@partylayer/adapter-send 1.0.2 → 1.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PartyLayer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.mts

@@ -1,5 +1,6 @@
 import * as _partylayer_core from '@partylayer/core';
-import { ProviderDetection, WalletAdapter, CapabilityKey, AdapterDetectResult, AdapterContext, PartyId, AdapterConnectResult, Session, PersistedSession, SignMessageParams, SignedMessage, SignTransactionParams, SignedTransaction, SubmitTransactionParams, TxReceipt, LedgerApiParams, LedgerApiResult, AdapterEventName, WalletNotInstalledError, ErrorMappingContext, PartyLayerError } from '@partylayer/core';
+import { ProviderDetection, CIP0103Provider, WalletAdapter, CapabilityKey, AdapterDetectResult, AdapterContext, PartyId, AdapterConnectResult, Session, PersistedSession, SignMessageParams, SignedMessage, SignTransactionParams, SignedTransaction, SubmitTransactionParams, TxReceipt, LedgerApiParams, LedgerApiResult, AdapterEventName, WalletNotInstalledError, ErrorMappingContext, PartyLayerError } from '@partylayer/core';
+import { AnnounceDiscoveryOptions, DiscoveredProvider } from '@partylayer/provider';
 
 /**
  * Local Sigilry-shape types.
@@ -195,65 +196,93 @@ declare global {
 }
 
 /**
- * Typed wrapper around the `window.canton` provider exposed by Send.
+ * Typed wrapper around the Send Canton wallet, reached via the
+ * `canton:announceProvider` + extension postMessage `target` channel.
  *
- * Detection is **registry-driven** via `matchesProviderDetection`. The
- * adapter accepts an optional `ProviderDetection` rule set at construction
- * (sourced from the registry's `providerDetection` field for the Send
- * entry); when omitted, it falls back to `SEND_BUILTIN_DETECTION` which
- * mirrors the canonical registry rule. Every public RPC method goes
- * through `guardedRequest`, which checks the live `status` response
- * against those rules before forwarding the call. The result: if a
- * non-Send wallet is sitting at `window.canton`, every Send call resolves
- * to a `SendKernelMismatchError` (treated by the SDK as "Send is not
- * installed"), and Send only ever acts on its own provider.
+ * WHY NOT `window.canton`: Send is announce-only. When another wallet (e.g.
+ * Console) owns the single shared `window.canton` slot, the old transport
+ * (bind `window.canton`, guard by `kernel.id`) returned a kernel mismatch and
+ * Send was unconnectable. Send instead fires `canton:announceProvider` with
+ * `{ id, name, icon, target }` (id == target == its extension id) and does NOT
+ * inject `window.canton`. So detection + every RPC now go through the announce
+ * handshake and the splice postMessage `target` channel, regardless of who
+ * owns `window.canton`.
+ *
+ * Transport is reused from `@partylayer/provider`: `discoverAnnouncedProviders`
+ * finds Send's announce entry (a ready `createExtensionChannelProvider` over
+ * its `target`), and every call is forwarded through that channel provider's
+ * request/response. Detection is registry-driven: the announce `id` is matched
+ * against Send's accepted extension ids (the `provider.id` matchers of the
+ * supplied `ProviderDetection`, plus `SEND_KNOWN_EXTENSION_IDS`).
+ *
+ * INBOUND EVENTS: the official splice extension (sync) provider does not push
+ * events over `postMessage` — the wire protocol has no inbound-event message
+ * type, and event push exists only on the remote/SSE path. Send's tx result
+ * comes from `prepareExecuteAndWait`'s response, not from `txChanged`. So
+ * `on`/`off` simply delegate to the channel provider's local event bus (kept so
+ * the `events` capability and API are preserved); they never throw.
  */
 
+interface SendProviderOptions {
+    /**
+     * Pre-resolved channel provider (used by tests). When set, the announce
+     * handshake is skipped and every call routes through this provider.
+     */
+    provider?: CIP0103Provider;
+    /** Override the announce-collection window (ms). Default 500. */
+    announceTimeoutMs?: number;
+    /** Override announce discovery (used by tests). Defaults to the real handshake. */
+    discover?: (options?: AnnounceDiscoveryOptions) => Promise<DiscoveredProvider[]>;
+}
 declare class SendProvider {
     private readonly detection;
+    private readonly announceTimeoutMs;
+    private readonly discover;
+    private readonly injectedProvider?;
+    private cachedChannel;
+    private channelPromise;
     private cachedStatus;
     /**
-     * @param detection Optional. Used to match the running `window.canton`
-     *   provider against Send's identity. When omitted, falls back to
-     *   `SEND_BUILTIN_DETECTION` (canonical registry rule mirror).
+     * @param detection Optional registry `ProviderDetection`. Its `provider.id`
+     *   exact-match values define which announced extension ids are treated as
+     *   Send. Defaults to `SEND_BUILTIN_DETECTION`.
+     * @param options Optional test/advanced hooks (see {@link SendProviderOptions}).
      */
-    constructor(detection?: ProviderDetection);
+    constructor(detection?: ProviderDetection, options?: SendProviderOptions);
+    /** Extension ids accepted as Send: registry `provider.id` matchers ∪ known ids. */
+    private acceptedIds;
     /**
-     * True when `window.canton` is present AND its self-reported status
-     * matches Send's detection rules. Performs an actual `status` round-trip
-     * on first call and caches the response for subsequent ones.
+     * Resolve (and cache) Send's announce channel. Returns null if Send did not
+     * announce. Concurrent callers share a single in-flight announce (dedup), so
+     * a burst of requests triggers exactly one handshake.
+     */
+    private resolveChannel;
+    private doResolveChannel;
+    private channelRequest;
+    /**
+     * True iff Send announces via `canton:announceProvider` — independent of who
+     * owns `window.canton`. Caches the resolved channel.
      */
     isInstalled(): Promise<boolean>;
     /**
-     * Synchronous best-effort presence check. Used for fast picker rendering
-     * before any async status introspection. May report `true` for a
-     * non-Send provider — callers must follow up with `isInstalled()` (or
-     * any guarded request) before assuming Send is wired in.
+     * Synchronous best-effort presence check: only that we are in a browser where
+     * announce discovery can run. The authoritative check is `isInstalled()` /
+     * any request (which performs the announce handshake). No longer depends on
+     * the shared `window.canton` slot.
      */
     isPotentiallyAvailable(): boolean;
     /**
-     * Read the cached `kernel.id` from the running provider, fetching status
-     * on demand. Diagnostic helper kept public for back-compat — detection
-     * itself no longer hinges on this single field.
+     * Read `status().kernel.id`. Diagnostic helper kept for back-compat. Live
+     * Send no longer reports a kernel; this throws `SendNotInstalledError` when
+     * absent (callers that need the stable id should use the announce target).
      */
     getKernelId(): Promise<string>;
-    /**
-     * Read the latest cached status object. Resolves the underlying RPC on
-     * demand if no cached value is present.
-     */
+    /** Latest status (cached after first fetch). */
     getStatus(): Promise<SendStatusResponse>;
-    /**
-     * Reset the cached status (e.g. after the user uninstalls and reinstalls
-     * the extension, or you suspect kernel identity changed mid-session).
-     * Kept under both names to avoid breaking existing test imports.
-     */
+    /** Reset cached status AND the resolved announce channel (forces re-announce). */
     resetKernelCache(): void;
     resetStatusCache(): void;
     private fetchStatus;
-    /** Internal — bypasses the detection guard. */
-    private rawRequest;
-    /** Public dispatch — guards every call with a registry-driven detection check. */
-    private guardedRequest;
     status(): Promise<SendStatusResponse>;
     connect(): Promise<SendStatusResponse>;
     disconnect(): Promise<null>;

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import * as _partylayer_core from '@partylayer/core';
-import { ProviderDetection, WalletAdapter, CapabilityKey, AdapterDetectResult, AdapterContext, PartyId, AdapterConnectResult, Session, PersistedSession, SignMessageParams, SignedMessage, SignTransactionParams, SignedTransaction, SubmitTransactionParams, TxReceipt, LedgerApiParams, LedgerApiResult, AdapterEventName, WalletNotInstalledError, ErrorMappingContext, PartyLayerError } from '@partylayer/core';
+import { ProviderDetection, CIP0103Provider, WalletAdapter, CapabilityKey, AdapterDetectResult, AdapterContext, PartyId, AdapterConnectResult, Session, PersistedSession, SignMessageParams, SignedMessage, SignTransactionParams, SignedTransaction, SubmitTransactionParams, TxReceipt, LedgerApiParams, LedgerApiResult, AdapterEventName, WalletNotInstalledError, ErrorMappingContext, PartyLayerError } from '@partylayer/core';
+import { AnnounceDiscoveryOptions, DiscoveredProvider } from '@partylayer/provider';
 
 /**
  * Local Sigilry-shape types.
@@ -195,65 +196,93 @@ declare global {
 }
 
 /**
- * Typed wrapper around the `window.canton` provider exposed by Send.
+ * Typed wrapper around the Send Canton wallet, reached via the
+ * `canton:announceProvider` + extension postMessage `target` channel.
  *
- * Detection is **registry-driven** via `matchesProviderDetection`. The
- * adapter accepts an optional `ProviderDetection` rule set at construction
- * (sourced from the registry's `providerDetection` field for the Send
- * entry); when omitted, it falls back to `SEND_BUILTIN_DETECTION` which
- * mirrors the canonical registry rule. Every public RPC method goes
- * through `guardedRequest`, which checks the live `status` response
- * against those rules before forwarding the call. The result: if a
- * non-Send wallet is sitting at `window.canton`, every Send call resolves
- * to a `SendKernelMismatchError` (treated by the SDK as "Send is not
- * installed"), and Send only ever acts on its own provider.
+ * WHY NOT `window.canton`: Send is announce-only. When another wallet (e.g.
+ * Console) owns the single shared `window.canton` slot, the old transport
+ * (bind `window.canton`, guard by `kernel.id`) returned a kernel mismatch and
+ * Send was unconnectable. Send instead fires `canton:announceProvider` with
+ * `{ id, name, icon, target }` (id == target == its extension id) and does NOT
+ * inject `window.canton`. So detection + every RPC now go through the announce
+ * handshake and the splice postMessage `target` channel, regardless of who
+ * owns `window.canton`.
+ *
+ * Transport is reused from `@partylayer/provider`: `discoverAnnouncedProviders`
+ * finds Send's announce entry (a ready `createExtensionChannelProvider` over
+ * its `target`), and every call is forwarded through that channel provider's
+ * request/response. Detection is registry-driven: the announce `id` is matched
+ * against Send's accepted extension ids (the `provider.id` matchers of the
+ * supplied `ProviderDetection`, plus `SEND_KNOWN_EXTENSION_IDS`).
+ *
+ * INBOUND EVENTS: the official splice extension (sync) provider does not push
+ * events over `postMessage` — the wire protocol has no inbound-event message
+ * type, and event push exists only on the remote/SSE path. Send's tx result
+ * comes from `prepareExecuteAndWait`'s response, not from `txChanged`. So
+ * `on`/`off` simply delegate to the channel provider's local event bus (kept so
+ * the `events` capability and API are preserved); they never throw.
  */
 
+interface SendProviderOptions {
+    /**
+     * Pre-resolved channel provider (used by tests). When set, the announce
+     * handshake is skipped and every call routes through this provider.
+     */
+    provider?: CIP0103Provider;
+    /** Override the announce-collection window (ms). Default 500. */
+    announceTimeoutMs?: number;
+    /** Override announce discovery (used by tests). Defaults to the real handshake. */
+    discover?: (options?: AnnounceDiscoveryOptions) => Promise<DiscoveredProvider[]>;
+}
 declare class SendProvider {
     private readonly detection;
+    private readonly announceTimeoutMs;
+    private readonly discover;
+    private readonly injectedProvider?;
+    private cachedChannel;
+    private channelPromise;
     private cachedStatus;
     /**
-     * @param detection Optional. Used to match the running `window.canton`
-     *   provider against Send's identity. When omitted, falls back to
-     *   `SEND_BUILTIN_DETECTION` (canonical registry rule mirror).
+     * @param detection Optional registry `ProviderDetection`. Its `provider.id`
+     *   exact-match values define which announced extension ids are treated as
+     *   Send. Defaults to `SEND_BUILTIN_DETECTION`.
+     * @param options Optional test/advanced hooks (see {@link SendProviderOptions}).
      */
-    constructor(detection?: ProviderDetection);
+    constructor(detection?: ProviderDetection, options?: SendProviderOptions);
+    /** Extension ids accepted as Send: registry `provider.id` matchers ∪ known ids. */
+    private acceptedIds;
     /**
-     * True when `window.canton` is present AND its self-reported status
-     * matches Send's detection rules. Performs an actual `status` round-trip
-     * on first call and caches the response for subsequent ones.
+     * Resolve (and cache) Send's announce channel. Returns null if Send did not
+     * announce. Concurrent callers share a single in-flight announce (dedup), so
+     * a burst of requests triggers exactly one handshake.
+     */
+    private resolveChannel;
+    private doResolveChannel;
+    private channelRequest;
+    /**
+     * True iff Send announces via `canton:announceProvider` — independent of who
+     * owns `window.canton`. Caches the resolved channel.
      */
     isInstalled(): Promise<boolean>;
     /**
-     * Synchronous best-effort presence check. Used for fast picker rendering
-     * before any async status introspection. May report `true` for a
-     * non-Send provider — callers must follow up with `isInstalled()` (or
-     * any guarded request) before assuming Send is wired in.
+     * Synchronous best-effort presence check: only that we are in a browser where
+     * announce discovery can run. The authoritative check is `isInstalled()` /
+     * any request (which performs the announce handshake). No longer depends on
+     * the shared `window.canton` slot.
      */
     isPotentiallyAvailable(): boolean;
     /**
-     * Read the cached `kernel.id` from the running provider, fetching status
-     * on demand. Diagnostic helper kept public for back-compat — detection
-     * itself no longer hinges on this single field.
+     * Read `status().kernel.id`. Diagnostic helper kept for back-compat. Live
+     * Send no longer reports a kernel; this throws `SendNotInstalledError` when
+     * absent (callers that need the stable id should use the announce target).
      */
     getKernelId(): Promise<string>;
-    /**
-     * Read the latest cached status object. Resolves the underlying RPC on
-     * demand if no cached value is present.
-     */
+    /** Latest status (cached after first fetch). */
     getStatus(): Promise<SendStatusResponse>;
-    /**
-     * Reset the cached status (e.g. after the user uninstalls and reinstalls
-     * the extension, or you suspect kernel identity changed mid-session).
-     * Kept under both names to avoid breaking existing test imports.
-     */
+    /** Reset cached status AND the resolved announce channel (forces re-announce). */
     resetKernelCache(): void;
     resetStatusCache(): void;
     private fetchStatus;
-    /** Internal — bypasses the detection guard. */
-    private rawRequest;
-    /** Public dispatch — guards every call with a registry-driven detection check. */
-    private guardedRequest;
     status(): Promise<SendStatusResponse>;
     connect(): Promise<SendStatusResponse>;
     disconnect(): Promise<null>;

package/dist/index.js

@@ -1,6 +1,7 @@
 'use strict';
 
 var core = require('@partylayer/core');
+var provider = require('@partylayer/provider');
 
 // src/send-adapter.ts
 
@@ -169,153 +170,171 @@ function safePreview(value, maxLen = 200) {
     return String(value);
   }
 }
+var DEFAULT_ANNOUNCE_TIMEOUT_MS = 500;
 var SendProvider = class {
   detection;
+  announceTimeoutMs;
+  discover;
+  injectedProvider;
+  cachedChannel = null;
+  channelPromise = null;
   cachedStatus = null;
   /**
-   * @param detection Optional. Used to match the running `window.canton`
-   *   provider against Send's identity. When omitted, falls back to
-   *   `SEND_BUILTIN_DETECTION` (canonical registry rule mirror).
+   * @param detection Optional registry `ProviderDetection`. Its `provider.id`
+   *   exact-match values define which announced extension ids are treated as
+   *   Send. Defaults to `SEND_BUILTIN_DETECTION`.
+   * @param options Optional test/advanced hooks (see {@link SendProviderOptions}).
    */
-  constructor(detection) {
+  constructor(detection, options) {
     this.detection = detection ?? SEND_BUILTIN_DETECTION;
+    this.announceTimeoutMs = options?.announceTimeoutMs ?? DEFAULT_ANNOUNCE_TIMEOUT_MS;
+    this.discover = options?.discover ?? ((o) => provider.discoverAnnouncedProviders(o));
+    this.injectedProvider = options?.provider;
   }
+  /** Extension ids accepted as Send: registry `provider.id` matchers ∪ known ids. */
+  acceptedIds() {
+    const fromDetection = this.detection.matchers.filter((m) => m.field === "provider.id" && m.match === "exact").flatMap((m) => m.values);
+    return Array.from(/* @__PURE__ */ new Set([...fromDetection, ...SEND_KNOWN_EXTENSION_IDS]));
+  }
+  /**
+   * Resolve (and cache) Send's announce channel. Returns null if Send did not
+   * announce. Concurrent callers share a single in-flight announce (dedup), so
+   * a burst of requests triggers exactly one handshake.
+   */
+  resolveChannel() {
+    if (this.cachedChannel) return Promise.resolve(this.cachedChannel);
+    if (this.channelPromise) return this.channelPromise;
+    this.channelPromise = this.doResolveChannel().then((channel) => {
+      if (channel) this.cachedChannel = channel;
+      return channel;
+    }).finally(() => {
+      this.channelPromise = null;
+    });
+    return this.channelPromise;
+  }
+  async doResolveChannel() {
+    if (this.injectedProvider) {
+      return { target: "injected", provider: this.injectedProvider };
+    }
+    if (typeof window === "undefined") return null;
+    const accepted = this.acceptedIds();
+    const entries = await this.discover({ timeoutMs: this.announceTimeoutMs });
+    const match = entries.find((e) => accepted.includes(e.id));
+    if (!match) return null;
+    return { target: match.id, provider: match.provider };
+  }
+  async channelRequest(method, params) {
+    const channel = await this.resolveChannel();
+    if (!channel) throw new SendNotInstalledError();
+    const payload = params === void 0 ? { method } : { method, params };
+    return channel.provider.request(payload);
+  }
+  // ── Detection ────────────────────────────────────────────────────────────
   /**
-   * True when `window.canton` is present AND its self-reported status
-   * matches Send's detection rules. Performs an actual `status` round-trip
-   * on first call and caches the response for subsequent ones.
+   * True iff Send announces via `canton:announceProvider` — independent of who
+   * owns `window.canton`. Caches the resolved channel.
    */
   async isInstalled() {
-    if (typeof window === "undefined" || !window.canton) return false;
     try {
-      const status = await this.fetchStatus();
-      return core.matchesProviderDetection(status, this.detection);
+      return await this.resolveChannel() !== null;
     } catch {
       return false;
     }
   }
   /**
-   * Synchronous best-effort presence check. Used for fast picker rendering
-   * before any async status introspection. May report `true` for a
-   * non-Send provider — callers must follow up with `isInstalled()` (or
-   * any guarded request) before assuming Send is wired in.
+   * Synchronous best-effort presence check: only that we are in a browser where
+   * announce discovery can run. The authoritative check is `isInstalled()` /
+   * any request (which performs the announce handshake). No longer depends on
+   * the shared `window.canton` slot.
    */
   isPotentiallyAvailable() {
-    return typeof window !== "undefined" && !!window.canton;
+    return typeof window !== "undefined";
   }
   /**
-   * Read the cached `kernel.id` from the running provider, fetching status
-   * on demand. Diagnostic helper kept public for back-compat — detection
-   * itself no longer hinges on this single field.
+   * Read `status().kernel.id`. Diagnostic helper kept for back-compat. Live
+   * Send no longer reports a kernel; this throws `SendNotInstalledError` when
+   * absent (callers that need the stable id should use the announce target).
    */
   async getKernelId() {
     const status = await this.fetchStatus();
     const id = status?.kernel?.id;
     if (typeof id !== "string" || id.length === 0) {
       throw new SendNotInstalledError(
-        "window.canton.status() did not return a kernel.id \u2014 provider is malformed."
+        "Send status() did not return a kernel.id."
       );
     }
     return id;
   }
-  /**
-   * Read the latest cached status object. Resolves the underlying RPC on
-   * demand if no cached value is present.
-   */
+  /** Latest status (cached after first fetch). */
   async getStatus() {
     return this.fetchStatus();
   }
-  /**
-   * Reset the cached status (e.g. after the user uninstalls and reinstalls
-   * the extension, or you suspect kernel identity changed mid-session).
-   * Kept under both names to avoid breaking existing test imports.
-   */
+  /** Reset cached status AND the resolved announce channel (forces re-announce). */
   resetKernelCache() {
     this.cachedStatus = null;
+    this.cachedChannel = null;
+    this.channelPromise = null;
   }
   resetStatusCache() {
     this.cachedStatus = null;
+    this.cachedChannel = null;
+    this.channelPromise = null;
   }
   async fetchStatus() {
     if (this.cachedStatus) return this.cachedStatus;
-    if (typeof window === "undefined" || !window.canton) {
-      throw new SendNotInstalledError();
-    }
-    const provider = window.canton;
-    const status = await provider.request({ method: "status" });
+    const status = await this.channelRequest("status");
     this.cachedStatus = status;
     return status;
   }
-  /** Internal — bypasses the detection guard. */
-  async rawRequest(args) {
-    if (typeof window === "undefined" || !window.canton) {
-      throw new SendNotInstalledError();
-    }
-    const provider = window.canton;
-    return provider.request(args);
-  }
-  /** Public dispatch — guards every call with a registry-driven detection check. */
-  async guardedRequest(args) {
-    const status = await this.fetchStatus();
-    if (!core.matchesProviderDetection(status, this.detection)) {
-      const observedId = status?.kernel?.id ?? "<unknown>";
-      throw new SendKernelMismatchError(observedId);
-    }
-    return this.rawRequest(args);
-  }
-  // ── Sigilry RPC methods (every one is guarded) ─────────────────────────
+  // ── Sigilry RPC methods (all over the announce target channel) ────────────
   status() {
-    return this.guardedRequest({ method: "status" });
+    return this.channelRequest("status");
   }
   connect() {
-    return this.guardedRequest({ method: "connect" });
+    return this.channelRequest("connect");
   }
   disconnect() {
-    return this.guardedRequest({ method: "disconnect" });
+    return this.channelRequest("disconnect");
   }
   isConnected() {
-    return this.guardedRequest({ method: "isConnected" });
+    return this.channelRequest("isConnected");
   }
   getActiveNetwork() {
-    return this.guardedRequest({ method: "getActiveNetwork" });
+    return this.channelRequest("getActiveNetwork");
   }
   listAccounts() {
-    return this.guardedRequest({ method: "listAccounts" });
+    return this.channelRequest("listAccounts");
   }
   getPrimaryAccount() {
-    return this.guardedRequest({ method: "getPrimaryAccount" });
+    return this.channelRequest("getPrimaryAccount");
   }
   signMessage(message) {
-    return this.guardedRequest({ method: "signMessage", params: { message } });
+    return this.channelRequest("signMessage", { message });
   }
   prepareExecute(params) {
-    return this.guardedRequest({ method: "prepareExecute", params });
+    return this.channelRequest("prepareExecute", params);
   }
   prepareExecuteAndWait(params) {
-    return this.guardedRequest({ method: "prepareExecuteAndWait", params });
+    return this.channelRequest("prepareExecuteAndWait", params);
   }
   ledgerApi(req) {
-    return this.guardedRequest({ method: "ledgerApi", params: req });
+    return this.channelRequest("ledgerApi", req);
   }
   // ── Events ─────────────────────────────────────────────────────────────
-  // No kernel guard here on purpose — by the time the dApp wires up an
-  // event listener it has already gone through `connect()` (which IS
-  // guarded), so we trust the binding.
+  // Delegated to the channel provider's local event bus. By the time a dApp
+  // wires up a listener it has already gone through connect(), so the channel
+  // is cached. The official extension (sync) provider has no postMessage event
+  // push either, so this preserves the API/`events` capability without
+  // inventing a non-existent wire shape; it never throws.
   on(event, listener) {
-    if (typeof window === "undefined" || !window.canton) {
-      throw new SendNotInstalledError();
-    }
-    window.canton.on(event, listener);
+    const channel = this.cachedChannel;
+    if (!channel) return;
+    channel.provider.on(event, listener);
   }
   off(event, listener) {
-    if (typeof window === "undefined" || !window.canton) return;
-    if (typeof window.canton.off === "function") {
-      window.canton.off(event, listener);
-      return;
-    }
-    if (typeof window.canton.removeListener === "function") {
-      window.canton.removeListener(event, listener);
-    }
+    const channel = this.cachedChannel;
+    if (!channel) return;
+    channel.provider.removeListener(event, listener);
   }
 };
 
@@ -367,7 +386,7 @@ var SendAdapter = class {
     }
     return {
       installed: false,
-      reason: "window.canton is present but its kernel.id does not match Send. Another Canton wallet is active."
+      reason: `Send Canton Wallet did not announce (canton:announceProvider). Visit ${SEND_INSTALL_URL} for installation instructions`
     };
   }
   async connect(ctx, _opts) {