solana-studio 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 752d18d346d95e1960408a04f03b7879bb25f34dfa3851a233e9070db6a1ec4d
-  data.tar.gz: 4d7bcb63da94cb07279077dc525f35a0e11df1e104cad6538d67e15261311ae5
+  metadata.gz: e7dab4511993a7a64ace8ad5319dfe98f8436fba4ed8ce02a086b754df0f6a6c
+  data.tar.gz: 8c95f186599f9d825b58756f8932577801485ebc6e621b9725eb34563c2ffa51
 SHA512:
-  metadata.gz: 2d265a31b6049386a96f286cabd2abd0dbd94520c068cccc5827c58c5b407ee75d95875c20aec7d9bb8893891f6ec26bd02a28acc5d565a6c6efb5378906ee08
-  data.tar.gz: 62a5d328df9adf8f2959bc3137b4d07b7345ca5e83841dcc69f572d84f46b5fe78c62863482a50550a50d916178aefb67a5d14157c85c1eb16d499de4a9fd0d2
+  metadata.gz: 539111d8afe1c593ca295bd37140c0cf9e437a08fff46db02bf87b39706d5187621d7769bd124808c07206823ffd5154f079049b96bc17bd4e748b718b32c0b5
+  data.tar.gz: 22d646247fad4661ad66b020b00034cfebe0c045106e04cf4a5fb9f36a4f558e2415d6d5b5e2d97c7677f85baeed988c1cf00e443adca8064c7905204b40c594

data/README.md

@@ -351,9 +351,11 @@ shipped on exactly these terms.
 
 #### The host JavaScript these modals reach for
 
-Every global below belongs to the **host**. This gem ships one JavaScript file
-(`solana_studio/network_guard.js`) and **no routes at all**, so none of these can
-live here. Each is reached behind a `typeof` guard: an absent one degrades the
+Every global below belongs to the **host**. This gem ships **no routes at all**,
+and the JavaScript it does ship is a different category from the globals below:
+`solana_studio/network_guard.js` plus the redirect-transport primitives
+(`wallet_transport`, `redirect_provider`, `wallet_journal`, `wallet_ops`), none of
+which provide any global in this table. So none of these can live here. Each is reached behind a `typeof` guard: an absent one degrades the
 card rather than breaking it, and the whole point of writing the list down is
 that a consumer meets it here instead of rediscovering it.
 

data/app/assets/javascripts/solana_studio/redirect_provider.js

@@ -0,0 +1,299 @@
+// SolanaStudio.redirectProvider — the redirect transport's provider surface.
+//
+// ONE FACTORY, NOT THREE ADAPTERS, and that is a deliberate call worth defending
+// rather than discovering later. Phantom, Solflare and Backpack all fork the
+// same deeplink spec: identical request parameters, identical payload JSON keys,
+// identical response keys, identical error codes, identical crypto. Every real
+// divergence already lives as data in walletTransport.PROFILES. Three files
+// would therefore be three copies of one algorithm differing by a lookup — and
+// the copies drift, which is the failure this codebase has been bitten by
+// before. So the behaviour is written once and PARAMETERISED by profile, and
+// the per-wallet differences are pinned by per-wallet tests instead.
+//
+// WHAT A REDIRECT PROVIDER CANNOT BE. A promise. `await provider.connect()`
+// works because the page survives the call; here the page is DESTROYED and the
+// answer arrives on a callback URL in a fresh document. So every operation
+// splits in two:
+//
+//   begin<Op>(opts)              → { url, journal }   — caller navigates + persists
+//   complete<Op>(params, journal) → the result        — caller ran the callback
+//
+// This object performs NO navigation and touches NO storage. That is not
+// squeamishness: it is what keeps the whole surface runnable in node, which is
+// how the per-wallet differences are actually asserted rather than hoped for.
+// The caller owns `window.location` and the journal's storage; the intent
+// registry and the resume journal own when and where.
+//
+// THE JOURNAL IS VERSIONED FROM ITS FIRST COMMIT. An old callback meeting a new
+// journal must fail loudly rather than decrypt garbage — this spans three repos
+// with a gem floor between them, and the Gemfile records several rounds of
+// silent failure from exactly that drift. JOURNAL_VERSION is the cheapest
+// insurance in the design.
+(function (W) {
+  'use strict';
+
+  W.SolanaStudio = W.SolanaStudio || {};
+
+  var JOURNAL_VERSION = 1;
+
+  function core() {
+    var t = W.SolanaStudio && W.SolanaStudio.walletTransport;
+    if (!t) throw new Error('SolanaStudio.redirectProvider requires solana_studio/wallet_transport.js');
+    return t;
+  }
+
+  // The journal carries the DAPP's ephemeral secret key, base58. That is the
+  // established shape (turf-monster's deep link already stores phantom_dl_secret
+  // the same way) and it is worth stating why it is safe: this keypair is
+  // generated per connect, exists only to decrypt the wallet's replies to THIS
+  // app, and is not the user's wallet key. It cannot sign, spend, or authorise
+  // anything. Losing it costs one reconnect.
+  //
+  // What must NEVER go in here is anything the wallet signs over or the user
+  // owns — a transaction's bytes, a private key, a session the user did not
+  // establish. The server-side prepared-transaction slug exists precisely so a
+  // transaction never has to travel this way.
+  function newJournal(walletKey, step, extra) {
+    var j = {
+      v: JOURNAL_VERSION,
+      wallet: walletKey,
+      step: step,
+      startedAt: Date.now()
+    };
+    for (var k in extra) {
+      if (Object.prototype.hasOwnProperty.call(extra, k)) j[k] = extra[k];
+    }
+    return j;
+  }
+
+  function requireJournal(journal, expectedStep) {
+    if (!journal) throw new Error('No pending wallet request');
+    if (journal.v !== JOURNAL_VERSION) {
+      // NAMED, and refusing. A version we do not understand is not something to
+      // best-effort our way through — the shared secret would decrypt to
+      // nonsense and the failure would surface somewhere unrelated.
+      throw new Error(
+        'Wallet journal version ' + journal.v + ' is not supported (expected ' +
+        JOURNAL_VERSION + ') — the wallet request was started by a different release'
+      );
+    }
+    if (expectedStep && journal.step !== expectedStep) {
+      throw new Error('Wallet journal is at step ' + journal.step + ', expected ' + expectedStep);
+    }
+    return journal;
+  }
+
+  // Every completion starts here. An error redirect carries NO data and NO
+  // nonce, so a decrypt-first reader turns a clean user rejection into a
+  // decryption exception — which is exactly the class of miscategorised failure
+  // that puts balance advice in front of someone who attempted no transaction.
+  function throwIfWalletError(params) {
+    var err = core().errorFrom(params);
+    if (!err) return;
+    var e = new Error(err.message);
+    e.code = err.code;
+    e.rejected = err.rejected;
+    throw e;
+  }
+
+  function readParam(params, name) {
+    if (!params) return null;
+    return typeof params.get === 'function' ? params.get(name) : params[name];
+  }
+
+  // Re-derive the shared secret from what the journal kept. This is what makes
+  // resume possible at all: the secret itself is binary and never stored, only
+  // the two base58 keys needed to recompute it.
+  function sharedSecretFrom(journal) {
+    var t = core();
+    if (!journal.walletPublicKey) throw new Error('Wallet journal carries no wallet public key — connect first');
+    return t.codec.sharedSecret(journal.walletPublicKey, t.base58.decode(journal.dappSecretKey));
+  }
+
+  function build(walletKey) {
+    var t = core();
+    var p = t.profile(walletKey);
+    if (!p) throw new Error('Unknown wallet: ' + walletKey);
+
+    // A signing request, built once for every method that takes one. The only
+    // thing that varies between signMessage, signTransaction and
+    // signAndSendTransaction is the payload's shape and the method name — the
+    // envelope, the encryption and the journal are identical.
+    function beginSigned(method, step, payloadFields, opts) {
+      if (!t.can(walletKey, method)) {
+        throw new Error(p.name + ' does not support ' + method + ' over the redirect transport');
+      }
+      var journal = requireJournal(opts.journal);
+      var secret = sharedSecretFrom(journal);
+      var payload = { session: journal.session };
+      for (var k in payloadFields) {
+        if (Object.prototype.hasOwnProperty.call(payloadFields, k)) payload[k] = payloadFields[k];
+      }
+      var sealed = t.codec.encrypt(payload, secret);
+      return {
+        url: t.url.method(walletKey, method, {
+          dappPublicKey: journal.dappPublicKey,
+          nonce: sealed.nonce,
+          redirectLink: opts.redirectLink,
+          payload: sealed.payload,
+          useScheme: opts.useScheme
+        }),
+        journal: newJournal(walletKey, step, {
+          dappSecretKey: journal.dappSecretKey,
+          dappPublicKey: journal.dappPublicKey,
+          walletPublicKey: journal.walletPublicKey,
+          session: journal.session,
+          intent: opts.intent || journal.intent || null
+        })
+      };
+    }
+
+    function completeSigned(step, params, journal) {
+      throwIfWalletError(params);
+      requireJournal(journal, step);
+      var data = readParam(params, 'data');
+      var nonce = readParam(params, 'nonce');
+      if (!data || !nonce) throw new Error('Wallet redirect carried no payload');
+      return t.codec.decrypt(data, nonce, sharedSecretFrom(journal));
+    }
+
+    return {
+      name: p.name,
+      key: walletKey,
+      transport: 'redirect',
+      // Exposed per-provider, not only on the module, so a caller holding just a
+      // provider can stamp a journal it builds itself (the supplied-session path
+      // in walletOps does exactly that).
+      JOURNAL_VERSION: JOURNAL_VERSION,
+
+      // The capability gate, per wallet. A caller asks BEFORE it paints a
+      // button — asking after is how a null provider reached .connect().
+      can: function (method) { return t.can(walletKey, method); },
+      supportsCluster: function (cluster) { return t.supportsCluster(walletKey, cluster); },
+      sendStrategy: function () { return t.sendStrategy(walletKey); },
+
+      // --- connect ---------------------------------------------------------
+      // Carries NO nonce and NO payload: the shared secret does not exist yet.
+      // This is the one asymmetry in the protocol and the reason connect cannot
+      // reuse beginSigned.
+      beginConnect: function (opts) {
+        var pair = t.codec.keypair();
+        var dappPublicKey = t.base58.encode(pair.publicKey);
+        return {
+          url: t.url.connect(walletKey, {
+            appUrl: opts.appUrl,
+            dappPublicKey: dappPublicKey,
+            redirectLink: opts.redirectLink,
+            cluster: opts.cluster,
+            useScheme: opts.useScheme
+          }),
+          journal: newJournal(walletKey, 'connect', {
+            dappSecretKey: t.base58.encode(pair.secretKey),
+            dappPublicKey: dappPublicKey,
+            intent: opts.intent || null
+          })
+        };
+      },
+
+      completeConnect: function (params, journal) {
+        throwIfWalletError(params);
+        requireJournal(journal, 'connect');
+        // The one response key that differs between wallets — resolved by the
+        // core so Backpack's documented/placeholder ambiguity lives in one place.
+        var walletPublicKey = t.connectPublicKey(walletKey, params);
+        if (!walletPublicKey) {
+          throw new Error(p.name + ' redirect carried no encryption public key');
+        }
+        var data = readParam(params, 'data');
+        var nonce = readParam(params, 'nonce');
+        if (!data || !nonce) throw new Error('Wallet redirect carried no payload');
+
+        var secret = t.codec.sharedSecret(walletPublicKey, t.base58.decode(journal.dappSecretKey));
+        var decoded = t.codec.decrypt(data, nonce, secret);
+
+        return {
+          publicKey: decoded.public_key,
+          session: decoded.session,
+          // The journal a caller persists to make later signing possible.
+          journal: newJournal(walletKey, 'connected', {
+            dappSecretKey: journal.dappSecretKey,
+            dappPublicKey: journal.dappPublicKey,
+            walletPublicKey: walletPublicKey,
+            session: decoded.session,
+            intent: journal.intent || null
+          })
+        };
+      },
+
+      // --- signMessage -----------------------------------------------------
+      // Sign-in is connect THEN signMessage on every wallet — no vendor ships a
+      // documented signIn deeplink, so there is no one-hop path to prefer here.
+      beginSignMessage: function (opts) {
+        return beginSigned('signMessage', 'signMessage', {
+          message: opts.message,           // base58, per the protocol
+          display: opts.display || 'utf8'
+        }, opts);
+      },
+      completeSignMessage: function (params, journal) {
+        return completeSigned('signMessage', params, journal);
+      },
+
+      // --- signTransaction -------------------------------------------------
+      // The app broadcasts afterwards. On Phantom this is the ONLY path, because
+      // its signAndSendTransaction deeplink is deprecated.
+      beginSignTransaction: function (opts) {
+        return beginSigned('signTransaction', 'signTransaction', {
+          transaction: opts.transaction
+        }, opts);
+      },
+      completeSignTransaction: function (params, journal) {
+        return completeSigned('signTransaction', params, journal);
+      },
+
+      // --- signAndSendTransaction ------------------------------------------
+      // The wallet broadcasts. Refused on Phantom by the capability gate, which
+      // is the point: the deprecation is data, not a special case here.
+      beginSignAndSendTransaction: function (opts) {
+        return beginSigned('signAndSendTransaction', 'signAndSendTransaction', {
+          transaction: opts.transaction,
+          sendOptions: opts.sendOptions
+        }, opts);
+      },
+      completeSignAndSendTransaction: function (params, journal) {
+        return completeSigned('signAndSendTransaction', params, journal);
+      },
+
+      // --- browse ----------------------------------------------------------
+      // The handoff that needs no protocol at all: open the page inside the
+      // wallet's own in-app browser, where the INJECTED provider works and the
+      // existing inline transport runs unchanged. Every wallet that ships this
+      // gets a working mobile path even with no adapter behind it.
+      browseUrl: function (targetUrl, refUrl) {
+        return t.url.browse(walletKey, targetUrl, refUrl);
+      }
+    };
+  }
+
+  W.SolanaStudio.redirectProvider = {
+    JOURNAL_VERSION: JOURNAL_VERSION,
+
+    // Build a provider for one wallet. Returns null for a wallet with no
+    // profile rather than throwing — callers enumerate.
+    forWallet: function (walletKey) {
+      var t = core();
+      return t.profile(walletKey) ? build(String(walletKey).toLowerCase()) : null;
+    },
+
+    // Every wallet reachable over the redirect transport. This is what a picker
+    // enumerates on a phone, and what `detect()` in a consuming app chooses from
+    // when no provider is injected.
+    all: function () {
+      var t = core();
+      var out = [];
+      for (var k in t.PROFILES) {
+        if (Object.prototype.hasOwnProperty.call(t.PROFILES, k)) out.push(build(k));
+      }
+      return out;
+    }
+  };
+})(typeof window !== 'undefined' ? window : globalThis);

data/app/assets/javascripts/solana_studio/wallet_journal.js

@@ -0,0 +1,154 @@
+// SolanaStudio.walletJournal — the only thing that survives the page's death.
+//
+// A redirect destroys the document. Whatever the app needs on the other side has
+// to be written down first, and this is where. Everything else about the
+// redirect transport is pure functions over data; this file is the one place
+// that touches storage, which is why it is small and separately testable.
+//
+// WHY NOT sessionStorage. The wallet round trip leaves the browser entirely and
+// may return in a NEW TAB — iOS in particular does not guarantee the originating
+// tab is what receives a universal link. sessionStorage is per-tab and would be
+// empty exactly when it mattered. localStorage is the only store that survives
+// the trip, which is also why the entries below expire and are single-use.
+//
+// SINGLE-USE, AND EXPIRING, BOTH ON PURPOSE. A journal that lingers is a journal
+// that gets replayed: a user who abandons a signature, wanders off and comes back
+// an hour later should get a clean "start again", not a resumed transaction they
+// have forgotten authorising. `take()` reads and clears in one motion so a
+// double-fired callback cannot advance the same step twice.
+//
+// WHAT MUST NEVER BE WRITTEN HERE, stated positively because the temptation is
+// real: no private keys belonging to the user, no unsigned transaction bytes, no
+// personal data. The dapp's ephemeral encryption secret IS here and is safe —
+// see the note in redirect_provider.js. Transactions stay server-side behind a
+// prepared-transaction slug, which is precisely why that slug exists.
+(function (W) {
+  'use strict';
+
+  W.SolanaStudio = W.SolanaStudio || {};
+
+  var PREFIX = 'wallet_dl';
+  var KEY = PREFIX + '_journal';
+
+  // Ten minutes. Long enough for a human to read a wallet approval screen,
+  // think, and approve; short enough that an abandoned trip is gone before it
+  // can be resumed by accident. Phantom's own nonce guidance is looser than
+  // this, so the tighter bound is ours and deliberate.
+  var MAX_AGE_MS = 10 * 60 * 1000;
+
+  // EVERY access is guarded. localStorage throws outright in a Safari private
+  // window and in some embedded webviews — the exact browsers a mobile wallet
+  // flow runs in. A storage failure must degrade to "no pending request", never
+  // to an exception thrown out of a callback page that then renders nothing.
+  function store() {
+    try {
+      return W.localStorage || null;
+    } catch (e) {
+      return null;
+    }
+  }
+
+  function save(journal) {
+    var s = store();
+    if (!s || !journal) return false;
+    try {
+      s.setItem(KEY, JSON.stringify(journal));
+      return true;
+    } catch (e) {
+      // Quota, private mode, or a disabled store. The caller is about to
+      // navigate to a wallet; telling it the write failed lets it refuse the
+      // trip rather than take one it can never complete.
+      return false;
+    }
+  }
+
+  // Read WITHOUT clearing. For a callback page that wants to inspect before
+  // committing to advancing — the resume path uses take().
+  function peek() {
+    var s = store();
+    if (!s) return null;
+    var raw;
+    try {
+      raw = s.getItem(KEY);
+    } catch (e) {
+      return null;
+    }
+    if (!raw) return null;
+
+    var journal;
+    try {
+      journal = JSON.parse(raw);
+    } catch (e) {
+      // Corrupt entry: drop it rather than leave it to fail every future read.
+      clear();
+      return null;
+    }
+
+    if (!journal || typeof journal !== 'object') { clear(); return null; }
+
+    if (typeof journal.startedAt === 'number' && (Date.now() - journal.startedAt) > MAX_AGE_MS) {
+      // EXPIRED IS NOT AN ERROR, it is an answer. Clearing here means the next
+      // read reports "nothing pending" instead of re-deciding expiry forever.
+      clear();
+      return null;
+    }
+
+    return journal;
+  }
+
+  // Read and clear in one motion. The resume path uses this so a callback that
+  // fires twice — a reload, a back button — cannot advance the same step twice.
+  function take() {
+    var journal = peek();
+    if (journal) clear();
+    return journal;
+  }
+
+  function clear() {
+    var s = store();
+    if (!s) return;
+    try { s.removeItem(KEY); } catch (e) { /* nothing to do and nothing to say */ }
+  }
+
+  // Purge every key this subsystem owns. A host calls this on user switch: a
+  // journal belongs to the person who started it, and one that outlived a logout
+  // would offer to resume a stranger's signature.
+  function purge() {
+    var s = store();
+    if (!s) return;
+    try {
+      var doomed = [];
+      for (var i = 0; i < s.length; i++) {
+        var k = s.key(i);
+        if (k && k.indexOf(PREFIX) === 0) doomed.push(k);
+      }
+      for (var j = 0; j < doomed.length; j++) s.removeItem(doomed[j]);
+    } catch (e) { /* a store we cannot enumerate is a store with nothing to purge */ }
+  }
+
+  W.SolanaStudio.walletJournal = {
+    KEY: KEY,
+    PREFIX: PREFIX,
+    MAX_AGE_MS: MAX_AGE_MS,
+    save: save,
+    peek: peek,
+    take: take,
+    clear: clear,
+    purge: purge,
+    // Whether a journal could be persisted at all. A caller that cannot write
+    // must not start a redirect it will be unable to finish — it should fall
+    // back to the browse handoff, which needs no journal.
+    writable: function () {
+      var s = store();
+      if (!s) return false;
+      try {
+        var probe = PREFIX + '_probe';
+        s.setItem(probe, '1');
+        s.removeItem(probe);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    }
+  };
+})(typeof window !== 'undefined' ? window : globalThis);

data/app/assets/javascripts/solana_studio/wallet_ops.js

@@ -0,0 +1,260 @@
+// SolanaStudio.walletOps — one call site, every platform.
+//
+// THE PROBLEM THIS SOLVES, and it is not "mobile support". It is that the SAME
+// piece of product logic — enter a contest, rename a user, export a wallet — has
+// to run over two transports with incompatible shapes: one where `await` works,
+// and one where the page is destroyed mid-operation. Written per-call-site, that
+// becomes two implementations of every flow, and the mobile one silently rots
+// because nobody exercises it on a laptop.
+//
+// So a flow is declared ONCE, as an intent:
+//
+//   walletOps.define('contest_entry', {
+//     prepare:  function (ctx) { ... return { transaction: <base58>, ...state }; },
+//     complete: function (ctx, result, state) { ... }
+//   });
+//
+//   walletOps.run('contest_entry', { contestId: 12 }, { provider: ... });
+//
+// THE ONE RULE A CALLER MUST FOLLOW: handlers are registered BY NAME at page
+// load, not passed as closures. A closure is precisely what cannot survive the
+// redirect — the page that held it no longer exists when the wallet answers. The
+// name is the only thing that can be written down and looked up again. Every
+// other constraint in this file follows from that one.
+//
+// AND THE CORRESPONDING RULE ON STATE: whatever `prepare` returns must be
+// JSON-serialisable, because on the redirect transport it is literally
+// serialised. This is why the entry flow's server-side prepared-transaction slug
+// matters so much — a slug survives the trip; a Transaction object does not.
+//
+// WHAT THIS FILE DOES NOT DO: it does not broadcast. Signing and sending are
+// different responsibilities with different failure modes, and the wallet that
+// broadcasts differs per vendor (Phantom deprecated its send-side deeplink, so
+// the app sends; Solflare and Backpack send for you). `complete` is told which
+// happened and owns the RPC, exactly as the existing flows already do.
+(function (W) {
+  'use strict';
+
+  W.SolanaStudio = W.SolanaStudio || {};
+
+  var handlers = {};
+
+  function studio() { return W.SolanaStudio; }
+
+  function requireHandler(name) {
+    var h = handlers[name];
+    if (!h) {
+      // NAMED, because the most likely cause is a real and specific bug: a
+      // callback page that did not load the script defining this intent. The
+      // resume then fails here, far from the define() that never ran, and a
+      // generic "not found" sends the reader hunting the journal instead.
+      throw new Error(
+        'No wallet intent registered as "' + name + '" — the page handling this ' +
+        'callback must load the same script that defined it'
+      );
+    }
+    return h;
+  }
+
+  // Default navigation, injectable so the whole surface stays testable in node.
+  function defaultNavigate(url) {
+    W.location.href = url;
+  }
+
+  // --- inline transport ----------------------------------------------------
+  //
+  // The path that already worked: the provider is injected, promises resolve,
+  // nothing is written down. Kept deliberately close to what the existing call
+  // sites do, so adopting walletOps is not also a rewrite of the desktop flow.
+  function runInline(name, ctx, opts) {
+    var handler = requireHandler(name);
+    var provider = opts.provider;
+
+    return Promise.resolve(handler.prepare(ctx)).then(function (prepared) {
+      return Promise.resolve(provider.connect()).then(function () {
+        return provider.signTransaction(prepared.transaction);
+      }).then(function (signed) {
+        return handler.complete(ctx, {
+          signedTransaction: signed,
+          signature: null,
+          sendStrategy: 'app-broadcasts'
+        }, prepared);
+      });
+    });
+  }
+
+  // --- redirect transport --------------------------------------------------
+  //
+  // Two or three hops, each ending in the page's destruction. `run` gets as far
+  // as the first navigation; `resume` picks up whatever the callback carries and
+  // either navigates again or finishes.
+  function runRedirect(name, ctx, opts) {
+    var handler = requireHandler(name);
+    var provider = opts.provider;
+    var journalStore = studio().walletJournal;
+    var navigate = opts.navigate || defaultNavigate;
+
+    // REFUSE EARLY rather than strand the user in their wallet app. Without a
+    // writable store there is nothing to resume from, and the trip would end in
+    // a callback page that finds no pending request and can only apologise.
+    if (!journalStore.writable()) {
+      return Promise.reject(new Error(
+        'This browser cannot store a pending wallet request — open this page in ' +
+        'your wallet app instead'
+      ));
+    }
+
+    return Promise.resolve(handler.prepare(ctx)).then(function (prepared) {
+      var intent = { op: name, ctx: ctx, state: prepared };
+
+      // Already connected? Go straight to signing. Otherwise connect first and
+      // carry the intent through — sessions do not expire on any of the three
+      // wallets, so this branch is taken once per user, not once per action.
+      var existing = opts.session || null;
+      var begun = existing
+        ? beginSigning(provider, intent, existing, opts)
+        : provider.beginConnect({
+            appUrl: opts.appUrl,
+            redirectLink: opts.redirectLink,
+            cluster: opts.cluster,
+            intent: intent
+          });
+
+      if (!journalStore.save(begun.journal)) {
+        return Promise.reject(new Error('Could not record the pending wallet request'));
+      }
+      navigate(begun.url);
+      // Nothing resolves here in a real browser — the page is gone. The value is
+      // for tests and for a caller that wants to know a trip started.
+      return { suspended: true, url: begun.url };
+    });
+  }
+
+  function beginSigning(provider, intent, session, opts) {
+    var connected = {
+      v: provider.JOURNAL_VERSION,
+      step: 'connected'
+    };
+    // A caller supplying its own session hands us the journal fields the connect
+    // hop would have produced. Kept explicit rather than reconstructed, because
+    // guessing them is how a shared secret ends up derived from the wrong key.
+    for (var k in session) {
+      if (Object.prototype.hasOwnProperty.call(session, k)) connected[k] = session[k];
+    }
+    connected.intent = intent;
+    return signingHop(provider, connected, opts);
+  }
+
+  // Which signing method this wallet gets is a CAPABILITY QUESTION, not a
+  // preference: Phantom's send-side deeplink is deprecated, so it signs and the
+  // app broadcasts. Asking the provider keeps that fact in the profile table
+  // where it is asserted, rather than branching on a wallet name here.
+  function signingHop(provider, journal, opts) {
+    var payload = {
+      journal: journal,
+      transaction: journal.intent.state.transaction,
+      redirectLink: opts.redirectLink,
+      intent: journal.intent
+    };
+    return provider.can('signAndSendTransaction')
+      ? provider.beginSignAndSendTransaction(payload)
+      : provider.beginSignTransaction(payload);
+  }
+
+  // Called by the callback page. Reads the pending journal, advances one step,
+  // and either navigates again or hands back the finished result.
+  //
+  // `take()` rather than `peek()` — reading clears, so a reloaded or
+  // double-fired callback cannot advance the same step twice.
+  function resume(params, opts) {
+    opts = opts || {};
+    var journalStore = studio().walletJournal;
+    var navigate = opts.navigate || defaultNavigate;
+
+    var journal = journalStore.take();
+    if (!journal) return Promise.resolve({ pending: false });
+
+    var provider = opts.provider ||
+      studio().redirectProvider.forWallet(journal.wallet);
+    if (!provider) {
+      return Promise.reject(new Error('No provider for wallet "' + journal.wallet + '"'));
+    }
+
+    try {
+      if (journal.step === 'connect') {
+        var connected = provider.completeConnect(params, journal);
+        var intent = connected.journal.intent;
+
+        // Connect with no intent behind it is a plain sign-in: hand the caller
+        // the account and stop. Connect CARRYING an intent immediately takes the
+        // next hop, which is what makes a transaction on a cold session two
+        // navigations rather than two user-initiated attempts.
+        if (!intent) {
+          return Promise.resolve({ pending: true, done: true, connect: connected });
+        }
+
+        var next = signingHop(provider, connected.journal, {
+          redirectLink: opts.redirectLink || journal.redirectLink
+        });
+        if (!journalStore.save(next.journal)) {
+          return Promise.reject(new Error('Could not record the pending wallet request'));
+        }
+        navigate(next.url);
+        return Promise.resolve({ pending: true, suspended: true, url: next.url });
+      }
+
+      if (journal.step === 'signTransaction' || journal.step === 'signAndSendTransaction') {
+        // HANDLER FIRST, BEFORE ANY DECRYPTION. If the intent is not registered
+        // on this page, no amount of successful decryption helps — and a crypto
+        // error surfacing here would send the reader after the shared secret
+        // when the real fault is a script the callback page did not load.
+        var handler = requireHandler(journal.intent && journal.intent.op);
+
+        var wallet = journal.step === 'signAndSendTransaction';
+        var out = wallet
+          ? provider.completeSignAndSendTransaction(params, journal)
+          : provider.completeSignTransaction(params, journal);
+        return Promise.resolve(handler.complete(journal.intent.ctx, {
+          signature: out.signature || null,
+          signedTransaction: out.transaction || null,
+          sendStrategy: wallet ? 'wallet-broadcasts' : 'app-broadcasts'
+        }, journal.intent.state)).then(function (value) {
+          return { pending: true, done: true, value: value };
+        });
+      }
+
+      return Promise.reject(new Error('Unknown wallet journal step: ' + journal.step));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  }
+
+  W.SolanaStudio.walletOps = {
+    define: function (name, handler) {
+      if (!handler || typeof handler.prepare !== 'function' || typeof handler.complete !== 'function') {
+        throw new Error('walletOps.define("' + name + '") needs both prepare and complete');
+      }
+      handlers[name] = handler;
+    },
+
+    defined: function (name) { return !!handlers[name]; },
+    names: function () { return Object.keys(handlers); },
+
+    // Test seam only. Production pages define once at load and never clear.
+    reset: function () { handlers = {}; },
+
+    // The single call site. Chooses the transport from the provider it is given,
+    // so a view never asks what platform it is on.
+    run: function (name, ctx, opts) {
+      opts = opts || {};
+      if (!opts.provider) {
+        return Promise.reject(new Error('walletOps.run needs a provider'));
+      }
+      return opts.provider.transport === 'redirect'
+        ? runRedirect(name, ctx, opts)
+        : runInline(name, ctx, opts);
+    },
+
+    resume: resume
+  };
+})(typeof window !== 'undefined' ? window : globalThis);

data/app/assets/javascripts/solana_studio/wallet_transport.js

@@ -0,0 +1,367 @@
+// SolanaStudio.walletTransport — the REDIRECT transport's shared core.
+//
+// WHY THIS FILE EXISTS. `walletProvider` in the consuming apps models exactly one
+// way of reaching a wallet: an object injected into the page. That is true of a
+// desktop extension and of a wallet's own in-app browser, and it is false of
+// every ordinary mobile browser. On iOS Safari and Android Chrome there is no
+// injected provider, `detect()` returns null, and every call site that reaches
+// for `provider.connect()` throws a null-dereference into a user-facing modal.
+//
+// The second transport is a REDIRECT: the page hands off to the wallet app by
+// URL and the answer comes back on a callback URL, with the original page
+// destroyed in between. A promise cannot survive that, which is the single fact
+// this whole design is shaped around.
+//
+// WHAT THIS FILE IS AND IS NOT. It is the wallet-agnostic HALF: the codec, the
+// per-wallet profile table, and the URL builders. It performs no navigation,
+// touches no localStorage, and knows nothing about intents or resume — those
+// belong to the journal (studio-engine) and the intent registry, which build ON
+// this. Keeping them apart is what lets this half be exercised in node without a
+// browser, which is how its per-wallet differences are actually pinned.
+//
+// THE PROTOCOLS ARE ~95% IDENTICAL, WHICH IS THE WHOLE OPPORTUNITY. Solflare and
+// Backpack both forked Phantom's deeplink spec: same x25519 + nacl.box, same
+// 24-byte nonce, base58 everywhere, byte-identical error tables, identical
+// payload JSON keys, identical response keys. Solflare's own docs even link
+// Phantom's blocklist repo. So the codec below is genuinely shared and only a
+// small profile varies. Verified against all three vendors' live docs
+// 2026-09-07; every divergence is recorded in PROFILES with its reason.
+//
+// ONE DEPENDENCY, AND IT IS GUARDED: window.nacl (tweetnacl). Base58 is INLINE
+// and self-contained on purpose — a previous extraction left B58_ALPHABET behind
+// at module scope where a classic script could not reach it, and every mobile
+// sign-in threw "B58_ALPHABET is not defined" on the first keypair encode. That
+// was invisible to eleven passing view tests and to a browser spec that checked
+// `typeof` without ever CALLING the function. Nothing here reads a free
+// variable it does not declare.
+(function (W) {
+  'use strict';
+
+  W.SolanaStudio = W.SolanaStudio || {};
+
+  var B58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+
+  // CORRECTED DURING EXTRACTION, and deliberately NOT a faithful copy. Both
+  // shipped encoders this was lifted from (turf-monster's deep link and
+  // studio-engine's callback) seed `digits` with [0] and then convert EVERY
+  // byte, including the leading zeros they also emit as '1' separately. For any
+  // input that is entirely zero bytes that yields one character too many —
+  // encode([0]) returns '11', which decodes back to [0, 0] — and encode([])
+  // returns '1' rather than the empty string.
+  //
+  // NOT A LIVE BUG IN EITHER CONSUMER, and worth saying so plainly rather than
+  // overstating the find: the only things they encode are 32-byte x25519 keys
+  // and 24-byte nonces, and an all-zero one of either is not reachable. It is
+  // still wrong, and a shared core that other code will build on should not
+  // carry a round-trip that fails on its simplest input.
+  //
+  // The fix is to count the leading zero bytes, convert only what remains, and
+  // let a zero value contribute no digits at all.
+  function encodeBase58(bytes) {
+    var zeros = 0;
+    while (zeros < bytes.length && bytes[zeros] === 0) zeros++;
+
+    var digits = [];
+    for (var i = zeros; i < bytes.length; i++) {
+      var carry = bytes[i];
+      for (var j = 0; j < digits.length; j++) {
+        carry += digits[j] << 8;
+        digits[j] = carry % 58;
+        carry = (carry / 58) | 0;
+      }
+      while (carry) { digits.push(carry % 58); carry = (carry / 58) | 0; }
+    }
+
+    var str = '';
+    for (var k = 0; k < zeros; k++) str += '1';
+    // The most significant digit of a non-zero number is never 0, so the '1'
+    // characters above stay unambiguously the zero-byte prefix on decode.
+    for (var m = digits.length - 1; m >= 0; m--) str += B58_ALPHABET[digits[m]];
+    return str;
+  }
+
+  function decodeBase58(str) {
+    var bytes = [];
+    for (var i = 0; i < str.length; i++) {
+      var idx = B58_ALPHABET.indexOf(str[i]);
+      if (idx < 0) throw new Error('Invalid base58 character');
+      var carry = idx;
+      for (var j = 0; j < bytes.length; j++) {
+        carry += bytes[j] * 58;
+        bytes[j] = carry & 0xff;
+        carry >>= 8;
+      }
+      while (carry) { bytes.push(carry & 0xff); carry >>= 8; }
+    }
+    for (var k = 0; k < str.length && str[k] === '1'; k++) bytes.push(0);
+    return new Uint8Array(bytes.reverse());
+  }
+
+  // --- Per-wallet profiles -------------------------------------------------
+  //
+  // Everything that is NOT shared. Each field below is a place one vendor
+  // diverged, and each carries why — because the next reader's instinct will be
+  // "these are all the same, collapse them", and four of them are traps.
+  var PROFILES = {
+    phantom: {
+      name: 'Phantom',
+      host: 'https://phantom.app',
+      // Phantom's scheme has NO /ul/ segment. Solflare's does. This is the one
+      // place a "just swap the host" adapter breaks.
+      scheme: 'phantom://v1/',
+      connectKeys: ['phantom_encryption_public_key'],
+      // browse carries NO version segment on Phantom — documented that way, and
+      // different from its own provider methods.
+      browsePath: '/ul/browse/',
+      clusters: ['mainnet-beta', 'testnet', 'devnet'],
+      // DEPRECATED BY PHANTOM: "The signAndSendTransaction deeplink is
+      // deprecated. Use signAllTransactions or signTransaction instead." So on
+      // Phantom the APP still broadcasts — sendRawTransaction + a confirmation
+      // poll stay. This is the opposite of the other two, and it applies to the
+      // wallet most users hold, so it is not an edge case.
+      send: 'app-broadcasts',
+      methods: {
+        connect: true, disconnect: true, signMessage: true,
+        signTransaction: true, signAllTransactions: true,
+        signAndSendTransaction: false, browse: true, signIn: false
+      }
+    },
+
+    solflare: {
+      name: 'Solflare',
+      host: 'https://solflare.com',
+      // KEEPS /ul/ — unlike Phantom. Evidence is Solflare's own sample app; the
+      // scheme form is not documented in prose.
+      scheme: 'solflare://ul/v1/',
+      connectKeys: ['solflare_encryption_public_key'],
+      browsePath: '/ul/v1/browse/',
+      clusters: ['mainnet-beta', 'testnet', 'devnet'],
+      send: 'wallet-broadcasts',
+      methods: {
+        connect: true, disconnect: true, signMessage: true,
+        signTransaction: true, signAllTransactions: true,
+        signAndSendTransaction: true, browse: true, signIn: false
+      }
+    },
+
+    backpack: {
+      name: 'Backpack',
+      host: 'https://backpack.app',
+      // NO custom scheme is documented anywhere in Backpack's corpus — universal
+      // links only. Unlike Phantom there is no scheme fallback, so a caller that
+      // needs one must handle null rather than assume a template.
+      scheme: null,
+      // Backpack's docs CONTRADICT THEMSELVES on this key: its encryption page
+      // says wallet_encryption_public_key, its connect page says `wallet_xxx`,
+      // which reads as an unresolved placeholder. Both are listed so the
+      // resolver tries the documented name first and still works if the
+      // placeholder turns out to be literal. Confirm on a device before trusting
+      // either — this is the highest-risk unknown in the profile table.
+      connectKeys: ['wallet_encryption_public_key', 'wallet_xxx'],
+      browsePath: '/ul/v1/browse/',
+      // DEVNET IS NOT DOCUMENTED for Backpack — its cluster parameter documents
+      // only mainnet-beta (plus an Eclipse chain id). Consumers that test on
+      // devnet cannot currently QA this wallet, which is a lane decision, not a
+      // bug to paper over here. supportsCluster() reports it honestly.
+      clusters: ['mainnet-beta'],
+      send: 'wallet-broadcasts',
+      methods: {
+        connect: true, disconnect: true, signMessage: true,
+        signTransaction: true, signAllTransactions: true,
+        signAndSendTransaction: true, browse: true, signIn: false
+      }
+    }
+  };
+
+  // NO WALLET SHIPS A DOCUMENTED signIn DEEPLINK — every profile above says
+  // false, and that is a measurement, not an oversight. Phantom's 404s in its
+  // docs and exists only in its official demo app, where the payload is base58
+  // PLAINTEXT rather than ciphertext and the response key is `address` or
+  // `public_key` depending on version. Consumers currently depending on that
+  // endpoint are depending on something unspecified. Mobile sign-in is
+  // connect-then-signMessage — two hops — on all three wallets.
+
+  function key(wallet) {
+    return String(wallet == null ? '' : wallet).toLowerCase();
+  }
+
+  function profile(wallet) {
+    return PROFILES[key(wallet)] || null;
+  }
+
+  // Can THIS wallet do THIS method over the redirect transport?
+  //
+  // The capability question is the one that prevents this whole bug class: a
+  // button that renders without asking is how a null provider reached
+  // `.connect()` in the first place. An unknown wallet answers false rather
+  // than throwing — a caller asking about a wallet we have never heard of
+  // wants "no", not an exception.
+  function can(wallet, method) {
+    var p = profile(wallet);
+    return !!(p && p.methods[method] === true);
+  }
+
+  function supportsCluster(wallet, cluster) {
+    var p = profile(wallet);
+    return !!(p && p.clusters.indexOf(String(cluster)) !== -1);
+  }
+
+  // Which side broadcasts a signed transaction for this wallet.
+  // 'app-broadcasts'    → sign only, then the app sends and confirms (Phantom)
+  // 'wallet-broadcasts' → signAndSendTransaction returns a signature
+  function sendStrategy(wallet) {
+    var p = profile(wallet);
+    return p ? p.send : null;
+  }
+
+  // Pull the wallet's encryption public key out of the connect redirect's query
+  // params. This is the ONLY response key that differs between wallets, which is
+  // exactly why it is resolved here instead of at call sites.
+  //
+  // `params` is anything with a .get (URLSearchParams, or a plain-object shim).
+  function connectPublicKey(wallet, params) {
+    var p = profile(wallet);
+    if (!p || !params) return null;
+    var get = typeof params.get === 'function'
+      ? function (k) { return params.get(k); }
+      : function (k) { return params[k]; };
+    for (var i = 0; i < p.connectKeys.length; i++) {
+      var v = get(p.connectKeys[i]);
+      if (v) return v;
+    }
+    return null;
+  }
+
+  // --- Codec ---------------------------------------------------------------
+  //
+  // Shared by all three wallets without variation. Throws a NAMED error when
+  // nacl is absent rather than a bare TypeError on `nacl.box` — the whole point
+  // of a guarded dependency is that its absence reads as itself.
+  function nacl() {
+    if (!W.nacl) throw new Error('SolanaStudio.walletTransport requires tweetnacl (window.nacl)');
+    return W.nacl;
+  }
+
+  var codec = {
+    keypair: function () { return nacl().box.keyPair(); },
+
+    sharedSecret: function (walletPublicKeyB58, dappSecretKey) {
+      return nacl().box.before(decodeBase58(walletPublicKeyB58), dappSecretKey);
+    },
+
+    // Returns the two halves a request needs, both base58, ready to be query
+    // params. The nonce is fresh per request — reusing one across requests under
+    // the same shared secret is a real break, not a style preference.
+    encrypt: function (payloadObject, sharedSecret) {
+      var n = nacl();
+      var nonce = n.randomBytes(24);
+      var bytes = new TextEncoder().encode(JSON.stringify(payloadObject));
+      return {
+        nonce: encodeBase58(nonce),
+        payload: encodeBase58(n.box.after(bytes, nonce, sharedSecret))
+      };
+    },
+
+    decrypt: function (dataB58, nonceB58, sharedSecret) {
+      var opened = nacl().box.open.after(
+        decodeBase58(dataB58), decodeBase58(nonceB58), sharedSecret
+      );
+      if (!opened) throw new Error('Decryption failed — wrong shared secret or corrupt payload');
+      return JSON.parse(new TextDecoder().decode(opened));
+    }
+  };
+
+  // --- URL builders --------------------------------------------------------
+  function base(wallet, useScheme) {
+    var p = profile(wallet);
+    if (!p) throw new Error('Unknown wallet: ' + wallet);
+    // A caller may ASK for the scheme and not get it — Backpack documents none.
+    // Falling back to the universal link is correct and silent here; refusing
+    // would strand a caller that has a perfectly good link available.
+    if (useScheme && p.scheme) return { profile: p, prefix: p.scheme };
+    return { profile: p, prefix: p.host + '/ul/v1/' };
+  }
+
+  function query(pairs) {
+    var parts = [];
+    for (var k in pairs) {
+      if (!Object.prototype.hasOwnProperty.call(pairs, k)) continue;
+      if (pairs[k] === null || pairs[k] === undefined || pairs[k] === '') continue;
+      parts.push(encodeURIComponent(k) + '=' + encodeURIComponent(pairs[k]));
+    }
+    return parts.join('&');
+  }
+
+  var url = {
+    // connect carries NO nonce and NO payload — the shared secret does not exist
+    // yet. Every other method requires both.
+    connect: function (wallet, opts) {
+      var b = base(wallet, opts && opts.useScheme);
+      return b.prefix + 'connect?' + query({
+        app_url: opts.appUrl,
+        dapp_encryption_public_key: opts.dappPublicKey,
+        redirect_link: opts.redirectLink,
+        cluster: opts.cluster
+      });
+    },
+
+    method: function (wallet, method, opts) {
+      if (!can(wallet, method)) {
+        throw new Error(wallet + ' does not support ' + method + ' over the redirect transport');
+      }
+      var b = base(wallet, opts && opts.useScheme);
+      return b.prefix + method + '?' + query({
+        dapp_encryption_public_key: opts.dappPublicKey,
+        nonce: opts.nonce,
+        redirect_link: opts.redirectLink,
+        payload: opts.payload
+      });
+    },
+
+    // The tier-3 handoff: open a page inside the wallet's own in-app browser,
+    // where the INJECTED provider works and the existing inline transport needs
+    // no changes at all. The target is a PATH segment, not a query param, and
+    // the version segment differs per wallet — both encoded in browsePath.
+    browse: function (wallet, targetUrl, refUrl) {
+      var p = profile(wallet);
+      if (!p) throw new Error('Unknown wallet: ' + wallet);
+      if (!can(wallet, 'browse')) throw new Error(p.name + ' has no browse deeplink');
+      return p.host + p.browsePath + encodeURIComponent(targetUrl) +
+             '?' + query({ ref: refUrl });
+    }
+  };
+
+  // Error redirects are IDENTICAL across all three wallets, codes included, so
+  // this needs no per-wallet branch. Read it BEFORE attempting any decryption:
+  // an error redirect carries no `data` and no `nonce`, so a decrypt-first
+  // reader turns a clean user rejection into a decryption exception.
+  var USER_REJECTED = '4001';
+
+  function errorFrom(params) {
+    if (!params) return null;
+    var get = typeof params.get === 'function'
+      ? function (k) { return params.get(k); }
+      : function (k) { return params[k]; };
+    var code = get('errorCode');
+    if (!code) return null;
+    return {
+      code: String(code),
+      message: get('errorMessage') || 'Wallet request failed',
+      rejected: String(code) === USER_REJECTED
+    };
+  }
+
+  W.SolanaStudio.walletTransport = {
+    PROFILES: PROFILES,
+    profile: profile,
+    can: can,
+    supportsCluster: supportsCluster,
+    sendStrategy: sendStrategy,
+    connectPublicKey: connectPublicKey,
+    errorFrom: errorFrom,
+    USER_REJECTED: USER_REJECTED,
+    base58: { encode: encodeBase58, decode: decodeBase58 },
+    codec: codec,
+    url: url
+  };
+})(typeof window !== 'undefined' ? window : globalThis);

data/app/views/solana_studio/modals/_wallet_connect.html.erb

@@ -77,9 +77,10 @@
                          calls window.startPhantomDeepLink(linkMode, userId).
     onBack()             the Back button; DEFAULT closes the modal
 
-  CONTRACT WITH THE HOST'S JS. This gem ships one JavaScript file
-  (solana_studio/network_guard.js) and no routes at all, so every global below is
-  the HOST'S to provide. Each is reached behind a `typeof` guard, and an absent
+  CONTRACT WITH THE HOST'S JS. This gem ships no routes at all, and the JavaScript
+  it does ship provides no global in this list: solana_studio/network_guard.js
+  plus the redirect-transport primitives (wallet_transport, redirect_provider,
+  wallet_journal, wallet_ops). So every global below is the HOST'S to provide. Each is reached behind a `typeof` guard, and an absent
   one degrades this card rather than breaking it — which is the whole reason the
   list is written down here instead of being rediscovered per consumer.
 
@@ -194,9 +195,25 @@
        // SECOND Phantom row pointing at a desktop download page the user
        // cannot act on. ONLY when a deep link can replace it: with no deep
        // link the install row is the only Phantom path there is, dead end on
-       // iOS or not, and removing it leaves the user nothing. Solflare and
-       // Backpack keep their install rows either way — there is no deep link
-       // for them, so the download page is still their only path.
+       // iOS or not, and removing it leaves the user nothing.
+       //
+       // SOLFLARE AND BACKPACK STILL GET INSTALL ROWS HERE, and the reason is NOT
+       // the one this comment used to give. It claimed there was no deep link for
+       // them, which is FALSE and was costing those users: verified against both
+       // vendors' docs 2026-09-07, Solflare (solflare.com/ul/v1) and Backpack
+       // (backpack.app/ul/v1) each ship a full deeplink protocol, forked from
+       // Phantom's and sharing its encryption scheme and parameter names. So on a
+       // phone this row hands them a DESKTOP EXTENSION download page — a silent
+       // dead end, with no error, for a wallet that could have worked.
+       //
+       // What is actually missing is on OUR side: canDeepLink below asks whether
+       // ONE Phantom-specific global exists, so no other wallet can answer yes.
+       // solana_studio/redirect_provider.js now knows all three, and rewiring
+       // these three getters to ask it is the fix. Deliberately NOT done in the
+       // change that added that file: these getters are pinned by exact-source
+       // assertions in test/views/wallet_connect_picker_test.rb, and rewriting
+       // those belongs with the behaviour change rather than riding along with
+       // new primitives.
        get missingInstalls() {
          var self = this;
          return this.installs.filter(function(i) {

data/lib/solana_studio/engine.rb

@@ -30,6 +30,10 @@ module SolanaStudio
 
       app.config.assets.precompile += %w[
         solana_studio/network_guard.js
+        solana_studio/wallet_transport.js
+        solana_studio/redirect_provider.js
+        solana_studio/wallet_journal.js
+        solana_studio/wallet_ops.js
       ]
     end
   end

data/lib/solana_studio/version.rb

@@ -16,5 +16,5 @@ module SolanaStudio
   # through the normal cycle. Splitting the version out is the same shape
   # studio-engine already uses (lib/studio/version.rb) and hands each file back
   # to its real owner: this one to the release, the gemspec to the PR.
-  VERSION = "0.7.0"
+  VERSION = "0.8.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solana-studio
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-07 00:00:00.000000000 Z
+date: 2026-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ed25519
@@ -38,6 +38,10 @@ files:
 - LICENSE
 - README.md
 - app/assets/javascripts/solana_studio/network_guard.js
+- app/assets/javascripts/solana_studio/redirect_provider.js
+- app/assets/javascripts/solana_studio/wallet_journal.js
+- app/assets/javascripts/solana_studio/wallet_ops.js
+- app/assets/javascripts/solana_studio/wallet_transport.js
 - app/views/solana_studio/_deeplink_assets.html.erb
 - app/views/solana_studio/_phantom_deeplink.html.erb
 - app/views/solana_studio/auth/_wallet_credential.html.erb