@bounded-sh/client 0.0.35 → 0.0.37

package/README.md

@@ -111,7 +111,26 @@ const unsubscribe = onAuthStateChanged((user) => {
 unsubscribe();
 ```
 
-  
+### Embedded wallets — signing
+
+When an app enables embedded wallets in `policy.json` (`"auth": { "wallets": true }`),
+every email login also gets a non-custodial Solana wallet (`@user.address`). That user
+can approve transactions with it — signing runs in a Bounded-hosted popup that does a
+one-time email verification; Bounded never holds the key.
+
+```typescript
+import { signAndSubmitTransaction } from '@bounded-sh/client';
+import { VersionedTransaction } from '@solana/web3.js';
+
+// Call from a user gesture (click/tap) — signing opens a popup.
+async function pay(tx: VersionedTransaction) {
+  const signature = await signAndSubmitTransaction(tx); // signs + submits, returns the hash
+  console.log('submitted', signature);
+}
+```
+
+`signMessage` and `signTransaction` (sign without submit) throw for embedded smart
+wallets — they sign and submit atomically, so use `signAndSubmitTransaction`.
 
 ## Usage
 

package/dist/auth/crossmint-signer-bridge.d.ts

@@ -0,0 +1,37 @@
+import { Transaction, VersionedTransaction } from '@solana/web3.js';
+export type SignerAction = {
+    kind: 'sendToken';
+    recipient: string;
+    token: string;
+    amount: string;
+} | {
+    kind: 'transaction';
+    serializedTransaction: string;
+};
+export interface SignerResult {
+    hash?: string;
+    explorerLink?: string;
+    transactionId?: string;
+}
+export declare const EMBEDDED_WALLET_UNSUPPORTED: string;
+/**
+ * Open the Bounded signer popup, send `action` to it, and resolve with the
+ * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
+ * the browser will block the popup — in which case this rejects with a clear
+ * "Popup blocked" error telling the app to call from a user gesture.
+ *
+ * Non-custodial: the popup gates signing behind an email OTP delivered to the
+ * wallet's owner, and validates that the wallet address matches the account.
+ */
+export declare function signViaSignerPopup(action: SignerAction): Promise<SignerResult>;
+/**
+ * Whether the active session carries an embedded wallet (so the provider should
+ * route signing through the popup rather than throw "no wallet").
+ */
+export declare function hasEmbeddedWallet(): boolean;
+/** signAndSubmitTransaction for embedded wallets: serialize + route through the
+ *  signer popup, resolve with the on-chain transaction signature/hash. */
+export declare function embeddedSignAndSubmit(transaction: Transaction | VersionedTransaction): Promise<string>;
+/** Send a token from the embedded wallet (Crossmint `wallet.send`). Convenience
+ *  primitive for the common "send crypto" case; returns the tx result. */
+export declare function embeddedSendToken(recipient: string, token: string, amount: string): Promise<SignerResult>;

package/dist/auth/hooks/useAuth.d.ts

@@ -1,6 +1,7 @@
 import { User } from '@bounded-sh/core';
+import { type LoginOptions } from '../../global';
 export interface UseAuthResult {
-    login: () => Promise<void>;
+    login: (options?: LoginOptions) => Promise<void>;
     logout: () => Promise<void>;
     loading: boolean;
     user: User | null;

package/dist/auth/providers/email-auth-provider.d.ts

@@ -1,5 +1,6 @@
 import type { AuthProvider, User, TransactionResult, SolTransaction, EVMTransaction, SetOptions } from '@bounded-sh/core';
 import { Transaction, VersionedTransaction } from '@solana/web3.js';
+import { PublicKey } from '@solana/web3.js';
 export declare class EmailAuthProvider implements AuthProvider {
     login(): Promise<User | null>;
     restoreSession(): Promise<User | null>;
@@ -7,7 +8,7 @@ export declare class EmailAuthProvider implements AuthProvider {
     signMessage(_message: string): Promise<string>;
     runTransaction(_evm?: EVMTransaction, _sol?: SolTransaction, _options?: SetOptions): Promise<TransactionResult>;
     signTransaction(_t: Transaction | VersionedTransaction): Promise<Transaction | VersionedTransaction>;
-    signAndSubmitTransaction(): Promise<string>;
+    signAndSubmitTransaction(transaction: Transaction | VersionedTransaction, _feePayer?: PublicKey): Promise<string>;
     getNativeMethods(): Promise<any>;
 }
 declare const emailProviderSingleton: EmailAuthProvider;

package/dist/auth/providers/offchain-auth-provider.d.ts

@@ -18,6 +18,7 @@ export declare class OffchainAuthProvider implements AuthProvider {
     private modalContainer;
     constructor(wrappedProvider: AuthProvider, config?: OffchainAuthProviderConfig);
     login(): Promise<User | null>;
+    setLoginOverrides(opts: any): void;
     logout(): Promise<void>;
     restoreSession(): Promise<User | null>;
     runTransaction(evmTransactionData?: EVMTransaction, solTransactionData?: SolTransaction, options?: SetOptions): Promise<TransactionResult>;
@@ -29,6 +30,7 @@ export declare class OffchainAuthProvider implements AuthProvider {
      */
     signAndSubmitTransaction(_transaction: Transaction | VersionedTransaction, _feePayer?: any): Promise<string>;
     getNativeMethods(): Promise<any>;
+    exportWallet(address?: string): Promise<void>;
     signMessage(message: string): Promise<string>;
     private showUnsupportedTransactionModal;
     private showTransactionModal;

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export type { HostedAuthMethod, OidcLoginOptions, PopupLoginOptions } from "./au
 export { get, getMany, docId, set, setMany, setFile, getFiles, search, queryAggregate, runQuery, runQueryMany, runExpression, runExpressionMany, signMessage, signTransaction, signAndSubmitTransaction, count, aggregate, GetOptions, SearchOptions, SetOptions, CountOptions, AggregateOptions, AggregateOperation, AggregateResult, AggregateSpec, AggregateRow, QueryAggregateOptions, } from "@bounded-sh/core";
 export type { GetOptions as BoundedGetOptions } from "@bounded-sh/core";
 export { subscribe } from "@bounded-sh/core";
+export { BoundedDeclineError, deriveDecline, dispatchDeclineEvent, DECLINE_EVENT_NAME } from "@bounded-sh/core";
+export type { BoundedDecline, DeclineReason, DeclineBoundary } from "@bounded-sh/core";
 export * from "@bounded-sh/core";
 export { useAuth } from "./auth/hooks/useAuth";
 export { useQuery } from "./hooks/useQuery";

package/dist/index.js

@@ -165,6 +165,15 @@ class OffchainAuthProvider {
         }
         return null;
     }
+    // Forward per-call login overrides (theme/title/subtitle and the `method`
+    // directive) to the wrapped provider. Without this, the top-level login()
+    // forwarder (which duck-types `setLoginOverrides` on the active provider)
+    // skips the wrapper and the override — including `method` — is dropped on
+    // offchain/Poofnet builds.
+    setLoginOverrides(opts) {
+        var _a, _b;
+        (_b = (_a = this.wrappedProvider).setLoginOverrides) === null || _b === void 0 ? void 0 : _b.call(_a, opts);
+    }
     async logout() {
         await this.wrappedProvider.logout();
     }
@@ -198,6 +207,15 @@ class OffchainAuthProvider {
     async getNativeMethods() {
         return this.wrappedProvider.getNativeMethods();
     }
+    // Forward wallet export to the wrapped provider (only Privy embedded wallets
+    // implement it). Duck-typed so wrappers around non-embedded providers throw
+    // a clear error rather than a "not a function" crash.
+    async exportWallet(address) {
+        if (typeof this.wrappedProvider.exportWallet !== 'function') {
+            throw new Error('Wallet export is not available for this wallet.');
+        }
+        await this.wrappedProvider.exportWallet(address);
+    }
     // ============ signMessage delegates to wrapped provider ============
     async signMessage(message) {
         var _a, _b, _c, _d, _e, _f;
@@ -3427,7 +3445,7 @@ const IDB_STORE = 'keys';
 const IDB_KEY = 'ed25519';
 const GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +
     'stored-secret guest credentials are disabled.';
-function toBase64(bytes) {
+function toBase64$1(bytes) {
     let bin = '';
     for (let i = 0; i < bytes.length; i++)
         bin += String.fromCharCode(bytes[i]);
@@ -3491,7 +3509,7 @@ async function webCryptoKey() {
             async sign(message) {
                 const data = new TextEncoder().encode(message);
                 const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));
-                return toBase64(sig);
+                return toBase64$1(sig);
             },
         };
     }
@@ -3594,14 +3612,221 @@ class GuestAuthProvider {
     }
 }
 
+var bufferExports = requireBuffer();
+
+// crossmint-signer-bridge.ts — routes embedded-wallet signing through the
+// Bounded-owned signer popup (auth.bounded.sh/wallet/signer).
+//
+// Slice-1 attached a non-custodial Crossmint smart wallet to email logins and
+// populated `@user.address`. This bridge is the slice-2 counterpart: a user
+// whose address came from `auth.wallets` can APPROVE transactions with that
+// wallet from ANY app, non-custodially, by having the Crossmint client SDK run
+// ONLY on the Bounded signer page (one whitelisted origin) and talking to it via
+// postMessage.
+//
+// SEMANTICS (Crossmint Solana smart wallets): these wallets cannot produce raw
+// detached signatures — there is no signMessage and no sign-without-submit. The
+// only honest primitive is EXECUTION (sign + submit) via the wallet's email-OTP
+// authorization. So this bridge implements `signAndSubmitTransaction` and a
+// token-send; `signMessage` / `signTransaction` throw a clear unsupported error.
+const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets — Crossmint Solana smart wallets sign ' +
+    'and submit atomically. Use signAndSubmitTransaction() (or bounded.sendWalletToken) ' +
+    'instead of signMessage/signTransaction.';
+const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so email logins get a non-custodial wallet (@user.address), ' +
+    'then sign from a user gesture.';
+function hasDOM$1() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+function decodeJwt$2(token) {
+    try {
+        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const pad = b64.length % 4;
+        if (pad === 2)
+            b64 += '==';
+        else if (pad === 3)
+            b64 += '=';
+        return JSON.parse(bufferExports.Buffer.from(b64, 'base64').toString('utf8'));
+    }
+    catch (_a) {
+        return {};
+    }
+}
+// Pull the embedded-wallet identity out of the active session's id token.
+// Returns null when this session has no wallet (so callers can throw the
+// informative NO_EMBEDDED_WALLET error).
+function walletClaimsFromSession() {
+    let idToken = null;
+    try {
+        idToken = core.getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        idToken = null;
+    }
+    if (!idToken)
+        return null;
+    const c = decodeJwt$2(idToken);
+    const address = c['custom:walletAddress'];
+    const email = c['email'];
+    if (typeof address !== 'string' || !address)
+        return null;
+    if (typeof email !== 'string' || !email)
+        return null;
+    const envClaim = c['custom:walletEnvironment'];
+    const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
+    return { email, address, environment };
+}
+async function signerPageUrl() {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
+}
+let requestSeq = 0;
+/**
+ * Open the Bounded signer popup, send `action` to it, and resolve with the
+ * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
+ * the browser will block the popup — in which case this rejects with a clear
+ * "Popup blocked" error telling the app to call from a user gesture.
+ *
+ * Non-custodial: the popup gates signing behind an email OTP delivered to the
+ * wallet's owner, and validates that the wallet address matches the account.
+ */
+async function signViaSignerPopup(action) {
+    if (!hasDOM$1()) {
+        throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const claims = walletClaimsFromSession();
+    if (!claims)
+        throw new Error(NO_EMBEDDED_WALLET);
+    const { url, origin: signerOrigin } = await signerPageUrl();
+    const requestId = `bsign_${Date.now()}_${++requestSeq}`;
+    // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
+    const w = 420, h = 600;
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    const popup = window.open(url, 'bounded-wallet-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    if (!popup) {
+        throw new Error('Popup blocked — call signAndSubmitTransaction() from a user gesture (e.g. a click handler) so the wallet approval window can open.');
+    }
+    const request = {
+        type: 'bounded:sign',
+        requestId,
+        environment: claims.environment, // may be undefined → page auto-detects
+        email: claims.email,
+        address: claims.address,
+        action,
+    };
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let closeTimer;
+        let sentRequest = false;
+        const cleanup = () => {
+            settled = true;
+            window.removeEventListener('message', onMsg);
+            if (closeTimer)
+                clearInterval(closeTimer);
+        };
+        const sendRequest = () => {
+            if (sentRequest)
+                return;
+            sentRequest = true;
+            try {
+                popup.postMessage(request, signerOrigin);
+            }
+            catch ( /* popup gone */_a) { /* popup gone */ }
+        };
+        const onMsg = (ev) => {
+            if (ev.origin !== signerOrigin)
+                return; // only trust the signer page origin
+            const d = ev.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:signer:ready') {
+                sendRequest();
+                return;
+            }
+            if (d.type === 'bounded:signer:result' && d.requestId === requestId) {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                if (d.ok)
+                    resolve({ hash: d.hash, explorerLink: d.explorerLink, transactionId: d.transactionId });
+                else
+                    reject(new Error(String(d.error || 'Wallet signing failed')));
+            }
+        };
+        window.addEventListener('message', onMsg);
+        // Fallback: if the ready ping was missed (fast load / focus race), push the
+        // request shortly after opening. The page ignores it until a bounded:sign
+        // arrives and only acts on the first one, so a duplicate is harmless.
+        setTimeout(sendRequest, 1200);
+        // If the user closes the popup before completing, reject (unless a result
+        // just arrived — give any in-flight message a beat to settle first).
+        closeTimer = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(closeTimer);
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Wallet approval window was closed before signing completed.'));
+                } }, 400);
+            }
+        }, 500);
+        // Overall safety timeout (OTP + signing). Generous — the user may take a
+        // while to fetch the code from their email.
+        setTimeout(() => { if (!settled) {
+            cleanup();
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+            reject(new Error('Wallet approval timed out.'));
+        } }, 5 * 60 * 1000);
+    });
+}
+function toBase64(bytes) {
+    return bufferExports.Buffer.from(bytes).toString('base64');
+}
+// Serialize a legacy or versioned Solana transaction to base64 for the signer
+// page. We do NOT require existing signatures (the smart wallet signs on the
+// page); Crossmint extracts the instructions and wraps them for the smart wallet.
+function serializeTransaction(transaction) {
+    const isLegacy = 'recentBlockhash' in transaction &&
+        !('message' in transaction && 'staticAccountKeys' in transaction.message);
+    const bytes = isLegacy
+        ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
+        : transaction.serialize();
+    return toBase64(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+}
+/**
+ * Whether the active session carries an embedded wallet (so the provider should
+ * route signing through the popup rather than throw "no wallet").
+ */
+function hasEmbeddedWallet() {
+    return walletClaimsFromSession() != null;
+}
+/** signAndSubmitTransaction for embedded wallets: serialize + route through the
+ *  signer popup, resolve with the on-chain transaction signature/hash. */
+async function embeddedSignAndSubmit(transaction) {
+    const serializedTransaction = serializeTransaction(transaction);
+    const result = await signViaSignerPopup({ kind: 'transaction', serializedTransaction });
+    const hash = result.hash || result.transactionId;
+    if (!hash)
+        throw new Error('Signer returned no transaction hash.');
+    return hash;
+}
+
 // Web uses localStorage (WebSessionManager); React Native uses the configured
 // ReactNativeSessionManager. getActiveSessionManager() picks the right one by
 // whether the RN manager was configured (NOT `typeof window`, which is truthy on
 // RN too and would wrongly route to localStorage). Same selector the core
 // request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.
 const sessionManager$1 = core.getActiveSessionManager;
-const NO_WALLET = 'Email login is offchain — it has no Solana wallet and cannot sign/submit ' +
-    'transactions. Use a wallet provider for onchain actions, or link a wallet later.';
+const NO_WALLET = 'Email login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so email logins get a non-custodial Crossmint wallet ' +
+    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +
+    'provider (e.g. Phantom) for onchain actions.';
 // ---------------------------------------------------------------------------
 // token / session helpers
 // ---------------------------------------------------------------------------
@@ -3651,10 +3876,23 @@ class EmailAuthProvider {
         sessionManager$1().clearSession();
         setCurrentUser(null);
     }
-    async signMessage(_message) { throw new Error(NO_WALLET); }
+    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a
+    // raw signature — signMessage/signTransaction are structurally unsupported
+    // (throw the clear "use signAndSubmitTransaction" error when a wallet exists;
+    // the no-wallet error otherwise). signAndSubmitTransaction routes through the
+    // Bounded signer popup for wallets-enabled email logins.
+    async signMessage(_message) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
+    }
     async runTransaction(_evm, _sol, _options) { throw new Error(NO_WALLET); }
-    async signTransaction(_t) { throw new Error(NO_WALLET); }
-    async signAndSubmitTransaction() { throw new Error(NO_WALLET); }
+    async signTransaction(_t) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
+    }
+    async signAndSubmitTransaction(transaction, _feePayer) {
+        if (!hasEmbeddedWallet())
+            throw new Error(NO_WALLET);
+        return embeddedSignAndSubmit(transaction);
+    }
     async getNativeMethods() { return {}; }
 }
 const emailProviderSingleton = new EmailAuthProvider();
@@ -3685,6 +3923,11 @@ function resolveSolanaRpcUrl(explicitRpcUrl, network, context) {
     throw new Error(`${context} requires an explicit Solana RPC URL. Pass config.rpcUrl before signing or submitting onchain transactions.`);
 }
 
+// Same message the email provider uses when a hosted (OIDC) login has no
+// embedded wallet — enable `auth.wallets` in policy to get one.
+const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so logins get a non-custodial Crossmint wallet (@user.address), ' +
+    'then sign from a user gesture.';
 const PKCE_STORE_KEY = 'bounded.oidc.pkce';
 const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // Active session store (Web on web, RN on React Native) — selected by config,
@@ -3709,6 +3952,10 @@ function decodeJwt(token) {
     }
 }
 // A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
+// Signing surface (slice 2): a hosted login on a wallets-enabled app carries an
+// embedded Crossmint wallet (@user.address). signAndSubmitTransaction routes
+// through the Bounded signer popup; signMessage/signTransaction are structurally
+// unsupported for Crossmint smart wallets (sign+submit atomically, no raw sig).
 const oidcProviderSingleton = {
     async login() {
         const idToken = sessionManager().getIdToken();
@@ -3719,6 +3966,17 @@ const oidcProviderSingleton = {
         return idToken ? userFromIdToken(idToken) : null;
     },
     async logout() { sessionManager().clearSession(); },
+    async signMessage(_message) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    },
+    async signTransaction(_t) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    },
+    async signAndSubmitTransaction(transaction, _feePayer) {
+        if (!hasEmbeddedWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return embeddedSignAndSubmit(transaction);
+    },
 };
 function userFromIdToken(idToken) {
     const c = decodeJwt(idToken);
@@ -4624,7 +4882,7 @@ function useAuth() {
     // Provide a fallback so server render doesn't break
     if (isSSR$1) {
         return {
-            login: async () => undefined,
+            login: async (_options) => undefined,
             logout: async () => undefined,
             loading: true,
             user: null,
@@ -4646,10 +4904,10 @@ function useAuth() {
             stopLoading();
         };
     }, []);
-    const login$1 = async () => {
+    const login$1 = async (options) => {
         try {
             setLoading(true);
-            const user = await login();
+            const user = await login(options);
             setUser(user);
         }
         catch (error) {
@@ -4759,8 +5017,6 @@ async function getIdToken() {
     return core.getIdToken(false);
 }
 
-var bufferExports = requireBuffer();
-
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */
@@ -5149,6 +5405,14 @@ class PrivyExpoProvider {
     }
 }
 
+Object.defineProperty(exports, "BoundedDeclineError", {
+    enumerable: true,
+    get: function () { return core.BoundedDeclineError; }
+});
+Object.defineProperty(exports, "DECLINE_EVENT_NAME", {
+    enumerable: true,
+    get: function () { return core.DECLINE_EVENT_NAME; }
+});
 Object.defineProperty(exports, "aggregate", {
     enumerable: true,
     get: function () { return core.aggregate; }
@@ -5157,6 +5421,14 @@ Object.defineProperty(exports, "count", {
     enumerable: true,
     get: function () { return core.count; }
 });
+Object.defineProperty(exports, "deriveDecline", {
+    enumerable: true,
+    get: function () { return core.deriveDecline; }
+});
+Object.defineProperty(exports, "dispatchDeclineEvent", {
+    enumerable: true,
+    get: function () { return core.dispatchDeclineEvent; }
+});
 Object.defineProperty(exports, "docId", {
     enumerable: true,
     get: function () { return core.docId; }