@vqh2602/mini-app-sdk 1.0.6 → 1.0.8

package/dist/transport/native-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-transport.d.ts","sourceRoot":"","sources":["../../src/transport/native-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAe,mBAAmB,EAAqD,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKjJ,wBAAgB,uBAAuB,IAAI,OAAO,CAMjD;AAED,qBAAa,qBAAsB,YAAW,UAAU;IACtD,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,SAAS,CAAmG;IACpH,OAAO,CAAC,SAAS,CAAoD;gBAEzD,MAAM,GAAE,eAAoB;IAOjC,OAAO,IAAI,aAAa;IAIxB,WAAW,IAAI,OAAO;IAI7B,OAAO,CAAC,sBAAsB;IAuD9B,OAAO,CAAC,oBAAoB;IAyBrB,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IA6ElG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,IAAI;IAQ5D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAUvD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI;CAe/C"}
+{"version":3,"file":"native-transport.d.ts","sourceRoot":"","sources":["../../src/transport/native-transport.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAe,mBAAmB,EAAqD,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKjJ,wBAAgB,uBAAuB,IAAI,OAAO,CAMjD;AAED,qBAAa,qBAAsB,YAAW,UAAU;IACtD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,GAAG,CAAY;gBAEX,MAAM,GAAE,eAAoB;IASjC,OAAO,IAAI,aAAa;IAIxB,WAAW,IAAI,OAAO;IAItB,cAAc,IAAI,MAAM;IAIxB,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IA2FlG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,IAAI;IAI5D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAIvD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI;IAOvC,OAAO,IAAI,IAAI;IAgBf,OAAO,IAAI,IAAI;CAGvB"}

package/dist/transport/native-transport.js

@@ -1,26 +1,29 @@
+import { BridgeHub, isForwardingShim } from './bridge-hub.js';
+import { bridgeTimeoutMs } from './timeout-policy.js';
 let requestSequence = 1;
-// A forwarding shim is not evidence that a native host is connected.
-const forwardingShims = new WeakSet();
+let transportSequence = 1;
 export function isNativeBridgeAvailable() {
     if (typeof window === 'undefined')
         return false;
     const win = window;
     const send = win.SuperAppBridge?.postMessage;
     return typeof win.FlutterBridge?.postMessage === 'function' ||
-        (typeof send === 'function' && !forwardingShims.has(send));
+        (typeof send === 'function' && !isForwardingShim(send));
 }
 export class NativeBridgeTransport {
-    installedBridges = new WeakSet();
+    transportId;
     appId;
     defaultTimeoutMs;
     debug;
-    callbacks = new Map();
-    listeners = new Map();
+    isDestroyed = false;
+    hub;
     constructor(config = {}) {
+        this.transportId = `native_trans_${Date.now()}_${transportSequence++}`;
         this.appId = config.appId || 'mini_app_default';
-        this.defaultTimeoutMs = config.timeoutMs ?? 10000;
+        this.defaultTimeoutMs = config.timeoutMs;
         this.debug = config.debug ?? false;
-        this.initNativeGlobalBridge();
+        this.hub = BridgeHub.getShared();
+        this.hub.installOnGlobalBridge();
     }
     getType() {
         return 'native';
@@ -28,94 +31,18 @@ export class NativeBridgeTransport {
     isConnected() {
         return isNativeBridgeAvailable();
     }
-    initNativeGlobalBridge() {
-        if (typeof window === 'undefined')
-            return;
-        const win = window;
-        if (!win.SuperAppBridge) {
-            // Keep the shared callback/listener contract used by the Flutter host and
-            // plain JS clients, even when this SDK is the first script to initialize.
-            win.SuperAppBridge = {};
-        }
-        const bridge = win.SuperAppBridge;
-        bridge._callbacks ||= {};
-        bridge._listeners ||= {};
-        if (!bridge.postMessage) {
-            bridge.postMessage = (msg) => {
-                win.FlutterBridge?.postMessage(typeof msg === 'string' ? msg : JSON.stringify(msg));
-            };
-            forwardingShims.add(bridge.postMessage);
-        }
-        if (!bridge.dispatchResponse) {
-            bridge.dispatchResponse = (res) => {
-                const callback = bridge._callbacks[res.id];
-                if (callback) {
-                    delete bridge._callbacks[res.id];
-                    callback(res);
-                }
-            };
-        }
-        if (!bridge.dispatchEvent) {
-            bridge.dispatchEvent = (evt) => {
-                for (const listener of [...(bridge._listeners[evt.event] || [])]) {
-                    try {
-                        listener(evt.payload);
-                    }
-                    catch (error) {
-                        console.error(error);
-                    }
-                }
-            };
-        }
-        bridge.addEventListener ||= (event, handler) => {
-            (bridge._listeners[event] ||= []).push(handler);
-        };
-        bridge.removeEventListener ||= (event, handler) => {
-            bridge._listeners[event] = (bridge._listeners[event] || []).filter(fn => fn !== handler);
-        };
-        // Install once per bridge object, rather than stacking new wrappers per call.
-        // Also reconnect if a host replaces the bridge after SDK initialization.
-        if (this.installedBridges.has(bridge))
-            return;
-        this.installedBridges.add(bridge);
-        const previousResponse = bridge.dispatchResponse;
-        bridge.dispatchResponse = (res) => {
-            this.handleNativeResponse(res);
-            previousResponse.call(bridge, res);
-        };
-        const previousEvent = bridge.dispatchEvent;
-        bridge.dispatchEvent = (evt) => {
-            this.emit(evt.event, evt.payload);
-            previousEvent.call(bridge, evt);
-        };
-    }
-    handleNativeResponse(res) {
-        if (!res || !res.id)
-            return;
-        if (this.debug) {
-            console.log(`[NativeBridgeTransport] Response received:`, res);
-        }
-        const pending = this.callbacks.get(res.id);
-        if (!pending)
-            return;
-        clearTimeout(pending.timer);
-        this.callbacks.delete(res.id);
-        if (typeof window !== 'undefined') {
-            const win = window;
-            if (win.SuperAppBridge?._callbacks) {
-                delete win.SuperAppBridge._callbacks[res.id];
-            }
-        }
-        if (res.success) {
-            pending.resolve(res.data);
-        }
-        else {
-            pending.reject(res.error || { code: 'UNKNOWN_ERROR', message: 'Operation failed without error payload' });
-        }
+    getTransportId() {
+        return this.transportId;
     }
     invoke(action, payload = {}, timeoutMs) {
+        if (this.isDestroyed) {
+            return Promise.reject({
+                code: 'TRANSPORT_DESTROYED',
+                message: 'NativeBridgeTransport has been destroyed and cannot invoke actions',
+            });
+        }
         const id = `sdk_req_${Date.now()}_${requestSequence++}`;
-        const timeout = timeoutMs ?? this.defaultTimeoutMs;
+        const timeout = bridgeTimeoutMs(action, timeoutMs ?? this.defaultTimeoutMs);
         const request = {
             id,
             action,
@@ -125,9 +52,9 @@ export class NativeBridgeTransport {
             timestamp: Date.now(),
         };
         return new Promise((resolve, reject) => {
-            this.initNativeGlobalBridge();
+            this.hub.installOnGlobalBridge();
             const timer = setTimeout(() => {
-                this.callbacks.delete(id);
+                this.hub.unregisterCallback(id);
                 if (typeof window !== 'undefined') {
                     const win = window;
                     if (win.SuperAppBridge?._callbacks) {
@@ -143,7 +70,14 @@ export class NativeBridgeTransport {
                 }
                 reject(timeoutError);
             }, timeout);
-            this.callbacks.set(id, { resolve, reject, timer });
+            this.hub.registerCallback(id, {
+                transportId: this.transportId,
+                action,
+                resolve,
+                reject,
+                timer,
+                createdAt: Date.now(),
+            });
             if (this.debug) {
                 console.log(`[NativeBridgeTransport] Invoking ${action}:`, request);
             }
@@ -153,7 +87,7 @@ export class NativeBridgeTransport {
                 if (win.SuperAppBridge) {
                     win.SuperAppBridge._callbacks = win.SuperAppBridge._callbacks || {};
                     win.SuperAppBridge._callbacks[id] = (res) => {
-                        this.handleNativeResponse(res);
+                        this.hub.dispatchResponse(res);
                     };
                 }
                 if (win.FlutterBridge?.postMessage) {
@@ -164,7 +98,7 @@ export class NativeBridgeTransport {
                 }
                 else {
                     clearTimeout(timer);
-                    this.callbacks.delete(id);
+                    this.hub.unregisterCallback(id);
                     if (win.SuperAppBridge?._callbacks) {
                         delete win.SuperAppBridge._callbacks[id];
                     }
@@ -176,7 +110,7 @@ export class NativeBridgeTransport {
             }
             else {
                 clearTimeout(timer);
-                this.callbacks.delete(id);
+                this.hub.unregisterCallback(id);
                 reject({
                     code: 'ENVIRONMENT_ERROR',
                     message: 'Cannot invoke native bridge in a non-browser environment',
@@ -185,36 +119,29 @@ export class NativeBridgeTransport {
         });
     }
     on(event, listener) {
-        if (!this.listeners.has(event)) {
-            this.listeners.set(event, new Set());
-        }
-        this.listeners.get(event).add(listener);
-        return () => this.off(event, listener);
+        return this.hub.addListener(this.transportId, event, listener);
     }
     off(event, listener) {
-        const set = this.listeners.get(event);
-        if (set) {
-            set.delete(listener);
-            if (set.size === 0) {
-                this.listeners.delete(event);
-            }
-        }
+        this.hub.removeListener(this.transportId, event, listener);
     }
     emit(event, payload) {
         if (this.debug) {
-            console.log(`[NativeBridgeTransport] Event received [${event}]:`, payload);
+            console.log(`[NativeBridgeTransport] Emitting event [${event}]:`, payload);
         }
-        const set = this.listeners.get(event);
-        if (set) {
-            set.forEach((listener) => {
-                try {
-                    listener(payload);
-                }
-                catch (err) {
-                    console.error(`[NativeBridgeTransport] Error in listener for event "${event}":`, err);
-                }
-            });
+        this.hub.dispatchEvent({ event, payload });
+    }
+    destroy() {
+        if (this.isDestroyed)
+            return;
+        this.isDestroyed = true;
+        this.hub.cancelPendingRequestsForTransport(this.transportId, 'ABORTED', 'NativeBridgeTransport was destroyed before request completed');
+        this.hub.removeListenersForTransport(this.transportId);
+        if (this.debug) {
+            console.log(`[NativeBridgeTransport] Transport ${this.transportId} destroyed.`);
         }
     }
+    dispose() {
+        this.destroy();
+    }
 }
 //# sourceMappingURL=native-transport.js.map

package/dist/transport/native-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"native-transport.js","sourceRoot":"","sources":["../../src/transport/native-transport.ts"],"names":[],"mappings":"AAGA,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,qEAAqE;AACrE,MAAM,eAAe,GAAG,IAAI,OAAO,EAAY,CAAC;AAChD,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,GAAG,GAAG,MAAuC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;IAC7C,OAAO,OAAO,GAAG,CAAC,aAAa,EAAE,WAAW,KAAK,UAAU;QACzD,CAAC,OAAO,IAAI,KAAK,UAAU,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,qBAAqB;IACxB,gBAAgB,GAAG,IAAI,OAAO,EAAU,CAAC;IACzC,KAAK,CAAS;IACd,gBAAgB,CAAS;IACzB,KAAK,CAAU;IACf,SAAS,GAAyF,IAAI,GAAG,EAAE,CAAC;IAC5G,SAAS,GAA0C,IAAI,GAAG,EAAE,CAAC;IAErE,YAAY,SAA0B,EAAE;QACtC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,kBAAkB,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;QACnC,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAEM,OAAO;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,WAAW;QAChB,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAEO,sBAAsB;QAC5B,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAC1C,MAAM,GAAG,GAAG,MAAuC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,0EAA0E;YAC1E,0EAA0E;YAC1E,GAAG,CAAC,cAAc,GAAG,EAAuD,CAAC;QAC/E,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;QAClC,MAAM,CAAC,UAAU,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,UAAU,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,WAAW,GAAG,CAAC,GAAQ,EAAE,EAAE;gBAChC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACtF,CAAC,CAAC;YACF,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC7B,MAAM,CAAC,gBAAgB,GAAG,CAAC,GAAmB,EAAE,EAAE;gBAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,EAAE,EAAE;gBAC7B,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBACjE,IAAI,CAAC;wBAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAAC,CAAC;gBACxE,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,gBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC7C,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC;QACF,MAAM,CAAC,mBAAmB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAChD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;QAC3F,CAAC,CAAC;QACF,8EAA8E;QAC9E,yEAAyE;QACzE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC9C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACjD,MAAM,CAAC,gBAAgB,GAAG,CAAC,GAAG,EAAE,EAAE;YAChC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC/B,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,GAAmB;QAC9C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QAC5B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE9B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,MAAuC,CAAC;YACpD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;gBACnC,OAAO,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAEM,MAAM,CAAU,MAAc,EAAE,UAA+B,EAAE,EAAE,SAAkB;QAC1F,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,IAAI,eAAe,EAAE,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAEnD,MAAM,OAAO,GAAkB;YAC7B,EAAE;YACF,MAAM;YACN,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;YAClF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAE9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;oBAClC,MAAM,GAAG,GAAG,MAAuC,CAAC;oBACpD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;wBACnC,OAAO,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;gBACD,MAAM,YAAY,GAAgB;oBAChC,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,gBAAgB,MAAM,qBAAqB,OAAO,IAAI;iBAChE,CAAC;gBACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CAAC,mCAAmC,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;gBACjF,CAAC;gBACD,MAAM,CAAC,YAAY,CAAC,CAAC;YACvB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAEnD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,MAAuC,CAAC;gBAEpD,gGAAgG;gBAChG,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;oBACvB,GAAG,CAAC,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;oBACpE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,GAAmB,EAAE,EAAE;wBAC1D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;oBACjC,CAAC,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;oBACnC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzD,CAAC;qBAAM,IAAI,uBAAuB,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,CAAC;oBACxE,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC1B,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;wBACnC,OAAO,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBACD,MAAM,CAAC;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,mEAAmE;qBAC9D,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1B,MAAM,CAAC;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,0DAA0D;iBACrD,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,EAAE,CAAC,KAAa,EAAE,QAA6B;QACpD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEM,GAAG,CAAC,KAAa,EAAE,QAA6B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAEM,IAAI,CAAC,KAAa,EAAE,OAAY;QACrC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACvB,IAAI,CAAC;oBACH,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,wDAAwD,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"native-transport.js","sourceRoot":"","sources":["../../src/transport/native-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAItD,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,GAAG,GAAG,MAAuC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;IAC7C,OAAO,OAAO,GAAG,CAAC,aAAa,EAAE,WAAW,KAAK,UAAU;QACzD,CAAC,OAAO,IAAI,KAAK,UAAU,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,OAAO,qBAAqB;IACxB,WAAW,CAAS;IACpB,KAAK,CAAS;IACd,gBAAgB,CAAU;IAC1B,KAAK,CAAU;IACf,WAAW,GAAG,KAAK,CAAC;IACpB,GAAG,CAAY;IAEvB,YAAY,SAA0B,EAAE;QACtC,IAAI,CAAC,WAAW,GAAG,gBAAgB,IAAI,CAAC,GAAG,EAAE,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,kBAAkB,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IACnC,CAAC;IAEM,OAAO;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEM,WAAW;QAChB,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAEM,cAAc;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEM,MAAM,CAAU,MAAc,EAAE,UAA+B,EAAE,EAAE,SAAkB;QAC1F,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC,MAAM,CAAC;gBACpB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,oEAAoE;aAC/D,CAAC,CAAC;QACpB,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,IAAI,eAAe,EAAE,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAkB;YAC7B,EAAE;YACF,MAAM;YACN,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;YAClF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YAEjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;oBAClC,MAAM,GAAG,GAAG,MAAuC,CAAC;oBACpD,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;wBACnC,OAAO,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;gBACD,MAAM,YAAY,GAAgB;oBAChC,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,gBAAgB,MAAM,qBAAqB,OAAO,IAAI;iBAChE,CAAC;gBACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CAAC,mCAAmC,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;gBACjF,CAAC;gBACD,MAAM,CAAC,YAAY,CAAC,CAAC;YACvB,CAAC,EAAE,OAAO,CAAC,CAAC;YAEZ,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,EAAE;gBAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,MAAuC,CAAC;gBAEpD,gGAAgG;gBAChG,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;oBACvB,GAAG,CAAC,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;oBACpE,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,GAAmB,EAAE,EAAE;wBAC1D,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;oBACjC,CAAC,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;oBACnC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzD,CAAC;qBAAM,IAAI,uBAAuB,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,CAAC;oBACxE,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;oBAChC,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;wBACnC,OAAO,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBAC3C,CAAC;oBACD,MAAM,CAAC;wBACL,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,mEAAmE;qBAC9D,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAChC,MAAM,CAAC;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,0DAA0D;iBACrD,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,EAAE,CAAC,KAAa,EAAE,QAA6B;QACpD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAEM,GAAG,CAAC,KAAa,EAAE,QAA6B;QACrD,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEM,IAAI,CAAC,KAAa,EAAE,OAAY;QACrC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEM,OAAO;QACZ,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,GAAG,CAAC,iCAAiC,CACxC,IAAI,CAAC,WAAW,EAChB,SAAS,EACT,8DAA8D,CAC/D,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,WAAW,aAAa,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEM,OAAO;QACZ,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;CACF"}

package/dist/transport/postmessage-transport.d.ts

@@ -2,19 +2,27 @@ import { ITransport } from './transport.interface.js';
 import { BridgeEventListener, TransportConfig, TransportType } from './types.js';
 export declare class PostMessageTransport implements ITransport {
     private appId;
-    private defaultTimeoutMs;
+    private defaultTimeoutMs?;
     private debug;
+    private trustedHostOrigin?;
     private callbacks;
     private listeners;
     private messageListener?;
     constructor(config?: TransportConfig);
     getType(): TransportType;
     isConnected(): boolean;
+    getTrustedHostOrigin(): string | undefined;
+    setTrustedHostOrigin(origin: string): void;
+    isValidHostOrigin(origin: string): boolean;
+    private resolveAutoDetectedHostOrigin;
+    getTargetOrigin(): string;
+    private initHandshake;
     private initMessageListener;
     invoke<T = any>(action: string, payload?: Record<string, any>, timeoutMs?: number): Promise<T>;
     on(event: string, listener: BridgeEventListener): () => void;
     off(event: string, listener: BridgeEventListener): void;
     emit(event: string, payload: any): void;
     destroy(): void;
+    dispose(): void;
 }
 //# sourceMappingURL=postmessage-transport.d.ts.map

package/dist/transport/postmessage-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postmessage-transport.d.ts","sourceRoot":"","sources":["../../src/transport/postmessage-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAe,mBAAmB,EAAiC,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI7H,qBAAa,oBAAqB,YAAW,UAAU;IACrD,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,SAAS,CAAmG;IACpH,OAAO,CAAC,SAAS,CAAoD;IACrE,OAAO,CAAC,eAAe,CAAC,CAAgC;gBAE5C,MAAM,GAAE,eAAoB;IAOjC,OAAO,IAAI,aAAa;IAIxB,WAAW,IAAI,OAAO;IAI7B,OAAO,CAAC,mBAAmB;IAkCpB,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IA4ClG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,IAAI;IAQ5D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAUvD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI;IAavC,OAAO,IAAI,IAAI;CAKvB"}
+{"version":3,"file":"postmessage-transport.d.ts","sourceRoot":"","sources":["../../src/transport/postmessage-transport.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAe,mBAAmB,EAAiC,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI7H,qBAAa,oBAAqB,YAAW,UAAU;IACrD,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,iBAAiB,CAAC,CAAS;IACnC,OAAO,CAAC,SAAS,CAUH;IACd,OAAO,CAAC,SAAS,CAAoD;IACrE,OAAO,CAAC,eAAe,CAAC,CAAgC;gBAE5C,MAAM,GAAE,eAAoB;IASjC,OAAO,IAAI,aAAa;IAIxB,WAAW,IAAI,OAAO;IAItB,oBAAoB,IAAI,MAAM,GAAG,SAAS;IAI1C,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAO1C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAsBjD,OAAO,CAAC,6BAA6B;IAkD9B,eAAe,IAAI,MAAM;IA0BhC,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,mBAAmB;IAuGpB,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAyDlG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,IAAI;IAQ5D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAUvD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI;IAavC,OAAO,IAAI,IAAI;IAiBf,OAAO,IAAI,IAAI;CAGvB"}

package/dist/transport/postmessage-transport.js

@@ -1,16 +1,20 @@
+import { bridgeTimeoutMs } from './timeout-policy.js';
 let requestSequence = 1;
 export class PostMessageTransport {
     appId;
     defaultTimeoutMs;
     debug;
+    trustedHostOrigin;
     callbacks = new Map();
     listeners = new Map();
     messageListener;
     constructor(config = {}) {
         this.appId = config.appId || 'mini_app_simulator';
-        this.defaultTimeoutMs = config.timeoutMs ?? 10000;
+        this.defaultTimeoutMs = config.timeoutMs;
         this.debug = config.debug ?? false;
+        this.trustedHostOrigin = config.trustedHostOrigin || this.resolveAutoDetectedHostOrigin();
         this.initMessageListener();
+        this.initHandshake();
     }
     getType() {
         return 'postmessage';
@@ -18,31 +22,206 @@ export class PostMessageTransport {
     isConnected() {
         return typeof window !== 'undefined' && window.parent !== window;
     }
+    getTrustedHostOrigin() {
+        return this.trustedHostOrigin;
+    }
+    setTrustedHostOrigin(origin) {
+        if (!this.isValidHostOrigin(origin) && origin !== '*') {
+            throw new Error(`[PostMessageTransport] Invalid host origin: "${origin}". Must be a valid HTTP localhost or HTTPS origin.`);
+        }
+        this.trustedHostOrigin = origin;
+    }
+    isValidHostOrigin(origin) {
+        if (!origin || typeof origin !== 'string')
+            return false;
+        try {
+            const url = new URL(origin);
+            if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+                return false;
+            }
+            // In development, localhost and 127.0.0.1 or local domains are allowed
+            if (url.hostname === 'localhost' ||
+                url.hostname === '127.0.0.1' ||
+                url.hostname.endsWith('.localhost')) {
+                return true;
+            }
+            // For remote hosts, HTTPS is required
+            return url.protocol === 'https:';
+        }
+        catch (_) {
+            return false;
+        }
+    }
+    resolveAutoDetectedHostOrigin() {
+        if (typeof window === 'undefined')
+            return undefined;
+        const win = window;
+        // 1. Explicit global injection by host container
+        if (win.__SUPERAPP_TRUSTED_HOST_ORIGIN__) {
+            return win.__SUPERAPP_TRUSTED_HOST_ORIGIN__;
+        }
+        if (win.__SUPERAPP_HOST_ORIGIN__) {
+            return win.__SUPERAPP_HOST_ORIGIN__;
+        }
+        // 2. Query param ?hostOrigin=... or ?trustedHostOrigin=...
+        try {
+            if (win.location?.search) {
+                const params = new URLSearchParams(win.location.search);
+                const fromParam = params.get('trustedHostOrigin') || params.get('hostOrigin');
+                if (fromParam) {
+                    const parsed = new URL(fromParam).origin;
+                    if (this.isValidHostOrigin(parsed)) {
+                        return parsed;
+                    }
+                }
+            }
+        }
+        catch (_) { }
+        // 3. window.location.ancestorOrigins (Chromium & WebKit)
+        try {
+            if (win.location?.ancestorOrigins && win.location.ancestorOrigins.length > 0) {
+                const ancestor = win.location.ancestorOrigins[0];
+                if (ancestor && ancestor !== 'null' && this.isValidHostOrigin(ancestor)) {
+                    return ancestor;
+                }
+            }
+        }
+        catch (_) { }
+        // 4. document.referrer
+        try {
+            if (typeof document !== 'undefined' && document.referrer) {
+                const referrerOrigin = new URL(document.referrer).origin;
+                if (referrerOrigin && referrerOrigin !== 'null' && this.isValidHostOrigin(referrerOrigin)) {
+                    return referrerOrigin;
+                }
+            }
+        }
+        catch (_) { }
+        return undefined;
+    }
+    getTargetOrigin() {
+        if (this.trustedHostOrigin && this.trustedHostOrigin !== '*') {
+            return this.trustedHostOrigin;
+        }
+        const detected = this.resolveAutoDetectedHostOrigin();
+        if (detected) {
+            this.trustedHostOrigin = detected;
+            return detected;
+        }
+        if (typeof window !== 'undefined' && window.location?.origin && window.location.origin !== 'null') {
+            try {
+                const url = new URL(window.location.origin);
+                if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
+                    return window.location.origin;
+                }
+            }
+            catch (_) { }
+        }
+        if (this.debug) {
+            console.warn('[PostMessageTransport] Warning: No trustedHostOrigin configured. Using fallback target origin.');
+        }
+        return '*';
+    }
+    initHandshake() {
+        if (typeof window === 'undefined' || !window.parent || window.parent === window)
+            return;
+        try {
+            const target = this.trustedHostOrigin || '*';
+            window.parent.postMessage({
+                type: 'SUPERAPP_BRIDGE_HANDSHAKE',
+                appId: this.appId,
+                clientOrigin: window.location?.origin,
+                timestamp: Date.now(),
+            }, target);
+        }
+        catch (_) { }
+    }
     initMessageListener() {
         if (typeof window === 'undefined')
             return;
         this.messageListener = (event) => {
+            // 1. Verify event source is parent window
+            if (typeof window !== 'undefined' && window.parent) {
+                if (event.source && event.source !== window.parent) {
+                    if (this.debug) {
+                        console.warn('[PostMessageTransport] Rejected message: event.source !== window.parent');
+                    }
+                    return;
+                }
+            }
+            // 2. Verify event origin against trustedHostOrigin
+            if (this.trustedHostOrigin && this.trustedHostOrigin !== '*') {
+                if (event.origin && event.origin !== this.trustedHostOrigin) {
+                    if (this.debug) {
+                        console.warn(`[PostMessageTransport] Rejected message from untrusted origin: "${event.origin}". Expected: "${this.trustedHostOrigin}"`);
+                    }
+                    return;
+                }
+            }
             const data = event.data;
             if (!data || typeof data !== 'object')
                 return;
+            // Handle handshake messages
+            if (data.type === 'SUPERAPP_SIMULATOR_HANDSHAKE' || data.type === 'SUPERAPP_SIMULATOR_HANDSHAKE_ACK') {
+                const hostOrigin = data.hostOrigin || event.origin;
+                if (hostOrigin && this.isValidHostOrigin(hostOrigin)) {
+                    if (!this.trustedHostOrigin) {
+                        this.trustedHostOrigin = hostOrigin;
+                        if (this.debug) {
+                            console.log(`[PostMessageTransport] Handshake established with host origin: ${this.trustedHostOrigin}`);
+                        }
+                    }
+                }
+                return;
+            }
             if (data.type === 'SUPERAPP_BRIDGE_RESPONSE') {
                 const res = data.response;
                 if (!res || !res.id)
                     return;
                 const pending = this.callbacks.get(res.id);
-                if (pending) {
-                    clearTimeout(pending.timer);
-                    this.callbacks.delete(res.id);
+                if (!pending) {
                     if (this.debug) {
-                        console.log(`[PostMessageTransport] Response received:`, res);
-                    }
-                    if (res.success) {
-                        pending.resolve(res.data);
+                        console.warn(`[PostMessageTransport] Response received for unknown or expired request: ${res.id}`);
                     }
-                    else {
-                        pending.reject(res.error || { code: 'UNKNOWN_ERROR', message: 'Request failed in simulator' });
+                    return;
+                }
+                // 3. Verify sessionNonce
+                if (pending.sessionNonce) {
+                    if (!res.sessionNonce || res.sessionNonce !== pending.sessionNonce) {
+                        const errorMsg = `Session nonce verification failed for request ${res.id}.`;
+                        console.error(`[PostMessageTransport] Security Violation: ${errorMsg}`);
+                        clearTimeout(pending.timer);
+                        this.callbacks.delete(res.id);
+                        pending.reject({
+                            code: 'SECURITY_ERROR',
+                            message: errorMsg,
+                        });
+                        return;
                     }
                 }
+                // 4. Verify action
+                if (res.action && pending.action && res.action !== pending.action) {
+                    const errorMsg = `Action mismatch for request ${res.id}: expected "${pending.action}", received "${res.action}".`;
+                    console.error(`[PostMessageTransport] Security Violation: ${errorMsg}`);
+                    clearTimeout(pending.timer);
+                    this.callbacks.delete(res.id);
+                    pending.reject({
+                        code: 'SECURITY_ERROR',
+                        message: errorMsg,
+                    });
+                    return;
+                }
+                clearTimeout(pending.timer);
+                this.callbacks.delete(res.id);
+                if (this.debug) {
+                    console.log(`[PostMessageTransport] Response received:`, res);
+                }
+                if (res.success) {
+                    pending.resolve(res.data);
+                }
+                else {
+                    pending.reject(res.error || { code: 'UNKNOWN_ERROR', message: 'Request failed in simulator' });
+                }
             }
             else if (data.type === 'SUPERAPP_BRIDGE_EVENT') {
                 if (data.event) {
@@ -54,14 +233,16 @@ export class PostMessageTransport {
     }
     invoke(action, payload = {}, timeoutMs) {
         const id = `req_${Date.now()}_${requestSequence++}`;
-        const timeout = timeoutMs ?? this.defaultTimeoutMs;
+        const sessionNonce = `nonce_${Date.now()}_${Math.random().toString(36).substring(2, 11)}_${requestSequence}`;
+        const timeout = bridgeTimeoutMs(action, timeoutMs ?? this.defaultTimeoutMs);
         const request = {
             id,
             action,
             payload,
             appId: this.appId,
-            origin: typeof window !== 'undefined' ? window.location.origin : 'miniapp://simulator',
+            origin: typeof window !== 'undefined' ? window.location?.origin : 'miniapp://simulator',
             timestamp: Date.now(),
+            sessionNonce,
         };
         return new Promise((resolve, reject) => {
             const timer = setTimeout(() => {
@@ -72,15 +253,23 @@ export class PostMessageTransport {
                 };
                 reject(timeoutError);
             }, timeout);
-            this.callbacks.set(id, { resolve, reject, timer });
+            this.callbacks.set(id, {
+                resolve,
+                reject,
+                timer,
+                action,
+                sessionNonce,
+                createdAt: Date.now(),
+            });
             if (typeof window !== 'undefined' && window.parent) {
                 if (this.debug) {
                     console.log(`[PostMessageTransport] PostMessage out to parent:`, request);
                 }
+                const targetOrigin = this.getTargetOrigin();
                 window.parent.postMessage({
                     type: 'SUPERAPP_BRIDGE_REQUEST',
                     request,
-                }, '*');
+                }, targetOrigin);
             }
             else {
                 clearTimeout(timer);
@@ -122,9 +311,22 @@ export class PostMessageTransport {
         }
     }
     destroy() {
+        for (const [id, pending] of this.callbacks.entries()) {
+            clearTimeout(pending.timer);
+            pending.reject({
+                code: 'ABORTED',
+                message: 'PostMessageTransport was destroyed',
+            });
+        }
+        this.callbacks.clear();
+        this.listeners.clear();
         if (typeof window !== 'undefined' && this.messageListener) {
             window.removeEventListener('message', this.messageListener);
+            this.messageListener = undefined;
         }
     }
+    dispose() {
+        this.destroy();
+    }
 }
 //# sourceMappingURL=postmessage-transport.js.map