@bounded-sh/client 0.0.53-next.1 → 0.0.55

package/dist/{index-Co7IqxVo.mjs → index-DkdIADby.mjs}

@@ -4443,7 +4443,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-CRFJd5Rp.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-yBbGzH2e.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4462,7 +4462,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-uF4yZt8l.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BhpwmpgW.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4475,7 +4475,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-Bsh00akg.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-D7fd42En.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4503,7 +4503,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-BLzLLs7u.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-BnugW3TI.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4559,7 +4559,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-BLzLLs7u.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-BnugW3TI.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -5674,14 +5674,32 @@ const builds = {
 };
 
 async function create(options = {}) {
-    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.clientToken !== undefined ? { clientToken: options.clientToken } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
+    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.idempotencyKey !== undefined ? { idempotencyKey: options.idempotencyKey } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
     const app = await requestDevApi('/apps/new', {
         method: 'POST',
         body,
     });
-    return Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url, 
-        // Fail closed against an older server response that omitted this field.
-        policySeeded: app.policySeeded === true });
+    return Object.assign(Object.assign(Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url }), (typeof app.prompt === 'string' && app.prompt ? { prompt: app.prompt } : {})), (typeof app.handoff === 'string' && app.handoff ? { handoff: app.handoff } : {}));
+}
+/**
+ * F-1200: build the create-flow redirect the owner is sent to after `create()`, with the
+ * prompt and handoff carried in the URL FRAGMENT (never the query - fragments never reach
+ * servers, logs, or Referer). Encoding is byte-exact so the widget's `URLSearchParams`
+ * parse + `.trim()` reproduces the SAME prompt string dev-api hashed into the handoff;
+ * getting this wrong would make the widget reject a genuine token and degrade to prefill.
+ * Callers (bounded.sh, oapps.fun) should use this instead of hand-building the URL.
+ *
+ * Returns `${url}#bounded_prompt=<prompt>` with no `&bounded_handoff=` when the server
+ * minted no handoff (HANDOFF_SECRET unset) - the widget then prefills without auto-running.
+ */
+function buildCreateRedirectUrl(app) {
+    const base = app.url;
+    const prompt = typeof app.prompt === 'string' ? app.prompt.trim() : '';
+    if (!prompt)
+        return base;
+    const params = `bounded_prompt=${encodeURIComponent(prompt)}`
+        + (app.handoff ? `&bounded_handoff=${encodeURIComponent(app.handoff)}` : '');
+    return `${base}#${params}`;
 }
 async function list() {
     // This legacy-compatible action shape is also used by oapps.fun listMyApps.
@@ -5702,8 +5720,11 @@ async function list() {
         const name = String((_d = row.name) !== null && _d !== void 0 ? _d : '').trim() || '(unnamed app)';
         const slug = typeof row.slug === 'string' && row.slug ? row.slug : undefined;
         const url = typeof row.url === 'string' && row.url.trim() ? row.url.trim() : undefined;
-        return Object.assign(Object.assign({ appId,
-            name }, (slug ? { slug } : {})), (url ? { url } : {}));
+        const buildStatus = row.buildStatus === 'building' || row.buildStatus === 'build_failed'
+            ? row.buildStatus
+            : undefined;
+        return Object.assign(Object.assign(Object.assign({ appId,
+            name }, (slug ? { slug } : {})), (url ? { url } : {})), (buildStatus ? { buildStatus } : {}));
     })
         .filter((app) => app !== null);
 }
@@ -5711,7 +5732,7 @@ async function list() {
  * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
  * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
  */
-const apps = { create, list };
+const apps = { create, list, buildCreateRedirectUrl };
 
 async function deserializeTransaction(tx) {
     // Literal specifier so bundlers can code-split the lazy chunk.
@@ -6194,4 +6215,4 @@ function defaultInjectedEvmProvider() {
 }
 
 export { loginWithPopup as A, completeLoginInPopup as B, useAuth as C, useQuery as D, EMBEDDED_WALLET_UNSUPPORTED as E, useBuildRun as F, apps as G, deserializeTransaction as H, getIdToken as I, setPlatform as J, requestEip6963Providers as K, builds as L, BuildsApiError as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, PARK_REASONS as Q, RUN_STATES as R, FAILURE_REASONS as S, TERMINAL_STATES as T, BUILD_REVIEW_CAPABILITY_SCHEMA as U, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as V, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as W, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, defaultInjectedProvider as d, embeddedRunEvmTransaction as e, bufferExports as f, getPlatform as g, hasEmbeddedWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithRedirect as y, completeLoginFromRedirect as z };
-//# sourceMappingURL=index-Co7IqxVo.mjs.map
+//# sourceMappingURL=index-DkdIADby.mjs.map