){return(!y||a)&&(y=new h(a)),y}export{h as OpenKey,k as default,I as getOpenKey};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// OpenKey SDK - Browser client for third-party apps\n// Provides \"Sign with OpenKey\" functionality via popup or iframe\n\nexport interface OpenKeyConfig {\n  /** OpenKey host URL (default: https://openkey.so) */\n  host?: string;\n  /** App identifier for display */\n  appName?: string;\n  /** Use popup instead of iframe (default: true) */\n  usePopup?: boolean;\n}\n\nexport interface SignMessageRequest {\n  message: string;\n  keyId?: string; // If not provided, user selects\n}\n\nexport interface SignTypedDataRequest {\n  domain: {\n    name?: string;\n    version?: string;\n    chainId?: number;\n    verifyingContract?: string;\n  };\n  types: Record<string, Array<{ name: string; type: string }>>;\n  primaryType: string;\n  message: Record<string, unknown>;\n  keyId?: string;\n}\n\nexport interface SignResult {\n  signature: string;\n  address: string;\n}\n\nexport interface AuthResult {\n  address: string;\n  keyId: string;\n}\n\nexport interface OpenKeyError {\n  code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN';\n  message: string;\n}\n\ntype MessageType =\n  | { type: 'openkey:auth:request'; appName: string }\n  | { type: 'openkey:auth:response'; success: true; address: string; keyId: string }\n  | { type: 'openkey:auth:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:sign:request'; message: string; keyId?: string }\n  | { type: 'openkey:sign:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:sign:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:signTypedData:request'; data: SignTypedDataRequest }\n  | { type: 'openkey:signTypedData:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:signTypedData:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:ready' }\n  | { type: 'openkey:close' };\n\nconst DEFAULT_HOST = 'https://openkey.so';\nconst POPUP_WIDTH = 400;\nconst POPUP_HEIGHT = 600;\nconst DEFAULT_TIMEOUT = 5 * 60 * 1000; // 5 minutes\n\nexport class OpenKey {\n  private host: string;\n  private appName: string;\n  private usePopup: boolean;\n  private popup: Window | null = null;\n  private iframe: HTMLIFrameElement | null = null;\n\n  constructor(config: OpenKeyConfig = {}) {\n    this.host = config.host || DEFAULT_HOST;\n    this.appName = config.appName || window.location.hostname;\n    this.usePopup = config.usePopup ?? true;\n  }\n\n  /**\n   * Connect to OpenKey and get user's wallet address\n   * Opens auth flow for user to select/create a key\n   */\n  async connect(): Promise<AuthResult> {\n    return this.openFlow<AuthResult>('connect', {\n      type: 'openkey:auth:request',\n      appName: this.appName,\n    });\n  }\n\n  /**\n   * Sign a message with the user's OpenKey wallet\n   */\n  async signMessage(request: SignMessageRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign', {\n      type: 'openkey:sign:request',\n      message: request.message,\n      keyId: request.keyId,\n    });\n  }\n\n  /**\n   * Sign typed data (EIP-712) with the user's OpenKey wallet\n   */\n  async signTypedData(request: SignTypedDataRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign-typed-data', {\n      type: 'openkey:signTypedData:request',\n      data: request,\n    });\n  }\n\n  /**\n   * Check if user is already authenticated\n   */\n  async isConnected(): Promise<boolean> {\n    // Check for existing session via API\n    try {\n      const res = await fetch(`${this.host}/api/auth/session`, {\n        credentials: 'include',\n      });\n      if (!res.ok) return false;\n      const data = await res.json();\n      return !!data.user;\n    } catch {\n      return false;\n    }\n  }\n\n  private async openFlow<T>(action: string, message: object): Promise<T> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.host}/widget/${action}?origin=${encodeURIComponent(window.location.origin)}`;\n\n      if (this.usePopup) {\n        this.openPopup(url, message, resolve, reject);\n      } else {\n        this.openIframe(url, message, resolve, reject);\n      }\n    });\n  }\n\n  private openPopup<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Calculate popup position\n    const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;\n    const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;\n\n    this.popup = window.open(\n      url,\n      'openkey',\n      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`\n    );\n\n    if (!this.popup) {\n      reject({\n        code: 'POPUP_BLOCKED',\n        message: 'Popup was blocked. Please allow popups for this site.',\n      });\n      return;\n    }\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearInterval(pollClosed);\n      clearTimeout(timeout);\n    };\n\n    // Poll to detect popup close\n    const pollClosed = setInterval(() => {\n      if (this.popup?.closed) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User closed the popup',\n        });\n      }\n    }, 500);\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      this.popup?.close();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        // Widget is ready, send our request\n        this.popup?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        this.popup?.close();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n        this.popup?.close();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  private openIframe<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Create overlay\n    const overlay = document.createElement('div');\n    overlay.style.cssText = `\n      position: fixed;\n      inset: 0;\n      background: rgba(0, 0, 0, 0.5);\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      z-index: 999999;\n    `;\n\n    // Create iframe container\n    const container = document.createElement('div');\n    container.style.cssText = `\n      width: ${POPUP_WIDTH}px;\n      height: ${POPUP_HEIGHT}px;\n      background: #1a1a1a;\n      border-radius: 12px;\n      overflow: hidden;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n    `;\n\n    // Create iframe\n    this.iframe = document.createElement('iframe');\n    this.iframe.src = url;\n    this.iframe.style.cssText = `\n      width: 100%;\n      height: 100%;\n      border: none;\n    `;\n\n    container.appendChild(this.iframe);\n    overlay.appendChild(container);\n    document.body.appendChild(overlay);\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearTimeout(timeout);\n      overlay.remove();\n      this.iframe = null;\n    };\n\n    // Close on overlay click\n    overlay.addEventListener('click', (e) => {\n      if (e.target === overlay) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n      }\n    });\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        this.iframe?.contentWindow?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  /**\n   * Disconnect and close any open flows\n   */\n  disconnect() {\n    this.popup?.close();\n    this.popup = null;\n    this.iframe?.parentElement?.parentElement?.remove();\n    this.iframe = null;\n  }\n}\n\n// Default export for convenience\nexport default OpenKey;\n\n// Create singleton instance\nlet defaultInstance: OpenKey | null = null;\n\nexport function getOpenKey(config?: OpenKeyConfig): OpenKey {\n  if (!defaultInstance || config) {\n    defaultInstance = new OpenKey(config);\n  }\n  return defaultInstance;\n}\n"],"mappings":"AA0DA,IAAMA,EAAe,qBAKd,IAAMC,EAAN,KAAc,CACX,KACA,QACA,SACA,MAAuB,KACvB,OAAmC,KAE3C,YAAYC,EAAwB,CAAC,EAAG,CACtC,KAAK,KAAOA,EAAO,MAAQC,EAC3B,KAAK,QAAUD,EAAO,SAAW,OAAO,SAAS,SACjD,KAAK,SAAWA,EAAO,UAAY,EACrC,CAMA,MAAM,SAA+B,CACnC,OAAO,KAAK,SAAqB,UAAW,CAC1C,KAAM,uBACN,QAAS,KAAK,OAChB,CAAC,CACH,CAKA,MAAM,YAAYE,EAAkD,CAClE,OAAO,KAAK,SAAqB,OAAQ,CACvC,KAAM,uBACN,QAASA,EAAQ,QACjB,MAAOA,EAAQ,KACjB,CAAC,CACH,CAKA,MAAM,cAAcA,EAAoD,CACtE,OAAO,KAAK,SAAqB,kBAAmB,CAClD,KAAM,gCACN,KAAMA,CACR,CAAC,CACH,CAKA,MAAM,aAAgC,CAEpC,GAAI,CACF,IAAMC,EAAM,MAAM,MAAM,GAAG,KAAK,IAAI,oBAAqB,CACvD,YAAa,SACf,CAAC,EACD,OAAKA,EAAI,GAEF,CAAC,EADK,MAAMA,EAAI,KAAK,GACd,KAFM,EAGtB,MAAQ,CACN,MAAO,EACT,CACF,CAEA,MAAc,SAAYC,EAAgBC,EAA6B,CACrE,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACtC,IAAMC,EAAM,GAAG,KAAK,IAAI,WAAWJ,CAAM,WAAW,mBAAmB,OAAO,SAAS,MAAM,CAAC,GAE1F,KAAK,SACP,KAAK,UAAUI,EAAKH,EAASC,EAASC,CAAM,EAE5C,KAAK,WAAWC,EAAKH,EAASC,EAASC,CAAM,CAEjD,CAAC,CACH,CAEQ,UACNC,EACAH,EACAC,EACAC,EACA,CAEA,IAAME,EAAO,OAAO,SAAW,OAAO,WAAa,KAAe,EAC5DC,EAAM,OAAO,SAAW,OAAO,YAAc,KAAgB,EAQnE,GANA,KAAK,MAAQ,OAAO,KAClBF,EACA,UACA,6BAAoDC,CAAI,QAAQC,CAAG,aACrE,EAEI,CAAC,KAAK,MAAO,CACfH,EAAO,CACL,KAAM,gBACN,QAAS,uDACX,CAAC,EACD,MACF,CAEA,IAAMI,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,cAAcC,CAAU,EACxB,aAAaC,CAAO,CACtB,EAGMD,EAAa,YAAY,IAAM,CAC/B,KAAK,OAAO,SACdF,EAAQ,EACRJ,EAAO,CACL,KAAM,iBACN,QAAS,uBACX,CAAC,EAEL,EAAG,GAAG,EAGAO,EAAU,WAAW,IAAM,CAC/BH,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBJ,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZK,EAAiBG,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMC,EAAOD,EAAM,KAEnB,GAAIC,EAAK,OAAS,gBAAiB,CAEjC,KAAK,OAAO,YAAYX,EAAS,KAAK,IAAI,EAC1C,MACF,CAEA,GAAIW,EAAK,OAAS,gBAAiB,CACjCL,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBJ,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIES,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEdL,EAAQ,EACR,KAAK,OAAO,MAAM,EAEdK,EAAK,QACHA,EAAK,OAAS,wBAChBV,EAAQ,CAAE,QAASU,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDV,EAAQ,CAAE,UAAWU,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnET,EAAOS,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAWJ,CAAa,CAClD,CAEQ,WACNJ,EACAH,EACAC,EACAC,EACA,CAEA,IAAMU,EAAU,SAAS,cAAc,KAAK,EAC5CA,EAAQ,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWxB,IAAMC,EAAY,SAAS,cAAc,KAAK,EAC9CA,EAAU,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAU1B,KAAK,OAAS,SAAS,cAAc,QAAQ,EAC7C,KAAK,OAAO,IAAMV,EAClB,KAAK,OAAO,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA,MAM5BU,EAAU,YAAY,KAAK,MAAM,EACjCD,EAAQ,YAAYC,CAAS,EAC7B,SAAS,KAAK,YAAYD,CAAO,EAEjC,IAAMN,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,aAAaE,CAAO,EACpBG,EAAQ,OAAO,EACf,KAAK,OAAS,IAChB,EAGAA,EAAQ,iBAAiB,QAAUE,GAAM,CACnCA,EAAE,SAAWF,IACfN,EAAQ,EACRJ,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EAEL,CAAC,EAGD,IAAMO,EAAU,WAAW,IAAM,CAC/BH,EAAQ,EACRJ,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZK,EAAiBG,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMC,EAAOD,EAAM,KAEnB,GAAIC,EAAK,OAAS,gBAAiB,CACjC,KAAK,QAAQ,eAAe,YAAYX,EAAS,KAAK,IAAI,EAC1D,MACF,CAEA,GAAIW,EAAK,OAAS,gBAAiB,CACjCL,EAAQ,EACRJ,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIES,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEdL,EAAQ,EAEJK,EAAK,QACHA,EAAK,OAAS,wBAChBV,EAAQ,CAAE,QAASU,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDV,EAAQ,CAAE,UAAWU,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnET,EAAOS,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAWJ,CAAa,CAClD,CAKA,YAAa,CACX,KAAK,OAAO,MAAM,EAClB,KAAK,MAAQ,KACb,KAAK,QAAQ,eAAe,eAAe,OAAO,EAClD,KAAK,OAAS,IAChB,CACF,EAGOQ,EAAQrB,EAGXsB,EAAkC,KAE/B,SAASC,EAAWtB,EAAiC,CAC1D,OAAI,CAACqB,GAAmBrB,KACtBqB,EAAkB,IAAItB,EAAQC,CAAM,GAE/BqB,CACT","names":["DEFAULT_HOST","OpenKey","config","DEFAULT_HOST","request","res","action","message","resolve","reject","url","left","top","cleanup","handleMessage","pollClosed","timeout","event","data","overlay","container","e","index_default","defaultInstance","getOpenKey"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// OpenKey SDK - Browser client for third-party apps\n// Provides \"Sign with OpenKey\" functionality via popup or iframe\n\nexport interface OpenKeyConfig {\n  /** OpenKey host URL (default: https://openkey.so) */\n  host?: string;\n  /** App identifier for display */\n  appName?: string;\n  /** Use popup instead of iframe (default: true) */\n  usePopup?: boolean;\n}\n\nexport interface SignMessageRequest {\n  message: string;\n  keyId?: string; // If not provided, user selects\n}\n\nexport interface SignTypedDataRequest {\n  domain: {\n    name?: string;\n    version?: string;\n    chainId?: number;\n    verifyingContract?: string;\n  };\n  types: Record<string, Array<{ name: string; type: string }>>;\n  primaryType: string;\n  message: Record<string, unknown>;\n  keyId?: string;\n}\n\nexport interface SignResult {\n  signature: string;\n  address: string;\n}\n\nexport interface AuthResult {\n  address: string;\n  keyId: string;\n}\n\nexport interface OpenKeyError {\n  code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';\n  message: string;\n}\n\n// ======= OAuth 2.1 Types =======\n\n/** OAuth configuration for third-party apps */\nexport interface OAuthConfig {\n  /** OAuth client_id (registered with OpenKey) */\n  clientId: string;\n  /** Redirect URI (must match registered URI) */\n  redirectUri: string;\n  /** State parameter for CSRF protection (auto-generated if not provided) */\n  state?: string;\n}\n\n/** Result from OAuth authorization */\nexport interface OAuthResult {\n  /** Authorization code (exchange for tokens) */\n  code: string;\n  /** State parameter (verify matches request) */\n  state: string;\n}\n\n/** Response from token exchange */\nexport interface OAuthTokenResponse {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  id_token: string;\n  scope: string;\n  refresh_token?: string;\n}\n\ntype MessageType =\n  | { type: 'openkey:auth:request'; appName: string }\n  | { type: 'openkey:auth:response'; success: true; address: string; keyId: string }\n  | { type: 'openkey:auth:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:sign:request'; message: string; keyId?: string }\n  | { type: 'openkey:sign:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:sign:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:signTypedData:request'; data: SignTypedDataRequest }\n  | { type: 'openkey:signTypedData:response'; success: true; signature: string; address: string }\n  | { type: 'openkey:signTypedData:response'; success: false; error: OpenKeyError }\n  | { type: 'openkey:ready' }\n  | { type: 'openkey:close' };\n\nconst DEFAULT_HOST = 'https://openkey.so';\nconst POPUP_WIDTH = 400;\nconst POPUP_HEIGHT = 600;\nconst DEFAULT_TIMEOUT = 5 * 60 * 1000; // 5 minutes\nconst OAUTH_STORAGE_KEY = 'openkey_oauth';\n\n// ======= PKCE Utilities =======\n\nfunction base64UrlEncode(buffer: Uint8Array): string {\n  const base64 = btoa(String.fromCharCode(...buffer));\n  return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\nasync function generateCodeVerifier(): Promise<string> {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return base64UrlEncode(array);\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction generateState(): string {\n  const array = new Uint8Array(16);\n  crypto.getRandomValues(array);\n  return base64UrlEncode(array);\n}\n\nexport class OpenKey {\n  private host: string;\n  private appName: string;\n  private usePopup: boolean;\n  private popup: Window | null = null;\n  private iframe: HTMLIFrameElement | null = null;\n\n  constructor(config: OpenKeyConfig = {}) {\n    this.host = config.host || DEFAULT_HOST;\n    this.appName = config.appName || window.location.hostname;\n    this.usePopup = config.usePopup ?? true;\n  }\n\n  /**\n   * Connect to OpenKey and get user's wallet address\n   * Opens auth flow for user to select/create a key\n   */\n  async connect(): Promise<AuthResult> {\n    return this.openFlow<AuthResult>('connect', {\n      type: 'openkey:auth:request',\n      appName: this.appName,\n    });\n  }\n\n  /**\n   * Sign a message with the user's OpenKey wallet\n   */\n  async signMessage(request: SignMessageRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign', {\n      type: 'openkey:sign:request',\n      message: request.message,\n      keyId: request.keyId,\n    });\n  }\n\n  /**\n   * Sign typed data (EIP-712) with the user's OpenKey wallet\n   */\n  async signTypedData(request: SignTypedDataRequest): Promise<SignResult> {\n    return this.openFlow<SignResult>('sign-typed-data', {\n      type: 'openkey:signTypedData:request',\n      data: request,\n    });\n  }\n\n  /**\n   * Check if user is already authenticated\n   */\n  async isConnected(): Promise<boolean> {\n    // Check for existing session via API\n    try {\n      const res = await fetch(`${this.host}/api/auth/session`, {\n        credentials: 'include',\n      });\n      if (!res.ok) return false;\n      const data = await res.json();\n      return !!data.user;\n    } catch {\n      return false;\n    }\n  }\n\n  // ======= OAuth 2.1 Provider Methods =======\n\n  /**\n   * OAuth 2.1 methods for third-party app authentication\n   * Use this when your app has registered OAuth client credentials with OpenKey\n   */\n  oauth = {\n    /**\n     * Start OAuth authorization flow\n     * Opens popup/redirect to OpenKey authorization endpoint\n     * @returns Promise that resolves with authorization code after user consent\n     */\n    connect: async (config: OAuthConfig): Promise<OAuthResult> => {\n      // Generate PKCE values\n      const verifier = await generateCodeVerifier();\n      const challenge = await generateCodeChallenge(verifier);\n      const state = config.state || generateState();\n\n      // Store for later token exchange\n      sessionStorage.setItem(\n        OAUTH_STORAGE_KEY,\n        JSON.stringify({ verifier, state })\n      );\n\n      // Build authorization URL\n      const authUrl = new URL(`${this.host}/api/auth/oauth2/authorize`);\n      authUrl.searchParams.set('client_id', config.clientId);\n      authUrl.searchParams.set('redirect_uri', config.redirectUri);\n      authUrl.searchParams.set('response_type', 'code');\n      authUrl.searchParams.set('scope', 'openid');\n      authUrl.searchParams.set('state', state);\n      authUrl.searchParams.set('code_challenge', challenge);\n      authUrl.searchParams.set('code_challenge_method', 'S256');\n\n      return this.openOAuthFlow(authUrl.toString(), state, config.redirectUri);\n    },\n\n    /**\n     * Exchange authorization code for tokens\n     * Call this after receiving the callback with authorization code\n     * @param code - Authorization code from callback URL\n     * @param config - Same config used for connect()\n     * @returns Promise that resolves with access_token, id_token, etc.\n     */\n    exchangeCode: async (\n      code: string,\n      config: OAuthConfig\n    ): Promise<OAuthTokenResponse> => {\n      const stored = sessionStorage.getItem(OAUTH_STORAGE_KEY);\n      if (!stored) {\n        throw new Error('No PKCE verifier found. Start a new OAuth flow.');\n      }\n\n      const { verifier } = JSON.parse(stored);\n\n      const response = await fetch(`${this.host}/api/auth/oauth2/token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'authorization_code',\n          code,\n          redirect_uri: config.redirectUri,\n          client_id: config.clientId,\n          code_verifier: verifier,\n        }),\n      });\n\n      // Clear stored verifier\n      sessionStorage.removeItem(OAUTH_STORAGE_KEY);\n\n      if (!response.ok) {\n        const error = await response.json();\n        throw new Error(error.error_description || 'Token exchange failed');\n      }\n\n      return response.json();\n    },\n\n    /**\n     * Verify state parameter from callback\n     * Call this before exchangeCode to prevent CSRF attacks\n     * @param receivedState - State parameter from callback URL\n     * @returns true if state matches, false otherwise\n     */\n    verifyState: (receivedState: string): boolean => {\n      const stored = sessionStorage.getItem(OAUTH_STORAGE_KEY);\n      if (!stored) return false;\n      const { state } = JSON.parse(stored);\n      return state === receivedState;\n    },\n\n    /**\n     * Parse authorization response from callback URL\n     * @param url - Callback URL (defaults to current window.location.href)\n     * @returns Parsed code and state, or error\n     */\n    parseCallback: (\n      url?: string\n    ): { code: string; state: string } | { error: string; errorDescription?: string } => {\n      const urlObj = new URL(url || window.location.href);\n      const error = urlObj.searchParams.get('error');\n\n      if (error) {\n        return {\n          error,\n          errorDescription: urlObj.searchParams.get('error_description') || undefined,\n        };\n      }\n\n      const code = urlObj.searchParams.get('code');\n      const state = urlObj.searchParams.get('state');\n\n      if (!code || !state) {\n        return { error: 'missing_params', errorDescription: 'Missing code or state parameter' };\n      }\n\n      return { code, state };\n    },\n  };\n\n  private openOAuthFlow(\n    url: string,\n    state: string,\n    redirectUri: string\n  ): Promise<OAuthResult> {\n    return new Promise((resolve, reject) => {\n      if (this.usePopup) {\n        this.openOAuthPopup(url, state, redirectUri, resolve, reject);\n      } else {\n        // Full page redirect - won't resolve, page navigates away\n        window.location.href = url;\n      }\n    });\n  }\n\n  private openOAuthPopup(\n    url: string,\n    state: string,\n    redirectUri: string,\n    resolve: (value: OAuthResult) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;\n    const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;\n\n    this.popup = window.open(\n      url,\n      'openkey-oauth',\n      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`\n    );\n\n    if (!this.popup) {\n      reject({\n        code: 'POPUP_BLOCKED',\n        message: 'Popup was blocked. Please allow popups or use redirect mode.',\n      });\n      return;\n    }\n\n    const redirectHost = new URL(redirectUri).origin;\n\n    // Poll for redirect back with code\n    const pollInterval = setInterval(() => {\n      try {\n        if (this.popup?.closed) {\n          clearInterval(pollInterval);\n          clearTimeout(timeout);\n          reject({\n            code: 'USER_CANCELLED',\n            message: 'User closed the popup',\n          });\n          return;\n        }\n\n        // Check if redirected to callback URL\n        const popupUrl = this.popup?.location?.href;\n        if (popupUrl && popupUrl.startsWith(redirectHost)) {\n          clearInterval(pollInterval);\n          clearTimeout(timeout);\n\n          const urlObj = new URL(popupUrl);\n          const code = urlObj.searchParams.get('code');\n          const returnedState = urlObj.searchParams.get('state');\n          const error = urlObj.searchParams.get('error');\n\n          this.popup?.close();\n\n          if (error) {\n            reject({\n              code: 'UNAUTHORIZED',\n              message: urlObj.searchParams.get('error_description') || error,\n            });\n            return;\n          }\n\n          if (returnedState !== state) {\n            reject({\n              code: 'STATE_MISMATCH',\n              message: 'State mismatch - possible CSRF attack',\n            });\n            return;\n          }\n\n          if (code) {\n            resolve({ code, state: returnedState });\n          } else {\n            reject({\n              code: 'UNAUTHORIZED',\n              message: 'Authorization failed - no code returned',\n            });\n          }\n        }\n      } catch {\n        // Cross-origin - popup still on OpenKey domain, continue polling\n      }\n    }, 100);\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      clearInterval(pollInterval);\n      this.popup?.close();\n      reject({\n        code: 'TIMEOUT',\n        message: 'OAuth flow timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n  }\n\n  private async openFlow<T>(action: string, message: object): Promise<T> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.host}/widget/${action}?origin=${encodeURIComponent(window.location.origin)}`;\n\n      if (this.usePopup) {\n        this.openPopup(url, message, resolve, reject);\n      } else {\n        this.openIframe(url, message, resolve, reject);\n      }\n    });\n  }\n\n  private openPopup<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Calculate popup position\n    const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;\n    const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;\n\n    this.popup = window.open(\n      url,\n      'openkey',\n      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`\n    );\n\n    if (!this.popup) {\n      reject({\n        code: 'POPUP_BLOCKED',\n        message: 'Popup was blocked. Please allow popups for this site.',\n      });\n      return;\n    }\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearInterval(pollClosed);\n      clearTimeout(timeout);\n    };\n\n    // Poll to detect popup close\n    const pollClosed = setInterval(() => {\n      if (this.popup?.closed) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User closed the popup',\n        });\n      }\n    }, 500);\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      this.popup?.close();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        // Widget is ready, send our request\n        this.popup?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        this.popup?.close();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n        this.popup?.close();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  private openIframe<T>(\n    url: string,\n    message: object,\n    resolve: (value: T) => void,\n    reject: (error: OpenKeyError) => void\n  ) {\n    // Create overlay\n    const overlay = document.createElement('div');\n    overlay.style.cssText = `\n      position: fixed;\n      inset: 0;\n      background: rgba(0, 0, 0, 0.5);\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      z-index: 999999;\n    `;\n\n    // Create iframe container\n    const container = document.createElement('div');\n    container.style.cssText = `\n      width: ${POPUP_WIDTH}px;\n      height: ${POPUP_HEIGHT}px;\n      background: #1a1a1a;\n      border-radius: 12px;\n      overflow: hidden;\n      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);\n    `;\n\n    // Create iframe\n    this.iframe = document.createElement('iframe');\n    this.iframe.src = url;\n    this.iframe.style.cssText = `\n      width: 100%;\n      height: 100%;\n      border: none;\n    `;\n\n    container.appendChild(this.iframe);\n    overlay.appendChild(container);\n    document.body.appendChild(overlay);\n\n    const cleanup = () => {\n      window.removeEventListener('message', handleMessage);\n      clearTimeout(timeout);\n      overlay.remove();\n      this.iframe = null;\n    };\n\n    // Close on overlay click\n    overlay.addEventListener('click', (e) => {\n      if (e.target === overlay) {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n      }\n    });\n\n    // Timeout\n    const timeout = setTimeout(() => {\n      cleanup();\n      reject({\n        code: 'TIMEOUT',\n        message: 'Request timed out',\n      });\n    }, DEFAULT_TIMEOUT);\n\n    // Listen for messages\n    const handleMessage = (event: MessageEvent) => {\n      if (event.origin !== this.host) return;\n\n      const data = event.data as MessageType;\n\n      if (data.type === 'openkey:ready') {\n        this.iframe?.contentWindow?.postMessage(message, this.host);\n        return;\n      }\n\n      if (data.type === 'openkey:close') {\n        cleanup();\n        reject({\n          code: 'USER_CANCELLED',\n          message: 'User cancelled the request',\n        });\n        return;\n      }\n\n      // Handle responses\n      if (\n        data.type === 'openkey:auth:response' ||\n        data.type === 'openkey:sign:response' ||\n        data.type === 'openkey:signTypedData:response'\n      ) {\n        cleanup();\n\n        if (data.success) {\n          if (data.type === 'openkey:auth:response') {\n            resolve({ address: data.address, keyId: data.keyId } as T);\n          } else {\n            resolve({ signature: data.signature, address: data.address } as T);\n          }\n        } else {\n          reject(data.error);\n        }\n      }\n    };\n\n    window.addEventListener('message', handleMessage);\n  }\n\n  /**\n   * Disconnect and close any open flows\n   */\n  disconnect() {\n    this.popup?.close();\n    this.popup = null;\n    this.iframe?.parentElement?.parentElement?.remove();\n    this.iframe = null;\n  }\n}\n\n// Default export for convenience\nexport default OpenKey;\n\n// Create singleton instance\nlet defaultInstance: OpenKey | null = null;\n\nexport function getOpenKey(config?: OpenKeyConfig): OpenKey {\n  if (!defaultInstance || config) {\n    defaultInstance = new OpenKey(config);\n  }\n  return defaultInstance;\n}\n"],"mappings":"AAwFA,IAAMA,EAAe,qBAIrB,IAAMC,EAAoB,gBAI1B,SAASC,EAAgBC,EAA4B,CAEnD,OADe,KAAK,OAAO,aAAa,GAAGA,CAAM,CAAC,EACpC,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,KAAM,EAAE,CACxE,CAEA,eAAeC,GAAwC,CACrD,IAAMC,EAAQ,IAAI,WAAW,EAAE,EAC/B,cAAO,gBAAgBA,CAAK,EACrBH,EAAgBG,CAAK,CAC9B,CAEA,eAAeC,EAAsBC,EAAmC,CAEtE,IAAMC,EADU,IAAI,YAAY,EACX,OAAOD,CAAQ,EAC9BE,EAAS,MAAM,OAAO,OAAO,OAAO,UAAWD,CAAI,EACzD,OAAON,EAAgB,IAAI,WAAWO,CAAM,CAAC,CAC/C,CAEA,SAASC,GAAwB,CAC/B,IAAML,EAAQ,IAAI,WAAW,EAAE,EAC/B,cAAO,gBAAgBA,CAAK,EACrBH,EAAgBG,CAAK,CAC9B,CAEO,IAAMM,EAAN,KAAc,CACX,KACA,QACA,SACA,MAAuB,KACvB,OAAmC,KAE3C,YAAYC,EAAwB,CAAC,EAAG,CACtC,KAAK,KAAOA,EAAO,MAAQC,EAC3B,KAAK,QAAUD,EAAO,SAAW,OAAO,SAAS,SACjD,KAAK,SAAWA,EAAO,UAAY,EACrC,CAMA,MAAM,SAA+B,CACnC,OAAO,KAAK,SAAqB,UAAW,CAC1C,KAAM,uBACN,QAAS,KAAK,OAChB,CAAC,CACH,CAKA,MAAM,YAAYE,EAAkD,CAClE,OAAO,KAAK,SAAqB,OAAQ,CACvC,KAAM,uBACN,QAASA,EAAQ,QACjB,MAAOA,EAAQ,KACjB,CAAC,CACH,CAKA,MAAM,cAAcA,EAAoD,CACtE,OAAO,KAAK,SAAqB,kBAAmB,CAClD,KAAM,gCACN,KAAMA,CACR,CAAC,CACH,CAKA,MAAM,aAAgC,CAEpC,GAAI,CACF,IAAMC,EAAM,MAAM,MAAM,GAAG,KAAK,IAAI,oBAAqB,CACvD,YAAa,SACf,CAAC,EACD,OAAKA,EAAI,GAEF,CAAC,EADK,MAAMA,EAAI,KAAK,GACd,KAFM,EAGtB,MAAQ,CACN,MAAO,EACT,CACF,CAQA,MAAQ,CAMN,QAAS,MAAOH,GAA8C,CAE5D,IAAML,EAAW,MAAMH,EAAqB,EACtCY,EAAY,MAAMV,EAAsBC,CAAQ,EAChDU,EAAQL,EAAO,OAASF,EAAc,EAG5C,eAAe,QACbT,EACA,KAAK,UAAU,CAAE,SAAAM,EAAU,MAAAU,CAAM,CAAC,CACpC,EAGA,IAAMC,EAAU,IAAI,IAAI,GAAG,KAAK,IAAI,4BAA4B,EAChE,OAAAA,EAAQ,aAAa,IAAI,YAAaN,EAAO,QAAQ,EACrDM,EAAQ,aAAa,IAAI,eAAgBN,EAAO,WAAW,EAC3DM,EAAQ,aAAa,IAAI,gBAAiB,MAAM,EAChDA,EAAQ,aAAa,IAAI,QAAS,QAAQ,EAC1CA,EAAQ,aAAa,IAAI,QAASD,CAAK,EACvCC,EAAQ,aAAa,IAAI,iBAAkBF,CAAS,EACpDE,EAAQ,aAAa,IAAI,wBAAyB,MAAM,EAEjD,KAAK,cAAcA,EAAQ,SAAS,EAAGD,EAAOL,EAAO,WAAW,CACzE,EASA,aAAc,MACZO,EACAP,IACgC,CAChC,IAAMQ,EAAS,eAAe,QAAQnB,CAAiB,EACvD,GAAI,CAACmB,EACH,MAAM,IAAI,MAAM,iDAAiD,EAGnE,GAAM,CAAE,SAAAb,CAAS,EAAI,KAAK,MAAMa,CAAM,EAEhCC,EAAW,MAAM,MAAM,GAAG,KAAK,IAAI,yBAA0B,CACjE,OAAQ,OACR,QAAS,CACP,eAAgB,mCAClB,EACA,KAAM,IAAI,gBAAgB,CACxB,WAAY,qBACZ,KAAAF,EACA,aAAcP,EAAO,YACrB,UAAWA,EAAO,SAClB,cAAeL,CACjB,CAAC,CACH,CAAC,EAKD,GAFA,eAAe,WAAWN,CAAiB,EAEvC,CAACoB,EAAS,GAAI,CAChB,IAAMC,EAAQ,MAAMD,EAAS,KAAK,EAClC,MAAM,IAAI,MAAMC,EAAM,mBAAqB,uBAAuB,CACpE,CAEA,OAAOD,EAAS,KAAK,CACvB,EAQA,YAAcE,GAAmC,CAC/C,IAAMH,EAAS,eAAe,QAAQnB,CAAiB,EACvD,GAAI,CAACmB,EAAQ,MAAO,GACpB,GAAM,CAAE,MAAAH,CAAM,EAAI,KAAK,MAAMG,CAAM,EACnC,OAAOH,IAAUM,CACnB,EAOA,cACEC,GACmF,CACnF,IAAMC,EAAS,IAAI,IAAID,GAAO,OAAO,SAAS,IAAI,EAC5CF,EAAQG,EAAO,aAAa,IAAI,OAAO,EAE7C,GAAIH,EACF,MAAO,CACL,MAAAA,EACA,iBAAkBG,EAAO,aAAa,IAAI,mBAAmB,GAAK,MACpE,EAGF,IAAMN,EAAOM,EAAO,aAAa,IAAI,MAAM,EACrCR,EAAQQ,EAAO,aAAa,IAAI,OAAO,EAE7C,MAAI,CAACN,GAAQ,CAACF,EACL,CAAE,MAAO,iBAAkB,iBAAkB,iCAAkC,EAGjF,CAAE,KAAAE,EAAM,MAAAF,CAAM,CACvB,CACF,EAEQ,cACNO,EACAP,EACAS,EACsB,CACtB,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CAClC,KAAK,SACP,KAAK,eAAeJ,EAAKP,EAAOS,EAAaC,EAASC,CAAM,EAG5D,OAAO,SAAS,KAAOJ,CAE3B,CAAC,CACH,CAEQ,eACNA,EACAP,EACAS,EACAC,EACAC,EACA,CACA,IAAMC,EAAO,OAAO,SAAW,OAAO,WAAa,KAAe,EAC5DC,EAAM,OAAO,SAAW,OAAO,YAAc,KAAgB,EAQnE,GANA,KAAK,MAAQ,OAAO,KAClBN,EACA,gBACA,6BAAoDK,CAAI,QAAQC,CAAG,aACrE,EAEI,CAAC,KAAK,MAAO,CACfF,EAAO,CACL,KAAM,gBACN,QAAS,8DACX,CAAC,EACD,MACF,CAEA,IAAMG,EAAe,IAAI,IAAIL,CAAW,EAAE,OAGpCM,EAAe,YAAY,IAAM,CACrC,GAAI,CACF,GAAI,KAAK,OAAO,OAAQ,CACtB,cAAcA,CAAY,EAC1B,aAAaC,CAAO,EACpBL,EAAO,CACL,KAAM,iBACN,QAAS,uBACX,CAAC,EACD,MACF,CAGA,IAAMM,EAAW,KAAK,OAAO,UAAU,KACvC,GAAIA,GAAYA,EAAS,WAAWH,CAAY,EAAG,CACjD,cAAcC,CAAY,EAC1B,aAAaC,CAAO,EAEpB,IAAMR,EAAS,IAAI,IAAIS,CAAQ,EACzBf,EAAOM,EAAO,aAAa,IAAI,MAAM,EACrCU,EAAgBV,EAAO,aAAa,IAAI,OAAO,EAC/CH,EAAQG,EAAO,aAAa,IAAI,OAAO,EAI7C,GAFA,KAAK,OAAO,MAAM,EAEdH,EAAO,CACTM,EAAO,CACL,KAAM,eACN,QAASH,EAAO,aAAa,IAAI,mBAAmB,GAAKH,CAC3D,CAAC,EACD,MACF,CAEA,GAAIa,IAAkBlB,EAAO,CAC3BW,EAAO,CACL,KAAM,iBACN,QAAS,uCACX,CAAC,EACD,MACF,CAEIT,EACFQ,EAAQ,CAAE,KAAAR,EAAM,MAAOgB,CAAc,CAAC,EAEtCP,EAAO,CACL,KAAM,eACN,QAAS,yCACX,CAAC,CAEL,CACF,MAAQ,CAER,CACF,EAAG,GAAG,EAGAK,EAAU,WAAW,IAAM,CAC/B,cAAcD,CAAY,EAC1B,KAAK,OAAO,MAAM,EAClBJ,EAAO,CACL,KAAM,UACN,QAAS,sBACX,CAAC,CACH,EAAG,GAAe,CACpB,CAEA,MAAc,SAAYQ,EAAgBC,EAA6B,CACrE,OAAO,IAAI,QAAQ,CAACV,EAASC,IAAW,CACtC,IAAMJ,EAAM,GAAG,KAAK,IAAI,WAAWY,CAAM,WAAW,mBAAmB,OAAO,SAAS,MAAM,CAAC,GAE1F,KAAK,SACP,KAAK,UAAUZ,EAAKa,EAASV,EAASC,CAAM,EAE5C,KAAK,WAAWJ,EAAKa,EAASV,EAASC,CAAM,CAEjD,CAAC,CACH,CAEQ,UACNJ,EACAa,EACAV,EACAC,EACA,CAEA,IAAMC,EAAO,OAAO,SAAW,OAAO,WAAa,KAAe,EAC5DC,EAAM,OAAO,SAAW,OAAO,YAAc,KAAgB,EAQnE,GANA,KAAK,MAAQ,OAAO,KAClBN,EACA,UACA,6BAAoDK,CAAI,QAAQC,CAAG,aACrE,EAEI,CAAC,KAAK,MAAO,CACfF,EAAO,CACL,KAAM,gBACN,QAAS,uDACX,CAAC,EACD,MACF,CAEA,IAAMU,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,cAAcC,CAAU,EACxB,aAAaP,CAAO,CACtB,EAGMO,EAAa,YAAY,IAAM,CAC/B,KAAK,OAAO,SACdF,EAAQ,EACRV,EAAO,CACL,KAAM,iBACN,QAAS,uBACX,CAAC,EAEL,EAAG,GAAG,EAGAK,EAAU,WAAW,IAAM,CAC/BK,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBV,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZW,EAAiBE,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMjC,EAAOiC,EAAM,KAEnB,GAAIjC,EAAK,OAAS,gBAAiB,CAEjC,KAAK,OAAO,YAAY6B,EAAS,KAAK,IAAI,EAC1C,MACF,CAEA,GAAI7B,EAAK,OAAS,gBAAiB,CACjC8B,EAAQ,EACR,KAAK,OAAO,MAAM,EAClBV,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIEpB,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEd8B,EAAQ,EACR,KAAK,OAAO,MAAM,EAEd9B,EAAK,QACHA,EAAK,OAAS,wBAChBmB,EAAQ,CAAE,QAASnB,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDmB,EAAQ,CAAE,UAAWnB,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnEoB,EAAOpB,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAW+B,CAAa,CAClD,CAEQ,WACNf,EACAa,EACAV,EACAC,EACA,CAEA,IAAMc,EAAU,SAAS,cAAc,KAAK,EAC5CA,EAAQ,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWxB,IAAMC,EAAY,SAAS,cAAc,KAAK,EAC9CA,EAAU,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAU1B,KAAK,OAAS,SAAS,cAAc,QAAQ,EAC7C,KAAK,OAAO,IAAMnB,EAClB,KAAK,OAAO,MAAM,QAAU;AAAA;AAAA;AAAA;AAAA,MAM5BmB,EAAU,YAAY,KAAK,MAAM,EACjCD,EAAQ,YAAYC,CAAS,EAC7B,SAAS,KAAK,YAAYD,CAAO,EAEjC,IAAMJ,EAAU,IAAM,CACpB,OAAO,oBAAoB,UAAWC,CAAa,EACnD,aAAaN,CAAO,EACpBS,EAAQ,OAAO,EACf,KAAK,OAAS,IAChB,EAGAA,EAAQ,iBAAiB,QAAUE,GAAM,CACnCA,EAAE,SAAWF,IACfJ,EAAQ,EACRV,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EAEL,CAAC,EAGD,IAAMK,EAAU,WAAW,IAAM,CAC/BK,EAAQ,EACRV,EAAO,CACL,KAAM,UACN,QAAS,mBACX,CAAC,CACH,EAAG,GAAe,EAGZW,EAAiBE,GAAwB,CAC7C,GAAIA,EAAM,SAAW,KAAK,KAAM,OAEhC,IAAMjC,EAAOiC,EAAM,KAEnB,GAAIjC,EAAK,OAAS,gBAAiB,CACjC,KAAK,QAAQ,eAAe,YAAY6B,EAAS,KAAK,IAAI,EAC1D,MACF,CAEA,GAAI7B,EAAK,OAAS,gBAAiB,CACjC8B,EAAQ,EACRV,EAAO,CACL,KAAM,iBACN,QAAS,4BACX,CAAC,EACD,MACF,EAIEpB,EAAK,OAAS,yBACdA,EAAK,OAAS,yBACdA,EAAK,OAAS,oCAEd8B,EAAQ,EAEJ9B,EAAK,QACHA,EAAK,OAAS,wBAChBmB,EAAQ,CAAE,QAASnB,EAAK,QAAS,MAAOA,EAAK,KAAM,CAAM,EAEzDmB,EAAQ,CAAE,UAAWnB,EAAK,UAAW,QAASA,EAAK,OAAQ,CAAM,EAGnEoB,EAAOpB,EAAK,KAAK,EAGvB,EAEA,OAAO,iBAAiB,UAAW+B,CAAa,CAClD,CAKA,YAAa,CACX,KAAK,OAAO,MAAM,EAClB,KAAK,MAAQ,KACb,KAAK,QAAQ,eAAe,eAAe,OAAO,EAClD,KAAK,OAAS,IAChB,CACF,EAGOM,EAAQlC,EAGXmC,EAAkC,KAE/B,SAASC,EAAWnC,EAAiC,CAC1D,OAAI,CAACkC,GAAmBlC,KACtBkC,EAAkB,IAAInC,EAAQC,CAAM,GAE/BkC,CACT","names":["DEFAULT_HOST","OAUTH_STORAGE_KEY","base64UrlEncode","buffer","generateCodeVerifier","array","generateCodeChallenge","verifier","data","digest","generateState","OpenKey","config","DEFAULT_HOST","request","res","challenge","state","authUrl","code","stored","response","error","receivedState","url","urlObj","redirectUri","resolve","reject","left","top","redirectHost","pollInterval","timeout","popupUrl","returnedState","action","message","cleanup","handleMessage","pollClosed","event","overlay","container","e","index_default","defaultInstance","getOpenKey"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openkey/sdk",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -12,6 +12,13 @@
       "types": "./dist/index.d.ts"
     }
   },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
   "scripts": {
     "dev": "tsup --watch",
     "build": "tsup",

package/.turbo/turbo-build.log

@@ -1,79 +0,0 @@
-$ tsup
-▲ [WARNING] The condition "types" here will never be used as it comes after both "import" and "require" [package.json]
-
-    package.json:12:6:
-      12 │       "types": "./dist/index.d.ts"
-         ╵       ~~~~~~~
-
-  The "import" condition comes earlier and will be used for all "import" statements:
-
-    package.json:10:6:
-      10 │       "import": "./dist/index.js",
-         ╵       ~~~~~~~~
-
-  The "require" condition comes earlier and will be used for all "require" calls:
-
-    package.json:11:6:
-      11 │       "require": "./dist/index.cjs",
-         ╵       ~~~~~~~~~
-
-CLI Building entry: src/index.ts
-CLI Using tsconfig: tsconfig.json
-CLI tsup v8.5.1
-CLI Using tsup config: /Users/samgbafa/Documents/github/tinycloud/openkey/packages/sdk/tsup.config.ts
-CLI Target: es2022
-CLI Cleaning output folder
-ESM Build start
-CJS Build start
-
- WARN  ▲ [WARNING] The condition "types" here will never be used as it comes after both "import" and "require" [package.json]
-
-    package.json:12:6:
-      12 │       "types": "./dist/index.d.ts"
-         ╵       ~~~~~~~
-
-  The "import" condition comes earlier and will be used for all "import" statements:
-
-    package.json:10:6:
-      10 │       "import": "./dist/index.js",
-         ╵       ~~~~~~~~
-
-  The "require" condition comes earlier and will be used for all "require" calls:
-
-    package.json:11:6:
-      11 │       "require": "./dist/index.cjs",
-         ╵       ~~~~~~~~~
-
-
-
-
- WARN  ▲ [WARNING] The condition "types" here will never be used as it comes after both "import" and "require" [package.json]
-
-    package.json:12:6:
-      12 │       "types": "./dist/index.d.ts"
-         ╵       ~~~~~~~
-
-  The "import" condition comes earlier and will be used for all "import" statements:
-
-    package.json:10:6:
-      10 │       "import": "./dist/index.js",
-         ╵       ~~~~~~~~
-
-  The "require" condition comes earlier and will be used for all "require" calls:
-
-    package.json:11:6:
-      11 │       "require": "./dist/index.cjs",
-         ╵       ~~~~~~~~~
-
-
-
-CJS dist/index.cjs     4.24 KB
-CJS dist/index.cjs.map 13.89 KB
-CJS ⚡️ Build success in 50ms
-ESM dist/index.js     3.76 KB
-ESM dist/index.js.map 13.74 KB
-ESM ⚡️ Build success in 51ms
-DTS Build start
-DTS ⚡️ Build success in 2139ms
-DTS dist/index.d.ts  2.00 KB
-DTS dist/index.d.cts 2.00 KB

package/src/index.ts

@@ -1,369 +0,0 @@
-// OpenKey SDK - Browser client for third-party apps
-// Provides "Sign with OpenKey" functionality via popup or iframe
-
-export interface OpenKeyConfig {
-  /** OpenKey host URL (default: https://openkey.so) */
-  host?: string;
-  /** App identifier for display */
-  appName?: string;
-  /** Use popup instead of iframe (default: true) */
-  usePopup?: boolean;
-}
-
-export interface SignMessageRequest {
-  message: string;
-  keyId?: string; // If not provided, user selects
-}
-
-export interface SignTypedDataRequest {
-  domain: {
-    name?: string;
-    version?: string;
-    chainId?: number;
-    verifyingContract?: string;
-  };
-  types: Record<string, Array<{ name: string; type: string }>>;
-  primaryType: string;
-  message: Record<string, unknown>;
-  keyId?: string;
-}
-
-export interface SignResult {
-  signature: string;
-  address: string;
-}
-
-export interface AuthResult {
-  address: string;
-  keyId: string;
-}
-
-export interface OpenKeyError {
-  code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN';
-  message: string;
-}
-
-type MessageType =
-  | { type: 'openkey:auth:request'; appName: string }
-  | { type: 'openkey:auth:response'; success: true; address: string; keyId: string }
-  | { type: 'openkey:auth:response'; success: false; error: OpenKeyError }
-  | { type: 'openkey:sign:request'; message: string; keyId?: string }
-  | { type: 'openkey:sign:response'; success: true; signature: string; address: string }
-  | { type: 'openkey:sign:response'; success: false; error: OpenKeyError }
-  | { type: 'openkey:signTypedData:request'; data: SignTypedDataRequest }
-  | { type: 'openkey:signTypedData:response'; success: true; signature: string; address: string }
-  | { type: 'openkey:signTypedData:response'; success: false; error: OpenKeyError }
-  | { type: 'openkey:ready' }
-  | { type: 'openkey:close' };
-
-const DEFAULT_HOST = 'https://openkey.so';
-const POPUP_WIDTH = 400;
-const POPUP_HEIGHT = 600;
-const DEFAULT_TIMEOUT = 5 * 60 * 1000; // 5 minutes
-
-export class OpenKey {
-  private host: string;
-  private appName: string;
-  private usePopup: boolean;
-  private popup: Window | null = null;
-  private iframe: HTMLIFrameElement | null = null;
-
-  constructor(config: OpenKeyConfig = {}) {
-    this.host = config.host || DEFAULT_HOST;
-    this.appName = config.appName || window.location.hostname;
-    this.usePopup = config.usePopup ?? true;
-  }
-
-  /**
-   * Connect to OpenKey and get user's wallet address
-   * Opens auth flow for user to select/create a key
-   */
-  async connect(): Promise<AuthResult> {
-    return this.openFlow<AuthResult>('connect', {
-      type: 'openkey:auth:request',
-      appName: this.appName,
-    });
-  }
-
-  /**
-   * Sign a message with the user's OpenKey wallet
-   */
-  async signMessage(request: SignMessageRequest): Promise<SignResult> {
-    return this.openFlow<SignResult>('sign', {
-      type: 'openkey:sign:request',
-      message: request.message,
-      keyId: request.keyId,
-    });
-  }
-
-  /**
-   * Sign typed data (EIP-712) with the user's OpenKey wallet
-   */
-  async signTypedData(request: SignTypedDataRequest): Promise<SignResult> {
-    return this.openFlow<SignResult>('sign-typed-data', {
-      type: 'openkey:signTypedData:request',
-      data: request,
-    });
-  }
-
-  /**
-   * Check if user is already authenticated
-   */
-  async isConnected(): Promise<boolean> {
-    // Check for existing session via API
-    try {
-      const res = await fetch(`${this.host}/api/auth/session`, {
-        credentials: 'include',
-      });
-      if (!res.ok) return false;
-      const data = await res.json();
-      return !!data.user;
-    } catch {
-      return false;
-    }
-  }
-
-  private async openFlow<T>(action: string, message: object): Promise<T> {
-    return new Promise((resolve, reject) => {
-      const url = `${this.host}/widget/${action}?origin=${encodeURIComponent(window.location.origin)}`;
-
-      if (this.usePopup) {
-        this.openPopup(url, message, resolve, reject);
-      } else {
-        this.openIframe(url, message, resolve, reject);
-      }
-    });
-  }
-
-  private openPopup<T>(
-    url: string,
-    message: object,
-    resolve: (value: T) => void,
-    reject: (error: OpenKeyError) => void
-  ) {
-    // Calculate popup position
-    const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;
-    const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;
-
-    this.popup = window.open(
-      url,
-      'openkey',
-      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`
-    );
-
-    if (!this.popup) {
-      reject({
-        code: 'POPUP_BLOCKED',
-        message: 'Popup was blocked. Please allow popups for this site.',
-      });
-      return;
-    }
-
-    const cleanup = () => {
-      window.removeEventListener('message', handleMessage);
-      clearInterval(pollClosed);
-      clearTimeout(timeout);
-    };
-
-    // Poll to detect popup close
-    const pollClosed = setInterval(() => {
-      if (this.popup?.closed) {
-        cleanup();
-        reject({
-          code: 'USER_CANCELLED',
-          message: 'User closed the popup',
-        });
-      }
-    }, 500);
-
-    // Timeout
-    const timeout = setTimeout(() => {
-      cleanup();
-      this.popup?.close();
-      reject({
-        code: 'TIMEOUT',
-        message: 'Request timed out',
-      });
-    }, DEFAULT_TIMEOUT);
-
-    // Listen for messages
-    const handleMessage = (event: MessageEvent) => {
-      if (event.origin !== this.host) return;
-
-      const data = event.data as MessageType;
-
-      if (data.type === 'openkey:ready') {
-        // Widget is ready, send our request
-        this.popup?.postMessage(message, this.host);
-        return;
-      }
-
-      if (data.type === 'openkey:close') {
-        cleanup();
-        this.popup?.close();
-        reject({
-          code: 'USER_CANCELLED',
-          message: 'User cancelled the request',
-        });
-        return;
-      }
-
-      // Handle responses
-      if (
-        data.type === 'openkey:auth:response' ||
-        data.type === 'openkey:sign:response' ||
-        data.type === 'openkey:signTypedData:response'
-      ) {
-        cleanup();
-        this.popup?.close();
-
-        if (data.success) {
-          if (data.type === 'openkey:auth:response') {
-            resolve({ address: data.address, keyId: data.keyId } as T);
-          } else {
-            resolve({ signature: data.signature, address: data.address } as T);
-          }
-        } else {
-          reject(data.error);
-        }
-      }
-    };
-
-    window.addEventListener('message', handleMessage);
-  }
-
-  private openIframe<T>(
-    url: string,
-    message: object,
-    resolve: (value: T) => void,
-    reject: (error: OpenKeyError) => void
-  ) {
-    // Create overlay
-    const overlay = document.createElement('div');
-    overlay.style.cssText = `
-      position: fixed;
-      inset: 0;
-      background: rgba(0, 0, 0, 0.5);
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      z-index: 999999;
-    `;
-
-    // Create iframe container
-    const container = document.createElement('div');
-    container.style.cssText = `
-      width: ${POPUP_WIDTH}px;
-      height: ${POPUP_HEIGHT}px;
-      background: #1a1a1a;
-      border-radius: 12px;
-      overflow: hidden;
-      box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
-    `;
-
-    // Create iframe
-    this.iframe = document.createElement('iframe');
-    this.iframe.src = url;
-    this.iframe.style.cssText = `
-      width: 100%;
-      height: 100%;
-      border: none;
-    `;
-
-    container.appendChild(this.iframe);
-    overlay.appendChild(container);
-    document.body.appendChild(overlay);
-
-    const cleanup = () => {
-      window.removeEventListener('message', handleMessage);
-      clearTimeout(timeout);
-      overlay.remove();
-      this.iframe = null;
-    };
-
-    // Close on overlay click
-    overlay.addEventListener('click', (e) => {
-      if (e.target === overlay) {
-        cleanup();
-        reject({
-          code: 'USER_CANCELLED',
-          message: 'User cancelled the request',
-        });
-      }
-    });
-
-    // Timeout
-    const timeout = setTimeout(() => {
-      cleanup();
-      reject({
-        code: 'TIMEOUT',
-        message: 'Request timed out',
-      });
-    }, DEFAULT_TIMEOUT);
-
-    // Listen for messages
-    const handleMessage = (event: MessageEvent) => {
-      if (event.origin !== this.host) return;
-
-      const data = event.data as MessageType;
-
-      if (data.type === 'openkey:ready') {
-        this.iframe?.contentWindow?.postMessage(message, this.host);
-        return;
-      }
-
-      if (data.type === 'openkey:close') {
-        cleanup();
-        reject({
-          code: 'USER_CANCELLED',
-          message: 'User cancelled the request',
-        });
-        return;
-      }
-
-      // Handle responses
-      if (
-        data.type === 'openkey:auth:response' ||
-        data.type === 'openkey:sign:response' ||
-        data.type === 'openkey:signTypedData:response'
-      ) {
-        cleanup();
-
-        if (data.success) {
-          if (data.type === 'openkey:auth:response') {
-            resolve({ address: data.address, keyId: data.keyId } as T);
-          } else {
-            resolve({ signature: data.signature, address: data.address } as T);
-          }
-        } else {
-          reject(data.error);
-        }
-      }
-    };
-
-    window.addEventListener('message', handleMessage);
-  }
-
-  /**
-   * Disconnect and close any open flows
-   */
-  disconnect() {
-    this.popup?.close();
-    this.popup = null;
-    this.iframe?.parentElement?.parentElement?.remove();
-    this.iframe = null;
-  }
-}
-
-// Default export for convenience
-export default OpenKey;
-
-// Create singleton instance
-let defaultInstance: OpenKey | null = null;
-
-export function getOpenKey(config?: OpenKeyConfig): OpenKey {
-  if (!defaultInstance || config) {
-    defaultInstance = new OpenKey(config);
-  }
-  return defaultInstance;
-}

package/tsconfig.json

@@ -1,10 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "lib": ["ES2022", "DOM"]
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}

package/tsup.config.ts

@@ -1,10 +0,0 @@
-import { defineConfig } from 'tsup';
-
-export default defineConfig({
-  entry: ['src/index.ts'],
-  format: ['esm', 'cjs'],
-  dts: true,
-  clean: true,
-  sourcemap: true,
-  minify: true,
-});