@bounded-sh/client 0.0.112-ux-audit.2 → 0.0.112

package/dist/{index-D3kdhCpH.mjs → index-D76-cZcD.mjs}

@@ -3876,9 +3876,13 @@ async function ensureSolanaMobileWalletRegistered(config, network) {
             }
             catch (_e) {
                 throw new WalletConfigError(`Bounded: Solana Mobile wallet support needs the optional peer dependency ` +
-                    `'@solana-mobile/wallet-standard-mobile', which is not installed. Install it ` +
-                    `in your app to enable the mobile wallet, or leave the Solana Mobile wallet ` +
-                    `out of this app's wallet configuration.`);
+                    `'@solana-mobile/wallet-standard-mobile', which is not installed. Until it is, ` +
+                    `Android users (Seeker, Saga, any phone browser) get NO wallet to connect: ` +
+                    `installed wallet apps are never injected into a page there, the mobile adapter ` +
+                    `is the only route. Fix: npm install @solana-mobile/wallet-standard-mobile ` +
+                    `(a web app also needs legacy-peer-deps=true in its .npmrc, because the adapter's ` +
+                    `protocol package declares react-native as a peer). Or leave the Solana Mobile ` +
+                    `wallet out of this app's wallet configuration on purpose.`);
             }
             const { registerMwa, createDefaultChainSelector, SolanaMobileWalletAdapterWalletName, SolanaMobileWalletAdapterRemoteWalletName, } = mwa;
             const before = new Set(getWallets().get());
@@ -3965,7 +3969,7 @@ const OVERLAY_CSS = `
 :host{all:initial}
 *{box-sizing:border-box}
 .bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+  font-family:"Bounded Schibsted Grotesk","Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
 .bw-ov.mounted{display:block}
 .bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
   transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
@@ -3998,6 +4002,29 @@ const OVERLAY_CSS = `
 }
 @media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
 `;
+/**
+ * Style the shadow tree with `css` as constructed stylesheets, and say whether it could. A host
+ * CSP whose style-src lacks 'unsafe-inline' refuses an inline <style> even inside a shadow root,
+ * which left the widget unstyled (the Bounded router compiles exactly `style-src 'self'` for an
+ * app that declares browser boundaries and names no style sources); CSP does not govern
+ * constructed sheets. A browser without them (they shipped with adoptedStyleSheets everywhere)
+ * gets <style> elements instead (styleTag).
+ */
+function adoptStyles(shadow, css) {
+    if (!("adoptedStyleSheets" in shadow))
+        return false;
+    shadow.adoptedStyleSheets = css.map((text) => {
+        const sheet = new CSSStyleSheet();
+        sheet.replaceSync(text);
+        return sheet;
+    });
+    return true;
+}
+function styleTag(css) {
+    const style = document.createElement("style");
+    style.textContent = css;
+    return style;
+}
 let modal = null;
 function getModal() {
     if (modal)
@@ -4005,9 +4032,8 @@ function getModal() {
     const root = document.createElement("div");
     root.setAttribute("data-bounded-widget", "");
     const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
+    if (!adoptStyles(shadow, [OVERLAY_CSS]))
+        shadow.appendChild(styleTag(OVERLAY_CSS));
     const overlay = document.createElement("div");
     overlay.className = "bw-ov";
     const back = document.createElement("div");
@@ -4142,12 +4168,15 @@ function fitPanelToContent(m) {
         m.fitObserver = ro;
     }
 }
-/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
-function mountContent(m, node) {
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`, styled by `css` until the next mount. */
+function mountContent(m, node, css) {
     var _a;
     detachIframe(m);
     (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
     m.fitObserver = null;
+    const shadow = m.root.shadowRoot;
+    if (!(shadow && adoptStyles(shadow, [OVERLAY_CSS, css] )) && css)
+        node.prepend(styleTag(css));
     m.content.replaceChildren(node);
     m.content.style.display = "block";
 }
@@ -4209,27 +4238,39 @@ function detachIframe(m) {
     m.iframeContext = "";
     m.onIframeMessage = null;
 }
-// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
-// JetBrains Mono) once at the document level so they apply inside the shadow root. A
-// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
-const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+/**
+ * The Bounded editorial typefaces the hosted auth page uses (Newsreader display, Schibsted
+ * Grotesk body), registered once at the document level so they apply inside the shadow root.
+ *
+ * The Bounded router serves them same-origin at /__bounded/fonts/*.woff2 on every site it
+ * serves (bounded-router scripts/build-widget-styles.cjs), and they load through the FontFace
+ * API: no stylesheet, so a host CSP's style-src never applies, and the only fetch is same-origin,
+ * which font-src 'self' admits. Google Fonts CSS injected here was refused by strict hosts such
+ * as the OpenApps venue (style-src 'self'), with a CSP error on every page. A page the router
+ * does not serve has none of its /__bounded/ scripts: nothing is fetched there, and the widget's
+ * font stacks fall back to the page's own faces or system ones. The Bounded-prefixed family
+ * names never restyle the host page's own text.
+ */
+const WIDGET_FONT_FACES = [
+    { family: "Bounded Newsreader", url: "/__bounded/fonts/newsreader.woff2", weight: "200 800" },
+    { family: "Bounded Schibsted Grotesk", url: "/__bounded/fonts/schibsted.woff2", weight: "400 900" },
+];
 function ensureFonts() {
-    if (!hasDOM$5())
+    if (!hasDOM$5() || typeof FontFace === "undefined" || !document.fonts)
         return;
-    if (document.querySelector('link[data-bounded-fonts="1"]'))
+    if (!document.querySelector('script[src^="/__bounded/"]'))
         return;
-    const pre1 = document.createElement("link");
-    pre1.rel = "preconnect";
-    pre1.href = "https://fonts.googleapis.com";
-    const pre2 = document.createElement("link");
-    pre2.rel = "preconnect";
-    pre2.href = "https://fonts.gstatic.com";
-    pre2.crossOrigin = "anonymous";
-    const link = document.createElement("link");
-    link.rel = "stylesheet";
-    link.href = FONTS_HREF;
-    link.setAttribute("data-bounded-fonts", "1");
-    document.head.append(pre1, pre2, link);
+    const registered = new Set();
+    document.fonts.forEach((face) => registered.add(face.family.replace(/^["']|["']$/g, "")));
+    for (const { family, url, weight } of WIDGET_FONT_FACES) {
+        if (registered.has(family))
+            continue;
+        // Against the page's origin, not its base URL: a <base href> elsewhere must not move the fetch off this origin.
+        const face = new FontFace(family, `url("${location.origin}${url}") format("woff2")`, { weight, display: "swap" });
+        document.fonts.add(face);
+        // A face that cannot load is taken back out; the font stack falls back to the next face.
+        face.load().catch(() => { document.fonts.delete(face); });
+    }
 }
 
 // turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
@@ -6249,7 +6290,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-C7RXLVd9.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-BV1Iea4A.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6291,7 +6332,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-0SSONh1d.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-UuGrzdNW.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6304,7 +6345,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BtyG1HOX.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-WxUbyMZL.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6329,7 +6370,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-2J4fnTX5.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-Cqx1zH23.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6391,7 +6432,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-2J4fnTX5.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-Cqx1zH23.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6562,7 +6603,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-0SSONh1d.mjs');
+            await import('./injected-wallet-provider-UuGrzdNW.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6665,7 +6706,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-0SSONh1d.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-UuGrzdNW.mjs');
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -7032,6 +7073,13 @@ function registerStorageBridge() {
         void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
     });
 }
+function sameSessionIdentity(next, previous) {
+    if (!next || !previous)
+        return false;
+    const a = deriveUserIdentityFromIdToken(next);
+    const b = deriveUserIdentityFromIdToken(previous);
+    return !!a.id && a.id === b.id && a.address === b.address && a.email === b.email && a.evmAddress === b.evmAddress;
+}
 async function syncStoredSession() {
     const config = initializedConfig;
     if (!config)
@@ -7040,6 +7088,18 @@ async function syncStoredSession() {
     const issuer = WebSessionManager.getIssuer();
     if (token === observedIdToken && issuer === observedIssuer)
         return;
+    // Another tab refreshed this same session (tokens rotate every few minutes):
+    // who is signed in did not change, so keep the user and its live reads, whose
+    // sockets take the new token on their own, instead of hiding and restoring it.
+    if (currentUser && issuer === observedIssuer && sameSessionIdentity(token, observedIdToken)) {
+        const record = await WebSessionManager.readSessionWithGeneration();
+        if (config !== initializedConfig || WebSessionManager.getIdToken() !== token)
+            return;
+        if ((record === null || record === void 0 ? void 0 : record.idToken) === token && (!record.appId || record.appId === config.appId)) {
+            observedIdToken = token;
+            return;
+        }
+    }
     observedIdToken = token;
     observedIssuer = issuer;
     const generation = ++initializationGeneration;
@@ -8067,8 +8127,8 @@ const CARD_CSS = `
   --line:rgba(232,230,222,.08);--line-strong:rgba(232,230,222,.16);
   --text:#e8e6de;--dim:#9b9991;--faint:#85837c;
   --green:#58c98f;--green-bg:rgba(88,201,143,.09);--green-line:rgba(88,201,143,.28);--red:#ec8488;
-  --disp:"Newsreader","Iowan Old Style",Georgia,serif;
-  --body:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif;
+  --disp:"Bounded Newsreader","Newsreader","Iowan Old Style",Georgia,serif;
+  --body:"Bounded Schibsted Grotesk","Schibsted Grotesk","Helvetica Neue",Arial,sans-serif;
   position:relative;padding:34px 32px 20px;color:var(--text);font-family:var(--body);
   -webkit-font-smoothing:antialiased}
 .x{position:absolute;top:20px;right:24px;border:0;background:transparent;color:var(--faint);
@@ -8189,6 +8249,17 @@ function discoverWallets(configuredNetwork) {
 // beats a click that does nothing, which is what "one at a time" looks like from
 // the outside.
 const BUSY_MSG = "A sign-in is already in progress - finish or cancel it first.";
+// Shown instead of an empty card when no lane can be offered (wallet-only app,
+// no wallet in this browser). A phone browser never sees installed wallet apps
+// as injected providers, so the honest advice there is a different browser,
+// not "install a wallet".
+function noLaneCopy(mobile) {
+    return mobile
+        ? "No wallet is available in this browser. Open this page in your wallet app's " +
+            "browser, or on a desktop browser with a wallet extension, then try again."
+        : "No wallet was found in this browser. Install a Solana wallet extension such as " +
+            "Phantom or Solflare, reload the page, then try again.";
+}
 const METHOD_LABEL = {
     google: "Continue with Google",
     apple: "Continue with Apple",
@@ -8530,12 +8601,9 @@ async function prepareAndOpen(opts, pending) {
             cancelPendingOpens();
         };
         m.onBackdrop = cancel;
-        const style = el("style");
-        style.textContent = CARD_CSS;
         let emailDraft = "";
         const renderChoose = (initialError) => {
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const x = el("button", "x", "Close");
             x.type = "button";
             x.setAttribute("aria-label", "Close");
@@ -8752,6 +8820,24 @@ async function prepareAndOpen(opts, pending) {
                     });
                 };
             }
+            // A card with no lane at all. It happens when an app asks for wallet-only
+            // (`methods: []`, `wallet: true`) and this browser has no wallet to offer:
+            // no injected wallet, and no Solana Mobile wallet (off-Android, or the app
+            // never installed the adapter). A blank card between the title and the
+            // footer was the shipped behaviour, and it reads as "the site is broken"
+            // to the person and tells the developer nothing. Say what is missing on
+            // screen, and name the usual cause once in the console, where the
+            // developer's own preview run will show it.
+            if (!hasEmail && social.length === 0 && !walletEnabled) {
+                card.appendChild(el("p", "sub", noLaneCopy(detectMobile())));
+                console.warn("[Bounded] openBoundedWidget has no sign-in lane to show: the app asked for " +
+                    "no email or social method and no wallet is available in this browser. " +
+                    (offerMobile
+                        ? "On Android the Solana Mobile wallet is offered only when the app installs " +
+                            "'@solana-mobile/wallet-standard-mobile' (see the warning above if registration failed); "
+                        : "") +
+                    "Add a method, or make sure wallet login is enabled and the mobile adapter is installed.");
+            }
             card.appendChild(status);
             const foot = el("div", "foot");
             const poweredBy = el("a", undefined, "Powered by Bounded");
@@ -8798,7 +8884,6 @@ async function prepareAndOpen(opts, pending) {
         const renderSignInGesture = (choice, done) => {
             var _a;
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const x = el("button", "x", "Close");
             x.type = "button";
             x.setAttribute("aria-label", "Close");
@@ -8819,7 +8904,6 @@ async function prepareAndOpen(opts, pending) {
         };
         const renderWallets = (initialError) => {
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const back = el("button", "back", "\u2190 Back");
             back.type = "button";
             // Leaving the wallet list supersedes any attempt still preparing, so it
@@ -8899,7 +8983,6 @@ async function prepareAndOpen(opts, pending) {
         // experience still feels native; the code input, sealing, and verify all live behind the frame.
         const renderOtpFrame = (handle) => {
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const back = el("button", "back", "\u2190 Back");
             back.type = "button";
             card.appendChild(back);
@@ -8946,7 +9029,7 @@ async function prepareAndOpen(opts, pending) {
             // land after a newer open has taken over the DOM.
             if (!owner.owns())
                 return;
-            mountContent(m, node);
+            mountContent(m, node, CARD_CSS);
             requestAnimationFrame(() => {
                 if (owner.owns())
                     fitPanelToContent(m);
@@ -11268,4 +11351,4 @@ function init(config = {}) {
 }
 
 export { onrampStatus as $, getAuthProvider as A, signInAnonymously as B, loginWithPrivy as C, loginWithWallet as D, ensureWalletLoginReady as E, ensureSharedWalletLoginReady as F, preloadWalletLogin as G, loginWithRedirect as H, completeLoginFromRedirect as I, getLoginReturnError as J, loginWithPopup as K, openBoundedWidget as L, ensureSignedIn as M, useAuth as N, useQuery as O, useBuildRun as P, apps as Q, signSolanaMessageViaTurnkey as R, getOrCreateTurnkeyWallet as S, openTurnkeyKeyExport as T, getTurnkeyWalletSessionState as U, getTurnkeyWalletRecoveryUrl as V, WalletConfigError as W, startTurnkeyEmailLogin as X, getIdToken as Y, onramp as Z, onrampQuote as _, signMessageWithTurnkey as a, setPlatform as a0, OffchainAuthProvider as a1, PrivyExpoProvider as a2, requestEip6963Providers as a3, connectBroadcast as a4, connectServiceSession as a5, builds as a6, BuildsApiError as a7, mediaAgentTools as a8, NON_TERMINAL_STATES as a9, TERMINAL_STATES as aa, RUN_STATES as ab, PARK_REASONS as ac, FAILURE_REASONS as ad, BUILD_REVIEW_CAPABILITY_SCHEMA as ae, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as af, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as ag, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, bufferExports as k, setStoredAuthMethod as l, confirmAndCheckTransaction as m, normalizeSolanaRpcUrl as n, defaultInjectedEvmProvider as o, init as p, getCurrentUser as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, onAuthStateChanged as u, onAuthLoadingChanged as v, getAuthLoading as w, waitForAuthReady as x, login as y, logout as z };
-//# sourceMappingURL=index-D3kdhCpH.mjs.map
+//# sourceMappingURL=index-D76-cZcD.mjs.map