@bounded-sh/client 0.0.119 → 0.0.120

package/dist/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-B4_eKphx.js');
+var index = require('./index-KUBcQdTX.js');
 var core = require('@bounded-sh/core');
 require('react');
 

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { as as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, ar as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, aq as BUILD_REVIEW_CAPABILITY_SCHEMA, aj as BuildsApiError, a7 as ConnectionError, ap as FAILURE_REASONS, al as NON_TERMINAL_STATES, ad as OffchainAuthProvider, ao as PARK_REASONS, ae as PrivyExpoProvider, an as RUN_STATES, am as TERMINAL_STATES, ab as VenueEscrowError, W as WalletConfigError, T as apps, ai as builds, a4 as completeConnection, K as completeLoginFromRedirect, a3 as connect, ag as connectBroadcast, ah as connectServiceSession, q as defaultInjectedEvmProvider, i as defaultInjectedProvider, a6 as disconnect, a9 as disputeVenueEscrow, H as ensureSharedWalletLoginReady, O as ensureSignedIn, G as ensureWalletLoginReady, a8 as fundVenueEscrow, y as getAuthLoading, C as getAuthProvider, a5 as getConnections, v as getCurrentUser, $ as getIdToken, L as getLoginReturnError, V as getOrCreateTurnkeyWallet, g as getPlatform, Z as getTurnkeyWalletRecoveryUrl, Y as getTurnkeyWalletSessionState, aa as getVenueEscrow, u as init, A as login, M as loginWithPopup, E as loginWithPrivy, J as loginWithRedirect, F as loginWithWallet, B as logout, ak as mediaAgentTools, x as onAuthLoadingChanged, w as onAuthStateChanged, a0 as onramp, a1 as onrampQuote, a2 as onrampStatus, N as openBoundedWidget, X as openTurnkeyKeyExport, I as preloadWalletLogin, af as requestEip6963Providers, ac as setPlatform, D as signInAnonymously, U as signSolanaMessageViaTurnkey, _ as startTurnkeyEmailLogin, l as supportsWalletSignIn, P as useAuth, R as useBuildRun, Q as useQuery, z as waitForAuthReady } from './index-BaXUWG8Q.mjs';
+export { as as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, ar as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, aq as BUILD_REVIEW_CAPABILITY_SCHEMA, aj as BuildsApiError, a7 as ConnectionError, ap as FAILURE_REASONS, al as NON_TERMINAL_STATES, ad as OffchainAuthProvider, ao as PARK_REASONS, ae as PrivyExpoProvider, an as RUN_STATES, am as TERMINAL_STATES, ab as VenueEscrowError, W as WalletConfigError, T as apps, ai as builds, a4 as completeConnection, K as completeLoginFromRedirect, a3 as connect, ag as connectBroadcast, ah as connectServiceSession, q as defaultInjectedEvmProvider, i as defaultInjectedProvider, a6 as disconnect, a9 as disputeVenueEscrow, H as ensureSharedWalletLoginReady, O as ensureSignedIn, G as ensureWalletLoginReady, a8 as fundVenueEscrow, y as getAuthLoading, C as getAuthProvider, a5 as getConnections, v as getCurrentUser, $ as getIdToken, L as getLoginReturnError, V as getOrCreateTurnkeyWallet, g as getPlatform, Z as getTurnkeyWalletRecoveryUrl, Y as getTurnkeyWalletSessionState, aa as getVenueEscrow, u as init, A as login, M as loginWithPopup, E as loginWithPrivy, J as loginWithRedirect, F as loginWithWallet, B as logout, ak as mediaAgentTools, x as onAuthLoadingChanged, w as onAuthStateChanged, a0 as onramp, a1 as onrampQuote, a2 as onrampStatus, N as openBoundedWidget, X as openTurnkeyKeyExport, I as preloadWalletLogin, af as requestEip6963Providers, ac as setPlatform, D as signInAnonymously, U as signSolanaMessageViaTurnkey, _ as startTurnkeyEmailLogin, l as supportsWalletSignIn, P as useAuth, R as useBuildRun, Q as useQuery, z as waitForAuthReady } from './index-BdzGX8fS.mjs';
 export * from '@bounded-sh/core';
 export { AppTokenExchangeError, BoundedDeclineError, DECLINE_EVENT_NAME, RATE_LIMIT_EVENT_NAME, ScopedClientReadOnlyError, aggregate, clearAppTokenCache, count, createAppTokenAuthHeaders, createClient, deriveDecline, dispatchDeclineEvent, dispatchRateLimitEvent, docId, exchangeAppToken, get, getConfig, getFiles, getMany, prepareToSign, queryAggregate, reconcileSetResult, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, waitForSetResult } from '@bounded-sh/core';
 import 'react';

package/dist/{index.native-B-pjNetI.js → index.native-CZSRvIAb.js}

@@ -151,8 +151,17 @@ function createWebPlatform() {
             // bundlers do not externalize or preload a Node-only module in the
             // email/guest graph; this branch is unreachable when WebCrypto is
             // available (all supported browsers and current Node releases).
+            // The try makes it an optional dependency for Metro, whose production
+            // constant folding turns the specifier back into a literal: a React Native
+            // app with no node:crypto mapping still bundles (it passes setPlatform({ sha256 })).
             const nodeCryptoSpecifier = 'node:crypto';
-            const { createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier);
+            let createHash;
+            try {
+                ({ createHash } = await import(/* @vite-ignore */ nodeCryptoSpecifier));
+            }
+            catch (_b) {
+                throw new Error('SHA-256 needs WebCrypto here: pass setPlatform({ sha256 }) (e.g. expo-crypto digest).');
+            }
             const hash = createHash('sha256').update(data).digest();
             return hash.buffer.slice(hash.byteOffset, hash.byteOffset + hash.byteLength);
         },
@@ -5189,6 +5198,14 @@ function cleanCallbackUrl(url) {
         clean.searchParams.delete(key);
     return clean;
 }
+// The address a code returned to, without the fragment. The issuer never sets one
+// (redirectUri may not carry one), but a browser can keep one across the redirect
+// chain: iOS lands a Google sign-in on `<redirectUri>?code=...#`.
+function returnAddress(url) {
+    const clean = cleanCallbackUrl(url);
+    clean.hash = '';
+    return clean.href;
+}
 async function validateAttempt(pkce, callback) {
     const cfg = await core.getConfig();
     if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
@@ -5198,7 +5215,7 @@ async function validateAttempt(pkce, callback) {
     if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
         throw new Error('Login expired. Start sign-in again.');
     }
-    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+    if (callback && (returnAddress(callback) !== returnAddress(new URL(pkce.redirectUri)) ||
         (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
         throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
     }
@@ -5451,7 +5468,7 @@ function parseCallbackParams(callbackUrl) {
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
 // as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
-    var _a, _b;
+    var _a, _b, _c, _d;
     const { url, pkce } = await buildAuthorize(opts);
     const WebBrowser = await loadExpoWebBrowser();
     const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
@@ -5463,12 +5480,16 @@ async function runNativeLogin(opts) {
         // openAuthSessionAsync keeps JS alive while the system browser is shown, then
         // resolves with the callback URL once the universal link fires — so `pkce`
         // stays in scope and never needs to be persisted.
-        const result = await openAuthSession(url, opts.redirectUri);
+        // iOS (17.4+) only returns an https callback to the app when asked to; without it the
+        // sheet treats "https" as a custom scheme and never completes. A custom scheme callback
+        // (an Expo Go preview's exps://) is caught by its scheme either way.
+        const preferUniversalLinks = (_c = (_b = opts.redirectUri) === null || _b === void 0 ? void 0 : _b.startsWith('https:')) !== null && _c !== void 0 ? _c : false;
+        const result = await openAuthSession(url, opts.redirectUri, { preferUniversalLinks });
         if (!result || result.type === 'cancel' || result.type === 'dismiss') {
             throw new Error('Login cancelled');
         }
         if (result.type !== 'success' || typeof result.url !== 'string') {
-            throw new Error(`Hosted login did not complete (result: ${(_b = result === null || result === void 0 ? void 0 : result.type) !== null && _b !== void 0 ? _b : 'unknown'})`);
+            throw new Error(`Hosted login did not complete (result: ${(_d = result === null || result === void 0 ? void 0 : result.type) !== null && _d !== void 0 ? _d : 'unknown'})`);
         }
         const { code, state: returnedState } = parseCallbackParams(result.url);
         if (!code)
@@ -5491,7 +5512,8 @@ async function runNativeLogin(opts) {
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
  *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
  *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
- *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
+ *  (custom `myapp://` schemes are rejected by the issuer; an app preview opened in Expo Go
+ *  uses `exps://<preview host>/--/<path>`). Needs the optional peer deps
  *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
 async function loginWithRedirect(opts) {
     if (isNative())
@@ -6170,7 +6192,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-wOISnCic.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-Bb_0mHJ_.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6212,7 +6234,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BsTfBAD4.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-Ckljhcbu.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6225,7 +6247,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-DQMYqPus.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-4T_-2UQI.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6250,7 +6272,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-xap-VQBP.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CJUbifdu.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6312,7 +6334,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-xap-VQBP.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CJUbifdu.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6483,7 +6505,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-BsTfBAD4.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-Ckljhcbu.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -9048,4 +9070,4 @@ exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
 exports.walletStandardFeatureName = walletStandardFeatureName;
-//# sourceMappingURL=index.native-B-pjNetI.js.map
+//# sourceMappingURL=index.native-CZSRvIAb.js.map