@bounded-sh/client 0.0.119 → 0.0.120-expo.0

package/dist/{index-B4_eKphx.js → index-KUBcQdTX.js}

@@ -158,8 +158,17 @@ function createWebPlatform() {
             // bundlers do not externalize or preload a Node-only module in the
             // email/guest graph; this branch is unreachable when WebCrypto is
             // available (all supported browsers and current Node releases).
+            // The try makes it an optional dependency for Metro, whose production
+            // constant folding turns the specifier back into a literal: a React Native
+            // app with no node:crypto mapping still bundles (it passes setPlatform({ sha256 })).
             const nodeCryptoSpecifier = 'node:crypto';
-            const { createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier);
+            let createHash;
+            try {
+                ({ createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier));
+            }
+            catch (_b) {
+                throw new Error('SHA-256 needs WebCrypto here: pass setPlatform({ sha256 }) (e.g. expo-crypto digest).');
+            }
             const hash = createHash('sha256').update(data).digest();
             return hash.buffer.slice(hash.byteOffset, hash.byteOffset + hash.byteLength);
         },
@@ -5522,6 +5531,14 @@ function cleanCallbackUrl(url) {
         clean.searchParams.delete(key);
     return clean;
 }
+// The address a code returned to, without the fragment. The issuer never sets one
+// (redirectUri may not carry one), but a browser can keep one across the redirect
+// chain: iOS lands a Google sign-in on `<redirectUri>?code=...#`.
+function returnAddress(url) {
+    const clean = cleanCallbackUrl(url);
+    clean.hash = '';
+    return clean.href;
+}
 async function validateAttempt(pkce, callback) {
     const cfg = await core.getConfig();
     if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
@@ -5531,7 +5548,7 @@ async function validateAttempt(pkce, callback) {
     if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
         throw new Error('Login expired. Start sign-in again.');
     }
-    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+    if (callback && (returnAddress(callback) !== returnAddress(new URL(pkce.redirectUri)) ||
         (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
         throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
     }
@@ -5784,7 +5801,7 @@ function parseCallbackParams(callbackUrl) {
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
 // as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
-    var _a, _b;
+    var _a, _b, _c, _d;
     const { url, pkce } = await buildAuthorize(opts);
     const WebBrowser = await loadExpoWebBrowser();
     const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
@@ -5796,12 +5813,16 @@ async function runNativeLogin(opts) {
         // openAuthSessionAsync keeps JS alive while the system browser is shown, then
         // resolves with the callback URL once the universal link fires — so `pkce`
         // stays in scope and never needs to be persisted.
-        const result = await openAuthSession(url, opts.redirectUri);
+        // iOS (17.4+) only returns an https callback to the app when asked to; without it the
+        // sheet treats "https" as a custom scheme and never completes. A custom scheme callback
+        // (an Expo Go preview's exps://) is caught by its scheme either way.
+        const preferUniversalLinks = (_c = (_b = opts.redirectUri) === null || _b === void 0 ? void 0 : _b.startsWith('https:')) !== null && _c !== void 0 ? _c : false;
+        const result = await openAuthSession(url, opts.redirectUri, { preferUniversalLinks });
         if (!result || result.type === 'cancel' || result.type === 'dismiss') {
             throw new Error('Login cancelled');
         }
         if (result.type !== 'success' || typeof result.url !== 'string') {
-            throw new Error(`Hosted login did not complete (result: ${(_b = result === null || result === void 0 ? void 0 : result.type) !== null && _b !== void 0 ? _b : 'unknown'})`);
+            throw new Error(`Hosted login did not complete (result: ${(_d = result === null || result === void 0 ? void 0 : result.type) !== null && _d !== void 0 ? _d : 'unknown'})`);
         }
         const { code, state: returnedState } = parseCallbackParams(result.url);
         if (!code)
@@ -5824,7 +5845,8 @@ async function runNativeLogin(opts) {
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
  *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
  *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
- *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
+ *  (custom `myapp://` schemes are rejected by the issuer; an app preview opened in Expo Go
+ *  uses `exps://<preview host>/--/<path>`). Needs the optional peer deps
  *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
 async function loginWithRedirect(opts) {
     if (isNative())
@@ -6561,7 +6583,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-DyzhiN9Y.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-IsiArtx0.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6603,7 +6625,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B8QTPxf6.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CJ0v5Sgn.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6616,7 +6638,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CKAv4Qxh.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider--XJFh-7d.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6641,7 +6663,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Br3iM3O3.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DTEwf7qP.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6703,7 +6725,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Br3iM3O3.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DTEwf7qP.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6874,7 +6896,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-B8QTPxf6.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-CJ0v5Sgn.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6979,7 +7001,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B8QTPxf6.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CJ0v5Sgn.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -12440,4 +12462,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-B4_eKphx.js.map
+//# sourceMappingURL=index-KUBcQdTX.js.map