@openkey/sdk 0.10.0 → 0.10.1

package/dist/index.mjs

@@ -239,12 +239,16 @@ function validateIframeResize(incoming, expected) {
   if (!incoming || typeof incoming !== "object") return null;
   const data = incoming;
   if (data.type !== "openkey:resize") return null;
-  if (expected.requestId === null || expected.protocolVersion === null) return null;
-  if (typeof data.protocolVersion !== "number" || data.protocolVersion !== expected.protocolVersion) {
-    return null;
-  }
-  if (typeof data.requestId !== "string" || data.requestId !== expected.requestId) {
-    return null;
+  if (expected.requestId === null && expected.protocolVersion === null) {
+    if (data.requestId !== void 0) return null;
+  } else {
+    if (expected.requestId === null || expected.protocolVersion === null) return null;
+    if (typeof data.protocolVersion !== "number" || data.protocolVersion !== expected.protocolVersion) {
+      return null;
+    }
+    if (typeof data.requestId !== "string" || data.requestId !== expected.requestId) {
+      return null;
+    }
   }
   if (typeof data.height !== "number" || !Number.isFinite(data.height) || data.height <= 0) {
     return null;
@@ -320,11 +324,11 @@ var IframeModal = class {
   onMessage;
   messageHandler;
   host;
-  // Sol final continuation contract requirement 5: iframe resize traffic
-  // MUST correlate to the active request's requestId AND protocolVersion.
-  // Set by `setExpectedCorrelation` after the outer flow decides which
-  // request this modal is bound to. When both are null, resize messages
-  // are dropped (no active request → no resize authority).
+  // Sol final continuation contract requirement 5: when the modal carries a
+  // versioned request, iframe resize traffic MUST correlate to its
+  // requestId AND protocolVersion. Set by `setExpectedCorrelation` as soon
+  // as the modal is created. When both are null the flow is unversioned and
+  // only uncorrelated resizes from this iframe are accepted (TC-647).
   expectedRequestId = null;
   expectedProtocolVersion = null;
   constructor(opts) {
@@ -406,10 +410,11 @@ var IframeModal = class {
    * request correlation so subsequent resize (and future correlated)
    * messages can be verified against `requestId` + `protocolVersion`.
    *
-   * The outer flow calls this immediately BEFORE posting the sign
-   * request into the iframe, so a resize that arrives synchronously
-   * after ready is correlated correctly. Passing `null` for either
-   * argument disables correlation (resize is dropped).
+   * The outer flow calls this right after creating the modal for a
+   * versioned request, before the iframe can send anything, so no
+   * uncorrelated resize is ever accepted for that request. Passing `null`
+   * for both arguments means the flow is unversioned; passing `null` for
+   * only one drops every resize.
    */
   setExpectedCorrelation(requestId, protocolVersion) {
     this.expectedRequestId = requestId;
@@ -1260,12 +1265,6 @@ var OpenKey = class {
         onMessage: (data) => {
           if (data.type === "openkey:ready") {
             readyReceived = true;
-            if (isVersionedRequest && modal) {
-              modal.setExpectedCorrelation(
-                outgoingRequestId,
-                outgoingProtocolVersion
-              );
-            }
             modal?.postMessage(message);
             return;
           }
@@ -1326,6 +1325,12 @@ var OpenKey = class {
           }
         }
       });
+      if (isVersionedRequest) {
+        modal.setExpectedCorrelation(
+          outgoingRequestId,
+          outgoingProtocolVersion
+        );
+      }
       const readyTimeout = setTimeout(() => {
         if (readyReceived || settled) return;
         cleanup();