@bounded-sh/client 0.0.34 → 0.0.36

package/dist/index.mjs

@@ -3407,7 +3407,7 @@ const IDB_STORE = 'keys';
 const IDB_KEY = 'ed25519';
 const GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +
     'stored-secret guest credentials are disabled.';
-function toBase64(bytes) {
+function toBase64$1(bytes) {
     let bin = '';
     for (let i = 0; i < bytes.length; i++)
         bin += String.fromCharCode(bytes[i]);
@@ -3471,7 +3471,7 @@ async function webCryptoKey() {
             async sign(message) {
                 const data = new TextEncoder().encode(message);
                 const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));
-                return toBase64(sig);
+                return toBase64$1(sig);
             },
         };
     }
@@ -3574,14 +3574,221 @@ class GuestAuthProvider {
     }
 }
 
+var bufferExports = requireBuffer();
+
+// crossmint-signer-bridge.ts — routes embedded-wallet signing through the
+// Bounded-owned signer popup (auth.bounded.sh/wallet/signer).
+//
+// Slice-1 attached a non-custodial Crossmint smart wallet to email logins and
+// populated `@user.address`. This bridge is the slice-2 counterpart: a user
+// whose address came from `auth.wallets` can APPROVE transactions with that
+// wallet from ANY app, non-custodially, by having the Crossmint client SDK run
+// ONLY on the Bounded signer page (one whitelisted origin) and talking to it via
+// postMessage.
+//
+// SEMANTICS (Crossmint Solana smart wallets): these wallets cannot produce raw
+// detached signatures — there is no signMessage and no sign-without-submit. The
+// only honest primitive is EXECUTION (sign + submit) via the wallet's email-OTP
+// authorization. So this bridge implements `signAndSubmitTransaction` and a
+// token-send; `signMessage` / `signTransaction` throw a clear unsupported error.
+const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets — Crossmint Solana smart wallets sign ' +
+    'and submit atomically. Use signAndSubmitTransaction() (or bounded.sendWalletToken) ' +
+    'instead of signMessage/signTransaction.';
+const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so email logins get a non-custodial wallet (@user.address), ' +
+    'then sign from a user gesture.';
+function hasDOM$1() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+function decodeJwt$2(token) {
+    try {
+        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const pad = b64.length % 4;
+        if (pad === 2)
+            b64 += '==';
+        else if (pad === 3)
+            b64 += '=';
+        return JSON.parse(bufferExports.Buffer.from(b64, 'base64').toString('utf8'));
+    }
+    catch (_a) {
+        return {};
+    }
+}
+// Pull the embedded-wallet identity out of the active session's id token.
+// Returns null when this session has no wallet (so callers can throw the
+// informative NO_EMBEDDED_WALLET error).
+function walletClaimsFromSession() {
+    let idToken = null;
+    try {
+        idToken = getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        idToken = null;
+    }
+    if (!idToken)
+        return null;
+    const c = decodeJwt$2(idToken);
+    const address = c['custom:walletAddress'];
+    const email = c['email'];
+    if (typeof address !== 'string' || !address)
+        return null;
+    if (typeof email !== 'string' || !email)
+        return null;
+    const envClaim = c['custom:walletEnvironment'];
+    const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
+    return { email, address, environment };
+}
+async function signerPageUrl() {
+    const cfg = await getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
+}
+let requestSeq = 0;
+/**
+ * Open the Bounded signer popup, send `action` to it, and resolve with the
+ * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
+ * the browser will block the popup — in which case this rejects with a clear
+ * "Popup blocked" error telling the app to call from a user gesture.
+ *
+ * Non-custodial: the popup gates signing behind an email OTP delivered to the
+ * wallet's owner, and validates that the wallet address matches the account.
+ */
+async function signViaSignerPopup(action) {
+    if (!hasDOM$1()) {
+        throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const claims = walletClaimsFromSession();
+    if (!claims)
+        throw new Error(NO_EMBEDDED_WALLET);
+    const { url, origin: signerOrigin } = await signerPageUrl();
+    const requestId = `bsign_${Date.now()}_${++requestSeq}`;
+    // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
+    const w = 420, h = 600;
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    const popup = window.open(url, 'bounded-wallet-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    if (!popup) {
+        throw new Error('Popup blocked — call signAndSubmitTransaction() from a user gesture (e.g. a click handler) so the wallet approval window can open.');
+    }
+    const request = {
+        type: 'bounded:sign',
+        requestId,
+        environment: claims.environment, // may be undefined → page auto-detects
+        email: claims.email,
+        address: claims.address,
+        action,
+    };
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let closeTimer;
+        let sentRequest = false;
+        const cleanup = () => {
+            settled = true;
+            window.removeEventListener('message', onMsg);
+            if (closeTimer)
+                clearInterval(closeTimer);
+        };
+        const sendRequest = () => {
+            if (sentRequest)
+                return;
+            sentRequest = true;
+            try {
+                popup.postMessage(request, signerOrigin);
+            }
+            catch ( /* popup gone */_a) { /* popup gone */ }
+        };
+        const onMsg = (ev) => {
+            if (ev.origin !== signerOrigin)
+                return; // only trust the signer page origin
+            const d = ev.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:signer:ready') {
+                sendRequest();
+                return;
+            }
+            if (d.type === 'bounded:signer:result' && d.requestId === requestId) {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                if (d.ok)
+                    resolve({ hash: d.hash, explorerLink: d.explorerLink, transactionId: d.transactionId });
+                else
+                    reject(new Error(String(d.error || 'Wallet signing failed')));
+            }
+        };
+        window.addEventListener('message', onMsg);
+        // Fallback: if the ready ping was missed (fast load / focus race), push the
+        // request shortly after opening. The page ignores it until a bounded:sign
+        // arrives and only acts on the first one, so a duplicate is harmless.
+        setTimeout(sendRequest, 1200);
+        // If the user closes the popup before completing, reject (unless a result
+        // just arrived — give any in-flight message a beat to settle first).
+        closeTimer = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(closeTimer);
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Wallet approval window was closed before signing completed.'));
+                } }, 400);
+            }
+        }, 500);
+        // Overall safety timeout (OTP + signing). Generous — the user may take a
+        // while to fetch the code from their email.
+        setTimeout(() => { if (!settled) {
+            cleanup();
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+            reject(new Error('Wallet approval timed out.'));
+        } }, 5 * 60 * 1000);
+    });
+}
+function toBase64(bytes) {
+    return bufferExports.Buffer.from(bytes).toString('base64');
+}
+// Serialize a legacy or versioned Solana transaction to base64 for the signer
+// page. We do NOT require existing signatures (the smart wallet signs on the
+// page); Crossmint extracts the instructions and wraps them for the smart wallet.
+function serializeTransaction(transaction) {
+    const isLegacy = 'recentBlockhash' in transaction &&
+        !('message' in transaction && 'staticAccountKeys' in transaction.message);
+    const bytes = isLegacy
+        ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
+        : transaction.serialize();
+    return toBase64(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+}
+/**
+ * Whether the active session carries an embedded wallet (so the provider should
+ * route signing through the popup rather than throw "no wallet").
+ */
+function hasEmbeddedWallet() {
+    return walletClaimsFromSession() != null;
+}
+/** signAndSubmitTransaction for embedded wallets: serialize + route through the
+ *  signer popup, resolve with the on-chain transaction signature/hash. */
+async function embeddedSignAndSubmit(transaction) {
+    const serializedTransaction = serializeTransaction(transaction);
+    const result = await signViaSignerPopup({ kind: 'transaction', serializedTransaction });
+    const hash = result.hash || result.transactionId;
+    if (!hash)
+        throw new Error('Signer returned no transaction hash.');
+    return hash;
+}
+
 // Web uses localStorage (WebSessionManager); React Native uses the configured
 // ReactNativeSessionManager. getActiveSessionManager() picks the right one by
 // whether the RN manager was configured (NOT `typeof window`, which is truthy on
 // RN too and would wrongly route to localStorage). Same selector the core
 // request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.
 const sessionManager$1 = getActiveSessionManager;
-const NO_WALLET = 'Email login is offchain — it has no Solana wallet and cannot sign/submit ' +
-    'transactions. Use a wallet provider for onchain actions, or link a wallet later.';
+const NO_WALLET = 'Email login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so email logins get a non-custodial Crossmint wallet ' +
+    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +
+    'provider (e.g. Phantom) for onchain actions.';
 // ---------------------------------------------------------------------------
 // token / session helpers
 // ---------------------------------------------------------------------------
@@ -3631,10 +3838,23 @@ class EmailAuthProvider {
         sessionManager$1().clearSession();
         setCurrentUser(null);
     }
-    async signMessage(_message) { throw new Error(NO_WALLET); }
+    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a
+    // raw signature — signMessage/signTransaction are structurally unsupported
+    // (throw the clear "use signAndSubmitTransaction" error when a wallet exists;
+    // the no-wallet error otherwise). signAndSubmitTransaction routes through the
+    // Bounded signer popup for wallets-enabled email logins.
+    async signMessage(_message) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
+    }
     async runTransaction(_evm, _sol, _options) { throw new Error(NO_WALLET); }
-    async signTransaction(_t) { throw new Error(NO_WALLET); }
-    async signAndSubmitTransaction() { throw new Error(NO_WALLET); }
+    async signTransaction(_t) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
+    }
+    async signAndSubmitTransaction(transaction, _feePayer) {
+        if (!hasEmbeddedWallet())
+            throw new Error(NO_WALLET);
+        return embeddedSignAndSubmit(transaction);
+    }
     async getNativeMethods() { return {}; }
 }
 const emailProviderSingleton = new EmailAuthProvider();
@@ -3665,6 +3885,11 @@ function resolveSolanaRpcUrl(explicitRpcUrl, network, context) {
     throw new Error(`${context} requires an explicit Solana RPC URL. Pass config.rpcUrl before signing or submitting onchain transactions.`);
 }
 
+// Same message the email provider uses when a hosted (OIDC) login has no
+// embedded wallet — enable `auth.wallets` in policy to get one.
+const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so logins get a non-custodial Crossmint wallet (@user.address), ' +
+    'then sign from a user gesture.';
 const PKCE_STORE_KEY = 'bounded.oidc.pkce';
 const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // Active session store (Web on web, RN on React Native) — selected by config,
@@ -3689,6 +3914,10 @@ function decodeJwt(token) {
     }
 }
 // A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
+// Signing surface (slice 2): a hosted login on a wallets-enabled app carries an
+// embedded Crossmint wallet (@user.address). signAndSubmitTransaction routes
+// through the Bounded signer popup; signMessage/signTransaction are structurally
+// unsupported for Crossmint smart wallets (sign+submit atomically, no raw sig).
 const oidcProviderSingleton = {
     async login() {
         const idToken = sessionManager().getIdToken();
@@ -3699,6 +3928,17 @@ const oidcProviderSingleton = {
         return idToken ? userFromIdToken(idToken) : null;
     },
     async logout() { sessionManager().clearSession(); },
+    async signMessage(_message) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    },
+    async signTransaction(_t) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    },
+    async signAndSubmitTransaction(transaction, _feePayer) {
+        if (!hasEmbeddedWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return embeddedSignAndSubmit(transaction);
+    },
 };
 function userFromIdToken(idToken) {
     const c = decodeJwt(idToken);
@@ -4739,8 +4979,6 @@ async function getIdToken() {
     return getIdToken$1(false);
 }
 
-var bufferExports = requireBuffer();
-
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */