cabalspy-id 0.5.1 → 0.5.2

package/dist/thesis.d.ts

@@ -1,20 +1,37 @@
-import { b as CabalSpyIDError } from './users-CDlDRuyv.js';
-export { A as ApiErrorBody, a as AuthenticationError, B as BadRequestError, C as CabalSpyID, c as CabalSpyIDErrorOptions, d as CabalSpyIDOptions, g as ConnectionError, i as DEFAULT_THESES_STREAM_URL, j as DeleteThesisParams, H as HandleKind, k as HeaderSource, I as InvalidResponseError, L as LatestThesesParams, p as ListThesesParams, M as MAX_THESES_STREAM_TOKENS, N as NotFoundError, O as OAuthError, P as PermissionError, q as PlanUserLimitError, r as PostThesisParams, R as RateLimitError, t as RateLimitInfo, u as ReactToThesisParams, w as ReplyToThesisParams, x as ReportThesisParams, S as SDK_VERSION, z as ServerError, U as ThesesReadyEvent, V as ThesesStream, W as ThesesStreamEventMap, X as ThesesStreamOptions, Y as ThesesSubscribedEvent, Z as ThesisRepliesParams, _ as ThesisScopeParam, $ as ThesisStreamEvent, a0 as ThesisTokenParams, a1 as ThesisTokenRef, a2 as ThesisWriter, a3 as TokenVerificationError, a5 as UserLike, a6 as UserThesesParams, a8 as VerifyWebhookOptions, aa as WebhookVerificationError, ab as handleKind, ac as hasX, ad as signWebhook, ae as verifyWebhook } from './users-CDlDRuyv.js';
+import { b as CabalSpyIDError } from './users-B4r33i4O.js';
+export { A as ApiErrorBody, a as AuthenticationError, B as BadRequestError, C as CabalSpyID, c as CabalSpyIDErrorOptions, d as CabalSpyIDOptions, g as ConnectionError, i as DEFAULT_THESES_STREAM_URL, j as DeleteThesisParams, H as HandleKind, k as HeaderSource, I as InvalidResponseError, L as LatestThesesParams, p as ListThesesParams, M as MAX_THESES_STREAM_TOKENS, N as NotFoundError, O as OAuthError, P as PermissionError, q as PlanUserLimitError, r as PostThesisParams, R as RateLimitError, t as RateLimitInfo, u as ReactToThesisParams, w as ReplyToThesisParams, x as ReportThesisParams, S as SDK_VERSION, z as ServerError, U as ThesesReadyEvent, V as ThesesStream, W as ThesesStreamEventMap, X as ThesesStreamOptions, Y as ThesesSubscribedEvent, Z as ThesisRepliesParams, _ as ThesisScopeParam, $ as ThesisStreamEvent, a0 as ThesisTokenParams, a1 as ThesisTokenRef, a2 as ThesisWriter, a3 as TokenVerificationError, a5 as UserLike, a6 as UserThesesParams, a8 as VerifyWebhookOptions, aa as WebhookVerificationError, ab as handleKind, ac as hasX, ad as signWebhook, ae as verifyWebhook } from './users-B4r33i4O.js';
 import { d as Chain, a3 as ThesisSort, a4 as ThesisStance, y as Thesis, o as Pagination, a6 as ThesisToken, B as ThesisCounts, a5 as ThesisSummary, F as ThesisEligibility, J as ThesisNotices, G as ThesisEmoji, _ as ThesisReactions, a2 as ThesisReportReason, Q as ThesisNotifications } from './types-UZeY9n1e.js';
 export { C as CHAINS, S as Scope, T as THESIS_EMOJIS, w as THESIS_MAX_BODY, x as THESIS_REPORT_REASONS, z as ThesisAuthor, E as ThesisCreatedData, I as ThesisLiveItem, K as ThesisNotification, N as ThesisNotificationKind, U as ThesisPnl, V as ThesisPosition, W as ThesisPositionPrivate, X as ThesisPositionPublic, Y as ThesisReactionData, Z as ThesisReactionUpdate, $ as ThesisReactor, a0 as ThesisRemoved, a1 as ThesisReplyData, ah as WebhookEvent } from './types-UZeY9n1e.js';
 
 declare const DEFAULT_THESIS_URL = "https://id.cabalspy.xyz/thesis/v1";
 declare const DEFAULT_THESIS_WS_URL = "wss://id.cabalspy.xyz/thesis/v1/ws";
+/** Header that carries the instance's public client_id on every thesis API call. */
+declare const CLIENT_ID_HEADER = "X-CSID-Client-Id";
 interface ThesisScopeOptions {
     /**
      * `global` (default): theses written on every platform. `instance`: only the
      * ones written on the instance named by `clientId`.
      */
     scope?: 'global' | 'instance';
-    /** Your instance's client_id. Needed for `scope: 'instance'`; also credits posts to your app. */
+    /**
+     * Instance whose theses `scope: 'instance'` reads. Defaults to the client's
+     * own `clientId`; you rarely need to set it per call.
+     */
     clientId?: string;
 }
-interface ThesisClientOptions extends ThesisScopeOptions {
+interface ThesisClientOptions {
+    /**
+     * Required. Your instance's PUBLIC client_id (`csid_...`), shown in the
+     * dashboard next to the API key. It is not a secret and not the API key. Sent
+     * as `X-CSID-Client-Id` on every call and as `client_id` on the live socket;
+     * also used for `scope: 'instance'` and credits posts to your app.
+     */
+    clientId: string;
+    /**
+     * `global` (default): theses written on every platform. `instance`: only the
+     * ones written on your instance.
+     */
+    scope?: 'global' | 'instance';
     /** The signed-in user's access token (scope `thesis`). Needed only for writing. */
     accessToken?: string | null;
     /** Default: https://id.cabalspy.xyz/thesis/v1 */
@@ -57,7 +74,7 @@ type ThesisMe = ThesisEligibility & {
  * Client for the public thesis API, e.g. in a browser app that builds its own
  * thesis UI.
  *
- *   const theses = new ThesisClient({ accessToken });     // from csid:login
+ *   const theses = new ThesisClient({ clientId: 'csid_...', accessToken }); // token from csid:login
  *   const page = await theses.list('solana', mint, { sort: 'top' });
  *   await theses.post('solana', mint, { body: 'Strong community, early.', stance: 'bull' });
  *   const live = theses.live('solana', mint);
@@ -69,10 +86,11 @@ declare class ThesisClient {
     readonly wsUrl: string;
     readonly timeout: number;
     readonly scope?: 'global' | 'instance';
-    readonly clientId?: string;
+    /** Your instance's public client_id, sent on every call. */
+    readonly clientId: string;
     private accessToken;
     private readonly fetchImpl;
-    constructor(options?: ThesisClientOptions);
+    constructor(options: ThesisClientOptions);
     /** Sets (or with null clears) the user's access token, e.g. after sign-in or sign-out. */
     setAccessToken(token: string | null | undefined): void;
     private call;
@@ -125,8 +143,8 @@ declare class ThesisClient {
         appealed: true;
     }>;
     /**
-     * Live updates for one token: thesis, reply, reaction, removed. With
-     * `scope: 'instance'` (and `clientId`) only theses written on that instance.
+     * Live updates for one token: thesis, reply, reaction, removed. The socket URL
+     * carries `client_id`. With `scope: 'instance'` only theses written on your instance.
      */
     live(chain: Chain, mint: string, options?: ThesisLiveOptions & ThesisScopeOptions): ThesisLive;
 }
@@ -158,10 +176,23 @@ interface ThesisLiveEventMap {
     error: CabalSpyIDError;
 }
 type LiveHandler<T> = (payload: T) => void;
+/** Close codes of the live socket for client_id checks (the close reason is the error code). */
+declare const THESIS_WS_CLOSE_CODES: {
+    /** client_id_required or invalid_client: final. */
+    readonly CLIENT: 4401;
+    /** origin_not_allowed: final. */
+    readonly ORIGIN: 4403;
+    /** rate_limited: reconnects after 60 s. */
+    readonly RATE_LIMITED: 4429;
+};
+/** The error for a refusing close code of the live socket, or null for an ordinary close. */
+declare function thesisCloseError(code: number | undefined, reason?: string): CabalSpyIDError | null;
 /**
  * Public live socket for one token. Messages arrive as `thesis`, `reply`,
  * `reaction` and `removed`; it reconnects after drops or missed heartbeats.
- * Code 1008 (invalid token address, too many sockets) is final.
+ * Codes 1008 (invalid token address, too many sockets), 4401 (client_id
+ * missing or invalid) and 4403 (origin not allowed) are final; after 4429
+ * (rate limited) it waits 60 s before reconnecting.
  */
 declare class ThesisLive {
     readonly url: string;
@@ -187,4 +218,4 @@ declare class ThesisLive {
     close(): void;
 }
 
-export { CabalSpyIDError, Chain, DEFAULT_THESIS_URL, DEFAULT_THESIS_WS_URL, Pagination, Thesis, ThesisClient, type ThesisClientOptions, ThesisCounts, ThesisEligibility, ThesisEmoji, ThesisLive, type ThesisLiveEventMap, type ThesisLiveOptions, type ThesisMe, ThesisNotices, ThesisNotifications, type ThesisPage, ThesisReactions, ThesisReportReason, type ThesisScopeOptions, ThesisSort, ThesisStance, ThesisSummary, ThesisToken, type ThesisViewer, type TokenThesesOptions, type TokenThesesPage };
+export { CLIENT_ID_HEADER, CabalSpyIDError, Chain, DEFAULT_THESIS_URL, DEFAULT_THESIS_WS_URL, Pagination, THESIS_WS_CLOSE_CODES, Thesis, ThesisClient, type ThesisClientOptions, ThesisCounts, ThesisEligibility, ThesisEmoji, ThesisLive, type ThesisLiveEventMap, type ThesisLiveOptions, type ThesisMe, ThesisNotices, ThesisNotifications, type ThesisPage, ThesisReactions, ThesisReportReason, type ThesisScopeOptions, ThesisSort, ThesisStance, ThesisSummary, ThesisToken, type ThesisViewer, type TokenThesesOptions, type TokenThesesPage, thesisCloseError };

package/dist/thesis.js

@@ -1,42 +1,48 @@
 import {
+  CLIENT_ID_HEADER,
   DEFAULT_THESIS_URL,
   DEFAULT_THESIS_WS_URL,
+  THESIS_WS_CLOSE_CODES,
   ThesisClient,
-  ThesisLive
-} from "./chunk-3P7QK2PG.js";
+  ThesisLive,
+  thesisCloseError
+} from "./chunk-Z23B5TY6.js";
 import "./chunk-CJFIOVBA.js";
 import {
-  AuthenticationError,
-  BadRequestError,
   CHAINS,
   CabalSpyID,
-  CabalSpyIDError,
-  ConnectionError,
   DEFAULT_THESES_STREAM_URL,
-  InvalidResponseError,
   MAX_THESES_STREAM_TOKENS,
-  NotFoundError,
-  OAuthError,
-  PermissionError,
-  PlanUserLimitError,
-  RateLimitError,
   SDK_VERSION,
-  ServerError,
   THESIS_EMOJIS,
   THESIS_MAX_BODY,
   THESIS_REPORT_REASONS,
   ThesesStream,
-  TokenVerificationError,
-  WebhookVerificationError,
   handleKind,
   hasX,
   signWebhook,
   verifyWebhook
-} from "./chunk-3LKLY5WQ.js";
+} from "./chunk-XLBO2RSL.js";
+import {
+  AuthenticationError,
+  BadRequestError,
+  CabalSpyIDError,
+  ConnectionError,
+  InvalidResponseError,
+  NotFoundError,
+  OAuthError,
+  PermissionError,
+  PlanUserLimitError,
+  RateLimitError,
+  ServerError,
+  TokenVerificationError,
+  WebhookVerificationError
+} from "./chunk-VOTYIQAY.js";
 export {
   AuthenticationError,
   BadRequestError,
   CHAINS,
+  CLIENT_ID_HEADER,
   CabalSpyID,
   CabalSpyIDError,
   ConnectionError,
@@ -55,6 +61,7 @@ export {
   THESIS_EMOJIS,
   THESIS_MAX_BODY,
   THESIS_REPORT_REASONS,
+  THESIS_WS_CLOSE_CODES,
   ThesesStream,
   ThesisClient,
   ThesisLive,
@@ -63,6 +70,7 @@ export {
   handleKind,
   hasX,
   signWebhook,
+  thesisCloseError,
   verifyWebhook
 };
 //# sourceMappingURL=thesis.js.map

package/dist/{users-BDLkwW1p.d.cts → users-3DAw88_U.d.cts}

@@ -46,10 +46,10 @@ declare class CabalSpyIDError extends Error {
 /** 400 — missing_parameter, invalid_parameter, instance_required */
 declare class BadRequestError extends CabalSpyIDError {
 }
-/** 401 — missing_api_key */
+/** 401 — missing_api_key; thesis API: client_id_required, invalid_client */
 declare class AuthenticationError extends CabalSpyIDError {
 }
-/** 403 — invalid_api_key, product_not_enabled, no_instance, scope_not_allowed */
+/** 403 — invalid_api_key, product_not_enabled, no_instance, scope_not_allowed; thesis API: origin_not_allowed */
 declare class PermissionError extends CabalSpyIDError {
 }
 /**
@@ -62,7 +62,7 @@ declare class PlanUserLimitError extends PermissionError {
 /** 404 — profile_not_found, wallet_not_found, instance_not_found */
 declare class NotFoundError extends CabalSpyIDError {
 }
-/** 429 — rate_limit_exceeded */
+/** 429 — rate_limit_exceeded; thesis API: rate_limited (Retry-After 60) */
 declare class RateLimitError extends CabalSpyIDError {
     /** Seconds until the next request is allowed, taken from Retry-After. */
     readonly retryAfter: number | null;
@@ -736,7 +736,7 @@ declare function signWebhook(secret: string, id: string, timestamp: number, payl
 declare function verifyWebhook<D = Record<string, unknown>>(options: VerifyWebhookOptions): Promise<WebhookEvent<D>>;
 
 /** Internal helpers: encoding, WebCrypto access, environment. */
-declare const SDK_VERSION = "0.5.1";
+declare const SDK_VERSION = "0.5.2";
 
 /**
  * People can sign in with X, Telegram or Google. Accounts without X have no

package/dist/{users-CDlDRuyv.d.ts → users-B4r33i4O.d.ts}

@@ -46,10 +46,10 @@ declare class CabalSpyIDError extends Error {
 /** 400 — missing_parameter, invalid_parameter, instance_required */
 declare class BadRequestError extends CabalSpyIDError {
 }
-/** 401 — missing_api_key */
+/** 401 — missing_api_key; thesis API: client_id_required, invalid_client */
 declare class AuthenticationError extends CabalSpyIDError {
 }
-/** 403 — invalid_api_key, product_not_enabled, no_instance, scope_not_allowed */
+/** 403 — invalid_api_key, product_not_enabled, no_instance, scope_not_allowed; thesis API: origin_not_allowed */
 declare class PermissionError extends CabalSpyIDError {
 }
 /**
@@ -62,7 +62,7 @@ declare class PlanUserLimitError extends PermissionError {
 /** 404 — profile_not_found, wallet_not_found, instance_not_found */
 declare class NotFoundError extends CabalSpyIDError {
 }
-/** 429 — rate_limit_exceeded */
+/** 429 — rate_limit_exceeded; thesis API: rate_limited (Retry-After 60) */
 declare class RateLimitError extends CabalSpyIDError {
     /** Seconds until the next request is allowed, taken from Retry-After. */
     readonly retryAfter: number | null;
@@ -736,7 +736,7 @@ declare function signWebhook(secret: string, id: string, timestamp: number, payl
 declare function verifyWebhook<D = Record<string, unknown>>(options: VerifyWebhookOptions): Promise<WebhookEvent<D>>;
 
 /** Internal helpers: encoding, WebCrypto access, environment. */
-declare const SDK_VERSION = "0.5.1";
+declare const SDK_VERSION = "0.5.2";
 
 /**
  * People can sign in with X, Telegram or Google. Accounts without X have no

package/dist/widget.cjs

@@ -1,4 +1,8 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/widget.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunkABFIPCBYcjs = require('./chunk-ABFIPCBY.cjs');
+
+// src/widget.ts
 var WIDGET_SRC = "https://id.cabalspy.xyz/widget.js";
 var isBrowser = () => typeof window !== "undefined" && typeof document !== "undefined";
 var loaders = /* @__PURE__ */ new Map();
@@ -66,11 +70,17 @@ function loginButtonAttributes(o) {
   };
 }
 function thesisWidgetAttributes(o) {
+  if (typeof _optionalChain([o, 'optionalAccess', _3 => _3.clientId]) !== "string" || !o.clientId.trim()) {
+    throw new (0, _chunkABFIPCBYcjs.AuthenticationError)(
+      "The theses widget needs your instance's public client_id (csid_..., shown in the dashboard next to the API key): { clientId: 'csid_...' }. It is not the API key; never put the API key in a browser.",
+      { code: "client_id_required", parameter: "clientId", docs: "https://docs.cabalspy.xyz/cabalspy-id/errors#client_id_required" }
+    );
+  }
   return {
     "data-csid-thesis": "",
     "data-chain": o.chain,
     "data-mint": o.mint,
-    "data-client-id": o.clientId,
+    "data-client-id": o.clientId.trim(),
     "data-theme": o.theme,
     "data-scope": o.scope,
     "data-sort": o.sort,
@@ -95,16 +105,16 @@ function onWidgetEvents(handlers, clientId) {
   if (!isBrowser()) return () => void 0;
   const login = (e) => {
     const d = e.detail;
-    const aud = _optionalChain([d, 'optionalAccess', _3 => _3.idToken]) ? audOf(d.idToken) : void 0;
+    const aud = _optionalChain([d, 'optionalAccess', _4 => _4.idToken]) ? audOf(d.idToken) : void 0;
     if (clientId && aud !== void 0 && aud !== clientId) return;
-    _optionalChain([handlers, 'access', _4 => _4.onLogin, 'optionalCall', _5 => _5(d)]);
+    _optionalChain([handlers, 'access', _5 => _5.onLogin, 'optionalCall', _6 => _6(d)]);
   };
   const logout = (e) => {
     const d = e.detail;
-    if (clientId && _optionalChain([d, 'optionalAccess', _6 => _6.clientId]) && d.clientId !== clientId) return;
-    _optionalChain([handlers, 'access', _7 => _7.onLogout, 'optionalCall', _8 => _8(d)]);
+    if (clientId && _optionalChain([d, 'optionalAccess', _7 => _7.clientId]) && d.clientId !== clientId) return;
+    _optionalChain([handlers, 'access', _8 => _8.onLogout, 'optionalCall', _9 => _9(d)]);
   };
-  const error = (e) => _optionalChain([handlers, 'access', _9 => _9.onError, 'optionalCall', _10 => _10(e.detail)]);
+  const error = (e) => _optionalChain([handlers, 'access', _10 => _10.onError, 'optionalCall', _11 => _11(e.detail)]);
   window.addEventListener("csid:login", login);
   window.addEventListener("csid:logout", logout);
   window.addEventListener("csid:error", error);
@@ -140,7 +150,7 @@ function mountWith(target, options, attributes, after, scriptSrc, onLoadError) {
           after(csid, current);
         }
       },
-      (err) => _optionalChain([onLoadError, 'optionalCall', _11 => _11(err)])
+      (err) => _optionalChain([onLoadError, 'optionalCall', _12 => _12(err)])
     );
   };
   render();
@@ -165,7 +175,7 @@ function mountLoginButton(target, options) {
     loginButtonAttributes,
     () => void 0,
     options.scriptSrc,
-    (err) => _optionalChain([options, 'access', _12 => _12.onError, 'optionalCall', _13 => _13({ error: "widget_load_failed", description: err.message })])
+    (err) => _optionalChain([options, 'access', _13 => _13.onError, 'optionalCall', _14 => _14({ error: "widget_load_failed", description: err.message })])
   );
   return {
     get element() {
@@ -184,14 +194,19 @@ function mountTheses(target, options) {
     options,
     thesisWidgetAttributes,
     (csid) => {
-      if (options.accessToken !== void 0) _optionalChain([csid, 'access', _14 => _14.thesis, 'optionalAccess', _15 => _15.setAccessToken, 'call', _16 => _16(options.accessToken)]);
+      if (options.accessToken !== void 0) _optionalChain([csid, 'access', _15 => _15.thesis, 'optionalAccess', _16 => _16.setAccessToken, 'call', _17 => _17(options.accessToken)]);
     },
     options.scriptSrc
   );
 }
 async function setThesisAccessToken(token, scriptSrc) {
   const csid = await loadCabalSpyIDWidget(scriptSrc);
-  _optionalChain([csid, 'access', _17 => _17.thesis, 'optionalAccess', _18 => _18.setAccessToken, 'call', _19 => _19(token)]);
+  _optionalChain([csid, 'access', _18 => _18.thesis, 'optionalAccess', _19 => _19.setAccessToken, 'call', _20 => _20(token)]);
+}
+async function setThesisSignInHandler(handler, scriptSrc) {
+  if (!isBrowser()) return;
+  const csid = await loadCabalSpyIDWidget(scriptSrc);
+  _optionalChain([csid, 'access', _21 => _21.thesis, 'optionalAccess', _22 => _22.setSignInHandler, 'optionalCall', _23 => _23(handler)]);
 }
 async function startLogin(options, scriptSrc) {
   const csid = await loadCabalSpyIDWidget(scriptSrc);
@@ -213,5 +228,6 @@ async function startLogin(options, scriptSrc) {
 
 
 
-exports.WIDGET_SRC = WIDGET_SRC; exports.audOf = audOf; exports.isBrowser = isBrowser; exports.loadCabalSpyIDWidget = loadCabalSpyIDWidget; exports.loginButtonAttributes = loginButtonAttributes; exports.mountLoginButton = mountLoginButton; exports.mountTheses = mountTheses; exports.onWidgetEvents = onWidgetEvents; exports.setThesisAccessToken = setThesisAccessToken; exports.startLogin = startLogin; exports.thesisWidgetAttributes = thesisWidgetAttributes;
+
+exports.WIDGET_SRC = WIDGET_SRC; exports.audOf = audOf; exports.isBrowser = isBrowser; exports.loadCabalSpyIDWidget = loadCabalSpyIDWidget; exports.loginButtonAttributes = loginButtonAttributes; exports.mountLoginButton = mountLoginButton; exports.mountTheses = mountTheses; exports.onWidgetEvents = onWidgetEvents; exports.setThesisAccessToken = setThesisAccessToken; exports.setThesisSignInHandler = setThesisSignInHandler; exports.startLogin = startLogin; exports.thesisWidgetAttributes = thesisWidgetAttributes;
 //# sourceMappingURL=widget.cjs.map

package/dist/widget.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["c:\\Users\\davis\\Desktop\\cabalspy-web\\github\\cabalspy-id-js\\dist\\widget.cjs"],"names":[],"mappings":"AAAA;AACA,IAAI,WAAW,EAAE,mCAAmC;AACpD,IAAI,UAAU,EAAE,CAAC,EAAE,GAAG,OAAO,OAAO,IAAI,YAAY,GAAG,OAAO,SAAS,IAAI,WAAW;AACtF,IAAI,QAAQ,kBAAkB,IAAI,GAAG,CAAC,CAAC;AACvC,SAAS,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE;AAChD,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC1F,EAAE,GAAG,iBAAC,MAAM,mBAAC,IAAI,6BAAE,UAAQ,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;AAChE,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1B,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE;AAC5D,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACvB,IAAI,EAAE,EAAE,KAAK,CAAC;AACd,EAAE;AACF,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE;AACV,IAAI,EAAE,EAAE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG;AACzC,MAAM,MAAM,KAAK,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AAC9H,MAAM,IAAI,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACjE,MAAM,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC;AAC9C,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE;AACnB,QAAQ,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC;AACjD,QAAQ,MAAM,CAAC,IAAI,EAAE,GAAG;AACxB,QAAQ,MAAM,CAAC,MAAM,EAAE,IAAI;AAC3B,QAAQ,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;AACzC,MAAM;AACN,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,MAAM,MAAM,CAAC,gBAAgB;AAC7B,QAAQ,OAAO;AACf,QAAQ,CAAC,EAAE,GAAG;AACd,UAAU,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AAC7B,UAAU,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;AACA,QAAA;AACA,QAAA;AACA,MAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA;AACA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,oBAAA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,oBAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,MAAA;AACA,QAAA;AACA,UAAA;AACA,UAAA;AACA,QAAA;AACA,MAAA;AACA,MAAA;AACA,IAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,MAAA;AACA,IAAA;AACA,IAAA;AACA,MAAA;AACA,MAAA;AACA,IAAA;AACA,IAAA;AACA,MAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,MAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,MAAA;AACA,MAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,MAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA,EAAA;AACA,kBAAA;AACA;AACA;AACA,EAAA;AACA,EAAA;AACA,IAAA;AACA,IAAA;AACA,IAAA;AACA,EAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"C:\\Users\\davis\\Desktop\\cabalspy-web\\github\\cabalspy-id-js\\dist\\widget.cjs","sourcesContent":[null]}
+{"version":3,"sources":["/home/runner/work/cabalspy-id-js/cabalspy-id-js/dist/widget.cjs","../src/widget.ts"],"names":[],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACA;ACYO,IAAM,WAAA,EAAa,mCAAA;AAqEnB,IAAM,UAAA,EAAY,CAAA,EAAA,GAAM,OAAO,OAAA,IAAW,YAAA,GAAe,OAAO,SAAA,IAAa,WAAA;AAEpF,IAAM,QAAA,kBAAU,IAAI,GAAA,CAAiC,CAAA;AAG9C,SAAS,oBAAA,CAAqB,IAAA,EAAc,UAAA,EAAiC;AAClF,EAAA,GAAA,CAAI,CAAC,SAAA,CAAU,CAAA,EAAG,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,oCAAoC,CAAC,CAAA;AACvF,EAAA,GAAA,iBAAI,MAAA,mBAAO,IAAA,6BAAM,UAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAC7D,EAAA,IAAI,EAAA,EAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAEvB,EAAA,GAAA,CAAI,EAAA,GAAK,CAAC,QAAA,CAAS,aAAA,CAAc,CAAA,YAAA,EAAe,GAAG,CAAA,EAAA,CAAI,CAAA,EAAG;AACxD,IAAA,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA;AAClB,IAAA,EAAA,EAAI,KAAA,CAAA;AAAA,EACN;AACA,EAAA,GAAA,CAAI,CAAC,CAAA,EAAG;AACN,IAAA,EAAA,EAAI,IAAI,OAAA,CAAoB,CAAC,OAAA,EAAS,MAAA,EAAA,GAAW;AAC/C,MAAA,MAAM,KAAA,EAAO,CAAA,EAAA,GAAO,MAAA,CAAO,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,EAAA,EAAI,MAAA,CAAO,IAAI,KAAA,CAAM,6CAA6C,CAAC,CAAA;AACxH,MAAA,IAAI,OAAA,EAAS,QAAA,CAAS,aAAA,CAAiC,CAAA,YAAA,EAAe,GAAG,CAAA,EAAA,CAAI,CAAA;AAC7E,MAAA,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,IAAA,EAAM,OAAO,IAAA,CAAK,CAAA;AACvC,MAAA,GAAA,CAAI,CAAC,MAAA,EAAQ;AACX,QAAA,OAAA,EAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AACxC,QAAA,MAAA,CAAO,IAAA,EAAM,GAAA;AACb,QAAA,MAAA,CAAO,MAAA,EAAQ,IAAA;AACf,QAAA,QAAA,CAAS,IAAA,CAAK,WAAA,CAAY,MAAM,CAAA;AAAA,MAClC;AACA,MAAA,MAAA,CAAO,gBAAA,CAAiB,MAAA,EAAQ,IAAA,EAAM,EAAE,IAAA,EAAM,KAAK,CAAC,CAAA;AACpD,MAAA,MAAA,CAAO,gBAAA;AAAA,QACL,OAAA;AAAA,QACA,CAAA,EAAA,GAAM;AACJ,UAAA,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA;AAClB,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,GAAG,CAAA,CAAA;AACxC,QAAA;AACa,QAAA;AACf,MAAA;AACD,IAAA;AACiB,IAAA;AACpB,EAAA;AACO,EAAA;AACT;AAG2D;AACrD,EAAA;AAC0C,IAAA;AACJ,IAAA;AACH,IAAA;AAC/B,EAAA;AACC,IAAA;AACT,EAAA;AACF;AAE4E;AACE;AA+EmB;AACxF,EAAA;AACc,IAAA;AACC,IAAA;AACJ,IAAA;AACA,IAAA;AACK,IAAA;AACL,IAAA;AACD,IAAA;AACC,IAAA;AACmB,IAAA;AACF,IAAA;AAClB,IAAA;AACQ,IAAA;AACkB,IAAA;AAC1B,IAAA;AACO,IAAA;AACxB,EAAA;AACF;AAGmG;AACvD,EAAA;AAC9B,IAAA;AACR,MAAA;AAEyC,MAAA;AAC3C,IAAA;AACF,EAAA;AACO,EAAA;AACe,IAAA;AACJ,IAAA;AACD,IAAA;AACmB,IAAA;AAClB,IAAA;AACA,IAAA;AACD,IAAA;AACA,IAAA;AACY,IAAA;AACd,IAAA;AACE,IAAA;AACA,IAAA;AACC,IAAA;AACC,IAAA;AACA,IAAA;AACK,IAAA;AACP,IAAA;AACA,IAAA;AACsB,IAAA;AACM,IAAA;AACb,IAAA;AACH,IAAA;AAC7B,EAAA;AACF;AAiB6F;AAC5D,EAAA;AACH,EAAA;AACoB,IAAA;AACF,IAAA;AACC,IAAA;AACzB,oBAAA;AACtB,EAAA;AAC6B,EAAA;AACyB,IAAA;AACnB,IAAA;AACZ,oBAAA;AACvB,EAAA;AACwF,EAAA;AAC7C,EAAA;AACE,EAAA;AACF,EAAA;AAC9B,EAAA;AAC8B,IAAA;AACC,IAAA;AACD,IAAA;AAC3C,EAAA;AACF;AAa0D;AACtB,EAAA;AACM,EAAA;AACf,EAAA;AAClB,EAAA;AACT;AAE2F;AAC7C,EAAA;AAC9C;AAME;AAIiC,EAAA;AACnB,EAAA;AACuB,EAAA;AAChB,EAAA;AACsB,IAAA;AACA,IAAA;AACH,IAAA;AACZ,IAAA;AACrB,IAAA;AAC2B,IAAA;AACpB,MAAA;AACY,QAAA;AACP,UAAA;AACQ,UAAA;AACrB,QAAA;AACF,MAAA;AACiC,MAAA;AACnC,IAAA;AACF,EAAA;AACO,EAAA;AACA,EAAA;AACS,IAAA;AACL,MAAA;AACT,IAAA;AACgB,IAAA;AACqB,MAAA;AAC5B,MAAA;AACT,IAAA;AACS,IAAA;AACG,MAAA;AACZ,IAAA;AACF,EAAA;AACF;AASqC;AACU,EAAA;AAC7B,EAAA;AACd,IAAA;AACA,IAAA;AACA,IAAA;AACM,IAAA;AACE,IAAA;AAC4B,IAAA;AACtC,EAAA;AACO,EAAA;AACS,IAAA;AACG,MAAA;AACjB,IAAA;AAC+B,IAAA;AACtB,IAAA;AACF,MAAA;AACU,MAAA;AACjB,IAAA;AACF,EAAA;AACF;AAUsC;AAC7B,EAAA;AACL,IAAA;AACA,IAAA;AACA,IAAA;AACU,IAAA;AACoC,MAAA;AAC9C,IAAA;AACQ,IAAA;AACV,EAAA;AACF;AAMiE;AACvB,EAAA;AACP,kBAAA;AACnC;AAgBkF;AAC9D,EAAA;AACsB,EAAA;AACD,kBAAA;AACzC;AAMiB;AACyB,EAAA;AACvB,EAAA;AACG,IAAA;AACG,IAAA;AACiB,IAAA;AACvC,EAAA;AACH;ADrPiD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/cabalspy-id-js/cabalspy-id-js/dist/widget.cjs","sourcesContent":[null,"/**\n * CabalSpy ID widgets for any web page (browser only, no framework):\n * the \"Sign in with CabalSpy ID\" button and the token theses widget.\n *\n *   import { mountLoginButton, mountTheses } from 'cabalspy-id/widget';\n *\n *   mountLoginButton('#login', { clientId: 'csid_…', onLogin: ({ idToken }) => sendToBackend(idToken) });\n *   mountTheses('#theses', { chain: 'solana', mint, clientId: 'csid_…', theme: 'dark' });\n *\n * Loads https://id.cabalspy.xyz/widget.js once and maps options to its data-*\n * attributes. React components: `cabalspy-id/react` (also `cabalspy-id/widget/react`).\n */\n\nimport { AuthenticationError } from './errors';\nimport type { CabalSpyIDClaims, Chain, OidcScope } from './types';\n\nexport const WIDGET_SRC = 'https://id.cabalspy.xyz/widget.js';\n\n/** Detail of the widget's `csid:login` event. */\nexport interface CabalSpyIDLogin {\n  /** userinfo claims; `limited: true` (anonymous sub) when the platform is over its plan's user limit. */\n  user: CabalSpyIDClaims;\n  /** Send this to your backend and verify it there. */\n  idToken: string;\n  accessToken: string;\n  /** Seconds. */\n  expiresIn: number;\n}\n\nexport interface CabalSpyIDLogoutEvent {\n  clientId: string;\n}\n\nexport interface CabalSpyIDErrorEvent {\n  error: string;\n  description?: string;\n}\n\n/** The signed-in person as the widget remembers them on this device. */\nexport interface CabalSpyIDUserSummary {\n  sub: string;\n  username?: string;\n  name?: string | null;\n  picture?: string | null;\n  kol_badge?: boolean;\n  limited?: boolean;\n}\n\n/** The global the widget defines (window.CSID). */\nexport interface CSIDGlobal {\n  __loaded: true;\n  user: CabalSpyIDLogin | null;\n  mount(): void;\n  login(opts: { clientId: string; redirectUri?: string; scope?: string }): Promise<void>;\n  setUser(clientId: string, user: CabalSpyIDUserSummary | CabalSpyIDClaims): void;\n  signOut(clientId: string): void;\n  onLogin(cb: (r: CabalSpyIDLogin) => void): void;\n  /** Thesis widgets on the page (data-csid-thesis). */\n  thesis?: {\n    /** Lets thesis widgets write as this user (access token with the scope \"thesis\"). */\n    setAccessToken(token: string | null): void;\n    /**\n     * Your own sign-in for the widget's \"Sign in to write\" (null removes it).\n     * See {@link setThesisSignInHandler}.\n     */\n    setSignInHandler?(handler: ThesisSignInHandler | null): void;\n    clear(): void;\n  };\n}\n\n/**\n * Your page's sign-in for thesis widgets: obtain a thesis-capable access token\n * for the person (e.g. your platform's own CabalSpy ID access token with the\n * scope \"thesis\", from your backend), call `setThesisAccessToken(token)` (or\n * `CSID.thesis.setAccessToken(token)`) and resolve `true`; resolve `false` when\n * the person is not signed in.\n */\nexport type ThesisSignInHandler = () => Promise<boolean> | boolean;\n\ndeclare global {\n  interface Window {\n    CSID?: CSIDGlobal;\n  }\n}\n\nexport const isBrowser = () => typeof window !== 'undefined' && typeof document !== 'undefined';\n\nconst loaders = new Map<string, Promise<CSIDGlobal>>();\n\n/** Loads widget.js once per page. Resolves with window.CSID. */\nexport function loadCabalSpyIDWidget(src: string = WIDGET_SRC): Promise<CSIDGlobal> {\n  if (!isBrowser()) return Promise.reject(new Error('CabalSpy ID widget needs a browser'));\n  if (window.CSID?.__loaded) return Promise.resolve(window.CSID);\n  let p = loaders.get(src);\n  // The script tag was removed (e.g. by a test or a head manager): load again.\n  if (p && !document.querySelector(`script[src=\"${src}\"]`)) {\n    loaders.delete(src);\n    p = undefined;\n  }\n  if (!p) {\n    p = new Promise<CSIDGlobal>((resolve, reject) => {\n      const done = () => (window.CSID ? resolve(window.CSID) : reject(new Error('widget.js loaded but window.CSID is missing')));\n      let script = document.querySelector<HTMLScriptElement>(`script[src=\"${src}\"]`);\n      if (script && window.CSID) return done();\n      if (!script) {\n        script = document.createElement('script');\n        script.src = src;\n        script.async = true;\n        document.head.appendChild(script);\n      }\n      script.addEventListener('load', done, { once: true });\n      script.addEventListener(\n        'error',\n        () => {\n          loaders.delete(src);\n          reject(new Error(`Could not load ${src}`));\n        },\n        { once: true },\n      );\n    });\n    loaders.set(src, p);\n  }\n  return p;\n}\n\n/** The `aud` of an (unverified) ID token, to route widget events to the right client. */\nexport function audOf(idToken: string): string | undefined {\n  try {\n    const part = idToken.split('.')[1]!.replace(/-/g, '+').replace(/_/g, '/');\n    const aud = (JSON.parse(atob(part + '='.repeat((4 - (part.length % 4)) % 4))) as { aud?: string | string[] }).aud;\n    return Array.isArray(aud) ? aud[0] : aud;\n  } catch {\n    return undefined;\n  }\n}\n\nconst bool = (v: boolean | undefined) => (v === undefined ? undefined : v ? 'true' : 'false');\nconst num = (v: number | undefined) => (v === undefined ? undefined : String(v));\n\n// ── options ──────────────────────────────────────────────────────────────────\n\n/** Design and behaviour of the login button. */\nexport interface LoginButtonOptions {\n  /** Your instance's client_id (`csid_…`). */\n  clientId: string;\n  /** Button design overrides; defaults come from the dashboard's button builder. */\n  theme?: 'dark' | 'light' | (string & {});\n  color?: string;\n  textColor?: string;\n  shape?: 'square' | 'rounded' | 'pill';\n  size?: 'sm' | 'md' | 'lg';\n  label?: string;\n  fullWidth?: boolean;\n  showLogo?: boolean;\n  /**\n   * Server-side apps: your own login route that starts the OIDC flow with your\n   * client secret. Without it, a public client runs PKCE in the browser.\n   */\n  href?: string;\n  /** Browser apps: redirect URI (default: the current page). */\n  redirectUri?: string;\n  /**\n   * Browser apps: requested scopes (default: openid profile). Add `thesis` so\n   * the person can write in thesis widgets on your page right after sign-in.\n   */\n  scope?: string | OidcScope[];\n  /** Server-side apps: the signed-in person's `sub`, to show the avatar menu. */\n  user?: string;\n  /** Server-side apps: where \"Sign out\" goes. */\n  logoutHref?: string;\n}\n\n/** Design and data of the token theses widget. */\nexport interface ThesisWidgetOptions {\n  /** solana | bnb | base | eth | rh */\n  chain: Chain;\n  /** Token mint / contract address. */\n  mint: string;\n  /**\n   * Required. Your instance's PUBLIC client_id (`csid_...`, shown in the\n   * dashboard next to the API key; not the API key). The widget sends it on\n   * every thesis API call; it also loads the design saved in the dashboard (the\n   * options below override it), credits posts to your app and enables `scope: 'instance'`.\n   */\n  clientId: string;\n  /** Default: dark */\n  theme?: 'dark' | 'light';\n  /** `global` (default): theses from every platform. `instance`: only the ones written on your instance. */\n  scope?: 'global' | 'instance';\n  /** Initial order. Default: new */\n  sort?: 'new' | 'top';\n  /** Font family, e.g. \"Inter\". */\n  font?: string;\n  /** Corner radius in px. Default: 12 */\n  radius?: number;\n  /** Colors (CSS colors, e.g. \"#0d0f12\"). */\n  bg?: string;\n  card?: string;\n  text?: string;\n  muted?: string;\n  border?: string;\n  accent?: string;\n  accentText?: string;\n  bull?: string;\n  bear?: string;\n  /** Show the token header. Default: true */\n  showHeader?: boolean;\n  /** Show the bull/bear sentiment bar. */\n  showSentiment?: boolean;\n  /** Denser layout. Default: false */\n  compact?: boolean;\n  /** Initial height in px; the widget then sizes itself to its content. Default: 520 */\n  height?: number;\n}\n\n/** The widget's data-* attributes for a login button. */\nexport function loginButtonAttributes(o: LoginButtonOptions): Record<string, string | undefined> {\n  return {\n    'data-csid-login': '',\n    'data-client-id': o.clientId,\n    'data-theme': o.theme,\n    'data-color': o.color,\n    'data-text-color': o.textColor,\n    'data-shape': o.shape,\n    'data-size': o.size,\n    'data-label': o.label,\n    'data-full-width': bool(o.fullWidth),\n    'data-show-logo': bool(o.showLogo),\n    'data-href': o.href,\n    'data-redirect-uri': o.redirectUri,\n    'data-scope': Array.isArray(o.scope) ? o.scope.join(' ') : o.scope,\n    'data-user': o.user,\n    'data-logout-href': o.logoutHref,\n  };\n}\n\n/** The widget's data-* attributes for a theses widget. Throws `client_id_required` without `clientId`. */\nexport function thesisWidgetAttributes(o: ThesisWidgetOptions): Record<string, string | undefined> {\n  if (typeof o?.clientId !== 'string' || !o.clientId.trim()) {\n    throw new AuthenticationError(\n      \"The theses widget needs your instance's public client_id (csid_..., shown in the dashboard next to the API key): \" +\n        \"{ clientId: 'csid_...' }. It is not the API key; never put the API key in a browser.\",\n      { code: 'client_id_required', parameter: 'clientId', docs: 'https://docs.cabalspy.xyz/cabalspy-id/errors#client_id_required' },\n    );\n  }\n  return {\n    'data-csid-thesis': '',\n    'data-chain': o.chain,\n    'data-mint': o.mint,\n    'data-client-id': o.clientId.trim(),\n    'data-theme': o.theme,\n    'data-scope': o.scope,\n    'data-sort': o.sort,\n    'data-font': o.font,\n    'data-radius': num(o.radius),\n    'data-bg': o.bg,\n    'data-card': o.card,\n    'data-text': o.text,\n    'data-muted': o.muted,\n    'data-border': o.border,\n    'data-accent': o.accent,\n    'data-accent-text': o.accentText,\n    'data-bull': o.bull,\n    'data-bear': o.bear,\n    'data-show-header': bool(o.showHeader),\n    'data-show-sentiment': bool(o.showSentiment),\n    'data-compact': bool(o.compact),\n    'data-height': num(o.height),\n  };\n}\n\n// ── events ───────────────────────────────────────────────────────────────────\n\nexport interface WidgetEventHandlers {\n  /** A browser-app login finished (window event `csid:login`). */\n  onLogin?: (result: CabalSpyIDLogin) => void;\n  /** The person signed out from the menu (window event `csid:logout`). */\n  onLogout?: (event: CabalSpyIDLogoutEvent) => void;\n  /** The browser flow failed (window event `csid:error`). */\n  onError?: (event: CabalSpyIDErrorEvent) => void;\n}\n\n/**\n * Listens to the widget's window events. With `clientId`, logins and logouts of\n * other clients on the same page are ignored. Returns a function that stops listening.\n */\nexport function onWidgetEvents(handlers: WidgetEventHandlers, clientId?: string): () => void {\n  if (!isBrowser()) return () => undefined;\n  const login = (e: Event) => {\n    const d = (e as CustomEvent<CabalSpyIDLogin>).detail;\n    const aud = d?.idToken ? audOf(d.idToken) : undefined;\n    if (clientId && aud !== undefined && aud !== clientId) return;\n    handlers.onLogin?.(d);\n  };\n  const logout = (e: Event) => {\n    const d = (e as CustomEvent<CabalSpyIDLogoutEvent>).detail;\n    if (clientId && d?.clientId && d.clientId !== clientId) return;\n    handlers.onLogout?.(d);\n  };\n  const error = (e: Event) => handlers.onError?.((e as CustomEvent<CabalSpyIDErrorEvent>).detail);\n  window.addEventListener('csid:login', login);\n  window.addEventListener('csid:logout', logout);\n  window.addEventListener('csid:error', error);\n  return () => {\n    window.removeEventListener('csid:login', login);\n    window.removeEventListener('csid:logout', logout);\n    window.removeEventListener('csid:error', error);\n  };\n}\n\n// ── mounting (vanilla) ───────────────────────────────────────────────────────\n\nexport interface MountedWidget<O> {\n  /** The element carrying the data-* attributes. */\n  readonly element: HTMLElement;\n  /** Re-renders with new options (a fresh element, so the widget mounts it again). */\n  update(options: Partial<O>): void;\n  /** Removes the widget and its event listeners. */\n  remove(): void;\n}\n\nfunction resolveTarget(target: Element | string): Element {\n  if (!isBrowser()) throw new Error('CabalSpy ID widget needs a browser');\n  const el = typeof target === 'string' ? document.querySelector(target) : target;\n  if (!el) throw new Error(`CabalSpy ID widget: no element matches ${String(target)}`);\n  return el;\n}\n\nfunction applyAttributes(el: HTMLElement, attrs: Record<string, string | undefined>): void {\n  for (const [k, v] of Object.entries(attrs)) if (v !== undefined) el.setAttribute(k, v);\n}\n\nfunction mountWith<O>(\n  target: Element | string,\n  options: O,\n  attributes: (o: O) => Record<string, string | undefined>,\n  after: (csid: CSIDGlobal, o: O) => void,\n  scriptSrc: string | undefined,\n  onLoadError?: (err: Error) => void,\n): MountedWidget<O> {\n  const host = resolveTarget(target);\n  let current = options;\n  let el = document.createElement('div');\n  const render = () => {\n    const next = document.createElement('div');\n    applyAttributes(next, attributes(current));\n    if (el.parentNode) el.replaceWith(next);\n    else host.appendChild(next);\n    el = next;\n    loadCabalSpyIDWidget(scriptSrc).then(\n      (csid) => {\n        if (el.isConnected) {\n          csid.mount();\n          after(csid, current);\n        }\n      },\n      (err: Error) => onLoadError?.(err),\n    );\n  };\n  render();\n  return {\n    get element() {\n      return el;\n    },\n    update(partial) {\n      current = { ...current, ...partial };\n      render();\n    },\n    remove() {\n      el.remove();\n    },\n  };\n}\n\n/**\n * Mounts the \"Sign in with CabalSpy ID\" button into `target` (an element or a\n * CSS selector).\n */\nexport function mountLoginButton(\n  target: Element | string,\n  options: LoginButtonOptions & WidgetEventHandlers & { scriptSrc?: string },\n): MountedWidget<LoginButtonOptions> {\n  const stop = onWidgetEvents(options, options.clientId);\n  const mounted = mountWith<LoginButtonOptions>(\n    target,\n    options,\n    loginButtonAttributes,\n    () => undefined,\n    options.scriptSrc,\n    (err) => options.onError?.({ error: 'widget_load_failed', description: err.message }),\n  );\n  return {\n    get element() {\n      return mounted.element;\n    },\n    update: (o) => mounted.update(o),\n    remove() {\n      stop();\n      mounted.remove();\n    },\n  };\n}\n\n/**\n * Mounts the token theses widget into `target` (an element or a CSS selector).\n * `clientId` (your instance's public client_id) is required. `accessToken`\n * (scope `thesis`) lets the signed-in person write right away.\n */\nexport function mountTheses(\n  target: Element | string,\n  options: ThesisWidgetOptions & { accessToken?: string | null; scriptSrc?: string },\n): MountedWidget<ThesisWidgetOptions> {\n  return mountWith<ThesisWidgetOptions>(\n    target,\n    options,\n    thesisWidgetAttributes,\n    (csid) => {\n      if (options.accessToken !== undefined) csid.thesis?.setAccessToken(options.accessToken);\n    },\n    options.scriptSrc,\n  );\n}\n\n/**\n * Lets thesis widgets on the page write as this user (an access token with the\n * scope `thesis`), or signs them out with `null`.\n */\nexport async function setThesisAccessToken(token: string | null, scriptSrc?: string): Promise<void> {\n  const csid = await loadCabalSpyIDWidget(scriptSrc);\n  csid.thesis?.setAccessToken(token);\n}\n\n/**\n * Lets your page handle the thesis widgets' \"Sign in to write\": the widget\n * calls `handler` instead of the page's login button / popup. While a handler\n * is set, the widget treats the page as the source of truth for sign-in (signed\n * out on the page = signed out in the widget). `null` removes it. Waits for\n * widget.js when it is not loaded yet; a no-op on the server.\n *\n *   setThesisSignInHandler(async () => {\n *     const token = await fetch('/api/csid-thesis-token').then((r) => (r.ok ? r.text() : null));\n *     if (!token) return false;\n *     await setThesisAccessToken(token);\n *     return true;\n *   });\n */\nexport async function setThesisSignInHandler(handler: ThesisSignInHandler | null, scriptSrc?: string): Promise<void> {\n  if (!isBrowser()) return; // server rendering: nothing to register\n  const csid = await loadCabalSpyIDWidget(scriptSrc);\n  csid.thesis?.setSignInHandler?.(handler);\n}\n\n/** Starts the browser (public client) login flow. */\nexport async function startLogin(\n  options: { clientId: string; redirectUri?: string; scope?: string | OidcScope[] },\n  scriptSrc?: string,\n): Promise<void> {\n  const csid = await loadCabalSpyIDWidget(scriptSrc);\n  await csid.login({\n    clientId: options.clientId,\n    redirectUri: options.redirectUri,\n    scope: Array.isArray(options.scope) ? options.scope.join(' ') : options.scope,\n  });\n}\n"]}

package/dist/widget.d.cts

@@ -57,9 +57,22 @@ interface CSIDGlobal {
     thesis?: {
         /** Lets thesis widgets write as this user (access token with the scope "thesis"). */
         setAccessToken(token: string | null): void;
+        /**
+         * Your own sign-in for the widget's "Sign in to write" (null removes it).
+         * See {@link setThesisSignInHandler}.
+         */
+        setSignInHandler?(handler: ThesisSignInHandler | null): void;
         clear(): void;
     };
 }
+/**
+ * Your page's sign-in for thesis widgets: obtain a thesis-capable access token
+ * for the person (e.g. your platform's own CabalSpy ID access token with the
+ * scope "thesis", from your backend), call `setThesisAccessToken(token)` (or
+ * `CSID.thesis.setAccessToken(token)`) and resolve `true`; resolve `false` when
+ * the person is not signed in.
+ */
+type ThesisSignInHandler = () => Promise<boolean> | boolean;
 declare global {
     interface Window {
         CSID?: CSIDGlobal;
@@ -107,13 +120,15 @@ interface ThesisWidgetOptions {
     /** Token mint / contract address. */
     mint: string;
     /**
-     * Your instance's client_id: loads the design saved in the dashboard (the
+     * Required. Your instance's PUBLIC client_id (`csid_...`, shown in the
+     * dashboard next to the API key; not the API key). The widget sends it on
+     * every thesis API call; it also loads the design saved in the dashboard (the
      * options below override it), credits posts to your app and enables `scope: 'instance'`.
      */
-    clientId?: string;
+    clientId: string;
     /** Default: dark */
     theme?: 'dark' | 'light';
-    /** `global` (default): theses from every platform. `instance`: only the ones written on your instance (needs clientId). */
+    /** `global` (default): theses from every platform. `instance`: only the ones written on your instance. */
     scope?: 'global' | 'instance';
     /** Initial order. Default: new */
     sort?: 'new' | 'top';
@@ -142,7 +157,7 @@ interface ThesisWidgetOptions {
 }
 /** The widget's data-* attributes for a login button. */
 declare function loginButtonAttributes(o: LoginButtonOptions): Record<string, string | undefined>;
-/** The widget's data-* attributes for a theses widget. */
+/** The widget's data-* attributes for a theses widget. Throws `client_id_required` without `clientId`. */
 declare function thesisWidgetAttributes(o: ThesisWidgetOptions): Record<string, string | undefined>;
 interface WidgetEventHandlers {
     /** A browser-app login finished (window event `csid:login`). */
@@ -174,7 +189,8 @@ declare function mountLoginButton(target: Element | string, options: LoginButton
 }): MountedWidget<LoginButtonOptions>;
 /**
  * Mounts the token theses widget into `target` (an element or a CSS selector).
- * `accessToken` (scope `thesis`) lets the signed-in person write right away.
+ * `clientId` (your instance's public client_id) is required. `accessToken`
+ * (scope `thesis`) lets the signed-in person write right away.
  */
 declare function mountTheses(target: Element | string, options: ThesisWidgetOptions & {
     accessToken?: string | null;
@@ -185,6 +201,21 @@ declare function mountTheses(target: Element | string, options: ThesisWidgetOpti
  * scope `thesis`), or signs them out with `null`.
  */
 declare function setThesisAccessToken(token: string | null, scriptSrc?: string): Promise<void>;
+/**
+ * Lets your page handle the thesis widgets' "Sign in to write": the widget
+ * calls `handler` instead of the page's login button / popup. While a handler
+ * is set, the widget treats the page as the source of truth for sign-in (signed
+ * out on the page = signed out in the widget). `null` removes it. Waits for
+ * widget.js when it is not loaded yet; a no-op on the server.
+ *
+ *   setThesisSignInHandler(async () => {
+ *     const token = await fetch('/api/csid-thesis-token').then((r) => (r.ok ? r.text() : null));
+ *     if (!token) return false;
+ *     await setThesisAccessToken(token);
+ *     return true;
+ *   });
+ */
+declare function setThesisSignInHandler(handler: ThesisSignInHandler | null, scriptSrc?: string): Promise<void>;
 /** Starts the browser (public client) login flow. */
 declare function startLogin(options: {
     clientId: string;
@@ -192,4 +223,4 @@ declare function startLogin(options: {
     scope?: string | OidcScope[];
 }, scriptSrc?: string): Promise<void>;
 
-export { type CSIDGlobal, type CabalSpyIDErrorEvent, type CabalSpyIDLogin, type CabalSpyIDLogoutEvent, type CabalSpyIDUserSummary, type LoginButtonOptions, type MountedWidget, type ThesisWidgetOptions, WIDGET_SRC, type WidgetEventHandlers, audOf, isBrowser, loadCabalSpyIDWidget, loginButtonAttributes, mountLoginButton, mountTheses, onWidgetEvents, setThesisAccessToken, startLogin, thesisWidgetAttributes };
+export { type CSIDGlobal, type CabalSpyIDErrorEvent, type CabalSpyIDLogin, type CabalSpyIDLogoutEvent, type CabalSpyIDUserSummary, type LoginButtonOptions, type MountedWidget, type ThesisSignInHandler, type ThesisWidgetOptions, WIDGET_SRC, type WidgetEventHandlers, audOf, isBrowser, loadCabalSpyIDWidget, loginButtonAttributes, mountLoginButton, mountTheses, onWidgetEvents, setThesisAccessToken, setThesisSignInHandler, startLogin, thesisWidgetAttributes };

package/dist/widget.d.ts

@@ -57,9 +57,22 @@ interface CSIDGlobal {
     thesis?: {
         /** Lets thesis widgets write as this user (access token with the scope "thesis"). */
         setAccessToken(token: string | null): void;
+        /**
+         * Your own sign-in for the widget's "Sign in to write" (null removes it).
+         * See {@link setThesisSignInHandler}.
+         */
+        setSignInHandler?(handler: ThesisSignInHandler | null): void;
         clear(): void;
     };
 }
+/**
+ * Your page's sign-in for thesis widgets: obtain a thesis-capable access token
+ * for the person (e.g. your platform's own CabalSpy ID access token with the
+ * scope "thesis", from your backend), call `setThesisAccessToken(token)` (or
+ * `CSID.thesis.setAccessToken(token)`) and resolve `true`; resolve `false` when
+ * the person is not signed in.
+ */
+type ThesisSignInHandler = () => Promise<boolean> | boolean;
 declare global {
     interface Window {
         CSID?: CSIDGlobal;
@@ -107,13 +120,15 @@ interface ThesisWidgetOptions {
     /** Token mint / contract address. */
     mint: string;
     /**
-     * Your instance's client_id: loads the design saved in the dashboard (the
+     * Required. Your instance's PUBLIC client_id (`csid_...`, shown in the
+     * dashboard next to the API key; not the API key). The widget sends it on
+     * every thesis API call; it also loads the design saved in the dashboard (the
      * options below override it), credits posts to your app and enables `scope: 'instance'`.
      */
-    clientId?: string;
+    clientId: string;
     /** Default: dark */
     theme?: 'dark' | 'light';
-    /** `global` (default): theses from every platform. `instance`: only the ones written on your instance (needs clientId). */
+    /** `global` (default): theses from every platform. `instance`: only the ones written on your instance. */
     scope?: 'global' | 'instance';
     /** Initial order. Default: new */
     sort?: 'new' | 'top';
@@ -142,7 +157,7 @@ interface ThesisWidgetOptions {
 }
 /** The widget's data-* attributes for a login button. */
 declare function loginButtonAttributes(o: LoginButtonOptions): Record<string, string | undefined>;
-/** The widget's data-* attributes for a theses widget. */
+/** The widget's data-* attributes for a theses widget. Throws `client_id_required` without `clientId`. */
 declare function thesisWidgetAttributes(o: ThesisWidgetOptions): Record<string, string | undefined>;
 interface WidgetEventHandlers {
     /** A browser-app login finished (window event `csid:login`). */
@@ -174,7 +189,8 @@ declare function mountLoginButton(target: Element | string, options: LoginButton
 }): MountedWidget<LoginButtonOptions>;
 /**
  * Mounts the token theses widget into `target` (an element or a CSS selector).
- * `accessToken` (scope `thesis`) lets the signed-in person write right away.
+ * `clientId` (your instance's public client_id) is required. `accessToken`
+ * (scope `thesis`) lets the signed-in person write right away.
  */
 declare function mountTheses(target: Element | string, options: ThesisWidgetOptions & {
     accessToken?: string | null;
@@ -185,6 +201,21 @@ declare function mountTheses(target: Element | string, options: ThesisWidgetOpti
  * scope `thesis`), or signs them out with `null`.
  */
 declare function setThesisAccessToken(token: string | null, scriptSrc?: string): Promise<void>;
+/**
+ * Lets your page handle the thesis widgets' "Sign in to write": the widget
+ * calls `handler` instead of the page's login button / popup. While a handler
+ * is set, the widget treats the page as the source of truth for sign-in (signed
+ * out on the page = signed out in the widget). `null` removes it. Waits for
+ * widget.js when it is not loaded yet; a no-op on the server.
+ *
+ *   setThesisSignInHandler(async () => {
+ *     const token = await fetch('/api/csid-thesis-token').then((r) => (r.ok ? r.text() : null));
+ *     if (!token) return false;
+ *     await setThesisAccessToken(token);
+ *     return true;
+ *   });
+ */
+declare function setThesisSignInHandler(handler: ThesisSignInHandler | null, scriptSrc?: string): Promise<void>;
 /** Starts the browser (public client) login flow. */
 declare function startLogin(options: {
     clientId: string;
@@ -192,4 +223,4 @@ declare function startLogin(options: {
     scope?: string | OidcScope[];
 }, scriptSrc?: string): Promise<void>;
 
-export { type CSIDGlobal, type CabalSpyIDErrorEvent, type CabalSpyIDLogin, type CabalSpyIDLogoutEvent, type CabalSpyIDUserSummary, type LoginButtonOptions, type MountedWidget, type ThesisWidgetOptions, WIDGET_SRC, type WidgetEventHandlers, audOf, isBrowser, loadCabalSpyIDWidget, loginButtonAttributes, mountLoginButton, mountTheses, onWidgetEvents, setThesisAccessToken, startLogin, thesisWidgetAttributes };
+export { type CSIDGlobal, type CabalSpyIDErrorEvent, type CabalSpyIDLogin, type CabalSpyIDLogoutEvent, type CabalSpyIDUserSummary, type LoginButtonOptions, type MountedWidget, type ThesisSignInHandler, type ThesisWidgetOptions, WIDGET_SRC, type WidgetEventHandlers, audOf, isBrowser, loadCabalSpyIDWidget, loginButtonAttributes, mountLoginButton, mountTheses, onWidgetEvents, setThesisAccessToken, setThesisSignInHandler, startLogin, thesisWidgetAttributes };

package/dist/widget.js

@@ -1,3 +1,7 @@
+import {
+  AuthenticationError
+} from "./chunk-VOTYIQAY.js";
+
 // src/widget.ts
 var WIDGET_SRC = "https://id.cabalspy.xyz/widget.js";
 var isBrowser = () => typeof window !== "undefined" && typeof document !== "undefined";
@@ -66,11 +70,17 @@ function loginButtonAttributes(o) {
   };
 }
 function thesisWidgetAttributes(o) {
+  if (typeof o?.clientId !== "string" || !o.clientId.trim()) {
+    throw new AuthenticationError(
+      "The theses widget needs your instance's public client_id (csid_..., shown in the dashboard next to the API key): { clientId: 'csid_...' }. It is not the API key; never put the API key in a browser.",
+      { code: "client_id_required", parameter: "clientId", docs: "https://docs.cabalspy.xyz/cabalspy-id/errors#client_id_required" }
+    );
+  }
   return {
     "data-csid-thesis": "",
     "data-chain": o.chain,
     "data-mint": o.mint,
-    "data-client-id": o.clientId,
+    "data-client-id": o.clientId.trim(),
     "data-theme": o.theme,
     "data-scope": o.scope,
     "data-sort": o.sort,
@@ -193,6 +203,11 @@ async function setThesisAccessToken(token, scriptSrc) {
   const csid = await loadCabalSpyIDWidget(scriptSrc);
   csid.thesis?.setAccessToken(token);
 }
+async function setThesisSignInHandler(handler, scriptSrc) {
+  if (!isBrowser()) return;
+  const csid = await loadCabalSpyIDWidget(scriptSrc);
+  csid.thesis?.setSignInHandler?.(handler);
+}
 async function startLogin(options, scriptSrc) {
   const csid = await loadCabalSpyIDWidget(scriptSrc);
   await csid.login({
@@ -211,6 +226,7 @@ export {
   mountTheses,
   onWidgetEvents,
   setThesisAccessToken,
+  setThesisSignInHandler,
   startLogin,
   thesisWidgetAttributes
 };