@bounded-sh/client 0.0.53 → 0.0.56

package/dist/index.d.ts

@@ -7,6 +7,8 @@ export type { HostedAuthMethod, OidcLoginOptions, PopupLoginOptions } from "./au
 export { get, getMany, docId, set, setMany, setFile, getFiles, search, queryAggregate, runQuery, runQueryMany, runExpression, runExpressionMany, signMessage, signTransaction, signAndSubmitTransaction, count, aggregate, GetOptions, SearchOptions, SetOptions, CountOptions, AggregateOptions, AggregateOperation, AggregateResult, AggregateSpec, AggregateRow, QueryAggregateOptions, } from "@bounded-sh/core";
 export type { GetOptions as BoundedGetOptions } from "@bounded-sh/core";
 export { subscribe } from "@bounded-sh/core";
+export { createClient, ScopedClientReadOnlyError } from "@bounded-sh/core";
+export type { BoundedClient, CreateClientConfig } from "@bounded-sh/core";
 export { BoundedDeclineError, deriveDecline, dispatchDeclineEvent, DECLINE_EVENT_NAME } from "@bounded-sh/core";
 export type { BoundedDecline, DeclineReason, DeclineBoundary } from "@bounded-sh/core";
 export { dispatchRateLimitEvent, RATE_LIMIT_EVENT_NAME } from "@bounded-sh/core";

package/dist/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-CK36YlGT.js');
+var index = require('./index-B_uRc6gn.js');
 var core = require('@bounded-sh/core');
 require('react');
 
@@ -55,6 +55,10 @@ Object.defineProperty(exports, "RATE_LIMIT_EVENT_NAME", {
 	enumerable: true,
 	get: function () { return core.RATE_LIMIT_EVENT_NAME; }
 });
+Object.defineProperty(exports, "ScopedClientReadOnlyError", {
+	enumerable: true,
+	get: function () { return core.ScopedClientReadOnlyError; }
+});
 Object.defineProperty(exports, "aggregate", {
 	enumerable: true,
 	get: function () { return core.aggregate; }
@@ -63,6 +67,10 @@ Object.defineProperty(exports, "count", {
 	enumerable: true,
 	get: function () { return core.count; }
 });
+Object.defineProperty(exports, "createClient", {
+	enumerable: true,
+	get: function () { return core.createClient; }
+});
 Object.defineProperty(exports, "deriveDecline", {
 	enumerable: true,
 	get: function () { return core.deriveDecline; }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { W as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, V as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, U as BUILD_REVIEW_CAPABILITY_SCHEMA, M as BuildsApiError, S as FAILURE_REASONS, N as NON_TERMINAL_STATES, O as OffchainAuthProvider, Q as PARK_REASONS, P as PrivyExpoProvider, R as RUN_STATES, T as TERMINAL_STATES, G as apps, L as builds, z as completeLoginFromRedirect, B as completeLoginInPopup, k as defaultInjectedEvmProvider, d as defaultInjectedProvider, H as deserializeTransaction, q as getAuthLoading, v as getAuthProvider, m as getCurrentUser, I as getIdToken, g as getPlatform, l as init, t as login, A as loginWithPopup, x as loginWithPrivy, y as loginWithRedirect, u as logout, p as onAuthLoadingChanged, o as onAuthStateChanged, K as requestEip6963Providers, J as setPlatform, w as signInAnonymously, C as useAuth, F as useBuildRun, D as useQuery } from './index-DuaMs1q-.mjs';
+export { W as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, V as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, U as BUILD_REVIEW_CAPABILITY_SCHEMA, M as BuildsApiError, S as FAILURE_REASONS, N as NON_TERMINAL_STATES, O as OffchainAuthProvider, Q as PARK_REASONS, P as PrivyExpoProvider, R as RUN_STATES, T as TERMINAL_STATES, G as apps, L as builds, z as completeLoginFromRedirect, B as completeLoginInPopup, k as defaultInjectedEvmProvider, d as defaultInjectedProvider, H as deserializeTransaction, q as getAuthLoading, v as getAuthProvider, m as getCurrentUser, I as getIdToken, g as getPlatform, l as init, t as login, A as loginWithPopup, x as loginWithPrivy, y as loginWithRedirect, u as logout, p as onAuthLoadingChanged, o as onAuthStateChanged, K as requestEip6963Providers, J as setPlatform, w as signInAnonymously, C as useAuth, F as useBuildRun, D as useQuery } from './index--jrXqxte.mjs';
 export * from '@bounded-sh/core';
-export { BoundedDeclineError, DECLINE_EVENT_NAME, RATE_LIMIT_EVENT_NAME, aggregate, count, deriveDecline, dispatchDeclineEvent, dispatchRateLimitEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
+export { BoundedDeclineError, DECLINE_EVENT_NAME, RATE_LIMIT_EVENT_NAME, ScopedClientReadOnlyError, aggregate, count, createClient, deriveDecline, dispatchDeclineEvent, dispatchRateLimitEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
 import 'react';
 //# sourceMappingURL=index.mjs.map

package/dist/{index.native-DoWvYWaz.js → index.native-BqK-14S8.js}

@@ -4464,7 +4464,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-ChDGkDyY.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CZ-xYVln.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4483,7 +4483,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-C_EmEki7.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-eMZ8tjas.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4496,7 +4496,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-9ephHduG.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CXfQT5sm.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4524,7 +4524,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-C7u3RFEX.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-D9A4SU4z.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4580,7 +4580,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-C7u3RFEX.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-D9A4SU4z.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -5376,9 +5376,11 @@ const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
 const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
 const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
 
+const FAST_POLL_MS = 1000;
 const NORMAL_POLL_MS = 2000;
 const PARKED_POLL_MS = 5000;
 const LONG_RUNNING_POLL_MS = 10000;
+const THIRTY_SECONDS_MS = 30000;
 const TWO_MINUTES_MS = 2 * 60000;
 const TEN_MINUTES_MS = 10 * 60000;
 const terminalStates = new Set(TERMINAL_STATES);
@@ -5387,6 +5389,10 @@ function pollCadence(state, elapsedMs) {
         return LONG_RUNNING_POLL_MS;
     if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
         return PARKED_POLL_MS;
+    // The first 30s is where the user is staring at "waiting for a build slot" /
+    // "building" and every transition matters most; poll fast, then relax.
+    if (elapsedMs < THIRTY_SECONDS_MS)
+        return FAST_POLL_MS;
     return NORMAL_POLL_MS;
 }
 function retryCadence(error, state, elapsedMs) {
@@ -5472,9 +5478,18 @@ function watch(appId, runId, onUpdate, options = {}) {
     const poll = async () => {
         if (!active)
             return;
+        // Fire the view and the events page concurrently: the events cursor (lastSeq)
+        // does not depend on the run view, so there is no reason to pay two serial
+        // round-trips per tick. Error semantics below are unchanged — the run result
+        // still gates, and a failed events page still publishes the run with no rows.
+        const runPromise = get(appId, runId);
+        const eventsPromise = events(appId, runId, lastSeq);
+        // Keep the in-flight events page from becoming an unhandled rejection if the
+        // run result makes us bail before awaiting it; the real await below still sees it.
+        eventsPromise.catch(() => { });
         let run;
         try {
-            const view = await get(appId, runId);
+            const view = await runPromise;
             if (!active)
                 return;
             run = view.run;
@@ -5492,7 +5507,7 @@ function watch(appId, runId, onUpdate, options = {}) {
             return;
         }
         try {
-            const response = await events(appId, runId, lastSeq);
+            const response = await eventsPromise;
             if (!active)
                 return;
             const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
@@ -5634,7 +5649,27 @@ async function create(options = {}) {
         method: 'POST',
         body,
     });
-    return Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url });
+    return Object.assign(Object.assign(Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url }), (typeof app.prompt === 'string' && app.prompt ? { prompt: app.prompt } : {})), (typeof app.handoff === 'string' && app.handoff ? { handoff: app.handoff } : {}));
+}
+/**
+ * F-1200: build the create-flow redirect the owner is sent to after `create()`, with the
+ * prompt and handoff carried in the URL FRAGMENT (never the query - fragments never reach
+ * servers, logs, or Referer). Encoding is byte-exact so the widget's `URLSearchParams`
+ * parse + `.trim()` reproduces the SAME prompt string dev-api hashed into the handoff;
+ * getting this wrong would make the widget reject a genuine token and degrade to prefill.
+ * Callers (bounded.sh, oapps.fun) should use this instead of hand-building the URL.
+ *
+ * Returns `${url}#bounded_prompt=<prompt>` with no `&bounded_handoff=` when the server
+ * minted no handoff (HANDOFF_SECRET unset) - the widget then prefills without auto-running.
+ */
+function buildCreateRedirectUrl(app) {
+    const base = app.url;
+    const prompt = typeof app.prompt === 'string' ? app.prompt.trim() : '';
+    if (!prompt)
+        return base;
+    const params = `bounded_prompt=${encodeURIComponent(prompt)}`
+        + (app.handoff ? `&bounded_handoff=${encodeURIComponent(app.handoff)}` : '');
+    return `${base}#${params}`;
 }
 async function list() {
     // This legacy-compatible action shape is also used by oapps.fun listMyApps.
@@ -5667,7 +5702,7 @@ async function list() {
  * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
  * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
  */
-const apps = { create, list };
+const apps = { create, list, buildCreateRedirectUrl };
 
 async function deserializeTransaction(tx) {
     // Literal specifier so bundlers can code-split the lazy chunk.
@@ -6109,4 +6144,4 @@ exports.setPlatform = setPlatform;
 exports.signInAnonymously = signInAnonymously;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
-//# sourceMappingURL=index.native-DoWvYWaz.js.map
+//# sourceMappingURL=index.native-BqK-14S8.js.map