{"_id":"@canton-network/core-origin-manager","_rev":"5-c4cc242caf658085548e99be91bd7773","name":"@canton-network/core-origin-manager","dist-tags":{"latest":"1.4.0"},"versions":{"1.1.0":{"name":"@canton-network/core-origin-manager","version":"1.1.0","author":"Mateusz Piątkowski ","license":"Apache-2.0","_id":"@canton-network/core-origin-manager@1.1.0","maintainers":[{"name":"ov4_da","email":"oscar.valle@digitalasset.com"},{"name":"cantonfoundation","email":"amanda@canton.foundation"},{"name":"nycnewman","email":"edward@digitalasset.com"},{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},{"name":"asangeethada","email":"abhi.sangeetha@digitalasset.com"}],"homepage":"https://github.com/canton-network/wallet/tree/main/core/origin-manager#readme","bugs":{"url":"https://github.com/canton-network/wallet/issues"},"dist":{"shasum":"37e24aa6bcae1821365ffb4a77c16b22503eb324","tarball":"https://registry.npmjs.org/@canton-network/core-origin-manager/-/core-origin-manager-1.1.0.tgz","fileCount":13,"integrity":"sha512-9cLOgS/6UQ3VoHtrl9wjBevcWe1eh+6g3xHfDkfeUJ59Udo0uYQZaxj3KxHE69erEKUsmjM+vU5zDCYDdCt+qA==","signatures":[{"sig":"MEQCIBL1YfMVeWCeua9NhJ3+aILVjrEfC67M8ElHBST3hY6sAiAcfUabjkPwQsevYy3cMmJfVZuWsY5UajskJPFs8H5MRw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":51766},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"test":"vitest run --project node --project browser","build":"tsdown --onSuccess \"tsc\"","clean":"tsc -b --clean; rm -rf dist","flatpack":"yarn pack --out \"$FLATPACK_OUTDIR\"","test:coverage":"vitest run --project node --project browser --coverage"},"_npmUser":{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},"repository":{"url":"git+https://github.com/canton-network/wallet.git","type":"git","directory":"core/origin-manager"},"description":"Secure cross-window origin handshake and guarded postMessage helpers.","directories":{},"_nodeVersion":"26.0.0","dependencies":{"tsx":"^4.23.1","zod":"^4.4.3","tsdown":"^0.22.14"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vite":"^8.1.5","vitest":"^4.1.10","typescript":"^5.7.2","vite-plugin-dts":"^5.0.3","@vitest/coverage-v8":"^4.1.10","@vitest/browser-playwright":"^4.1.10"},"_npmOperationalInternal":{"tmp":"tmp/core-origin-manager_1.1.0_1787072818219_0.964941774362331","host":"s3://npm-registry-packages-npm-production"}},"1.2.0":{"name":"@canton-network/core-origin-manager","version":"1.2.0","author":"Mateusz Piątkowski ","license":"Apache-2.0","_id":"@canton-network/core-origin-manager@1.2.0","maintainers":[{"name":"ov4_da","email":"oscar.valle@digitalasset.com"},{"name":"cantonfoundation","email":"amanda@canton.foundation"},{"name":"nycnewman","email":"edward@digitalasset.com"},{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},{"name":"asangeethada","email":"abhi.sangeetha@digitalasset.com"}],"homepage":"https://github.com/canton-network/wallet/tree/main/core/origin-manager#readme","bugs":{"url":"https://github.com/canton-network/wallet/issues"},"dist":{"shasum":"bcd3ce0be526c45c9287405b587aff08c1623996","tarball":"https://registry.npmjs.org/@canton-network/core-origin-manager/-/core-origin-manager-1.2.0.tgz","fileCount":13,"integrity":"sha512-4tXGtgcw0umBluV9M3tEHSY9tsUJi4rO3rp8KOFMucmu5yg3sLs3fZxJp+Up4UU+44xAxoFiybGhTZgpeNQEjw==","signatures":[{"sig":"MEUCIQCmZswO8eD3pmwuOhaqLJY7vJdxFbj1UjDuoeVp50TKAwIgE6ggB7rhqliD1kF4zI1FtvjAV8KtnBN2WiVh+eO+L1M=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":51766},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"test":"vitest run --project node --project browser","build":"tsdown --onSuccess \"tsc\"","clean":"tsc -b --clean; rm -rf dist","flatpack":"yarn pack --out \"$FLATPACK_OUTDIR\"","test:coverage":"vitest run --project node --project browser --coverage"},"_npmUser":{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},"repository":{"url":"git+https://github.com/canton-network/wallet.git","type":"git","directory":"core/origin-manager"},"description":"Secure cross-window origin handshake and guarded postMessage helpers.","directories":{},"_nodeVersion":"26.0.0","dependencies":{"tsx":"^4.23.1","zod":"^4.4.3","tsdown":"^0.22.14"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vite":"^8.1.5","vitest":"^4.1.10","typescript":"^5.7.2","vite-plugin-dts":"^5.0.3","@vitest/coverage-v8":"^4.1.10","@vitest/browser-playwright":"^4.1.10"},"_npmOperationalInternal":{"tmp":"tmp/core-origin-manager_1.2.0_1788288001749_0.12541061074422744","host":"s3://npm-registry-packages-npm-production"}},"1.3.0":{"name":"@canton-network/core-origin-manager","version":"1.3.0","author":"Mateusz Piątkowski ","license":"Apache-2.0","_id":"@canton-network/core-origin-manager@1.3.0","maintainers":[{"name":"ov4_da","email":"oscar.valle@digitalasset.com"},{"name":"cantonfoundation","email":"amanda@canton.foundation"},{"name":"nycnewman","email":"edward@digitalasset.com"},{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},{"name":"asangeethada","email":"abhi.sangeetha@digitalasset.com"}],"homepage":"https://github.com/canton-network/wallet/tree/main/core/origin-manager#readme","bugs":{"url":"https://github.com/canton-network/wallet/issues"},"dist":{"shasum":"7cc65c10791d90bc5b2c059693cc886c526ba2c1","tarball":"https://registry.npmjs.org/@canton-network/core-origin-manager/-/core-origin-manager-1.3.0.tgz","fileCount":13,"integrity":"sha512-L3mmYgp3BGYmlh91lYfTRhcjBdlLtXe+jIYHAS6hKakd10JwyPYsLcaEVjRCP+DIHwqCloWU8h4P4Nwx2UHvHg==","signatures":[{"sig":"MEUCIQCC3BQU7EGgHu5L0CeZFwO438O23Iy/bT1nj2tk3+WpmwIgMkFS3meAVj3M1K0Io5N1k9W4UgPa3+VFpHW+41BtS98=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":51766},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"test":"vitest run --project node --project browser","build":"tsdown --onSuccess \"tsc\"","clean":"tsc -b --clean; rm -rf dist","flatpack":"yarn pack --out \"$FLATPACK_OUTDIR\"","test:coverage":"vitest run --project node --project browser --coverage"},"_npmUser":{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},"repository":{"url":"git+https://github.com/canton-network/wallet.git","type":"git","directory":"core/origin-manager"},"description":"Secure cross-window origin handshake and guarded postMessage helpers.","directories":{},"_nodeVersion":"26.0.0","dependencies":{"tsx":"^4.23.1","zod":"^4.4.3","tsdown":"^0.22.14"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vite":"^8.1.5","vitest":"^4.1.10","typescript":"^5.7.2","vite-plugin-dts":"^5.0.3","@vitest/coverage-v8":"^4.1.10","@vitest/browser-playwright":"^4.1.10"},"_npmOperationalInternal":{"tmp":"tmp/core-origin-manager_1.3.0_1788992818341_0.5841200497923313","host":"s3://npm-registry-packages-npm-production"}},"1.3.1":{"name":"@canton-network/core-origin-manager","version":"1.3.1","author":"Mateusz Piątkowski ","license":"Apache-2.0","_id":"@canton-network/core-origin-manager@1.3.1","maintainers":[{"name":"ov4_da","email":"oscar.valle@digitalasset.com"},{"name":"cantonfoundation","email":"amanda@canton.foundation"},{"name":"nycnewman","email":"edward@digitalasset.com"},{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},{"name":"asangeethada","email":"abhi.sangeetha@digitalasset.com"}],"homepage":"https://github.com/canton-network/wallet/tree/main/core/origin-manager#readme","bugs":{"url":"https://github.com/canton-network/wallet/issues"},"dist":{"shasum":"5834f3c5f2749cededc47c9e42113d490664df36","tarball":"https://registry.npmjs.org/@canton-network/core-origin-manager/-/core-origin-manager-1.3.1.tgz","fileCount":13,"integrity":"sha512-b3JB8K7tH/c49EkX47rO6zm5FZabddjCf7ZfedHS6wo7n9on1BtVl6CciXFSOFa/6WKS+HUTq3GRPlll1cIXhQ==","signatures":[{"sig":"MEYCIQClIUbXs4vuOZ84w8RI9Q/Do3L5c5X+hV4K45Fua666hwIhAKOpKLDK67HqG5D/QSZoopHcvKZlzGGnu2Ksjv+cB3MO","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIH+cOFCCiFFaqJZQyruWsY/YoHSW+WQ7nVpZ7tymMloTAiEAi98/W8WJOcDz9T/RI2iERzjFG2votzNhtohDjn+2bcU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":51766},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"test":"vitest run --project node --project browser","build":"tsdown --onSuccess \"tsc\"","clean":"tsc -b --clean; rm -rf dist","flatpack":"yarn pack --out \"$FLATPACK_OUTDIR\"","test:coverage":"vitest run --project node --project browser --coverage"},"_npmUser":{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},"repository":{"url":"git+https://github.com/canton-network/wallet.git","type":"git","directory":"core/origin-manager"},"description":"Secure cross-window origin handshake and guarded postMessage helpers.","directories":{},"dependencies":{"tsx":"^4.23.1","zod":"^4.4.3","tsdown":"^0.22.14"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vite":"^8.1.5","vitest":"^4.1.11","typescript":"^5.7.2","vite-plugin-dts":"^5.0.3","@vitest/coverage-v8":"^4.1.11","@vitest/browser-playwright":"^4.1.11"},"_npmOperationalInternal":{"tmp":"tmp/core-origin-manager_1.3.1_1789650858065_0.38737195859873297","host":"s3://npm-registry-packages-npm-production"}},"1.4.0":{"_id":"@canton-network/core-origin-manager@1.4.0","bugs":{"url":"https://github.com/canton-network/wallet/issues"},"dist":{"shasum":"89ab1a45979300302cfe0841c15201de8ae75dda","tarball":"https://registry.npmjs.org/@canton-network/core-origin-manager/-/core-origin-manager-1.4.0.tgz","fileCount":13,"integrity":"sha512-E/X2eMUVnqtDl2dqwRbTp0KA+n+k0B2XLOgoloiz9vRkLJUXCdGyE0q0Cvw4mlzl1hj3CPO6ZNWDHPUzF3ELlw==","signatures":[{"sig":"MEUCIGrd43BiSV0Gw+FOg6DFffxJiLpfqrDtbUfnmmeUJDuzAiEA6befVH6YScCljPdfVUgB1zfMlwu8huqliAJweYETEyQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIDUa5BwihqyZNwYxh7+XZd9LwDoEc45/ZszilL9PbkERAiAWtVUDhsVMpNp916/vZC3mtDhpWe419kekip7BpYFUKw=="}],"unpackedSize":51762},"main":"./dist/index.cjs","name":"@canton-network/core-origin-manager","type":"module","types":"./dist/index.d.ts","author":"Mateusz Piątkowski ","module":"./dist/index.js","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","default":"./dist/index.js","require":"./dist/index.cjs"}},"license":"Apache-2.0","scripts":{"test":"vitest run --project node --project browser","build":"tsdown --onSuccess \"tsc\"","clean":"tsc -b --clean; rm -rf dist","flatpack":"yarn pack --out \"$FLATPACK_OUTDIR\"","test:coverage":"vitest run --project node --project browser --coverage"},"version":"1.4.0","_npmUser":{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},"homepage":"https://github.com/canton-network/wallet/tree/main/core/origin-manager#readme","repository":{"url":"git+https://github.com/canton-network/wallet.git","type":"git","directory":"core/origin-manager"},"description":"Secure cross-window origin handshake and guarded postMessage helpers.","directories":{},"maintainers":[{"name":"ov4_da","email":"oscar.valle@digitalasset.com"},{"name":"cantonfoundation","email":"amanda@canton.foundation"},{"name":"nycnewman","email":"edward@digitalasset.com"},{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},{"name":"asangeethada","email":"abhi.sangeetha@digitalasset.com"}],"dependencies":{"tsx":"^4.23.0","zod":"^4.4.3","tsdown":"^0.22.9"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vite":"^7.3.6","vitest":"^5.0.1","typescript":"^5.9.3","vite-plugin-dts":"^5.0.3","@vitest/coverage-v8":"^5.0.1","@vitest/browser-playwright":"^5.0.1"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/core-origin-manager_1.4.0_1790781028350_0.6570236151195483"}}},"time":{"created":"2026-08-18T17:06:57.913Z","modified":"2026-09-30T15:10:28.607Z","1.1.0":"2026-08-18T17:06:58.391Z","1.2.0":"2026-09-01T18:40:01.900Z","1.3.0":"2026-09-09T22:26:58.506Z","1.3.1":"2026-09-17T13:14:18.155Z","1.4.0":"2026-09-30T15:10:28.444Z"},"bugs":{"url":"https://github.com/canton-network/wallet/issues"},"author":"Mateusz Piątkowski ","license":"Apache-2.0","homepage":"https://github.com/canton-network/wallet/tree/main/core/origin-manager#readme","repository":{"url":"git+https://github.com/canton-network/wallet.git","type":"git","directory":"core/origin-manager"},"description":"Secure cross-window origin handshake and guarded postMessage helpers.","maintainers":[{"name":"ov4_da","email":"oscar.valle@digitalasset.com"},{"name":"cantonfoundation","email":"amanda@canton.foundation"},{"name":"nycnewman","email":"edward@digitalasset.com"},{"name":"alexmatson-da","email":"alex.matson@digitalasset.com"},{"name":"asangeethada","email":"abhi.sangeetha@digitalasset.com"}],"readme":"# @canton-network/core-origin-manager\n\nThis package provides a secure cross-window communication mechanism for verifying the origin of messages in a browser environment. It implements a handshake protocol to validate and track allowed origins before permitting inter-window communication.\n\n## Installation\n\n```sh\npnpm add @canton-network/core-origin-manager\n```\n\n## Overview\n\nThe origin-check package provides origin validation for secure cross-window communication in browser applications. It uses a bidirectional handshake protocol to establish trust between parent and child windows before allowing message passing.\n\n## Handshake flow\n\n1. Parent starts polling a known child origin with `SPLICE_WALLET_BROADCAST_ORIGIN`.\n2. Child validates the message, allowlists the parent, replies with `SPLICE_WALLET_BROADCAST_ORIGIN_ACK` via `window.opener`, then stops listening.\n3. Parent allowlists the child and stops polling.\n4. Both sides only send application messages to origins that completed the handshake.\n\n```mermaid\nsequenceDiagram\n participant Parent as Parent window
(ParentWindowOriginManager)\n participant Child as Child popup
(ChildWindowOriginManager)\n\n Note over Parent,Child: Setup\n Parent->>Parent: addEventListener(\"message\")\n Child->>Child: addEventListener(\"message\")\n Parent->>Parent: poll(childOrigin) every 500ms\n\n Note over Parent,Child: Handshake\n loop Until ACK received\n Parent->>Child: postMessage({ message: SPLICE_WALLET_BROADCAST_ORIGIN, origin: parentOrigin }, childOrigin)\n end\n\n Child->>Child: Zod-parse + check event.origin matches payload.origin\n Child->>Child: allowedOrigins.add(parentOrigin)\n Child->>Parent: opener.postMessage({ message: SPLICE_WALLET_BROADCAST_ORIGIN_ACK, origin: childOrigin }, parentOrigin)\n Child->>Child: removeListener()\n\n Parent->>Parent: Zod-parse + check event.origin matches payload.origin\n Parent->>Parent: allowedOrigins.add(childOrigin)\n Parent->>Parent: clearInterval(poll)\n\n Note over Parent,Child: After handshake\n Parent->>Child: postMessage(appData, childOrigin)
only if assert(childOrigin)\n Child->>Parent: opener.postMessage(appData, parentOrigin)
only if assert(parentOrigin)\n```\n\n## Key Components\n\n### [OriginHandshake](./src/types.ts)\n\nA Zod-validated schema defining the structure of origin handshake messages. Contains:\n\n- `message`: The type of handshake message (`SPLICE_WALLET_BROADCAST_ORIGIN` or `SPLICE_WALLET_BROADCAST_ORIGIN_ACK`)\n- `origin`: The origin string being communicated\n\n### [OriginManager](./src/manager.ts)\n\nAbstract base class that manages origin validation through a message-based handshake protocol. Provides:\n\n- Automatic listener registration for `window.message` events\n- Origin allowlist management\n- Message validation using Zod schemas\n- `assert(origin)`: Check if an origin is allowed\n- `postMessage(message, origin)`: Send a message to an allowed origin (safely validates origin first)\n- `removeListener()`: Clean up the message event listener\n\n### [ParentWindowOriginManager](./src/manager.ts)\n\nExtends `OriginManager` for use in parent windows. Features:\n\n- `postMessage(message, origin)`: Send a message to the child window (only succeeds if handshake completed). Initiates polling to establish connection with a child window for the first time.\n- Automatically clears polling intervals upon successful handshake\n\n### [ChildWindowOriginManager](./src/manager.ts)\n\nExtends `OriginManager` for use in child windows. Features:\n\n- Constructor accepts an optional `parentWindow` parameter (defaults to `window.opener`)\n- `postMessage(message)`: Send a message to the parent window (only succeeds if handshake completed and parentWindow exists)\n- Automatic handshake acknowledgment when receiving origin broadcasts\n- Cleans up listeners after successful handshake\n\n## Usage\n\n### Parent Window Example\n\n```typescript\nimport { ParentWindowOriginManager } from '@canton-network/core-origin-check'\n\n// Create a manager instance\nconst originManager = new ParentWindowOriginManager()\n\n// Send a message using the safe postMessage method\n// This will initiate polling if connection is not established,\n// and send the message once the handshake is complete\nconst childOrigin = 'https://child.example.com'\noriginManager.postMessage({ type: 'greeting', data: 'hello' }, childOrigin)\n\n// Or manually check before sending\nif (originManager.assert(childOrigin)) {\n window.postMessage(data, childOrigin)\n}\n```\n\n### Child Window Example\n\n```typescript\nimport { ChildWindowOriginManager } from '@canton-network/core-origin-check'\n\n// Create a manager instance with optional parent window parameter\nconst originManager = new ChildWindowOriginManager()\n// or specify a parent window explicitly:\n// const originManager = new ChildWindowOriginManager(parentWindow)\n\n// The handshake is automatic; once complete, listener is removed\n\n// Send a message using the safe postMessage method\n// This will only succeed if the handshake is complete and parent window exists\noriginManager.postMessage({ type: 'response', data: 'world' })\n```\n\n## Security Considerations\n\n- Always validate origins before posting messages across window boundaries\n- The handshake protocol ensures that both sides confirm the other's origin\n- Use `postMessage()` method to automatically validate origins before sending\n- The `assert()` method checks if an origin has completed the handshake\n- Attempting `postMessage()` to an unapproved origin will silently fail\n- Call `removeListener()` to clean up event listeners when done\n","readmeFilename":""}