@bounded-sh/client 0.0.51 → 0.0.53-next.0

package/dist/index.js

@@ -1,11 +1,14 @@
 'use strict';
 
-var index = require('./index-BsrZb496.js');
+var index = require('./index-C6p_-77w.js');
 var core = require('@bounded-sh/core');
 require('react');
 
 
 
+exports.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = index.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA;
+exports.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = index.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA;
+exports.BUILD_REVIEW_CAPABILITY_SCHEMA = index.BUILD_REVIEW_CAPABILITY_SCHEMA;
 exports.BuildsApiError = index.BuildsApiError;
 exports.FAILURE_REASONS = index.FAILURE_REASONS;
 exports.NON_TERMINAL_STATES = index.NON_TERMINAL_STATES;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { M as BuildsApiError, U as FAILURE_REASONS, N as NON_TERMINAL_STATES, O as OffchainAuthProvider, Q as PARK_REASONS, P as PrivyExpoProvider, R as RUN_STATES, T as TERMINAL_STATES, G as apps, L as builds, z as completeLoginFromRedirect, B as completeLoginInPopup, k as defaultInjectedEvmProvider, d as defaultInjectedProvider, H as deserializeTransaction, q as getAuthLoading, v as getAuthProvider, m as getCurrentUser, I as getIdToken, g as getPlatform, l as init, t as login, A as loginWithPopup, x as loginWithPrivy, y as loginWithRedirect, u as logout, p as onAuthLoadingChanged, o as onAuthStateChanged, K as requestEip6963Providers, J as setPlatform, w as signInAnonymously, C as useAuth, F as useBuildRun, D as useQuery } from './index-Cy0IRs6U.mjs';
+export { W as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, V as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, U as BUILD_REVIEW_CAPABILITY_SCHEMA, M as BuildsApiError, S as FAILURE_REASONS, N as NON_TERMINAL_STATES, O as OffchainAuthProvider, Q as PARK_REASONS, P as PrivyExpoProvider, R as RUN_STATES, T as TERMINAL_STATES, G as apps, L as builds, z as completeLoginFromRedirect, B as completeLoginInPopup, k as defaultInjectedEvmProvider, d as defaultInjectedProvider, H as deserializeTransaction, q as getAuthLoading, v as getAuthProvider, m as getCurrentUser, I as getIdToken, g as getPlatform, l as init, t as login, A as loginWithPopup, x as loginWithPrivy, y as loginWithRedirect, u as logout, p as onAuthLoadingChanged, o as onAuthStateChanged, K as requestEip6963Providers, J as setPlatform, w as signInAnonymously, C as useAuth, F as useBuildRun, D as useQuery } from './index-Co7IqxVo.mjs';
 export * from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, RATE_LIMIT_EVENT_NAME, aggregate, count, deriveDecline, dispatchDeclineEvent, dispatchRateLimitEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
 import 'react';

package/dist/{index.native-BaEZwiWd.js → index.native-BTPOnWux.js}

@@ -840,11 +840,9 @@ class OffchainAuthProvider {
     }
 }
 
-const SURFNET_RPC_URL = "https://surfpool.fly.dev";
 const SUPPORTED_SOLANA_NETWORKS = new Set([
     "solana_devnet",
     "solana_mainnet",
-    "surfnet",
 ]);
 function normalizeSolanaRpcUrl(rpcUrl) {
     if (typeof rpcUrl !== "string")
@@ -858,7 +856,7 @@ function isSupportedSolanaRpcNetwork(network) {
 function resolveSolanaRpcUrl(explicitRpcUrl, network, context) {
     if (network != null && network !== "" && !isSupportedSolanaRpcNetwork(network)) {
         throw new Error(`${context} does not support Solana network "${network}". ` +
-            `Expected one of: solana_devnet, solana_mainnet, surfnet.`);
+            `Expected one of: solana_devnet, solana_mainnet.`);
     }
     const rpcUrl = normalizeSolanaRpcUrl(explicitRpcUrl);
     if (rpcUrl)
@@ -4466,7 +4464,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CnHsY8U-.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CyEhOnGQ.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4485,7 +4483,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-C65NiItg.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CmhZtf9E.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4498,7 +4496,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-DUyX7Xj9.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-Cjs3K7fU.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4526,7 +4524,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-fjOMwfpW.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DkUngKob.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4582,7 +4580,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-fjOMwfpW.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DkUngKob.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4825,7 +4823,12 @@ async function logout$1(options) {
     // Hosted sessions ('email' covers the whole hosted surface: email OTP +
     // social + the OIDC redirect/popup flows) are the ones with an issuer
     // cookie; wallet and guest sessions have nothing hosted to end.
-    const wasHosted = (currentAuthMethod !== null && currentAuthMethod !== void 0 ? currentAuthMethod : getStoredAuthMethod()) === 'email';
+    // Check the STORED marker as well as the in-memory method: the hosted
+    // OIDC flows (loginWithPopup / completeLoginFromRedirect) write the
+    // 'email' marker via exchangeCode() but never touch currentAuthMethod,
+    // which stays 'guest'/explicit even after a hosted upgrade. Worst case of
+    // a false positive is a harmless idempotent issuer bounce.
+    const wasHosted = currentAuthMethod === 'email' || getStoredAuthMethod() === 'email';
     await currentAuthProvider.logout();
     setStoredAuthMethod(null);
     currentAuthProvider = null;
@@ -5299,6 +5302,31 @@ async function decideGate(appId, runId, gateId, options) {
     const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, decision = __rest(options, ["intentKey", "idempotencyKey"]);
     return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/decision`, { method: 'POST', body: Object.assign(Object.assign({}, decision), { idempotencyKey }) });
 }
+async function refreshReviewCapability(appId, runId, gateId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'refreshReviewCapability()');
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability/refresh`, {
+        method: 'POST',
+        body: {
+            expectedGeneration: options.expectedGeneration,
+            expectedExpiresAtMs: options.expectedExpiresAtMs,
+            expectedRecoveryUntilMs: options.expectedRecoveryUntilMs,
+            expectedAudience: options.expectedAudience,
+            expectedReviewerBindingHash: options.expectedReviewerBindingHash,
+            idempotencyKey,
+        },
+    });
+}
+/**
+ * Read one exact delegated-review capability and its narrow lifecycle result.
+ * This does not refresh or extend the window and exposes no generic run-view
+ * authority.
+ */
+async function getReviewCapability(appId, runId, gateId, options) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability`, {
+        method: 'POST',
+        body: { expectedPreviewUrl: options.expectedPreviewUrl },
+    });
+}
 async function topup(appId, runId, options) {
     return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/topup`, { method: 'POST', body: options });
 }
@@ -5344,6 +5372,9 @@ const FAILURE_REASONS = [
     'bind_failed',
     'internal_error',
 ];
+const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
+const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
+const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
 
 const NORMAL_POLL_MS = 2000;
 const PARKED_POLL_MS = 5000;
@@ -5580,22 +5611,25 @@ function useBuildRun(appId, runId, options) {
 }
 
 /**
- * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
- * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
+ * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost), with
+ * one exact Drafted exception for delegated review/decision routes. Other
+ * generated-app origins remain blocked; server-side callers are unaffected.
  */
 const builds = {
     submit,
     get,
+    getReviewCapability,
     events,
     cancel,
     decideGate,
+    refreshReviewCapability,
     topup,
     list: list$1,
     watch,
 };
 
 async function create(options = {}) {
-    const body = Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.clientToken !== undefined ? { clientToken: options.clientToken } : {})), (options.intent !== undefined ? { intent: options.intent } : {}));
+    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.clientToken !== undefined ? { clientToken: options.clientToken } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
     const app = await requestDevApi('/apps/new', {
         method: 'POST',
         body,
@@ -5861,7 +5895,7 @@ class PrivyExpoProvider {
                 };
             }
             // Sign and submit
-            const { signature, txInfo } = await this.signAndSubmitInternal(tx, wallet, rpcUrl, connection);
+            const { signature, txInfo } = await this.signAndSubmitInternal(tx, wallet, connection);
             return {
                 transactionSignature: signature,
                 blockNumber: (txInfo === null || txInfo === void 0 ? void 0 : txInfo.slot) || 0,
@@ -5941,7 +5975,7 @@ class PrivyExpoProvider {
             const { blockhash } = await connection.getLatestBlockhash('confirmed');
             versionedTx.message.recentBlockhash = blockhash;
         }
-        const { signature } = await this.signAndSubmitInternal(transaction, wallet, rpcUrl, connection);
+        const { signature } = await this.signAndSubmitInternal(transaction, wallet, connection);
         return signature;
     }
     async restoreSession() {
@@ -5993,22 +6027,10 @@ class PrivyExpoProvider {
         }
         return wallet;
     }
-    async signAndSubmitInternal(transaction, wallet, rpcUrl, connection) {
-        let signature;
-        if (rpcUrl.includes('surfpool') || rpcUrl === SURFNET_RPC_URL) {
-            // Surfnet: sign locally, then submit raw
-            const signed = await wallet.signTransaction(transaction);
-            const txSig = await connection.sendRawTransaction(signed.signedTransaction, {
-                skipPreflight: true,
-                maxRetries: 3,
-            });
-            signature = txSig;
-        }
-        else {
-            // Non-Surfnet: use Privy's combined sign+send
-            const result = await wallet.signAndSendTransaction(transaction, connection);
-            signature = result.signature;
-        }
+    async signAndSubmitInternal(transaction, wallet, connection) {
+        // Use Privy's combined sign+send
+        const result = await wallet.signAndSendTransaction(transaction, connection);
+        const signature = result.signature;
         const txInfo = await confirmAndCheckTransaction(connection, signature);
         return { signature, txInfo };
     }
@@ -6041,6 +6063,9 @@ class PrivyExpoProvider {
     }
 }
 
+exports.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA;
+exports.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA;
+exports.BUILD_REVIEW_CAPABILITY_SCHEMA = BUILD_REVIEW_CAPABILITY_SCHEMA;
 exports.BuildsApiError = BuildsApiError;
 exports.EMBEDDED_WALLET_UNSUPPORTED = EMBEDDED_WALLET_UNSUPPORTED;
 exports.FAILURE_REASONS = FAILURE_REASONS;
@@ -6049,7 +6074,6 @@ exports.OffchainAuthProvider = OffchainAuthProvider;
 exports.PARK_REASONS = PARK_REASONS;
 exports.PrivyExpoProvider = PrivyExpoProvider;
 exports.RUN_STATES = RUN_STATES;
-exports.SURFNET_RPC_URL = SURFNET_RPC_URL;
 exports.TERMINAL_STATES = TERMINAL_STATES;
 exports.apps = apps;
 exports.bs58 = bs58;
@@ -6084,4 +6108,4 @@ exports.setPlatform = setPlatform;
 exports.signInAnonymously = signInAnonymously;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
-//# sourceMappingURL=index.native-BaEZwiWd.js.map
+//# sourceMappingURL=index.native-BTPOnWux.js.map