solana-studio 0.8.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7dab4511993a7a64ace8ad5319dfe98f8436fba4ed8ce02a086b754df0f6a6c
-  data.tar.gz: 8c95f186599f9d825b58756f8932577801485ebc6e621b9725eb34563c2ffa51
+  metadata.gz: a00c3f09eb98073668c9218045e49e705be6e803348ad9338e4295d32ca7c091
+  data.tar.gz: 16189d3a834e1880bbba0b37113823fdf95d4a690926d98f67120213818b70db
 SHA512:
-  metadata.gz: 539111d8afe1c593ca295bd37140c0cf9e437a08fff46db02bf87b39706d5187621d7769bd124808c07206823ffd5154f079049b96bc17bd4e748b718b32c0b5
-  data.tar.gz: 22d646247fad4661ad66b020b00034cfebe0c045106e04cf4a5fb9f36a4f558e2415d6d5b5e2d97c7677f85baeed988c1cf00e443adca8064c7905204b40c594
+  metadata.gz: 43e0a031a5fb9c2bcb451c4bddcf2df0e79a1c1722c60e57e9fcd302699434736bf363dd12a6f1ee7f847f447a1b3aeb792e557a7874edc419714a66a9a8b094
+  data.tar.gz: 8613a4f8bcead4253fb9b1814b1fbb008d9d1f9c3db4e1e8be33b5ca5fc005ce2b7b4226f136454a52f4ef66ccec59c22cf968d6f78762558e51355a2e2de056

data/app/assets/javascripts/solana_studio/wallet_ops.js

@@ -11,11 +11,22 @@
 //
 //   walletOps.define('contest_entry', {
 //     prepare:  function (ctx) { ... return { transaction: <base58>, ...state }; },
-//     complete: function (ctx, result, state) { ... }
+//     complete: function (ctx, result, state) { ... },
+//     signOnly: true
 //   });
 //
 //   walletOps.run('contest_entry', { contestId: 12 }, { provider: ... });
 //
+// `signOnly` IS A REQUIREMENT OF THE TRANSACTION, NOT A PREFERENCE ABOUT THE
+// WALLET, and it is the intent's to declare because only the intent knows the
+// shape of the bytes it prepared. A CO-SIGNED transaction — one whose second
+// signer slot is deliberately empty because a server fills it — cannot be
+// broadcast by the wallet: the chain would reject it for a missing required
+// signature, and, worse, the signed bytes the server needs would never come
+// back to the app, so the flow fails with nothing to retry. Declaring it makes
+// the transaction's own requirement outrank the wallet's capability. Omit it
+// and nothing changes: a wallet that can broadcast still does.
+//
 // THE ONE RULE A CALLER MUST FOLLOW: handlers are registered BY NAME at page
 // load, not passed as closures. A closure is precisely what cannot survive the
 // redirect — the page that held it no longer exists when the wallet answers. The
@@ -30,7 +41,8 @@
 // WHAT THIS FILE DOES NOT DO: it does not broadcast. Signing and sending are
 // different responsibilities with different failure modes, and the wallet that
 // broadcasts differs per vendor (Phantom deprecated its send-side deeplink, so
-// the app sends; Solflare and Backpack send for you). `complete` is told which
+// the app sends; Solflare and Backpack send for you) — and, where the intent
+// declares `signOnly`, per TRANSACTION as well. `complete` is told which
 // happened and owns the RPC, exactly as the existing flows already do.
 (function (W) {
   'use strict';
@@ -107,6 +119,23 @@
     return Promise.resolve(handler.prepare(ctx)).then(function (prepared) {
       var intent = { op: name, ctx: ctx, state: prepared };
 
+      // THE DECLARATION TRAVELS IN THE JOURNAL, NOT LOOKED UP FROM THE HANDLER
+      // AT THE FAR END, and that is the whole reason this line exists here
+      // rather than inside signingHop. The signing hop is taken from TWO
+      // places: this one, where the handler is certainly registered, and the
+      // connect callback, which is a DIFFERENT PAGE that may not have loaded
+      // the script that defined this intent. A handler lookup there would come
+      // back empty and silently fall through to the send-side default — the
+      // exact branch a co-signed transaction must never take. A boolean on the
+      // intent is JSON-serialisable, which is the one thing this file requires
+      // of anything that has to survive a redirect.
+      //
+      // Set ONLY when true, so the journal an undeclared intent writes is
+      // byte-identical to the one it wrote before this option existed. That is
+      // also why JOURNAL_VERSION does not move: no reader's expectations
+      // change, and bumping it would strand every trip already in flight.
+      if (handler.signOnly) intent.signOnly = true;
+
       // Already connected? Go straight to signing. Otherwise connect first and
       // carry the intent through — sessions do not expire on any of the three
       // wallets, so this branch is taken once per user, not once per action.
@@ -145,18 +174,38 @@
     return signingHop(provider, connected, opts);
   }
 
-  // Which signing method this wallet gets is a CAPABILITY QUESTION, not a
-  // preference: Phantom's send-side deeplink is deprecated, so it signs and the
-  // app broadcasts. Asking the provider keeps that fact in the profile table
-  // where it is asserted, rather than branching on a wallet name here.
+  // Which signing method this wallet gets is TWO questions asked in order, and
+  // the order is the point.
+  //
+  // FIRST, what does the TRANSACTION allow? A co-signed transaction has an
+  // empty signer slot the server fills, so the wallet must sign and hand the
+  // bytes back — broadcasting it is not a worse option, it is a broken one.
+  // An intent that knows this declares `signOnly` and that answer is final.
+  //
+  // SECOND, and only for everything else, what can the WALLET do? Phantom's
+  // send-side deeplink is deprecated, so it signs and the app broadcasts;
+  // Solflare and Backpack broadcast for you. Asking the provider keeps that
+  // fact in the profile table where it is asserted, rather than branching on a
+  // wallet name here.
+  //
+  // Asking them the other way round is the bug this replaced: capability alone
+  // sent every co-signed transaction to the wallet's broadcaster on any wallet
+  // that had one.
+  //
+  // A wallet with no signTransaction at all would be refused BY NAME by the
+  // provider's own capability gate rather than quietly broadcast here. No
+  // profile is in that state today (all three sign), and this is the branch
+  // that would have to be revisited if one ever were.
   function signingHop(provider, journal, opts) {
+    var intent = journal.intent;
     var payload = {
       journal: journal,
-      transaction: journal.intent.state.transaction,
+      transaction: intent.state.transaction,
       redirectLink: opts.redirectLink,
-      intent: journal.intent
+      intent: intent
     };
-    return provider.can('signAndSendTransaction')
+    var signOnly = !!(intent && intent.signOnly);
+    return (!signOnly && provider.can('signAndSendTransaction'))
       ? provider.beginSignAndSendTransaction(payload)
       : provider.beginSignTransaction(payload);
   }
@@ -234,6 +283,18 @@
       if (!handler || typeof handler.prepare !== 'function' || typeof handler.complete !== 'function') {
         throw new Error('walletOps.define("' + name + '") needs both prepare and complete');
       }
+      // REFUSED RATHER THAN COERCED, because every wrong answer here fails in
+      // the dangerous direction. A typo'd `signOnly: 'true'` read as truthy
+      // would sign-only a flow that wanted the wallet to broadcast; read
+      // strictly, it silently sends a co-signed transaction to a broadcaster.
+      // Neither is discoverable at the call site, and both surface as a chain
+      // error one page death later. So the option is a boolean or it is a bug.
+      if (handler.signOnly !== undefined && typeof handler.signOnly !== 'boolean') {
+        throw new Error(
+          'walletOps.define("' + name + '") signOnly must be true or false, got ' +
+          typeof handler.signOnly
+        );
+      }
       handlers[name] = handler;
     },
 

data/app/views/solana_studio/modals/_wallet_connect.html.erb

@@ -214,11 +214,55 @@
        // assertions in test/views/wallet_connect_picker_test.rb, and rewriting
        // those belongs with the behaviour change rather than riding along with
        // new primitives.
+       // THE REDIRECT-TRANSPORT REGISTRY, guarded the same way canDeepLink is and
+       // for the same reason: a consumer that does not load
+       // solana_studio/redirect_provider.js has no registry, and an absent
+       // capability must not default to the permissive branch. Empty list, no
+       // rows, install rows keep their place.
+       get redirectProviders() {
+         var rp = window.SolanaStudio && window.SolanaStudio.redirectProvider;
+         if (!rp || typeof rp.all !== 'function') return [];
+         return rp.all().filter(function(w) { return w.can('browse'); });
+       },
+       // Wallets we can hand a phone to RIGHT NOW, and the honesty rule that
+       // shapes this list: a row is painted only when tapping it does something.
+       //
+       // The handoff is the browse deeplink — it opens this page inside the
+       // wallet's OWN in-app browser, where the wallet injects a provider and the
+       // ordinary detected-row flow above works unchanged. That needs no signing
+       // protocol on our side, which is exactly why it can ship before one.
+       //
+       // Excluded: a wallet already injected (the detected row above is a better
+       // offer than leaving the page), and Phantom when canDeepLink is true
+       // (its own row below is a full sign-in, not a handoff — offering both
+       // would be two Phantom rows racing each other).
+       get mobileHandoffs() {
+         if (!this.isMobile) return [];
+         var self = this;
+         return this.redirectProviders.filter(function(w) {
+           if (self.hasWallet(w.name)) return false;
+           if (w.key === 'phantom' && self.canDeepLink) return false;
+           return true;
+         });
+       },
+       // Navigate into the wallet's browser, carrying THIS page as the target so
+       // the user lands where they already were rather than on a home screen.
+       openInWallet(key) {
+         var rp = window.SolanaStudio && window.SolanaStudio.redirectProvider;
+         var w = rp && rp.forWallet(key);
+         if (!w) return;
+         window.location.href = w.browseUrl(window.location.href, window.location.origin);
+       },
        get missingInstalls() {
          var self = this;
+         var handoffs = this.mobileHandoffs.map(function(w) { return w.name.toLowerCase(); });
          return this.installs.filter(function(i) {
            if (self.hasWallet(i.name)) return false;
            if (self.isMobile && self.canDeepLink && i.name === 'Phantom') return false;
+           // A wallet with a working handoff row must not ALSO offer a desktop
+           // download page. That pairing is what sent Solflare and Backpack users
+           // on a phone to solflare.com/download — a dead end with no error.
+           if (self.isMobile && handoffs.indexOf(i.name.toLowerCase()) !== -1) return false;
            return true;
          });
        },
@@ -387,6 +431,23 @@
       </span>
     </button>
 
+    <%# Wallets we can hand this phone to. Rendered ABOVE the install rows on
+        purpose: a path that works belongs before a download page. Each row is
+        painted only when tapping it does something — see mobileHandoffs. %>
+    <template x-for="w in mobileHandoffs" :key="'handoff-' + w.key">
+      <button type="button" @click="openInWallet(w.key)"
+              class="w-full flex items-center gap-3 p-3 rounded-xl bg-surface-alt border border-strong hover:bg-surface transition text-left">
+        <svg class="w-9 h-9 shrink-0" aria-hidden="true"><use :href="'#se-wallet-' + brandIcon(w.name)"></use></svg>
+        <span class="font-semibold text-heading" x-text="w.name"></span>
+        <span class="ml-auto flex items-center gap-2">
+          <span class="text-xs text-muted uppercase tracking-wide">Open app</span>
+          <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" class="w-4 h-4 text-muted">
+            <path stroke-linecap="round" stroke-linejoin="round" d="m8.25 4.5 7.5 7.5-7.5 7.5" />
+          </svg>
+        </span>
+      </button>
+    </template>
+
     <%# Featured wallets that aren't installed — open the install page %>
     <template x-for="i in missingInstalls" :key="i.name">
       <a :href="i.url" target="_blank" rel="noopener noreferrer"

data/lib/solana_studio/version.rb

@@ -16,5 +16,5 @@ module SolanaStudio
   # through the normal cycle. Splitting the version out is the same shape
   # studio-engine already uses (lib/studio/version.rb) and hands each file back
   # to its real owner: this one to the release, the gemspec to the PR.
-  VERSION = "0.8.0"
+  VERSION = "0.9.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solana-studio
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-08 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ed25519