@bounded-sh/client 0.0.112-ux-audit.2 → 0.0.113

package/dist/{index.native-CAH_ks0s.mjs → index.native-DcW2klyn.mjs}

@@ -3739,6 +3739,46 @@ function isSolanaMobileWallet(wallet) {
 function solanaMobileWalletLeavesPage(name) {
     return name === LOCAL_MOBILE_WALLET_NAME;
 }
+/**
+ * Whether this wallet answers a sign-in from its authorization cache, so the
+ * cached record must be dropped before asking it to sign in.
+ *
+ * Both Mobile Wallet Adapter transports consult their persisted authorization
+ * before EVERY authorize call, including the one that carries the Sign In With
+ * Solana payload (@solana-mobile/wallet-standard-mobile 0.5.3
+ * lib/esm/index.browser.js:1291). A record left by a plain connect holds no
+ * sign-in result, so that sign-in fails with "no sign in result returned by
+ * wallet" without the wallet app ever being asked; a record left by an earlier
+ * sign-in holds that OLD proof, so a later sign-in replays a spent nonce. The
+ * wallet's own `standard:disconnect` clears the record locally - it opens
+ * nothing - and the sign-in that follows then authorizes afresh, with its
+ * payload, in the wallet app. A name check, like leavesPage: this describes the
+ * transport, and the same adapter registered by another SDK behaves the same.
+ */
+function solanaMobileWalletAnswersSignInFromCache(name) {
+    return mobileWalletNames.has(name);
+}
+/**
+ * The Wallet Standard name of a feature a Mobile Wallet Adapter account reports.
+ *
+ * The adapter copies a wallet app's per-account `features` into the Wallet
+ * Standard account untranslated (0.5.3 lib/esm/index.browser.js:1421), and the
+ * MWA protocol names them differently from the Wallet Standard (spec feature
+ * identifiers: `solana:signMessages`, `solana:signInWithSolana`,
+ * `solana:signTransactions`). Filtered by the Wallet Standard names, such an
+ * account looks unable to sign a message or sign in, and the page sees no
+ * connected account after a successful authorization. Wallet Standard names pass
+ * through unchanged, so this applies to every account.
+ */
+const MWA_FEATURE_NAMES = {
+    'solana:signMessages': 'solana:signMessage',
+    'solana:signInWithSolana': 'solana:signIn',
+    'solana:signTransactions': 'solana:signTransaction',
+};
+function walletStandardFeatureName(feature) {
+    var _a;
+    return (_a = MWA_FEATURE_NAMES[feature]) !== null && _a !== void 0 ? _a : feature;
+}
 /**
  * Register Solana Mobile's MWA wallet with the Wallet Standard registry so
  * wallet discovery surfaces it. Idempotent - the first wallet-lane activation
@@ -3819,9 +3859,13 @@ async function ensureSolanaMobileWalletRegistered(config, network) {
             }
             catch (_e) {
                 throw new WalletConfigError(`Bounded: Solana Mobile wallet support needs the optional peer dependency ` +
-                    `'@solana-mobile/wallet-standard-mobile', which is not installed. Install it ` +
-                    `in your app to enable the mobile wallet, or leave the Solana Mobile wallet ` +
-                    `out of this app's wallet configuration.`);
+                    `'@solana-mobile/wallet-standard-mobile', which is not installed. Until it is, ` +
+                    `Android users (Seeker, Saga, any phone browser) get NO wallet to connect: ` +
+                    `installed wallet apps are never injected into a page there, the mobile adapter ` +
+                    `is the only route. Fix: npm install @solana-mobile/wallet-standard-mobile ` +
+                    `(a web app also needs legacy-peer-deps=true in its .npmrc, because the adapter's ` +
+                    `protocol package declares react-native as a peer). Or leave the Solana Mobile ` +
+                    `wallet out of this app's wallet configuration on purpose.`);
             }
             const { registerMwa, createDefaultChainSelector, SolanaMobileWalletAdapterWalletName, SolanaMobileWalletAdapterRemoteWalletName, } = mwa;
             const before = new Set(getWallets().get());
@@ -3908,7 +3952,7 @@ const OVERLAY_CSS = `
 :host{all:initial}
 *{box-sizing:border-box}
 .bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+  font-family:"Bounded Schibsted Grotesk","Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
 .bw-ov.mounted{display:block}
 .bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
   transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
@@ -3941,6 +3985,29 @@ const OVERLAY_CSS = `
 }
 @media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
 `;
+/**
+ * Style the shadow tree with `css` as constructed stylesheets, and say whether it could. A host
+ * CSP whose style-src lacks 'unsafe-inline' refuses an inline <style> even inside a shadow root,
+ * which left the widget unstyled (the Bounded router compiles exactly `style-src 'self'` for an
+ * app that declares browser boundaries and names no style sources); CSP does not govern
+ * constructed sheets. A browser without them (they shipped with adoptedStyleSheets everywhere)
+ * gets <style> elements instead (styleTag).
+ */
+function adoptStyles(shadow, css) {
+    if (!("adoptedStyleSheets" in shadow))
+        return false;
+    shadow.adoptedStyleSheets = css.map((text) => {
+        const sheet = new CSSStyleSheet();
+        sheet.replaceSync(text);
+        return sheet;
+    });
+    return true;
+}
+function styleTag(css) {
+    const style = document.createElement("style");
+    style.textContent = css;
+    return style;
+}
 let modal = null;
 function getModal() {
     if (modal)
@@ -3948,9 +4015,8 @@ function getModal() {
     const root = document.createElement("div");
     root.setAttribute("data-bounded-widget", "");
     const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
+    if (!adoptStyles(shadow, [OVERLAY_CSS]))
+        shadow.appendChild(styleTag(OVERLAY_CSS));
     const overlay = document.createElement("div");
     overlay.className = "bw-ov";
     const back = document.createElement("div");
@@ -5949,7 +6015,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-BfCH7K6N.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-Bk5GSpYT.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -5991,7 +6057,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CfYNIIHd.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DxPcYxP-.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6004,7 +6070,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-DXjwPjLW.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BQ_kG1vI.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6029,7 +6095,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-DjOFjtnk.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-DDudqqxY.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6091,7 +6157,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-DjOFjtnk.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-DDudqqxY.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6262,7 +6328,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-CfYNIIHd.mjs');
+            await import('./injected-wallet-provider-DxPcYxP-.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6574,6 +6640,13 @@ function registerStorageBridge() {
         void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
     });
 }
+function sameSessionIdentity(next, previous) {
+    if (!next || !previous)
+        return false;
+    const a = deriveUserIdentityFromIdToken(next);
+    const b = deriveUserIdentityFromIdToken(previous);
+    return !!a.id && a.id === b.id && a.address === b.address && a.email === b.email && a.evmAddress === b.evmAddress;
+}
 async function syncStoredSession() {
     const config = initializedConfig;
     if (!config)
@@ -6582,6 +6655,18 @@ async function syncStoredSession() {
     const issuer = WebSessionManager.getIssuer();
     if (token === observedIdToken && issuer === observedIssuer)
         return;
+    // Another tab refreshed this same session (tokens rotate every few minutes):
+    // who is signed in did not change, so keep the user and its live reads, whose
+    // sockets take the new token on their own, instead of hiding and restoring it.
+    if (currentUser && issuer === observedIssuer && sameSessionIdentity(token, observedIdToken)) {
+        const record = await WebSessionManager.readSessionWithGeneration();
+        if (config !== initializedConfig || WebSessionManager.getIdToken() !== token)
+            return;
+        if ((record === null || record === void 0 ? void 0 : record.idToken) === token && (!record.appId || record.appId === config.appId)) {
+            observedIdToken = token;
+            return;
+        }
+    }
     observedIdToken = token;
     observedIssuer = issuer;
     const generation = ++initializationGeneration;
@@ -8741,5 +8826,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { BUILD_REVIEW_CAPABILITY_SCHEMA as $, logout as A, getAuthProvider as B, signInAnonymously as C, loginWithPrivy as D, loginWithRedirect as E, completeLoginFromRedirect as F, getLoginReturnError as G, loginWithPopup as H, useAuth as I, useQuery as J, useBuildRun as K, apps as L, getIdToken as M, onramp as N, onrampQuote as O, onrampStatus as P, setPlatform as Q, OffchainAuthProvider as R, PrivyExpoProvider as S, builds as T, BuildsApiError as U, mediaAgentTools as V, NON_TERMINAL_STATES as W, TERMINAL_STATES as X, RUN_STATES as Y, PARK_REASONS as Z, FAILURE_REASONS as _, signMessageWithTurnkey as a, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a0, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a1, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, isSolanaMobileWallet as i, solanaMobileWalletLeavesPage as j, setAuthLoading as k, bufferExports as l, setStoredAuthMethod as m, normalizeSolanaRpcUrl as n, confirmAndCheckTransaction as o, resolveSolanaRpcUrl as p, init as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, waitForAuthReady as y, login as z };
-//# sourceMappingURL=index.native-CAH_ks0s.mjs.map
+export { PARK_REASONS as $, waitForAuthReady as A, login as B, logout as C, getAuthProvider as D, signInAnonymously as E, loginWithPrivy as F, loginWithRedirect as G, completeLoginFromRedirect as H, getLoginReturnError as I, loginWithPopup as J, useAuth as K, useQuery as L, useBuildRun as M, apps as N, getIdToken as O, onramp as P, onrampQuote as Q, onrampStatus as R, setPlatform as S, OffchainAuthProvider as T, PrivyExpoProvider as U, builds as V, BuildsApiError as W, mediaAgentTools as X, NON_TERMINAL_STATES as Y, TERMINAL_STATES as Z, RUN_STATES as _, signMessageWithTurnkey as a, FAILURE_REASONS as a0, BUILD_REVIEW_CAPABILITY_SCHEMA as a1, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a2, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a3, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, isSolanaMobileWallet as i, solanaMobileWalletLeavesPage as j, solanaMobileWalletAnswersSignInFromCache as k, setAuthLoading as l, bufferExports as m, normalizeSolanaRpcUrl as n, setStoredAuthMethod as o, confirmAndCheckTransaction as p, resolveSolanaRpcUrl as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, init as u, getCurrentUser as v, walletStandardFeatureName as w, onAuthStateChanged as x, onAuthLoadingChanged as y, getAuthLoading as z };
+//# sourceMappingURL=index.native-DcW2klyn.mjs.map