@swype-org/deposit 0.3.13 → 0.3.14

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DepositStatus, a as DepositResult, b as DepositError, c as DepositConfig, d as DepositRequest } from './types-CCi4cpnQ.js';
-export { C as CheckoutConfig, e as CheckoutError, f as CheckoutErrorCode, g as CheckoutStatus, h as DepositErrorCode, S as SignerFunction, i as SignerRequest, j as SignerResponse, T as TransferSummary, k as getDisplayMessage } from './types-CCi4cpnQ.js';
+import { D as DepositStatus, a as DepositResult, b as DepositError, c as DepositConfig, d as DepositRequest } from './types-DYsZwNXq.js';
+export { C as CheckoutConfig, e as CheckoutError, f as CheckoutErrorCode, g as CheckoutStatus, h as DepositErrorCode, S as SignerFunction, i as SignerRequest, j as SignerResponse, T as TransferSummary, k as getDisplayMessage } from './types-DYsZwNXq.js';
 
 declare const DEFAULT_WEBVIEW_BASE_URL = "https://pay.blink.cash";
 type EventMap = {
@@ -73,6 +73,162 @@ declare class Deposit {
 /** @deprecated Use {@link Deposit} instead. */
 declare const Checkout: typeof Deposit;
 
+/** Current wire-protocol version. Bump on breaking changes. */
+declare const BRIDGE_PROTOCOL_VERSION = 1;
+interface EIP6963ProviderInfo {
+    uuid: string;
+    name: string;
+    icon: string;
+    rdns: string;
+}
+interface EIP1193RequestArgs {
+    method: string;
+    params?: unknown[] | Record<string, unknown>;
+}
+interface EIP1193Provider {
+    request(args: EIP1193RequestArgs): Promise<unknown>;
+    on?: (event: string, listener: (...args: unknown[]) => void) => unknown;
+    removeListener?: (event: string, listener: (...args: unknown[]) => void) => unknown;
+}
+interface EIP6963ProviderDetail {
+    info: EIP6963ProviderInfo;
+    provider: EIP1193Provider;
+}
+/** Iframe → Parent: handshake, sent once on mount. */
+interface BridgeHelloMessage {
+    type: 'blink:bridge-hello';
+    protocolVersion: number;
+}
+/** Parent → Iframe: list of installed wallets the iframe can borrow. */
+interface WalletsAdvertisedMessage {
+    type: 'blink:wallets-advertised';
+    protocolVersion: number;
+    wallets: AdvertisedWallet[];
+}
+interface AdvertisedWallet {
+    uuid: string;
+    rdns: string;
+    name: string;
+    icon: string;
+}
+/** Iframe → Parent: invoke a JSON-RPC method on a top-frame wallet. */
+interface RpcRequestMessage {
+    type: 'blink:rpc-request';
+    protocolVersion: number;
+    uuid: string;
+    id: string;
+    method: string;
+    params?: unknown[] | Record<string, unknown>;
+}
+/** Parent → Iframe: result of a previous `RpcRequestMessage`. */
+interface RpcResponseMessage {
+    type: 'blink:rpc-response';
+    protocolVersion: number;
+    id: string;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+/** Parent → Iframe: forwarded EIP-1193 event from a top-frame wallet. */
+interface RpcEventMessage {
+    type: 'blink:rpc-event';
+    protocolVersion: number;
+    uuid: string;
+    event: string;
+    args: unknown[];
+}
+/**
+ * Iframe → Parent: ask "which advertised wallet has any of these flags
+ * (e.g. `isUniswapWallet`) set as a truthy property on its provider?".
+ * Used to disambiguate Reown registry entries that lack `rdns` (e.g.
+ * Uniswap, where Reown only ships `injected[].injectedId:
+ * 'isUniswapWallet'`). The parent reads `provider[flag]` defensively
+ * for each advertised provider and returns the first hit, or null.
+ *
+ * The parent answers each request once; the response is matched by
+ * `id`. Cost is local property reads on already-discovered providers —
+ * no network and no cross-frame I/O beyond the postMessage round-trip.
+ */
+interface ResolveByFlagRequestMessage {
+    type: 'blink:resolve-by-flag';
+    protocolVersion: number;
+    /** Request id, mirrored on the response so the iframe can route it. */
+    id: string;
+    /** Flag names to test in order; first truthy property wins. */
+    flags: string[];
+}
+/** Parent → Iframe: result of a previous `ResolveByFlagRequestMessage`. */
+interface ResolveByFlagResponseMessage {
+    type: 'blink:resolve-by-flag-response';
+    protocolVersion: number;
+    id: string;
+    /** `null` when no advertised provider had any flag set. */
+    match: ResolveByFlagMatch | null;
+}
+interface ResolveByFlagMatch {
+    /** EIP-6963 `rdns` of the matched provider. */
+    rdns: string;
+    /** EIP-6963 `uuid` of the matched provider. */
+    uuid: string;
+    /** Which flag matched first (lets the caller log/telemeter). */
+    flag: string;
+}
+type BridgeMessage = BridgeHelloMessage | WalletsAdvertisedMessage | RpcRequestMessage | RpcResponseMessage | RpcEventMessage | ResolveByFlagRequestMessage | ResolveByFlagResponseMessage;
+declare const ALLOWED_RPC_METHODS: Set<string>;
+declare function parseBridgeMessage(data: unknown): BridgeMessage | null;
+
+interface RegisteredProvider {
+    info: EIP6963ProviderInfo;
+    provider: EIP1193Provider;
+}
+interface WalletDiscovererHandle {
+    /** Snapshot of currently-registered providers. */
+    list(): RegisteredProvider[];
+    /** Look up a single provider by EIP-6963 uuid. */
+    get(uuid: string): EIP1193Provider | undefined;
+    /** Subscribe to registry changes. Returns an unsubscribe callback. */
+    subscribe(listener: (snapshot: RegisteredProvider[]) => void): () => void;
+    /**
+     * Re-dispatch `eip6963:requestProvider`. Wallets that wired up after
+     * page load (or after the initial sweep) will re-announce in response.
+     */
+    requestProviders(): void;
+    /** Tear down listeners. After this, `list()` returns `[]`. */
+    destroy(): void;
+}
+/**
+ * Start discovering EIP-6963 providers in the current (top-level) frame.
+ *
+ * Safe to call multiple times — each handle owns its own listeners and
+ * registry; calling `destroy()` releases both. In practice, `createIframe`
+ * spins one handle per modal open.
+ */
+declare function createWalletDiscoverer(): WalletDiscovererHandle;
+
+interface RpcHostHandle {
+    /** Tear down listeners and unsubscribe from all bridged providers. */
+    detach(): void;
+}
+interface RpcHostOptions {
+    /** Cross-origin iframe window we're talking to. */
+    iframeWindow: Window;
+    /** Origin of the iframe — origin-pin all postMessage send/receive. */
+    iframeOrigin: string;
+    /** Discoverer providing the EIP-6963 provider registry. */
+    discoverer: WalletDiscovererHandle;
+    /** Optional debug logger; defaults to a no-op. */
+    log?: (message: string, data?: Record<string, unknown>) => void;
+}
+/**
+ * Attach an RPC host to the given iframe. Listens on `window` for
+ * messages from the iframe and routes allowlisted JSON-RPC calls to the
+ * matching top-frame EIP-1193 provider.
+ */
+declare function attachRpcHost(options: RpcHostOptions): RpcHostHandle;
+
 declare const VERSION = "0.3.0";
 
-export { Checkout, DEFAULT_WEBVIEW_BASE_URL, Deposit, DepositConfig, DepositError, DepositRequest, DepositResult, DepositStatus, VERSION };
+export { ALLOWED_RPC_METHODS, type AdvertisedWallet, BRIDGE_PROTOCOL_VERSION, type EIP1193Provider as BridgeEIP1193Provider, type BridgeHelloMessage, type BridgeMessage, Checkout, DEFAULT_WEBVIEW_BASE_URL, Deposit, DepositConfig, DepositError, DepositRequest, DepositResult, DepositStatus, type EIP6963ProviderDetail, type EIP6963ProviderInfo, type RegisteredProvider, type RpcEventMessage, type RpcHostHandle, type RpcHostOptions, type RpcRequestMessage, type RpcResponseMessage, VERSION, type WalletDiscovererHandle, type WalletsAdvertisedMessage, attachRpcHost, createWalletDiscoverer, parseBridgeMessage };

package/dist/index.js

@@ -1,4 +1,4 @@
-export { Checkout, CheckoutError, DEFAULT_WEBVIEW_BASE_URL, Deposit, DepositError, getDisplayMessage } from './chunk-7Y4RWJI3.js';
+export { ALLOWED_RPC_METHODS, BRIDGE_PROTOCOL_VERSION, Checkout, CheckoutError, DEFAULT_WEBVIEW_BASE_URL, Deposit, DepositError, attachRpcHost, createWalletDiscoverer, getDisplayMessage, parseBridgeMessage } from './chunk-XYI3ZPQD.js';
 
 // src/index.ts
 var VERSION = "0.3.0";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAgBO,IAAM,OAAA,GAAU","file":"index.js","sourcesContent":["export { Deposit, Checkout, DEFAULT_WEBVIEW_BASE_URL } from './checkout.ts';\nexport { DepositError, CheckoutError, getDisplayMessage } from './errors.ts';\nexport type { DepositErrorCode, CheckoutErrorCode } from './errors.ts';\nexport type {\n  DepositConfig,\n  CheckoutConfig,\n  DepositStatus,\n  CheckoutStatus,\n  DepositRequest,\n  DepositResult,\n  SignerFunction,\n  SignerRequest,\n  SignerResponse,\n  TransferSummary,\n} from './types.ts';\n\nexport const VERSION = '0.3.0';\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AA2CO,IAAM,OAAA,GAAU","file":"index.js","sourcesContent":["export { Deposit, Checkout, DEFAULT_WEBVIEW_BASE_URL } from './checkout.ts';\nexport { DepositError, CheckoutError, getDisplayMessage } from './errors.ts';\nexport type { DepositErrorCode, CheckoutErrorCode } from './errors.ts';\nexport type {\n  DepositConfig,\n  CheckoutConfig,\n  DepositStatus,\n  CheckoutStatus,\n  DepositRequest,\n  DepositResult,\n  SignerFunction,\n  SignerRequest,\n  SignerResponse,\n  TransferSummary,\n} from './types.ts';\n\n// ── Wallet bridge (advanced) ──────────────────────────────────────────\n// Internal building blocks for the top-frame → iframe wallet bridge.\n// Default merchant integrations don't need these — `createIframe()` wires\n// them automatically. Re-exported so monorepo tests and any merchant\n// custom-iframe wrapper can poke at the protocol shapes.\nexport { createWalletDiscoverer } from './walletBridge/discover.ts';\nexport type { WalletDiscovererHandle, RegisteredProvider } from './walletBridge/discover.ts';\nexport { attachRpcHost } from './walletBridge/rpcHost.ts';\nexport type { RpcHostHandle, RpcHostOptions } from './walletBridge/rpcHost.ts';\nexport {\n  ALLOWED_RPC_METHODS,\n  BRIDGE_PROTOCOL_VERSION,\n  parseBridgeMessage,\n} from './walletBridge/protocol.ts';\nexport type {\n  AdvertisedWallet,\n  BridgeMessage,\n  BridgeHelloMessage,\n  WalletsAdvertisedMessage,\n  RpcRequestMessage,\n  RpcResponseMessage,\n  RpcEventMessage,\n  EIP1193Provider as BridgeEIP1193Provider,\n  EIP6963ProviderInfo,\n  EIP6963ProviderDetail,\n} from './walletBridge/protocol.ts';\n\nexport const VERSION = '0.3.0';\n"]}

package/dist/react.cjs

@@ -94,6 +94,396 @@ function parseCloseRequest(data) {
   return { type: "blink:close-request" };
 }
 
+// src/walletBridge/discover.ts
+function createWalletDiscoverer() {
+  if (typeof window === "undefined") {
+    return makeNoopHandle();
+  }
+  const registry = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  let destroyed = false;
+  const onAnnounce = (event) => {
+    if (destroyed) return;
+    const detail = event.detail;
+    if (!isValidProviderDetail(detail)) {
+      console.info("[blink-bridge:parent] dropping malformed EIP-6963 announcement", {
+        rawInfo: event.detail && event.detail.info
+      });
+      return;
+    }
+    const existing = registry.get(detail.info.uuid);
+    if (existing && existing.provider === detail.provider) {
+      return;
+    }
+    console.info("[blink-bridge:parent] EIP-6963 announceProvider", {
+      rdns: detail.info.rdns,
+      name: detail.info.name,
+      uuid: detail.info.uuid
+    });
+    registry.set(detail.info.uuid, {
+      info: { ...detail.info },
+      provider: detail.provider
+    });
+    notify();
+  };
+  window.addEventListener("eip6963:announceProvider", onAnnounce);
+  requestProviders();
+  const RESWEEP_INTERVALS_MS = [500, 1500, 3e3, 6e3];
+  const reSweepTimers = [];
+  for (const ms of RESWEEP_INTERVALS_MS) {
+    reSweepTimers.push(
+      setTimeout(() => {
+        if (!destroyed) requestProviders();
+      }, ms)
+    );
+  }
+  function requestProviders() {
+    try {
+      window.dispatchEvent(new Event("eip6963:requestProvider"));
+    } catch {
+    }
+  }
+  function notify() {
+    const snapshot = list();
+    for (const listener of listeners) {
+      try {
+        listener(snapshot);
+      } catch {
+      }
+    }
+  }
+  function list() {
+    return [...registry.values()];
+  }
+  return {
+    list,
+    get(uuid) {
+      return registry.get(uuid)?.provider;
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    requestProviders,
+    destroy() {
+      if (destroyed) return;
+      destroyed = true;
+      window.removeEventListener("eip6963:announceProvider", onAnnounce);
+      for (const t of reSweepTimers) clearTimeout(t);
+      registry.clear();
+      listeners.clear();
+    }
+  };
+}
+function makeNoopHandle() {
+  return {
+    list: () => [],
+    get: () => void 0,
+    subscribe: () => () => {
+    },
+    requestProviders: () => {
+    },
+    destroy: () => {
+    }
+  };
+}
+function isValidProviderDetail(value) {
+  if (!value || typeof value !== "object") return false;
+  const detail = value;
+  const info = detail.info;
+  const provider = detail.provider;
+  if (!info || !provider) return false;
+  if (typeof info.uuid !== "string" || info.uuid.length === 0) return false;
+  if (typeof info.name !== "string") return false;
+  if (typeof info.rdns !== "string") return false;
+  if (typeof provider.request !== "function") return false;
+  return true;
+}
+
+// src/walletBridge/protocol.ts
+var BRIDGE_PROTOCOL_VERSION = 1;
+var ALLOWED_RPC_METHODS = /* @__PURE__ */ new Set([
+  // Read
+  "eth_accounts",
+  "eth_blockNumber",
+  "eth_call",
+  "eth_chainId",
+  "eth_estimateGas",
+  "eth_gasPrice",
+  "eth_getBalance",
+  "eth_getCode",
+  "eth_getStorageAt",
+  "eth_getTransactionByHash",
+  "eth_getTransactionCount",
+  "eth_getTransactionReceipt",
+  "net_version",
+  "wallet_getCapabilities",
+  "wallet_getCallsStatus",
+  // Write / sign
+  "eth_requestAccounts",
+  "eth_sendTransaction",
+  "eth_sendRawTransaction",
+  "eth_sign",
+  "personal_sign",
+  "eth_signTypedData",
+  "eth_signTypedData_v3",
+  "eth_signTypedData_v4",
+  "wallet_addEthereumChain",
+  "wallet_switchEthereumChain",
+  "wallet_sendCalls",
+  "wallet_watchAsset"
+]);
+var FORWARDED_PROVIDER_EVENTS = [
+  "accountsChanged",
+  "chainChanged",
+  "connect",
+  "disconnect",
+  "message"
+];
+function parseBridgeMessage(data) {
+  if (!data || typeof data !== "object") return null;
+  const msg = data;
+  if (msg.protocolVersion !== BRIDGE_PROTOCOL_VERSION) return null;
+  switch (msg.type) {
+    case "blink:bridge-hello":
+      return msg;
+    case "blink:wallets-advertised":
+      return Array.isArray(msg.wallets) ? msg : null;
+    case "blink:rpc-request":
+      if (typeof msg.uuid !== "string" || typeof msg.id !== "string" || typeof msg.method !== "string") {
+        return null;
+      }
+      return msg;
+    case "blink:rpc-response":
+      if (typeof msg.id !== "string") return null;
+      return msg;
+    case "blink:rpc-event":
+      if (typeof msg.uuid !== "string" || typeof msg.event !== "string" || !Array.isArray(msg.args)) {
+        return null;
+      }
+      return msg;
+    case "blink:resolve-by-flag":
+      if (typeof msg.id !== "string" || !Array.isArray(msg.flags)) return null;
+      if (!msg.flags.every((f) => typeof f === "string" && f.length > 0)) return null;
+      return msg;
+    case "blink:resolve-by-flag-response":
+      if (typeof msg.id !== "string") return null;
+      if (msg.match !== null && (typeof msg.match !== "object" || !msg.match)) return null;
+      return msg;
+    default:
+      return null;
+  }
+}
+
+// src/walletBridge/rpcHost.ts
+function attachRpcHost(options) {
+  const { iframeWindow, iframeOrigin, discoverer } = options;
+  const log = options.log ?? noopLog;
+  if (typeof window === "undefined") {
+    return { detach: () => {
+    } };
+  }
+  let detached = false;
+  const subscriptions = /* @__PURE__ */ new Map();
+  const unsubscribeFromDiscoverer = discoverer.subscribe((snapshot) => {
+    if (detached) return;
+    advertiseWallets(snapshot);
+  });
+  function postToIframe(message) {
+    if (detached) return;
+    try {
+      iframeWindow.postMessage(message, iframeOrigin);
+    } catch (err) {
+      log("postMessage to iframe failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  function advertiseWallets(snapshot) {
+    const wallets = snapshot.map((entry) => ({
+      uuid: entry.info.uuid,
+      rdns: entry.info.rdns,
+      name: entry.info.name,
+      icon: entry.info.icon
+    }));
+    console.info("[blink-bridge:parent] advertising wallets", wallets.map((w) => ({
+      rdns: w.rdns,
+      name: w.name
+    })));
+    const message = {
+      type: "blink:wallets-advertised",
+      protocolVersion: BRIDGE_PROTOCOL_VERSION,
+      wallets
+    };
+    postToIframe(message);
+  }
+  function ensureSubscription(uuid, provider) {
+    if (subscriptions.has(uuid)) return;
+    if (typeof provider.on !== "function") {
+      subscriptions.set(uuid, { provider, listeners: /* @__PURE__ */ new Map() });
+      return;
+    }
+    const record = { provider, listeners: /* @__PURE__ */ new Map() };
+    for (const event of FORWARDED_PROVIDER_EVENTS) {
+      const listener = (...args) => {
+        const eventMessage = {
+          type: "blink:rpc-event",
+          protocolVersion: BRIDGE_PROTOCOL_VERSION,
+          uuid,
+          event,
+          args
+        };
+        postToIframe(eventMessage);
+      };
+      try {
+        provider.on(event, listener);
+        record.listeners.set(event, listener);
+      } catch (err) {
+        log(`provider.on('${event}') threw \u2014 skipping that event`, {
+          uuid,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+    subscriptions.set(uuid, record);
+  }
+  function unsubscribeAll() {
+    for (const [, record] of subscriptions) {
+      const provider = record.provider;
+      if (typeof provider.removeListener !== "function") continue;
+      for (const [event, listener] of record.listeners) {
+        try {
+          provider.removeListener(event, listener);
+        } catch {
+        }
+      }
+    }
+    subscriptions.clear();
+  }
+  function sendError(id, code, message, data) {
+    const response = {
+      type: "blink:rpc-response",
+      protocolVersion: BRIDGE_PROTOCOL_VERSION,
+      id,
+      error: data === void 0 ? { code, message } : { code, message, data }
+    };
+    postToIframe(response);
+  }
+  function sendResult(id, result) {
+    const response = {
+      type: "blink:rpc-response",
+      protocolVersion: BRIDGE_PROTOCOL_VERSION,
+      id,
+      result
+    };
+    postToIframe(response);
+  }
+  const onMessage = (event) => {
+    if (detached) return;
+    if (event.source !== iframeWindow) return;
+    if (event.origin !== iframeOrigin) return;
+    const message = parseBridgeMessage(event.data);
+    if (!message) return;
+    switch (message.type) {
+      case "blink:bridge-hello": {
+        advertiseWallets(discoverer.list());
+        discoverer.requestProviders();
+        return;
+      }
+      case "blink:rpc-request": {
+        const { id, uuid, method, params } = message;
+        console.info("[blink-bridge:parent] rpc-request", { uuid, method });
+        if (!ALLOWED_RPC_METHODS.has(method)) {
+          log("rejecting non-allowlisted method", { uuid, method });
+          sendError(id, -32601, `Method not allowed: ${method}`);
+          return;
+        }
+        const provider = discoverer.get(uuid);
+        if (!provider) {
+          log("no provider for uuid", { uuid, method });
+          sendError(id, -32602, `Unknown wallet: ${uuid}`);
+          return;
+        }
+        ensureSubscription(uuid, provider);
+        provider.request({ method, params }).then((result) => {
+          console.info("[blink-bridge:parent] rpc-result", { uuid, method, ok: true });
+          sendResult(id, result);
+        }).catch((err) => {
+          const { code, message: errMessage, data } = normalizeProviderError(err);
+          console.info("[blink-bridge:parent] rpc-error", { uuid, method, code, message: errMessage });
+          sendError(id, code, errMessage, data);
+        });
+        return;
+      }
+      case "blink:resolve-by-flag": {
+        const match = resolveByFlag(discoverer.list(), message.flags, log);
+        console.info("[blink-bridge:parent] resolveByFlag", {
+          flags: message.flags,
+          match: match ? { rdns: match.rdns, flag: match.flag } : null
+        });
+        const response = {
+          type: "blink:resolve-by-flag-response",
+          protocolVersion: BRIDGE_PROTOCOL_VERSION,
+          id: message.id,
+          match
+        };
+        postToIframe(response);
+        return;
+      }
+      case "blink:wallets-advertised":
+      case "blink:rpc-response":
+      case "blink:rpc-event":
+      case "blink:resolve-by-flag-response":
+        return;
+    }
+  };
+  window.addEventListener("message", onMessage);
+  return {
+    detach() {
+      if (detached) return;
+      detached = true;
+      window.removeEventListener("message", onMessage);
+      unsubscribeFromDiscoverer();
+      unsubscribeAll();
+    }
+  };
+}
+function noopLog() {
+}
+function resolveByFlag(snapshot, flags, log) {
+  for (const flag of flags) {
+    for (const entry of snapshot) {
+      let value;
+      try {
+        value = entry.provider[flag];
+      } catch (err) {
+        log("provider threw on flag read \u2014 skipping", {
+          rdns: entry.info.rdns,
+          flag,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        continue;
+      }
+      if (value) {
+        return { rdns: entry.info.rdns, uuid: entry.info.uuid, flag };
+      }
+    }
+  }
+  return null;
+}
+function normalizeProviderError(err) {
+  if (err && typeof err === "object") {
+    const e = err;
+    const code = typeof e.code === "number" ? e.code : -32603;
+    const message = typeof e.message === "string" ? e.message : err instanceof Error ? err.message : "Provider error";
+    const data = "data" in e ? e.data : void 0;
+    return data === void 0 ? { code, message } : { code, message, data };
+  }
+  return { code: -32603, message: typeof err === "string" ? err : "Provider error" };
+}
+
 // src/iframe.ts
 var STYLE_ID = "blink-deposit-styles";
 var CLOSE_DURATION_MS = 280;
@@ -129,13 +519,26 @@ function createIframe(url, containerElement) {
   const iframe = document.createElement("iframe");
   iframe.src = url;
   const iframeOrigin = new URL(url).origin;
-  iframe.allow = `publickey-credentials-get ${iframeOrigin}; publickey-credentials-create ${iframeOrigin}`;
+  iframe.allow = `publickey-credentials-get ${iframeOrigin}; publickey-credentials-create ${iframeOrigin}; clipboard-write ${iframeOrigin}`;
   const handle = document.createElement("div");
   container.appendChild(handle);
   container.appendChild(iframe);
   overlay.appendChild(container);
   const mountTarget = containerElement ?? document.body;
   mountTarget.appendChild(overlay);
+  const discoverer = createWalletDiscoverer();
+  let rpcHostHandle = null;
+  const attachBridge = () => {
+    if (rpcHostHandle) return;
+    if (!iframe.contentWindow) return;
+    rpcHostHandle = attachRpcHost({
+      iframeWindow: iframe.contentWindow,
+      iframeOrigin,
+      discoverer
+    });
+  };
+  attachBridge();
+  iframe.addEventListener("load", attachBridge);
   const savedOverflow = document.body.style.overflow;
   document.body.style.overflow = "hidden";
   const onBackdropClick = (event) => {
@@ -162,6 +565,7 @@ function createIframe(url, containerElement) {
     if (closed) return;
     closed = true;
     removeListeners();
+    detachBridge();
     overlay.setAttribute("data-blink-closing", "");
     let removed = false;
     const removeOverlay = () => {
@@ -174,6 +578,14 @@ function createIframe(url, containerElement) {
     container.addEventListener("animationend", removeOverlay, { once: true });
     setTimeout(removeOverlay, CLOSE_DURATION_MS + 50);
   }
+  function detachBridge() {
+    iframe.removeEventListener("load", attachBridge);
+    if (rpcHostHandle) {
+      rpcHostHandle.detach();
+      rpcHostHandle = null;
+    }
+    discoverer.destroy();
+  }
   return {
     get contentWindow() {
       return iframe.contentWindow;
@@ -192,6 +604,7 @@ function createIframe(url, containerElement) {
       if (!closed) {
         closed = true;
         removeListeners();
+        detachBridge();
         overlay.remove();
         unlockScroll();
       }
@@ -314,8 +727,10 @@ function isValidTokenAddress(value) {
   return TOKEN_ADDRESS_RE.test(value) || SOLANA_ADDRESS_RE.test(value);
 }
 function validateDepositRequest(request) {
-  if (!Number.isFinite(request.amount) || request.amount <= 0) {
-    throw new DepositError("INVALID_REQUEST", "amount must be a positive number.");
+  if (request.amount !== null) {
+    if (typeof request.amount !== "number" || !Number.isFinite(request.amount) || request.amount <= 0) {
+      throw new DepositError("INVALID_REQUEST", "amount must be a positive number or null.");
+    }
   }
   if (!Number.isInteger(request.chainId) || request.chainId <= 0) {
     throw new DepositError("INVALID_REQUEST", "chainId must be a positive integer.");