@bounded-sh/client 0.0.24 → 0.0.26

package/dist/{index.native-D1YQ-LU7.mjs → index.native-DEWlFCQV.mjs}

@@ -67,6 +67,17 @@ function createWebPlatform() {
             const hash = createHash('sha256').update(data).digest();
             return hash.buffer.slice(hash.byteOffset, hash.byteOffset + hash.byteLength);
         },
+        getRandomBytes(length) {
+            const out = new Uint8Array(length);
+            const g = typeof globalThis !== 'undefined' ? globalThis : undefined;
+            if (g && g.crypto && typeof g.crypto.getRandomValues === 'function') {
+                g.crypto.getRandomValues(out);
+                return out;
+            }
+            throw new Error('No secure random source available for PKCE. On React Native, either import ' +
+                "'react-native-get-random-values' once at your app entry, or pass getRandomBytes " +
+                'via setPlatform({ getRandomBytes }) (e.g. expo-crypto getRandomBytes).');
+        },
         getUserAgent() {
             if (hasWindow && typeof navigator !== 'undefined')
                 return navigator.userAgent;
@@ -4234,24 +4245,27 @@ async function issuerBase() {
     const cfg = await getConfig();
     return (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
 }
+// Base64url-encode raw bytes via the platform abstraction (web: window.btoa;
+// RN/Node: the polyfilled/Buffer btoa supplied by getPlatform()). On web this is
+// byte-identical to the previous direct `btoa(...)` call.
 function b64url(buf) {
     let s = '';
-    const bytes = new Uint8Array(buf);
+    const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
     for (let i = 0; i < bytes.length; i++)
         s += String.fromCharCode(bytes[i]);
-    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return getPlatform().btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
+// PKCE verifier + S256 challenge, fully platform-neutral: random bytes and the
+// SHA-256 digest both come from getPlatform() (web → WebCrypto, RN → polyfill/
+// expo-crypto). Web output is identical to the previous raw-crypto path.
 async function makePkce() {
-    const rnd = new Uint8Array(32);
-    crypto.getRandomValues(rnd);
-    const verifier = b64url(rnd.buffer);
-    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    const rnd = getPlatform().getRandomBytes(32);
+    const verifier = b64url(rnd);
+    const digest = await getPlatform().sha256(getPlatform().textEncode(verifier));
     return { verifier, challenge: b64url(digest) };
 }
 function randomState() {
-    const rnd = new Uint8Array(16);
-    crypto.getRandomValues(rnd);
-    return b64url(rnd.buffer);
+    return b64url(getPlatform().getRandomBytes(16));
 }
 function normalizeMethod(value) {
     const normalized = String(value || '').trim().toLowerCase();
@@ -4267,84 +4281,171 @@ function appendHostedLoginHints(params, opts) {
     const provider = normalizeMethod(opts.provider);
     if (provider)
         params.set('bounded_provider', provider);
+    // Standard OIDC prompt (e.g. 'login' to force a fresh sign-in / account choice).
+    const prompt = normalizeMethod(opts.prompt);
+    if (prompt)
+        params.set('prompt', prompt);
 }
-async function buildAuthorizeUrl(opts) {
+// Build the authorize URL + the PKCE state that pairs with it. PURE: no storage,
+// no navigation — so it's shared verbatim by the web redirect/popup paths and the
+// native (expo-web-browser) path. The caller decides where the PkceState lives
+// (web → sessionStorage across the full-page redirect; native → in-memory across
+// the awaited browser session).
+async function buildAuthorize(opts, guestHint) {
     const cfg = await getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
     const redirectUri = opts.redirectUri;
     const { verifier, challenge } = await makePkce();
     const state = randomState();
-    // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
-    // is per-tab and cleared on close — appropriate for a short-lived auth handshake.
-    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify({ verifier, state, redirectUri }));
     const base = await issuerBase();
     const params = new URLSearchParams({
         client_id: cfg.appId, redirect_uri: redirectUri, response_type: 'code', scope: 'openid profile email',
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    return `${base}/api/auth/oauth2/authorize?${params.toString()}`;
+    // Anonymous→real UPGRADE (linkWithRedirect): carry the guest's signed id-token THROUGH
+    // the authorize request as a hint. The issuer signature-verifies it and binds it to this
+    // request's PKCE code_challenge, so the link is completed single-use during the normal
+    // code→token exchange — no retired /link/social, and the appId stays bound to client_id.
+    if (guestHint)
+        params.set('bounded_guest_hint', guestHint);
+    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
+}
+// Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
+// expo-web-browser driver vs. the web full-page-redirect/popup driver.
+function isNative() {
+    return !getPlatform().hasDOM;
+}
+// ---------------------------------------------------------------------------
+// Native (React Native / Expo) redirect driver
+// ---------------------------------------------------------------------------
+// Lazily load expo-web-browser. It's an OPTIONAL peer dep — imported dynamically
+// so the web/Node bundle never requires it. Throws an actionable error if a native
+// app calls hosted login without installing it.
+async function loadExpoWebBrowser() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        return await import('expo-web-browser');
+    }
+    catch (_a) {
+        throw new Error('React Native hosted login requires the optional peer dependency "expo-web-browser". ' +
+            'Install it with `npx expo install expo-web-browser` (and `expo-crypto`), then retry.');
+    }
 }
-/** Start login: navigate the whole page to the hosted Bounded login. Returns after redirect
- *  to `redirectUri?code=...`, where you call completeLoginFromRedirect(). Web only. */
+// Parse code/state out of the universal-link callback URL. Hand-rolled (no `new URL()`)
+// because React Native's URL implementation is non-spec-compliant for query parsing.
+function parseCallbackParams(callbackUrl) {
+    var _a, _b;
+    const qIndex = callbackUrl.indexOf('?');
+    if (qIndex < 0)
+        return { code: null, state: null };
+    const query = callbackUrl.slice(qIndex + 1).split('#')[0];
+    const out = {};
+    for (const part of query.split('&')) {
+        if (!part)
+            continue;
+        const eq = part.indexOf('=');
+        const k = eq < 0 ? part : part.slice(0, eq);
+        const v = eq < 0 ? '' : part.slice(eq + 1);
+        try {
+            out[decodeURIComponent(k)] = decodeURIComponent(v.replace(/\+/g, ' '));
+        }
+        catch (_c) {
+            out[k] = v;
+        }
+    }
+    return { code: (_a = out['code']) !== null && _a !== void 0 ? _a : null, state: (_b = out['state']) !== null && _b !== void 0 ? _b : null };
+}
+// Full native login: open the hosted page in the system auth session, await the
+// universal-link callback, verify state, and run the SAME PKCE code→token exchange
+// as web. Returns the signed-in User (native completes inline — there's no separate
+// completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
+async function runNativeLogin(opts, guestHint) {
+    var _a, _b;
+    const { url, pkce } = await buildAuthorize(opts, guestHint);
+    const WebBrowser = await loadExpoWebBrowser();
+    const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
+    if (typeof openAuthSession !== 'function') {
+        throw new Error('expo-web-browser.openAuthSessionAsync is unavailable — update expo-web-browser.');
+    }
+    setAuthLoading(true);
+    try {
+        // openAuthSessionAsync keeps JS alive while the system browser is shown, then
+        // resolves with the callback URL once the universal link fires — so `pkce`
+        // stays in scope and never needs to be persisted.
+        const result = await openAuthSession(url, opts.redirectUri);
+        if (!result || result.type === 'cancel' || result.type === 'dismiss') {
+            throw new Error('Login cancelled');
+        }
+        if (result.type !== 'success' || typeof result.url !== 'string') {
+            throw new Error(`Hosted login did not complete (result: ${(_b = result === null || result === void 0 ? void 0 : result.type) !== null && _b !== void 0 ? _b : 'unknown'})`);
+        }
+        const { code, state: returnedState } = parseCallbackParams(result.url);
+        if (!code)
+            throw new Error('No authorization code in the callback URL');
+        if (!returnedState || returnedState !== pkce.state) {
+            throw new Error('OAuth state mismatch — possible CSRF; aborting');
+        }
+        return await exchangeCode(code, pkce.verifier, pkce.redirectUri);
+    }
+    finally {
+        setAuthLoading(false);
+    }
+}
+/** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
+ *
+ *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
+ *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *
+ *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
+ *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
+ *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
+ *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
+ *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
+ *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
 async function loginWithRedirect(opts) {
+    if (isNative())
+        return runNativeLogin(opts);
     if (!hasDOM())
-        throw new Error('loginWithRedirect is web-only');
-    const url = await buildAuthorizeUrl(opts);
+        throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
+    const { url, pkce } = await buildAuthorize(opts);
+    // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
+    // is per-tab and cleared on close — appropriate for a short-lived auth handshake.
+    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
     window.location.href = url;
 }
-const LINK_GUEST_KEY = 'bounded.link.guest';
 /** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
- *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Stashes the guest token,
- *  then runs the normal redirect login; `completeLoginFromRedirect()` on the callback
- *  page finishes the link automatically (if the social account is brand-new the guest's
- *  `@user.id` is preserved, else it stays separate). Requires an active guest session. */
+ *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
+ *  id-token THROUGH the OIDC authorize request (as a single-use hint bound to the PKCE
+ *  challenge), then runs the normal redirect login. The issuer completes the link during
+ *  the standard code→token exchange: if the chosen account is brand-new the guest's
+ *  `@user.id` is preserved (the returned id_token is minted under it), else the account
+ *  stays separate (guest id discarded). Requires an active guest session.
+ *
+ *  Works on WEB (navigates, finish with completeLoginFromRedirect) and REACT NATIVE
+ *  (opens expo-web-browser and resolves with the upgraded User inline). */
 async function linkWithRedirect(opts) {
-    if (!hasDOM())
-        throw new Error('linkWithRedirect is web-only');
     const guestToken = sessionManager().getIdToken();
     if (!guestToken)
         throw new Error('linkWithRedirect requires an active anonymous session — call signInAnonymously() first.');
-    sessionStorage.setItem(LINK_GUEST_KEY, guestToken);
-    const url = await buildAuthorizeUrl(opts);
-    window.location.href = url;
-}
-// If a guest-link is pending (linkWithRedirect stashed a guest token before this
-// redirect), exchange it + the fresh social token for an UPGRADED token via
-// /link/social and replace the session. Returns the upgraded user, or null if no
-// link was pending / the link failed (in which case the plain social login stands).
-async function finishGuestLinkIfPending(socialIdToken) {
+    if (isNative())
+        return runNativeLogin(opts, guestToken);
     if (!hasDOM())
-        return null;
-    const guestToken = sessionStorage.getItem(LINK_GUEST_KEY);
-    if (!guestToken)
-        return null;
-    sessionStorage.removeItem(LINK_GUEST_KEY);
-    try {
-        const cfg = await getConfig();
-        const base = await issuerBase();
-        const res = await fetch(`${base}/link/social`, {
-            method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ appId: cfg.appId, guestToken, socialToken: socialIdToken }),
-        });
-        const data = await res.json().catch(() => null);
-        const idToken = tokenField(data, 'id_token', 'idToken');
-        if (!res.ok || !idToken)
-            return null; // link failed -> keep the plain social session
-        const upgraded = userFromIdToken(idToken);
-        const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
-        const refreshToken = boundedRefreshTokenField(data);
-        await sessionManager().storeSession(String(upgraded.address || ''), accessToken, idToken, refreshToken, base);
-        setCurrentUser(upgraded);
-        return upgraded;
-    }
-    catch (_a) {
-        return null;
-    }
+        throw new Error('linkWithRedirect requires a browser or a configured React Native platform');
+    const { url, pkce } = await buildAuthorize(opts, guestToken);
+    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    window.location.href = url;
 }
-/** Finish login on the redirect_uri page: exchange ?code= for a token (PKCE-verified), store
- *  the session, and return the User. Idempotent: returns null if there's no ?code= in the URL. */
+/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
+ *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
+ *  When the redirect was a guest UPGRADE (linkWithRedirect) and the issuer adopted the guest
+ *  id, the exchanged id_token already carries the preserved `@user.id`, so the returned User
+ *  reflects it automatically (no extra round-trip).
+ *
+ *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
+ *  loginWithRedirect()/linkWithRedirect() (which resolve with the User), so there is no
+ *  separate redirect page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
     if (!hasDOM())
         return null;
@@ -4363,15 +4464,11 @@ async function completeLoginFromRedirect() {
             throw new Error('OAuth state mismatch — possible CSRF; aborting');
         const user = await exchangeCode(code, pkce.verifier, pkce.redirectUri);
         sessionStorage.removeItem(PKCE_STORE_KEY);
-        // If this redirect was a guest UPGRADE (linkWithRedirect), finish the link now:
-        // swap the fresh social session for one minted under the guest's preserved id.
-        const socialIdToken = sessionManager().getIdToken();
-        const upgraded = socialIdToken ? await finishGuestLinkIfPending(socialIdToken) : null;
         // Strip code/state from the URL so a reload doesn't re-exchange (codes are single-use anyway).
         url.searchParams.delete('code');
         url.searchParams.delete('state');
         window.history.replaceState({}, document.title, url.pathname + url.search + url.hash);
-        return upgraded !== null && upgraded !== void 0 ? upgraded : user;
+        return user;
     }
     finally {
         setAuthLoading(false);
@@ -4381,8 +4478,9 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */
 async function loginWithPopup(opts) {
     if (!hasDOM())
-        throw new Error('loginWithPopup is web-only');
-    const url = await buildAuthorizeUrl(opts);
+        throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
+    const { url, pkce } = await buildAuthorize(opts);
+    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
     const w = opts.width || 480, h = opts.height || 720;
     const left = window.screenX + (window.outerWidth - w) / 2;
     const top = window.screenY + (window.outerHeight - h) / 2;
@@ -4589,17 +4687,17 @@ function clearIncompatibleSession() {
 // Lazy loaders for web-only providers.
 // Using dynamic import() ensures Metro (RN) never resolves these modules.
 async function loadPhantomWalletProvider() {
-    const mod = await import('./phantom-wallet-provider-3_IulJlh.mjs');
+    const mod = await import('./phantom-wallet-provider-B3ztJGu2.mjs');
     return { PhantomWalletProvider: mod.PhantomWalletProvider };
 }
 // Web Privy provider (depends on react-dom + @privy-io/react-auth). Lazy so Metro
 // never bundles it into the RN build — RN uses the @privy-io/expo provider instead.
 async function loadPrivyWalletProvider() {
-    const mod = await import('./privy-wallet-provider-DQtXFGFF.mjs');
+    const mod = await import('./privy-wallet-provider-D2i_xwYW.mjs');
     return mod.PrivyWalletProvider;
 }
 async function loadSolanaMobileWalletProvider() {
-    const mod = await import('./solana-mobile-wallet-provider-DE_zCpKE.mjs');
+    const mod = await import('./solana-mobile-wallet-provider-dOWiujmo.mjs');
     return mod.SolanaMobileWalletProvider;
 }
 function requireWebPrivyConfig(config) {
@@ -5641,4 +5739,4 @@ class PrivyExpoProvider {
 }
 
 export { loginWithRedirect as A, linkWithRedirect as B, completeLoginFromRedirect as C, loginWithPopup as D, completeLoginInPopup as E, useAuth as F, deserializeTransaction as G, getIdToken as H, setPlatform as I, index as J, OffchainAuthProvider as O, PrivyExpoProvider as P, SURFNET_RPC_URL as S, detectAndroid as a, bufferExports as b, confirmAndCheckTransaction as c, detectMobile as d, setAuthLoading as e, resolveSolanaWalletStandardChain as f, getPlatform as g, bs58 as h, init as i, getCurrentUser as j, onAuthLoadingChanged as k, getAuthLoading as l, login as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, logout as p, getAuthProvider as q, resolveSolanaRpcUrl as r, setCurrentUser as s, signInAnonymously as t, sendEmailOtp as u, sendTextOtp as v, verifyEmailOtp as w, verifyTextOtp as x, linkEmail as y, loginWithPrivy as z };
-//# sourceMappingURL=index.native-D1YQ-LU7.mjs.map
+//# sourceMappingURL=index.native-DEWlFCQV.mjs.map