@bounded-sh/client 0.0.58 → 0.0.59

package/dist/{index-MKE9tHpl.js → index-uu8hKP-p.js}

@@ -3475,7 +3475,7 @@ const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets —
 const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
     'the app policy so email logins get a non-custodial wallet (@user.address), ' +
     'then sign from a user gesture.';
-function hasDOM$4() {
+function hasDOM$5() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt$1(token) {
@@ -3535,7 +3535,7 @@ let requestSeq$1 = 0;
  * wallet's owner, and validates that the wallet address matches the account.
  */
 async function signViaSignerPopup(action) {
-    if (!hasDOM$4()) {
+    if (!hasDOM$5()) {
         throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
     }
     const isEvm = action.kind === 'evmTransaction';
@@ -3711,7 +3711,7 @@ const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = core.getActiveSessionManager;
-function hasDOM$3() {
+function hasDOM$4() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -3742,7 +3742,7 @@ const oidcProviderSingleton = {
         const idToken = sessionManager().getIdToken();
         return idToken ? userFromIdToken(idToken) : null;
     },
-    async logout() { sessionManager().clearSession(); },
+    async logout() { await sessionManager().clearSession(); },
     async signMessage(_message) {
         throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
     },
@@ -3851,7 +3851,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM$3() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$4() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3959,7 +3959,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3975,7 +3975,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4021,7 +4021,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4161,7 +4161,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$3() || !window.opener)
+    if (!hasDOM$4() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4390,15 +4390,20 @@ function authProviderConfigKey(config) {
  * so both web (WebSessionManager) and RN (ReactNativeSessionManager) sessions
  * are properly cleared.
  */
-function clearIncompatibleSession() {
+async function clearIncompatibleSession() {
     if (getStoredAuthMethod() === currentAuthMethod) {
         return false;
     }
     // Clear both managers: on web the RN manager is a no-op (not configured),
     // and on RN the web manager is a no-op (no localStorage).
-    core.WebSessionManager.clearSession();
+    //
+    // AWAITED. Session removal is serialized through a cross-tab lock now, so a
+    // fire-and-forget call would let init() reach setCurrentUser while the old
+    // credential was still readable — and a request issued in that gap would
+    // authenticate as the session we are in the middle of discarding.
+    await core.WebSessionManager.clearSession();
     try {
-        core.ReactNativeSessionManager.clearSession();
+        await core.ReactNativeSessionManager.clearSession();
     }
     catch ( /* not configured on web */_a) { /* not configured on web */ }
     setStoredAuthMethod(null);
@@ -4531,7 +4536,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BHtR1H_E.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-N-dfsNnE.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4550,7 +4555,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BUvN5Y6_.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CVeZgfEt.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4563,7 +4568,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-BOPzdm7E.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CItxws1D.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4591,7 +4596,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BPXDJoEQ.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BFodq9Rc.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4647,7 +4652,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BPXDJoEQ.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BFodq9Rc.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4689,7 +4694,7 @@ async function signInAnonymously() {
             }
             catch (_b) {
                 try {
-                    core.getActiveSessionManager().clearSession();
+                    await core.getActiveSessionManager().clearSession();
                 }
                 catch ( /* fail closed below */_c) { /* fail closed below */ }
             }
@@ -4798,7 +4803,7 @@ async function loginWithWallet(options) {
         ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
     const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
     const network = getConfiguredSolanaNetwork(cfg);
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BUvN5Y6_.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CVeZgfEt.js'); });
     let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
     if (coreConfig.chain === 'offchain')
         provider = new OffchainAuthProvider(provider);
@@ -4972,6 +4977,22 @@ var index = /*#__PURE__*/Object.freeze({
     signInAnonymously: signInAnonymously
 });
 
+/**
+ * Subscribed once per process, not per init(): re-registering on every init would
+ * stack duplicate handlers on repeated initialization.
+ */
+let sessionClearedBridgeRegistered = false;
+function registerSessionClearedBridge() {
+    if (sessionClearedBridgeRegistered)
+        return;
+    sessionClearedBridgeRegistered = true;
+    core.onSessionCleared(() => {
+        // Core fires this only when storage was ACTUALLY cleared, never on a
+        // transient refresh failure that preserved the session — so this cannot
+        // sign anyone out over a network blip.
+        setCurrentUser(null);
+    });
+}
 /**
  * Read the active session's idToken synchronously from whichever store is live
  * for this runtime (WebSessionManager on web, ReactNativeSessionManager on RN —
@@ -5029,6 +5050,15 @@ async function init(newConfig) {
     // setting it here makes "no flash" the SDK's default behavior for every consumer.
     setAuthLoading(true);
     try {
+        // Bridge core's "the stored session is gone" signal into SDK auth state.
+        //
+        // Core cannot import this package, and a session can die deep inside a
+        // session manager (dead refresh token, rejected refresh, app-id mismatch).
+        // Before this, setCurrentUser(null) was only ever called by logout() and
+        // init(), so storage could be wiped while `currentUser` stayed populated —
+        // onAuthStateChanged never fired, and every consumer UI went on showing a
+        // connected wallet for a session the server no longer knew about.
+        registerSessionClearedBridge();
         // Get auth provider first
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
@@ -5045,7 +5075,12 @@ async function init(newConfig) {
         let user = await authProviderInstance.restoreSession();
         // If a session exists but was created before auth method tracking (legacy session),
         // clear it to avoid mismatches when the app switches auth methods (e.g. email → phantom)
-        if (user && clearIncompatibleSession()) {
+        //
+        // AWAITED: the clear is serialized through a cross-tab lock now, and an
+        // unawaited call would return a Promise (always truthy) — nulling the user
+        // unconditionally AND letting setCurrentUser run while the old credential
+        // was still in storage.
+        if (user && await clearIncompatibleSession()) {
             user = null;
         }
         setCurrentUser(user);
@@ -5163,7 +5198,7 @@ function setAuthProviderInstance(provider) {
 // The modal is a warm singleton: it stays mounted (hidden) between uses so a
 // second open - or a signature right after login - is instant and, when it is
 // already open, a clean in-place view swap rather than a reopen.
-function hasDOM$2() {
+function hasDOM$3() {
     return typeof window !== "undefined" && typeof document !== "undefined";
 }
 const OVERLAY_CSS = `
@@ -5385,7 +5420,7 @@ function detachIframe(m) {
 // no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
 const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
 function ensureFonts() {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         return;
     if (document.querySelector('link[data-bounded-fonts="1"]'))
         return;
@@ -5691,7 +5726,7 @@ function discoverStandardWallets() {
     return out;
 }
 
-function hasDOM$1() {
+function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 async function signerOrigin() {
@@ -5768,7 +5803,7 @@ function sealOtpInIframe(code, otpEncryptionTargetBundle) {
  * step needs the signer iframe); on React Native use loginWithRedirect() instead.
  */
 async function startTurnkeyEmailLogin(email) {
-    if (!hasDOM$1()) {
+    if (!hasDOM$2()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
     const trimmed = email.trim();
@@ -5957,7 +5992,7 @@ function el(tag, cls, text) {
  */
 async function openBoundedWidget(opts = {}) {
     var _a, _b, _c, _d, _e, _f, _g, _h;
-    if (!hasDOM$2()) {
+    if (!hasDOM$3()) {
         throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
     }
     // Imported lazily to avoid a static cycle with the auth index barrel.
@@ -7064,7 +7099,7 @@ async function deserializeTransaction(tx) {
  * (Safari cross-origin create) or cannot be mounted.
  */
 async function runWidget(url, signerOrigin, ex, popupFallback) {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         return popupFallback();
     const m = getModal();
     const requestId = String(ex.request.requestId);
@@ -7173,7 +7208,7 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
 // ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
 // Bounded apps (any subdomain / custom domain) sign through this one origin - giving
 // every user one wallet + one passkey that roams across every app.
-function hasDOM() {
+function hasDOM$1() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 // Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
@@ -7182,7 +7217,7 @@ function hasDOM() {
 // There we pick the popup up front, from the original click, so enrollment is solid.
 // Everywhere else the inline widget is used (buttery in-app modal).
 function preferPopup() {
-    if (!hasDOM() || typeof navigator === 'undefined')
+    if (!hasDOM$1() || typeof navigator === 'undefined')
         return true;
     const ua = navigator.userAgent || '';
     return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
@@ -7299,7 +7334,7 @@ async function runPopup(url, signerOrigin, ex) {
  * Use this to learn the fee-payer address BEFORE building a transaction to sign.
  */
 async function getOrCreateTurnkeyWallet() {
-    if (!hasDOM())
+    if (!hasDOM$1())
         throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
     const { url, origin } = await turnkeySignerPage();
     const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
@@ -7323,7 +7358,7 @@ async function getOrCreateTurnkeyWallet() {
  * signatures are just a passkey approval.
  */
 async function signSolanaMessageViaTurnkey(message) {
-    if (!hasDOM()) {
+    if (!hasDOM$1()) {
         throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
     }
     const { url, origin } = await turnkeySignerPage();
@@ -7340,6 +7375,109 @@ async function signSolanaMessageViaTurnkey(message) {
     });
 }
 
+// bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
+//
+// Web-only. Opens Coinbase's hosted checkout (pay.coinbase.com) in a popup
+// (new-tab fallback) using a single-use session token minted by the Bounded
+// platform at POST <origin>/__bounded/onramp/session on the app's own origin.
+// The platform holds the Coinbase credential; the app never sees it. The
+// session is bound server-side to the caller's verified Bounded JWT, and the
+// destination defaults to that user's embedded wallet.
+//
+// Works on Bounded-served origins (<app>.bounded.page / custom domains). On a
+// local dev origin the session endpoint does not exist; we fail with a clear
+// error rather than guessing a host.
+function hasDOM() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+/**
+ * Open Coinbase Onramp for the signed-in user. Resolves when the popup closes.
+ * Call from a click handler - popup blockers require user activation.
+ */
+async function onramp(options = {}) {
+    var _a, _b, _c;
+    if (!hasDOM())
+        throw new Error('onramp() is web-only');
+    const user = getCurrentUser();
+    const address = (_b = (_a = options.address) !== null && _a !== void 0 ? _a : user === null || user === void 0 ? void 0 : user.address) !== null && _b !== void 0 ? _b : undefined;
+    if (!address) {
+        throw new Error(user
+            ? 'onramp(): the signed-in account has no wallet address - pass { address } explicitly'
+            : 'onramp(): no signed-in user - call login() first or pass { address }');
+    }
+    const idToken = await getIdToken();
+    if (!idToken)
+        throw new Error('onramp(): no active session - call login() first');
+    // Open the window synchronously so the click's user-activation window is not
+    // consumed by the fetch below (same hard-won pattern as loginWithPopup).
+    let popup = null;
+    if (!options.newTab) {
+        const w = options.width || 460;
+        const h = options.height || 720;
+        const left = window.screenX + (window.outerWidth - w) / 2;
+        const top = window.screenY + (window.outerHeight - h) / 2;
+        popup = window.open('', 'bounded-onramp', `width=${w},height=${h},left=${left},top=${top}`);
+    }
+    let session;
+    try {
+        const res = await fetch(`${window.location.origin}/__bounded/onramp/session`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${idToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.address ? { address: options.address } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {}))),
+        });
+        if (!res.ok) {
+            let detail = '';
+            try {
+                detail = (_c = (await res.json()).error) !== null && _c !== void 0 ? _c : '';
+            }
+            catch ( /* keep status only */_d) { /* keep status only */ }
+            if (res.status === 404) {
+                throw new Error('onramp(): session endpoint not found - onramp works on Bounded-served origins (your deployed app URL), not local dev servers');
+            }
+            throw new Error(`onramp(): session mint failed (${res.status}${detail ? `: ${detail}` : ''})`);
+        }
+        session = (await res.json());
+    }
+    catch (error) {
+        try {
+            popup === null || popup === void 0 ? void 0 : popup.close();
+        }
+        catch ( /* ignore */_e) { /* ignore */ }
+        throw error;
+    }
+    if (popup) {
+        try {
+            popup.location.replace(session.url);
+        }
+        catch (_f) {
+            try {
+                popup.location.href = session.url;
+            }
+            catch (_g) {
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_h) { /* ignore */ }
+                throw new Error('onramp(): popup failed to navigate - retry with { newTab: true }');
+            }
+        }
+        return await new Promise((resolve) => {
+            const timer = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(timer);
+                    resolve({ status: 'closed', address: session.address, asset: session.asset });
+                }
+            }, 500);
+        });
+    }
+    // New-tab path (popup was blocked or explicitly requested): cross-origin tab
+    // close is not observable, so resolve immediately.
+    const tab = window.open(session.url, '_blank');
+    if (!tab)
+        throw new Error('onramp(): window.open was blocked - call onramp() from a click handler');
+    return { status: 'opened', address: session.address, asset: session.asset };
+}
+
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */
@@ -7469,7 +7607,7 @@ class PrivyExpoProvider {
                 return { provider: this, address: session.address };
             }
             // Stale session — clear and continue to fresh login flow
-            core.getActiveSessionManager().clearSession();
+            await core.getActiveSessionManager().clearSession();
         }
         // Trigger Privy login
         const privyUser = await this.privyMethods.login();
@@ -7650,7 +7788,7 @@ class PrivyExpoProvider {
         if ((_a = this.privyMethods) === null || _a === void 0 ? void 0 : _a.isAuthenticated) {
             await this.privyMethods.logout();
         }
-        core.getActiveSessionManager().clearSession();
+        await core.getActiveSessionManager().clearSession();
     }
     async getNativeMethods() {
         return this.privyMethods;
@@ -7850,6 +7988,7 @@ exports.logout = logout;
 exports.normalizeSolanaRpcUrl = normalizeSolanaRpcUrl;
 exports.onAuthLoadingChanged = onAuthLoadingChanged;
 exports.onAuthStateChanged = onAuthStateChanged;
+exports.onramp = onramp;
 exports.openBoundedWidget = openBoundedWidget;
 exports.requestEip6963Providers = requestEip6963Providers;
 exports.resolveSolanaRpcUrl = resolveSolanaRpcUrl;
@@ -7862,4 +8001,4 @@ exports.startTurnkeyEmailLogin = startTurnkeyEmailLogin;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index-MKE9tHpl.js.map
+//# sourceMappingURL=index-uu8hKP-p.js.map