@thru/embedded-provider 0.2.0 → 0.2.3

package/README.md

@@ -0,0 +1,135 @@
+# @thru/embedded-provider
+
+Client-side provider for embedding the Thru wallet into any web application. Manages an iframe that hosts the wallet UI, communicates with it over `postMessage`, and exposes a simple API for connecting, signing transactions, and managing accounts.
+
+## Installation
+
+```bash
+npm install @thru/embedded-provider
+```
+
+## Basic Usage
+
+```typescript
+import { EmbeddedProvider } from '@thru/embedded-provider';
+
+const provider = new EmbeddedProvider({
+  iframeUrl: 'https://wallet.thru.io',
+});
+
+// Initialize iframe (must be called before any other operation)
+await provider.initialize();
+
+// Connect to wallet (opens modal)
+const result = await provider.connect();
+console.log(result.accounts);
+
+// Sign a transaction via the Thru chain interface
+const signed = await provider.thru.signTransaction(base64EncodedTx);
+
+// Disconnect
+await provider.disconnect();
+
+// Cleanup when done
+provider.destroy();
+```
+
+## API
+
+### `EmbeddedProvider`
+
+Main entry point. Creates and manages the wallet iframe.
+
+#### Constructor
+
+```typescript
+new EmbeddedProvider(config: EmbeddedProviderConfig)
+```
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `iframeUrl` | `string` | `DEFAULT_IFRAME_URL` | URL of the hosted wallet application |
+| `addressTypes` | `AddressType[]` | `[AddressType.THRU]` | Chain types to enable |
+
+#### Methods
+
+| Method | Returns | Description |
+|--------|---------|-------------|
+| `initialize()` | `Promise<void>` | Create the iframe and wait for it to signal readiness |
+| `connect(options?)` | `Promise<ConnectResult>` | Open the wallet modal and request a connection |
+| `disconnect()` | `Promise<void>` | Disconnect the current session |
+| `isConnected()` | `boolean` | Whether a wallet session is active |
+| `getAccounts()` | `WalletAccount[]` | List of connected accounts |
+| `getSelectedAccount()` | `WalletAccount \| null` | Currently selected account |
+| `selectAccount(publicKey)` | `Promise<WalletAccount>` | Switch the active account |
+| `mountInline(container)` | `Promise<void>` | Mount the wallet inline inside a DOM element instead of as a modal |
+| `on(event, callback)` | `void` | Subscribe to provider events |
+| `off(event, callback)` | `void` | Unsubscribe from provider events |
+| `destroy()` | `void` | Remove the iframe and clean up all listeners |
+
+#### Properties
+
+| Property | Type | Description |
+|----------|------|-------------|
+| `thru` | `IThruChain` | Chain-specific interface for signing transactions on the Thru network |
+
+### `EmbeddedThruChain`
+
+Implements `IThruChain`. Accessed via `provider.thru`.
+
+| Method | Returns | Description |
+|--------|---------|-------------|
+| `connect()` | `Promise<{ publicKey: string }>` | Connect and return the Thru address |
+| `disconnect()` | `Promise<void>` | Disconnect |
+| `signTransaction(serializedTransaction)` | `Promise<string>` | Sign a base64-encoded transaction, returns the signed result |
+
+### Events
+
+Subscribe with `provider.on(event, callback)`:
+
+- `connect` -- Wallet connected successfully
+- `connect:start` -- Connection flow initiated
+- `connect:error` -- Connection attempt failed
+- `disconnect` -- Wallet disconnected
+- `lock` -- Wallet locked by the user
+- `account:changed` -- Active account switched
+- `ui:show` -- Wallet UI requested to be shown
+
+### Display Modes
+
+The provider supports two display modes:
+
+- **Modal** (default) -- The iframe is appended to `document.body` as a full-screen overlay.
+- **Inline** -- The iframe is mounted inside a container element you provide, useful for embedding a connect button directly in your page layout.
+
+```typescript
+// Inline mode
+const container = document.getElementById('wallet-mount');
+await provider.mountInline(container);
+```
+
+## Security
+
+The `IframeManager` validates that the iframe URL belongs to a set of trusted origins before loading it. Allowed origins:
+
+- `https://wallet.thru.io`
+- `https://wallet.thru.org`
+- `https://thru-wallet.up.railway.app`
+- `http://localhost` (any port, for development)
+
+Messages are sent with a strict `targetOrigin` and each iframe instance is tagged with a unique frame ID to prevent cross-talk.
+
+## Key Capabilities
+
+- Iframe lifecycle management with automatic readiness detection
+- Request/response correlation over `postMessage` with per-request timeouts
+- Origin validation to prevent unauthorized wallet iframes
+- Modal and inline display modes
+- Event-driven architecture for connection state changes
+- WebAuthn (passkey) support via iframe `allow` policy
+- Chain-specific interfaces via the `IThruChain` abstraction
+
+## Dependencies
+
+- `@thru/chain-interfaces` -- Shared chain interface types (`IThruChain`, `WalletAccount`)
+- `@thru/protocol` -- Message type constants, request/response schemas, and helper utilities

package/dist/index.d.ts

@@ -11,14 +11,19 @@ declare class IframeManager {
     private iframe;
     private iframeUrl;
     private iframeOrigin;
+    private frameId;
     private messageHandlers;
     private messageListener;
     private readyPromise;
+    private displayMode;
+    private inlineContainer;
+    private visible;
     /**
      * Callback for event broadcasts from iframe (no request id)
      */
     onEvent?: (eventType: string, payload: any) => void;
     constructor(iframeUrl: string);
+    private getIframeSrc;
     /**
      * Create and inject iframe into DOM
      * Returns a promise that resolves when iframe is ready
@@ -28,6 +33,18 @@ declare class IframeManager {
      * Wait for iframe to send 'ready' signal
      */
     private waitForReady;
+    /**
+     * Mount iframe inline inside the provided container.
+     */
+    mountInline(container: HTMLElement): Promise<void>;
+    /**
+     * Show iframe inline (embedded in container).
+     */
+    showInline(): void;
+    /**
+     * Show iframe as a full-screen modal.
+     */
+    showModal(): void;
     /**
      * Show iframe modal
      */
@@ -36,6 +53,9 @@ declare class IframeManager {
      * Hide iframe modal
      */
     hide(): void;
+    isInline(): boolean;
+    private applyIframeStyles;
+    private setVisibility;
     /**
      * Send message to iframe and wait for response
      */
@@ -48,6 +68,7 @@ declare class IframeManager {
      * Handle event broadcasts from iframe
      */
     private handleEvent;
+    private isMessageFromIframe;
     /**
      * Destroy iframe and cleanup
      */
@@ -72,12 +93,17 @@ declare class EmbeddedProvider {
     private accounts;
     private selectedAccount;
     private eventListeners;
+    private inlineMode;
     constructor(config: EmbeddedProviderConfig);
     /**
      * Initialize the provider (must be called before use)
      * Creates iframe and waits for it to be ready
      */
     initialize(): Promise<void>;
+    /**
+     * Mount the wallet iframe inline in a container (for inline connect button).
+     */
+    mountInline(container: HTMLElement): Promise<void>;
     /**
      * Connect to wallet
      * Shows iframe modal and requests connection

package/dist/index.js

@@ -49,6 +49,7 @@ var EmbeddedThruChain = class {
 // src/IframeManager.ts
 var ALLOWED_IFRAME_ORIGINS = [
   "https://thru-wallet.up.railway.app",
+  "https://wallet.thru.io",
   "https://wallet.thru.org",
   // Allow localhost for development (any port)
   "http://localhost"
@@ -81,9 +82,18 @@ var IframeManager = class {
     this.messageHandlers = /* @__PURE__ */ new Map();
     this.messageListener = null;
     this.readyPromise = null;
+    this.displayMode = "modal";
+    this.inlineContainer = null;
+    this.visible = false;
     validateIframeOrigin(iframeUrl);
     this.iframeUrl = iframeUrl;
     this.iframeOrigin = new URL(iframeUrl).origin;
+    this.frameId = createRequestId("frame");
+  }
+  getIframeSrc() {
+    const url = new URL(this.iframeUrl);
+    url.searchParams.set("tn_frame_id", this.frameId);
+    return url.toString();
   }
   /**
    * Create and inject iframe into DOM
@@ -96,24 +106,23 @@ var IframeManager = class {
     this.readyPromise = (async () => {
       if (!this.iframe) {
         this.iframe = document.createElement("iframe");
-        this.iframe.src = this.iframeUrl;
-        this.iframe.style.cssText = `
-          position: fixed;
-          top: 0;
-          left: 0;
-          width: 100%;
-          height: 100%;
-          border: none;
-          z-index: 999999;
-          display: none;
-          background: rgba(0, 0, 0, 0.5);
-        `;
-        document.body.appendChild(this.iframe);
+        this.iframe.src = this.getIframeSrc();
+        this.iframe.allow = "publickey-credentials-get; publickey-credentials-create";
+        this.applyIframeStyles();
+        this.setVisibility(false);
+        if (this.displayMode === "inline" && this.inlineContainer) {
+          this.inlineContainer.appendChild(this.iframe);
+        } else {
+          document.body.appendChild(this.iframe);
+        }
         this.messageListener = this.handleMessage.bind(this);
         window.addEventListener("message", this.messageListener);
       }
       await this.waitForReady();
-    })();
+    })().catch((error) => {
+      this.readyPromise = null;
+      throw error;
+    });
     return this.readyPromise;
   }
   /**
@@ -121,50 +130,139 @@ var IframeManager = class {
    */
   waitForReady() {
     return new Promise((resolve, reject) => {
+      let resolved = false;
+      let readyHandler;
+      const cleanup = () => {
+        if (resolved) {
+          return;
+        }
+        resolved = true;
+        window.removeEventListener("message", readyHandler);
+        clearTimeout(timeout);
+      };
       const timeout = setTimeout(() => {
+        cleanup();
         reject(new Error("Iframe ready timeout - wallet failed to load"));
       }, 1e4);
-      const readyHandler = (event) => {
-        if (event.origin !== this.iframeOrigin) {
+      readyHandler = (event) => {
+        if (!this.isMessageFromIframe(event)) {
           return;
         }
-        if (event.data.type === IFRAME_READY_EVENT) {
-          clearTimeout(timeout);
-          window.removeEventListener("message", readyHandler);
+        if (event.data?.type === IFRAME_READY_EVENT) {
+          cleanup();
           resolve();
         }
       };
       window.addEventListener("message", readyHandler);
     });
   }
+  /**
+   * Mount iframe inline inside the provided container.
+   */
+  async mountInline(container) {
+    this.inlineContainer = container;
+    this.displayMode = "inline";
+    await this.createIframe();
+    this.showInline();
+  }
+  /**
+   * Show iframe inline (embedded in container).
+   */
+  showInline() {
+    if (!this.iframe) {
+      return;
+    }
+    this.displayMode = "inline";
+    if (this.inlineContainer && this.iframe.parentElement !== this.inlineContainer) {
+      this.inlineContainer.appendChild(this.iframe);
+    }
+    this.applyIframeStyles();
+    this.setVisibility(true);
+  }
+  /**
+   * Show iframe as a full-screen modal.
+   */
+  showModal() {
+    if (!this.iframe) {
+      return;
+    }
+    this.displayMode = "modal";
+    if (this.iframe.parentElement !== document.body) {
+      document.body.appendChild(this.iframe);
+    }
+    this.applyIframeStyles();
+    this.setVisibility(true);
+  }
   /**
    * Show iframe modal
    */
   show() {
-    if (this.iframe) {
-      this.iframe.style.display = "block";
-    }
+    this.showModal();
   }
   /**
    * Hide iframe modal
    */
   hide() {
-    if (this.iframe) {
-      this.iframe.style.display = "none";
+    this.setVisibility(false);
+  }
+  isInline() {
+    return this.displayMode === "inline";
+  }
+  applyIframeStyles() {
+    if (!this.iframe) {
+      return;
+    }
+    if (this.displayMode === "inline") {
+      this.iframe.style.cssText = `
+        position: relative;
+        width: 100%;
+        height: 100%;
+        border: none;
+        z-index: 1;
+        display: block;
+        background: transparent;
+      `;
+      return;
     }
+    this.iframe.style.cssText = `
+      position: fixed;
+      top: 0;
+      left: 0;
+      width: 100%;
+      height: 100%;
+      border: none;
+      z-index: 999999;
+      display: block;
+      background: rgba(0, 0, 0, 0.5);
+    `;
+  }
+  setVisibility(visible) {
+    if (!this.iframe) {
+      return;
+    }
+    this.visible = visible;
+    this.iframe.style.opacity = visible ? "1" : "0";
+    this.iframe.style.pointerEvents = visible ? "auto" : "none";
+    this.iframe.style.visibility = visible ? "visible" : "hidden";
   }
   /**
    * Send message to iframe and wait for response
    */
   async sendMessage(request) {
+    if (this.readyPromise) {
+      await this.readyPromise;
+    } else {
+      await this.createIframe();
+    }
     if (!this.iframe?.contentWindow) {
       throw new Error("Iframe not initialized - call createIframe() first");
     }
     return new Promise((resolve, reject) => {
+      const timeoutMs = request.type === POST_MESSAGE_REQUEST_TYPES.CONNECT || request.type === POST_MESSAGE_REQUEST_TYPES.SIGN_MESSAGE || request.type === POST_MESSAGE_REQUEST_TYPES.SIGN_TRANSACTION ? 5 * 60 * 1e3 : 30 * 1e3;
       const timeout = setTimeout(() => {
         this.messageHandlers.delete(request.id);
         reject(new Error("Request timeout - wallet did not respond"));
-      }, 3e4);
+      }, timeoutMs);
       this.messageHandlers.set(request.id, (response) => {
         clearTimeout(timeout);
         this.messageHandlers.delete(request.id);
@@ -183,8 +281,7 @@ var IframeManager = class {
    * Handle incoming messages from iframe
    */
   handleMessage(event) {
-    const iframeOrigin = new URL(this.iframeUrl).origin;
-    if (event.origin !== iframeOrigin) {
+    if (!this.isMessageFromIframe(event)) {
       return;
     }
     const data = event.data;
@@ -207,6 +304,22 @@ var IframeManager = class {
       this.onEvent(data.event, data.data);
     }
   }
+  isMessageFromIframe(event) {
+    if (event.origin !== this.iframeOrigin) {
+      return false;
+    }
+    const data = event.data;
+    if (!data || data.frameId !== this.frameId) {
+      return false;
+    }
+    if (!event.source) {
+      return true;
+    }
+    if (this.iframe?.contentWindow && event.source !== this.iframe.contentWindow) {
+      return false;
+    }
+    return true;
+  }
   /**
    * Destroy iframe and cleanup
    */
@@ -231,10 +344,19 @@ var EmbeddedProvider = class {
     this.accounts = [];
     this.selectedAccount = null;
     this.eventListeners = /* @__PURE__ */ new Map();
+    this.inlineMode = false;
     const iframeUrl = config.iframeUrl || DEFAULT_IFRAME_URL;
     this.iframeManager = new IframeManager(iframeUrl);
     this.iframeManager.onEvent = (eventType, payload) => {
       this.emit(eventType, payload);
+      if (eventType === EMBEDDED_PROVIDER_EVENTS.UI_SHOW) {
+        if (this.inlineMode) {
+          this.iframeManager.showInline();
+        } else {
+          this.iframeManager.showModal();
+        }
+        return;
+      }
       if (eventType === EMBEDDED_PROVIDER_EVENTS.DISCONNECT || eventType === EMBEDDED_PROVIDER_EVENTS.LOCK) {
         this.connected = false;
         this.accounts = [];
@@ -258,14 +380,25 @@ var EmbeddedProvider = class {
   async initialize() {
     await this.iframeManager.createIframe();
   }
+  /**
+   * Mount the wallet iframe inline in a container (for inline connect button).
+   */
+  async mountInline(container) {
+    this.inlineMode = true;
+    await this.iframeManager.mountInline(container);
+  }
   /**
    * Connect to wallet
    * Shows iframe modal and requests connection
    */
   async connect(options) {
     this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_START, {});
-    this.iframeManager.show();
     try {
+      if (this.inlineMode) {
+        this.iframeManager.showInline();
+      } else {
+        this.iframeManager.showModal();
+      }
       const payload = {};
       if (options?.metadata) {
         payload.metadata = options.metadata;
@@ -280,10 +413,14 @@ var EmbeddedProvider = class {
       this.accounts = response.result.accounts;
       this.selectedAccount = response.result.accounts[0] ?? null;
       this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT, response.result);
-      this.iframeManager.hide();
+      if (!this.inlineMode) {
+        this.iframeManager.hide();
+      }
       return response.result;
     } catch (error) {
-      this.iframeManager.hide();
+      if (!this.inlineMode) {
+        this.iframeManager.hide();
+      }
       this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_ERROR, { error });
       throw error;
     }
@@ -298,13 +435,17 @@ var EmbeddedProvider = class {
         type: POST_MESSAGE_REQUEST_TYPES.DISCONNECT,
         origin: window.location.origin
       });
-      this.connected = false;
-      this.accounts = [];
-      this.iframeManager.hide();
       this.emit(EMBEDDED_PROVIDER_EVENTS.DISCONNECT, {});
     } catch (error) {
       this.emit(EMBEDDED_PROVIDER_EVENTS.ERROR, { error });
       throw error;
+    } finally {
+      this.connected = false;
+      this.accounts = [];
+      this.selectedAccount = null;
+      if (!this.inlineMode) {
+        this.iframeManager.hide();
+      }
     }
   }
   /**

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../chain-interfaces/src/types.ts","../src/chains/ThruChain.ts","../src/IframeManager.ts","../src/EmbeddedProvider.ts"],"names":["DEFAULT_IFRAME_URL","EMBEDDED_PROVIDER_EVENTS","createRequestId","POST_MESSAGE_REQUEST_TYPES"],"mappings":";;;;AAAO,IAAM,WAAA,GAAc;EACzB,IAAA,EAAM;AACR,CAAA;ACMO,IAAM,oBAAN,MAA8C;AAAA,EAInD,WAAA,CAAY,eAA8B,QAAA,EAA4B;AACpE,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AACrB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAS,WAAA,EAAY;AAAA,EACnC;AAAA,EAEA,MAAM,OAAA,GAA0C;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAA,EAAQ;AAC3C,IAAA,MAAM,WAAA,GAAc,OAAO,QAAA,CAAS,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,KAAgB,WAAA,CAAY,IAAI,CAAA;AAExF,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AAEA,IAAA,OAAO,EAAE,SAAA,EAAW,WAAA,CAAY,OAAA,EAAQ;AAAA,EAC1C;AAAA,EAEA,MAAM,UAAA,GAA4B;AAChC,IAAA,MAAM,IAAA,CAAK,SAAS,UAAA,EAAW;AAAA,EACjC;AAAA,EAEA,MAAM,gBAAgB,qBAAA,EAAgD;AACpE,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,WAAA,EAAY,EAAG;AAChC,MAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,IACxC;AACA,IAAA,IAAI,OAAO,qBAAA,KAA0B,QAAA,IAAY,qBAAA,CAAsB,WAAW,CAAA,EAAG;AACnF,MAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,IACvE;AAEA,IAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAExB,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY;AAAA,QACpD,IAAI,eAAA,EAAgB;AAAA,QACpB,MAAM,0BAAA,CAA2B,gBAAA;AAAA,QACjC,OAAA,EAAS,EAAE,WAAA,EAAa,qBAAA,EAAsB;AAAA,QAC9C,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,OACzB,CAAA;AACD,MAAA,OAAO,SAAS,MAAA,CAAO,iBAAA;AAAA,IACzB,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAAA,IAC1B;AAAA,EACF;AACF;;;AC9CA,IAAM,sBAAA,GAAyB;AAAA,EAC7B,oCAAA;AAAA,EACA,yBAAA;AAAA;AAAA,EAEA;AACF,CAAA;AAMA,SAAS,qBAAqB,SAAA,EAAyB;AACrD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,SAAS,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uBAAuB,SAAS,CAAA,mCAAA;AAAA,KAClC;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAInB,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,IAAA,CAAK,CAAC,aAAA,KAAkB;AAC/D,IAAA,IAAI,kBAAkB,kBAAA,EAAoB;AAExC,MAAA,OAAO,MAAA,KAAW,kBAAA,IAAsB,MAAA,CAAO,KAAA,CAAM,0BAA0B,CAAA;AAAA,IACjF;AACA,IAAA,OAAO,MAAA,KAAW,aAAA;AAAA,EACpB,CAAC,CAAA;AAED,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,4BAA4B,MAAM,CAAA,2CAAA,EACY,sBAAA,CAAuB,IAAA,CAAK,IAAI,CAAC,CAAA,2FAAA;AAAA,KAEjF;AAAA,EACF;AACF;AAMO,IAAM,gBAAN,MAAoB;AAAA,EAazB,YAAY,SAAA,EAAmB;AAZ/B,IAAA,IAAA,CAAQ,MAAA,GAAmC,IAAA;AAG3C,IAAA,IAAA,CAAQ,eAAA,uBAAsB,GAAA,EAAqD;AACnF,IAAA,IAAA,CAAQ,eAAA,GAA0D,IAAA;AAClE,IAAA,IAAA,CAAQ,YAAA,GAAqC,IAAA;AAS3C,IAAA,oBAAA,CAAqB,SAAS,CAAA;AAE9B,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,MAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,GAA8B;AAClC,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd;AAEA,IAAA,IAAA,CAAK,gBAAgB,YAAY;AAC/B,MAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,QAAA,IAAA,CAAK,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC7C,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,IAAA,CAAK,SAAA;AACvB,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAAA,CAAA;AAY5B,QAAA,QAAA,CAAS,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AAGrC,QAAA,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,QAAA,MAAA,CAAO,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,eAAe,CAAA;AAAA,MACzD;AAGA,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B,CAAA,GAAG;AAEH,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAA,GAA8B;AACpC,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,8CAA8C,CAAC,CAAA;AAAA,MAClE,GAAG,GAAK,CAAA;AAER,MAAA,MAAM,YAAA,GAAe,CAAC,KAAA,KAAwB;AAC5C,QAAA,IAAI,KAAA,CAAM,MAAA,KAAW,IAAA,CAAK,YAAA,EAAc;AACtC,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,KAAA,CAAM,IAAA,CAAK,IAAA,KAAS,kBAAA,EAAoB;AAC1C,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,YAAY,CAAA;AAClD,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF,CAAA;AAEA,MAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,YAAY,CAAA;AAAA,IACjD,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAa;AACX,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,OAAA,GAAU,OAAA;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAa;AACX,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,OAAA,GAAU,MAAA;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YACJ,OAAA,EACuD;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,aAAA,EAAe;AAC/B,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACtE;AAEA,IAAA,OAAO,IAAI,OAAA,CAAsD,CAAC,OAAA,EAAS,MAAA,KAAW;AACpF,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,OAAA,CAAQ,EAAE,CAAA;AACtC,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,0CAA0C,CAAC,CAAA;AAAA,MAC9D,GAAG,GAAK,CAAA;AAGR,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,EAAA,EAAI,CAAC,QAAA,KAAkC;AACtE,QAAA,YAAA,CAAa,OAAO,CAAA;AACpB,QAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,OAAA,CAAQ,EAAE,CAAA;AAEtC,QAAA,IAAI,SAAS,OAAA,EAAS;AACpB,UAAA,OAAA,CAAQ,QAAwD,CAAA;AAAA,QAClE,CAAA,MAAO;AACL,UAAA,MAAM,QAAQ,IAAI,KAAA,CAAM,QAAA,CAAS,KAAA,EAAO,WAAW,eAAe,CAAA;AAClE,UAAC,KAAA,CAAc,IAAA,GAAO,QAAA,CAAS,KAAA,EAAO,IAAA;AACtC,UAAA,MAAA,CAAO,KAAK,CAAA;AAAA,QACd;AAAA,MACF,CAAC,CAAA;AAGD,MAAA,IAAA,CAAK,MAAA,CAAQ,aAAA,CAAe,WAAA,CAAY,OAAA,EAAS,KAAK,YAAY,CAAA;AAAA,IACpE,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,KAAA,EAA2B;AAE/C,IAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,IAAA,CAAK,SAAS,CAAA,CAAE,MAAA;AAC7C,IAAA,IAAI,KAAA,CAAM,WAAW,YAAA,EAAc;AACjC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,IAAA,IAAI,KAAK,EAAA,IAAM,IAAA,CAAK,gBAAgB,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AAChD,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,KAAK,EAAE,CAAA;AAChD,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,IAA2B,CAAA;AAAA,MACrC;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,uBAAA,EAAyB;AACzC,MAAA,IAAA,CAAK,YAAY,IAAwB,CAAA;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,IAAA,EAA8B;AAEhD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,IAAI,CAAA;AAAA,IACpC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAgB;AACd,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAA,CAAK,OAAO,MAAA,EAAO;AACnB,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AAAA,IAChB;AAEA,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAEpB,IAAA,IAAI,KAAK,eAAA,EAAiB;AACxB,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,eAAe,CAAA;AAC1D,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,IACzB;AAEA,IAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAAA,EAC7B;AACF,CAAA;;;AC3NO,IAAM,mBAAN,MAAuB;AAAA,EAO5B,YAAY,MAAA,EAAgC;AAJ5C,IAAA,IAAA,CAAQ,SAAA,GAAY,KAAA;AACpB,IAAA,IAAA,CAAQ,WAA4B,EAAC;AACrC,IAAA,IAAA,CAAQ,eAAA,GAAwC,IAAA;AAChD,IAAA,IAAA,CAAQ,cAAA,uBAAqB,GAAA,EAA2B;AAEtD,IAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAaA,kBAAAA;AACtC,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAI,aAAA,CAAc,SAAS,CAAA;AAGhD,IAAA,IAAA,CAAK,aAAA,CAAc,OAAA,GAAU,CAAC,SAAA,EAAmB,OAAA,KAAiB;AAChE,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,OAAO,CAAA;AAE5B,MAAA,IACE,SAAA,KAAcC,wBAAAA,CAAyB,UAAA,IACvC,SAAA,KAAcA,yBAAyB,IAAA,EACvC;AACA,QAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,QAAA,IAAA,CAAK,WAAW,EAAC;AACjB,QAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,SAAA,KAAcA,yBAAyB,eAAA,EAAiB;AAC1D,QAAA,MAAM,OAAA,GAAW,OAAA,IAAY,OAAA,CAAQ,OAAA,IAA0C,IAAA;AAC/E,QAAA,IAAA,CAAK,mBAAA,CAAoB,WAAW,IAAI,CAAA;AAAA,MAC1C;AAAA,IACF,CAAA;AAGA,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,CAAC,YAAY,IAAI,CAAA;AAC7D,IAAA,IAAI,YAAA,CAAa,QAAA,CAAS,WAAA,CAAY,IAAI,CAAA,EAAG;AAC3C,MAAA,IAAA,CAAK,UAAA,GAAa,IAAI,iBAAA,CAAkB,IAAA,CAAK,eAAe,IAAI,CAAA;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAA,GAA4B;AAChC,IAAA,MAAM,IAAA,CAAK,cAAc,YAAA,EAAa;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,OAAA,EAAkD;AAE9D,IAAA,IAAA,CAAK,IAAA,CAAKA,wBAAAA,CAAyB,aAAA,EAAe,EAAE,CAAA;AAGpD,IAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAExB,IAAA,IAAI;AACF,MAAA,MAAM,UAAiC,EAAC;AAExC,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,OAAA,CAAQ,WAAW,OAAA,CAAQ,QAAA;AAAA,MAC7B;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY;AAAA,QACpD,IAAIC,eAAAA,EAAgB;AAAA,QACpB,MAAMC,0BAAAA,CAA2B,OAAA;AAAA,QACjC,OAAA;AAAA,QACA,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,OACzB,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,MAAA,IAAA,CAAK,QAAA,GAAW,SAAS,MAAA,CAAO,QAAA;AAChC,MAAA,IAAA,CAAK,eAAA,GAAkB,QAAA,CAAS,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,IAAA;AAGtD,MAAA,IAAA,CAAK,IAAA,CAAKF,wBAAAA,CAAyB,OAAA,EAAS,QAAA,CAAS,MAAM,CAAA;AAG3D,MAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAExB,MAAA,OAAO,QAAA,CAAS,MAAA;AAAA,IAClB,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AACxB,MAAA,IAAA,CAAK,IAAA,CAAKA,wBAAAA,CAAyB,aAAA,EAAe,EAAE,OAAO,CAAA;AAC3D,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAA,GAA4B;AAChC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,cAAc,WAAA,CAAY;AAAA,QACnC,IAAIC,eAAAA,EAAgB;AAAA,QACpB,MAAMC,0BAAAA,CAA2B,UAAA;AAAA,QACjC,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,OACzB,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,MAAA,IAAA,CAAK,WAAW,EAAC;AACjB,MAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAExB,MAAA,IAAA,CAAK,IAAA,CAAKF,wBAAAA,CAAyB,UAAA,EAAY,EAAE,CAAA;AAAA,IACnD,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,IAAA,CAAKA,wBAAAA,CAAyB,KAAA,EAAO,EAAE,OAAO,CAAA;AACnD,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,GAAuB;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,GAA+B;AAC7B,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AAAA,EAEA,kBAAA,GAA2C;AACzC,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA,EAEA,MAAM,cAAc,SAAA,EAA2C;AAC7D,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,MAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,YAAA,GAAe,KAAK,QAAA,CAAS,IAAA,CAAK,SAAO,GAAA,CAAI,OAAA,KAAY,SAAS,CAAA,IAAK,IAAA;AAC7E,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,OAAA,CAAQ,KAAK,iEAAiE,CAAA;AAAA,IAChF;AACA,IAAA,MAAM,OAAA,GAAgC,EAAE,SAAA,EAAU;AAElD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY;AAAA,MACpD,IAAIC,eAAAA,EAAgB;AAAA,MACpB,MAAMC,0BAAAA,CAA2B,cAAA;AAAA,MACjC,OAAA;AAAA,MACA,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,KACzB,CAAA;AAED,IAAA,MAAM,OAAA,GAAU,SAAS,MAAA,CAAO,OAAA;AAEhC,IAAA,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAChC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,IAAA,GAAmB;AACrB,IAAA,IAAI,CAAC,KAAK,UAAA,EAAY;AACpB,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,EAAA,CAAG,OAAe,QAAA,EAA0B;AAC1C,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAA,kBAAO,IAAI,KAAK,CAAA;AAAA,IAC1C;AACA,IAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,CAAG,IAAI,QAAQ,CAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,GAAA,CAAI,OAAe,QAAA,EAA0B;AAC3C,IAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,EAAG,OAAO,QAAQ,CAAA;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKQ,IAAA,CAAK,OAAe,IAAA,EAAkB;AAC5C,IAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,EAAG,QAAQ,CAAA,QAAA,KAAY;AAClD,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,IAAI,CAAA;AAAA,MACf,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,4BAAA,EAA+B,KAAK,CAAA,CAAA,CAAA,EAAK,KAAK,CAAA;AAAA,MAC9D;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAA,GAAkC;AAChC,IAAA,OAAO,IAAA,CAAK,aAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAgB;AACd,IAAA,IAAA,CAAK,cAAc,OAAA,EAAQ;AAC3B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,EACzB;AAAA,EAEQ,oBAAoB,OAAA,EAAqC;AAC/D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,KAAK,QAAA,CAAS,SAAA,CAAU,SAAO,GAAA,CAAI,OAAA,KAAY,QAAQ,OAAO,CAAA;AAClF,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,GAAI,OAAA;AAAA,IAC/B,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,QAAA,GAAW,CAAC,GAAG,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,IAC5C;AACA,IAAA,IAAA,CAAK,eAAA,GAAkB,OAAA;AAAA,EACzB;AACF","file":"index.js","sourcesContent":["export const AddressType = {\n  THRU: 'thru',\n} as const;\n\nexport type AddressType = typeof AddressType[keyof typeof AddressType];\n\nexport interface WalletAccount {\n  accountType: AddressType;\n  address: string;\n  label: string;\n}\n\nexport interface AppMetadata {\n  appId: string;\n  appName: string;\n  appUrl: string;\n  imageUrl?: string;\n}\n\nexport interface ConnectResult {\n  walletId?: string;\n  accounts: WalletAccount[];\n  status?: 'pending' | 'completed';\n  metadata?: AppMetadata;\n}\n\nexport interface ConnectedApp {\n  accountId: number;\n  appId: string;\n  origin: string;\n  metadata: AppMetadata;\n  connectedAt: number;\n  updatedAt: number;\n}\n\nexport interface SignMessageParams {\n  message: string | Uint8Array;\n  networkId: string;\n}\n\nexport interface SignMessageResult {\n  signature: Uint8Array;\n  publicKey: string;\n}\n","import { AddressType, type IThruChain } from '@thru/chain-interfaces';\nimport { POST_MESSAGE_REQUEST_TYPES, createRequestId } from '@thru/protocol';\nimport type { EmbeddedProvider } from '../EmbeddedProvider';\nimport type { IframeManager } from '../IframeManager';\n\n/**\n * EmbeddedThruChain - postMessage-backed Thru chain adapter.\n */\nexport class EmbeddedThruChain implements IThruChain {\n  private readonly iframeManager: IframeManager;\n  private readonly provider: EmbeddedProvider;\n\n  constructor(iframeManager: IframeManager, provider: EmbeddedProvider) {\n    this.iframeManager = iframeManager;\n    this.provider = provider;\n  }\n\n  get connected(): boolean {\n    return this.provider.isConnected();\n  }\n\n  async connect(): Promise<{ publicKey: string }> {\n    const result = await this.provider.connect();\n    const thruAccount = result.accounts.find((addr) => addr.accountType === AddressType.THRU);\n\n    if (!thruAccount) {\n      throw new Error('Thru address not found in connection result');\n    }\n\n    return { publicKey: thruAccount.address };\n  }\n\n  async disconnect(): Promise<void> {\n    await this.provider.disconnect();\n  }\n\n  async signTransaction(serializedTransaction: string): Promise<string> {\n    if (!this.provider.isConnected()) {\n      throw new Error('Wallet not connected');\n    }\n    if (typeof serializedTransaction !== 'string' || serializedTransaction.length === 0) {\n      throw new Error('Transaction payload must be a base64 encoded string');\n    }\n\n    this.iframeManager.show();\n\n    try {\n      const response = await this.iframeManager.sendMessage({\n        id: createRequestId(),\n        type: POST_MESSAGE_REQUEST_TYPES.SIGN_TRANSACTION,\n        payload: { transaction: serializedTransaction },\n        origin: window.location.origin,\n      });\n      return response.result.signedTransaction;\n    } finally {\n      this.iframeManager.hide();\n    }\n  }\n}\n","import type {\n  InferSuccessfulPostMessageResponse,\n  PostMessageEvent,\n  PostMessageRequest,\n  PostMessageResponse,\n} from './types/messages';\nimport { IFRAME_READY_EVENT, POST_MESSAGE_EVENT_TYPE } from './types/messages';\n\n/**\n * Allowed origins for wallet iframe URLs\n * Only iframes from these origins can be loaded for security\n */\nconst ALLOWED_IFRAME_ORIGINS = [\n  'https://thru-wallet.up.railway.app',\n  'https://wallet.thru.org',\n  // Allow localhost for development (any port)\n  'http://localhost',\n];\n\n/**\n * Validates that the iframe URL is from a trusted origin\n * @throws Error if the origin is not allowed\n */\nfunction validateIframeOrigin(iframeUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(iframeUrl);\n  } catch (error) {\n    throw new Error(\n      `Invalid iframe URL: ${iframeUrl}. URL must be a valid absolute URL.`\n    );\n  }\n\n  const origin = url.origin;\n\n  // Check if origin matches any allowed origin\n  // For localhost, we allow any port (e.g., http://localhost:3000)\n  const isAllowed = ALLOWED_IFRAME_ORIGINS.some((allowedOrigin) => {\n    if (allowedOrigin === 'http://localhost') {\n      // Match exactly http://localhost or http://localhost:port\n      return origin === 'http://localhost' || origin.match(/^http:\\/\\/localhost:\\d+$/);\n    }\n    return origin === allowedOrigin;\n  });\n\n  if (!isAllowed) {\n    throw new Error(\n      `Untrusted iframe origin: ${origin}. ` +\n        `Only trusted wallet origins are allowed: ${ALLOWED_IFRAME_ORIGINS.join(', ')}. ` +\n        `This security check prevents malicious websites from loading unauthorized wallet iframes.`\n    );\n  }\n}\n\n/**\n * Manages iframe lifecycle and postMessage communication\n * Handles creating, showing/hiding iframe, and message passing\n */\nexport class IframeManager {\n  private iframe: HTMLIFrameElement | null = null;\n  private iframeUrl: string;\n  private iframeOrigin: string;\n  private messageHandlers = new Map<string, (response: PostMessageResponse) => void>();\n  private messageListener: ((event: MessageEvent) => void) | null = null;\n  private readyPromise: Promise<void> | null = null;\n\n  /**\n   * Callback for event broadcasts from iframe (no request id)\n   */\n  public onEvent?: (eventType: string, payload: any) => void;\n\n  constructor(iframeUrl: string) {\n    // Validate origin before accepting the URL\n    validateIframeOrigin(iframeUrl);\n\n    this.iframeUrl = iframeUrl;\n    this.iframeOrigin = new URL(iframeUrl).origin;\n  }\n\n  /**\n   * Create and inject iframe into DOM\n   * Returns a promise that resolves when iframe is ready\n   */\n  async createIframe(): Promise<void> {\n    if (this.readyPromise) {\n      return this.readyPromise;\n    }\n\n    this.readyPromise = (async () => {\n      if (!this.iframe) {\n        this.iframe = document.createElement('iframe');\n        this.iframe.src = this.iframeUrl;\n        this.iframe.style.cssText = `\n          position: fixed;\n          top: 0;\n          left: 0;\n          width: 100%;\n          height: 100%;\n          border: none;\n          z-index: 999999;\n          display: none;\n          background: rgba(0, 0, 0, 0.5);\n        `;\n\n        document.body.appendChild(this.iframe);\n\n        // Set up message listener\n        this.messageListener = this.handleMessage.bind(this);\n        window.addEventListener('message', this.messageListener);\n      }\n\n      // Wait for iframe ready signal\n      await this.waitForReady();\n    })();\n\n    return this.readyPromise;\n  }\n\n  /**\n   * Wait for iframe to send 'ready' signal\n   */\n  private waitForReady(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const timeout = setTimeout(() => {\n        reject(new Error('Iframe ready timeout - wallet failed to load'));\n      }, 10000); // 10 second timeout\n\n      const readyHandler = (event: MessageEvent) => {\n        if (event.origin !== this.iframeOrigin) {\n          return;\n        }\n\n        if (event.data.type === IFRAME_READY_EVENT) {\n          clearTimeout(timeout);\n          window.removeEventListener('message', readyHandler);\n          resolve();\n        }\n      };\n\n      window.addEventListener('message', readyHandler);\n    });\n  }\n\n  /**\n   * Show iframe modal\n   */\n  show(): void {\n    if (this.iframe) {\n      this.iframe.style.display = 'block';\n    }\n  }\n\n  /**\n   * Hide iframe modal\n   */\n  hide(): void {\n    if (this.iframe) {\n      this.iframe.style.display = 'none';\n    }\n  }\n\n  /**\n   * Send message to iframe and wait for response\n   */\n  async sendMessage<TRequest extends PostMessageRequest>(\n    request: TRequest\n  ): Promise<InferSuccessfulPostMessageResponse<TRequest>> {\n    if (!this.iframe?.contentWindow) {\n      throw new Error('Iframe not initialized - call createIframe() first');\n    }\n\n    return new Promise<InferSuccessfulPostMessageResponse<TRequest>>((resolve, reject) => {\n      const timeout = setTimeout(() => {\n        this.messageHandlers.delete(request.id);\n        reject(new Error('Request timeout - wallet did not respond'));\n      }, 30000); // 30 second timeout\n\n      // Store handler for this request\n      this.messageHandlers.set(request.id, (response: PostMessageResponse) => {\n        clearTimeout(timeout);\n        this.messageHandlers.delete(request.id);\n\n        if (response.success) {\n          resolve(response as InferSuccessfulPostMessageResponse<TRequest>);\n        } else {\n          const error = new Error(response.error?.message || 'Unknown error');\n          (error as any).code = response.error?.code;\n          reject(error);\n        }\n      });\n\n      // Send message to iframe\n      this.iframe!.contentWindow!.postMessage(request, this.iframeOrigin);\n    });\n  }\n\n  /**\n   * Handle incoming messages from iframe\n   */\n  private handleMessage(event: MessageEvent): void {\n    // Validate origin\n    const iframeOrigin = new URL(this.iframeUrl).origin;\n    if (event.origin !== iframeOrigin) {\n      return; // Ignore messages from other origins\n    }\n\n    const data = event.data;\n\n    // Handle response to a specific request (has id)\n    if (data.id && this.messageHandlers.has(data.id)) {\n      const handler = this.messageHandlers.get(data.id);\n      if (handler) {\n        handler(data as PostMessageResponse);\n      }\n      return;\n    }\n\n    // Handle event broadcasts (type === 'event')\n    if (data.type === POST_MESSAGE_EVENT_TYPE) {\n      this.handleEvent(data as PostMessageEvent);\n    }\n  }\n\n  /**\n   * Handle event broadcasts from iframe\n   */\n  private handleEvent(data: PostMessageEvent): void {\n    // Forward to EmbeddedProvider via callback\n    if (this.onEvent) {\n      this.onEvent(data.event, data.data);\n    }\n  }\n\n  /**\n   * Destroy iframe and cleanup\n   */\n  destroy(): void {\n    if (this.iframe) {\n      this.iframe.remove();\n      this.iframe = null;\n    }\n\n    this.readyPromise = null;\n\n    if (this.messageListener) {\n      window.removeEventListener('message', this.messageListener);\n      this.messageListener = null;\n    }\n\n    this.messageHandlers.clear();\n  }\n}\n","import type {\n  AddressType as AddressTypeValue,\n  ConnectResult,\n  IThruChain,\n  WalletAccount,\n} from '@thru/chain-interfaces';\nimport { AddressType } from '@thru/chain-interfaces';\nimport {\n  DEFAULT_IFRAME_URL,\n  EMBEDDED_PROVIDER_EVENTS,\n  POST_MESSAGE_REQUEST_TYPES,\n  createRequestId,\n  type ConnectMetadataInput,\n  type ConnectRequestPayload,\n  type SelectAccountPayload\n} from '@thru/protocol';\nimport { IframeManager } from './IframeManager';\nimport { EmbeddedThruChain } from './chains/ThruChain';\n\nexport interface EmbeddedProviderConfig {\n  iframeUrl?: string;\n  addressTypes?: AddressTypeValue[];\n}\n\nexport interface ConnectOptions {\n  metadata?: ConnectMetadataInput;\n}\n\n/**\n * Main embedded provider class\n * Manages iframe lifecycle, connection state, and chain-specific interfaces\n */\nexport class EmbeddedProvider {\n  private iframeManager: IframeManager;\n  private _thruChain?: IThruChain;\n  private connected = false;\n  private accounts: WalletAccount[] = [];\n  private selectedAccount: WalletAccount | null = null;\n  private eventListeners = new Map<string, Set<Function>>();\n  constructor(config: EmbeddedProviderConfig) {\n    const iframeUrl = config.iframeUrl || DEFAULT_IFRAME_URL;\n    this.iframeManager = new IframeManager(iframeUrl);\n\n    // Set up event forwarding from iframe\n    this.iframeManager.onEvent = (eventType: string, payload: any) => {\n      this.emit(eventType, payload);\n\n      if (\n        eventType === EMBEDDED_PROVIDER_EVENTS.DISCONNECT ||\n        eventType === EMBEDDED_PROVIDER_EVENTS.LOCK\n      ) {\n        this.connected = false;\n        this.accounts = [];\n        this.selectedAccount = null;\n        return;\n      }\n\n      if (eventType === EMBEDDED_PROVIDER_EVENTS.ACCOUNT_CHANGED) {\n        const account = (payload && (payload.account as WalletAccount | undefined)) || null;\n        this.refreshAccountCache(account ?? null);\n      }\n    };\n\n    // Create chain instances\n    const addressTypes = config.addressTypes || [AddressType.THRU];\n    if (addressTypes.includes(AddressType.THRU)) {\n      this._thruChain = new EmbeddedThruChain(this.iframeManager, this);\n    }\n  }\n\n  /**\n   * Initialize the provider (must be called before use)\n   * Creates iframe and waits for it to be ready\n   */\n  async initialize(): Promise<void> {\n    await this.iframeManager.createIframe();\n  }\n\n  /**\n   * Connect to wallet\n   * Shows iframe modal and requests connection\n   */\n  async connect(options?: ConnectOptions): Promise<ConnectResult> {\n    // Emit connecting event\n    this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_START, {});\n\n    // Show iframe modal\n    this.iframeManager.show();\n\n    try {\n      const payload: ConnectRequestPayload = {};\n\n      if (options?.metadata) {\n        payload.metadata = options.metadata;\n      }\n\n      const response = await this.iframeManager.sendMessage({\n        id: createRequestId(),\n        type: POST_MESSAGE_REQUEST_TYPES.CONNECT,\n        payload,\n        origin: window.location.origin,\n      });\n\n      this.connected = true;\n      this.accounts = response.result.accounts;\n      this.selectedAccount = response.result.accounts[0] ?? null;\n\n      // Emit success event\n      this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT, response.result);\n\n      // Hide iframe after successful connection\n      this.iframeManager.hide();\n\n      return response.result;\n    } catch (error) {\n      this.iframeManager.hide();\n      this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_ERROR, { error });\n      throw error;\n    }\n  }\n\n  /**\n   * Disconnect from wallet\n   */\n  async disconnect(): Promise<void> {\n    try {\n      await this.iframeManager.sendMessage({\n        id: createRequestId(),\n        type: POST_MESSAGE_REQUEST_TYPES.DISCONNECT,\n        origin: window.location.origin,\n      });\n\n      this.connected = false;\n      this.accounts = [];\n      this.iframeManager.hide();\n\n      this.emit(EMBEDDED_PROVIDER_EVENTS.DISCONNECT, {});\n    } catch (error) {\n      this.emit(EMBEDDED_PROVIDER_EVENTS.ERROR, { error });\n      throw error;\n    }\n  }\n\n  /**\n   * Check if connected\n   */\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  /**\n   * Get accounts\n   */\n  getAccounts(): WalletAccount[] {\n    return this.accounts;\n  }\n\n  getSelectedAccount(): WalletAccount | null {\n    return this.selectedAccount;\n  }\n\n  async selectAccount(publicKey: string): Promise<WalletAccount> {\n    if (!this.connected) {\n      throw new Error('Wallet not connected');\n    }\n\n    const knownAccount = this.accounts.find(acc => acc.address === publicKey) ?? null;\n    if (!knownAccount) {\n      console.warn('[EmbeddedProvider] Selecting account not present in local cache');\n    }\n    const payload: SelectAccountPayload = { publicKey };\n\n    const response = await this.iframeManager.sendMessage({\n      id: createRequestId(),\n      type: POST_MESSAGE_REQUEST_TYPES.SELECT_ACCOUNT,\n      payload,\n      origin: window.location.origin,\n    });\n\n    const account = response.result.account;\n\n    this.refreshAccountCache(account);\n    return account;\n  }\n\n  /**\n   * Get Thru chain API\n   */\n  get thru(): IThruChain {\n    if (!this._thruChain) {\n      throw new Error('Thru chain not enabled in provider config');\n    }\n    return this._thruChain;\n  }\n\n  /**\n   * Event emitter: on\n   */\n  on(event: string, callback: Function): void {\n    if (!this.eventListeners.has(event)) {\n      this.eventListeners.set(event, new Set());\n    }\n    this.eventListeners.get(event)!.add(callback);\n  }\n\n  /**\n   * Event emitter: off\n   */\n  off(event: string, callback: Function): void {\n    this.eventListeners.get(event)?.delete(callback);\n  }\n\n  /**\n   * Emit event to all listeners\n   */\n  private emit(event: string, data?: any): void {\n    this.eventListeners.get(event)?.forEach(callback => {\n      try {\n        callback(data);\n      } catch (error) {\n        console.error(`Error in event listener for ${event}:`, error);\n      }\n    });\n  }\n\n  /**\n   * Get iframe manager (for chain implementations)\n   * @internal\n   */\n  getIframeManager(): IframeManager {\n    return this.iframeManager;\n  }\n\n  /**\n   * Destroy provider and cleanup\n   */\n  destroy(): void {\n    this.iframeManager.destroy();\n    this.eventListeners.clear();\n    this.connected = false;\n    this.accounts = [];\n    this.selectedAccount = null;\n  }\n\n  private refreshAccountCache(account: WalletAccount | null): void {\n    if (!account) {\n      this.selectedAccount = null;\n      return;\n    }\n\n    const existingIdx = this.accounts.findIndex(acc => acc.address === account.address);\n    if (existingIdx >= 0) {\n      this.accounts[existingIdx] = account;\n    } else {\n      this.accounts = [...this.accounts, account];\n    }\n    this.selectedAccount = account;\n  }\n}\n"]}
+{"version":3,"sources":["../../chain-interfaces/src/types.ts","../src/chains/ThruChain.ts","../src/IframeManager.ts","../src/EmbeddedProvider.ts"],"names":["createRequestId","POST_MESSAGE_REQUEST_TYPES","DEFAULT_IFRAME_URL","EMBEDDED_PROVIDER_EVENTS"],"mappings":";;;;AAAO,IAAM,WAAA,GAAc;EACzB,IAAA,EAAM;AACR,CAAA;ACMO,IAAM,oBAAN,MAA8C;AAAA,EAInD,WAAA,CAAY,eAA8B,QAAA,EAA4B;AACpE,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AACrB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,SAAS,WAAA,EAAY;AAAA,EACnC;AAAA,EAEA,MAAM,OAAA,GAA0C;AAC9C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,OAAA,EAAQ;AAC3C,IAAA,MAAM,WAAA,GAAc,OAAO,QAAA,CAAS,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,KAAgB,WAAA,CAAY,IAAI,CAAA;AAExF,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AAEA,IAAA,OAAO,EAAE,SAAA,EAAW,WAAA,CAAY,OAAA,EAAQ;AAAA,EAC1C;AAAA,EAEA,MAAM,UAAA,GAA4B;AAChC,IAAA,MAAM,IAAA,CAAK,SAAS,UAAA,EAAW;AAAA,EACjC;AAAA,EAEA,MAAM,gBAAgB,qBAAA,EAAgD;AACpE,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,WAAA,EAAY,EAAG;AAChC,MAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,IACxC;AACA,IAAA,IAAI,OAAO,qBAAA,KAA0B,QAAA,IAAY,qBAAA,CAAsB,WAAW,CAAA,EAAG;AACnF,MAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,IACvE;AAEA,IAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAExB,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY;AAAA,QACpD,IAAI,eAAA,EAAgB;AAAA,QACpB,MAAM,0BAAA,CAA2B,gBAAA;AAAA,QACjC,OAAA,EAAS,EAAE,WAAA,EAAa,qBAAA,EAAsB;AAAA,QAC9C,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,OACzB,CAAA;AACD,MAAA,OAAO,SAAS,MAAA,CAAO,iBAAA;AAAA,IACzB,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAAA,IAC1B;AAAA,EACF;AACF;;;ACzCA,IAAM,sBAAA,GAAyB;AAAA,EAC7B,oCAAA;AAAA,EACA,wBAAA;AAAA,EACA,yBAAA;AAAA;AAAA,EAEA;AACF,CAAA;AAMA,SAAS,qBAAqB,SAAA,EAAyB;AACrD,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,SAAS,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uBAAuB,SAAS,CAAA,mCAAA;AAAA,KAClC;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAInB,EAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,IAAA,CAAK,CAAC,aAAA,KAAkB;AAC/D,IAAA,IAAI,kBAAkB,kBAAA,EAAoB;AAExC,MAAA,OAAO,MAAA,KAAW,kBAAA,IAAsB,MAAA,CAAO,KAAA,CAAM,0BAA0B,CAAA;AAAA,IACjF;AACA,IAAA,OAAO,MAAA,KAAW,aAAA;AAAA,EACpB,CAAC,CAAA;AAED,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,4BAA4B,MAAM,CAAA,2CAAA,EACY,sBAAA,CAAuB,IAAA,CAAK,IAAI,CAAC,CAAA,2FAAA;AAAA,KAEjF;AAAA,EACF;AACF;AAMO,IAAM,gBAAN,MAAoB;AAAA,EAiBzB,YAAY,SAAA,EAAmB;AAhB/B,IAAA,IAAA,CAAQ,MAAA,GAAmC,IAAA;AAI3C,IAAA,IAAA,CAAQ,eAAA,uBAAsB,GAAA,EAAqD;AACnF,IAAA,IAAA,CAAQ,eAAA,GAA0D,IAAA;AAClE,IAAA,IAAA,CAAQ,YAAA,GAAqC,IAAA;AAC7C,IAAA,IAAA,CAAQ,WAAA,GAAkC,OAAA;AAC1C,IAAA,IAAA,CAAQ,eAAA,GAAsC,IAAA;AAC9C,IAAA,IAAA,CAAQ,OAAA,GAAU,KAAA;AAShB,IAAA,oBAAA,CAAqB,SAAS,CAAA;AAE9B,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,MAAA;AAGvC,IAAA,IAAA,CAAK,OAAA,GAAUA,gBAAgB,OAAO,CAAA;AAAA,EACxC;AAAA,EAEQ,YAAA,GAAuB;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,SAAS,CAAA;AAClC,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,IAAA,CAAK,OAAO,CAAA;AAChD,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,GAA8B;AAClC,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd;AAEA,IAAA,IAAA,CAAK,gBAAgB,YAAY;AAC/B,MAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,QAAA,IAAA,CAAK,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC7C,QAAA,IAAA,CAAK,MAAA,CAAO,GAAA,GAAM,IAAA,CAAK,YAAA,EAAa;AAEpC,QAAA,IAAA,CAAK,OAAO,KAAA,GAAQ,yDAAA;AACpB,QAAA,IAAA,CAAK,iBAAA,EAAkB;AAEvB,QAAA,IAAA,CAAK,cAAc,KAAK,CAAA;AAExB,QAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,QAAA,IAAY,IAAA,CAAK,eAAA,EAAiB;AACzD,UAAA,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AAAA,QAC9C,CAAA,MAAO;AACL,UAAA,QAAA,CAAS,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AAAA,QACvC;AAGA,QAAA,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,IAAI,CAAA;AACnD,QAAA,MAAA,CAAO,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,eAAe,CAAA;AAAA,MACzD;AAEA,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B,CAAA,GAAG,CAAE,KAAA,CAAM,CAAC,KAAA,KAAU;AACpB,MAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,MAAA,MAAM,KAAA;AAAA,IACR,CAAC,CAAA;AAED,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAA,GAA8B;AACpC,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,IAAI,YAAA;AACJ,MAAA,MAAM,UAAU,MAAM;AACpB,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA;AAAA,QACF;AACA,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,YAAY,CAAA;AAClD,QAAA,YAAA,CAAa,OAAO,CAAA;AAAA,MACtB,CAAA;AAEA,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,OAAA,EAAQ;AACR,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,8CAA8C,CAAC,CAAA;AAAA,MAClE,GAAG,GAAK,CAAA;AAER,MAAA,YAAA,GAAe,CAAC,KAAA,KAAwB;AACtC,QAAA,IAAI,CAAC,IAAA,CAAK,mBAAA,CAAoB,KAAK,CAAA,EAAG;AACpC,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,KAAA,CAAM,IAAA,EAAM,IAAA,KAAS,kBAAA,EAAoB;AAC3C,UAAA,OAAA,EAAQ;AACR,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF,CAAA;AAEA,MAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,YAAY,CAAA;AAAA,IACjD,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,SAAA,EAAuC;AACvD,IAAA,IAAA,CAAK,eAAA,GAAkB,SAAA;AACvB,IAAA,IAAA,CAAK,WAAA,GAAc,QAAA;AACnB,IAAA,MAAM,KAAK,YAAA,EAAa;AACxB,IAAA,IAAA,CAAK,UAAA,EAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,GAAmB;AACjB,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,QAAA;AACnB,IAAA,IAAI,KAAK,eAAA,IAAmB,IAAA,CAAK,MAAA,CAAO,aAAA,KAAkB,KAAK,eAAA,EAAiB;AAC9E,MAAA,IAAA,CAAK,eAAA,CAAgB,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AAAA,IAC9C;AACA,IAAA,IAAA,CAAK,iBAAA,EAAkB;AACvB,IAAA,IAAA,CAAK,cAAc,IAAI,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAkB;AAChB,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,WAAA,GAAc,OAAA;AACnB,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,aAAA,KAAkB,QAAA,CAAS,IAAA,EAAM;AAC/C,MAAA,QAAA,CAAS,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,MAAM,CAAA;AAAA,IACvC;AACA,IAAA,IAAA,CAAK,iBAAA,EAAkB;AACvB,IAAA,IAAA,CAAK,cAAc,IAAI,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,SAAA,EAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,EAC1B;AAAA,EAEA,QAAA,GAAoB;AAClB,IAAA,OAAO,KAAK,WAAA,KAAgB,QAAA;AAAA,EAC9B;AAAA,EAEQ,iBAAA,GAA0B;AAChC,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,gBAAgB,QAAA,EAAU;AACjC,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAAA,CAAA;AAS5B,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAA,CAAA;AAAA,EAW9B;AAAA,EAEQ,cAAc,OAAA,EAAwB;AAC5C,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,OAAA,GAAU,OAAA,GAAU,GAAA,GAAM,GAAA;AAC5C,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,aAAA,GAAgB,OAAA,GAAU,MAAA,GAAS,MAAA;AACrD,IAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,UAAA,GAAa,OAAA,GAAU,SAAA,GAAY,QAAA;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YACJ,OAAA,EACuD;AAIvD,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,MAAM,IAAA,CAAK,YAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B;AAEA,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAQ,aAAA,EAAe;AAC/B,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACtE;AAEA,IAAA,OAAO,IAAI,OAAA,CAAsD,CAAC,OAAA,EAAS,MAAA,KAAW;AAGpF,MAAA,MAAM,YACJ,OAAA,CAAQ,IAAA,KAASC,0BAAAA,CAA2B,OAAA,IAC5C,QAAQ,IAAA,KAASA,0BAAAA,CAA2B,YAAA,IAC5C,OAAA,CAAQ,SAASA,0BAAAA,CAA2B,gBAAA,GACxC,CAAA,GAAI,EAAA,GAAK,MACT,EAAA,GAAK,GAAA;AAEX,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,OAAA,CAAQ,EAAE,CAAA;AACtC,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,0CAA0C,CAAC,CAAA;AAAA,MAC9D,GAAG,SAAS,CAAA;AAGZ,MAAA,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,EAAA,EAAI,CAAC,QAAA,KAAkC;AACtE,QAAA,YAAA,CAAa,OAAO,CAAA;AACpB,QAAA,IAAA,CAAK,eAAA,CAAgB,MAAA,CAAO,OAAA,CAAQ,EAAE,CAAA;AAEtC,QAAA,IAAI,SAAS,OAAA,EAAS;AACpB,UAAA,OAAA,CAAQ,QAAwD,CAAA;AAAA,QAClE,CAAA,MAAO;AACL,UAAA,MAAM,QAAQ,IAAI,KAAA,CAAM,QAAA,CAAS,KAAA,EAAO,WAAW,eAAe,CAAA;AAClE,UAAC,KAAA,CAAc,IAAA,GAAO,QAAA,CAAS,KAAA,EAAO,IAAA;AACtC,UAAA,MAAA,CAAO,KAAK,CAAA;AAAA,QACd;AAAA,MACF,CAAC,CAAA;AAGD,MAAA,IAAA,CAAK,MAAA,CAAQ,aAAA,CAAe,WAAA,CAAY,OAAA,EAAS,KAAK,YAAY,CAAA;AAAA,IACpE,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,KAAA,EAA2B;AAC/C,IAAA,IAAI,CAAC,IAAA,CAAK,mBAAA,CAAoB,KAAK,CAAA,EAAG;AACpC,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AAGnB,IAAA,IAAI,KAAK,EAAA,IAAM,IAAA,CAAK,gBAAgB,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AAChD,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,KAAK,EAAE,CAAA;AAChD,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,IAA2B,CAAA;AAAA,MACrC;AACA,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,IAAA,CAAK,SAAS,uBAAA,EAAyB;AACzC,MAAA,IAAA,CAAK,YAAY,IAAwB,CAAA;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,IAAA,EAA8B;AAEhD,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,IAAI,CAAA;AAAA,IACpC;AAAA,EACF;AAAA,EAEQ,oBAAoB,KAAA,EAA8B;AACxD,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,IAAA,CAAK,YAAA,EAAc;AACtC,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,OAAA,KAAY,KAAK,OAAA,EAAS;AAC1C,MAAA,OAAO,KAAA;AAAA,IACT;AAIA,IAAA,IAAI,CAAC,MAAM,MAAA,EAAQ;AACjB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAK,MAAA,EAAQ,aAAA,IAAiB,MAAM,MAAA,KAAW,IAAA,CAAK,OAAO,aAAA,EAAe;AAC5E,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAgB;AACd,IAAA,IAAI,KAAK,MAAA,EAAQ;AACf,MAAA,IAAA,CAAK,OAAO,MAAA,EAAO;AACnB,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AAAA,IAChB;AAEA,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAEpB,IAAA,IAAI,KAAK,eAAA,EAAiB;AACxB,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,eAAe,CAAA;AAC1D,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,IACzB;AAEA,IAAA,IAAA,CAAK,gBAAgB,KAAA,EAAM;AAAA,EAC7B;AACF,CAAA;;;ACjXO,IAAM,mBAAN,MAAuB;AAAA,EAQ5B,YAAY,MAAA,EAAgC;AAL5C,IAAA,IAAA,CAAQ,SAAA,GAAY,KAAA;AACpB,IAAA,IAAA,CAAQ,WAA4B,EAAC;AACrC,IAAA,IAAA,CAAQ,eAAA,GAAwC,IAAA;AAChD,IAAA,IAAA,CAAQ,cAAA,uBAAqB,GAAA,EAA2B;AACxD,IAAA,IAAA,CAAQ,UAAA,GAAa,KAAA;AAEnB,IAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAaC,kBAAAA;AACtC,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAI,aAAA,CAAc,SAAS,CAAA;AAGhD,IAAA,IAAA,CAAK,aAAA,CAAc,OAAA,GAAU,CAAC,SAAA,EAAmB,OAAA,KAAiB;AAChE,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,OAAO,CAAA;AAE5B,MAAA,IAAI,SAAA,KAAcC,yBAAyB,OAAA,EAAS;AAClD,QAAA,IAAI,KAAK,UAAA,EAAY;AACnB,UAAA,IAAA,CAAK,cAAc,UAAA,EAAW;AAAA,QAChC,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,QAC/B;AACA,QAAA;AAAA,MACF;AAEA,MAAA,IACE,SAAA,KAAcA,wBAAAA,CAAyB,UAAA,IACvC,SAAA,KAAcA,yBAAyB,IAAA,EACvC;AACA,QAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,QAAA,IAAA,CAAK,WAAW,EAAC;AACjB,QAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,SAAA,KAAcA,yBAAyB,eAAA,EAAiB;AAC1D,QAAA,MAAM,OAAA,GAAW,OAAA,IAAY,OAAA,CAAQ,OAAA,IAA0C,IAAA;AAC/E,QAAA,IAAA,CAAK,mBAAA,CAAoB,WAAW,IAAI,CAAA;AAAA,MAC1C;AAAA,IACF,CAAA;AAGA,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,CAAC,YAAY,IAAI,CAAA;AAC7D,IAAA,IAAI,YAAA,CAAa,QAAA,CAAS,WAAA,CAAY,IAAI,CAAA,EAAG;AAC3C,MAAA,IAAA,CAAK,UAAA,GAAa,IAAI,iBAAA,CAAkB,IAAA,CAAK,eAAe,IAAI,CAAA;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAA,GAA4B;AAChC,IAAA,MAAM,IAAA,CAAK,cAAc,YAAA,EAAa;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,SAAA,EAAuC;AACvD,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,MAAM,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY,SAAS,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,OAAA,EAAkD;AAE9D,IAAA,IAAA,CAAK,IAAA,CAAKA,wBAAAA,CAAyB,aAAA,EAAe,EAAE,CAAA;AAEpD,IAAA,IAAI;AACF,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,IAAA,CAAK,cAAc,UAAA,EAAW;AAAA,MAChC,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,cAAc,SAAA,EAAU;AAAA,MAC/B;AAEA,MAAA,MAAM,UAAiC,EAAC;AAExC,MAAA,IAAI,SAAS,QAAA,EAAU;AACrB,QAAA,OAAA,CAAQ,WAAW,OAAA,CAAQ,QAAA;AAAA,MAC7B;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY;AAAA,QACpD,IAAIH,eAAAA,EAAgB;AAAA,QACpB,MAAMC,0BAAAA,CAA2B,OAAA;AAAA,QACjC,OAAA;AAAA,QACA,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,OACzB,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,MAAA,IAAA,CAAK,QAAA,GAAW,SAAS,MAAA,CAAO,QAAA;AAChC,MAAA,IAAA,CAAK,eAAA,GAAkB,QAAA,CAAS,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,IAAA;AAGtD,MAAA,IAAA,CAAK,IAAA,CAAKE,wBAAAA,CAAyB,OAAA,EAAS,QAAA,CAAS,MAAM,CAAA;AAG3D,MAAA,IAAI,CAAC,KAAK,UAAA,EAAY;AACpB,QAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAAA,MAC1B;AAEA,MAAA,OAAO,QAAA,CAAS,MAAA;AAAA,IAClB,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,CAAC,KAAK,UAAA,EAAY;AACpB,QAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAAA,MAC1B;AACA,MAAA,IAAA,CAAK,IAAA,CAAKA,wBAAAA,CAAyB,aAAA,EAAe,EAAE,OAAO,CAAA;AAC3D,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAA,GAA4B;AAChC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,cAAc,WAAA,CAAY;AAAA,QACnC,IAAIH,eAAAA,EAAgB;AAAA,QACpB,MAAMC,0BAAAA,CAA2B,UAAA;AAAA,QACjC,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,OACzB,CAAA;AAED,MAAA,IAAA,CAAK,IAAA,CAAKE,wBAAAA,CAAyB,UAAA,EAAY,EAAE,CAAA;AAAA,IACnD,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,IAAA,CAAKA,wBAAAA,CAAyB,KAAA,EAAO,EAAE,OAAO,CAAA;AACnD,MAAA,MAAM,KAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,MAAA,IAAA,CAAK,WAAW,EAAC;AACjB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAI,CAAC,KAAK,UAAA,EAAY;AACpB,QAAA,IAAA,CAAK,cAAc,IAAA,EAAK;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,GAAuB;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,GAA+B;AAC7B,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AAAA,EAEA,kBAAA,GAA2C;AACzC,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA,EAEA,MAAM,cAAc,SAAA,EAA2C;AAC7D,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,MAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,IACxC;AAEA,IAAA,MAAM,YAAA,GAAe,KAAK,QAAA,CAAS,IAAA,CAAK,SAAO,GAAA,CAAI,OAAA,KAAY,SAAS,CAAA,IAAK,IAAA;AAC7E,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,OAAA,CAAQ,KAAK,iEAAiE,CAAA;AAAA,IAChF;AACA,IAAA,MAAM,OAAA,GAAgC,EAAE,SAAA,EAAU;AAElD,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,aAAA,CAAc,WAAA,CAAY;AAAA,MACpD,IAAIH,eAAAA,EAAgB;AAAA,MACpB,MAAMC,0BAAAA,CAA2B,cAAA;AAAA,MACjC,OAAA;AAAA,MACA,MAAA,EAAQ,OAAO,QAAA,CAAS;AAAA,KACzB,CAAA;AAED,IAAA,MAAM,OAAA,GAAU,SAAS,MAAA,CAAO,OAAA;AAEhC,IAAA,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAChC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,IAAA,GAAmB;AACrB,IAAA,IAAI,CAAC,KAAK,UAAA,EAAY;AACpB,MAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,EAAA,CAAG,OAAe,QAAA,EAA0B;AAC1C,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,EAAG;AACnC,MAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAA,kBAAO,IAAI,KAAK,CAAA;AAAA,IAC1C;AACA,IAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,CAAG,IAAI,QAAQ,CAAA;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,GAAA,CAAI,OAAe,QAAA,EAA0B;AAC3C,IAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,EAAG,OAAO,QAAQ,CAAA;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKQ,IAAA,CAAK,OAAe,IAAA,EAAkB;AAC5C,IAAA,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,EAAG,QAAQ,CAAA,QAAA,KAAY;AAClD,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,IAAI,CAAA;AAAA,MACf,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,4BAAA,EAA+B,KAAK,CAAA,CAAA,CAAA,EAAK,KAAK,CAAA;AAAA,MAC9D;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAA,GAAkC;AAChC,IAAA,OAAO,IAAA,CAAK,aAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAgB;AACd,IAAA,IAAA,CAAK,cAAc,OAAA,EAAQ;AAC3B,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,EACzB;AAAA,EAEQ,oBAAoB,OAAA,EAAqC;AAC/D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,KAAK,QAAA,CAAS,SAAA,CAAU,SAAO,GAAA,CAAI,OAAA,KAAY,QAAQ,OAAO,CAAA;AAClF,IAAA,IAAI,eAAe,CAAA,EAAG;AACpB,MAAA,IAAA,CAAK,QAAA,CAAS,WAAW,CAAA,GAAI,OAAA;AAAA,IAC/B,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,QAAA,GAAW,CAAC,GAAG,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,IAC5C;AACA,IAAA,IAAA,CAAK,eAAA,GAAkB,OAAA;AAAA,EACzB;AACF","file":"index.js","sourcesContent":["export const AddressType = {\n  THRU: 'thru',\n} as const;\n\nexport type AddressType = typeof AddressType[keyof typeof AddressType];\n\nexport interface WalletAccount {\n  accountType: AddressType;\n  address: string;\n  label: string;\n}\n\nexport interface AppMetadata {\n  appId: string;\n  appName: string;\n  appUrl: string;\n  imageUrl?: string;\n}\n\nexport interface ConnectResult {\n  walletId?: string;\n  accounts: WalletAccount[];\n  status?: 'pending' | 'completed';\n  metadata?: AppMetadata;\n}\n\nexport interface ConnectedApp {\n  accountId: number;\n  appId: string;\n  origin: string;\n  metadata: AppMetadata;\n  connectedAt: number;\n  updatedAt: number;\n}\n\nexport interface SignMessageParams {\n  message: string | Uint8Array;\n  networkId: string;\n}\n\nexport interface SignMessageResult {\n  signature: Uint8Array;\n  publicKey: string;\n}\n","import { AddressType, type IThruChain } from '@thru/chain-interfaces';\nimport { POST_MESSAGE_REQUEST_TYPES, createRequestId } from '@thru/protocol';\nimport type { EmbeddedProvider } from '../EmbeddedProvider';\nimport type { IframeManager } from '../IframeManager';\n\n/**\n * EmbeddedThruChain - postMessage-backed Thru chain adapter.\n */\nexport class EmbeddedThruChain implements IThruChain {\n  private readonly iframeManager: IframeManager;\n  private readonly provider: EmbeddedProvider;\n\n  constructor(iframeManager: IframeManager, provider: EmbeddedProvider) {\n    this.iframeManager = iframeManager;\n    this.provider = provider;\n  }\n\n  get connected(): boolean {\n    return this.provider.isConnected();\n  }\n\n  async connect(): Promise<{ publicKey: string }> {\n    const result = await this.provider.connect();\n    const thruAccount = result.accounts.find((addr) => addr.accountType === AddressType.THRU);\n\n    if (!thruAccount) {\n      throw new Error('Thru address not found in connection result');\n    }\n\n    return { publicKey: thruAccount.address };\n  }\n\n  async disconnect(): Promise<void> {\n    await this.provider.disconnect();\n  }\n\n  async signTransaction(serializedTransaction: string): Promise<string> {\n    if (!this.provider.isConnected()) {\n      throw new Error('Wallet not connected');\n    }\n    if (typeof serializedTransaction !== 'string' || serializedTransaction.length === 0) {\n      throw new Error('Transaction payload must be a base64 encoded string');\n    }\n\n    this.iframeManager.show();\n\n    try {\n      const response = await this.iframeManager.sendMessage({\n        id: createRequestId(),\n        type: POST_MESSAGE_REQUEST_TYPES.SIGN_TRANSACTION,\n        payload: { transaction: serializedTransaction },\n        origin: window.location.origin,\n      });\n      return response.result.signedTransaction;\n    } finally {\n      this.iframeManager.hide();\n    }\n  }\n}\n","import type {\n  InferSuccessfulPostMessageResponse,\n  PostMessageEvent,\n  PostMessageRequest,\n  PostMessageResponse,\n} from './types/messages';\nimport {\n  IFRAME_READY_EVENT,\n  POST_MESSAGE_EVENT_TYPE,\n  POST_MESSAGE_REQUEST_TYPES,\n  createRequestId,\n} from './types/messages';\n\n/**\n * Allowed origins for wallet iframe URLs\n * Only iframes from these origins can be loaded for security\n */\nconst ALLOWED_IFRAME_ORIGINS = [\n  'https://thru-wallet.up.railway.app',\n  'https://wallet.thru.io',\n  'https://wallet.thru.org',\n  // Allow localhost for development (any port)\n  'http://localhost',\n];\n\n/**\n * Validates that the iframe URL is from a trusted origin\n * @throws Error if the origin is not allowed\n */\nfunction validateIframeOrigin(iframeUrl: string): void {\n  let url: URL;\n  try {\n    url = new URL(iframeUrl);\n  } catch (error) {\n    throw new Error(\n      `Invalid iframe URL: ${iframeUrl}. URL must be a valid absolute URL.`\n    );\n  }\n\n  const origin = url.origin;\n\n  // Check if origin matches any allowed origin\n  // For localhost, we allow any port (e.g., http://localhost:3000)\n  const isAllowed = ALLOWED_IFRAME_ORIGINS.some((allowedOrigin) => {\n    if (allowedOrigin === 'http://localhost') {\n      // Match exactly http://localhost or http://localhost:port\n      return origin === 'http://localhost' || origin.match(/^http:\\/\\/localhost:\\d+$/);\n    }\n    return origin === allowedOrigin;\n  });\n\n  if (!isAllowed) {\n    throw new Error(\n      `Untrusted iframe origin: ${origin}. ` +\n        `Only trusted wallet origins are allowed: ${ALLOWED_IFRAME_ORIGINS.join(', ')}. ` +\n        `This security check prevents malicious websites from loading unauthorized wallet iframes.`\n    );\n  }\n}\n\n/**\n * Manages iframe lifecycle and postMessage communication\n * Handles creating, showing/hiding iframe, and message passing\n */\nexport class IframeManager {\n  private iframe: HTMLIFrameElement | null = null;\n  private iframeUrl: string;\n  private iframeOrigin: string;\n  private frameId: string;\n  private messageHandlers = new Map<string, (response: PostMessageResponse) => void>();\n  private messageListener: ((event: MessageEvent) => void) | null = null;\n  private readyPromise: Promise<void> | null = null;\n  private displayMode: 'modal' | 'inline' = 'modal';\n  private inlineContainer: HTMLElement | null = null;\n  private visible = false;\n\n  /**\n   * Callback for event broadcasts from iframe (no request id)\n   */\n  public onEvent?: (eventType: string, payload: any) => void;\n\n  constructor(iframeUrl: string) {\n    // Validate origin before accepting the URL\n    validateIframeOrigin(iframeUrl);\n\n    this.iframeUrl = iframeUrl;\n    this.iframeOrigin = new URL(iframeUrl).origin;\n    /* Used to correlate postMessage traffic with the correct iframe instance.\n       Important in dev (React Strict Mode) where iframes can be created twice. */\n    this.frameId = createRequestId('frame');\n  }\n\n  private getIframeSrc(): string {\n    const url = new URL(this.iframeUrl);\n    url.searchParams.set('tn_frame_id', this.frameId);\n    return url.toString();\n  }\n\n  /**\n   * Create and inject iframe into DOM\n   * Returns a promise that resolves when iframe is ready\n   */\n  async createIframe(): Promise<void> {\n    if (this.readyPromise) {\n      return this.readyPromise;\n    }\n\n    this.readyPromise = (async () => {\n      if (!this.iframe) {\n        this.iframe = document.createElement('iframe');\n        this.iframe.src = this.getIframeSrc();\n        /* Allow WebAuthn in cross-origin iframe for passkey auth. */\n        this.iframe.allow = 'publickey-credentials-get; publickey-credentials-create';\n        this.applyIframeStyles();\n        /* Keep hidden (but still load) until the wallet asks to show UI. */\n        this.setVisibility(false);\n\n        if (this.displayMode === 'inline' && this.inlineContainer) {\n          this.inlineContainer.appendChild(this.iframe);\n        } else {\n          document.body.appendChild(this.iframe);\n        }\n\n        // Set up message listener\n        this.messageListener = this.handleMessage.bind(this);\n        window.addEventListener('message', this.messageListener);\n      }\n\n      await this.waitForReady();\n    })().catch((error) => {\n      this.readyPromise = null;\n      throw error;\n    });\n\n    return this.readyPromise;\n  }\n\n  /**\n   * Wait for iframe to send 'ready' signal\n   */\n  private waitForReady(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      let resolved = false;\n      let readyHandler: (event: MessageEvent) => void;\n      const cleanup = () => {\n        if (resolved) {\n          return;\n        }\n        resolved = true;\n        window.removeEventListener('message', readyHandler);\n        clearTimeout(timeout);\n      };\n\n      const timeout = setTimeout(() => {\n        cleanup();\n        reject(new Error('Iframe ready timeout - wallet failed to load'));\n      }, 10000);\n\n      readyHandler = (event: MessageEvent) => {\n        if (!this.isMessageFromIframe(event)) {\n          return;\n        }\n\n        if (event.data?.type === IFRAME_READY_EVENT) {\n          cleanup();\n          resolve();\n        }\n      };\n\n      window.addEventListener('message', readyHandler);\n    });\n  }\n\n  /**\n   * Mount iframe inline inside the provided container.\n   */\n  async mountInline(container: HTMLElement): Promise<void> {\n    this.inlineContainer = container;\n    this.displayMode = 'inline';\n    await this.createIframe();\n    this.showInline();\n  }\n\n  /**\n   * Show iframe inline (embedded in container).\n   */\n  showInline(): void {\n    if (!this.iframe) {\n      return;\n    }\n    this.displayMode = 'inline';\n    if (this.inlineContainer && this.iframe.parentElement !== this.inlineContainer) {\n      this.inlineContainer.appendChild(this.iframe);\n    }\n    this.applyIframeStyles();\n    this.setVisibility(true);\n  }\n\n  /**\n   * Show iframe as a full-screen modal.\n   */\n  showModal(): void {\n    if (!this.iframe) {\n      return;\n    }\n    this.displayMode = 'modal';\n    if (this.iframe.parentElement !== document.body) {\n      document.body.appendChild(this.iframe);\n    }\n    this.applyIframeStyles();\n    this.setVisibility(true);\n  }\n\n  /**\n   * Show iframe modal\n   */\n  show(): void {\n    this.showModal();\n  }\n\n  /**\n   * Hide iframe modal\n   */\n  hide(): void {\n    this.setVisibility(false);\n  }\n\n  isInline(): boolean {\n    return this.displayMode === 'inline';\n  }\n\n  private applyIframeStyles(): void {\n    if (!this.iframe) {\n      return;\n    }\n\n    if (this.displayMode === 'inline') {\n      this.iframe.style.cssText = `\n        position: relative;\n        width: 100%;\n        height: 100%;\n        border: none;\n        z-index: 1;\n        display: block;\n        background: transparent;\n      `;\n      return;\n    }\n\n    this.iframe.style.cssText = `\n      position: fixed;\n      top: 0;\n      left: 0;\n      width: 100%;\n      height: 100%;\n      border: none;\n      z-index: 999999;\n      display: block;\n      background: rgba(0, 0, 0, 0.5);\n    `;\n  }\n\n  private setVisibility(visible: boolean): void {\n    if (!this.iframe) {\n      return;\n    }\n    this.visible = visible;\n    this.iframe.style.opacity = visible ? '1' : '0';\n    this.iframe.style.pointerEvents = visible ? 'auto' : 'none';\n    this.iframe.style.visibility = visible ? 'visible' : 'hidden';\n  }\n\n  /**\n   * Send message to iframe and wait for response\n   */\n  async sendMessage<TRequest extends PostMessageRequest>(\n    request: TRequest\n  ): Promise<InferSuccessfulPostMessageResponse<TRequest>> {\n    /* Ensure the iframe has navigated to the wallet origin before we try to\n       postMessage to a strict targetOrigin. Otherwise the iframe can still be\n       about:blank (same-origin with the dapp) and postMessage will throw. */\n    if (this.readyPromise) {\n      await this.readyPromise;\n    } else {\n      await this.createIframe();\n    }\n\n    if (!this.iframe?.contentWindow) {\n      throw new Error('Iframe not initialized - call createIframe() first');\n    }\n\n    return new Promise<InferSuccessfulPostMessageResponse<TRequest>>((resolve, reject) => {\n      /* CONNECT/SIGN_* requests require a human click and can take minutes.\n         Keep a longer timeout to avoid breaking \"inline connect button\" flows. */\n      const timeoutMs =\n        request.type === POST_MESSAGE_REQUEST_TYPES.CONNECT ||\n        request.type === POST_MESSAGE_REQUEST_TYPES.SIGN_MESSAGE ||\n        request.type === POST_MESSAGE_REQUEST_TYPES.SIGN_TRANSACTION\n          ? 5 * 60 * 1000 /* 5 minutes */\n          : 30 * 1000; /* 30 seconds */\n\n      const timeout = setTimeout(() => {\n        this.messageHandlers.delete(request.id);\n        reject(new Error('Request timeout - wallet did not respond'));\n      }, timeoutMs);\n\n      // Store handler for this request\n      this.messageHandlers.set(request.id, (response: PostMessageResponse) => {\n        clearTimeout(timeout);\n        this.messageHandlers.delete(request.id);\n\n        if (response.success) {\n          resolve(response as InferSuccessfulPostMessageResponse<TRequest>);\n        } else {\n          const error = new Error(response.error?.message || 'Unknown error');\n          (error as any).code = response.error?.code;\n          reject(error);\n        }\n      });\n\n      // Send message to iframe\n      this.iframe!.contentWindow!.postMessage(request, this.iframeOrigin);\n    });\n  }\n\n  /**\n   * Handle incoming messages from iframe\n   */\n  private handleMessage(event: MessageEvent): void {\n    if (!this.isMessageFromIframe(event)) {\n      return; // Ignore messages from other origins\n    }\n\n    const data = event.data;\n\n    // Handle response to a specific request (has id)\n    if (data.id && this.messageHandlers.has(data.id)) {\n      const handler = this.messageHandlers.get(data.id);\n      if (handler) {\n        handler(data as PostMessageResponse);\n      }\n      return;\n    }\n\n    // Handle event broadcasts (type === 'event')\n    if (data.type === POST_MESSAGE_EVENT_TYPE) {\n      this.handleEvent(data as PostMessageEvent);\n    }\n  }\n\n  /**\n   * Handle event broadcasts from iframe\n   */\n  private handleEvent(data: PostMessageEvent): void {\n    // Forward to EmbeddedProvider via callback\n    if (this.onEvent) {\n      this.onEvent(data.event, data.data);\n    }\n  }\n\n  private isMessageFromIframe(event: MessageEvent): boolean {\n    if (event.origin !== this.iframeOrigin) {\n      return false;\n    }\n\n    const data = event.data as any;\n    if (!data || data.frameId !== this.frameId) {\n      return false;\n    }\n\n    /* Some browsers (notably Safari) can provide a null `event.source` for\n       cross-origin postMessage events. Frame id + origin is sufficient. */\n    if (!event.source) {\n      return true;\n    }\n\n    if (this.iframe?.contentWindow && event.source !== this.iframe.contentWindow) {\n      return false;\n    }\n\n    return true;\n  }\n\n  /**\n   * Destroy iframe and cleanup\n   */\n  destroy(): void {\n    if (this.iframe) {\n      this.iframe.remove();\n      this.iframe = null;\n    }\n\n    this.readyPromise = null;\n\n    if (this.messageListener) {\n      window.removeEventListener('message', this.messageListener);\n      this.messageListener = null;\n    }\n\n    this.messageHandlers.clear();\n  }\n}\n","import type {\n  AddressType as AddressTypeValue,\n  ConnectResult,\n  IThruChain,\n  WalletAccount,\n} from '@thru/chain-interfaces';\nimport { AddressType } from '@thru/chain-interfaces';\nimport {\n  DEFAULT_IFRAME_URL,\n  EMBEDDED_PROVIDER_EVENTS,\n  POST_MESSAGE_REQUEST_TYPES,\n  createRequestId,\n  type ConnectMetadataInput,\n  type ConnectRequestPayload,\n  type SelectAccountPayload\n} from '@thru/protocol';\nimport { IframeManager } from './IframeManager';\nimport { EmbeddedThruChain } from './chains/ThruChain';\n\nexport interface EmbeddedProviderConfig {\n  iframeUrl?: string;\n  addressTypes?: AddressTypeValue[];\n}\n\nexport interface ConnectOptions {\n  metadata?: ConnectMetadataInput;\n}\n\n/**\n * Main embedded provider class\n * Manages iframe lifecycle, connection state, and chain-specific interfaces\n */\nexport class EmbeddedProvider {\n  private iframeManager: IframeManager;\n  private _thruChain?: IThruChain;\n  private connected = false;\n  private accounts: WalletAccount[] = [];\n  private selectedAccount: WalletAccount | null = null;\n  private eventListeners = new Map<string, Set<Function>>();\n  private inlineMode = false;\n  constructor(config: EmbeddedProviderConfig) {\n    const iframeUrl = config.iframeUrl || DEFAULT_IFRAME_URL;\n    this.iframeManager = new IframeManager(iframeUrl);\n\n    // Set up event forwarding from iframe\n    this.iframeManager.onEvent = (eventType: string, payload: any) => {\n      this.emit(eventType, payload);\n\n      if (eventType === EMBEDDED_PROVIDER_EVENTS.UI_SHOW) {\n        if (this.inlineMode) {\n          this.iframeManager.showInline();\n        } else {\n          this.iframeManager.showModal();\n        }\n        return;\n      }\n\n      if (\n        eventType === EMBEDDED_PROVIDER_EVENTS.DISCONNECT ||\n        eventType === EMBEDDED_PROVIDER_EVENTS.LOCK\n      ) {\n        this.connected = false;\n        this.accounts = [];\n        this.selectedAccount = null;\n        return;\n      }\n\n      if (eventType === EMBEDDED_PROVIDER_EVENTS.ACCOUNT_CHANGED) {\n        const account = (payload && (payload.account as WalletAccount | undefined)) || null;\n        this.refreshAccountCache(account ?? null);\n      }\n    };\n\n    // Create chain instances\n    const addressTypes = config.addressTypes || [AddressType.THRU];\n    if (addressTypes.includes(AddressType.THRU)) {\n      this._thruChain = new EmbeddedThruChain(this.iframeManager, this);\n    }\n  }\n\n  /**\n   * Initialize the provider (must be called before use)\n   * Creates iframe and waits for it to be ready\n   */\n  async initialize(): Promise<void> {\n    await this.iframeManager.createIframe();\n  }\n\n  /**\n   * Mount the wallet iframe inline in a container (for inline connect button).\n   */\n  async mountInline(container: HTMLElement): Promise<void> {\n    this.inlineMode = true;\n    await this.iframeManager.mountInline(container);\n  }\n\n  /**\n   * Connect to wallet\n   * Shows iframe modal and requests connection\n   */\n  async connect(options?: ConnectOptions): Promise<ConnectResult> {\n    // Emit connecting event\n    this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_START, {});\n\n    try {\n      if (this.inlineMode) {\n        this.iframeManager.showInline();\n      } else {\n        this.iframeManager.showModal();\n      }\n\n      const payload: ConnectRequestPayload = {};\n\n      if (options?.metadata) {\n        payload.metadata = options.metadata;\n      }\n\n      const response = await this.iframeManager.sendMessage({\n        id: createRequestId(),\n        type: POST_MESSAGE_REQUEST_TYPES.CONNECT,\n        payload,\n        origin: window.location.origin,\n      });\n\n      this.connected = true;\n      this.accounts = response.result.accounts;\n      this.selectedAccount = response.result.accounts[0] ?? null;\n\n      // Emit success event\n      this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT, response.result);\n\n      // Hide iframe after successful connection\n      if (!this.inlineMode) {\n        this.iframeManager.hide();\n      }\n\n      return response.result;\n    } catch (error) {\n      if (!this.inlineMode) {\n        this.iframeManager.hide();\n      }\n      this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_ERROR, { error });\n      throw error;\n    }\n  }\n\n  /**\n   * Disconnect from wallet\n   */\n  async disconnect(): Promise<void> {\n    try {\n      await this.iframeManager.sendMessage({\n        id: createRequestId(),\n        type: POST_MESSAGE_REQUEST_TYPES.DISCONNECT,\n        origin: window.location.origin,\n      });\n\n      this.emit(EMBEDDED_PROVIDER_EVENTS.DISCONNECT, {});\n    } catch (error) {\n      this.emit(EMBEDDED_PROVIDER_EVENTS.ERROR, { error });\n      throw error;\n    } finally {\n      this.connected = false;\n      this.accounts = [];\n      this.selectedAccount = null;\n      if (!this.inlineMode) {\n        this.iframeManager.hide();\n      }\n    }\n  }\n\n  /**\n   * Check if connected\n   */\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  /**\n   * Get accounts\n   */\n  getAccounts(): WalletAccount[] {\n    return this.accounts;\n  }\n\n  getSelectedAccount(): WalletAccount | null {\n    return this.selectedAccount;\n  }\n\n  async selectAccount(publicKey: string): Promise<WalletAccount> {\n    if (!this.connected) {\n      throw new Error('Wallet not connected');\n    }\n\n    const knownAccount = this.accounts.find(acc => acc.address === publicKey) ?? null;\n    if (!knownAccount) {\n      console.warn('[EmbeddedProvider] Selecting account not present in local cache');\n    }\n    const payload: SelectAccountPayload = { publicKey };\n\n    const response = await this.iframeManager.sendMessage({\n      id: createRequestId(),\n      type: POST_MESSAGE_REQUEST_TYPES.SELECT_ACCOUNT,\n      payload,\n      origin: window.location.origin,\n    });\n\n    const account = response.result.account;\n\n    this.refreshAccountCache(account);\n    return account;\n  }\n\n  /**\n   * Get Thru chain API\n   */\n  get thru(): IThruChain {\n    if (!this._thruChain) {\n      throw new Error('Thru chain not enabled in provider config');\n    }\n    return this._thruChain;\n  }\n\n  /**\n   * Event emitter: on\n   */\n  on(event: string, callback: Function): void {\n    if (!this.eventListeners.has(event)) {\n      this.eventListeners.set(event, new Set());\n    }\n    this.eventListeners.get(event)!.add(callback);\n  }\n\n  /**\n   * Event emitter: off\n   */\n  off(event: string, callback: Function): void {\n    this.eventListeners.get(event)?.delete(callback);\n  }\n\n  /**\n   * Emit event to all listeners\n   */\n  private emit(event: string, data?: any): void {\n    this.eventListeners.get(event)?.forEach(callback => {\n      try {\n        callback(data);\n      } catch (error) {\n        console.error(`Error in event listener for ${event}:`, error);\n      }\n    });\n  }\n\n  /**\n   * Get iframe manager (for chain implementations)\n   * @internal\n   */\n  getIframeManager(): IframeManager {\n    return this.iframeManager;\n  }\n\n  /**\n   * Destroy provider and cleanup\n   */\n  destroy(): void {\n    this.iframeManager.destroy();\n    this.eventListeners.clear();\n    this.connected = false;\n    this.accounts = [];\n    this.selectedAccount = null;\n  }\n\n  private refreshAccountCache(account: WalletAccount | null): void {\n    if (!account) {\n      this.selectedAccount = null;\n      return;\n    }\n\n    const existingIdx = this.accounts.findIndex(acc => acc.address === account.address);\n    if (existingIdx >= 0) {\n      this.accounts[existingIdx] = account;\n    } else {\n      this.accounts = [...this.accounts, account];\n    }\n    this.selectedAccount = account;\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thru/embedded-provider",
-  "version": "0.2.0",
+  "version": "0.2.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -11,8 +11,8 @@
     }
   },
   "dependencies": {
-    "@thru/chain-interfaces": "0.2.0",
-    "@thru/protocol": "0.2.0"
+    "@thru/chain-interfaces": "0.2.3",
+    "@thru/protocol": "0.2.3"
   },
   "devDependencies": {
     "@types/node": "^24.7.0"

package/src/EmbeddedProvider.ts

@@ -37,6 +37,7 @@ export class EmbeddedProvider {
   private accounts: WalletAccount[] = [];
   private selectedAccount: WalletAccount | null = null;
   private eventListeners = new Map<string, Set<Function>>();
+  private inlineMode = false;
   constructor(config: EmbeddedProviderConfig) {
     const iframeUrl = config.iframeUrl || DEFAULT_IFRAME_URL;
     this.iframeManager = new IframeManager(iframeUrl);
@@ -45,6 +46,15 @@ export class EmbeddedProvider {
     this.iframeManager.onEvent = (eventType: string, payload: any) => {
       this.emit(eventType, payload);
 
+      if (eventType === EMBEDDED_PROVIDER_EVENTS.UI_SHOW) {
+        if (this.inlineMode) {
+          this.iframeManager.showInline();
+        } else {
+          this.iframeManager.showModal();
+        }
+        return;
+      }
+
       if (
         eventType === EMBEDDED_PROVIDER_EVENTS.DISCONNECT ||
         eventType === EMBEDDED_PROVIDER_EVENTS.LOCK
@@ -76,6 +86,14 @@ export class EmbeddedProvider {
     await this.iframeManager.createIframe();
   }
 
+  /**
+   * Mount the wallet iframe inline in a container (for inline connect button).
+   */
+  async mountInline(container: HTMLElement): Promise<void> {
+    this.inlineMode = true;
+    await this.iframeManager.mountInline(container);
+  }
+
   /**
    * Connect to wallet
    * Shows iframe modal and requests connection
@@ -84,10 +102,13 @@ export class EmbeddedProvider {
     // Emit connecting event
     this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_START, {});
 
-    // Show iframe modal
-    this.iframeManager.show();
-
     try {
+      if (this.inlineMode) {
+        this.iframeManager.showInline();
+      } else {
+        this.iframeManager.showModal();
+      }
+
       const payload: ConnectRequestPayload = {};
 
       if (options?.metadata) {
@@ -109,11 +130,15 @@ export class EmbeddedProvider {
       this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT, response.result);
 
       // Hide iframe after successful connection
-      this.iframeManager.hide();
+      if (!this.inlineMode) {
+        this.iframeManager.hide();
+      }
 
       return response.result;
     } catch (error) {
-      this.iframeManager.hide();
+      if (!this.inlineMode) {
+        this.iframeManager.hide();
+      }
       this.emit(EMBEDDED_PROVIDER_EVENTS.CONNECT_ERROR, { error });
       throw error;
     }
@@ -130,14 +155,17 @@ export class EmbeddedProvider {
         origin: window.location.origin,
       });
 
-      this.connected = false;
-      this.accounts = [];
-      this.iframeManager.hide();
-
       this.emit(EMBEDDED_PROVIDER_EVENTS.DISCONNECT, {});
     } catch (error) {
       this.emit(EMBEDDED_PROVIDER_EVENTS.ERROR, { error });
       throw error;
+    } finally {
+      this.connected = false;
+      this.accounts = [];
+      this.selectedAccount = null;
+      if (!this.inlineMode) {
+        this.iframeManager.hide();
+      }
     }
   }
 

package/src/IframeManager.ts

@@ -4,7 +4,12 @@ import type {
   PostMessageRequest,
   PostMessageResponse,
 } from './types/messages';
-import { IFRAME_READY_EVENT, POST_MESSAGE_EVENT_TYPE } from './types/messages';
+import {
+  IFRAME_READY_EVENT,
+  POST_MESSAGE_EVENT_TYPE,
+  POST_MESSAGE_REQUEST_TYPES,
+  createRequestId,
+} from './types/messages';
 
 /**
  * Allowed origins for wallet iframe URLs
@@ -12,6 +17,7 @@ import { IFRAME_READY_EVENT, POST_MESSAGE_EVENT_TYPE } from './types/messages';
  */
 const ALLOWED_IFRAME_ORIGINS = [
   'https://thru-wallet.up.railway.app',
+  'https://wallet.thru.io',
   'https://wallet.thru.org',
   // Allow localhost for development (any port)
   'http://localhost',
@@ -60,9 +66,13 @@ export class IframeManager {
   private iframe: HTMLIFrameElement | null = null;
   private iframeUrl: string;
   private iframeOrigin: string;
+  private frameId: string;
   private messageHandlers = new Map<string, (response: PostMessageResponse) => void>();
   private messageListener: ((event: MessageEvent) => void) | null = null;
   private readyPromise: Promise<void> | null = null;
+  private displayMode: 'modal' | 'inline' = 'modal';
+  private inlineContainer: HTMLElement | null = null;
+  private visible = false;
 
   /**
    * Callback for event broadcasts from iframe (no request id)
@@ -75,6 +85,15 @@ export class IframeManager {
 
     this.iframeUrl = iframeUrl;
     this.iframeOrigin = new URL(iframeUrl).origin;
+    /* Used to correlate postMessage traffic with the correct iframe instance.
+       Important in dev (React Strict Mode) where iframes can be created twice. */
+    this.frameId = createRequestId('frame');
+  }
+
+  private getIframeSrc(): string {
+    const url = new URL(this.iframeUrl);
+    url.searchParams.set('tn_frame_id', this.frameId);
+    return url.toString();
   }
 
   /**
@@ -89,29 +108,29 @@ export class IframeManager {
     this.readyPromise = (async () => {
       if (!this.iframe) {
         this.iframe = document.createElement('iframe');
-        this.iframe.src = this.iframeUrl;
-        this.iframe.style.cssText = `
-          position: fixed;
-          top: 0;
-          left: 0;
-          width: 100%;
-          height: 100%;
-          border: none;
-          z-index: 999999;
-          display: none;
-          background: rgba(0, 0, 0, 0.5);
-        `;
-
-        document.body.appendChild(this.iframe);
+        this.iframe.src = this.getIframeSrc();
+        /* Allow WebAuthn in cross-origin iframe for passkey auth. */
+        this.iframe.allow = 'publickey-credentials-get; publickey-credentials-create';
+        this.applyIframeStyles();
+        /* Keep hidden (but still load) until the wallet asks to show UI. */
+        this.setVisibility(false);
+
+        if (this.displayMode === 'inline' && this.inlineContainer) {
+          this.inlineContainer.appendChild(this.iframe);
+        } else {
+          document.body.appendChild(this.iframe);
+        }
 
         // Set up message listener
         this.messageListener = this.handleMessage.bind(this);
         window.addEventListener('message', this.messageListener);
       }
 
-      // Wait for iframe ready signal
       await this.waitForReady();
-    })();
+    })().catch((error) => {
+      this.readyPromise = null;
+      throw error;
+    });
 
     return this.readyPromise;
   }
@@ -121,18 +140,29 @@ export class IframeManager {
    */
   private waitForReady(): Promise<void> {
     return new Promise((resolve, reject) => {
+      let resolved = false;
+      let readyHandler: (event: MessageEvent) => void;
+      const cleanup = () => {
+        if (resolved) {
+          return;
+        }
+        resolved = true;
+        window.removeEventListener('message', readyHandler);
+        clearTimeout(timeout);
+      };
+
       const timeout = setTimeout(() => {
+        cleanup();
         reject(new Error('Iframe ready timeout - wallet failed to load'));
-      }, 10000); // 10 second timeout
+      }, 10000);
 
-      const readyHandler = (event: MessageEvent) => {
-        if (event.origin !== this.iframeOrigin) {
+      readyHandler = (event: MessageEvent) => {
+        if (!this.isMessageFromIframe(event)) {
           return;
         }
 
-        if (event.data.type === IFRAME_READY_EVENT) {
-          clearTimeout(timeout);
-          window.removeEventListener('message', readyHandler);
+        if (event.data?.type === IFRAME_READY_EVENT) {
+          cleanup();
           resolve();
         }
       };
@@ -141,22 +171,103 @@ export class IframeManager {
     });
   }
 
+  /**
+   * Mount iframe inline inside the provided container.
+   */
+  async mountInline(container: HTMLElement): Promise<void> {
+    this.inlineContainer = container;
+    this.displayMode = 'inline';
+    await this.createIframe();
+    this.showInline();
+  }
+
+  /**
+   * Show iframe inline (embedded in container).
+   */
+  showInline(): void {
+    if (!this.iframe) {
+      return;
+    }
+    this.displayMode = 'inline';
+    if (this.inlineContainer && this.iframe.parentElement !== this.inlineContainer) {
+      this.inlineContainer.appendChild(this.iframe);
+    }
+    this.applyIframeStyles();
+    this.setVisibility(true);
+  }
+
+  /**
+   * Show iframe as a full-screen modal.
+   */
+  showModal(): void {
+    if (!this.iframe) {
+      return;
+    }
+    this.displayMode = 'modal';
+    if (this.iframe.parentElement !== document.body) {
+      document.body.appendChild(this.iframe);
+    }
+    this.applyIframeStyles();
+    this.setVisibility(true);
+  }
+
   /**
    * Show iframe modal
    */
   show(): void {
-    if (this.iframe) {
-      this.iframe.style.display = 'block';
-    }
+    this.showModal();
   }
 
   /**
    * Hide iframe modal
    */
   hide(): void {
-    if (this.iframe) {
-      this.iframe.style.display = 'none';
+    this.setVisibility(false);
+  }
+
+  isInline(): boolean {
+    return this.displayMode === 'inline';
+  }
+
+  private applyIframeStyles(): void {
+    if (!this.iframe) {
+      return;
+    }
+
+    if (this.displayMode === 'inline') {
+      this.iframe.style.cssText = `
+        position: relative;
+        width: 100%;
+        height: 100%;
+        border: none;
+        z-index: 1;
+        display: block;
+        background: transparent;
+      `;
+      return;
+    }
+
+    this.iframe.style.cssText = `
+      position: fixed;
+      top: 0;
+      left: 0;
+      width: 100%;
+      height: 100%;
+      border: none;
+      z-index: 999999;
+      display: block;
+      background: rgba(0, 0, 0, 0.5);
+    `;
+  }
+
+  private setVisibility(visible: boolean): void {
+    if (!this.iframe) {
+      return;
     }
+    this.visible = visible;
+    this.iframe.style.opacity = visible ? '1' : '0';
+    this.iframe.style.pointerEvents = visible ? 'auto' : 'none';
+    this.iframe.style.visibility = visible ? 'visible' : 'hidden';
   }
 
   /**
@@ -165,15 +276,33 @@ export class IframeManager {
   async sendMessage<TRequest extends PostMessageRequest>(
     request: TRequest
   ): Promise<InferSuccessfulPostMessageResponse<TRequest>> {
+    /* Ensure the iframe has navigated to the wallet origin before we try to
+       postMessage to a strict targetOrigin. Otherwise the iframe can still be
+       about:blank (same-origin with the dapp) and postMessage will throw. */
+    if (this.readyPromise) {
+      await this.readyPromise;
+    } else {
+      await this.createIframe();
+    }
+
     if (!this.iframe?.contentWindow) {
       throw new Error('Iframe not initialized - call createIframe() first');
     }
 
     return new Promise<InferSuccessfulPostMessageResponse<TRequest>>((resolve, reject) => {
+      /* CONNECT/SIGN_* requests require a human click and can take minutes.
+         Keep a longer timeout to avoid breaking "inline connect button" flows. */
+      const timeoutMs =
+        request.type === POST_MESSAGE_REQUEST_TYPES.CONNECT ||
+        request.type === POST_MESSAGE_REQUEST_TYPES.SIGN_MESSAGE ||
+        request.type === POST_MESSAGE_REQUEST_TYPES.SIGN_TRANSACTION
+          ? 5 * 60 * 1000 /* 5 minutes */
+          : 30 * 1000; /* 30 seconds */
+
       const timeout = setTimeout(() => {
         this.messageHandlers.delete(request.id);
         reject(new Error('Request timeout - wallet did not respond'));
-      }, 30000); // 30 second timeout
+      }, timeoutMs);
 
       // Store handler for this request
       this.messageHandlers.set(request.id, (response: PostMessageResponse) => {
@@ -198,9 +327,7 @@ export class IframeManager {
    * Handle incoming messages from iframe
    */
   private handleMessage(event: MessageEvent): void {
-    // Validate origin
-    const iframeOrigin = new URL(this.iframeUrl).origin;
-    if (event.origin !== iframeOrigin) {
+    if (!this.isMessageFromIframe(event)) {
       return; // Ignore messages from other origins
     }
 
@@ -231,6 +358,29 @@ export class IframeManager {
     }
   }
 
+  private isMessageFromIframe(event: MessageEvent): boolean {
+    if (event.origin !== this.iframeOrigin) {
+      return false;
+    }
+
+    const data = event.data as any;
+    if (!data || data.frameId !== this.frameId) {
+      return false;
+    }
+
+    /* Some browsers (notably Safari) can provide a null `event.source` for
+       cross-origin postMessage events. Frame id + origin is sufficient. */
+    if (!event.source) {
+      return true;
+    }
+
+    if (this.iframe?.contentWindow && event.source !== this.iframe.contentWindow) {
+      return false;
+    }
+
+    return true;
+  }
+
   /**
    * Destroy iframe and cleanup
    */