@bounded-sh/client 0.0.114 → 0.0.116

package/dist/{index.native-DcW2klyn.mjs → index.native-DfDVa7MG.mjs}

@@ -1,4 +1,4 @@
-import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, init as init$1, deriveUserIdentityFromIdToken, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, init as init$1, deriveUserIdentityFromIdToken, onSessionCleared, onSessionChange, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
@@ -4379,6 +4379,47 @@ async function openHiddenSignerFrame(page) {
     };
 }
 
+// turnkey-signer-window.ts - the top-level Bounded signer window: opening it, and reserving it
+// inside a click for an approval that is reached only after awaits.
+//
+// A cross-app Turnkey signature (the capability says `transport: 'popup'`) cannot run in the
+// in-app frame, so it opens in its own window, and a browser opens a window only inside the
+// user's click. The click handler therefore calls `reserveSignerPopup()` first, before any
+// `await`, and the exchange in turnkey-signer-bridge.ts navigates that window to the signer later.
+//
+// Kept out of the bridge on purpose: the bridge is loaded lazily as a whole module, so a bundler
+// keeps every one of its exports in every app that signs, while this reservation is needed only
+// by an app that funds an escrow.
+function openSignerWindow(url, w = 420, h = 620) {
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    return window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+}
+// One slot: the next popup exchange takes it, and a new reservation replaces an unused earlier one.
+// A property of a const rather than a reassigned `let`, which a bundler would keep every assignment
+// to, dragging the reservation into apps that never reserve.
+const reserved = { popup: null };
+/** Hand the reserved window, if one is held, to an exchange: navigated to the signer page at `url`. */
+function takeReservedPopup(url) {
+    const popup = reserved.popup;
+    reserved.popup = null;
+    if (!popup)
+        return null;
+    if (popup.closed)
+        throw new Error('Wallet approval window was closed before it completed.');
+    try {
+        popup.location.replace(url);
+    }
+    catch (_a) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw new Error('Wallet approval window could not open the signer - retry from a click.');
+    }
+    return popup;
+}
+
 // turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
 // kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
 //
@@ -4390,9 +4431,10 @@ async function openHiddenSignerFrame(page) {
 // so a regression here (a dropped capability, a wrong route, a swallowed error) is
 // caught without a browser.
 // POST the Bounded id token + payload hash to the issuer's capability mint route and
-// return the issuer-signed capability for exactly these bytes. Credential-free: identity
-// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
-// would not carry). Throws with the same stable messages the bridge relied on inline.
+// return the issuer-signed capability for exactly these bytes, with the transport the
+// issuer requires for them. Credential-free: identity is proven with the id token in the
+// body (not an ambient cookie the cross-origin fetch would not carry). Throws with the same
+// stable messages the bridge relied on inline.
 async function requestTurnkeySigningCapability(opts) {
     const base = opts.baseUrl.replace(/\/$/, '');
     let res;
@@ -4422,7 +4464,7 @@ async function requestTurnkeySigningCapability(opts) {
     if (!d || typeof d.capability !== 'string' || !d.capability) {
         throw new Error('Turnkey signing capability was malformed.');
     }
-    return d.capability;
+    return d.transport === 'popup' ? { capability: d.capability, transport: 'popup' } : { capability: d.capability };
 }
 // Assemble the `bounded:turnkey:sign` postMessage request, carrying the issuer-signed
 // capability for the same bytes. Without the capability the hosted signer refuses
@@ -4501,12 +4543,16 @@ function hasDOM$2() {
 // when we cannot embed (no DOM, or the frame never mounts/loads). Nothing in the
 // email-session flow needs a popup by preference: the code entry and the approval
 // click both run fine inside a cross-origin iframe on every engine (the old
-// Safari popup preference existed only for in-iframe WebAuthn CREATE).
+// Safari popup preference existed only for in-iframe WebAuthn CREATE). The one
+// exception is a signature the issuer marks `transport: 'popup'` (a cross-app
+// write): the hosted signer refuses it inside any frame, so it never touches the widget.
 async function deliver(url, origin, ex) {
     var _a, _b;
     const popup = () => runPopup(url, origin, ex);
     (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
-    const result = await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
+    const result = ex.transport === 'popup'
+        ? await popup()
+        : await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
     (_b = ex.assertCurrent) === null || _b === void 0 ? void 0 : _b.call(ex);
     return result;
 }
@@ -4571,14 +4617,12 @@ function activeTurnkeyAddress() {
         : null;
 }
 let requestSeq = 0;
-// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
-// resolve when `onResult` accepts a result message. Origin + source are pinned.
+// Shared popup driver: open the signer page (in the reserved window when one is held), do the
+// ready/postMessage handshake, and resolve when `onResult` accepts a result message. Origin +
+// source are pinned.
 async function runPopup(url, signerOrigin, ex) {
-    var _a, _b;
-    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
-    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
-    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    var _a;
+    const popup = (_a = takeReservedPopup(url)) !== null && _a !== void 0 ? _a : openSignerWindow(url, ex.width, ex.height);
     if (!popup) {
         throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the wallet approval window can open.');
     }
@@ -4756,7 +4800,7 @@ async function signSolanaMessageViaTurnkey(message) {
     const messageHex = toHex(message);
     // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
     // refuse (capability_required) without it. Fetched per signature (each is single-payload).
-    const capability = await fetchSigningCapability(messageHex, context);
+    const { capability, transport } = await fetchSigningCapability(messageHex, context);
     // Inline (authMode:"turnkey") sessions plant no Better Auth cookie on the issuer, so the
     // signer's same-origin status/create fetches need a bearer session proof: attach the
     // createWallet action authorization (it covers the sign flow's get-or-create too). Minted
@@ -4765,11 +4809,20 @@ async function signSolanaMessageViaTurnkey(message) {
     return await deliver(url, origin, {
         context: context.key, assertCurrent: context.assertCurrent,
         request: buildTurnkeySignRequest({ requestId, messageHex, capability, authorization }),
+        transport,
         onResult: (d) => {
             if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
-                setWalletSessionState(context.key, { expiresAt: Number(d.signingSessionExpiresAt) });
+                // A top-level popup keeps its signing session in the signer origin's own storage, which the
+                // warm in-app frame (a partitioned context) cannot see, so it says nothing about that frame.
+                if (transport !== 'popup')
+                    setWalletSessionState(context.key, { expiresAt: Number(d.signingSessionExpiresAt) });
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
             }
+            // The hosted signer refuses a cross-app signature inside a frame. Never retry it from here:
+            // the top-level window needs the user's own click.
+            if (d.error === 'top_level_required') {
+                return { error: 'top_level_required: an approval that writes to another app must open in its own window. Start it from a click handler.' };
+            }
             return { error: String(d.error || 'Turnkey signing failed') };
         },
     });
@@ -6015,7 +6068,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-Bk5GSpYT.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-C5bYKzpN.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6057,7 +6110,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DxPcYxP-.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BoRoxrEl.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6070,7 +6123,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BQ_kG1vI.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-E7eCpvLr.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6095,7 +6148,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-DDudqqxY.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-CsM_SuGH.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6157,7 +6210,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-DDudqqxY.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-CsM_SuGH.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6328,7 +6381,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-DxPcYxP-.mjs');
+            await import('./injected-wallet-provider-BoRoxrEl.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6639,6 +6692,14 @@ function registerStorageBridge() {
             return;
         void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
     });
+    // `storage` fires only in other tabs. Another SDK copy in THIS tab (the hosted widget beside
+    // the app, or the app beside the widget) announces its sign-in and sign-out on the session
+    // channel instead; the nudge carries no authority, the record is re-read the same way.
+    onSessionChange(() => {
+        if (!initializedConfig)
+            return;
+        void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
+    });
 }
 function sameSessionIdentity(next, previous) {
     if (!next || !previous)
@@ -8826,5 +8887,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { PARK_REASONS as $, waitForAuthReady as A, login as B, logout as C, getAuthProvider as D, signInAnonymously as E, loginWithPrivy as F, loginWithRedirect as G, completeLoginFromRedirect as H, getLoginReturnError as I, loginWithPopup as J, useAuth as K, useQuery as L, useBuildRun as M, apps as N, getIdToken as O, onramp as P, onrampQuote as Q, onrampStatus as R, setPlatform as S, OffchainAuthProvider as T, PrivyExpoProvider as U, builds as V, BuildsApiError as W, mediaAgentTools as X, NON_TERMINAL_STATES as Y, TERMINAL_STATES as Z, RUN_STATES as _, signMessageWithTurnkey as a, FAILURE_REASONS as a0, BUILD_REVIEW_CAPABILITY_SCHEMA as a1, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a2, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a3, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, isSolanaMobileWallet as i, solanaMobileWalletLeavesPage as j, solanaMobileWalletAnswersSignInFromCache as k, setAuthLoading as l, bufferExports as m, normalizeSolanaRpcUrl as n, setStoredAuthMethod as o, confirmAndCheckTransaction as p, resolveSolanaRpcUrl as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, init as u, getCurrentUser as v, walletStandardFeatureName as w, onAuthStateChanged as x, onAuthLoadingChanged as y, getAuthLoading as z };
-//# sourceMappingURL=index.native-DcW2klyn.mjs.map
+export { PARK_REASONS as $, waitForAuthReady as A, login as B, logout as C, getAuthProvider as D, signInAnonymously as E, loginWithPrivy as F, loginWithRedirect as G, completeLoginFromRedirect as H, getLoginReturnError as I, loginWithPopup as J, useAuth as K, useQuery as L, useBuildRun as M, apps as N, getIdToken as O, onramp as P, onrampQuote as Q, onrampStatus as R, setPlatform as S, OffchainAuthProvider as T, PrivyExpoProvider as U, builds as V, BuildsApiError as W, mediaAgentTools as X, NON_TERMINAL_STATES as Y, TERMINAL_STATES as Z, RUN_STATES as _, signMessageWithTurnkey as a, FAILURE_REASONS as a0, BUILD_REVIEW_CAPABILITY_SCHEMA as a1, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a2, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a3, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, solanaMobileWalletLeavesPage as i, solanaMobileWalletAnswersSignInFromCache as j, isSolanaMobileWallet as k, setAuthLoading as l, bufferExports as m, normalizeSolanaRpcUrl as n, setStoredAuthMethod as o, confirmAndCheckTransaction as p, resolveSolanaRpcUrl as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, init as u, getCurrentUser as v, walletStandardFeatureName as w, onAuthStateChanged as x, onAuthLoadingChanged as y, getAuthLoading as z };
+//# sourceMappingURL=index.native-DfDVa7MG.mjs.map