@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/SeamsWeb/walletIframe/client/sessionCommands.js

@@ -0,0 +1,61 @@
+import { toError } from "../../../shared-ts/src/utils/errors.js";
+import { walletIframeUnlockRequestFromLoginHooks } from "../shared/unlockOptions.js";
+//#region src/SeamsWeb/walletIframe/client/sessionCommands.ts
+function createApplicationSessionCommands(walletIframe) {
+	return {
+		unlock: unlock.bind(null, walletIframe),
+		lock: lock.bind(null, walletIframe),
+		getSession: getSession.bind(null, walletIframe),
+		getRecentUnlocks: getRecentUnlocks.bind(null, walletIframe),
+		hasPasskey: hasPasskey.bind(null, walletIframe)
+	};
+}
+async function unlock(walletIframe, walletId, options) {
+	const resolvedWalletId = String(walletId || "").trim();
+	if (!resolvedWalletId) throw new Error("unlock requires walletId");
+	try {
+		const result = await (await walletIframe.requireRouter()).unlock(walletIframeUnlockRequestFromLoginHooks({
+			walletId: resolvedWalletId,
+			options
+		}));
+		if (!result.success) {
+			const unlockError = new Error(result.error || "Login failed");
+			await options?.onError?.(unlockError);
+			await options?.afterCall?.(false, void 0, unlockError);
+			return result;
+		}
+		await options?.afterCall?.(true, result);
+		return result;
+	} catch (error) {
+		const wrappedError = toError(error);
+		await options?.onError?.(wrappedError);
+		await options?.afterCall?.(false);
+		throw wrappedError;
+	}
+}
+async function lock(walletIframe) {
+	await (await walletIframe.requireRouter()).lock();
+}
+async function getSession(walletIframe, walletId) {
+	return await (await walletIframe.requireRouter()).getWalletSession(walletId);
+}
+async function hasPasskey(walletIframe, walletId) {
+	const resolvedWalletId = String(walletId || "").trim();
+	if (!resolvedWalletId) return false;
+	return await (await walletIframe.requireRouter()).hasPasskeyCredential(resolvedWalletId);
+}
+async function getRecentUnlocks(walletIframe) {
+	try {
+		return await (await walletIframe.requireRouter()).getRecentUnlocks();
+	} catch {
+		return {
+			walletIds: [],
+			accountIds: [],
+			lastUsedAccount: null
+		};
+	}
+}
+//#endregion
+export { createApplicationSessionCommands };
+
+//# sourceMappingURL=sessionCommands.js.map

package/dist/esm/SeamsWeb/walletIframe/coordinator.js

@@ -1,19 +1,13 @@
-import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { toWalletId } from "../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { __isWalletIframeHostMode } from "../../core/browser/walletIframe/host-mode.js";
+import { buildAnonymousWalletSession } from "../publicApi/session.js";
 import { createWalletIframeRouter } from "../assembly/createWalletIframeRouter.js";
 //#region src/SeamsWeb/walletIframe/coordinator.ts
-function requireRegistrationRpId(value, source) {
-	const parsed = parseWebAuthnRpId(value);
-	if (!parsed.ok) throw new Error(`${source}: ${parsed.error.message}`);
-	return parsed.value;
+function assertNeverConnection(state) {
+	throw new Error(`Unsupported connection state: ${String(state)}`);
 }
-function walletOriginHostname(walletOrigin) {
-	try {
-		return new URL(walletOrigin).hostname;
-	} catch {
-		throw new Error("[SeamsWeb] Wallet iframe origin is not a valid URL.");
-	}
+function noSubscription() {}
+function rejectAbortedConnection(signal, _resolve, reject) {
+	signal.addEventListener("abort", reject.bind(null, /* @__PURE__ */ new Error("Wallet connection interrupted")), { once: true });
 }
 /**
 * Coordinates wallet-iframe lifecycle and preference mirroring.
@@ -22,171 +16,227 @@ function walletOriginHostname(walletOrigin) {
 var WalletIframeCoordinator = class {
 	constructor(deps) {
 		this.iframeRouter = null;
-		this.walletIframeRouterCreationInFlight = null;
-		this.walletIframeInitInFlight = null;
-		this.walletIframeDisposed = false;
+		this.connection = { kind: "idle" };
+		this.connectionGeneration = 0;
+		this.connectionListeners = /* @__PURE__ */ new Set();
+		this.walletIframeCloseUnsubscribe = null;
 		this.walletIframePrefsUnsubscribe = null;
+		this.sessionDeliveryRevision = 0;
+		this.walletIframeSessionUnsubscribe = null;
+		this.sessionListeners = /* @__PURE__ */ new Set();
 		this.walletIframeLifecycleUnsubscribe = null;
 		this.walletIframeAuthMenuUnsubscribe = null;
-		this.walletIframeAuthMenuDemoOtpUnsubscribe = null;
 		this.sdkLifecycleEventListeners = /* @__PURE__ */ new Set();
 		this.hostedAuthMenuExternalAuthRequestListeners = /* @__PURE__ */ new Set();
-		this.hostedAuthMenuDemoEmailOtpDeliveryListeners = /* @__PURE__ */ new Set();
 		this.configs = deps.configs;
-		this.signingEngine = deps.signingEngine;
 		this.userPreferences = deps.userPreferences;
 		this.getAppearance = deps.getAppearance;
 		this.forwardSdkLifecycleEventListener = this.forwardSdkLifecycleEvent.bind(this);
 		this.forwardHostedAuthMenuExternalAuthRequestListener = this.forwardHostedAuthMenuExternalAuthRequest.bind(this);
-		this.forwardHostedAuthMenuDemoEmailOtpDeliveryListener = this.forwardHostedAuthMenuDemoEmailOtpDelivery.bind(this);
-	}
-	/**
-	* True when the SDK is running on the app origin with a wallet iframe configured.
-	* In this mode, sensitive persistence must live in the wallet-iframe origin.
-	*/
-	shouldUseWalletIframe() {
-		return this.configs.wallet.mode === "iframe" && !__isWalletIframeHostMode();
-	}
-	resolveRegistrationRpId(localRpId) {
-		if (!this.shouldUseWalletIframe()) return requireRegistrationRpId(localRpId, "[SeamsWeb] Local registration RP ID is invalid");
-		const iframeConfig = this.configs.wallet.iframe;
-		const configuredRpId = String(iframeConfig.rpIdOverride || "").trim();
-		if (configuredRpId) return requireRegistrationRpId(configuredRpId, "[SeamsWeb] Wallet iframe registration RP ID is invalid");
-		const walletOrigin = iframeConfig.origin;
-		if (!walletOrigin) throw new Error("[SeamsWeb] Wallet iframe registration requires a wallet origin.");
-		return requireRegistrationRpId(walletOriginHostname(walletOrigin), "[SeamsWeb] Wallet iframe origin hostname is not a valid registration RP ID");
-	}
-	isReady() {
-		return !!this.iframeRouter?.isReady();
+	}
+	getConnectionState() {
+		const state = this.connection;
+		if (state.kind === "connecting") return {
+			kind: "connecting",
+			generation: state.generation
+		};
+		return state;
+	}
+	onConnectionChange(listener) {
+		if (this.connection.kind !== "disposed") this.connectionListeners.add(listener);
+		this.deliverConnectionState(listener);
+		return this.connectionListeners.delete.bind(this.connectionListeners, listener);
+	}
+	deliverConnectionState(listener) {
+		try {
+			listener(this.getConnectionState());
+		} catch {}
+	}
+	setConnection(state) {
+		this.connection = state;
+		for (const listener of Array.from(this.connectionListeners)) {
+			if (this.connection !== state) break;
+			this.deliverConnectionState(listener);
+		}
 	}
 	getTransportDiagnosticsSnapshot() {
 		return this.iframeRouter?.getTransportDiagnosticsSnapshot() ?? null;
 	}
 	dispose() {
-		if (this.walletIframeDisposed) return;
-		this.walletIframeDisposed = true;
-		this.iframeRouter?.dispose();
+		const previous = this.connection;
+		if (previous.kind === "disposed") return;
+		this.setConnection({ kind: "disposed" });
+		if (previous.kind === "connecting") previous.abort.abort();
+		this.releaseRouter();
+		this.connectionListeners.clear();
+		this.sdkLifecycleEventListeners.clear();
+		this.sessionListeners.clear();
+		this.hostedAuthMenuExternalAuthRequestListeners.clear();
+	}
+	releaseRouter() {
+		this.sessionDeliveryRevision += 1;
+		this.walletIframeCloseUnsubscribe?.();
+		this.walletIframePrefsUnsubscribe?.();
+		this.walletIframeLifecycleUnsubscribe?.();
+		this.walletIframeSessionUnsubscribe?.();
+		this.walletIframeAuthMenuUnsubscribe?.();
+		this.walletIframeCloseUnsubscribe = null;
+		this.walletIframePrefsUnsubscribe = null;
+		this.walletIframeLifecycleUnsubscribe = null;
+		this.walletIframeSessionUnsubscribe = null;
+		this.walletIframeAuthMenuUnsubscribe = null;
+		const router = this.iframeRouter;
+		this.iframeRouter = null;
+		router?.dispose();
 	}
-	onReady(listener) {
+	connectionClosed() {
+		const previous = this.connection;
+		if (previous.kind === "disposed" || previous.kind === "failed") return;
+		const error = /* @__PURE__ */ new Error("Wallet connection closed");
+		if (previous.kind === "connecting") previous.abort.abort();
+		this.releaseRouter();
+		this.setConnection({
+			kind: "failed",
+			generation: this.connectionGeneration,
+			error
+		});
+	}
+	onSessionChange(listener) {
+		if (this.connection.kind === "disposed") return noSubscription;
+		this.sessionListeners.add(listener);
+		if (this.connection.kind === "ready") this.refreshSession();
+		return this.sessionListeners.delete.bind(this.sessionListeners, listener);
+	}
+	refreshSession() {
 		const router = this.iframeRouter;
-		if (!router) return () => {};
-		return router.onReady(listener);
+		if (router) this.publishSessionChange(router.getMirroredExactSessionState(), { kind: "refresh" });
 	}
-	onLoginStatusChanged(listener) {
+	publishSessionChange(state, publication) {
+		const revision = ++this.sessionDeliveryRevision;
 		const router = this.iframeRouter;
-		if (!router) return () => {};
-		return router.onLoginStatusChanged(listener);
+		if (!router || this.sessionListeners.size === 0) return;
+		if (state.kind === "wallet_locked") {
+			this.deliverSession(router, revision, buildAnonymousWalletSession());
+			return;
+		}
+		if (publication.kind === "observed") {
+			this.deliverSession(router, revision, publication.session);
+			return;
+		}
+		this.publishSession(router, revision, state.walletId).catch(this.reportSessionFailure.bind(this, revision));
+	}
+	reportSessionFailure(revision, error) {
+		if (revision === this.sessionDeliveryRevision && this.connection.kind !== "disposed") console.warn("[WalletIframeClient] Session reconciliation failed:", error);
+	}
+	async publishSession(router, revision, walletId) {
+		const session = await router.getWalletSession(walletId);
+		this.deliverSession(router, revision, session);
+	}
+	deliverSession(router, revision, session) {
+		for (const listener of Array.from(this.sessionListeners)) {
+			if (revision !== this.sessionDeliveryRevision || router !== this.iframeRouter) return;
+			if (!this.sessionListeners.has(listener)) continue;
+			try {
+				listener(session);
+			} catch {}
+		}
 	}
 	onSdkLifecycleEvent(listener) {
+		if (this.connection.kind === "disposed") return noSubscription;
 		this.sdkLifecycleEventListeners.add(listener);
 		if (this.iframeRouter) this.ensureWalletIframeLifecycleMirror(this.iframeRouter);
 		return this.removeSdkLifecycleEventListener.bind(this, listener);
 	}
-	onPreferencesChanged(listener) {
-		const router = this.iframeRouter;
-		if (!router) return () => {};
-		return router.onPreferencesChanged(listener);
-	}
-	async init(_walletId) {
-		if (!this.shouldUseWalletIframe()) {
-			await this.signingEngine.warmCriticalResources({ kind: "none" });
-			return { kind: "wallet_locked" };
-		}
-		if (__isWalletIframeHostMode()) return { kind: "wallet_locked" };
-		const walletOrigin = this.configs.wallet.iframe?.origin;
-		if (!walletOrigin) return { kind: "wallet_locked" };
-		if (!this.iframeRouter) {
-			if (!this.walletIframeInitInFlight) this.walletIframeInitInFlight = (async () => {
-				const router = await this.getOrCreateRouter(walletOrigin);
-				await router.init();
-				try {
-					await router.prefetchBlockheight();
-				} catch {}
-			})();
-			try {
-				await this.walletIframeInitInFlight;
-			} finally {
-				this.walletIframeInitInFlight = null;
+	connect() {
+		const current = this.connection;
+		switch (current.kind) {
+			case "disposed": return Promise.reject(/* @__PURE__ */ new Error("Wallet client is disposed"));
+			case "ready": return Promise.resolve();
+			case "connecting": return current.completion;
+			case "idle":
+			case "failed": {
+				const generation = ++this.connectionGeneration;
+				const abort = new AbortController();
+				const interrupted = new Promise(rejectAbortedConnection.bind(null, abort.signal));
+				const completion = Promise.race([Promise.resolve().then(this.initializeConnection.bind(this, generation)), interrupted]).finally(abort.abort.bind(abort));
+				this.setConnection({
+					kind: "connecting",
+					generation,
+					completion,
+					abort
+				});
+				return completion;
 			}
-		} else {
-			this.ensureWalletIframePreferencesMirror(this.iframeRouter);
-			this.ensureWalletIframeLifecycleMirror(this.iframeRouter);
-			this.ensureWalletIframeAuthMenuMirror(this.iframeRouter);
-			await this.iframeRouter.init();
-			try {
-				await this.iframeRouter.prefetchBlockheight();
-			} catch {}
+			default: return assertNeverConnection(current);
 		}
-		if (this.iframeRouter) {
-			const exactState = this.iframeRouter.getMirroredExactSessionState();
-			if (exactState.kind !== "wallet_locked") this.userPreferences.setCurrentWallet(exactState.walletId);
-			const cfg = await this.iframeRouter.getConfirmationConfig().catch(() => null);
-			if (cfg) {
-				const confirmationWalletId = exactState.kind === "wallet_locked" ? null : exactState.walletId;
-				this.userPreferences.applyWalletHostConfirmationConfig({
-					walletId: confirmationWalletId,
-					confirmationConfig: cfg
+	}
+	async initializeConnection(generation) {
+		try {
+			this.assertConnecting(generation);
+			const router = await createWalletIframeRouter({
+				configs: this.configs,
+				walletOrigin: this.configs.wallet.iframe.origin,
+				getAppearance: this.getAppearance
+			});
+			if (this.connection.kind !== "connecting" || this.connection.generation !== generation) {
+				router.dispose();
+				throw new Error("Wallet router creation was interrupted");
+			}
+			this.iframeRouter = router;
+			this.walletIframeCloseUnsubscribe = router.onConnectionClosed(this.connectionClosed.bind(this));
+			this.ensureWalletIframePreferencesMirror(router);
+			this.ensureWalletIframeLifecycleMirror(router);
+			this.walletIframeSessionUnsubscribe = router.onSessionChange(this.publishSessionChange.bind(this));
+			this.ensureWalletIframeAuthMenuMirror(router);
+			await router.init();
+			this.assertConnecting(generation);
+			router.getMirroredExactSessionState();
+			this.setConnection({
+				kind: "ready",
+				generation
+			});
+		} catch (cause) {
+			if (this.connection.kind === "connecting" && this.connection.generation === generation) {
+				const error = cause instanceof Error ? cause : new Error(String(cause));
+				this.releaseRouter();
+				this.setConnection({
+					kind: "failed",
+					generation,
+					error
 				});
 			}
-			return exactState;
+			throw cause;
 		}
-		return { kind: "wallet_locked" };
+	}
+	assertConnecting(generation) {
+		if (this.connection.kind !== "connecting" || this.connection.generation !== generation) throw new Error("Wallet connection attempt is no longer current");
 	}
 	async getExactSessionState() {
 		return await (await this.requireRouter()).getExactSessionState();
 	}
 	async openHostedAuthMenu(request, anchorElement) {
-		return await (await this.requireTransportRouter()).openHostedAuthMenu(request, anchorElement);
+		return await (await this.requireRouter()).openHostedAuthMenu(request, anchorElement);
 	}
 	async cancelHostedAuthMenu(args) {
 		await (await this.requireRouter()).cancelHostedAuthMenu(args);
 	}
 	onHostedAuthMenuExternalAuthRequest(listener) {
+		if (this.connection.kind === "disposed") return noSubscription;
 		this.hostedAuthMenuExternalAuthRequestListeners.add(listener);
 		if (this.iframeRouter) this.ensureWalletIframeAuthMenuMirror(this.iframeRouter);
 		return this.removeHostedAuthMenuExternalAuthRequestListener.bind(this, listener);
 	}
-	onHostedAuthMenuDemoEmailOtpDelivery(listener) {
-		this.hostedAuthMenuDemoEmailOtpDeliveryListeners.add(listener);
-		if (this.iframeRouter) this.ensureWalletIframeAuthMenuMirror(this.iframeRouter);
-		return this.removeHostedAuthMenuDemoEmailOtpDeliveryListener.bind(this, listener);
-	}
 	async resolveHostedAuthMenuExternalAuth(resolution) {
 		await (await this.requireRouter()).resolveHostedAuthMenuExternalAuth(resolution);
 	}
 	async lockExactSession(identity) {
-		return await (await this.requireRouter(String(identity.walletId))).lockExactSession(identity);
+		return await (await this.requireRouter()).lockExactSession(identity);
 	}
-	async requireRouter(walletId) {
-		if (!this.shouldUseWalletIframe()) throw new Error("[SeamsWeb] Wallet iframe is not configured.");
-		if (!this.iframeRouter) await this.init(walletId);
+	async requireRouter() {
+		await this.connect();
 		if (!this.iframeRouter) throw new Error("[SeamsWeb] Wallet iframe is configured but unavailable.");
 		return this.iframeRouter;
 	}
-	async requireTransportRouter() {
-		if (!this.shouldUseWalletIframe()) throw new Error("[SeamsWeb] Wallet iframe is not configured.");
-		const walletOrigin = this.configs.wallet.iframe?.origin;
-		if (!walletOrigin) throw new Error("[SeamsWeb] Wallet iframe is configured but unavailable.");
-		return await this.getOrCreateRouter(walletOrigin);
-	}
-	async getOrCreateRouter(walletOrigin) {
-		if (this.iframeRouter) return this.iframeRouter;
-		this.walletIframeRouterCreationInFlight ??= createWalletIframeRouter({
-			configs: this.configs,
-			walletOrigin,
-			getAppearance: this.getAppearance
-		});
-		try {
-			const router = await this.walletIframeRouterCreationInFlight;
-			this.iframeRouter = router;
-			this.ensureWalletIframePreferencesMirror(router);
-			this.ensureWalletIframeLifecycleMirror(router);
-			this.ensureWalletIframeAuthMenuMirror(router);
-			return router;
-		} finally {
-			this.walletIframeRouterCreationInFlight = null;
-		}
-	}
 	ensureWalletIframePreferencesMirror(router) {
 		if (this.walletIframePrefsUnsubscribe) return;
 		this.walletIframePrefsUnsubscribe = router.onPreferencesChanged?.((payload) => {
@@ -204,7 +254,6 @@ var WalletIframeCoordinator = class {
 	}
 	ensureWalletIframeAuthMenuMirror(router) {
 		if (!this.walletIframeAuthMenuUnsubscribe) this.walletIframeAuthMenuUnsubscribe = router.onHostedAuthMenuExternalAuthRequest(this.forwardHostedAuthMenuExternalAuthRequestListener);
-		if (!this.walletIframeAuthMenuDemoOtpUnsubscribe) this.walletIframeAuthMenuDemoOtpUnsubscribe = router.onHostedAuthMenuDemoEmailOtpDelivery(this.forwardHostedAuthMenuDemoEmailOtpDeliveryListener);
 	}
 	forwardSdkLifecycleEvent(event) {
 		for (const listener of Array.from(this.sdkLifecycleEventListeners)) listener(event);
@@ -220,14 +269,6 @@ var WalletIframeCoordinator = class {
 	removeHostedAuthMenuExternalAuthRequestListener(listener) {
 		this.hostedAuthMenuExternalAuthRequestListeners.delete(listener);
 	}
-	forwardHostedAuthMenuDemoEmailOtpDelivery(delivery) {
-		for (const listener of Array.from(this.hostedAuthMenuDemoEmailOtpDeliveryListeners)) try {
-			listener(delivery);
-		} catch {}
-	}
-	removeHostedAuthMenuDemoEmailOtpDeliveryListener(listener) {
-		this.hostedAuthMenuDemoEmailOtpDeliveryListeners.delete(listener);
-	}
 };
 //#endregion
 export { WalletIframeCoordinator };

package/dist/esm/SeamsWeb/walletIframe/host/ui/auth-menu/AuthMenuSurface.js

@@ -1,6 +1,7 @@
 import { isLinkedDeviceTargetEmailAddressV1 } from "../../../../../core/types/linkDevice.js";
-import { PadlockIcon } from "../../../../../core/signingEngine/uiConfirm/ui/preact/PadlockIcon.js";
+import { demoEmailOtpCodeFromDelivery } from "../../../../../core/signingEngine/session/emailOtp/challengeDelivery.js";
 import { isAuthMenuActionReady, isAuthMenuGoogleActionReady, isAuthMenuLoadingStatus, isAuthMenuReady, resolveAuthMenuLoginAccount } from "../../auth-menu/domain.js";
+import { PadlockIcon } from "../../../../../core/signingEngine/uiConfirm/ui/preact/PadlockIcon.js";
 import { blinkMenuItem } from "../../../../../utils/menuItemBlink.js";
 import { accountDropdownIcon, backIcon, chevronIcon, fingerprintIcon, googleIcon, linkDeviceIcon, linkFailedIcon, mailIcon, recoveryIcon, rerollIcon } from "./icons.js";
 import { AuthMenuFooter } from "./AuthMenuFooter.js";
@@ -8,6 +9,14 @@ import { Component, Fragment } from "preact";
 import { Fragment as Fragment$1, jsx, jsxs } from "preact/jsx-runtime";
 //#region src/SeamsWeb/walletIframe/host/ui/auth-menu/AuthMenuSurface.tsx
 /** @jsxImportSource preact */
+function renderDemoEmailCode(delivery) {
+	const code = demoEmailOtpCodeFromDelivery(delivery);
+	if (code === null) return null;
+	return /* @__PURE__ */ jsxs("p", {
+		class: "seams-otp-description",
+		children: ["Demo email code: ", /* @__PURE__ */ jsx("code", { children: code })]
+	});
+}
 const AUTH_MENU_TITLE_ID = "seams-auth-menu-title";
 const AUTH_MENU_ACCOUNT_LIST_ID = "seams-auth-menu-account-list";
 function otpCodeDigits(code) {
@@ -52,6 +61,7 @@ function passkeyButtonLabel(mode) {
 }
 /** The failure the footer strip reports. Only the menu itself reports there. */
 function menuNotice(viewModel) {
+	if (viewModel.kind === "google_otp_login" || viewModel.kind === "google_registration") return viewModel.error || null;
 	return viewModel.kind === "passkey" && viewModel.status.kind === "recoverable" && viewModel.status.reason === "error" ? viewModel.status.message : null;
 }
 const LINK_DEVICE_DOT_COUNT = 12;
@@ -891,6 +901,7 @@ var AuthMenuSurface = class extends Component {
 						class: "seams-otp-description",
 						children: deliveryMessage
 					}),
+					renderDemoEmailCode(viewModel.delivery),
 					/* @__PURE__ */ jsx("label", {
 						class: "seams-field-label",
 						for: "seams-recovery-google-otp",
@@ -1354,6 +1365,7 @@ var AuthMenuSurface = class extends Component {
 							class: "seams-otp-description",
 							children: deliveryMessage
 						}),
+						renderDemoEmailCode(viewModel.delivery),
 						/* @__PURE__ */ jsxs("div", {
 							class: "seams-otp-account",
 							title: viewModel.walletId,

package/dist/esm/SeamsWeb/walletIframe/host/ui/auth-menu/mountAuthMenuSurface.js

@@ -1,5 +1,5 @@
-import { createCspStylesheetManager, getDefaultCspNonce } from "../../../../../core/browser/walletIframe/csp-stylesheet.js";
 import { appearanceTokenCssRule } from "../../../../../core/signingEngine/uiConfirm/ui/appearance-token-vars.js";
+import { createCspStylesheetManager, getDefaultCspNonce } from "../../../../../core/browser/walletIframe/csp-stylesheet.js";
 import { AuthMenuSurface } from "./AuthMenuSurface.js";
 import { render } from "preact";
 import { jsx } from "preact/jsx-runtime";

package/dist/esm/SeamsWeb/walletIframe/shared/configuration.js

@@ -0,0 +1,37 @@
+import { parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
+import "../../../shared-ts/src/utils/signingSessionSeal.js";
+//#region src/SeamsWeb/walletIframe/shared/configuration.ts
+function resolveWalletRpId(config) {
+	const iframe = config.wallet.iframe;
+	const configured = iframe.rpIdOverride?.trim();
+	const parsed = parseWebAuthnRpId(configured || new URL(iframe.origin).hostname);
+	if (!parsed.ok) throw new Error(`Invalid wallet RP ID: ${parsed.error.message}`);
+	return parsed.value;
+}
+function createWalletHostConfig(config) {
+	return {
+		network: config.network,
+		registration: config.registration,
+		signing: config.signing,
+		webauthn: config.webauthn,
+		wallet: {
+			mode: "direct",
+			rpId: resolveWalletRpId(config)
+		},
+		ui: config.ui
+	};
+}
+function replaceWalletHostAppearance(config, appearance) {
+	return {
+		network: config.network,
+		registration: config.registration,
+		signing: config.signing,
+		webauthn: config.webauthn,
+		wallet: config.wallet,
+		ui: { appearance }
+	};
+}
+//#endregion
+export { createWalletHostConfig, replaceWalletHostAppearance };
+
+//# sourceMappingURL=configuration.js.map

package/dist/esm/SeamsWeb/walletIframe/shared/exactSessionState.js

@@ -1,16 +1,16 @@
+import { requireArray, requireNonEmptyString, requireRecordCopy } from "../../../shared-ts/src/utils/validation.js";
 import { parseCapabilityInstanceRef, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { requireArray, requireNonEmptyString, requireRecordCopy } from "../../../shared-ts/src/utils/validation.js";
+import { thresholdEcdsaChainTargetFromRequest } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import "../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
 import { isWalletAuthMethod } from "../../../shared-ts/src/utils/signerDomain.js";
+import { NonceCoordinatorDegradationReason, NonceCoordinatorFallback, NonceLeaseState } from "../../../core/signingEngine/nonce/nonceTypes.js";
+import { parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
 import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIds.js";
-import { walletAuthMethodBindingFromRaw } from "../../../shared-ts/src/utils/walletCapabilityBindings.js";
-import { thresholdEcdsaChainTargetFromRequest } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { parseSignerSlot } from "../../../shared-ts/src/utils/signerSlot.js";
-import { parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { NonceCoordinatorDegradationReason, NonceCoordinatorFallback, NonceLeaseState } from "../../../core/signingEngine/nonce/nonceTypes.js";
+import { walletAuthMethodBindingFromRaw } from "../../../shared-ts/src/utils/walletCapabilityBindings.js";
 //#region src/SeamsWeb/walletIframe/shared/exactSessionState.ts
 var WalletIframeSessionExpiredRequestError = class extends Error {
 	constructor(failure) {
@@ -19,6 +19,23 @@ var WalletIframeSessionExpiredRequestError = class extends Error {
 		this.failure = failure;
 	}
 };
+function parseWalletIframeSessionRevision(value) {
+	return requireNonNegativeSafeInteger(value, "Wallet session revision");
+}
+function parseWalletIframeExactSessionSnapshot(value) {
+	const record = requireRecordCopy(value, "Wallet iframe exact session snapshot");
+	const walletId = record.walletId === null ? null : requireWalletId(record.walletId);
+	const state = parseWalletIframeExactSessionState(record.state);
+	if (state.kind !== "wallet_locked" && state.walletId !== walletId) throw new Error("Wallet session snapshot identity differs from its projection");
+	const session = parseWalletSessionFromBoundary(record.session, state.kind === "wallet_locked" ? void 0 : state.walletId);
+	if (state.kind === "wallet_locked" && (session.authentication.kind !== "signed_out" || session.appIdentity.kind !== "anonymous")) throw new Error("Locked wallet snapshot must publish an anonymous session");
+	return {
+		revision: parseWalletIframeSessionRevision(record.revision),
+		walletId,
+		state,
+		session
+	};
+}
 function parseWalletIframeExactSessionState(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("Wallet iframe exact session state must be an object");
 	switch (Reflect.get(value, "kind")) {
@@ -346,15 +363,15 @@ function parseNullableWalletAuthMethod(value) {
 }
 function parseUserPreferences(value) {
 	const record = requireRecordCopy(value, "Wallet Session user preferences");
-	if (typeof record.useRelayer !== "boolean") throw new Error("Wallet Session user preferences useRelayer is invalid");
-	if (record.useNetwork !== "testnet" && record.useNetwork !== "mainnet") throw new Error("Wallet Session user preferences useNetwork is invalid");
+	if (record.useRelayer !== void 0 && typeof record.useRelayer !== "boolean") throw new Error("Wallet Session user preferences useRelayer is invalid");
+	if (record.useNetwork !== void 0 && record.useNetwork !== "testnet" && record.useNetwork !== "mainnet") throw new Error("Wallet Session user preferences useNetwork is invalid");
 	const confirmation = requireRecordCopy(record.confirmationConfig, "Wallet Session confirmationConfig");
 	if (confirmation.uiMode !== "none" && confirmation.uiMode !== "modal" && confirmation.uiMode !== "drawer") throw new Error("Wallet Session confirmationConfig uiMode is invalid");
 	if (confirmation.behavior !== "requireClick" && confirmation.behavior !== "skipClick") throw new Error("Wallet Session confirmationConfig behavior is invalid");
 	const autoProceedDelay = confirmation.autoProceedDelay === void 0 ? void 0 : requireNonNegativeSafeInteger(confirmation.autoProceedDelay, "confirmationConfig.autoProceedDelay");
 	return {
-		useRelayer: record.useRelayer,
-		useNetwork: record.useNetwork,
+		...record.useRelayer === void 0 ? {} : { useRelayer: record.useRelayer },
+		...record.useNetwork === void 0 ? {} : { useNetwork: record.useNetwork },
 		confirmationConfig: {
 			uiMode: confirmation.uiMode,
 			behavior: confirmation.behavior,
@@ -557,6 +574,9 @@ function requireNonNegativeSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative integer`);
 	return value;
 }
+function exactSessionIdentitiesMatch(left, right) {
+	return left.walletId === right.walletId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId;
+}
 function parseIdentity(value) {
 	const walletSessionId = parseWalletSessionId(Reflect.get(value, "walletSessionId"));
 	if (!walletSessionId.ok) throw new Error("Wallet iframe walletSessionId is invalid");
@@ -600,6 +620,6 @@ function isPositiveSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 }
 //#endregion
-export { WalletIframeSessionExpiredRequestError, parseWalletIframeExactSessionIdentity, parseWalletIframeExactSessionLockResult, parseWalletIframeExactSessionState, parseWalletSessionFromBoundary };
+export { WalletIframeSessionExpiredRequestError, exactSessionIdentitiesMatch, parseWalletIframeExactSessionIdentity, parseWalletIframeExactSessionLockResult, parseWalletIframeExactSessionSnapshot, parseWalletIframeSessionRevision, parseWalletSessionFromBoundary };
 
 //# sourceMappingURL=exactSessionState.js.map