@bounded-sh/client 0.0.119 → 0.0.120-expo.0

package/dist/{index.native-B4yI0BqT.mjs → index.native-N5zxPEYK.mjs}

@@ -130,8 +130,17 @@ function createWebPlatform() {
             // bundlers do not externalize or preload a Node-only module in the
             // email/guest graph; this branch is unreachable when WebCrypto is
             // available (all supported browsers and current Node releases).
+            // The try makes it an optional dependency for Metro, whose production
+            // constant folding turns the specifier back into a literal: a React Native
+            // app with no node:crypto mapping still bundles (it passes setPlatform({ sha256 })).
             const nodeCryptoSpecifier = 'node:crypto';
-            const { createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier);
+            let createHash;
+            try {
+                ({ createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier));
+            }
+            catch (_b) {
+                throw new Error('SHA-256 needs WebCrypto here: pass setPlatform({ sha256 }) (e.g. expo-crypto digest).');
+            }
             const hash = createHash('sha256').update(data).digest();
             return hash.buffer.slice(hash.byteOffset, hash.byteOffset + hash.byteLength);
         },
@@ -5168,6 +5177,14 @@ function cleanCallbackUrl(url) {
         clean.searchParams.delete(key);
     return clean;
 }
+// The address a code returned to, without the fragment. The issuer never sets one
+// (redirectUri may not carry one), but a browser can keep one across the redirect
+// chain: iOS lands a Google sign-in on `<redirectUri>?code=...#`.
+function returnAddress(url) {
+    const clean = cleanCallbackUrl(url);
+    clean.hash = '';
+    return clean.href;
+}
 async function validateAttempt(pkce, callback) {
     const cfg = await getConfig();
     if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
@@ -5177,7 +5194,7 @@ async function validateAttempt(pkce, callback) {
     if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
         throw new Error('Login expired. Start sign-in again.');
     }
-    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+    if (callback && (returnAddress(callback) !== returnAddress(new URL(pkce.redirectUri)) ||
         (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
         throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
     }
@@ -5430,7 +5447,7 @@ function parseCallbackParams(callbackUrl) {
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
 // as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
-    var _a, _b;
+    var _a, _b, _c, _d;
     const { url, pkce } = await buildAuthorize(opts);
     const WebBrowser = await loadExpoWebBrowser();
     const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
@@ -5442,12 +5459,16 @@ async function runNativeLogin(opts) {
         // openAuthSessionAsync keeps JS alive while the system browser is shown, then
         // resolves with the callback URL once the universal link fires — so `pkce`
         // stays in scope and never needs to be persisted.
-        const result = await openAuthSession(url, opts.redirectUri);
+        // iOS (17.4+) only returns an https callback to the app when asked to; without it the
+        // sheet treats "https" as a custom scheme and never completes. A custom scheme callback
+        // (an Expo Go preview's exps://) is caught by its scheme either way.
+        const preferUniversalLinks = (_c = (_b = opts.redirectUri) === null || _b === void 0 ? void 0 : _b.startsWith('https:')) !== null && _c !== void 0 ? _c : false;
+        const result = await openAuthSession(url, opts.redirectUri, { preferUniversalLinks });
         if (!result || result.type === 'cancel' || result.type === 'dismiss') {
             throw new Error('Login cancelled');
         }
         if (result.type !== 'success' || typeof result.url !== 'string') {
-            throw new Error(`Hosted login did not complete (result: ${(_b = result === null || result === void 0 ? void 0 : result.type) !== null && _b !== void 0 ? _b : 'unknown'})`);
+            throw new Error(`Hosted login did not complete (result: ${(_d = result === null || result === void 0 ? void 0 : result.type) !== null && _d !== void 0 ? _d : 'unknown'})`);
         }
         const { code, state: returnedState } = parseCallbackParams(result.url);
         if (!code)
@@ -5470,7 +5491,8 @@ async function runNativeLogin(opts) {
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
  *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
  *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
- *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
+ *  (custom `myapp://` schemes are rejected by the issuer; an app preview opened in Expo Go
+ *  uses `exps://<preview host>/--/<path>`). Needs the optional peer deps
  *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
 async function loginWithRedirect(opts) {
     if (isNative())
@@ -6149,7 +6171,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-DOI-4lPC.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-ao5ce_SN.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6191,7 +6213,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CQxGVYja.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-yyJfuVgv.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6204,7 +6226,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-Vw-Puwxh.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-CtPPhtMh.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6229,7 +6251,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-ZOBNFoeC.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-DxQG3JvU.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6291,7 +6313,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-ZOBNFoeC.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-DxQG3JvU.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6462,7 +6484,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-CQxGVYja.mjs');
+            await import('./injected-wallet-provider-yyJfuVgv.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -8969,4 +8991,4 @@ class PrivyExpoProvider {
 }
 
 export { RUN_STATES as $, getAuthLoading as A, waitForAuthReady as B, login as C, logout as D, getAuthProvider as E, signInAnonymously as F, loginWithPrivy as G, loginWithRedirect as H, completeLoginFromRedirect as I, getLoginReturnError as J, loginWithPopup as K, useAuth as L, useQuery as M, useBuildRun as N, apps as O, getIdToken as P, onramp as Q, onrampQuote as R, onrampStatus as S, setPlatform as T, OffchainAuthProvider as U, PrivyExpoProvider as V, builds as W, BuildsApiError as X, mediaAgentTools as Y, NON_TERMINAL_STATES as Z, TERMINAL_STATES as _, signMessageWithTurnkey as a, PARK_REASONS as a0, FAILURE_REASONS as a1, BUILD_REVIEW_CAPABILITY_SCHEMA as a2, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a3, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a4, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, ensureTurnkeySigningSession as e, bs58 as f, getPlatform as g, hasTurnkeyWallet as h, getWallets as i, solanaMobileWalletLeavesPage as j, solanaMobileWalletAnswersSignInFromCache as k, isSolanaMobileWallet as l, setAuthLoading as m, normalizeSolanaRpcUrl as n, bufferExports as o, setStoredAuthMethod as p, confirmAndCheckTransaction as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, resolveSolanaRpcUrl as u, init as v, walletStandardFeatureName as w, getCurrentUser as x, onAuthStateChanged as y, onAuthLoadingChanged as z };
-//# sourceMappingURL=index.native-B4yI0BqT.mjs.map
+//# sourceMappingURL=index.native-N5zxPEYK.mjs.map