solana-studio 0.9.2 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7241d6d065b9809d2860f069a5719e7e45ffe69d819b7b179556153a1e18fc8
-  data.tar.gz: 4f3463bdabd2e64fd778485856cfdf7615d5f75cb373bf025f044c24e4d1a000
+  metadata.gz: 6298dedd5eff0a7e2c908b874052c189c7084964bf98fa660e99bb2c3a02a3ed
+  data.tar.gz: 89dc78d9370c93ef76a58f936c4285b08336c06a0651e17b246cff26e6563af5
 SHA512:
-  metadata.gz: 5fb81a7cd7050a2be3d6ae91f38d3ac2e39c0907d57585cca239e86d3e1ecc2a433561df2bf43cffb1d9f1593f9d97acdad6ae48a5d811bf5d99c7e55576c501
-  data.tar.gz: e19a0a621a94498d9fabb1c2fdeb5322fd135f2f695ff8d1adb58685eeea08133566f3e2b5f33a4e2a238e3734df2cc00ec380ae65f0a284489904358e001d66
+  metadata.gz: e50c4f0545d30084afc32da7e1c44a370e122da1beeed22627f2e4aa3aae109fbcc47918a93383504015342c52b6c596e97f49419457e0da9330beeafeff0f2c
+  data.tar.gz: 8769de22b4f7ec6d27f3136b65a7459ea871032571d451d52de45f07fcf5de8b11bd756090a3095c5286f04032b0d45299b4db438e14f1f288b5fff772903b5a

data/app/assets/javascripts/solana_studio/redirect_provider.js

@@ -134,7 +134,10 @@
         url: t.url.method(walletKey, method, {
           dappPublicKey: journal.dappPublicKey,
           nonce: sealed.nonce,
-          redirectLink: opts.redirectLink,
+          // The caller's value wins when present, but a resume has no caller —
+          // it runs on a page the wallet sent us to. The journal is the fallback
+          // that makes the second hop possible at all.
+          redirectLink: opts.redirectLink || journal.redirectLink,
           payload: sealed.payload,
           useScheme: opts.useScheme
         }),
@@ -142,6 +145,7 @@
           dappSecretKey: journal.dappSecretKey,
           dappPublicKey: journal.dappPublicKey,
           walletPublicKey: journal.walletPublicKey,
+          redirectLink: opts.redirectLink || journal.redirectLink,
           session: journal.session,
           intent: opts.intent || journal.intent || null
         })
@@ -187,9 +191,15 @@
             cluster: opts.cluster,
             useScheme: opts.useScheme
           }),
+          // redirectLink IS TRIP STATE, not call state. The hop AFTER this one
+          // runs in a different document — often reached by the wallet, not by
+          // us — and it needs the same return address. Capturing only what the
+          // next LINE uses is what lost it; the journal exists precisely for
+          // what the whole trip needs.
           journal: newJournal(walletKey, 'connect', {
             dappSecretKey: t.base58.encode(pair.secretKey),
             dappPublicKey: dappPublicKey,
+            redirectLink: opts.redirectLink,
             intent: opts.intent || null
           })
         };

data/app/assets/javascripts/solana_studio/wallet_transport.js

@@ -292,11 +292,39 @@
     return parts.join('&');
   }
 
+  // A REQUEST WITH NOWHERE TO RETURN IS NOT A REQUEST, and until this existed it
+  // was possible to build one and impossible to notice. query() below SKIPS
+  // null/undefined/empty values, so a missing redirect_link simply vanished from
+  // the URL and the request looked perfectly well formed on the way out. Phantom
+  // received it, had nothing to do with it, and opened to its HOME SCREEN — which
+  // is indistinguishable, to a user, from the app being broken.
+  //
+  // Measured on a real iPhone against QA 2026-09-09: hop one (connect) completed
+  // correctly and hop two was built with redirect_link undefined, because the
+  // journal never carried it across the page death. The entry was lost after the
+  // user had already approved it.
+  //
+  // Guarding at the BUILDER rather than at each call site is the point. There are
+  // three places that construct these URLs today and more will follow; a rule
+  // enforced where the string is assembled cannot be forgotten by the next one.
+  function requireField(value, name, method) {
+    if (value === null || value === undefined || value === '') {
+      throw new Error(
+        'Cannot build a ' + method + ' wallet request without ' + name +
+        ' — the wallet would have nowhere to return to. This usually means the ' +
+        'value was not carried across the redirect in the journal.'
+      );
+    }
+    return value;
+  }
+
   var url = {
     // connect carries NO nonce and NO payload — the shared secret does not exist
     // yet. Every other method requires both.
     connect: function (wallet, opts) {
       var b = base(wallet, opts && opts.useScheme);
+      requireField(opts && opts.redirectLink, 'redirect_link', 'connect');
+      requireField(opts && opts.dappPublicKey, 'dapp_encryption_public_key', 'connect');
       return b.prefix + 'connect?' + query({
         app_url: opts.appUrl,
         dapp_encryption_public_key: opts.dappPublicKey,
@@ -310,6 +338,10 @@
         throw new Error(wallet + ' does not support ' + method + ' over the redirect transport');
       }
       var b = base(wallet, opts && opts.useScheme);
+      requireField(opts && opts.redirectLink, 'redirect_link', method);
+      requireField(opts && opts.dappPublicKey, 'dapp_encryption_public_key', method);
+      requireField(opts && opts.payload, 'payload', method);
+      requireField(opts && opts.nonce, 'nonce', method);
       return b.prefix + method + '?' + query({
         dapp_encryption_public_key: opts.dappPublicKey,
         nonce: opts.nonce,

data/lib/solana_studio/version.rb

@@ -16,5 +16,5 @@ module SolanaStudio
   # through the normal cycle. Splitting the version out is the same shape
   # studio-engine already uses (lib/studio/version.rb) and hands each file back
   # to its real owner: this one to the release, the gemspec to the PR.
-  VERSION = "0.9.2"
+  VERSION = "0.9.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solana-studio
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-09 00:00:00.000000000 Z
+date: 2026-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ed25519