@openkey/sdk 0.0.1 → 0.0.3

package/README.md

@@ -0,0 +1,227 @@
+# @openkey/sdk
+
+The official JavaScript/TypeScript SDK for [OpenKey](https://openkey.so) - secure key management powered by passkeys.
+
+## What is OpenKey?
+
+OpenKey provides secure cryptographic key management using passkeys (WebAuthn). Instead of managing seed phrases or private keys directly, OpenKey stores your keys securely and lets you authorize operations with biometric authentication (Face ID, Touch ID, etc.).
+
+**Key features:**
+- **Passkey-secured keys** - Keys are protected by WebAuthn, not passwords
+- **No seed phrases** - Never worry about losing or exposing recovery phrases
+- **Popup-based signing** - Clean UX with authorization popups
+- **EIP-1193 compatible** - Works with ethers.js, viem, and other web3 libraries
+
+## Installation
+
+```bash
+npm install @openkey/sdk
+# or
+yarn add @openkey/sdk
+# or
+bun add @openkey/sdk
+```
+
+## Quick Start
+
+```typescript
+import { OpenKey } from '@openkey/sdk';
+
+// Initialize the SDK
+const openkey = new OpenKey({
+  host: 'https://openkey.so', // Production
+  // host: 'http://localhost:5173', // Development
+});
+
+// Connect to OpenKey (opens popup for user to select/create a key)
+const { address, keyId } = await openkey.connect();
+console.log('Connected:', address);
+
+// Sign a message (opens popup for user approval)
+const signature = await openkey.signMessage({
+  message: 'Hello, OpenKey!',
+  keyId,
+});
+console.log('Signature:', signature);
+```
+
+## API Reference
+
+### `new OpenKey(options)`
+
+Create a new OpenKey instance.
+
+```typescript
+const openkey = new OpenKey({
+  host: 'https://openkey.so', // OpenKey server URL
+});
+```
+
+**Options:**
+- `host` (string): The OpenKey server URL. Use `https://openkey.so` for production.
+
+### `openkey.connect()`
+
+Opens the OpenKey popup for the user to authenticate and select a key.
+
+```typescript
+const { address, keyId } = await openkey.connect();
+```
+
+**Returns:**
+- `address` (string): The Ethereum address of the selected key
+- `keyId` (string): The unique identifier for the key (used in signing operations)
+
+### `openkey.signMessage(params)`
+
+Sign a message with the user's key. Opens a popup for user approval.
+
+```typescript
+const signature = await openkey.signMessage({
+  message: 'Hello, World!',
+  keyId: 'key-id-from-connect',
+});
+```
+
+**Parameters:**
+- `message` (string): The message to sign
+- `keyId` (string): The key ID from `connect()`
+
+**Returns:**
+- `signature` (string): The hex-encoded signature
+
+### `openkey.signTypedData(params)`
+
+Sign EIP-712 typed data with the user's key.
+
+```typescript
+const signature = await openkey.signTypedData({
+  domain: {
+    name: 'My App',
+    version: '1',
+    chainId: 1,
+  },
+  types: {
+    Message: [{ name: 'content', type: 'string' }],
+  },
+  primaryType: 'Message',
+  message: {
+    content: 'Hello!',
+  },
+  keyId: 'key-id-from-connect',
+});
+```
+
+## Integration with ethers.js
+
+OpenKey can be used as an EIP-1193 provider with ethers.js:
+
+```typescript
+import { OpenKey } from '@openkey/sdk';
+import { BrowserProvider } from 'ethers';
+
+// Create OpenKey instance
+const openkey = new OpenKey({ host: 'https://openkey.so' });
+
+// Connect and get the address
+const { address, keyId } = await openkey.connect();
+
+// Create an EIP-1193 compatible provider
+const eip1193Provider = {
+  async request({ method, params }: { method: string; params?: any[] }) {
+    switch (method) {
+      case 'eth_accounts':
+      case 'eth_requestAccounts':
+        return [address];
+      case 'eth_chainId':
+        return '0x1'; // Mainnet
+      case 'personal_sign': {
+        const message = hexToString(params![0]);
+        const result = await openkey.signMessage({ message, keyId });
+        return result.signature;
+      }
+      default:
+        throw new Error(`Unsupported method: ${method}`);
+    }
+  },
+};
+
+// Use with ethers
+const provider = new BrowserProvider(eip1193Provider);
+const signer = await provider.getSigner();
+```
+
+## Integration with TinyCloud
+
+OpenKey works seamlessly with [TinyCloud](https://tinycloud.xyz) for decentralized storage:
+
+```typescript
+import { OpenKey } from '@openkey/sdk';
+import { TinyCloudWeb } from '@tinycloud/web-sdk';
+import { BrowserProvider } from 'ethers';
+
+// Setup OpenKey
+const openkey = new OpenKey({ host: 'https://openkey.so' });
+const { address, keyId } = await openkey.connect();
+
+// Create EIP-1193 provider (see above)
+const eip1193Provider = createOpenKeyProvider(openkey, address, keyId);
+const ethersProvider = new BrowserProvider(eip1193Provider);
+
+// Initialize TinyCloud with OpenKey as the signer
+const tcw = new TinyCloudWeb({
+  providers: {
+    web3: {
+      driver: ethersProvider,
+    },
+  },
+});
+
+// Sign in to TinyCloud (uses OpenKey for SIWE signature)
+await tcw.signIn();
+
+// Now you can use TinyCloud storage
+await tcw.kv.put('hello', 'world');
+const result = await tcw.kv.get('hello');
+```
+
+## Development
+
+For local development, point the SDK to your local OpenKey instance:
+
+```typescript
+const openkey = new OpenKey({
+  host: 'http://localhost:5173',
+});
+```
+
+You can also enable dev mode in your app to use local OpenKey:
+
+```javascript
+localStorage.setItem('__DEV_MODE__', 'true');
+```
+
+## Browser Support
+
+OpenKey requires WebAuthn support:
+- Chrome 67+
+- Firefox 60+
+- Safari 13+
+- Edge 79+
+
+## Security
+
+- Keys never leave the OpenKey TEE (Trusted Execution Environment)
+- All signing operations require explicit user approval via passkey
+- No seed phrases or private keys to manage or lose
+
+## Links
+
+- [OpenKey Website](https://openkey.so)
+- [Documentation](https://docs.openkey.so)
+- [GitHub](https://github.com/AstroX11/openkey)
+- [TinyCloud Integration](https://tinycloud.xyz)
+
+## License
+
+MIT

package/dist/index.d.mts

@@ -0,0 +1,190 @@
+interface EIP1193Provider {
+    request(args: {
+        method: string;
+        params?: any[];
+    }): Promise<any>;
+}
+interface OpenKeyConfig {
+    /** OpenKey host URL (default: https://openkey.so) */
+    host?: string;
+    /** App identifier for display */
+    appName?: string;
+    /** Use popup instead of iframe (default: true) */
+    usePopup?: boolean;
+    /** App-provided wallet provider for external key signing */
+    externalProvider?: EIP1193Provider;
+}
+interface SignMessageRequest {
+    message: string;
+    keyId?: string;
+}
+interface SignTypedDataRequest {
+    domain: {
+        name?: string;
+        version?: string;
+        chainId?: number;
+        verifyingContract?: string;
+    };
+    types: Record<string, Array<{
+        name: string;
+        type: string;
+    }>>;
+    primaryType: string;
+    message: Record<string, unknown>;
+    keyId?: string;
+}
+interface SignResult {
+    signature: string;
+    address: string;
+}
+interface AuthResult {
+    address: string;
+    keyId: string;
+    keyType: 'MANAGED' | 'EXTERNAL';
+}
+interface OpenKeyError {
+    code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';
+    message: string;
+}
+/** OAuth configuration for third-party apps */
+interface OAuthConfig {
+    /** OAuth client_id (registered with OpenKey) */
+    clientId: string;
+    /** Redirect URI (must match registered URI) */
+    redirectUri: string;
+    /** State parameter for CSRF protection (auto-generated if not provided) */
+    state?: string;
+}
+/** Result from OAuth authorization */
+interface OAuthResult {
+    /** Authorization code (exchange for tokens) */
+    code: string;
+    /** State parameter (verify matches request) */
+    state: string;
+}
+/** Response from token exchange */
+interface OAuthTokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    id_token: string;
+    scope: string;
+    refresh_token?: string;
+}
+declare class OpenKey {
+    private host;
+    private appName;
+    private usePopup;
+    private config;
+    private popup;
+    private iframe;
+    private lastAuth;
+    private discoveredProviders;
+    constructor(config?: OpenKeyConfig);
+    /**
+     * Connect to OpenKey and get user's wallet address
+     * Opens auth flow for user to select/create a key
+     */
+    connect(): Promise<AuthResult>;
+    /**
+     * Link an external wallet to the user's OpenKey account
+     * Opens link-wallet widget flow
+     */
+    linkWallet(): Promise<{
+        address: string;
+        keyId: string;
+    }>;
+    /**
+     * Sign a message with the user's OpenKey wallet
+     * For external keys, routes directly to the user's wallet provider
+     */
+    signMessage(request: SignMessageRequest): Promise<SignResult>;
+    /**
+     * Sign typed data (EIP-712) with the user's OpenKey wallet
+     * For external keys, routes directly to the user's wallet provider
+     */
+    signTypedData(request: SignTypedDataRequest): Promise<SignResult>;
+    /**
+     * Find a wallet provider that controls the given address.
+     * Checks: 1) app-provided externalProvider, 2) EIP-6963 discovered wallets, 3) window.ethereum
+     */
+    findWalletProvider(targetAddress: string): Promise<EIP1193Provider>;
+    private signWithExternalWallet;
+    private signTypedDataWithExternalWallet;
+    private signWithPopup;
+    private signTypedDataWithPopup;
+    private toHex;
+    /**
+     * Check if user is already authenticated
+     */
+    isConnected(): Promise<boolean>;
+    /**
+     * OAuth 2.1 methods for third-party app authentication
+     * Use this when your app has registered OAuth client credentials with OpenKey
+     */
+    oauth: {
+        /**
+         * Start OAuth authorization flow
+         * Opens popup/redirect to OpenKey authorization endpoint
+         * @returns Promise that resolves with authorization code after user consent
+         */
+        connect: (config: OAuthConfig) => Promise<OAuthResult>;
+        /**
+         * Exchange authorization code for tokens
+         * Call this after receiving the callback with authorization code
+         * @param code - Authorization code from callback URL
+         * @param config - Same config used for connect()
+         * @returns Promise that resolves with access_token, id_token, etc.
+         */
+        exchangeCode: (code: string, config: OAuthConfig) => Promise<OAuthTokenResponse>;
+        /**
+         * Verify state parameter from callback
+         * Call this before exchangeCode to prevent CSRF attacks
+         * @param receivedState - State parameter from callback URL
+         * @returns true if state matches, false otherwise
+         */
+        verifyState: (receivedState: string) => boolean;
+        /**
+         * Parse authorization response from callback URL
+         * @param url - Callback URL (defaults to current window.location.href)
+         * @returns Parsed code and state, or error
+         */
+        parseCallback: (url?: string) => {
+            code: string;
+            state: string;
+        } | {
+            error: string;
+            errorDescription?: string;
+        };
+    };
+    private openOAuthFlow;
+    private openOAuthPopup;
+    private openFlow;
+    private openPopup;
+    private openIframe;
+    /**
+     * Disconnect and close any open flows
+     */
+    disconnect(): void;
+}
+/**
+ * Unified EIP-1193 provider that wraps an OpenKey instance.
+ * Transparently routes signing to either OpenKey (managed keys) or the user's
+ * wallet (external keys).
+ */
+declare class OpenKeyEIP1193Provider implements EIP1193Provider {
+    private openkey;
+    private address;
+    private keyId;
+    private keyType;
+    constructor(openkey: OpenKey, authResult: AuthResult);
+    request({ method, params }: {
+        method: string;
+        params?: any[];
+    }): Promise<any>;
+    private hexToString;
+}
+
+declare function getOpenKey(config?: OpenKeyConfig): OpenKey;
+
+export { type AuthResult, type EIP1193Provider, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, OpenKeyEIP1193Provider, type OpenKeyError, type SignMessageRequest, type SignResult, type SignTypedDataRequest, OpenKey as default, getOpenKey };

package/dist/index.d.ts

@@ -1,3 +1,9 @@
+interface EIP1193Provider {
+    request(args: {
+        method: string;
+        params?: any[];
+    }): Promise<any>;
+}
 interface OpenKeyConfig {
     /** OpenKey host URL (default: https://openkey.so) */
     host?: string;
@@ -5,6 +11,8 @@ interface OpenKeyConfig {
     appName?: string;
     /** Use popup instead of iframe (default: true) */
     usePopup?: boolean;
+    /** App-provided wallet provider for external key signing */
+    externalProvider?: EIP1193Provider;
 }
 interface SignMessageRequest {
     message: string;
@@ -32,35 +40,125 @@ interface SignResult {
 interface AuthResult {
     address: string;
     keyId: string;
+    keyType: 'MANAGED' | 'EXTERNAL';
 }
 interface OpenKeyError {
-    code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN';
+    code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';
     message: string;
 }
+/** OAuth configuration for third-party apps */
+interface OAuthConfig {
+    /** OAuth client_id (registered with OpenKey) */
+    clientId: string;
+    /** Redirect URI (must match registered URI) */
+    redirectUri: string;
+    /** State parameter for CSRF protection (auto-generated if not provided) */
+    state?: string;
+}
+/** Result from OAuth authorization */
+interface OAuthResult {
+    /** Authorization code (exchange for tokens) */
+    code: string;
+    /** State parameter (verify matches request) */
+    state: string;
+}
+/** Response from token exchange */
+interface OAuthTokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    id_token: string;
+    scope: string;
+    refresh_token?: string;
+}
 declare class OpenKey {
     private host;
     private appName;
     private usePopup;
+    private config;
     private popup;
     private iframe;
+    private lastAuth;
+    private discoveredProviders;
     constructor(config?: OpenKeyConfig);
     /**
      * Connect to OpenKey and get user's wallet address
      * Opens auth flow for user to select/create a key
      */
     connect(): Promise<AuthResult>;
+    /**
+     * Link an external wallet to the user's OpenKey account
+     * Opens link-wallet widget flow
+     */
+    linkWallet(): Promise<{
+        address: string;
+        keyId: string;
+    }>;
     /**
      * Sign a message with the user's OpenKey wallet
+     * For external keys, routes directly to the user's wallet provider
      */
     signMessage(request: SignMessageRequest): Promise<SignResult>;
     /**
      * Sign typed data (EIP-712) with the user's OpenKey wallet
+     * For external keys, routes directly to the user's wallet provider
      */
     signTypedData(request: SignTypedDataRequest): Promise<SignResult>;
+    /**
+     * Find a wallet provider that controls the given address.
+     * Checks: 1) app-provided externalProvider, 2) EIP-6963 discovered wallets, 3) window.ethereum
+     */
+    findWalletProvider(targetAddress: string): Promise<EIP1193Provider>;
+    private signWithExternalWallet;
+    private signTypedDataWithExternalWallet;
+    private signWithPopup;
+    private signTypedDataWithPopup;
+    private toHex;
     /**
      * Check if user is already authenticated
      */
     isConnected(): Promise<boolean>;
+    /**
+     * OAuth 2.1 methods for third-party app authentication
+     * Use this when your app has registered OAuth client credentials with OpenKey
+     */
+    oauth: {
+        /**
+         * Start OAuth authorization flow
+         * Opens popup/redirect to OpenKey authorization endpoint
+         * @returns Promise that resolves with authorization code after user consent
+         */
+        connect: (config: OAuthConfig) => Promise<OAuthResult>;
+        /**
+         * Exchange authorization code for tokens
+         * Call this after receiving the callback with authorization code
+         * @param code - Authorization code from callback URL
+         * @param config - Same config used for connect()
+         * @returns Promise that resolves with access_token, id_token, etc.
+         */
+        exchangeCode: (code: string, config: OAuthConfig) => Promise<OAuthTokenResponse>;
+        /**
+         * Verify state parameter from callback
+         * Call this before exchangeCode to prevent CSRF attacks
+         * @param receivedState - State parameter from callback URL
+         * @returns true if state matches, false otherwise
+         */
+        verifyState: (receivedState: string) => boolean;
+        /**
+         * Parse authorization response from callback URL
+         * @param url - Callback URL (defaults to current window.location.href)
+         * @returns Parsed code and state, or error
+         */
+        parseCallback: (url?: string) => {
+            code: string;
+            state: string;
+        } | {
+            error: string;
+            errorDescription?: string;
+        };
+    };
+    private openOAuthFlow;
+    private openOAuthPopup;
     private openFlow;
     private openPopup;
     private openIframe;
@@ -69,7 +167,24 @@ declare class OpenKey {
      */
     disconnect(): void;
 }
+/**
+ * Unified EIP-1193 provider that wraps an OpenKey instance.
+ * Transparently routes signing to either OpenKey (managed keys) or the user's
+ * wallet (external keys).
+ */
+declare class OpenKeyEIP1193Provider implements EIP1193Provider {
+    private openkey;
+    private address;
+    private keyId;
+    private keyType;
+    constructor(openkey: OpenKey, authResult: AuthResult);
+    request({ method, params }: {
+        method: string;
+        params?: any[];
+    }): Promise<any>;
+    private hexToString;
+}
 
 declare function getOpenKey(config?: OpenKeyConfig): OpenKey;
 
-export { type AuthResult, OpenKey, type OpenKeyConfig, type OpenKeyError, type SignMessageRequest, type SignResult, type SignTypedDataRequest, OpenKey as default, getOpenKey };
+export { type AuthResult, type EIP1193Provider, type OAuthConfig, type OAuthResult, type OAuthTokenResponse, OpenKey, type OpenKeyConfig, OpenKeyEIP1193Provider, type OpenKeyError, type SignMessageRequest, type SignResult, type SignTypedDataRequest, OpenKey as default, getOpenKey };

package/dist/index.js

@@ -1,4 +1,4 @@
-var h="https://openkey.so";var c=class{host;appName;usePopup;popup=null;iframe=null;constructor(e={}){this.host=e.host||h,this.appName=e.appName||window.location.hostname,this.usePopup=e.usePopup??!0}async connect(){return this.openFlow("connect",{type:"openkey:auth:request",appName:this.appName})}async signMessage(e){return this.openFlow("sign",{type:"openkey:sign:request",message:e.message,keyId:e.keyId})}async signTypedData(e){return this.openFlow("sign-typed-data",{type:"openkey:signTypedData:request",data:e})}async isConnected(){try{let e=await fetch(`${this.host}/api/auth/session`,{credentials:"include"});return e.ok?!!(await e.json()).user:!1}catch{return!1}}async openFlow(e,a){return new Promise((i,t)=>{let r=`${this.host}/widget/${e}?origin=${encodeURIComponent(window.location.origin)}`;this.usePopup?this.openPopup(r,a,i,t):this.openIframe(r,a,i,t)})}openPopup(e,a,i,t){let r=window.screenX+(window.outerWidth-400)/2,d=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(e,"openkey",`width=400,height=600,left=${r},top=${d},popup=true`),!this.popup){t({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups for this site."});return}let o=()=>{window.removeEventListener("message",p),clearInterval(g),clearTimeout(u)},g=setInterval(()=>{this.popup?.closed&&(o(),t({code:"USER_CANCELLED",message:"User closed the popup"}))},500),u=setTimeout(()=>{o(),this.popup?.close(),t({code:"TIMEOUT",message:"Request timed out"})},3e5),p=s=>{if(s.origin!==this.host)return;let n=s.data;if(n.type==="openkey:ready"){this.popup?.postMessage(a,this.host);return}if(n.type==="openkey:close"){o(),this.popup?.close(),t({code:"USER_CANCELLED",message:"User cancelled the request"});return}(n.type==="openkey:auth:response"||n.type==="openkey:sign:response"||n.type==="openkey:signTypedData:response")&&(o(),this.popup?.close(),n.success?n.type==="openkey:auth:response"?i({address:n.address,keyId:n.keyId}):i({signature:n.signature,address:n.address}):t(n.error))};window.addEventListener("message",p)}openIframe(e,a,i,t){let r=document.createElement("div");r.style.cssText=`
+"use strict";var w=Object.defineProperty;var O=Object.getOwnPropertyDescriptor;var U=Object.getOwnPropertyNames;var _=Object.prototype.hasOwnProperty;var R=(a,e)=>{for(var t in e)w(a,t,{get:e[t],enumerable:!0})},S=(a,e,t,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of U(e))!_.call(a,r)&&r!==t&&w(a,r,{get:()=>e[r],enumerable:!(s=O(e,r))||s.enumerable});return a};var D=a=>S(w({},"__esModule",{value:!0}),a);var W={};R(W,{OpenKey:()=>m,OpenKeyEIP1193Provider:()=>E,default:()=>M,getOpenKey:()=>H});module.exports=D(W);var x="https://openkey.so";var P="openkey_oauth";function k(a){return btoa(String.fromCharCode(...a)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function C(){let a=new Uint8Array(32);return crypto.getRandomValues(a),k(a)}async function L(a){let t=new TextEncoder().encode(a),s=await crypto.subtle.digest("SHA-256",t);return k(new Uint8Array(s))}function N(){let a=new Uint8Array(16);return crypto.getRandomValues(a),k(a)}var m=class{host;appName;usePopup;config;popup=null;iframe=null;lastAuth=null;discoveredProviders=[];constructor(e={}){this.config=e,this.host=e.host||x,this.appName=e.appName||window.location.hostname,this.usePopup=e.usePopup??!0,typeof window<"u"&&(this.discoveredProviders=[],window.addEventListener("eip6963:announceProvider",t=>{this.discoveredProviders.push(t.detail)}),window.dispatchEvent(new Event("eip6963:requestProvider")))}async connect(){let e=await this.openFlow("connect",{type:"openkey:auth:request",appName:this.appName});return this.lastAuth=e,e}async linkWallet(){return this.openFlow("link-wallet",{type:"openkey:link-wallet:request"})}async signMessage(e){var t;return((t=this.lastAuth)==null?void 0:t.keyType)==="EXTERNAL"?this.signWithExternalWallet(e):this.signWithPopup(e)}async signTypedData(e){var t;return((t=this.lastAuth)==null?void 0:t.keyType)==="EXTERNAL"?this.signTypedDataWithExternalWallet(e):this.signTypedDataWithPopup(e)}async findWalletProvider(e){if(this.config.externalProvider)return this.config.externalProvider;for(let{provider:t}of this.discoveredProviders)try{if((await t.request({method:"eth_accounts"})).some(r=>r.toLowerCase()===e.toLowerCase()))return t}catch{}if(typeof window<"u"&&window.ethereum)return window.ethereum;throw new Error("No wallet provider found for external key. Connect your wallet.")}async signWithExternalWallet(e){let t=await this.findWalletProvider(this.lastAuth.address),s=this.toHex(e.message);return{signature:await t.request({method:"personal_sign",params:[s,this.lastAuth.address]}),address:this.lastAuth.address}}async signTypedDataWithExternalWallet(e){return{signature:await(await this.findWalletProvider(this.lastAuth.address)).request({method:"eth_signTypedData_v4",params:[this.lastAuth.address,JSON.stringify(e)]}),address:this.lastAuth.address}}signWithPopup(e){return this.openFlow("sign",{type:"openkey:sign:request",message:e.message,keyId:e.keyId})}signTypedDataWithPopup(e){return this.openFlow("sign-typed-data",{type:"openkey:signTypedData:request",data:e})}toHex(e){return"0x"+Array.from(new TextEncoder().encode(e)).map(t=>t.toString(16).padStart(2,"0")).join("")}async isConnected(){try{let e=await fetch(`${this.host}/api/auth/session`,{credentials:"include"});return e.ok?!!(await e.json()).user:!1}catch{return!1}}oauth={connect:async e=>{let t=await C(),s=await L(t),r=e.state||N();sessionStorage.setItem(P,JSON.stringify({verifier:t,state:r}));let n=new URL(`${this.host}/api/auth/oauth2/authorize`);return n.searchParams.set("client_id",e.clientId),n.searchParams.set("redirect_uri",e.redirectUri),n.searchParams.set("response_type","code"),n.searchParams.set("scope","openid"),n.searchParams.set("state",r),n.searchParams.set("code_challenge",s),n.searchParams.set("code_challenge_method","S256"),this.openOAuthFlow(n.toString(),r,e.redirectUri)},exchangeCode:async(e,t)=>{let s=sessionStorage.getItem(P);if(!s)throw new Error("No PKCE verifier found. Start a new OAuth flow.");let{verifier:r}=JSON.parse(s),n=await fetch(`${this.host}/api/auth/oauth2/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:e,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:r})});if(sessionStorage.removeItem(P),!n.ok){let c=await n.json();throw new Error(c.error_description||"Token exchange failed")}return n.json()},verifyState:e=>{let t=sessionStorage.getItem(P);if(!t)return!1;let{state:s}=JSON.parse(t);return s===e},parseCallback:e=>{let t=new URL(e||window.location.href),s=t.searchParams.get("error");if(s)return{error:s,errorDescription:t.searchParams.get("error_description")||void 0};let r=t.searchParams.get("code"),n=t.searchParams.get("state");return!r||!n?{error:"missing_params",errorDescription:"Missing code or state parameter"}:{code:r,state:n}}};openOAuthFlow(e,t,s){return new Promise((r,n)=>{this.usePopup?this.openOAuthPopup(e,t,s,r,n):window.location.href=e})}openOAuthPopup(e,t,s,r,n){let c=window.screenX+(window.outerWidth-400)/2,p=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(e,"openkey-oauth",`width=400,height=600,left=${c},top=${p},popup=true`),!this.popup){n({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups or use redirect mode."});return}let h=new URL(s).origin,u=setInterval(()=>{var i,o,l,y;try{if((i=this.popup)!=null&&i.closed){clearInterval(u),clearTimeout(d),n({code:"USER_CANCELLED",message:"User closed the popup"});return}let g=(l=(o=this.popup)==null?void 0:o.location)==null?void 0:l.href;if(g&&g.startsWith(h)){clearInterval(u),clearTimeout(d);let f=new URL(g),v=f.searchParams.get("code"),I=f.searchParams.get("state"),A=f.searchParams.get("error");if((y=this.popup)==null||y.close(),A){n({code:"UNAUTHORIZED",message:f.searchParams.get("error_description")||A});return}if(I!==t){n({code:"STATE_MISMATCH",message:"State mismatch - possible CSRF attack"});return}v?r({code:v,state:I}):n({code:"UNAUTHORIZED",message:"Authorization failed - no code returned"})}}catch{}},100),d=setTimeout(()=>{var i;clearInterval(u),(i=this.popup)==null||i.close(),n({code:"TIMEOUT",message:"OAuth flow timed out"})},3e5)}async openFlow(e,t){return new Promise((s,r)=>{let n=`${this.host}/widget/${e}?origin=${encodeURIComponent(window.location.origin)}`;this.usePopup?this.openPopup(n,t,s,r):this.openIframe(n,t,s,r)})}openPopup(e,t,s,r){let n=window.screenX+(window.outerWidth-400)/2,c=window.screenY+(window.outerHeight-600)/2;if(this.popup=window.open(e,"openkey",`width=400,height=600,left=${n},top=${c},popup=true`),!this.popup){r({code:"POPUP_BLOCKED",message:"Popup was blocked. Please allow popups for this site."});return}let p=()=>{window.removeEventListener("message",d),clearInterval(h),clearTimeout(u)},h=setInterval(()=>{var i;(i=this.popup)!=null&&i.closed&&(p(),r({code:"USER_CANCELLED",message:"User closed the popup"}))},500),u=setTimeout(()=>{var i;p(),(i=this.popup)==null||i.close(),r({code:"TIMEOUT",message:"Request timed out"})},3e5),d=i=>{var l,y,g;if(i.origin!==this.host)return;let o=i.data;if(o.type==="openkey:ready"){(l=this.popup)==null||l.postMessage(t,this.host);return}if(o.type==="openkey:close"){p(),(y=this.popup)==null||y.close(),r({code:"USER_CANCELLED",message:"User cancelled the request"});return}(o.type==="openkey:auth:response"||o.type==="openkey:sign:response"||o.type==="openkey:signTypedData:response"||o.type==="openkey:link-wallet:response")&&(p(),(g=this.popup)==null||g.close(),o.success?o.type==="openkey:auth:response"?s({address:o.address,keyId:o.keyId,keyType:o.keyType||"MANAGED"}):o.type==="openkey:link-wallet:response"?s({address:o.address,keyId:o.keyId}):s({signature:o.signature,address:o.address}):r(o.error))};window.addEventListener("message",d)}openIframe(e,t,s,r){let n=document.createElement("div");n.style.cssText=`
       position: fixed;
       inset: 0;
       background: rgba(0, 0, 0, 0.5);
@@ -6,7 +6,7 @@ var h="https://openkey.so";var c=class{host;appName;usePopup;popup=null;iframe=n
       align-items: center;
       justify-content: center;
       z-index: 999999;
-    `;let d=document.createElement("div");d.style.cssText=`
+    `;let c=document.createElement("div");c.style.cssText=`
       width: 400px;
       height: 600px;
       background: #1a1a1a;
@@ -17,5 +17,5 @@ var h="https://openkey.so";var c=class{host;appName;usePopup;popup=null;iframe=n
       width: 100%;
       height: 100%;
       border: none;
-    `,d.appendChild(this.iframe),r.appendChild(d),document.body.appendChild(r);let o=()=>{window.removeEventListener("message",u),clearTimeout(g),r.remove(),this.iframe=null};r.addEventListener("click",p=>{p.target===r&&(o(),t({code:"USER_CANCELLED",message:"User cancelled the request"}))});let g=setTimeout(()=>{o(),t({code:"TIMEOUT",message:"Request timed out"})},3e5),u=p=>{if(p.origin!==this.host)return;let s=p.data;if(s.type==="openkey:ready"){this.iframe?.contentWindow?.postMessage(a,this.host);return}if(s.type==="openkey:close"){o(),t({code:"USER_CANCELLED",message:"User cancelled the request"});return}(s.type==="openkey:auth:response"||s.type==="openkey:sign:response"||s.type==="openkey:signTypedData:response")&&(o(),s.success?s.type==="openkey:auth:response"?i({address:s.address,keyId:s.keyId}):i({signature:s.signature,address:s.address}):t(s.error))};window.addEventListener("message",u)}disconnect(){this.popup?.close(),this.popup=null,this.iframe?.parentElement?.parentElement?.remove(),this.iframe=null}},m=c,l=null;function T(y){return(!l||y)&&(l=new c(y)),l}export{c as OpenKey,m as default,T as getOpenKey};
+    `,c.appendChild(this.iframe),n.appendChild(c),document.body.appendChild(n);let p=()=>{window.removeEventListener("message",u),clearTimeout(h),n.remove(),this.iframe=null};n.addEventListener("click",d=>{d.target===n&&(p(),r({code:"USER_CANCELLED",message:"User cancelled the request"}))});let h=setTimeout(()=>{p(),r({code:"TIMEOUT",message:"Request timed out"})},3e5),u=d=>{var o,l;if(d.origin!==this.host)return;let i=d.data;if(i.type==="openkey:ready"){(l=(o=this.iframe)==null?void 0:o.contentWindow)==null||l.postMessage(t,this.host);return}if(i.type==="openkey:close"){p(),r({code:"USER_CANCELLED",message:"User cancelled the request"});return}(i.type==="openkey:auth:response"||i.type==="openkey:sign:response"||i.type==="openkey:signTypedData:response"||i.type==="openkey:link-wallet:response")&&(p(),i.success?i.type==="openkey:auth:response"?s({address:i.address,keyId:i.keyId,keyType:i.keyType||"MANAGED"}):i.type==="openkey:link-wallet:response"?s({address:i.address,keyId:i.keyId}):s({signature:i.signature,address:i.address}):r(i.error))};window.addEventListener("message",u)}disconnect(){var e,t,s,r;(e=this.popup)==null||e.close(),this.popup=null,(r=(s=(t=this.iframe)==null?void 0:t.parentElement)==null?void 0:s.parentElement)==null||r.remove(),this.iframe=null}},E=class{openkey;address;keyId;keyType;constructor(e,t){this.openkey=e,this.address=t.address,this.keyId=t.keyId,this.keyType=t.keyType}async request({method:e,params:t}){switch(e){case"eth_accounts":case"eth_requestAccounts":return[this.address];case"eth_chainId":return"0x1";case"personal_sign":{if(this.keyType==="EXTERNAL")return(await this.openkey.findWalletProvider(this.address)).request({method:e,params:t});let s=this.hexToString(t[0]);return(await this.openkey.signMessage({message:s,keyId:this.keyId})).signature}case"eth_signTypedData_v4":{if(this.keyType==="EXTERNAL")return(await this.openkey.findWalletProvider(this.address)).request({method:e,params:t});let s=JSON.parse(t[1]);return(await this.openkey.signTypedData(s)).signature}default:throw new Error(`Unsupported method: ${e}`)}}hexToString(e){let t=new Uint8Array((e.startsWith("0x")?e.slice(2):e).match(/.{1,2}/g).map(s=>parseInt(s,16)));return new TextDecoder().decode(t)}},M=m,T=null;function H(a){return(!T||a)&&(T=new m(a)),T}0&&(module.exports={OpenKey,OpenKeyEIP1193Provider,getOpenKey});
 //# sourceMappingURL=index.js.map