@rhinestone/deposit-modal 0.17.0 → 0.19.0

package/README.md

@@ -114,6 +114,31 @@ time, it does not emit the `submitted` lifecycle event with the processor's
 internal tracking key. Its `complete` event reports the settled source and
 destination transaction hashes once they exist.
 
+## Checkout payments
+
+Pass `payment` when the modal funds one merchant order:
+
+```tsx
+<DepositModal
+  {...depositProps}
+  payment={{ salt: order.accountSalt, amount: order.amountBaseUnits }}
+/>
+```
+
+Register the order's managed account on your server first, then pass its 32-byte
+salt to the modal. The same salt must resolve to the account address stored with
+the order. `amount` is the required **destination token amount in base units**,
+not a USD amount. The modal asks `/quotes/preview` for an `exactOut` quote and
+shows the source amount the payer should send; the backend proxy must forward
+that route to a processor with `exactOut` support.
+
+Reconcile using the account on processor webhooks or `GET /deposits?account=`.
+`destinationAmount` on the `complete` event is the amount actually delivered in
+destination token base units. Quotes are estimates, and a payer using a QR,
+exchange, or card can send a different amount, so compare the delivered amount
+with the order amount before marking it paid. Checkout mode withholds the
+recipient's deposit history from the payer.
+
 ## Withdraw
 
 `WithdrawModal` lives at `@rhinestone/deposit-modal/withdraw` and reports through the same `onLifecycle` + `onError` callbacks. It needs no wallet: you give it the account holding the funds and a function that performs one transfer.
@@ -347,3 +372,87 @@ Local setup, the release process and where the docs live are in
 ## License
 
 MIT
+
+## Onramp and offramp services
+
+Deploy an updated `deposit-widget-proxy` before enabling these opt-in clients.
+Custom proxies must allow Authorization in CORS and forward customer routes
+without injecting `x-api-key`. Never proxy `POST /compliance/sessions` publicly.
+
+On your server, import `createCustomerSessionHandler` from
+`@rhinestone/deposit-modal/server`. Supply your server-held `apiKey` and an
+`authorize(request)` callback that authenticates the user, enforces CSRF policy,
+and returns `{ externalCustomerId, smartAccount? }` from trusted server state.
+Mount its returned handler on your authenticated POST endpoint. It returns only
+the 15-minute `token` and `expiresAt`, with no-store response headers.
+
+Use separate scoped clients for onramp and offramp. The transport is internal;
+the package does not expose a generic customer service or arbitrary request method.
+
+```ts
+import { createOnrampService } from '@rhinestone/deposit-modal/onramp';
+import { createOfframpService } from '@rhinestone/deposit-modal/offramp';
+import { getComplianceStatus } from '@rhinestone/deposit-modal/compliance';
+
+const options = {
+  backendUrl: proxyUrl,
+  getSession: () => authenticatedSessionClient.getCustomerSession(),
+};
+const onramp = createOnrampService(options);
+const offramp = createOfframpService(options);
+const setup = await onramp.createSetup({
+  purpose: 'account_setup',
+  country: 'DE',
+  currency: 'EUR',
+  paymentMethod: 'bank_transfer',
+});
+// Setup completes in this call and returns the account it configured.
+// Show the customer their bank details through a separate, repeatable call:
+const { nextAction } = await onramp.getAccountDetails(setup.account.id);
+const status = await getComplianceStatus(options);
+```
+
+The onramp client has `createSetup`, `getSetup`, `getOptions`, `listAccounts`,
+`getAccount`, `getAccountDetails`, `listPayments` and `getPayment`. The offramp
+client has session/options/payment methods, without accounts.
+`getComplianceStatus` retains the existing `/compliance/status` read separately;
+it is not a preliminary step. Shared types include `RampSession` (offramp),
+`OnrampSetup`, `RampOption` and `RampCurrency`.
+`CustomerSession` remains the browser bearer/expiry pair. Catch `ScopedRequestError`
+and inspect its `status` for HTTP failures; response bodies are not included.
+
+The three lightweight subpaths replace the unpublished `/customer` entry point.
+They do not import React, wallet connectors or the server-only token helper.
+
+`getSession` is called per request. Keep tokens in memory, scoped to the logged-in
+user, and refresh them through your authenticated server. The clients reject
+expired sessions and never fall back to an application key. They make no calls
+until explicitly invoked, so existing modals and Swapped flows remain unchanged.
+There is no preliminary capability request. Support/recovery methods belong to
+the future provider lifecycle implementation and are not exposed here.
+
+**An onramp setup is not a session.** It completes in the call that creates it
+and returns `{ id, account }` — no status to poll, no expiry, no `nextAction`.
+Bank details are read separately through `getAccountDetails`, because a customer
+reads them before every transfer while setup happens once; that call returns a
+hosted address and never the coordinates themselves. An offramp session keeps
+`RampSession` with its status, expiry and `nextAction`, because it really is one
+interaction.
+
+Routes are scoped to the provider that serves them — `/onramp/noah/*` and
+`/offramp/noah/*` here, while the existing Swapped flows keep their own paths.
+A proxy must allow each one explicitly; an unlisted path 404s before reaching
+the processor.
+
+The initial contracts support EUR/USD bank transfers only. Onramp setup
+uses `purpose: 'account_setup'` without an amount; the actual transfer determines
+fiat sent. Offramp hosted beneficiary collection uses
+`purpose: 'beneficiary_collection'`, separately from quoting and funding.
+Offramp options use `amount` as decimal fiat major units the recipient receives.
+No crypto-input quoting is exposed. Accounts return safe references/config/status,
+not bank instructions. Hosted interaction completion never means payment
+settlement; funding, payout and late returns have independent status fields.
+
+The provider adapter and journey execution are not connected by this release.
+Expect 503 until those implementations are deployed. Render hosted URLs only
+after the journey's iframe presentation has been verified; do not log/store URLs.

package/dist/{DepositModalReown-6CXXGQ7X.cjs → DepositModalReown-UITYXJ6W.cjs}

@@ -1,7 +1,8 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkXJMDCBHScjs = require('./chunk-XJMDCBHS.cjs');
+var _chunkOCWSMLOPcjs = require('./chunk-OCWSMLOP.cjs');
+require('./chunk-LVCD6RHF.cjs');
 
 
 
@@ -10,13 +11,12 @@ var _chunkXJMDCBHScjs = require('./chunk-XJMDCBHS.cjs');
 
 
 
-var _chunkQGNJFDEOcjs = require('./chunk-QGNJFDEO.cjs');
-require('./chunk-JCWJ6HW7.cjs');
-require('./chunk-LVCD6RHF.cjs');
+var _chunkHMUGY66Ocjs = require('./chunk-HMUGY66O.cjs');
 
 
 
 var _chunkOY5N3E6Lcjs = require('./chunk-OY5N3E6L.cjs');
+require('./chunk-PYOC6K24.cjs');
 
 // src/DepositModalReown.tsx
 var _react = require('react');
@@ -44,7 +44,7 @@ var {
   unichain,
   katana,
   hyperEvm
-} = _chunkXJMDCBHScjs.getReownDependencies.call(void 0, )[1];
+} = _chunkOCWSMLOPcjs.getReownDependencies.call(void 0, )[1];
 var APPKIT_NETWORK_BY_ID = {
   [mainnet.id]: mainnet,
   [optimism.id]: optimism,
@@ -76,7 +76,7 @@ function getAppKitNetwork(chainId) {
 
 // src/core/reown-theme.ts
 function mapTheme(theme) {
-  const themeMode = _chunkQGNJFDEOcjs.resolveThemeMode.call(void 0, _optionalChain([theme, 'optionalAccess', _ => _.mode])) === "light" ? "light" : "dark";
+  const themeMode = _chunkHMUGY66Ocjs.resolveThemeMode.call(void 0, _optionalChain([theme, 'optionalAccess', _ => _.mode])) === "light" ? "light" : "dark";
   const themeVariables = {
     "--apkt-accent": _optionalChain([theme, 'optionalAccess', _2 => _2.ctaColor])
   };
@@ -93,7 +93,7 @@ function setAppKitTheme(appKit, theme) {
 
 // src/core/reown.tsx
 var _jsxruntime = require('react/jsx-runtime');
-var [appKitReact, appKitNetworks, wagmiAdapter, solanaAdapter] = _chunkXJMDCBHScjs.getReownDependencies.call(void 0, );
+var [appKitReact, appKitNetworks, wagmiAdapter, solanaAdapter] = _chunkOCWSMLOPcjs.getReownDependencies.call(void 0, );
 var {
   createAppKit,
   useAppKit,
@@ -109,14 +109,14 @@ function buildTransports(rpcUrls, networks = EVM_NETWORKS) {
   const transports = {};
   for (const network of networks) {
     const id = Number(network.id);
-    transports[id] = _viem.http.call(void 0, _chunkQGNJFDEOcjs.rpcUrlFor.call(void 0, rpcUrls, id));
+    transports[id] = _viem.http.call(void 0, _chunkHMUGY66Ocjs.rpcUrlFor.call(void 0, rpcUrls, id));
   }
   return transports;
 }
 function getEvmRpcFingerprint(rpcUrls, networks) {
   return networks.map((network) => {
     const id = Number(network.id);
-    return `${id}=${_nullishCoalesce(_chunkQGNJFDEOcjs.rpcUrlFor.call(void 0, rpcUrls, id), () => ( ""))}`;
+    return `${id}=${_nullishCoalesce(_chunkHMUGY66Ocjs.rpcUrlFor.call(void 0, rpcUrls, id), () => ( ""))}`;
   }).join("|");
 }
 var cachedAdapter = null;
@@ -187,7 +187,7 @@ function ReownWalletProvider({
   backendUrl,
   children
 }) {
-  const rpcUrls = _chunkQGNJFDEOcjs.useStableRpcUrls.call(void 0, rpcUrlsProp);
+  const rpcUrls = _chunkHMUGY66Ocjs.useStableRpcUrls.call(void 0, rpcUrlsProp);
   const [queryClient] = _react.useState.call(void 0, () => new (0, _reactquery.QueryClient)());
   const overrides = _react.useMemo.call(void 0, () => {
     if (!rpcUrls) return void 0;
@@ -199,14 +199,14 @@ function ReownWalletProvider({
     return out;
   }, [rpcUrls]);
   const [state, setState] = _react.useState.call(void 0, () => {
-    const primed = _chunkQGNJFDEOcjs.peekRuntimeChains.call(void 0, backendUrl, overrides);
+    const primed = _chunkHMUGY66Ocjs.peekRuntimeChains.call(void 0, backendUrl, overrides);
     return { ready: primed !== null, chains: _nullishCoalesce(primed, () => ( [])) };
   });
   _react.useEffect.call(void 0, () => {
     let active = true;
-    const primed = _chunkQGNJFDEOcjs.peekRuntimeChains.call(void 0, backendUrl, overrides);
+    const primed = _chunkHMUGY66Ocjs.peekRuntimeChains.call(void 0, backendUrl, overrides);
     setState({ ready: primed !== null, chains: _nullishCoalesce(primed, () => ( [])) });
-    _chunkQGNJFDEOcjs.primeRuntimeChains.call(void 0, backendUrl, overrides).then((chains) => {
+    _chunkHMUGY66Ocjs.primeRuntimeChains.call(void 0, backendUrl, overrides).then((chains) => {
       if (active) setState({ ready: true, chains });
     });
     return () => {
@@ -215,7 +215,7 @@ function ReownWalletProvider({
   }, [backendUrl, overrides]);
   _react.useEffect.call(void 0, () => {
     setAppKitTheme(appKitReact.modal, theme);
-    return _chunkQGNJFDEOcjs.followSystemAppearance.call(void 0, 
+    return _chunkHMUGY66Ocjs.followSystemAppearance.call(void 0, 
       _optionalChain([theme, 'optionalAccess', _7 => _7.mode]),
       () => setAppKitTheme(appKitReact.modal, theme)
     );
@@ -279,7 +279,7 @@ function useReownWalletSession() {
           await switchChainAsync({ chainId });
         }
       } catch (err) {
-        if (_chunkQGNJFDEOcjs.isUnsupportedChainSwitchError.call(void 0, err)) {
+        if (_chunkHMUGY66Ocjs.isUnsupportedChainSwitchError.call(void 0, err)) {
           throw new Error(
             `Switch to ${chainDisplayName(chainId)} in your wallet to continue`
           );
@@ -292,7 +292,7 @@ function useReownWalletSession() {
 
 // src/DepositModalReown.tsx
 
-var [appKitReact2, , , , solanaAdapterReact] = _chunkXJMDCBHScjs.getReownDependencies.call(void 0, );
+var [appKitReact2, , , , solanaAdapterReact] = _chunkOCWSMLOPcjs.getReownDependencies.call(void 0, );
 var { useAppKitProvider } = appKitReact2;
 var { useAppKitConnection } = solanaAdapterReact;
 function DepositModalWithReown(props) {
@@ -314,7 +314,7 @@ function DepositModalWithReown(props) {
     reown.disconnect();
   }, [reown.disconnect]);
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    _chunkXJMDCBHScjs.DepositModalInner,
+    _chunkOCWSMLOPcjs.DepositModalInner,
     {
       ...props,
       walletSession: reownWithSolana,

package/dist/{DepositModalReown-ELDSTIME.mjs → DepositModalReown-XBNY6QCI.mjs}

@@ -1,7 +1,8 @@
 import {
   DepositModalInner,
   getReownDependencies
-} from "./chunk-H66WM5AO.mjs";
+} from "./chunk-NITKDXHR.mjs";
+import "./chunk-FTWKAJGN.mjs";
 import {
   followSystemAppearance,
   isUnsupportedChainSwitchError,
@@ -10,13 +11,12 @@ import {
   resolveThemeMode,
   rpcUrlFor,
   useStableRpcUrls
-} from "./chunk-QMGEK623.mjs";
-import "./chunk-XCBDJPBD.mjs";
-import "./chunk-FTWKAJGN.mjs";
+} from "./chunk-5NWLS5BQ.mjs";
 import {
   SUPPORTED_CHAIN_IDS,
   getChainName
 } from "./chunk-EAGMY3QE.mjs";
+import "./chunk-X6N2XPTO.mjs";
 
 // src/DepositModalReown.tsx
 import { useCallback, useMemo as useMemo2 } from "react";

package/dist/{WithdrawModal-QRMDR5T4.mjs → WithdrawModal-DY6A55OA.mjs}

@@ -1,10 +1,10 @@
 import {
   WithdrawModal,
   buildWithdrawAnalyticsSessionProperties
-} from "./chunk-ZHX4QROC.mjs";
-import "./chunk-QMGEK623.mjs";
-import "./chunk-XCBDJPBD.mjs";
+} from "./chunk-BIL4ENC3.mjs";
+import "./chunk-5NWLS5BQ.mjs";
 import "./chunk-EAGMY3QE.mjs";
+import "./chunk-X6N2XPTO.mjs";
 export {
   WithdrawModal,
   buildWithdrawAnalyticsSessionProperties

package/dist/WithdrawModal-V42OK7L3.cjs

@@ -0,0 +1,11 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _chunkEG4H7OMCcjs = require('./chunk-EG4H7OMC.cjs');
+require('./chunk-HMUGY66O.cjs');
+require('./chunk-OY5N3E6L.cjs');
+require('./chunk-PYOC6K24.cjs');
+
+
+
+exports.WithdrawModal = _chunkEG4H7OMCcjs.WithdrawModal; exports.buildWithdrawAnalyticsSessionProperties = _chunkEG4H7OMCcjs.buildWithdrawAnalyticsSessionProperties;

package/dist/bearer-transport-CVHNBgoV.d.cts

@@ -0,0 +1,14 @@
+interface CustomerSession {
+    token: string;
+    expiresAt: string;
+}
+interface CustomerSessionOptions {
+    backendUrl: string;
+    getSession: () => CustomerSession | Promise<CustomerSession>;
+}
+declare class ScopedRequestError extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+
+export { type CustomerSessionOptions as C, ScopedRequestError as S, type CustomerSession as a };

package/dist/bearer-transport-CVHNBgoV.d.ts

@@ -0,0 +1,14 @@
+interface CustomerSession {
+    token: string;
+    expiresAt: string;
+}
+interface CustomerSessionOptions {
+    backendUrl: string;
+    getSession: () => CustomerSession | Promise<CustomerSession>;
+}
+declare class ScopedRequestError extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+
+export { type CustomerSessionOptions as C, ScopedRequestError as S, type CustomerSession as a };