@bounded-sh/client 0.0.53 → 0.0.56

package/dist/{index-CK36YlGT.js → index-B_uRc6gn.js}

@@ -4464,7 +4464,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BZJ9EcnE.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-4Df8dFOh.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4483,7 +4483,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CABVyh7K.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-ClI_h_fy.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4496,7 +4496,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-GANZNy2j.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-xZ01LIw2.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4524,7 +4524,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-B2CPHhym.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DWcdRvLW.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4580,7 +4580,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-B2CPHhym.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DWcdRvLW.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -5442,9 +5442,11 @@ const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
 const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
 const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
 
+const FAST_POLL_MS = 1000;
 const NORMAL_POLL_MS = 2000;
 const PARKED_POLL_MS = 5000;
 const LONG_RUNNING_POLL_MS = 10000;
+const THIRTY_SECONDS_MS = 30000;
 const TWO_MINUTES_MS = 2 * 60000;
 const TEN_MINUTES_MS = 10 * 60000;
 const terminalStates = new Set(TERMINAL_STATES);
@@ -5453,6 +5455,10 @@ function pollCadence(state, elapsedMs) {
         return LONG_RUNNING_POLL_MS;
     if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
         return PARKED_POLL_MS;
+    // The first 30s is where the user is staring at "waiting for a build slot" /
+    // "building" and every transition matters most; poll fast, then relax.
+    if (elapsedMs < THIRTY_SECONDS_MS)
+        return FAST_POLL_MS;
     return NORMAL_POLL_MS;
 }
 function retryCadence(error, state, elapsedMs) {
@@ -5538,9 +5544,18 @@ function watch(appId, runId, onUpdate, options = {}) {
     const poll = async () => {
         if (!active)
             return;
+        // Fire the view and the events page concurrently: the events cursor (lastSeq)
+        // does not depend on the run view, so there is no reason to pay two serial
+        // round-trips per tick. Error semantics below are unchanged — the run result
+        // still gates, and a failed events page still publishes the run with no rows.
+        const runPromise = get(appId, runId);
+        const eventsPromise = events(appId, runId, lastSeq);
+        // Keep the in-flight events page from becoming an unhandled rejection if the
+        // run result makes us bail before awaiting it; the real await below still sees it.
+        eventsPromise.catch(() => { });
         let run;
         try {
-            const view = await get(appId, runId);
+            const view = await runPromise;
             if (!active)
                 return;
             run = view.run;
@@ -5558,7 +5573,7 @@ function watch(appId, runId, onUpdate, options = {}) {
             return;
         }
         try {
-            const response = await events(appId, runId, lastSeq);
+            const response = await eventsPromise;
             if (!active)
                 return;
             const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
@@ -5700,7 +5715,27 @@ async function create(options = {}) {
         method: 'POST',
         body,
     });
-    return Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url });
+    return Object.assign(Object.assign(Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url }), (typeof app.prompt === 'string' && app.prompt ? { prompt: app.prompt } : {})), (typeof app.handoff === 'string' && app.handoff ? { handoff: app.handoff } : {}));
+}
+/**
+ * F-1200: build the create-flow redirect the owner is sent to after `create()`, with the
+ * prompt and handoff carried in the URL FRAGMENT (never the query - fragments never reach
+ * servers, logs, or Referer). Encoding is byte-exact so the widget's `URLSearchParams`
+ * parse + `.trim()` reproduces the SAME prompt string dev-api hashed into the handoff;
+ * getting this wrong would make the widget reject a genuine token and degrade to prefill.
+ * Callers (bounded.sh, oapps.fun) should use this instead of hand-building the URL.
+ *
+ * Returns `${url}#bounded_prompt=<prompt>` with no `&bounded_handoff=` when the server
+ * minted no handoff (HANDOFF_SECRET unset) - the widget then prefills without auto-running.
+ */
+function buildCreateRedirectUrl(app) {
+    const base = app.url;
+    const prompt = typeof app.prompt === 'string' ? app.prompt.trim() : '';
+    if (!prompt)
+        return base;
+    const params = `bounded_prompt=${encodeURIComponent(prompt)}`
+        + (app.handoff ? `&bounded_handoff=${encodeURIComponent(app.handoff)}` : '');
+    return `${base}#${params}`;
 }
 async function list() {
     // This legacy-compatible action shape is also used by oapps.fun listMyApps.
@@ -5733,7 +5768,7 @@ async function list() {
  * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
  * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
  */
-const apps = { create, list };
+const apps = { create, list, buildCreateRedirectUrl };
 
 async function deserializeTransaction(tx) {
     // Literal specifier so bundlers can code-split the lazy chunk.
@@ -6264,4 +6299,4 @@ exports.signInAnonymously = signInAnonymously;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index-CK36YlGT.js.map
+//# sourceMappingURL=index-B_uRc6gn.js.map