@rhinestone/deposit-modal 0.13.0 → 0.14.0

package/dist/embed.cjs

@@ -1,18 +1,18 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunk2G2EIN4Acjs = require('./chunk-2G2EIN4A.cjs');
+var _chunkYCQZJQO6cjs = require('./chunk-YCQZJQO6.cjs');
 
 
-var _chunkRAADLTSWcjs = require('./chunk-RAADLTSW.cjs');
-require('./chunk-CVGNCUVU.cjs');
-require('./chunk-HOGZKHHY.cjs');
+var _chunk7ICSHJFEcjs = require('./chunk-7ICSHJFE.cjs');
+require('./chunk-X2IPAPXU.cjs');
+require('./chunk-LZFRL2AL.cjs');
 
 
-var _chunkZMT4ATHRcjs = require('./chunk-ZMT4ATHR.cjs');
+var _chunkV2OBGLJDcjs = require('./chunk-V2OBGLJD.cjs');
 
 
 
-var _chunkGACIGCSNcjs = require('./chunk-GACIGCSN.cjs');
+var _chunk6KG642KHcjs = require('./chunk-6KG642KH.cjs');
 require('./chunk-DW2EQA2U.cjs');
 
 
@@ -38,7 +38,16 @@ var BRIDGE_METHOD = {
   SIGN_RECOVERY: "host.signRecovery",
   /** Page→host: show a payment page outside the web view. Gated by
    *  `CAPABILITY.OPEN_URL`. */
-  OPEN_URL: "host.openUrl"
+  OPEN_URL: "host.openUrl",
+  /**
+   * Page→host, from a SUB-FRAME. Gated by `CAPABILITY.PROBE_FRAME_SCOPE`.
+   *
+   * The one request a host is meant to ignore. See `frame-scope.ts`: the page
+   * sends it from a frame that is not the main one, and a host that answers has
+   * proved it acts on sub-frame traffic — which means it would act on a wallet
+   * request from there too.
+   */
+  PROBE_FRAME_SCOPE: "bridge.probeFrameScope"
 };
 var HOST_METHOD = {
   /** Host→page: Android's hardware back and iOS's interactive swipe. Answers
@@ -48,8 +57,24 @@ var HOST_METHOD = {
 var CAPABILITY = {
   SEND_TRANSACTION: BRIDGE_METHOD.SEND_TRANSACTION,
   SIGN_RECOVERY: BRIDGE_METHOD.SIGN_RECOVERY,
-  OPEN_URL: BRIDGE_METHOD.OPEN_URL
+  OPEN_URL: BRIDGE_METHOD.OPEN_URL,
+  PROBE_FRAME_SCOPE: BRIDGE_METHOD.PROBE_FRAME_SCOPE
 };
+var PAGE_EVENT = {
+  READY: "ready",
+  LIFECYCLE: "lifecycle",
+  ANALYTICS: "analytics",
+  ERROR: "error",
+  UI_STATE: "ui.state",
+  WALLET_CONNECT_REQUESTED: "wallet.connectRequested",
+  WALLET_DISCONNECT_REQUESTED: "wallet.disconnectRequested",
+  DISMISS_REQUESTED: "dismissRequested"
+};
+var PASSTHROUGH_EVENTS = [
+  PAGE_EVENT.LIFECYCLE,
+  PAGE_EVENT.ANALYTICS,
+  PAGE_EVENT.ERROR
+];
 var ALLOWED_WALLET_METHODS = [
   "eth_chainId",
   "eth_accounts",
@@ -265,7 +290,9 @@ function createBridgeTransport(options) {
     channel.post(JSON.stringify(frame));
   }
   function notifyPending() {
-    _optionalChain([options, 'access', _3 => _3.onPendingChange, 'optionalCall', _4 => _4(pending.size)]);
+    let counted = 0;
+    for (const [, entry] of pending) if (entry.counted) counted += 1;
+    _optionalChain([options, 'access', _3 => _3.onPendingChange, 'optionalCall', _4 => _4(counted)]);
   }
   function forgetPending(id) {
     const entry = pending.get(id);
@@ -358,58 +385,71 @@ function createBridgeTransport(options) {
       });
     }
   }
-  return {
-    stats,
-    request(method, params, requestOptions) {
-      if (closed) {
-        return Promise.reject(
+  function issue(method, params, requestOptions, post, counted) {
+    if (closed) {
+      return Promise.reject(
+        new BridgeRequestError(
+          bridgeError(
+            BridgeErrorCode.CHANNEL_CLOSED,
+            "The connection to the app closed."
+          )
+        )
+      );
+    }
+    counter += 1;
+    const id = `${sessionId}.${counter}`;
+    const timeoutMs = _nullishCoalesce(_optionalChain([requestOptions, 'optionalAccess', _5 => _5.timeoutMs]), () => ( defaultTimeoutMs));
+    return new Promise((resolve, reject) => {
+      const timer = timeoutMs > 0 ? setTimeout(() => {
+        forgetPending(id);
+        reject(
           new BridgeRequestError(
+            _optionalChain([requestOptions, 'optionalAccess', _6 => _6.uncertainOnTimeout]) ? bridgeError(
+              BridgeErrorCode.SUBMISSION_UNCERTAIN,
+              "The app did not confirm whether the transaction was sent."
+            ) : bridgeError(
+              BridgeErrorCode.REQUEST_TIMEOUT,
+              "The app did not respond."
+            )
+          )
+        );
+      }, timeoutMs) : void 0;
+      pending.set(id, {
+        resolve,
+        reject,
+        timer,
+        counted
+      });
+      notifyPending();
+      try {
+        post(JSON.stringify({ kind: "request", id, method, params }));
+      } catch (error) {
+        forgetPending(id);
+        if (timer !== void 0) clearTimeout(timer);
+        reject(
+          error instanceof NoHostChannelError ? new BridgeRequestError(
             bridgeError(
               BridgeErrorCode.CHANNEL_CLOSED,
               "The connection to the app closed."
             )
-          )
+          ) : error
         );
       }
-      counter += 1;
-      const id = `${sessionId}.${counter}`;
-      const timeoutMs = _nullishCoalesce(_optionalChain([requestOptions, 'optionalAccess', _5 => _5.timeoutMs]), () => ( defaultTimeoutMs));
-      return new Promise((resolve, reject) => {
-        const timer = timeoutMs > 0 ? setTimeout(() => {
-          forgetPending(id);
-          reject(
-            new BridgeRequestError(
-              _optionalChain([requestOptions, 'optionalAccess', _6 => _6.uncertainOnTimeout]) ? bridgeError(
-                BridgeErrorCode.SUBMISSION_UNCERTAIN,
-                "The app did not confirm whether the transaction was sent."
-              ) : bridgeError(
-                BridgeErrorCode.REQUEST_TIMEOUT,
-                "The app did not respond."
-              )
-            )
-          );
-        }, timeoutMs) : void 0;
-        pending.set(id, {
-          resolve,
-          reject,
-          timer
-        });
-        notifyPending();
-        try {
-          send({ kind: "request", id, method, params });
-        } catch (error) {
-          forgetPending(id);
-          if (timer !== void 0) clearTimeout(timer);
-          reject(
-            error instanceof NoHostChannelError ? new BridgeRequestError(
-              bridgeError(
-                BridgeErrorCode.CHANNEL_CLOSED,
-                "The connection to the app closed."
-              )
-            ) : error
-          );
-        }
-      });
+    });
+  }
+  return {
+    stats,
+    request(method, params, requestOptions) {
+      return issue(
+        method,
+        params,
+        requestOptions,
+        (json) => channel.post(json),
+        true
+      );
+    },
+    requestVia(post, method, params, requestOptions) {
+      return issue(method, params, requestOptions, post, false);
     },
     emit(type, payload) {
       if (closed) return;
@@ -444,6 +484,106 @@ function createBridgeTransport(options) {
   };
 }
 
+// src/core/bridge/frame-scope.ts
+var PROBE_TIMEOUT_MS = 750;
+var FRAME_OPEN_TIMEOUT_MS = 150;
+var PROBE_MARKER_ID = "rs-frame-probe";
+function subFramePosters(inner) {
+  const posters = [];
+  const push = (candidate) => {
+    const channel = candidate;
+    if (typeof _optionalChain([channel, 'optionalAccess', _7 => _7.postMessage]) !== "function") return;
+    const post = channel.postMessage;
+    posters.push((json) => post.call(channel, json));
+  };
+  push(inner[PAGE_TO_HOST_CHANNEL]);
+  push(inner.ReactNativeWebView);
+  const webkit = inner.webkit;
+  const handlers = _optionalChain([webkit, 'optionalAccess', _8 => _8.messageHandlers]);
+  if (handlers && typeof handlers === "object") {
+    for (const name of Object.keys(handlers)) push(handlers[name]);
+  }
+  return posters;
+}
+function openProbeFrame(doc) {
+  return new Promise((resolve) => {
+    let frame;
+    try {
+      frame = doc.createElement("iframe");
+    } catch (e3) {
+      resolve(void 0);
+      return;
+    }
+    frame.setAttribute("aria-hidden", "true");
+    frame.setAttribute("title", "");
+    frame.style.cssText = "position:absolute;width:0;height:0;border:0;visibility:hidden";
+    let settled = false;
+    const done = (win) => {
+      if (settled) return;
+      settled = true;
+      if (!win) {
+        frame.remove();
+        resolve(void 0);
+        return;
+      }
+      resolve({ win, close: () => frame.remove() });
+    };
+    frame.addEventListener("load", () => {
+      if (!_optionalChain([frame, 'access', _9 => _9.contentDocument, 'optionalAccess', _10 => _10.getElementById, 'call', _11 => _11(PROBE_MARKER_ID)])) return;
+      done(_nullishCoalesce(frame.contentWindow, () => ( void 0)));
+    });
+    frame.addEventListener("error", () => done(void 0));
+    setTimeout(() => done(void 0), FRAME_OPEN_TIMEOUT_MS);
+    try {
+      frame.srcdoc = `<!doctype html><meta charset=utf-8><i id=${PROBE_MARKER_ID}></i>`;
+      doc.body.appendChild(frame);
+    } catch (e4) {
+      frame.remove();
+      done(void 0);
+    }
+  });
+}
+async function probeChannelScope(options) {
+  const doc = options.doc;
+  if (!_optionalChain([doc, 'optionalAccess', _12 => _12.body])) return "unknown";
+  const frame = await (_nullishCoalesce(options.openFrame, () => ( openProbeFrame)))(doc);
+  if (!frame) return "unknown";
+  try {
+    const posters = subFramePosters(frame.win);
+    if (posters.length === 0) return "main-frame";
+    let delivered = 0;
+    try {
+      await options.issue((json) => {
+        for (const post of posters) {
+          try {
+            post(json);
+            delivered += 1;
+          } catch (e5) {
+          }
+        }
+      });
+      return "all-frames";
+    } catch (error) {
+      if (delivered === 0) return "unknown";
+      if (isBridgeCode(error, BridgeErrorCode.REQUEST_TIMEOUT)) {
+        return "main-frame";
+      }
+      if (isBridgeCode(error, BridgeErrorCode.CHANNEL_CLOSED)) return "unknown";
+      if (isBridgeRequestError(error)) return "all-frames";
+      return "unknown";
+    }
+  } finally {
+    frame.close();
+  }
+}
+var CHANNEL_SCOPE_ADVICE = `[rhinestone] This app answered ${BRIDGE_METHOD.PROBE_FRAME_SCOPE} sent from a sub-frame, so any frame in its web view can drive the wallet. Fix it natively: drop a message unless frameInfo.isMainFrame (iOS) or onPostMessage's isMainFrame (Android). Scoping the ${PAGE_TO_HOST_CHANNEL} shim is not enough \u2014 the primitive under it is in every frame regardless. Wallet, withdraw and claim are withheld until then.`;
+var advised = false;
+function adviseOnChannelScope(scope) {
+  if (scope !== "all-frames" || advised) return;
+  advised = true;
+  console.error(CHANNEL_SCOPE_ADVICE);
+}
+
 // src/core/bridge/validate.ts
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -515,7 +655,7 @@ var SWITCH_CONFIRMATION_TIMEOUT_MS = 15e3;
 var HASH_PATTERN = /^0x[0-9a-fA-F]{64}$/;
 var HEX_PATTERN = /^0x[0-9a-fA-F]*$/;
 function evmAccount(state) {
-  return _optionalChain([state, 'access', _7 => _7.accounts, 'access', _8 => _8.find, 'call', _9 => _9((account) => account.caip10.startsWith("eip155:")), 'optionalAccess', _10 => _10.caip10]);
+  return _optionalChain([state, 'access', _13 => _13.accounts, 'access', _14 => _14.find, 'call', _15 => _15((account) => account.caip10.startsWith("eip155:")), 'optionalAccess', _16 => _16.caip10]);
 }
 function evmAddressFrom(state) {
   const caip10 = evmAccount(state);
@@ -555,7 +695,7 @@ function assertResultShape(method, result) {
         `${method}: ${detail}`
       )
     );
-    throw SUBMITTING_WALLET_METHODS.includes(method) ? _chunkRAADLTSWcjs.markSubmissionUncertain.call(void 0, error) : error;
+    throw SUBMITTING_WALLET_METHODS.includes(method) ? _chunk7ICSHJFEcjs.markSubmissionUncertain.call(void 0, error) : error;
   };
   switch (method) {
     case "eth_sendTransaction":
@@ -607,7 +747,7 @@ function createBridgedWalletSession(options) {
       );
     } catch (error) {
       if (submitting && isBridgeRequestError(error) && error.code === -32603) {
-        throw _chunkRAADLTSWcjs.markSubmissionUncertain.call(void 0, 
+        throw _chunk7ICSHJFEcjs.markSubmissionUncertain.call(void 0, 
           new BridgeRequestError(
             bridgeError(
               BridgeErrorCode.SUBMISSION_UNCERTAIN,
@@ -618,7 +758,7 @@ function createBridgedWalletSession(options) {
         );
       }
       if (submitting && isBridgeCode(error, BridgeErrorCode.SUBMISSION_UNCERTAIN)) {
-        throw _chunkRAADLTSWcjs.markSubmissionUncertain.call(void 0, error);
+        throw _chunk7ICSHJFEcjs.markSubmissionUncertain.call(void 0, error);
       }
       throw error;
     }
@@ -659,7 +799,7 @@ function createBridgedWalletSession(options) {
         stateWaiters.delete(waiter);
         reject(
           new Error(
-            `Switch to ${_nullishCoalesce(_optionalChain([resolveChain, 'call', _11 => _11(chainId), 'optionalAccess', _12 => _12.name]), () => ( _chunk4KCSH4T3cjs.getChainName.call(void 0, chainId)))} in your wallet to continue`
+            `Switch to ${_nullishCoalesce(_optionalChain([resolveChain, 'call', _17 => _17(chainId), 'optionalAccess', _18 => _18.name]), () => ( _chunk4KCSH4T3cjs.getChainName.call(void 0, chainId)))} in your wallet to continue`
           )
         );
       }, SWITCH_CONFIRMATION_TIMEOUT_MS);
@@ -714,7 +854,7 @@ function createBridgedWalletSession(options) {
     applyWalletState(next) {
       state = next;
       for (const waiter of [...stateWaiters]) waiter(next);
-      _optionalChain([options, 'access', _13 => _13.onStateChange, 'optionalCall', _14 => _14(next)]);
+      _optionalChain([options, 'access', _19 => _19.onStateChange, 'optionalCall', _20 => _20(next)]);
     }
   };
 }
@@ -737,7 +877,7 @@ async function connectToHost(options) {
   });
   const params = {
     protocol: PROTOCOL_VERSION,
-    modalVersion: _chunkGACIGCSNcjs.MODAL_VERSION
+    modalVersion: _chunk6KG642KHcjs.MODAL_VERSION
   };
   let raw;
   try {
@@ -769,8 +909,32 @@ async function connectToHost(options) {
   transport.on("session.configure", (payload) => {
     if (typeof payload !== "object" || payload === null) return;
     config = payload;
-    _optionalChain([options, 'access', _15 => _15.onConfig, 'optionalCall', _16 => _16(config)]);
+    _optionalChain([options, 'access', _21 => _21.onConfig, 'optionalCall', _22 => _22(config)]);
   });
+  const probeable = hello.capabilities.includes(CAPABILITY.PROBE_FRAME_SCOPE);
+  let channelScope = probeable ? "probing" : "unknown";
+  let announceSettled = () => {
+  };
+  const channelScopeSettled = probeable ? new Promise((resolve) => {
+    announceSettled = resolve;
+  }) : Promise.resolve(channelScope);
+  const settleScope = (next) => {
+    channelScope = next;
+    adviseOnChannelScope(next);
+    _optionalChain([options, 'access', _23 => _23.onChannelScope, 'optionalCall', _24 => _24(next)]);
+    announceSettled(next);
+  };
+  if (probeable) {
+    void probeChannelScope({
+      doc: options.probeDocument !== void 0 ? options.probeDocument : globalThis.document,
+      issue: (post) => transport.requestVia(
+        post,
+        BRIDGE_METHOD.PROBE_FRAME_SCOPE,
+        {},
+        { timeoutMs: PROBE_TIMEOUT_MS }
+      )
+    }).then(settleScope).catch(() => settleScope("unknown"));
+  }
   return {
     transport,
     hello,
@@ -778,6 +942,10 @@ async function connectToHost(options) {
     get config() {
       return config;
     },
+    get channelScope() {
+      return channelScope;
+    },
+    channelScopeSettled,
     close() {
       transport.close();
     }
@@ -795,12 +963,12 @@ async function requestHostTransfer(transport, params) {
     );
   } catch (error) {
     if (error instanceof Error && isBridgeCode(error, BridgeErrorCode.SUBMISSION_UNCERTAIN)) {
-      throw _chunkRAADLTSWcjs.markSubmissionUncertain.call(void 0, error);
+      throw _chunk7ICSHJFEcjs.markSubmissionUncertain.call(void 0, error);
     }
     throw error;
   }
-  if (!isTxHash(_optionalChain([result, 'optionalAccess', _17 => _17.txHash]))) {
-    throw _chunkRAADLTSWcjs.markSubmissionUncertain.call(void 0, 
+  if (!isTxHash(_optionalChain([result, 'optionalAccess', _25 => _25.txHash]))) {
+    throw _chunk7ICSHJFEcjs.markSubmissionUncertain.call(void 0, 
       new Error(
         "The app did not return a transaction hash. Check your activity before trying again."
       )
@@ -814,7 +982,7 @@ async function requestHostRecoverySignature(transport, params) {
     params,
     { timeoutMs: USER_APPROVAL_TIMEOUT_MS }
   );
-  if (!isHex(_optionalChain([result, 'optionalAccess', _18 => _18.signature]))) {
+  if (!isHex(_optionalChain([result, 'optionalAccess', _26 => _26.signature]))) {
     throw new Error("The app did not return a signature.");
   }
   return result.signature;
@@ -823,7 +991,7 @@ async function requestHostBrowser(transport, url) {
   let parsed;
   try {
     parsed = new URL(url);
-  } catch (e3) {
+  } catch (e6) {
     throw new Error("The payment page address could not be read.");
   }
   if (parsed.protocol !== "https:") {
@@ -875,8 +1043,8 @@ function uiStateFor(input) {
 var VIEWPORT_HEIGHT_PROPERTY = "--rs-embed-viewport-height";
 function trackVisualViewport(win) {
   const target = win;
-  const viewport = _optionalChain([target, 'optionalAccess', _19 => _19.visualViewport]);
-  const style = _optionalChain([target, 'optionalAccess', _20 => _20.document, 'optionalAccess', _21 => _21.documentElement, 'optionalAccess', _22 => _22.style]);
+  const viewport = _optionalChain([target, 'optionalAccess', _27 => _27.visualViewport]);
+  const style = _optionalChain([target, 'optionalAccess', _28 => _28.document, 'optionalAccess', _29 => _29.documentElement, 'optionalAccess', _30 => _30.style]);
   if (!viewport || !style) return () => {
   };
   const apply = () => {
@@ -898,10 +1066,10 @@ var UNKNOWN_SCREEN = "unknown";
 // src/embed.tsx
 var _jsxruntime = require('react/jsx-runtime');
 var WithdrawModal = _react.lazy.call(void 0, 
-  () => Promise.resolve().then(() => _interopRequireWildcard(require("./WithdrawModal-YYSBPCJJ.cjs"))).then((m) => ({ default: m.WithdrawModal }))
+  () => Promise.resolve().then(() => _interopRequireWildcard(require("./WithdrawModal-VP6PMIRO.cjs"))).then((m) => ({ default: m.WithdrawModal }))
 );
 var ClaimModal = _react.lazy.call(void 0, 
-  () => Promise.resolve().then(() => _interopRequireWildcard(require("./ClaimModal-JRIA32U2.cjs"))).then((m) => ({ default: m.ClaimModal }))
+  () => Promise.resolve().then(() => _interopRequireWildcard(require("./ClaimModal-IKTJU43Y.cjs"))).then((m) => ({ default: m.ClaimModal }))
 );
 function missingField(config, keys) {
   const missing = keys.find(
@@ -925,7 +1093,19 @@ function missingCapability(capabilities, needed, mode) {
     message: `This app cannot run ${mode}: it does not implement ${needed}.`
   };
 }
-function refusal(config, capabilities) {
+var UNSCOPED_CHANNEL_CODE = "EMBED_CHANNEL_UNSCOPED";
+var UNSCOPED_REQUEST_MESSAGE = "This app cannot complete the request: every frame in its web view can reach the bridge channel.";
+function unscopedRefusal(mode) {
+  return {
+    code: UNSCOPED_CHANNEL_CODE,
+    message: `This app cannot run ${mode}: every frame in its web view can reach the bridge channel, so the page will not send it a signing request.`
+  };
+}
+function refusal(config, capabilities, channelScope) {
+  if (channelScope === "all-frames") {
+    if (config.mode === "withdraw") return unscopedRefusal("a withdrawal");
+    if (config.mode === "claim") return unscopedRefusal("a claim");
+  }
   switch (config.mode) {
     case "deposit": {
       const missing = missingField(config, [
@@ -1011,6 +1191,7 @@ function sanitizeConfig(config) {
     enableQrTransfer: bool(config.enableQrTransfer),
     enableGaslessDeposit: bool(config.enableGaslessDeposit),
     enableExchangeConnect: bool(config.enableExchangeConnect),
+    enableAnalyticsIngest: bool(config.enableAnalyticsIngest),
     fiatMethods: obj(config.fiatMethods),
     assetMigrations: obj(config.assetMigrations),
     initialAssetMigration: str(
@@ -1033,7 +1214,7 @@ function onrampUnavailable(config, capabilities) {
     message: `Fiat and exchange funding are hidden: this app does not implement ${CAPABILITY.OPEN_URL}.`
   };
 }
-function toModalProps(config, canOpenExternally) {
+function toModalProps(config, canOpenExternally, walletWithheld) {
   return {
     isOpen: true,
     // Native draws the sheet. Inline is what stops the page drawing a scrim
@@ -1055,11 +1236,15 @@ function toModalProps(config, canOpenExternally) {
     outputTokenRules: config.outputTokenRules,
     rejectUnmapped: config.rejectUnmapped,
     forceRegister: config.forceRegister,
-    enableWallet: config.enableWallet,
+    // Explicit `false`, not an absent flag: `DepositFlow` defaults
+    // `enableWallet` to true, so leaving it undefined would offer the wallet
+    // row on exactly the host it is being withheld from.
+    enableWallet: walletWithheld ? false : config.enableWallet,
     enableFiatOnramp: canOpenExternally && config.enableFiatOnramp,
     enableQrTransfer: config.enableQrTransfer,
     enableGaslessDeposit: config.enableGaslessDeposit,
     enableExchangeConnect: canOpenExternally && config.enableExchangeConnect,
+    enableAnalyticsIngest: config.enableAnalyticsIngest,
     fiatMethods: config.fiatMethods,
     assetMigrations: config.assetMigrations,
     initialAssetMigration: config.initialAssetMigration,
@@ -1072,6 +1257,7 @@ function DepositEmbed({ target, onFatal }) {
   const [session, setSession] = _react.useState.call(void 0, null);
   const [config, setConfig] = _react.useState.call(void 0, null);
   const [walletPending, setWalletPending] = _react.useState.call(void 0, false);
+  const [channelScope, setChannelScope] = _react.useState.call(void 0, "unknown");
   const pendingRef = _react.useRef.call(void 0, false);
   const completedRef = _react.useRef.call(void 0, false);
   const uiRef = _react.useRef.call(void 0, {
@@ -1099,6 +1285,9 @@ function DepositEmbed({ target, onFatal }) {
           onPendingChange: (pending) => {
             pendingRef.current = pending > 0;
             if (live) setWalletPending(pending > 0);
+          },
+          onChannelScope: (scope) => {
+            if (live) setChannelScope(scope);
           }
         });
         if (!live) {
@@ -1114,30 +1303,31 @@ function DepositEmbed({ target, onFatal }) {
             return { handled: true };
           }
           const back = uiRef.current.back;
-          _optionalChain([back, 'optionalCall', _23 => _23()]);
+          _optionalChain([back, 'optionalCall', _31 => _31()]);
           return { handled: Boolean(back) };
         });
-        _chunkGACIGCSNcjs.setEmbedHost.call(void 0, next.hello.host);
+        _chunk6KG642KHcjs.setEmbedHost.call(void 0, next.hello.host);
         setSession(next);
+        setChannelScope(next.channelScope);
         setConfig(sanitizeConfig(next.hello.config));
-        void _chunkZMT4ATHRcjs.primeRuntimeChains.call(void 0, next.hello.config.backendUrl).then((result) => {
+        void _chunkV2OBGLJDcjs.primeRuntimeChains.call(void 0, next.hello.config.backendUrl).then((result) => {
           chains = result;
         });
       } catch (error) {
-        if (live) _optionalChain([onFatalRef, 'access', _24 => _24.current, 'optionalCall', _25 => _25(error)]);
+        if (live) _optionalChain([onFatalRef, 'access', _32 => _32.current, 'optionalCall', _33 => _33(error)]);
       }
     })();
     return () => {
       live = false;
-      _optionalChain([opened, 'optionalAccess', _26 => _26.close, 'call', _27 => _27()]);
-      _chunkGACIGCSNcjs.setEmbedHost.call(void 0, null);
+      _optionalChain([opened, 'optionalAccess', _34 => _34.close, 'call', _35 => _35()]);
+      _chunk6KG642KHcjs.setEmbedHost.call(void 0, null);
     };
   }, [target]);
   const handleUiState = _react.useCallback.call(void 0, 
     (state) => {
       if (isHomeScreen(state.screen)) completedRef.current = false;
       uiRef.current = state;
-      _optionalChain([session, 'optionalAccess', _28 => _28.transport, 'access', _29 => _29.emit, 'call', _30 => _30(
+      _optionalChain([session, 'optionalAccess', _36 => _36.transport, 'access', _37 => _37.emit, 'call', _38 => _38(
         "ui.state",
         uiStateFor({ ...state, walletRequestPending: walletPending })
       )]);
@@ -1158,16 +1348,30 @@ function DepositEmbed({ target, onFatal }) {
       uiStateFor({ ...uiRef.current, walletRequestPending: walletPending })
     );
   }, [session, walletPending]);
-  const refused = config && session ? refusal(config, session.hello.capabilities) : null;
+  const refused = config && session ? refusal(config, session.hello.capabilities, channelScope) : null;
+  const walletWithheld = channelScope === "all-frames" || channelScope === "probing";
+  const refuseIfUnscoped = _react.useCallback.call(void 0, async () => {
+    if (!session) throw new Error("The app is not connected.");
+    const scope = await session.channelScopeSettled;
+    if (scope === "all-frames") throw new Error(UNSCOPED_REQUEST_MESSAGE);
+  }, [session]);
   _react.useEffect.call(void 0, () => {
     if (!session || !refused) return;
     session.transport.emit("error", refused);
-  }, [session, _optionalChain([refused, 'optionalAccess', _31 => _31.code]), _optionalChain([refused, 'optionalAccess', _32 => _32.message])]);
+  }, [session, _optionalChain([refused, 'optionalAccess', _39 => _39.code]), _optionalChain([refused, 'optionalAccess', _40 => _40.message])]);
   const onrampHidden = config && session && !refused ? onrampUnavailable(config, session.hello.capabilities) : null;
   _react.useEffect.call(void 0, () => {
     if (!session || !onrampHidden) return;
     session.transport.emit("error", onrampHidden);
-  }, [session, _optionalChain([onrampHidden, 'optionalAccess', _33 => _33.code]), _optionalChain([onrampHidden, 'optionalAccess', _34 => _34.message])]);
+  }, [session, _optionalChain([onrampHidden, 'optionalAccess', _41 => _41.code]), _optionalChain([onrampHidden, 'optionalAccess', _42 => _42.message])]);
+  const walletHidden = session && !refused && channelScope === "all-frames" ? {
+    code: UNSCOPED_CHANNEL_CODE,
+    message: "Wallet funding is hidden: every frame in this app's web view can reach the bridge channel. Scope the injected channel to the main frame."
+  } : null;
+  _react.useEffect.call(void 0, () => {
+    if (!session || !walletHidden) return;
+    session.transport.emit("error", walletHidden);
+  }, [session, _optionalChain([walletHidden, 'optionalAccess', _43 => _43.code]), _optionalChain([walletHidden, 'optionalAccess', _44 => _44.message])]);
   if (!session || !config || refused) return null;
   const ready = config;
   const { transport } = session;
@@ -1177,6 +1381,7 @@ function DepositEmbed({ target, onFatal }) {
     inline: true,
     className: "rs-embed",
     backendUrl: ready.backendUrl,
+    enableAnalyticsIngest: ready.enableAnalyticsIngest,
     theme: config.theme,
     uiConfig: config.uiConfig,
     debug: config.debug,
@@ -1200,15 +1405,18 @@ function DepositEmbed({ target, onFatal }) {
         recipient: ready.recipient,
         defaultAmount: ready.defaultAmount,
         forceRegister: ready.forceRegister,
-        onSendTransaction: async (request) => ({
-          txHash: await requestHostTransfer(transport, {
-            chainId: request.chainId,
-            token: request.token,
-            amount: request.amount.toString(),
-            to: request.to,
-            from: ready.accountAddress
-          })
-        }),
+        onSendTransaction: async (request) => {
+          await refuseIfUnscoped();
+          return {
+            txHash: await requestHostTransfer(transport, {
+              chainId: request.chainId,
+              token: request.token,
+              amount: request.amount.toString(),
+              to: request.to,
+              from: ready.accountAddress
+            })
+          };
+        },
         onUiState: handleUiState,
         onLifecycle: (event) => {
           if (event.type === "complete") completedRef.current = true;
@@ -1224,16 +1432,15 @@ function DepositEmbed({ target, onFatal }) {
         ...shared,
         defaultTxHash: ready.defaultTxHash,
         defaultRefundDestination: ready.defaultDestination,
-        signRecovery: async ({ chainId, signer, depositId, destination }) => (
-          // The fields, not the struct: the host holds the canonical domain
-          // and types, so this cannot become a request to sign anything else.
-          await requestHostRecoverySignature(transport, {
+        signRecovery: async ({ chainId, signer, depositId, destination }) => {
+          await refuseIfUnscoped();
+          return await requestHostRecoverySignature(transport, {
             chainId,
             signer,
             depositId,
             destination
-          })
-        ),
+          });
+        },
         onUiState: handleUiState,
         onLifecycle: (event) => {
           if (event.type === "complete") completedRef.current = true;
@@ -1243,11 +1450,12 @@ function DepositEmbed({ target, onFatal }) {
     ) });
   }
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    _chunk2G2EIN4Acjs.DepositModalInner,
+    _chunkYCQZJQO6cjs.DepositModalInner,
     {
-      ...toModalProps(ready, canOpenExternally),
+      ...toModalProps(ready, canOpenExternally, walletWithheld),
       openExternally: canOpenExternally ? openExternally : void 0,
-      walletSession: session.wallet.session,
+      walletSession: walletWithheld ? void 0 : session.wallet.session,
+      walletIntegration: "host_supplied",
       hasWalletClientProp: false,
       onUiState: handleUiState,
       onReady: () => session.transport.emit("ready"),