@bounded-sh/client 0.0.118 → 0.0.120-expo.0

package/dist/{index.native-YmmnwqEw.mjs → index.native-N5zxPEYK.mjs}

@@ -35,7 +35,18 @@ function walletOperationGuard() {
             throw new Error('wallet_session_changed');
     };
 }
-function setWalletSessionState(key, state) { }
+// This realm owns one active SDK session and one retained signer frame.
+let activeWalletState;
+function setWalletSessionState(key, state) { activeWalletState = { key, state }; }
+function walletSessionState(key) {
+    if ((activeWalletState === null || activeWalletState === void 0 ? void 0 : activeWalletState.key) !== key)
+        return { status: 'verification-required' };
+    const state = activeWalletState.state;
+    if (state.status === 'ready' && (!Number.isFinite(state.expiresAt) || state.expiresAt <= Date.now())) {
+        return { status: 'verification-required', reason: 'wallet_session_expired' };
+    }
+    return state;
+}
 
 /**
  * Platform abstraction layer for React Native compatibility.
@@ -119,8 +130,17 @@ function createWebPlatform() {
             // bundlers do not externalize or preload a Node-only module in the
             // email/guest graph; this branch is unreachable when WebCrypto is
             // available (all supported browsers and current Node releases).
+            // The try makes it an optional dependency for Metro, whose production
+            // constant folding turns the specifier back into a literal: a React Native
+            // app with no node:crypto mapping still bundles (it passes setPlatform({ sha256 })).
             const nodeCryptoSpecifier = 'node:crypto';
-            const { createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier);
+            let createHash;
+            try {
+                ({ createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier));
+            }
+            catch (_b) {
+                throw new Error('SHA-256 needs WebCrypto here: pass setPlatform({ sha256 }) (e.g. expo-crypto digest).');
+            }
             const hash = createHash('sha256').update(data).digest();
             return hash.buffer.slice(hash.byteOffset, hash.byteOffset + hash.byteLength);
         },
@@ -226,6 +246,10 @@ class OffchainAuthProvider {
     async signTransaction(tx) {
         return this.wrappedProvider.signTransaction(tx);
     }
+    async prepareToSign() {
+        var _a, _b, _c;
+        return (_c = (await ((_b = (_a = this.wrappedProvider).prepareToSign) === null || _b === void 0 ? void 0 : _b.call(_a)))) !== null && _c !== void 0 ? _c : 'ready';
+    }
     /**
      * Sign and submit transaction - not supported in poofnet environment.
      * See the real providers (PhantomWalletProvider, SolanaKeypairProvider)
@@ -4143,6 +4167,11 @@ function detachWarmSignerIframe(origin) {
     detachIframe(modal);
     return true;
 }
+/** A removed frame cannot still supply its in-memory signing session. */
+function hasWarmSignerFrame(context) {
+    var _a;
+    return Boolean(((_a = modal === null || modal === void 0 ? void 0 : modal.iframe) === null || _a === void 0 ? void 0 : _a.isConnected) && modal.iframeContext === context);
+}
 function detachIframe(m) {
     if (m.iframe) {
         try {
@@ -4184,7 +4213,7 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
     const requestId = String(ex.request.requestId);
     // Serialize: the approve card is modal, and one warm frame handles one request at a time.
     const run = m.chain.then(() => new Promise((resolve, reject) => {
-        var _a;
+        var _a, _b;
         let settled = false;
         let usedFallback = false;
         (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
@@ -4227,16 +4256,20 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
                 /* frame gone */
             }
         };
+        const dismiss = () => {
+            if (!ex.silent)
+                hideModal(m);
+        };
         const goFallback = () => {
             if (usedFallback || settled)
                 return;
             usedFallback = true;
-            hideModal(m);
+            dismiss();
             finish(() => popupFallback().then(resolve, reject));
         };
         m.onBackdrop = () => {
             cancelInFrame();
-            hideModal(m);
+            dismiss();
             finish(() => reject(new Error("cancelled")));
         };
         m.onIframeMessage = (d) => {
@@ -4251,17 +4284,18 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
             if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
                 const outcome = ex.onResult(d);
                 if ("error" in outcome) {
-                    hideModal(m);
+                    dismiss();
                     finish(() => reject(new Error(outcome.error)));
                     return;
                 }
                 if (outcome.done) {
-                    hideModal(m);
+                    dismiss();
                     finish(() => resolve(outcome.value));
                 }
             }
         };
-        showModal(m);
+        if (!ex.silent)
+            showModal(m);
         if (m.iframeReady)
             send();
         // If the frame never loads, degrade to the popup (best-effort - a post-load
@@ -4274,10 +4308,10 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
         ceilingTimer = window.setTimeout(() => {
             if (!settled) {
                 cancelInFrame();
-                hideModal(m);
+                dismiss();
                 finish(() => reject(new Error("Wallet approval timed out.")));
             }
-        }, 5 * 60 * 1000);
+        }, (_b = ex.ceilingMs) !== null && _b !== void 0 ? _b : 5 * 60 * 1000);
     }));
     m.chain = run.then(() => undefined, () => undefined);
     return run;
@@ -4779,6 +4813,59 @@ async function clearTurnkeySigningSession(idToken) {
 function hasTurnkeyWallet() {
     return activeTurnkeyAddress() !== null;
 }
+/** The signer frame could not take the exchange: it never loaded, or a page from before the request existed stays silent. */
+class SignerFrameUnavailable extends Error {
+    constructor() { super('The Bounded signer frame did not answer.'); }
+}
+/** How long a silent session probe may wait for the frame before the write goes on without it. */
+const SESSION_PROBE_MS = 8000;
+/**
+ * Make the wallet's 24-hour signing session live BEFORE a transaction exists. Without one the
+ * approve card must first collect an emailed code, which takes longer than a transaction's
+ * blockhash lifetime (about 33 seconds on mainnet in late 2026), so a transaction built before
+ * the code is dead by the time it is signed. A live session is found with nothing shown: the
+ * warm frame answers a silent probe, and it holds the session even where the browser blocks its
+ * storage. Only a lapsed session opens the card, which runs the code ceremony and closes without
+ * signing anything. Resolves `'established'` when that ceremony ran, else `'ready'`.
+ *
+ * Both exchanges run in the warm frame only, since it is the frame that signs next and a popup
+ * keeps its session to itself. Where the frame cannot answer (an embedder that blocks it, or a
+ * signer page from before this request existed), the write goes on the way it always did: the
+ * approve card collects the code itself, and an expired build is built again.
+ */
+async function ensureTurnkeySigningSession() {
+    if (!hasDOM$2())
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (trusted wallet UI).');
+    const context = await turnkeySignerPage();
+    context.assertCurrent();
+    if (hasWarmSignerFrame(context.key) && walletSessionState(context.key).status === 'ready')
+        return 'ready';
+    const { url, origin } = context;
+    const authorization = await fetchActionAuthorization('createWallet', context);
+    const frameOnly = () => Promise.reject(new SignerFrameUnavailable());
+    const exchange = (probeOnly) => ({
+        context: context.key, assertCurrent: context.assertCurrent,
+        request: Object.assign({ type: 'bounded:turnkey:session', requestId: `tksession_${Date.now()}_${++requestSeq}`, authorization }, (probeOnly ? { probeOnly: true } : {})),
+        onResult: (d) => d.ok ? { done: true, value: d } : { error: String(d.error || 'The signing session could not be established') },
+    });
+    const probed = await runWidget(url, origin, Object.assign(Object.assign({}, exchange(true)), { silent: true, ceilingMs: SESSION_PROBE_MS }), frameOnly)
+        .catch(() => null);
+    if (!probed)
+        return 'ready';
+    let result = probed;
+    if (result.ready !== true) {
+        try {
+            result = await runWidget(url, origin, exchange(false), frameOnly);
+        }
+        catch (error) {
+            if (error instanceof SignerFrameUnavailable)
+                return 'ready';
+            throw error;
+        }
+    }
+    setWalletSessionState(context.key, { status: 'ready', expiresAt: Number(result.signingSessionExpiresAt) });
+    return result.established === true ? 'established' : 'ready';
+}
 /**
  * Open the Bounded Turnkey approval card and sign `message` (raw bytes) with the
  * user's Turnkey wallet, resolving with the ed25519 signature and wallet address.
@@ -4815,7 +4902,7 @@ async function signSolanaMessageViaTurnkey(message) {
                 // A top-level popup keeps its signing session in the signer origin's own storage, which the
                 // warm in-app frame (a partitioned context) cannot see, so it says nothing about that frame.
                 if (transport !== 'popup')
-                    setWalletSessionState(context.key, { expiresAt: Number(d.signingSessionExpiresAt) });
+                    setWalletSessionState(context.key, { status: 'ready', expiresAt: Number(d.signingSessionExpiresAt) });
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
             }
             // The hosted signer refuses a cross-app signature inside a frame. Never retry it from here:
@@ -4931,6 +5018,7 @@ async function signAndSubmitTransactionWithTurnkey(transaction, feePayer) {
 var turnkeySignerBridge = /*#__PURE__*/Object.freeze({
     __proto__: null,
     clearTurnkeySigningSession: clearTurnkeySigningSession,
+    ensureTurnkeySigningSession: ensureTurnkeySigningSession,
     hasTurnkeyWallet: hasTurnkeyWallet,
     signAndSubmitTransactionWithTurnkey: signAndSubmitTransactionWithTurnkey,
     signMessageWithTurnkey: signMessageWithTurnkey,
@@ -5010,6 +5098,11 @@ const oidcProviderSingleton = {
             throw new Error(OIDC_NO_WALLET);
         return signTransactionV1WithTurnkey(transaction);
     },
+    async prepareToSign() {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return ensureTurnkeySigningSession();
+    },
     supportedTransactionVersions() {
         return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];
     },
@@ -5084,6 +5177,14 @@ function cleanCallbackUrl(url) {
         clean.searchParams.delete(key);
     return clean;
 }
+// The address a code returned to, without the fragment. The issuer never sets one
+// (redirectUri may not carry one), but a browser can keep one across the redirect
+// chain: iOS lands a Google sign-in on `<redirectUri>?code=...#`.
+function returnAddress(url) {
+    const clean = cleanCallbackUrl(url);
+    clean.hash = '';
+    return clean.href;
+}
 async function validateAttempt(pkce, callback) {
     const cfg = await getConfig();
     if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
@@ -5093,7 +5194,7 @@ async function validateAttempt(pkce, callback) {
     if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
         throw new Error('Login expired. Start sign-in again.');
     }
-    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+    if (callback && (returnAddress(callback) !== returnAddress(new URL(pkce.redirectUri)) ||
         (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
         throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
     }
@@ -5346,7 +5447,7 @@ function parseCallbackParams(callbackUrl) {
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
 // as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
-    var _a, _b;
+    var _a, _b, _c, _d;
     const { url, pkce } = await buildAuthorize(opts);
     const WebBrowser = await loadExpoWebBrowser();
     const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
@@ -5358,12 +5459,16 @@ async function runNativeLogin(opts) {
         // openAuthSessionAsync keeps JS alive while the system browser is shown, then
         // resolves with the callback URL once the universal link fires — so `pkce`
         // stays in scope and never needs to be persisted.
-        const result = await openAuthSession(url, opts.redirectUri);
+        // iOS (17.4+) only returns an https callback to the app when asked to; without it the
+        // sheet treats "https" as a custom scheme and never completes. A custom scheme callback
+        // (an Expo Go preview's exps://) is caught by its scheme either way.
+        const preferUniversalLinks = (_c = (_b = opts.redirectUri) === null || _b === void 0 ? void 0 : _b.startsWith('https:')) !== null && _c !== void 0 ? _c : false;
+        const result = await openAuthSession(url, opts.redirectUri, { preferUniversalLinks });
         if (!result || result.type === 'cancel' || result.type === 'dismiss') {
             throw new Error('Login cancelled');
         }
         if (result.type !== 'success' || typeof result.url !== 'string') {
-            throw new Error(`Hosted login did not complete (result: ${(_b = result === null || result === void 0 ? void 0 : result.type) !== null && _b !== void 0 ? _b : 'unknown'})`);
+            throw new Error(`Hosted login did not complete (result: ${(_d = result === null || result === void 0 ? void 0 : result.type) !== null && _d !== void 0 ? _d : 'unknown'})`);
         }
         const { code, state: returnedState } = parseCallbackParams(result.url);
         if (!code)
@@ -5386,7 +5491,8 @@ async function runNativeLogin(opts) {
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
  *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
  *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
- *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
+ *  (custom `myapp://` schemes are rejected by the issuer; an app preview opened in Expo Go
+ *  uses `exps://<preview host>/--/<path>`). Needs the optional peer deps
  *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
 async function loginWithRedirect(opts) {
     if (isNative())
@@ -6065,7 +6171,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-DFHalX9c.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-ao5ce_SN.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6107,7 +6213,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DSOjJP3u.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-yyJfuVgv.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6120,7 +6226,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BoLGCVqD.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-CtPPhtMh.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6145,7 +6251,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-BRq3JB0_.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-DxQG3JvU.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6207,7 +6313,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-BRq3JB0_.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-DxQG3JvU.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6378,7 +6484,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-DSOjJP3u.mjs');
+            await import('./injected-wallet-provider-yyJfuVgv.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -8884,5 +8990,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { PARK_REASONS as $, waitForAuthReady as A, login as B, logout as C, getAuthProvider as D, signInAnonymously as E, loginWithPrivy as F, loginWithRedirect as G, completeLoginFromRedirect as H, getLoginReturnError as I, loginWithPopup as J, useAuth as K, useQuery as L, useBuildRun as M, apps as N, getIdToken as O, onramp as P, onrampQuote as Q, onrampStatus as R, setPlatform as S, OffchainAuthProvider as T, PrivyExpoProvider as U, builds as V, BuildsApiError as W, mediaAgentTools as X, NON_TERMINAL_STATES as Y, TERMINAL_STATES as Z, RUN_STATES as _, signMessageWithTurnkey as a, FAILURE_REASONS as a0, BUILD_REVIEW_CAPABILITY_SCHEMA as a1, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a2, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a3, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, solanaMobileWalletLeavesPage as i, solanaMobileWalletAnswersSignInFromCache as j, isSolanaMobileWallet as k, setAuthLoading as l, bufferExports as m, normalizeSolanaRpcUrl as n, setStoredAuthMethod as o, confirmAndCheckTransaction as p, resolveSolanaRpcUrl as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, init as u, getCurrentUser as v, walletStandardFeatureName as w, onAuthStateChanged as x, onAuthLoadingChanged as y, getAuthLoading as z };
-//# sourceMappingURL=index.native-YmmnwqEw.mjs.map
+export { RUN_STATES as $, getAuthLoading as A, waitForAuthReady as B, login as C, logout as D, getAuthProvider as E, signInAnonymously as F, loginWithPrivy as G, loginWithRedirect as H, completeLoginFromRedirect as I, getLoginReturnError as J, loginWithPopup as K, useAuth as L, useQuery as M, useBuildRun as N, apps as O, getIdToken as P, onramp as Q, onrampQuote as R, onrampStatus as S, setPlatform as T, OffchainAuthProvider as U, PrivyExpoProvider as V, builds as W, BuildsApiError as X, mediaAgentTools as Y, NON_TERMINAL_STATES as Z, TERMINAL_STATES as _, signMessageWithTurnkey as a, PARK_REASONS as a0, FAILURE_REASONS as a1, BUILD_REVIEW_CAPABILITY_SCHEMA as a2, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a3, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a4, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, ensureTurnkeySigningSession as e, bs58 as f, getPlatform as g, hasTurnkeyWallet as h, getWallets as i, solanaMobileWalletLeavesPage as j, solanaMobileWalletAnswersSignInFromCache as k, isSolanaMobileWallet as l, setAuthLoading as m, normalizeSolanaRpcUrl as n, bufferExports as o, setStoredAuthMethod as p, confirmAndCheckTransaction as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, resolveSolanaRpcUrl as u, init as v, walletStandardFeatureName as w, getCurrentUser as x, onAuthStateChanged as y, onAuthLoadingChanged as z };
+//# sourceMappingURL=index.native-N5zxPEYK.mjs.map