@xrpl-wallet-kit/browser 0.1.12 → 0.1.13

package/dist/xrpl-wallet-kit.iife.js

@@ -1,4 +1,4 @@
-/*! @xrpl-wallet-kit/browser v0.1.12 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
+/*! @xrpl-wallet-kit/browser v0.1.13 | MIT | https://github.com/XRPDomains/xrpl-wallet-kit */
 var __defProp = Object.defineProperty;
 var __typeError = (msg) => {
   throw TypeError(msg);
@@ -1860,16 +1860,90 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
     WalletKitErrorCode2["UNSUPPORTED_METHOD"] = "UNSUPPORTED_METHOD";
     WalletKitErrorCode2["INVALID_ADAPTER"] = "INVALID_ADAPTER";
     WalletKitErrorCode2["NETWORK_MISMATCH"] = "NETWORK_MISMATCH";
+    WalletKitErrorCode2["NETWORK_NOT_SUPPORTED"] = "NETWORK_NOT_SUPPORTED";
     WalletKitErrorCode2["NOT_CONNECTED"] = "NOT_CONNECTED";
     WalletKitErrorCode2["ALREADY_CONNECTED"] = "ALREADY_CONNECTED";
     WalletKitErrorCode2["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
     return WalletKitErrorCode2;
   })(WalletKitErrorCode || {});
+  var WalletKitErrorCategory = /* @__PURE__ */ ((WalletKitErrorCategory2) => {
+    WalletKitErrorCategory2["WALLET_UNAVAILABLE"] = "WALLET_UNAVAILABLE";
+    WalletKitErrorCategory2["USER_ACTION"] = "USER_ACTION";
+    WalletKitErrorCategory2["NETWORK"] = "NETWORK";
+    WalletKitErrorCategory2["INVALID_INPUT"] = "INVALID_INPUT";
+    WalletKitErrorCategory2["TIMEOUT"] = "TIMEOUT";
+    WalletKitErrorCategory2["INTERNAL"] = "INTERNAL";
+    return WalletKitErrorCategory2;
+  })(WalletKitErrorCategory || {});
+  const WALLET_KIT_ERROR_CATEGORY_BY_CODE = {
+    [
+      "WALLET_NOT_FOUND"
+      /* WALLET_NOT_FOUND */
+    ]: "WALLET_UNAVAILABLE",
+    [
+      "WALLET_NOT_INSTALLED"
+      /* WALLET_NOT_INSTALLED */
+    ]: "WALLET_UNAVAILABLE",
+    [
+      "WALLET_NOT_AVAILABLE"
+      /* WALLET_NOT_AVAILABLE */
+    ]: "WALLET_UNAVAILABLE",
+    [
+      "CONNECTION_FAILED"
+      /* CONNECTION_FAILED */
+    ]: "INTERNAL",
+    [
+      "CONNECTION_REJECTED"
+      /* CONNECTION_REJECTED */
+    ]: "USER_ACTION",
+    [
+      "SIGN_FAILED"
+      /* SIGN_FAILED */
+    ]: "INTERNAL",
+    [
+      "SIGN_REJECTED"
+      /* SIGN_REJECTED */
+    ]: "USER_ACTION",
+    [
+      "REQUEST_TIMEOUT"
+      /* REQUEST_TIMEOUT */
+    ]: "TIMEOUT",
+    [
+      "UNSUPPORTED_METHOD"
+      /* UNSUPPORTED_METHOD */
+    ]: "INVALID_INPUT",
+    [
+      "INVALID_ADAPTER"
+      /* INVALID_ADAPTER */
+    ]: "INVALID_INPUT",
+    [
+      "NETWORK_MISMATCH"
+      /* NETWORK_MISMATCH */
+    ]: "NETWORK",
+    [
+      "NETWORK_NOT_SUPPORTED"
+      /* NETWORK_NOT_SUPPORTED */
+    ]: "NETWORK",
+    [
+      "NOT_CONNECTED"
+      /* NOT_CONNECTED */
+    ]: "USER_ACTION",
+    [
+      "ALREADY_CONNECTED"
+      /* ALREADY_CONNECTED */
+    ]: "USER_ACTION",
+    [
+      "UNKNOWN_ERROR"
+      /* UNKNOWN_ERROR */
+    ]: "INTERNAL"
+    /* INTERNAL */
+  };
   class WalletKitError extends Error {
     constructor(code, message, options = {}) {
       super(message);
       this.name = "WalletKitError";
       this.code = code;
+      this.category = options.category ?? WALLET_KIT_ERROR_CATEGORY_BY_CODE[code] ?? "INTERNAL";
       this.cause = options.cause;
       this.details = options.details;
     }
@@ -1937,6 +2011,16 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
       `Wallet adapter is invalid: ${adapterId}`,
       { details: { adapterId, issues } }
     ),
+    networkMismatch: (walletName, expected, actual, cause) => new WalletKitError(
+      "NETWORK_MISMATCH",
+      `${walletName} is connected to ${actual ?? "an unknown network"} but the app requested ${expected ?? "a different network"}`,
+      { cause, details: { walletName, expected, actual } }
+    ),
+    networkNotSupported: (walletName, network, cause) => new WalletKitError(
+      "NETWORK_NOT_SUPPORTED",
+      `${walletName} does not support ${network ?? "the requested network"}`,
+      { cause, details: { walletName, network } }
+    ),
     notConnected: () => new WalletKitError(
       "NOT_CONNECTED",
       "No wallet is connected"
@@ -2464,6 +2548,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
   const RECOVER_SESSION_RETRY_DELAYS_MS = [0, 700, 1600, 3e3];
   const DEFAULT_AUTO_RECONNECT_RESTORE_TIMEOUT_MS = 3e3;
   const DEFAULT_PENDING_RETURN_RECOVERY_TIMEOUT_MS = 1e4;
+  const DEFAULT_AVAILABILITY_CHECK_TIMEOUT_MS = 1e3;
   const DEFAULT_ACCOUNT_STATUS_TIMEOUT_MS = 2500;
   const DEFAULT_AUTHENTICATE_EXPIRES_IN_SECONDS = 3600;
   const DEFAULT_TX_CONFIRMATION_ATTEMPTS = 6;
@@ -2505,7 +2590,12 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
       const entries = await Promise.all([...this.adapters.values()].map(async (adapter) => {
         if (!adapter.isAvailable) return [adapter.metadata.id, false];
         try {
-          return [adapter.metadata.id, Boolean(await adapter.isAvailable())];
+          const availability = await this.withTimeout(Promise.resolve(adapter.isAvailable()), DEFAULT_AVAILABILITY_CHECK_TIMEOUT_MS);
+          if (availability.timedOut) {
+            this.logger.warn(`Availability check timed out for ${adapter.metadata.id}`);
+            return [adapter.metadata.id, false];
+          }
+          return [adapter.metadata.id, Boolean(availability.value)];
         } catch (error) {
           this.logger.warn(`Availability check failed for ${adapter.metadata.id}`, error);
           return [adapter.metadata.id, false];
@@ -2517,7 +2607,12 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
       const results2 = await Promise.all([...this.adapters.values()].map(async (adapter) => {
         if (!adapter.isAvailable) return null;
         try {
-          return await adapter.isAvailable() ? adapter : null;
+          const availability = await this.withTimeout(Promise.resolve(adapter.isAvailable()), DEFAULT_AVAILABILITY_CHECK_TIMEOUT_MS);
+          if (availability.timedOut) {
+            this.logger.warn(`Availability check timed out for ${adapter.metadata.id}`);
+            return null;
+          }
+          return availability.value ? adapter : null;
         } catch (error) {
           this.logger.warn(`Availability check failed for ${adapter.metadata.id}`, error);
           return null;
@@ -2581,6 +2676,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
             await this.clearStoredSessionAsStale(session, "restore_unavailable");
             return null;
           }
+          this.assertSessionNetwork(adapter, restored.session, this.getNetwork(), "restoreSession");
           const enrichedSession2 = await this.enrichSession(this.withWalletMetadata(restored.session, adapter));
           this.setSession(enrichedSession2);
           await this.loadPersistedTransactions(enrichedSession2);
@@ -2604,6 +2700,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
           return null;
         }
         const enrichedSession = await this.enrichSession(this.withWalletMetadata(session, adapter));
+        this.assertSessionNetwork(adapter, enrichedSession, this.getNetwork(), "autoReconnect");
         this.setSession(enrichedSession);
         await this.loadPersistedTransactions(enrichedSession);
         this.emit("session_restored", { adapterId: enrichedSession.adapterId, account: enrichedSession.account, session: enrichedSession, stale: true });
@@ -2660,6 +2757,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
             }
             const recovered = recovery.value;
             if (!(recovered == null ? void 0 : recovered.session)) continue;
+            this.assertSessionNetwork(adapter, recovered.session, network, "recoverSession");
             const enrichedSession = await this.enrichSession(this.withWalletMetadata(recovered.session, adapter));
             this.setSession(enrichedSession);
             await this.saveSession(enrichedSession);
@@ -2698,7 +2796,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
         this.pendingAdapterId = adapterId;
         this.pendingAbortController = new AbortController();
         this.emit("connecting", { adapterId });
-        if (adapter.isAvailable && !await adapter.isAvailable()) {
+        if (adapter.isAvailable && !await this.isAdapterAvailable(adapter)) {
           throw createWalletError.walletNotAvailable(adapter.metadata.name);
         }
         const signal = options.signal ?? this.pendingAbortController.signal;
@@ -2706,6 +2804,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
         if (signal.aborted || this.pendingAdapterId !== adapterId) {
           throw new Error("Wallet connection was cancelled");
         }
+        this.assertAccountNetwork(adapter, result.account, network, "connect");
         const session = await this.enrichSession(this.withWalletMetadata(result.session ?? { adapterId, account: { ...result.account, network }, connectedAt: Date.now() }, adapter));
         this.setSession(session);
         await this.saveSession(session);
@@ -3181,6 +3280,31 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
         if (timer) clearTimeout(timer);
       }
     }
+    async isAdapterAvailable(adapter) {
+      if (!adapter.isAvailable) return true;
+      const availability = await this.withTimeout(Promise.resolve(adapter.isAvailable()), DEFAULT_AVAILABILITY_CHECK_TIMEOUT_MS);
+      if (availability.timedOut) {
+        this.logger.warn(`Availability check timed out for ${adapter.metadata.id}`);
+        return false;
+      }
+      return Boolean(availability.value);
+    }
+    assertSessionNetwork(adapter, session, expected, source) {
+      this.assertAccountNetwork(adapter, session.account, expected, source);
+    }
+    assertAccountNetwork(adapter, account, expected, source) {
+      const actualNetwork = account.network;
+      const actualId = actualNetwork == null ? void 0 : actualNetwork.id;
+      const actualType = (actualNetwork == null ? void 0 : actualNetwork.networkType) ?? account.networkType;
+      const expectedId = expected.id;
+      const expectedType = expected.networkType;
+      if (actualId && actualId !== expectedId) {
+        throw createWalletError.networkMismatch(adapter.metadata.name, String(expectedId), String(actualId), new Error(`${source} returned a different network id`));
+      }
+      if (actualType && actualType !== expectedType) {
+        throw createWalletError.networkMismatch(adapter.metadata.name, expectedType, actualType, new Error(`${source} returned a different network type`));
+      }
+    }
     normalizeConnectionError(adapter, error) {
       if (isWalletKitError(error)) return error;
       const message = error instanceof Error ? error.message : String(error);
@@ -3216,6 +3340,21 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
     const encoder2 = new TextEncoder();
     return [...encoder2.encode(value)].map((byte) => byte.toString(16).padStart(2, "0")).join("").toUpperCase();
   }
+  const EXECUTABLE_URL_PROTOCOLS = /* @__PURE__ */ new Set(["blob:", "data:", "file:", "javascript:", "vbscript:"]);
+  const SAFE_DATA_IMAGE_PATTERN = /^data:image\/(?:avif|gif|jpeg|jpg|png|svg\+xml|webp);base64,[a-z0-9+/]+=*$/i;
+  function isSafeWalletUrl(value, options = {}) {
+    var _a2, _b;
+    if (typeof value !== "string") return false;
+    const url = value.trim();
+    if (!url) return false;
+    if (options.allowDataImage && SAFE_DATA_IMAGE_PATTERN.test(url)) return true;
+    const protocol = (_b = (_a2 = url.match(/^([a-z][a-z0-9+.-]*):/i)) == null ? void 0 : _a2[1]) == null ? void 0 : _b.toLowerCase();
+    if (!protocol) return true;
+    return !EXECUTABLE_URL_PROTOCOLS.has(`${protocol}:`);
+  }
+  function sanitizeWalletUrl(value, options = {}) {
+    return isSafeWalletUrl(value, options) ? value.trim() : void 0;
+  }
   var umd$1 = { exports: {} };
   var umd = umd$1.exports;
   var hasRequiredUmd;
@@ -9167,6 +9306,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
     }
     async signAndSubmit(request) {
       if (!this.session) throw createWalletError.notConnected();
+      this.assertSingleSignTransaction(request.txJson);
       try {
         const result = await this.session.signTransaction(request.txJson, request.submit ?? true);
         return {
@@ -9184,6 +9324,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
     }
     async signTransaction(request) {
       if (!this.session) throw createWalletError.notConnected();
+      this.assertSingleSignTransaction(request.txJson);
       try {
         const result = await this.session.signTransaction(request.txJson, false);
         return {
@@ -9247,6 +9388,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
     async signWithDefaultLedger(tx, submit2 = true) {
       if (!this.xrp || !this.session) throw createWalletError.notConnected();
       if (!this.network) throw createWalletError.connectionFailed(this.metadata.name, new Error("XRPL network is required for Ledger signing"));
+      this.assertSingleSignTransaction(tx);
       const { Client, encode: encode2 } = await Promise.resolve().then(() => index$4);
       const client2 = new Client(this.network.rpcUrl);
       await client2.connect();
@@ -9354,6 +9496,12 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
         if (timer) clearTimeout(timer);
       }
     }
+    assertSingleSignTransaction(tx) {
+      const txJson = asRecord(tx);
+      if (txJson.SigningPubKey === "" || Array.isArray(txJson.Signers)) {
+        throw createWalletError.unsupportedMethod("XRPL multisigning", this.metadata.name);
+      }
+    }
   }
   function createLedgerAdapter(options) {
     return new LedgerAdapter(options);
@@ -15844,7 +15992,7 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
       this.activeAddress = void 0;
       this.activeProvider = ethereum;
       await this.selectSnapNetwork(options);
-      const snap = await this.withAbort(ethereum.request({ method: "wallet_invokeSnap", params: { snapId: this.snapId, request: { method: "xrpl_getAccount" } } }), options.signal);
+      const snap = await this.withAbort(this.invokeSnap("xrpl_getAccount", void 0), options.signal);
       const address = snap.account;
       const publicKey = snap.publicKey;
       if (!address) throw new Error("XRPL Snap did not return an XRPL address");
@@ -15939,10 +16087,27 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
     }
     async invokeSnap(method, params) {
       const ethereum = await this.ethereum();
-      return ethereum.request({
+      const request = () => ethereum.request({
         method: "wallet_invokeSnap",
         params: { snapId: this.snapId, request: { method, params } }
       });
+      const retryDelays = this.options.snapRequestRetryDelaysMs ?? [120, 350, 800];
+      try {
+        return await request();
+      } catch (error) {
+        if (!this.isSnapKeyringHydratingError(error)) throw error;
+        let lastError = error;
+        for (const delayMs of retryDelays) {
+          await this.delay(delayMs);
+          try {
+            return await request();
+          } catch (retryError) {
+            lastError = retryError;
+            if (!this.isSnapKeyringHydratingError(retryError)) throw retryError;
+          }
+        }
+        throw lastError;
+      }
     }
     createSignMessagePaymentTx(request) {
       var _a2;
@@ -16031,8 +16196,9 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
       const injected = globalThis.ethereum;
       this.startEip6963Discovery();
       const configured = this.options.ethereum;
+      if (this.activeProvider) return this.activeProvider;
       if (configured) return await this.pickSnapProvider(configured, true) ?? this.pickStrongMetaMaskProvider(configured);
-      const ethereum = this.activeProvider ?? await this.pickSnapProvider(injected, false) ?? await this.discoverMetaMaskProvider() ?? [...discoveredMetaMaskProviders][0] ?? this.pickStrongMetaMaskProvider(injected);
+      const ethereum = await this.pickSnapProvider(injected, false) ?? await this.discoverMetaMaskProvider() ?? [...discoveredMetaMaskProviders][0] ?? this.pickStrongMetaMaskProvider(injected);
       if (!ethereum && required) throw new Error("No MetaMask provider installed");
       if (ethereum) this.activeProvider = ethereum;
       return ethereum;
@@ -16134,6 +16300,14 @@ var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot
       const message = this.getErrorMessage(error);
       return /-32601|wallet_requestSnaps|wallet_getSnaps|does not exist|not available|unsupported|method not found|unknown method/i.test(message);
     }
+    isSnapKeyringHydratingError(error) {
+      const message = this.getErrorMessage(error);
+      return /KeyringController\s*-\s*Keyring not found|Keyring not found/i.test(message);
+    }
+    delay(ms2) {
+      if (ms2 <= 0) return Promise.resolve();
+      return new Promise((resolve) => setTimeout(resolve, ms2));
+    }
     withAbort(promise, signal) {
       if (!signal) return promise;
       if (signal.aborted) return Promise.reject(createWalletError.connectionRejected(this.metadata.name, new Error("Connection was cancelled")));
@@ -20651,7 +20825,7 @@ ${new this._window.XMLSerializer().serializeToString(e4)}`;
       const textSize = this.options.textSize ?? "sm";
       const hasReadyUri = state2.status === "ready" && Boolean(state2.uri);
       state2.status === "ready" ? state2.uri : void 0;
-      const deeplink = state2.status === "ready" ? state2.deeplink : void 0;
+      const deeplink = state2.status === "ready" ? sanitizeWalletUrl(state2.deeplink) : void 0;
       const qrCodeAttributes = hasReadyUri ? ` aria-hidden="true"` : "";
       const openAction = hasReadyUri && deeplink ? `<a class="xwk-action xwk-action-primary" data-xwk-open href="${this.escapeHtml(deeplink)}">${this.escapeHtml(messages.openWallet)}</a>` : "";
       const copyAction = hasReadyUri ? `<button class="xwk-action xwk-copy-inside" data-xwk-copy type="button">${this.renderQrCopyButtonContent()}</button>` : "";
@@ -20771,7 +20945,8 @@ ${new this._window.XMLSerializer().serializeToString(e4)}`;
       const previewLimit = group.maxPreviewIcons ?? 5;
       const previewWallets = wallets.slice(0, previewLimit);
       const overflow = wallets.length - previewWallets.length;
-      const icon = group.icon ? `<img src="${this.escapeHtml(group.icon)}" alt="">` : `<span class="xwk-icon-fallback">${this.escapeHtml(group.name.slice(0, 1).toUpperCase())}</span>`;
+      const iconUrl = sanitizeWalletUrl(group.icon, { allowDataImage: true });
+      const icon = iconUrl ? `<img src="${this.escapeHtml(iconUrl)}" alt="">` : `<span class="xwk-icon-fallback">${this.escapeHtml(group.name.slice(0, 1).toUpperCase())}</span>`;
       const secondary = layout === "list" ? `<span class="xwk-group">${this.escapeHtml(messages.walletCount(wallets.length))}</span>` : layout === "card" || layout === "grid" ? `<span class="xwk-group">+${this.escapeHtml(messages.walletCount(wallets.length))}</span>` : "";
       const preview = previewWallets.length ? `<span class="xwk-group-icons">${previewWallets.map((wallet) => this.renderMiniWalletIcon(wallet)).join("")}${overflow > 0 ? `<span class="xwk-mini-more" aria-label="${this.escapeHtml(messages.moreWallets(overflow))}">+${overflow}</span>` : ""}</span>` : "";
       return `<button class="xwk-wallet xwk-wallet-group" data-wallet-group-id="${this.escapeHtml(group.id)}">${icon}<span class="xwk-wallet-info"><span class="xwk-name">${this.escapeHtml(group.name)}</span>${secondary}${preview}</span></button>`;
@@ -20828,14 +21003,16 @@ ${new this._window.XMLSerializer().serializeToString(e4)}`;
       }
     }
     renderWalletIcon(wallet) {
-      if (wallet == null ? void 0 : wallet.icon)
-        return `<img src="${this.escapeHtml(wallet.icon)}" alt="">`;
+      const icon = sanitizeWalletUrl(wallet == null ? void 0 : wallet.icon, { allowDataImage: true });
+      if (icon)
+        return `<img src="${this.escapeHtml(icon)}" alt="">`;
       const letter = (wallet == null ? void 0 : wallet.name.slice(0, 1).toUpperCase()) ?? "W";
       return `<span class="xwk-icon-fallback">${this.escapeHtml(letter)}</span>`;
     }
     renderMiniWalletIcon(wallet) {
-      if (wallet.icon)
-        return `<img class="xwk-mini-icon" src="${this.escapeHtml(wallet.icon)}" alt="">`;
+      const icon = sanitizeWalletUrl(wallet.icon, { allowDataImage: true });
+      if (icon)
+        return `<img class="xwk-mini-icon" src="${this.escapeHtml(icon)}" alt="">`;
       return `<span class="xwk-mini-icon xwk-mini-fallback">${this.escapeHtml(wallet.name.slice(0, 1).toUpperCase())}</span>`;
     }
     backIcon() {
@@ -21800,7 +21977,8 @@ ${new this._window.XMLSerializer().serializeToString(e4)}`;
         return `<div class="xwk-account-art xwk-account-avatar-skeleton" role="status" aria-label="${this.escapeHtml(this.messages().connecting)}"><span class="xwk-skeleton xwk-skeleton-circle"></span></div>`;
       }
       if (this.identityAvatar) {
-        return `<img class="xwk-account-avatar" src="${this.escapeHtml(this.identityAvatar)}" alt="">`;
+        const avatar = sanitizeWalletUrl(this.identityAvatar, { allowDataImage: true });
+        if (avatar) return `<img class="xwk-account-avatar" src="${this.escapeHtml(avatar)}" alt="">`;
       }
       const [from2, to2, spot] = this.getAddressGradient(this.getSessionAddress(session));
       return `<div class="xwk-account-art" style="--xwk-avatar-from:${from2};--xwk-avatar-to:${to2};--xwk-avatar-spot:${spot}"><span></span></div>`;
@@ -21836,7 +22014,7 @@ ${new this._window.XMLSerializer().serializeToString(e4)}`;
       return resolveWalletUiMessages(this.options.language, this.options.messages);
     }
     renderWalletIcon(wallet, fallbackIcon) {
-      const icon = (wallet == null ? void 0 : wallet.icon) ?? fallbackIcon;
+      const icon = sanitizeWalletUrl((wallet == null ? void 0 : wallet.icon) ?? fallbackIcon, { allowDataImage: true });
       if (icon) return `<img class="xwk-button-icon" src="${this.escapeHtml(icon)}" alt="">`;
       if (!wallet) return `<span class="xwk-button-icon xwk-button-icon-fallback xwk-button-icon-svg-fallback" aria-hidden="true">${this.walletIcon()}</span>`;
       const label = wallet.name.slice(0, 1).toUpperCase();
@@ -21846,8 +22024,10 @@ ${new this._window.XMLSerializer().serializeToString(e4)}`;
       const icon = this.options.icon;
       if (!icon || icon.type === "default") return this.renderWalletIcon(void 0);
       if (icon.type === "image") {
+        const src2 = sanitizeWalletUrl(icon.src, { allowDataImage: true });
+        if (!src2) return this.renderWalletIcon(void 0);
         const aria = icon.alt ? ` role="img" aria-label="${this.escapeHtml(icon.alt)}"` : ` aria-hidden="true"`;
-        return `<span class="xwk-button-icon xwk-button-icon-custom xwk-button-icon-custom-image"${aria}><img src="${this.escapeHtml(icon.src)}" alt="" decoding="async"></span>`;
+        return `<span class="xwk-button-icon xwk-button-icon-custom xwk-button-icon-custom-image"${aria}><img src="${this.escapeHtml(src2)}" alt="" decoding="async"></span>`;
       }
       return this.renderCustomHtmlIcon(icon);
     }
@@ -77899,6 +78079,7 @@ ${e2.length}`, n2 = new TextEncoder().encode(t2 + e2);
   exports.WALLETCONNECT_GROUP_ICON = WALLETCONNECT_GROUP_ICON;
   exports.WALLETCONNECT_ICON = WALLETCONNECT_ICON;
   exports.WALLET_ADAPTER_API_VERSION = WALLET_ADAPTER_API_VERSION;
+  exports.WALLET_KIT_ERROR_CATEGORY_BY_CODE = WALLET_KIT_ERROR_CATEGORY_BY_CODE;
   exports.WALLET_STORAGE_VERSION = WALLET_STORAGE_VERSION;
   exports.WalletButton = WalletButtonController;
   exports.WalletButtonController = WalletButtonController;
@@ -77906,6 +78087,7 @@ ${e2.length}`, n2 = new TextEncoder().encode(t2 + e2);
   exports.WalletEventEmitter = WalletEventEmitter;
   exports.WalletInline = WalletInline;
   exports.WalletKitError = WalletKitError;
+  exports.WalletKitErrorCategory = WalletKitErrorCategory;
   exports.WalletKitErrorCode = WalletKitErrorCode;
   exports.WalletManager = WalletManager;
   exports.WalletModal = WalletModal;
@@ -77962,6 +78144,7 @@ ${e2.length}`, n2 = new TextEncoder().encode(t2 + e2);
   exports.getNativeAsset = getNativeAsset;
   exports.glassTheme = glassTheme;
   exports.isMainnetNetwork = isMainnetNetwork;
+  exports.isSafeWalletUrl = isSafeWalletUrl;
   exports.isSuccessResult = isSuccessResult;
   exports.isWalletKitError = isWalletKitError;
   exports.lightTheme = lightTheme;
@@ -77978,6 +78161,7 @@ ${e2.length}`, n2 = new TextEncoder().encode(t2 + e2);
   exports.resolveWalletUiMessages = resolveWalletUiMessages;
   exports.resolveWalletUiOptions = resolveWalletUiOptions;
   exports.roundedTheme = roundedTheme;
+  exports.sanitizeWalletUrl = sanitizeWalletUrl;
   exports.softTheme = softTheme;
   exports.utf8ToHex = utf8ToHex;
   exports.validateWalletAdapter = validateWalletAdapter;