@sparkvault/sdk 1.21.9 → 1.21.10

package/dist/sparkvault.esm.js

@@ -561,13 +561,13 @@ const MULTI_PART_TLDS = new Set([
 /**
  * Extract the root (registrable) domain from a hostname for cross-subdomain cookies.
  * Returns the domain prefixed with a dot (e.g., ".client.com") or null when
- * the domain attribute should not be set (localhost, IP addresses).
+ * the domain attribute should not be set (loopback hosts, IP addresses).
  *
  * @param hostname - The hostname to extract the root domain from
  * @returns Root domain with leading dot, or null
  */
 function getRootDomain(hostname) {
-    // Localhost — browsers reject domain attribute for localhost
+    // Loopback host — browsers reject domain attribute for localhost
     if (hostname === 'localhost' || hostname === '127.0.0.1')
         return null;
     // IPv4 addresses
@@ -1418,10 +1418,6 @@ class PasskeyHandler {
             if (hostname === 'sparkvault.com' || hostname.endsWith('.sparkvault.com')) {
                 return true;
             }
-            // Allow localhost for development
-            if (hostname === 'localhost') {
-                return true;
-            }
             return false;
         }
         catch {
@@ -4790,17 +4786,27 @@ class IdentityRenderer {
                 case 'sparklink': {
                     this.setState({ view: 'loading' });
                     // Open WebSocket and get connectionId before sending
-                    const connectionId = await this.openSparkLinkWebSocket();
-                    if (!connectionId) {
+                    const wsResult = await this.openSparkLinkWebSocket();
+                    if ('error' in wsResult) {
                         this.cleanupSparkLink();
-                        this.setState({
-                            view: 'error',
-                            message: 'Failed to establish connection',
-                            code: 'sparklink_ws_failed',
-                        });
+                        if (wsResult.error === 'csp') {
+                            // CSP blocking WebSocket - provide developer-friendly error
+                            this.setState({
+                                view: 'error',
+                                message: 'Connection blocked by security policy. Please contact the site administrator to add wss://*.sparkvault.com to the Content-Security-Policy connect-src directive.',
+                                code: 'sparklink_csp_blocked',
+                            });
+                        }
+                        else {
+                            this.setState({
+                                view: 'error',
+                                message: 'Failed to establish connection',
+                                code: 'sparklink_ws_failed',
+                            });
+                        }
                         return;
                     }
-                    const result = await this.sparkLinkHandler.send(connectionId);
+                    const result = await this.sparkLinkHandler.send(wsResult.connectionId);
                     if (!result.success) {
                         this.cleanupSparkLink();
                         this.setState({
@@ -5103,6 +5109,11 @@ class IdentityRenderer {
      * Open a WebSocket connection and return the connectionId.
      * The server echoes back the connectionId on init; this is used to route
      * the SparkLink verification result back to this SDK instance.
+     *
+     * Returns:
+     * - { connectionId: string } on success
+     * - { error: 'csp' } if blocked by Content Security Policy
+     * - { error: 'connection' } for other connection failures
      */
     openSparkLinkWebSocket() {
         this.cleanupSparkLink();
@@ -5110,13 +5121,27 @@ class IdentityRenderer {
         const wsUrl = `wss://${wsDomain}`;
         return new Promise((resolve) => {
             let resolved = false;
+            let cspViolationDetected = false;
+            // Listen for CSP violations to provide a more helpful error message
+            const cspHandler = (event) => {
+                // Check if this CSP violation is for our WebSocket connection
+                if (event.violatedDirective === 'connect-src' &&
+                    event.blockedURI.includes(wsDomain)) {
+                    cspViolationDetected = true;
+                }
+            };
+            document.addEventListener('securitypolicyviolation', cspHandler);
+            const cleanup = () => {
+                document.removeEventListener('securitypolicyviolation', cspHandler);
+            };
             const ws = new WebSocket(wsUrl);
             this.sparkLinkWs = ws;
             const timeout = setTimeout(() => {
                 if (!resolved) {
                     resolved = true;
+                    cleanup();
                     ws.close();
-                    resolve(null);
+                    resolve({ error: cspViolationDetected ? 'csp' : 'connection' });
                 }
             }, 10000);
             ws.onopen = () => {
@@ -5126,8 +5151,9 @@ class IdentityRenderer {
                 catch {
                     if (!resolved) {
                         resolved = true;
+                        cleanup();
                         clearTimeout(timeout);
-                        resolve(null);
+                        resolve({ error: 'connection' });
                     }
                 }
             };
@@ -5141,24 +5167,27 @@ class IdentityRenderer {
                 }
                 if (!resolved && data.type === 'connection' && typeof data.connectionId === 'string') {
                     resolved = true;
+                    cleanup();
                     clearTimeout(timeout);
                     this.setupSparkLinkWsHandler(ws);
-                    resolve(data.connectionId);
+                    resolve({ connectionId: data.connectionId });
                     return;
                 }
             };
             ws.onerror = () => {
                 if (!resolved) {
                     resolved = true;
+                    cleanup();
                     clearTimeout(timeout);
-                    resolve(null);
+                    resolve({ error: cspViolationDetected ? 'csp' : 'connection' });
                 }
             };
             ws.onclose = () => {
                 if (!resolved) {
                     resolved = true;
+                    cleanup();
                     clearTimeout(timeout);
-                    resolve(null);
+                    resolve({ error: cspViolationDetected ? 'csp' : 'connection' });
                 }
             };
         });
@@ -5248,17 +5277,26 @@ class IdentityRenderer {
      */
     async handleSparkLinkResend() {
         // Open new WebSocket for the resend
-        const connectionId = await this.openSparkLinkWebSocket();
-        if (!connectionId) {
+        const wsResult = await this.openSparkLinkWebSocket();
+        if ('error' in wsResult) {
             this.cleanupSparkLink();
-            this.setState({
-                view: 'error',
-                message: 'Unable to establish a secure connection. Please try again or choose a different method.',
-                code: 'sparklink_ws_failed',
-            });
+            if (wsResult.error === 'csp') {
+                this.setState({
+                    view: 'error',
+                    message: 'Connection blocked by security policy. Please contact the site administrator to add wss://*.sparkvault.com to the Content-Security-Policy connect-src directive.',
+                    code: 'sparklink_csp_blocked',
+                });
+            }
+            else {
+                this.setState({
+                    view: 'error',
+                    message: 'Unable to establish a secure connection. Please try again or choose a different method.',
+                    code: 'sparklink_ws_failed',
+                });
+            }
             return;
         }
-        const result = await this.sparkLinkHandler.send(connectionId);
+        const result = await this.sparkLinkHandler.send(wsResult.connectionId);
         if (result.success) {
             this.setState({
                 view: 'sparklink-waiting',