@bounded-sh/client 0.0.117-sync.0 → 0.0.118-openapps.0

package/dist/{index-C2xAP67N.js → index-B2HWEA13.js}

@@ -6496,7 +6496,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BFOw9iI9.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CjbJ8wK1.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6538,7 +6538,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-Bc_xtyRd.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BEaDBzcd.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6551,7 +6551,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CL_FBjLe.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-qB_GQ9ih.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6576,7 +6576,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DJD3zkBU.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-ClCOa69H.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6638,7 +6638,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DJD3zkBU.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-ClCOa69H.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6809,7 +6809,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-Bc_xtyRd.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-BEaDBzcd.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6914,7 +6914,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-Bc_xtyRd.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BEaDBzcd.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -8452,6 +8452,18 @@ function walletGlyph() {
     svg.append(rect, dot);
     return svg;
 }
+/** Whether the card shows "Powered by Bounded": the caller decides, else it is off on OpenApps pages. */
+function showsAttribution(opts) {
+    if (typeof opts.attribution === "boolean")
+        return opts.attribution;
+    try {
+        const host = location.hostname.toLowerCase();
+        return !(host === "openapps.xyz" || host.endsWith(".openapps.xyz"));
+    }
+    catch (_a) {
+        return true;
+    }
+}
 function isInjectedProvider(v) {
     return supportsWalletSignIn(v);
 }
@@ -9091,13 +9103,15 @@ async function prepareAndOpen(opts, pending) {
                         : "Add a method, or make sure wallet login is enabled and the mobile adapter is installed."));
             }
             card.appendChild(status);
-            const foot = el("div", "foot");
-            const poweredBy = el("a", undefined, "Powered by Bounded");
-            poweredBy.href = "https://bounded.sh";
-            poweredBy.target = "_blank";
-            poweredBy.rel = "noopener";
-            foot.appendChild(poweredBy);
-            card.appendChild(foot);
+            if (showsAttribution(opts)) {
+                const foot = el("div", "foot");
+                const poweredBy = el("a", undefined, "Powered by Bounded");
+                poweredBy.href = "https://bounded.sh";
+                poweredBy.target = "_blank";
+                poweredBy.rel = "noopener";
+                foot.appendChild(poweredBy);
+                card.appendChild(foot);
+            }
             return card;
         };
         // Solana Mobile leaves the page to sign in: the nonce fetch that precedes
@@ -9250,13 +9264,15 @@ async function prepareAndOpen(opts, pending) {
             frame.style.cssText = "width:100%;height:210px;border:0;background:transparent;color-scheme:dark";
             card.appendChild(frame);
             card.appendChild(status);
-            const foot = el("div", "foot");
-            const poweredBy = el("a", undefined, "Powered by Bounded");
-            poweredBy.href = "https://bounded.sh";
-            poweredBy.target = "_blank";
-            poweredBy.rel = "noopener";
-            foot.appendChild(poweredBy);
-            card.appendChild(foot);
+            if (showsAttribution(opts)) {
+                const foot = el("div", "foot");
+                const poweredBy = el("a", undefined, "Powered by Bounded");
+                poweredBy.href = "https://bounded.sh";
+                poweredBy.target = "_blank";
+                poweredBy.rel = "noopener";
+                foot.appendChild(poweredBy);
+                card.appendChild(foot);
+            }
             // Running the frame MINTS a session, so it takes the lock like every other lane. Abandoning
             // via Back settles it so the next lane the user picks is not refused by a claim nobody owns.
             const attempt = beginAttempt();
@@ -10795,6 +10811,133 @@ async function onramp(options = {}) {
     return Object.assign(Object.assign({}, base), { status: 'closed' });
 }
 
+// Connections: the signed-in user proves they own an account on another service
+// (X today) and Bounded records it for THIS app at `__connections__/<userId>`.
+// Policy rules read it, e.g. `get(/__connections__/@user.id).xHandle`; only the
+// platform can write it, and only after the provider's own consent screen.
+//
+//   await connect('x')                    // leaves the page for X's consent screen
+//   const done = await completeConnection() // on the page X sent the user back to
+//   const { x } = await getConnections()  // { id, handle, imageUrl, linkedAt } | null
+//   await disconnect('x')
+//
+// Only identity is kept: the provider token is discarded after one profile read.
+// The return page must be on an origin that serves this app (its bounded.page or
+// custom domain, or an origin the owner registered, such as localhost).
+/**
+ * `code` is the platform's error code, e.g. `cancelled`, `x_link_expired`, `connection_return_origin_not_allowed`,
+ * or `x_account_linked_elsewhere` when the app's policy sets `auth.connections.x.unique` and another user
+ * of the app already linked that X account.
+ */
+class ConnectionError extends Error {
+    constructor(code) {
+        super(`Connection failed: ${code}`);
+        this.code = code;
+        this.name = 'ConnectionError';
+    }
+}
+const RETURN_PARAMS = ['x_link', 'x_link_error'];
+async function request(path, init) {
+    var _a;
+    const base = (_a = (await core.getConfig()).devApiUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/$/, '');
+    if (!base)
+        throw new ConnectionError('connection_unavailable');
+    const generation = await core.getSessionGeneration(false);
+    let token = await core.getFreshAuthToken(false);
+    if (!token)
+        throw new ConnectionError('connection_sign_in_required');
+    const send = (bearer) => fetch(`${base}${path}`, Object.assign({ method: init.method, headers: Object.assign({ Authorization: `Bearer ${bearer}` }, (init.body === undefined ? {} : { 'Content-Type': 'application/json' })) }, (init.body === undefined ? {} : { body: JSON.stringify(init.body) })));
+    let response = await send(token);
+    if (response.status === 401) {
+        // Retry once with a refreshed token, never under a different login.
+        token = await core.getFreshAuthToken(false, { force: true });
+        if (!token || await core.getSessionGeneration(false) !== generation)
+            throw new ConnectionError('connection_sign_in_required');
+        response = await send(token);
+    }
+    const data = await response.json().catch(() => null);
+    if (!response.ok || (data === null || data === void 0 ? void 0 : data.ok) !== true) {
+        throw new ConnectionError(typeof (data === null || data === void 0 ? void 0 : data.error) === 'string' ? data.error : 'connection_unavailable');
+    }
+    return data;
+}
+function parseConnection(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const value = raw;
+    if (typeof value.id !== 'string' || typeof value.handle !== 'string' || !Number.isSafeInteger(value.linkedAt))
+        return null;
+    return {
+        id: value.id,
+        handle: value.handle,
+        imageUrl: typeof value.imageUrl === 'string' ? value.imageUrl : null,
+        linkedAt: value.linkedAt,
+    };
+}
+function assertProvider(provider) {
+    if (provider !== 'x')
+        throw new ConnectionError('connection_provider_unsupported');
+}
+/** The signed-in user's linked accounts for this app. */
+async function getConnections() {
+    var _a;
+    const data = await request('/connections', { method: 'GET' });
+    const connections = ((_a = data.connections) !== null && _a !== void 0 ? _a : {});
+    return { x: parseConnection(connections.x) };
+}
+/**
+ * Send the user to the provider's consent screen. They come back to `returnUrl`
+ * (default: this page), where `completeConnection()` finishes the link.
+ */
+async function connect(provider, options = {}) {
+    var _a;
+    assertProvider(provider);
+    if (typeof window === 'undefined')
+        throw new ConnectionError('connection_requires_browser');
+    const returnUrl = new URL((_a = options.returnUrl) !== null && _a !== void 0 ? _a : window.location.href, window.location.href);
+    for (const key of RETURN_PARAMS)
+        returnUrl.searchParams.delete(key);
+    const data = await request(`/connections/${provider}/start`, { method: 'POST', body: { returnUrl: returnUrl.href } });
+    const target = typeof data.authorizationUrl === 'string' ? new URL(data.authorizationUrl) : null;
+    if (!target || target.origin !== 'https://x.com')
+        throw new ConnectionError('connection_unavailable');
+    window.location.assign(target.href);
+}
+/**
+ * Finish a link on the page the provider returned to. Returns null when this page is
+ * not a connection return; throws ConnectionError when the user cancelled or it failed.
+ * Call it once the user is signed in. The return parameters leave the address bar on
+ * success or cancellation; after another failure they stay, so calling again retries.
+ */
+async function completeConnection() {
+    if (typeof window === 'undefined')
+        return null;
+    const url = new URL(window.location.href);
+    const token = url.searchParams.get('x_link');
+    const error = url.searchParams.get('x_link_error');
+    if (token === null && error === null)
+        return null;
+    const clear = () => {
+        for (const key of RETURN_PARAMS)
+            url.searchParams.delete(key);
+        window.history.replaceState(window.history.state, '', url.href);
+    };
+    if (error !== null || !token) {
+        clear();
+        throw new ConnectionError(error || 'failed');
+    }
+    // Keep the return token in the address bar until the platform accepts it, so a
+    // sign-in still loading or a transient failure can retry by calling this again.
+    const data = await request('/connections/x/complete', { method: 'POST', body: { state: token } });
+    clear();
+    return { provider: 'x', connection: parseConnection(data.connection) };
+}
+/** Remove the user's linked account for this app. */
+async function disconnect(provider) {
+    assertProvider(provider);
+    await request(`/connections/${provider}`, { method: 'DELETE' });
+}
+
 // venue-escrow.ts - fund and dispute a venue escrow from inside an OpenApps app (VENUE-GRANT-DESIGN.md).
 //
 // An OpenApps app's escrow lives in its venue (`agentescrows/<rootAppId>/e/<escrowId>`), and this
@@ -12153,6 +12296,7 @@ exports.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = BUILD_DELEGATED_REVIEW_CAPABI
 exports.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA;
 exports.BUILD_REVIEW_CAPABILITY_SCHEMA = BUILD_REVIEW_CAPABILITY_SCHEMA;
 exports.BuildsApiError = BuildsApiError;
+exports.ConnectionError = ConnectionError;
 exports.FAILURE_REASONS = FAILURE_REASONS;
 exports.NON_TERMINAL_STATES = NON_TERMINAL_STATES;
 exports.OffchainAuthProvider = OffchainAuthProvider;
@@ -12167,12 +12311,15 @@ exports.apps = apps;
 exports.bs58 = bs58;
 exports.bufferExports = bufferExports;
 exports.builds = builds;
+exports.completeConnection = completeConnection;
 exports.completeLoginFromRedirect = completeLoginFromRedirect;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
+exports.connect = connect;
 exports.connectBroadcast = connectBroadcast;
 exports.connectServiceSession = connectServiceSession;
 exports.defaultInjectedEvmProvider = defaultInjectedEvmProvider;
 exports.defaultInjectedProvider = defaultInjectedProvider;
+exports.disconnect = disconnect;
 exports.disputeVenueEscrow = disputeVenueEscrow;
 exports.ensureSharedWalletLoginReady = ensureSharedWalletLoginReady;
 exports.ensureSignedIn = ensureSignedIn;
@@ -12181,6 +12328,7 @@ exports.firstStandardWalletProvider = firstStandardWalletProvider;
 exports.fundVenueEscrow = fundVenueEscrow;
 exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
+exports.getConnections = getConnections;
 exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
 exports.getLoginReturnError = getLoginReturnError;
@@ -12226,4 +12374,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-C2xAP67N.js.map
+//# sourceMappingURL=index-B2HWEA13.js.map