@bounded-sh/client 0.0.35 → 0.0.37

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction } from '@bounded-sh/core';
 export * from '@bounded-sh/core';
-export { aggregate, count, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
+export { BoundedDeclineError, DECLINE_EVENT_NAME, aggregate, count, deriveDecline, dispatchDeclineEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
 import * as React from 'react';
 import { VersionedTransaction, Transaction, Connection, PublicKey } from '@solana/web3.js';
 import * as anchor from '@coral-xyz/anchor';
@@ -145,6 +145,15 @@ class OffchainAuthProvider {
         }
         return null;
     }
+    // Forward per-call login overrides (theme/title/subtitle and the `method`
+    // directive) to the wrapped provider. Without this, the top-level login()
+    // forwarder (which duck-types `setLoginOverrides` on the active provider)
+    // skips the wrapper and the override — including `method` — is dropped on
+    // offchain/Poofnet builds.
+    setLoginOverrides(opts) {
+        var _a, _b;
+        (_b = (_a = this.wrappedProvider).setLoginOverrides) === null || _b === void 0 ? void 0 : _b.call(_a, opts);
+    }
     async logout() {
         await this.wrappedProvider.logout();
     }
@@ -178,6 +187,15 @@ class OffchainAuthProvider {
     async getNativeMethods() {
         return this.wrappedProvider.getNativeMethods();
     }
+    // Forward wallet export to the wrapped provider (only Privy embedded wallets
+    // implement it). Duck-typed so wrappers around non-embedded providers throw
+    // a clear error rather than a "not a function" crash.
+    async exportWallet(address) {
+        if (typeof this.wrappedProvider.exportWallet !== 'function') {
+            throw new Error('Wallet export is not available for this wallet.');
+        }
+        await this.wrappedProvider.exportWallet(address);
+    }
     // ============ signMessage delegates to wrapped provider ============
     async signMessage(message) {
         var _a, _b, _c, _d, _e, _f;
@@ -3407,7 +3425,7 @@ const IDB_STORE = 'keys';
 const IDB_KEY = 'ed25519';
 const GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +
     'stored-secret guest credentials are disabled.';
-function toBase64(bytes) {
+function toBase64$1(bytes) {
     let bin = '';
     for (let i = 0; i < bytes.length; i++)
         bin += String.fromCharCode(bytes[i]);
@@ -3471,7 +3489,7 @@ async function webCryptoKey() {
             async sign(message) {
                 const data = new TextEncoder().encode(message);
                 const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));
-                return toBase64(sig);
+                return toBase64$1(sig);
             },
         };
     }
@@ -3574,14 +3592,221 @@ class GuestAuthProvider {
     }
 }
 
+var bufferExports = requireBuffer();
+
+// crossmint-signer-bridge.ts — routes embedded-wallet signing through the
+// Bounded-owned signer popup (auth.bounded.sh/wallet/signer).
+//
+// Slice-1 attached a non-custodial Crossmint smart wallet to email logins and
+// populated `@user.address`. This bridge is the slice-2 counterpart: a user
+// whose address came from `auth.wallets` can APPROVE transactions with that
+// wallet from ANY app, non-custodially, by having the Crossmint client SDK run
+// ONLY on the Bounded signer page (one whitelisted origin) and talking to it via
+// postMessage.
+//
+// SEMANTICS (Crossmint Solana smart wallets): these wallets cannot produce raw
+// detached signatures — there is no signMessage and no sign-without-submit. The
+// only honest primitive is EXECUTION (sign + submit) via the wallet's email-OTP
+// authorization. So this bridge implements `signAndSubmitTransaction` and a
+// token-send; `signMessage` / `signTransaction` throw a clear unsupported error.
+const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets — Crossmint Solana smart wallets sign ' +
+    'and submit atomically. Use signAndSubmitTransaction() (or bounded.sendWalletToken) ' +
+    'instead of signMessage/signTransaction.';
+const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so email logins get a non-custodial wallet (@user.address), ' +
+    'then sign from a user gesture.';
+function hasDOM$1() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+function decodeJwt$2(token) {
+    try {
+        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const pad = b64.length % 4;
+        if (pad === 2)
+            b64 += '==';
+        else if (pad === 3)
+            b64 += '=';
+        return JSON.parse(bufferExports.Buffer.from(b64, 'base64').toString('utf8'));
+    }
+    catch (_a) {
+        return {};
+    }
+}
+// Pull the embedded-wallet identity out of the active session's id token.
+// Returns null when this session has no wallet (so callers can throw the
+// informative NO_EMBEDDED_WALLET error).
+function walletClaimsFromSession() {
+    let idToken = null;
+    try {
+        idToken = getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        idToken = null;
+    }
+    if (!idToken)
+        return null;
+    const c = decodeJwt$2(idToken);
+    const address = c['custom:walletAddress'];
+    const email = c['email'];
+    if (typeof address !== 'string' || !address)
+        return null;
+    if (typeof email !== 'string' || !email)
+        return null;
+    const envClaim = c['custom:walletEnvironment'];
+    const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
+    return { email, address, environment };
+}
+async function signerPageUrl() {
+    const cfg = await getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
+}
+let requestSeq = 0;
+/**
+ * Open the Bounded signer popup, send `action` to it, and resolve with the
+ * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
+ * the browser will block the popup — in which case this rejects with a clear
+ * "Popup blocked" error telling the app to call from a user gesture.
+ *
+ * Non-custodial: the popup gates signing behind an email OTP delivered to the
+ * wallet's owner, and validates that the wallet address matches the account.
+ */
+async function signViaSignerPopup(action) {
+    if (!hasDOM$1()) {
+        throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const claims = walletClaimsFromSession();
+    if (!claims)
+        throw new Error(NO_EMBEDDED_WALLET);
+    const { url, origin: signerOrigin } = await signerPageUrl();
+    const requestId = `bsign_${Date.now()}_${++requestSeq}`;
+    // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
+    const w = 420, h = 600;
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    const popup = window.open(url, 'bounded-wallet-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    if (!popup) {
+        throw new Error('Popup blocked — call signAndSubmitTransaction() from a user gesture (e.g. a click handler) so the wallet approval window can open.');
+    }
+    const request = {
+        type: 'bounded:sign',
+        requestId,
+        environment: claims.environment, // may be undefined → page auto-detects
+        email: claims.email,
+        address: claims.address,
+        action,
+    };
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let closeTimer;
+        let sentRequest = false;
+        const cleanup = () => {
+            settled = true;
+            window.removeEventListener('message', onMsg);
+            if (closeTimer)
+                clearInterval(closeTimer);
+        };
+        const sendRequest = () => {
+            if (sentRequest)
+                return;
+            sentRequest = true;
+            try {
+                popup.postMessage(request, signerOrigin);
+            }
+            catch ( /* popup gone */_a) { /* popup gone */ }
+        };
+        const onMsg = (ev) => {
+            if (ev.origin !== signerOrigin)
+                return; // only trust the signer page origin
+            const d = ev.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:signer:ready') {
+                sendRequest();
+                return;
+            }
+            if (d.type === 'bounded:signer:result' && d.requestId === requestId) {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                if (d.ok)
+                    resolve({ hash: d.hash, explorerLink: d.explorerLink, transactionId: d.transactionId });
+                else
+                    reject(new Error(String(d.error || 'Wallet signing failed')));
+            }
+        };
+        window.addEventListener('message', onMsg);
+        // Fallback: if the ready ping was missed (fast load / focus race), push the
+        // request shortly after opening. The page ignores it until a bounded:sign
+        // arrives and only acts on the first one, so a duplicate is harmless.
+        setTimeout(sendRequest, 1200);
+        // If the user closes the popup before completing, reject (unless a result
+        // just arrived — give any in-flight message a beat to settle first).
+        closeTimer = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(closeTimer);
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Wallet approval window was closed before signing completed.'));
+                } }, 400);
+            }
+        }, 500);
+        // Overall safety timeout (OTP + signing). Generous — the user may take a
+        // while to fetch the code from their email.
+        setTimeout(() => { if (!settled) {
+            cleanup();
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+            reject(new Error('Wallet approval timed out.'));
+        } }, 5 * 60 * 1000);
+    });
+}
+function toBase64(bytes) {
+    return bufferExports.Buffer.from(bytes).toString('base64');
+}
+// Serialize a legacy or versioned Solana transaction to base64 for the signer
+// page. We do NOT require existing signatures (the smart wallet signs on the
+// page); Crossmint extracts the instructions and wraps them for the smart wallet.
+function serializeTransaction(transaction) {
+    const isLegacy = 'recentBlockhash' in transaction &&
+        !('message' in transaction && 'staticAccountKeys' in transaction.message);
+    const bytes = isLegacy
+        ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
+        : transaction.serialize();
+    return toBase64(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+}
+/**
+ * Whether the active session carries an embedded wallet (so the provider should
+ * route signing through the popup rather than throw "no wallet").
+ */
+function hasEmbeddedWallet() {
+    return walletClaimsFromSession() != null;
+}
+/** signAndSubmitTransaction for embedded wallets: serialize + route through the
+ *  signer popup, resolve with the on-chain transaction signature/hash. */
+async function embeddedSignAndSubmit(transaction) {
+    const serializedTransaction = serializeTransaction(transaction);
+    const result = await signViaSignerPopup({ kind: 'transaction', serializedTransaction });
+    const hash = result.hash || result.transactionId;
+    if (!hash)
+        throw new Error('Signer returned no transaction hash.');
+    return hash;
+}
+
 // Web uses localStorage (WebSessionManager); React Native uses the configured
 // ReactNativeSessionManager. getActiveSessionManager() picks the right one by
 // whether the RN manager was configured (NOT `typeof window`, which is truthy on
 // RN too and would wrongly route to localStorage). Same selector the core
 // request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.
 const sessionManager$1 = getActiveSessionManager;
-const NO_WALLET = 'Email login is offchain — it has no Solana wallet and cannot sign/submit ' +
-    'transactions. Use a wallet provider for onchain actions, or link a wallet later.';
+const NO_WALLET = 'Email login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so email logins get a non-custodial Crossmint wallet ' +
+    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +
+    'provider (e.g. Phantom) for onchain actions.';
 // ---------------------------------------------------------------------------
 // token / session helpers
 // ---------------------------------------------------------------------------
@@ -3631,10 +3856,23 @@ class EmailAuthProvider {
         sessionManager$1().clearSession();
         setCurrentUser(null);
     }
-    async signMessage(_message) { throw new Error(NO_WALLET); }
+    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a
+    // raw signature — signMessage/signTransaction are structurally unsupported
+    // (throw the clear "use signAndSubmitTransaction" error when a wallet exists;
+    // the no-wallet error otherwise). signAndSubmitTransaction routes through the
+    // Bounded signer popup for wallets-enabled email logins.
+    async signMessage(_message) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
+    }
     async runTransaction(_evm, _sol, _options) { throw new Error(NO_WALLET); }
-    async signTransaction(_t) { throw new Error(NO_WALLET); }
-    async signAndSubmitTransaction() { throw new Error(NO_WALLET); }
+    async signTransaction(_t) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
+    }
+    async signAndSubmitTransaction(transaction, _feePayer) {
+        if (!hasEmbeddedWallet())
+            throw new Error(NO_WALLET);
+        return embeddedSignAndSubmit(transaction);
+    }
     async getNativeMethods() { return {}; }
 }
 const emailProviderSingleton = new EmailAuthProvider();
@@ -3665,6 +3903,11 @@ function resolveSolanaRpcUrl(explicitRpcUrl, network, context) {
     throw new Error(`${context} requires an explicit Solana RPC URL. Pass config.rpcUrl before signing or submitting onchain transactions.`);
 }
 
+// Same message the email provider uses when a hosted (OIDC) login has no
+// embedded wallet — enable `auth.wallets` in policy to get one.
+const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
+    'the app policy so logins get a non-custodial Crossmint wallet (@user.address), ' +
+    'then sign from a user gesture.';
 const PKCE_STORE_KEY = 'bounded.oidc.pkce';
 const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // Active session store (Web on web, RN on React Native) — selected by config,
@@ -3689,6 +3932,10 @@ function decodeJwt(token) {
     }
 }
 // A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
+// Signing surface (slice 2): a hosted login on a wallets-enabled app carries an
+// embedded Crossmint wallet (@user.address). signAndSubmitTransaction routes
+// through the Bounded signer popup; signMessage/signTransaction are structurally
+// unsupported for Crossmint smart wallets (sign+submit atomically, no raw sig).
 const oidcProviderSingleton = {
     async login() {
         const idToken = sessionManager().getIdToken();
@@ -3699,6 +3946,17 @@ const oidcProviderSingleton = {
         return idToken ? userFromIdToken(idToken) : null;
     },
     async logout() { sessionManager().clearSession(); },
+    async signMessage(_message) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    },
+    async signTransaction(_t) {
+        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    },
+    async signAndSubmitTransaction(transaction, _feePayer) {
+        if (!hasEmbeddedWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return embeddedSignAndSubmit(transaction);
+    },
 };
 function userFromIdToken(idToken) {
     const c = decodeJwt(idToken);
@@ -4604,7 +4862,7 @@ function useAuth() {
     // Provide a fallback so server render doesn't break
     if (isSSR$1) {
         return {
-            login: async () => undefined,
+            login: async (_options) => undefined,
             logout: async () => undefined,
             loading: true,
             user: null,
@@ -4626,10 +4884,10 @@ function useAuth() {
             stopLoading();
         };
     }, []);
-    const login$1 = async () => {
+    const login$1 = async (options) => {
         try {
             setLoading(true);
-            const user = await login();
+            const user = await login(options);
             setUser(user);
         }
         catch (error) {
@@ -4739,8 +4997,6 @@ async function getIdToken() {
     return getIdToken$1(false);
 }
 
-var bufferExports = requireBuffer();
-
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */