@openkey/sdk 0.9.0 → 0.10.1

package/dist/index.mjs

@@ -1,16 +1,321 @@
+// ../core/dist/index.js
+var u = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function g(e) {
+  let r = "", n = e.length;
+  for (let t = 0; t < n; t += 3) {
+    let c = e[t], d = t + 1 < n ? e[t + 1] : 0, i = t + 2 < n ? e[t + 2] : 0, o = c << 16 | d << 8 | i;
+    r += u[o >> 18 & 63], r += u[o >> 12 & 63], r += t + 1 < n ? u[o >> 6 & 63] : "", r += t + 2 < n ? u[o & 63] : "";
+  }
+  return r.replace(/\+/g, "-").replace(/\//g, "_");
+}
+function y() {
+  let e = new Uint8Array(32);
+  return crypto.getRandomValues(e), g(e);
+}
+async function x(e) {
+  let n = new TextEncoder().encode(e), t = await crypto.subtle.digest("SHA-256", n);
+  return new Uint8Array(t);
+}
+async function k(e, r) {
+  let t = await (r ?? x)(e);
+  return g(t);
+}
+function m() {
+  let e = new Uint8Array(16);
+  return crypto.getRandomValues(e), g(e);
+}
+function T(e) {
+  let { host: r, clientId: n, redirectUri: t, codeChallenge: c, state: d, scopes: i, authorizePath: o = "/api/auth/oauth2/authorize" } = e, s = new URL(o, r);
+  return s.searchParams.set("client_id", n), s.searchParams.set("redirect_uri", t), s.searchParams.set("response_type", "code"), s.searchParams.set("scope", i.join(" ")), s.searchParams.set("state", d), s.searchParams.set("code_challenge", c), s.searchParams.set("code_challenge_method", "S256"), s.toString();
+}
+
+// src/nostr.ts
+var NOSTR_FRAME_TIMEOUT_MS = 5 * 60 * 1e3;
+var NOSTR_PROTOCOL_VERSION = 1;
+function newRequestId() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") {
+    throw new Error("Secure request-id generation is unavailable.");
+  }
+  const bytes = new Uint32Array(4);
+  crypto.getRandomValues(bytes);
+  return `nostr-${Array.from(bytes, (value) => value.toString(16)).join("")}`;
+}
+var NostrFrame = class {
+  root;
+  shadow;
+  iframe;
+  outer;
+  host;
+  messageHandler = () => {
+  };
+  revealed = false;
+  requestedHeight = 400;
+  viewportHandler = () => {
+    this.syncViewport();
+    this.applyFrameHeight();
+  };
+  constructor(host, url) {
+    this.host = host;
+    this.root = document.createElement("div");
+    this.shadow = this.root.attachShadow({ mode: "closed" });
+    const style = document.createElement("style");
+    style.textContent = `
+      :host{all:initial}
+      .nf-outer{position:fixed;top:-9999px;left:-9999px;width:1px;height:1px;overflow:hidden;opacity:0;pointer-events:none}
+      .nf-outer.nf-visible{position:fixed;top:var(--nf-viewport-top,0px);left:var(--nf-viewport-left,0px);width:var(--nf-viewport-width,100vw);height:var(--nf-viewport-height,100dvh);box-sizing:border-box;padding:max(16px,env(safe-area-inset-top)) max(16px,env(safe-area-inset-right)) max(16px,env(safe-area-inset-bottom)) max(16px,env(safe-area-inset-left));overflow:auto;overscroll-behavior:contain;opacity:1;pointer-events:auto;background:rgba(0,0,0,0.42);z-index:999999;display:flex;align-items:center;justify-content:center}
+      .nf-card{width:1px;height:1px;overflow:hidden}
+      .nf-visible .nf-card{background:#fafafa;width:min(400px,100%);height:auto;max-height:100%;border-radius:16px;box-shadow:0 25px 50px -12px rgba(0,0,0,0.25);overflow:auto;flex:0 1 auto}
+      iframe{border:none;width:1px;height:1px;display:block;transition:height 200ms ease}
+      .nf-visible iframe{width:100%;height:400px;max-height:100%}
+      @media (prefers-reduced-motion:reduce){iframe{transition:none}}
+    `;
+    this.outer = document.createElement("div");
+    this.outer.className = "nf-outer";
+    this.outer.setAttribute("role", "dialog");
+    this.outer.setAttribute("aria-modal", "true");
+    this.outer.setAttribute("aria-label", "OpenKey approval");
+    this.outer.setAttribute("aria-hidden", "true");
+    const card = document.createElement("div");
+    card.className = "nf-card";
+    this.iframe = document.createElement("iframe");
+    this.iframe.src = url;
+    this.iframe.title = "OpenKey approval";
+    this.iframe.setAttribute("allow", "clipboard-write *; publickey-credentials-get *; publickey-credentials-create *");
+    this.iframe.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox");
+    card.appendChild(this.iframe);
+    this.outer.appendChild(card);
+    this.shadow.appendChild(style);
+    this.shadow.appendChild(this.outer);
+    document.body.appendChild(this.root);
+    this.syncViewport();
+    window.addEventListener("resize", this.viewportHandler);
+    window.visualViewport?.addEventListener("resize", this.viewportHandler);
+    window.visualViewport?.addEventListener("scroll", this.viewportHandler);
+  }
+  onMessage(handler) {
+    this.messageHandler = (event) => {
+      if (event.origin !== this.host) return;
+      if (event.source !== this.iframe.contentWindow) return;
+      handler(event.data);
+    };
+    window.addEventListener("message", this.messageHandler);
+  }
+  reveal() {
+    if (this.revealed) return;
+    this.revealed = true;
+    this.syncViewport();
+    this.outer.classList.add("nf-visible");
+    this.outer.setAttribute("aria-hidden", "false");
+    this.applyFrameHeight();
+  }
+  resize(height) {
+    if (!Number.isFinite(height) || height <= 0) return;
+    this.requestedHeight = height;
+    if (this.revealed) this.applyFrameHeight();
+  }
+  syncViewport() {
+    const viewport = window.visualViewport;
+    this.outer.style.setProperty("--nf-viewport-top", `${viewport?.offsetTop ?? 0}px`);
+    this.outer.style.setProperty("--nf-viewport-left", `${viewport?.offsetLeft ?? 0}px`);
+    this.outer.style.setProperty("--nf-viewport-width", `${viewport?.width ?? window.innerWidth}px`);
+    this.outer.style.setProperty("--nf-viewport-height", `${viewport?.height ?? window.innerHeight}px`);
+  }
+  applyFrameHeight() {
+    if (!this.revealed) return;
+    const viewportHeight = window.visualViewport?.height ?? window.innerHeight;
+    const max = Math.max(1, Math.floor(viewportHeight - 32));
+    this.iframe.style.height = `${Math.min(this.requestedHeight, max)}px`;
+  }
+  postMessage(message) {
+    this.iframe.contentWindow?.postMessage(message, this.host);
+  }
+  destroy() {
+    window.removeEventListener("message", this.messageHandler);
+    window.removeEventListener("resize", this.viewportHandler);
+    window.visualViewport?.removeEventListener("resize", this.viewportHandler);
+    window.visualViewport?.removeEventListener("scroll", this.viewportHandler);
+    this.root.remove();
+  }
+};
+var OpenKeyNostr = class {
+  constructor(host) {
+    this.host = host;
+  }
+  /**
+   * Get-or-create the user's OpenKey-custodied Nostr identity. Always shows
+   * a visible consent card (identity creation, or - when `relayUrl` is
+   * given - a relay-scoped kind:22242/NIP-42 grant for that exact relay).
+   * Never resolves with the secret key; only `keyId`/`pubkey`/`npub`.
+   */
+  async connect(opts) {
+    const url = this.widgetUrl();
+    return this.run(
+      url,
+      { type: "openkey:nostr:connect:request", relayUrl: opts?.relayUrl },
+      (data, resolve, reject) => {
+        if (data.type !== "openkey:nostr:connect:response") return false;
+        if (data.success) resolve({ keyId: data.keyId, pubkey: data.pubkey, npub: data.npub });
+        else reject(data.error);
+        return true;
+      }
+    );
+  }
+  /**
+   * Sign a NIP-01 event template with the user's OpenKey Nostr key. Silent
+   * (no visible UI) when an active grant already covers this client origin
+   * + key + kind (+ exact relay, for kind 22242). Otherwise shows a visible
+   * consent card before signing - required for every first kind:9 message to
+   * a new origin, per NIP-29 channel-message policy.
+   */
+  async signEvent(keyId, event) {
+    const url = this.widgetUrl();
+    return this.run(
+      url,
+      { type: "openkey:nostr:sign:request", keyId, event },
+      (data, resolve, reject) => {
+        if (data.type !== "openkey:nostr:sign:response") return false;
+        if (data.success) resolve(data.event);
+        else reject(data.error);
+        return true;
+      }
+    );
+  }
+  widgetUrl() {
+    const origin = encodeURIComponent(window.location.origin);
+    return `${this.host}/widget/embed/nostr/approve?origin=${origin}`;
+  }
+  run(url, request, onData) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const frame = new NostrFrame(this.host, url);
+      const requestId = newRequestId();
+      const settle = (fn) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeout);
+        fn();
+        frame.destroy();
+      };
+      frame.onMessage((data) => {
+        if (!data || typeof data.type !== "string") return;
+        if (data.type === "openkey:ready") {
+          if (data.protocolVersion !== NOSTR_PROTOCOL_VERSION) return;
+          frame.postMessage({ ...request, requestId, protocolVersion: NOSTR_PROTOCOL_VERSION });
+          return;
+        }
+        if (data.requestId !== requestId || data.protocolVersion !== NOSTR_PROTOCOL_VERSION) return;
+        if (data.type === "openkey:resize") {
+          frame.resize(data.height);
+          return;
+        }
+        if (data.type === "openkey:nostr:show") {
+          frame.reveal();
+          return;
+        }
+        if (data.type === "openkey:close") {
+          settle(() => reject({ code: "USER_CANCELLED", message: "Request closed" }));
+          return;
+        }
+        onData(data, (v) => settle(() => resolve(v)), (e) => settle(() => reject(e)));
+      });
+      const timeout = setTimeout(() => {
+        settle(() => reject({ code: "TIMEOUT", message: "Nostr request timed out" }));
+      }, NOSTR_FRAME_TIMEOUT_MS);
+    });
+  }
+};
+
 // src/index.ts
-import {
-  generateCodeVerifier,
-  generateCodeChallenge,
-  generateState,
-  buildAuthorizationUrl
-} from "@openkey/core";
 var DEFAULT_HOST = "https://openkey.so";
 var POPUP_WIDTH = 400;
 var POPUP_HEIGHT = 600;
 var DEFAULT_TIMEOUT = 5 * 60 * 1e3;
 var IFRAME_READY_TIMEOUT = 3e3;
 var OAUTH_STORAGE_KEY = "openkey_oauth";
+function validateIframeResize(incoming, expected) {
+  if (!incoming || typeof incoming !== "object") return null;
+  const data = incoming;
+  if (data.type !== "openkey:resize") return null;
+  if (expected.requestId === null && expected.protocolVersion === null) {
+    if (data.requestId !== void 0) return null;
+  } else {
+    if (expected.requestId === null || expected.protocolVersion === null) return null;
+    if (typeof data.protocolVersion !== "number" || data.protocolVersion !== expected.protocolVersion) {
+      return null;
+    }
+    if (typeof data.requestId !== "string" || data.requestId !== expected.requestId) {
+      return null;
+    }
+  }
+  if (typeof data.height !== "number" || !Number.isFinite(data.height) || data.height <= 0) {
+    return null;
+  }
+  return Math.min(data.height, Math.floor(expected.viewportHeight * 0.85));
+}
+function shouldRouteAuthorizeTinyCloudExternal(state) {
+  return state.lastAuth?.keyType === "EXTERNAL";
+}
+var KeyIdTypeMismatchError = class extends Error {
+  code;
+  requestKeyId;
+  lastAuthKeyId;
+  requestKeyType;
+  lastAuthKeyType;
+  constructor(fields) {
+    super(fields.message);
+    this.name = "KeyIdTypeMismatchError";
+    this.code = "KEY_ID_TYPE_MISMATCH";
+    this.requestKeyId = fields.requestKeyId;
+    this.lastAuthKeyId = fields.lastAuthKeyId;
+    this.requestKeyType = fields.requestKeyType;
+    this.lastAuthKeyType = fields.lastAuthKeyType;
+  }
+};
+function resolveAuthorizeTinyCloudRouting(state) {
+  const lastAuthKeyId = state.lastAuth?.keyId ?? null;
+  const lastAuthKeyType = state.lastAuth?.keyType ?? null;
+  const rawRequestKeyId = state.requestKeyId ?? null;
+  const requestKeyId = rawRequestKeyId && rawRequestKeyId.length > 0 ? rawRequestKeyId : null;
+  const knownKeys = state.knownKeys ?? [];
+  const lookupType = (id) => {
+    for (const k2 of knownKeys) {
+      if (k2.id === id) return k2.keyType;
+      if (k2.address && k2.address.toLowerCase() === id.toLowerCase()) return k2.keyType;
+    }
+    if (id.startsWith("external:")) return "EXTERNAL";
+    return null;
+  };
+  if (!requestKeyId) {
+    const route = lastAuthKeyType === "EXTERNAL" ? "external" : "managed";
+    return {
+      route,
+      resolvedKeyId: lastAuthKeyId,
+      resolvedKeyType: lastAuthKeyType
+    };
+  }
+  let requestKeyType = lookupType(requestKeyId);
+  if (!requestKeyType && lastAuthKeyId && requestKeyId === lastAuthKeyId) {
+    requestKeyType = lastAuthKeyType;
+  }
+  if (requestKeyType && lastAuthKeyType && requestKeyType !== lastAuthKeyType) {
+    throw new KeyIdTypeMismatchError({
+      message: `authorizeTinyCloud: request.keyId ${requestKeyId} resolves to ${requestKeyType} but active session key ${lastAuthKeyId} is ${lastAuthKeyType}; refuse to route silently`,
+      requestKeyId,
+      lastAuthKeyId,
+      requestKeyType,
+      lastAuthKeyType
+    });
+  }
+  const effectiveType = requestKeyType ?? lastAuthKeyType;
+  return {
+    route: effectiveType === "EXTERNAL" ? "external" : "managed",
+    resolvedKeyId: requestKeyId,
+    resolvedKeyType: effectiveType
+  };
+}
 var IframeModal = class {
   root;
   shadow;
@@ -19,6 +324,13 @@ var IframeModal = class {
   onMessage;
   messageHandler;
   host;
+  // Sol final continuation contract requirement 5: when the modal carries a
+  // versioned request, iframe resize traffic MUST correlate to its
+  // requestId AND protocolVersion. Set by `setExpectedCorrelation` as soon
+  // as the modal is created. When both are null the flow is unversioned and
+  // only uncorrelated resizes from this iframe are accepted (TC-647).
+  expectedRequestId = null;
+  expectedProtocolVersion = null;
   constructor(opts) {
     this.host = opts.host;
     this.onClose = opts.onClose;
@@ -74,10 +386,17 @@ var IframeModal = class {
       if (event.source !== this.iframe.contentWindow) return;
       const data = event.data;
       if (data.type === "openkey:resize") {
-        const h = Math.min(data.height, Math.floor(window.innerHeight * 0.85));
+        const h = validateIframeResize(event.data, {
+          requestId: this.expectedRequestId,
+          protocolVersion: this.expectedProtocolVersion,
+          viewportHeight: window.innerHeight
+        });
+        if (h === null) return;
         this.iframe.style.height = `${h}px`;
         return;
       }
+      if (data.type === "openkey:close") {
+      }
       this.onMessage(data);
     };
     window.addEventListener("message", this.messageHandler);
@@ -86,6 +405,21 @@ var IframeModal = class {
   postMessage(message) {
     this.iframe.contentWindow?.postMessage(message, this.host);
   }
+  /**
+   * Sol final continuation contract requirement 5: bind the active
+   * request correlation so subsequent resize (and future correlated)
+   * messages can be verified against `requestId` + `protocolVersion`.
+   *
+   * The outer flow calls this right after creating the modal for a
+   * versioned request, before the iframe can send anything, so no
+   * uncorrelated resize is ever accepted for that request. Passing `null`
+   * for both arguments means the flow is unversioned; passing `null` for
+   * only one drops every resize.
+   */
+  setExpectedCorrelation(requestId, protocolVersion) {
+    this.expectedRequestId = requestId;
+    this.expectedProtocolVersion = protocolVersion;
+  }
   destroy() {
     window.removeEventListener("message", this.messageHandler);
     this.root.remove();
@@ -219,12 +553,23 @@ var OpenKey = class {
   lastAuth = null;
   discoveredProviders = [];
   sessionToken = null;
+  /** Cancels widget flows that could outlive a sign-out on this instance. */
+  activeFlowCancellations = /* @__PURE__ */ new Set();
+  /**
+   * Nostr identity custody + signing (secp256k1 Schnorr / BIP-340). Kept
+   * fully separate from the Ethereum flows above: it never reuses
+   * `lastAuth`/`sessionToken`, and its widget messages never carry a
+   * sessionToken - the OpenKey session and any signing grants stay inside
+   * the OpenKey-origin iframe for the whole lifetime of this client.
+   */
+  nostr;
   constructor(config = {}) {
     this.config = config;
     this.host = config.host || DEFAULT_HOST;
     this.oauthHost = config.oauthHost || this.deriveOAuthHost(this.host);
     this.appName = config.appName || window.location.hostname;
     this.mode = config.mode ?? "iframe";
+    this.nostr = new OpenKeyNostr(this.host);
     if (typeof window !== "undefined") {
       this.discoveredProviders = [];
       window.addEventListener("eip6963:announceProvider", (event) => {
@@ -250,6 +595,37 @@ var OpenKey = class {
       return "https://api.openkey.so";
     }
   }
+  /**
+   * Sol MAJOR-4 (final continuation): fetch the caller's registered keys
+   * so `resolveAuthorizeTinyCloudRouting` can resolve an explicit pin
+   * whose keyId does not match the active session key. Called only when
+   * the caller passes a `requestKeyId` we do not already recognise; the
+   * common no-pin path skips the network round-trip.
+   *
+   * Failures do NOT block routing — we fall through with `knownKeys=[]`
+   * so the resolver's lastAuth-based fallback still runs. If the caller
+   * pinned a genuinely unknown key that turns out to be external, the
+   * widget rejects the server-signing path and the SDK surfaces that
+   * error from the finalize call rather than silently routing wrong.
+   */
+  async fetchKnownKeysIfNeeded(requestKeyId) {
+    if (!requestKeyId) return [];
+    const la = this.lastAuth;
+    if (la?.keyId === requestKeyId) return [];
+    if (la?.address && la.address.toLowerCase() === requestKeyId.toLowerCase()) return [];
+    if (requestKeyId.startsWith("external:")) return [];
+    try {
+      const res = await fetch(`${this.oauthHost}/api/keys`, {
+        method: "GET",
+        credentials: "include"
+      });
+      if (!res.ok) return [];
+      const body = await res.json();
+      return Array.isArray(body?.keys) ? body.keys : [];
+    } catch {
+      return [];
+    }
+  }
   /**
    * Connect to OpenKey and get user's wallet address
    * Opens auth flow for user to select/create a key
@@ -262,6 +638,36 @@ var OpenKey = class {
     this.lastAuth = result;
     return result;
   }
+  /**
+   * Signs the active OpenKey account out through the OpenKey-owned widget.
+   *
+   * The SDK passes its Better Auth bearer through the OpenKey-owned widget
+   * protocol so applications do not have to implement revocation themselves.
+   * Local SDK session state is cleared before opening the widget, including
+   * when remote revocation is unavailable.
+   */
+  async signOut(opts) {
+    const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+    const sessionToken = this.sessionToken || void 0;
+    const mode = this.resolveMode(opts?.mode) === "redirect" ? "popup" : opts?.mode;
+    this.cancelActiveFlows();
+    this.lastAuth = null;
+    this.sessionToken = null;
+    const acknowledgement = await this.openFlow(
+      "sign-out",
+      {
+        type: "openkey:sign-out:request",
+        requestId,
+        protocolVersion: 1,
+        sessionToken
+      },
+      mode
+    );
+    if (acknowledgement.requestId !== requestId) {
+      throw new Error("OpenKey signOut received an acknowledgement for a different request");
+    }
+    return acknowledgement;
+  }
   /**
    * Better-auth session token relayed during connect(), or null if the
    * flow did not provide one. Use as a bearer token for API calls made
@@ -300,6 +706,208 @@ var OpenKey = class {
     }
     return this.signWithOpenKey(request, opts?.mode);
   }
+  /**
+   * Versioned TinyCloud authorization protocol (v1).
+   *
+   * Unlike `signMessage()` (which is contractually byte-exact — the returned
+   * signature always verifies against the caller's exact bytes), this method
+   * permits the user to narrow the requested capabilities before signing.
+   * OpenKey may therefore regenerate the SIWE. The response carries
+   * `signedMessage` — the exact bytes the signature actually verifies against.
+   *
+   * TinyCloud completes the session with `signedMessage`, not the original
+   * `siwe` passed in. Consumers MUST use the returned bytes and MUST NOT
+   * assume the returned grants are a superset of what they requested — the
+   * user is allowed to remove any grant that is not required.
+   *
+   * Legacy `signMessage()` callers are unaffected: their exact-byte contract
+   * remains preserved and OpenKey never rewrites their bytes.
+   */
+  async authorizeTinyCloud(request, opts) {
+    if (request.protocolVersion !== 1) {
+      throw new Error(
+        `authorizeTinyCloud only supports protocolVersion 1; got ${request.protocolVersion}`
+      );
+    }
+    if (typeof request.siwe !== "string" || !request.siwe) {
+      throw new Error("authorizeTinyCloud requires a non-empty SIWE");
+    }
+    let routing;
+    try {
+      const knownKeys = await this.fetchKnownKeysIfNeeded(request.keyId);
+      routing = resolveAuthorizeTinyCloudRouting({
+        lastAuth: this.lastAuth,
+        requestKeyId: request.keyId,
+        knownKeys
+      });
+    } catch (e) {
+      if (e instanceof KeyIdTypeMismatchError) throw e;
+      throw e instanceof Error ? e : new Error("authorizeTinyCloud: failed to resolve target key type");
+    }
+    if (routing.route === "external") {
+      return this.authorizeTinyCloudExternal(request, opts);
+    }
+    const requestId = `ok-auth-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+    const resolvedKeyId = routing.resolvedKeyId ?? request.keyId ?? this.lastAuth?.keyId;
+    const raw = await this.openFlow(
+      "sign",
+      {
+        type: "openkey:sign:request",
+        requestId,
+        protocolVersion: 1,
+        message: request.siwe,
+        keyId: resolvedKeyId,
+        // Forward JWK so the widget can pass it to /authorize-sign for
+        // narrowed-SIWE regeneration.
+        jwk: request.jwk,
+        // Forward the TinyCloud host so the widget can bind it into the
+        // /authorize-sign-prepare context (Sol MAJOR-2).
+        host: request.host,
+        // Sol MAJOR-2 (envelope): forward the caller-supplied presentation
+        // envelope so the widget can render honest provenance and the
+        // /authorize-sign-prepare route can bind it into the authorization
+        // context. The envelope is display-only; the widget transport
+        // validates and size-bounds it before use and NEVER treats it as
+        // verified unless the server actually origin-binds a manifest.
+        presentation: request.presentation,
+        sessionToken: this.sessionToken || void 0
+      },
+      opts?.mode
+    );
+    if (typeof raw.signedMessage !== "string" || !raw.signedMessage) {
+      throw new Error(
+        "authorizeTinyCloud: widget returned no signedMessage \u2014 signature would not correspond to the displayed authorization"
+      );
+    }
+    if (!Array.isArray(raw.selectedActionKeys)) {
+      throw new Error(
+        "authorizeTinyCloud: widget returned no selectedActionKeys \u2014 cannot verify displayed authorization matches the signed bytes"
+      );
+    }
+    if (!Array.isArray(raw.permissions)) {
+      throw new Error(
+        "authorizeTinyCloud: widget returned no permissions \u2014 cannot verify displayed authorization matches the signed bytes"
+      );
+    }
+    return {
+      protocolVersion: 1,
+      address: raw.address,
+      signature: raw.signature,
+      signedMessage: raw.signedMessage,
+      selectedActionKeys: raw.selectedActionKeys,
+      permissions: raw.permissions
+    };
+  }
+  /**
+   * Sol MAJOR-3 (continuation): authorizeTinyCloud path for external keys.
+   * The wallet lives outside OpenKey, so the SDK opens the shared widget
+   * for review + preview, then invokes the user's wallet to sign the
+   * preview bytes, then finalizes server-side via /authorize-sign.
+   *
+   * Flow:
+   *   1. Open the widget with `externalSign: true` — the widget renders
+   *      the shared SigningApproval UI, calls /authorize-sign-prepare,
+   *      calls /authorize-sign-preview after the user approves a
+   *      selection, and hands back `{ previewApprovalToken,
+   *      signedMessage, selectedActionIds, address, authorizationContextToken }`.
+   *   2. SDK invokes the user's wallet on the returned signedMessage.
+   *   3. SDK POSTs /authorize-sign with `externalSignature`.
+   *
+   * Legacy exact-byte signMessage callers are unaffected — this path is
+   * only taken via authorizeTinyCloud (protocolVersion:1) when the target
+   * key is EXTERNAL. Sol's rejection required this path to go through
+   * the same review UI as managed keys.
+   */
+  async authorizeTinyCloudExternal(request, opts) {
+    const keyId = request.keyId ?? this.lastAuth?.keyId;
+    if (!keyId) {
+      throw new Error(
+        "authorizeTinyCloud (external) requires a keyId \u2014 call connect() first or pass request.keyId"
+      );
+    }
+    const walletAddress = this.lastAuth?.address;
+    if (!walletAddress) {
+      throw new Error(
+        "authorizeTinyCloud (external) requires a connected wallet \u2014 call connect() first"
+      );
+    }
+    const requestId = `ok-ext-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+    const approval = await this.openFlow(
+      "sign",
+      {
+        type: "openkey:sign:request",
+        requestId,
+        protocolVersion: 1,
+        message: request.siwe,
+        keyId,
+        jwk: request.jwk,
+        host: request.host,
+        // Sol MAJOR-2 (envelope): forward the caller-supplied presentation
+        // envelope. Same rules as the managed path — display-only, size-
+        // bounded at the transport, never treated as verified without
+        // server-side origin-binding.
+        presentation: request.presentation,
+        sessionToken: this.sessionToken || void 0,
+        // Sol MAJOR-3 (continuation): tell the widget to hand us back
+        // the previewApproval instead of asking OpenKey to sign
+        // server-side with a managed key. The widget will still render
+        // the SAME SigningApproval component; it just diverges at the
+        // "sign" step and emits `openkey:externalSign:approve` back
+        // through the transport.
+        externalSign: true
+      },
+      opts?.mode
+    );
+    if (!approval?.previewApprovalToken || !approval?.signedMessage) {
+      throw new Error(
+        "authorizeTinyCloud (external): widget did not return a previewApprovalToken + signedMessage"
+      );
+    }
+    if (approval.address && approval.address.toLowerCase() !== walletAddress.toLowerCase()) {
+      throw new Error(
+        `authorizeTinyCloud (external): widget preview address ${approval.address} does not match connected wallet ${walletAddress}`
+      );
+    }
+    const provider = await this.findWalletProvider(walletAddress);
+    const hexMessage = this.toHex(approval.signedMessage);
+    const walletSignature = await provider.request({
+      method: "personal_sign",
+      params: [hexMessage, walletAddress]
+    });
+    const finalizeRes = await fetch(
+      `${this.oauthHost}/api/delegate/authorize-sign`,
+      {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          authorizationContextToken: approval.authorizationContextToken,
+          previewApprovalToken: approval.previewApprovalToken,
+          selectedActionIds: approval.selectedActionIds,
+          protocolVersion: 1,
+          externalSignature: walletSignature
+        })
+      }
+    );
+    if (!finalizeRes.ok) {
+      const body = await finalizeRes.json().catch(() => ({ error: `HTTP ${finalizeRes.status}` }));
+      throw new Error(body.error || `authorize-sign failed (${finalizeRes.status})`);
+    }
+    const finalize = await finalizeRes.json();
+    if (finalize.signedMessage !== approval.signedMessage) {
+      throw new Error(
+        "authorizeTinyCloud (external): server signed different bytes than the preview showed"
+      );
+    }
+    return {
+      protocolVersion: 1,
+      address: finalize.address,
+      signature: finalize.signature,
+      signedMessage: finalize.signedMessage,
+      selectedActionKeys: finalize.selectedActionKeys ?? [],
+      permissions: finalize.permissions ?? []
+    };
+  }
   /**
    * Sign typed data (EIP-712) with the user's OpenKey wallet
    * For external keys, routes directly to the user's wallet provider
@@ -434,14 +1042,14 @@ var OpenKey = class {
      * @returns Promise that resolves with authorization code after user consent
      */
     connect: async (config) => {
-      const verifier = generateCodeVerifier();
-      const challenge = await generateCodeChallenge(verifier);
-      const state = config.state || generateState();
+      const verifier = y();
+      const challenge = await k(verifier);
+      const state = config.state || m();
       sessionStorage.setItem(
         OAUTH_STORAGE_KEY,
         JSON.stringify({ verifier, state })
       );
-      const authUrl = buildAuthorizationUrl({
+      const authUrl = T({
         host: this.oauthHost,
         clientId: config.clientId,
         redirectUri: config.redirectUri,
@@ -613,7 +1221,7 @@ var OpenKey = class {
     const eoaFlag = action === "connect" && this.hasDetectedEoa() ? "&hasEoa=true" : "";
     if (mode === "popup") {
       const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}`;
-      return new Promise((resolve, reject) => this.openPopup(url2, message, resolve, reject));
+      return new Promise((resolve, reject) => this.openPopup(action, url2, message, resolve, reject));
     }
     if (mode === "redirect") {
       const url2 = `${this.host}/widget/${action}?origin=${origin}${eoaFlag}`;
@@ -625,10 +1233,14 @@ var OpenKey = class {
     return this.openIframeModal(url, action, message, origin);
   }
   openIframeModal(url, action, message, origin) {
+    const outgoingRequestId = message.requestId;
+    const outgoingProtocolVersion = message.protocolVersion;
+    const isVersionedRequest = typeof outgoingRequestId === "string" && typeof outgoingProtocolVersion === "number" && outgoingProtocolVersion >= 1;
     return new Promise((resolve, reject) => {
       let readyReceived = false;
       let settled = false;
       let modal = null;
+      let cancel;
       const settle = (fn) => {
         if (settled) return;
         settled = true;
@@ -639,15 +1251,14 @@ var OpenKey = class {
         clearTimeout(overallTimeout);
         modal?.destroy();
         modal = null;
+        this.activeFlowCancellations.delete(cancel);
       };
       modal = new IframeModal({
         url,
         host: this.host,
         onClose: () => {
           settle(() => {
-            clearTimeout(readyTimeout);
-            clearTimeout(overallTimeout);
-            modal = null;
+            cleanup();
             reject({ code: "USER_CANCELLED", message: "User cancelled the request" });
           });
         },
@@ -657,6 +1268,12 @@ var OpenKey = class {
             modal?.postMessage(message);
             return;
           }
+          if (isVersionedRequest) {
+            const respRequestId = data.requestId;
+            const respVersion = data.protocolVersion;
+            if (respRequestId !== outgoingRequestId) return;
+            if (respVersion !== outgoingProtocolVersion) return;
+          }
           if (data.type === "openkey:close") {
             settle(() => {
               cleanup();
@@ -673,7 +1290,7 @@ var OpenKey = class {
             this.handleExternalWalletConnect(resolve, reject);
             return;
           }
-          if (data.type === "openkey:auth:response" || data.type === "openkey:sign:response" || data.type === "openkey:signTypedData:response" || data.type === "openkey:link-wallet:response") {
+          if (this.isResponseForAction(action, data)) {
             settle(() => {
               cleanup();
               if (data.success) {
@@ -682,8 +1299,24 @@ var OpenKey = class {
                   resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
                 } else if (data.type === "openkey:link-wallet:response") {
                   resolve({ address: data.address, keyId: data.keyId });
+                } else if (data.type === "openkey:sign-out:response") {
+                  resolve({ requestId: data.requestId, revoked: data.revoked });
+                } else if (data.type === "openkey:externalSign:approve") {
+                  resolve({
+                    authorizationContextToken: data.authorizationContextToken,
+                    previewApprovalToken: data.previewApprovalToken,
+                    signedMessage: data.signedMessage,
+                    selectedActionIds: data.selectedActionIds,
+                    address: data.address
+                  });
                 } else {
-                  resolve({ signature: data.signature, address: data.address });
+                  resolve({
+                    signature: data.signature,
+                    address: data.address,
+                    signedMessage: data.signedMessage,
+                    selectedActionKeys: data.selectedActionKeys,
+                    permissions: data.permissions
+                  });
                 }
               } else {
                 reject(data.error);
@@ -692,13 +1325,19 @@ var OpenKey = class {
           }
         }
       });
+      if (isVersionedRequest) {
+        modal.setExpectedCorrelation(
+          outgoingRequestId,
+          outgoingProtocolVersion
+        );
+      }
       const readyTimeout = setTimeout(() => {
         if (readyReceived || settled) return;
         cleanup();
         console.warn("OpenKey: iframe blocked by CSP, falling back to popup. Add frame-src https://openkey.so to your CSP.");
         showToast();
         const popupUrl = `${this.host}/widget/${action}?origin=${origin}`;
-        this.openPopup(popupUrl, message, (val) => settle(() => resolve(val)), (err) => settle(() => reject(err)));
+        this.openPopup(action, popupUrl, message, (val) => settle(() => resolve(val)), (err) => settle(() => reject(err)));
       }, IFRAME_READY_TIMEOUT);
       const overallTimeout = setTimeout(() => {
         settle(() => {
@@ -706,8 +1345,24 @@ var OpenKey = class {
           reject({ code: "TIMEOUT", message: "Request timed out" });
         });
       }, DEFAULT_TIMEOUT);
+      cancel = () => {
+        settle(() => {
+          cleanup();
+          reject({ code: "USER_CANCELLED", message: "Superseded by sign-out" });
+        });
+      };
+      this.activeFlowCancellations.add(cancel);
     });
   }
+  isResponseForAction(action, data) {
+    const type = data.type;
+    if (action === "connect") return type === "openkey:auth:response";
+    if (action === "sign") return type === "openkey:sign:response" || type === "openkey:externalSign:approve";
+    if (action === "sign-typed-data") return type === "openkey:signTypedData:response";
+    if (action === "link-wallet") return type === "openkey:link-wallet:response";
+    if (action === "sign-out") return type === "openkey:sign-out:response";
+    return false;
+  }
   handleWalletLinkDelegation(modal) {
     const sendResult = (result) => modal.postMessage(result);
     new WalletPicker({
@@ -769,15 +1424,16 @@ var OpenKey = class {
       }
     });
   }
-  openPopup(url, message, resolve, reject) {
+  openPopup(action, url, message, resolve, reject) {
     const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;
     const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;
-    this.popup = window.open(
+    const popup = window.open(
       url,
-      "openkey",
+      `openkey-${action}-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
       `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`
     );
-    if (!this.popup) {
+    this.popup = popup;
+    if (!popup) {
       showToast("Popup was blocked. Please allow popups for this site.", "error");
       reject({
         code: "POPUP_BLOCKED",
@@ -785,74 +1441,129 @@ var OpenKey = class {
       });
       return;
     }
+    let settled = false;
+    let cancel;
     const cleanup = () => {
       window.removeEventListener("message", handleMessage);
       clearInterval(pollClosed);
       clearTimeout(timeout);
+      this.activeFlowCancellations.delete(cancel);
+      if (this.popup === popup) this.popup = null;
+    };
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      fn();
     };
     const pollClosed = setInterval(() => {
-      if (this.popup?.closed) {
-        cleanup();
-        reject({
+      if (popup.closed) {
+        settle(() => reject({
           code: "USER_CANCELLED",
           message: "User closed the popup"
-        });
+        }));
       }
     }, 500);
     const timeout = setTimeout(() => {
-      cleanup();
-      this.popup?.close();
-      reject({
-        code: "TIMEOUT",
-        message: "Request timed out"
+      settle(() => {
+        popup.close();
+        reject({
+          code: "TIMEOUT",
+          message: "Request timed out"
+        });
       });
     }, DEFAULT_TIMEOUT);
+    const outgoingRequestId = message.requestId;
+    const outgoingProtocolVersion = message.protocolVersion;
+    const isVersionedRequest = typeof outgoingRequestId === "string" && typeof outgoingProtocolVersion === "number" && outgoingProtocolVersion >= 1;
     const handleMessage = (event) => {
       if (event.origin !== this.host) return;
-      if (event.source !== this.popup) return;
+      if (event.source !== popup) return;
       const data = event.data;
       if (data.type === "openkey:ready") {
-        this.popup?.postMessage(message, this.host);
+        popup.postMessage(message, this.host);
         return;
       }
       if (data.type === "openkey:close") {
-        cleanup();
-        this.popup?.close();
-        reject({
-          code: "USER_CANCELLED",
-          message: "User cancelled the request"
+        if (isVersionedRequest) {
+          const closeRequestId = data.requestId;
+          const closeVersion = data.protocolVersion;
+          if (closeRequestId !== outgoingRequestId) return;
+          if (closeVersion !== outgoingProtocolVersion) return;
+        }
+        settle(() => {
+          popup.close();
+          reject({
+            code: "USER_CANCELLED",
+            message: "User cancelled the request"
+          });
         });
         return;
       }
       if (data.type === "openkey:auth:use-external-wallet") {
-        cleanup();
-        this.popup?.close();
-        this.handleExternalWalletConnect(resolve, reject);
+        settle(() => {
+          popup.close();
+          this.handleExternalWalletConnect(resolve, reject);
+        });
         return;
       }
-      if (data.type === "openkey:auth:response" || data.type === "openkey:sign:response" || data.type === "openkey:signTypedData:response" || data.type === "openkey:link-wallet:response") {
-        cleanup();
-        this.popup?.close();
-        if (data.success) {
-          if (data.type === "openkey:auth:response") {
-            if (data.sessionToken) this.sessionToken = data.sessionToken;
-            resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
-          } else if (data.type === "openkey:link-wallet:response") {
-            resolve({ address: data.address, keyId: data.keyId });
+      if (this.isResponseForAction(action, data)) {
+        if (isVersionedRequest) {
+          const respRequestId = data.requestId;
+          const respVersion = data.protocolVersion;
+          if (respRequestId !== outgoingRequestId) return;
+          if (respVersion !== outgoingProtocolVersion) return;
+        }
+        settle(() => {
+          popup.close();
+          if (data.success) {
+            if (data.type === "openkey:auth:response") {
+              if (data.sessionToken) this.sessionToken = data.sessionToken;
+              resolve({ address: data.address, keyId: data.keyId, keyType: data.keyType || "MANAGED" });
+            } else if (data.type === "openkey:link-wallet:response") {
+              resolve({ address: data.address, keyId: data.keyId });
+            } else if (data.type === "openkey:sign-out:response") {
+              resolve({ requestId: data.requestId, revoked: data.revoked });
+            } else if (data.type === "openkey:externalSign:approve") {
+              resolve({
+                authorizationContextToken: data.authorizationContextToken,
+                previewApprovalToken: data.previewApprovalToken,
+                signedMessage: data.signedMessage,
+                selectedActionIds: data.selectedActionIds,
+                address: data.address
+              });
+            } else {
+              resolve({
+                signature: data.signature,
+                address: data.address,
+                signedMessage: data.signedMessage,
+                selectedActionKeys: data.selectedActionKeys,
+                permissions: data.permissions
+              });
+            }
           } else {
-            resolve({ signature: data.signature, address: data.address });
+            reject(data.error);
           }
-        } else {
-          reject(data.error);
-        }
+        });
       }
     };
     window.addEventListener("message", handleMessage);
+    cancel = () => {
+      settle(() => {
+        popup.close();
+        reject({ code: "USER_CANCELLED", message: "Superseded by sign-out" });
+      });
+    };
+    this.activeFlowCancellations.add(cancel);
+  }
+  cancelActiveFlows() {
+    for (const cancel of [...this.activeFlowCancellations]) cancel();
   }
   /**
    * Disconnect and close any open flows
    */
   disconnect() {
+    this.cancelActiveFlows();
     this.popup?.close();
     this.popup = null;
   }
@@ -924,9 +1635,14 @@ function getOpenKey(config) {
   return defaultInstance;
 }
 export {
+  KeyIdTypeMismatchError,
   OpenKey,
+  OpenKeyNostr,
   OpenKeyProvider,
   index_default as default,
-  getOpenKey
+  getOpenKey,
+  resolveAuthorizeTinyCloudRouting,
+  shouldRouteAuthorizeTinyCloudExternal,
+  validateIframeResize
 };
 //# sourceMappingURL=index.mjs.map