@bounded-sh/client 0.0.57 → 0.0.59

package/dist/{index.native-hu3o3zXU.js → index.native-D48QQ0-q.js}

@@ -3475,7 +3475,7 @@ const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets —
 const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
     'the app policy so email logins get a non-custodial wallet (@user.address), ' +
     'then sign from a user gesture.';
-function hasDOM$1() {
+function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt$1(token) {
@@ -3535,7 +3535,7 @@ let requestSeq = 0;
  * wallet's owner, and validates that the wallet address matches the account.
  */
 async function signViaSignerPopup(action) {
-    if (!hasDOM$1()) {
+    if (!hasDOM$2()) {
         throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
     }
     const isEvm = action.kind === 'evmTransaction';
@@ -3711,7 +3711,7 @@ const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = core.getActiveSessionManager;
-function hasDOM() {
+function hasDOM$1() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -3742,7 +3742,7 @@ const oidcProviderSingleton = {
         const idToken = sessionManager().getIdToken();
         return idToken ? userFromIdToken(idToken) : null;
     },
-    async logout() { sessionManager().clearSession(); },
+    async logout() { await sessionManager().clearSession(); },
     async signMessage(_message) {
         throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
     },
@@ -3851,7 +3851,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$1() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3959,7 +3959,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM())
+    if (!hasDOM$1())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3975,7 +3975,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM())
+    if (!hasDOM$1())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4021,7 +4021,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM())
+    if (!hasDOM$1())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4161,7 +4161,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM() || !window.opener)
+    if (!hasDOM$1() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4362,15 +4362,20 @@ function authProviderConfigKey(config) {
  * so both web (WebSessionManager) and RN (ReactNativeSessionManager) sessions
  * are properly cleared.
  */
-function clearIncompatibleSession() {
+async function clearIncompatibleSession() {
     if (getStoredAuthMethod() === currentAuthMethod) {
         return false;
     }
     // Clear both managers: on web the RN manager is a no-op (not configured),
     // and on RN the web manager is a no-op (no localStorage).
-    core.WebSessionManager.clearSession();
+    //
+    // AWAITED. Session removal is serialized through a cross-tab lock now, so a
+    // fire-and-forget call would let init() reach setCurrentUser while the old
+    // credential was still readable — and a request issued in that gap would
+    // authenticate as the session we are in the middle of discarding.
+    await core.WebSessionManager.clearSession();
     try {
-        core.ReactNativeSessionManager.clearSession();
+        await core.ReactNativeSessionManager.clearSession();
     }
     catch ( /* not configured on web */_a) { /* not configured on web */ }
     setStoredAuthMethod(null);
@@ -4469,7 +4474,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BlJI-8w9.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BSw9FRjg.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4488,7 +4493,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-7ep-jcal.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CmXqreEE.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4501,7 +4506,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-Xbt2CUPi.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-HQMOL_mZ.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4529,7 +4534,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BRjJV8Zq.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Czl48mOP.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4585,7 +4590,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BRjJV8Zq.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Czl48mOP.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4627,7 +4632,7 @@ async function signInAnonymously() {
             }
             catch (_b) {
                 try {
-                    core.getActiveSessionManager().clearSession();
+                    await core.getActiveSessionManager().clearSession();
                 }
                 catch ( /* fail closed below */_c) { /* fail closed below */ }
             }
@@ -4851,6 +4856,22 @@ async function logout$1(options) {
     }
 }
 
+/**
+ * Subscribed once per process, not per init(): re-registering on every init would
+ * stack duplicate handlers on repeated initialization.
+ */
+let sessionClearedBridgeRegistered = false;
+function registerSessionClearedBridge() {
+    if (sessionClearedBridgeRegistered)
+        return;
+    sessionClearedBridgeRegistered = true;
+    core.onSessionCleared(() => {
+        // Core fires this only when storage was ACTUALLY cleared, never on a
+        // transient refresh failure that preserved the session — so this cannot
+        // sign anyone out over a network blip.
+        setCurrentUser(null);
+    });
+}
 /**
  * Read the active session's idToken synchronously from whichever store is live
  * for this runtime (WebSessionManager on web, ReactNativeSessionManager on RN —
@@ -4908,6 +4929,15 @@ async function init(newConfig) {
     // setting it here makes "no flash" the SDK's default behavior for every consumer.
     setAuthLoading(true);
     try {
+        // Bridge core's "the stored session is gone" signal into SDK auth state.
+        //
+        // Core cannot import this package, and a session can die deep inside a
+        // session manager (dead refresh token, rejected refresh, app-id mismatch).
+        // Before this, setCurrentUser(null) was only ever called by logout() and
+        // init(), so storage could be wiped while `currentUser` stayed populated —
+        // onAuthStateChanged never fired, and every consumer UI went on showing a
+        // connected wallet for a session the server no longer knew about.
+        registerSessionClearedBridge();
         // Get auth provider first
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
@@ -4924,7 +4954,12 @@ async function init(newConfig) {
         let user = await authProviderInstance.restoreSession();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
-        if (user && clearIncompatibleSession()) {
+        //
+        // AWAITED: the clear is serialized through a cross-tab lock now, and an
+        // unawaited call would return a Promise (always truthy) — nulling the user
+        // unconditionally AND letting setCurrentUser run while the old credential
+        // was still in storage.
+        if (user && await clearIncompatibleSession()) {
             user = null;
         }
         setCurrentUser(user);
@@ -5787,6 +5822,109 @@ async function deserializeTransaction(tx) {
     }
 }
 
+// bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
+//
+// Web-only. Opens Coinbase's hosted checkout (pay.coinbase.com) in a popup
+// (new-tab fallback) using a single-use session token minted by the Bounded
+// platform at POST <origin>/__bounded/onramp/session on the app's own origin.
+// The platform holds the Coinbase credential; the app never sees it. The
+// session is bound server-side to the caller's verified Bounded JWT, and the
+// destination defaults to that user's embedded wallet.
+//
+// Works on Bounded-served origins (<app>.bounded.page / custom domains). On a
+// local dev origin the session endpoint does not exist; we fail with a clear
+// error rather than guessing a host.
+function hasDOM() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+/**
+ * Open Coinbase Onramp for the signed-in user. Resolves when the popup closes.
+ * Call from a click handler - popup blockers require user activation.
+ */
+async function onramp(options = {}) {
+    var _a, _b, _c;
+    if (!hasDOM())
+        throw new Error('onramp() is web-only');
+    const user = getCurrentUser();
+    const address = (_b = (_a = options.address) !== null && _a !== void 0 ? _a : user === null || user === void 0 ? void 0 : user.address) !== null && _b !== void 0 ? _b : undefined;
+    if (!address) {
+        throw new Error(user
+            ? 'onramp(): the signed-in account has no wallet address - pass { address } explicitly'
+            : 'onramp(): no signed-in user - call login() first or pass { address }');
+    }
+    const idToken = await getIdToken();
+    if (!idToken)
+        throw new Error('onramp(): no active session - call login() first');
+    // Open the window synchronously so the click's user-activation window is not
+    // consumed by the fetch below (same hard-won pattern as loginWithPopup).
+    let popup = null;
+    if (!options.newTab) {
+        const w = options.width || 460;
+        const h = options.height || 720;
+        const left = window.screenX + (window.outerWidth - w) / 2;
+        const top = window.screenY + (window.outerHeight - h) / 2;
+        popup = window.open('', 'bounded-onramp', `width=${w},height=${h},left=${left},top=${top}`);
+    }
+    let session;
+    try {
+        const res = await fetch(`${window.location.origin}/__bounded/onramp/session`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${idToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.address ? { address: options.address } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {}))),
+        });
+        if (!res.ok) {
+            let detail = '';
+            try {
+                detail = (_c = (await res.json()).error) !== null && _c !== void 0 ? _c : '';
+            }
+            catch ( /* keep status only */_d) { /* keep status only */ }
+            if (res.status === 404) {
+                throw new Error('onramp(): session endpoint not found - onramp works on Bounded-served origins (your deployed app URL), not local dev servers');
+            }
+            throw new Error(`onramp(): session mint failed (${res.status}${detail ? `: ${detail}` : ''})`);
+        }
+        session = (await res.json());
+    }
+    catch (error) {
+        try {
+            popup === null || popup === void 0 ? void 0 : popup.close();
+        }
+        catch ( /* ignore */_e) { /* ignore */ }
+        throw error;
+    }
+    if (popup) {
+        try {
+            popup.location.replace(session.url);
+        }
+        catch (_f) {
+            try {
+                popup.location.href = session.url;
+            }
+            catch (_g) {
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_h) { /* ignore */ }
+                throw new Error('onramp(): popup failed to navigate - retry with { newTab: true }');
+            }
+        }
+        return await new Promise((resolve) => {
+            const timer = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(timer);
+                    resolve({ status: 'closed', address: session.address, asset: session.asset });
+                }
+            }, 500);
+        });
+    }
+    // New-tab path (popup was blocked or explicitly requested): cross-origin tab
+    // close is not observable, so resolve immediately.
+    const tab = window.open(session.url, '_blank');
+    if (!tab)
+        throw new Error('onramp(): window.open was blocked - call onramp() from a click handler');
+    return { status: 'opened', address: session.address, asset: session.asset };
+}
+
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */
@@ -5916,7 +6054,7 @@ class PrivyExpoProvider {
                 return { provider: this, address: session.address };
             }
             // Stale session — clear and continue to fresh login flow
-            core.getActiveSessionManager().clearSession();
+            await core.getActiveSessionManager().clearSession();
         }
         // Trigger Privy login
         const privyUser = await this.privyMethods.login();
@@ -6097,7 +6235,7 @@ class PrivyExpoProvider {
         if ((_a = this.privyMethods) === null || _a === void 0 ? void 0 : _a.isAuthenticated) {
             await this.privyMethods.logout();
         }
-        core.getActiveSessionManager().clearSession();
+        await core.getActiveSessionManager().clearSession();
     }
     async getNativeMethods() {
         return this.privyMethods;
@@ -6208,6 +6346,7 @@ exports.logout = logout;
 exports.normalizeSolanaRpcUrl = normalizeSolanaRpcUrl;
 exports.onAuthLoadingChanged = onAuthLoadingChanged;
 exports.onAuthStateChanged = onAuthStateChanged;
+exports.onramp = onramp;
 exports.resolveSolanaRpcUrl = resolveSolanaRpcUrl;
 exports.setAuthLoading = setAuthLoading;
 exports.setCurrentUser = setCurrentUser;
@@ -6216,4 +6355,4 @@ exports.signInAnonymously = signInAnonymously;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index.native-hu3o3zXU.js.map
+//# sourceMappingURL=index.native-D48QQ0-q.js.map