@bounded-sh/client 0.0.64 → 0.0.65

package/dist/{index-Bk0nEjB6.js → index-FkEGh6dx.js}

@@ -3817,6 +3817,63 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
     return run;
 }
 
+// turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
+// kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
+//
+// The hosted Turnkey signer refuses to sign unless the request carries an issuer-signed
+// SIGNING CAPABILITY bound to the app id, the requesting origin, and the EXACT payload
+// hash. `requestTurnkeySigningCapability` mints one for the given bytes and
+// `buildTurnkeySignRequest` assembles the signer request that carries it. The bridge
+// (turnkey-signer-bridge.ts) supplies the base url + id token and routes through both,
+// so a regression here (a dropped capability, a wrong route, a swallowed error) is
+// caught without a browser.
+// POST the Bounded id token + payload hash to the issuer's capability mint route and
+// return the issuer-signed capability for exactly these bytes. Credential-free: identity
+// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
+// would not carry). Throws with the same stable messages the bridge relied on inline.
+async function requestTurnkeySigningCapability(opts) {
+    const base = opts.baseUrl.replace(/\/$/, '');
+    let res;
+    try {
+        res = await opts.fetchImpl(`${base}/wallet/turnkey/capability`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ idToken: opts.idToken, messageHex: opts.messageHex }),
+        });
+    }
+    catch (_a) {
+        throw new Error('Could not reach the Bounded signer to authorize this signature.');
+    }
+    if (!res.ok) {
+        let error = 'signing_capability_denied';
+        try {
+            const d = (await res.json());
+            if (d && typeof d.error === 'string')
+                error = d.error;
+        }
+        catch (_b) {
+            /* keep the default marker */
+        }
+        throw new Error(`Turnkey signing was not authorized (${error}).`);
+    }
+    const d = (await res.json());
+    if (!d || typeof d.capability !== 'string' || !d.capability) {
+        throw new Error('Turnkey signing capability was malformed.');
+    }
+    return d.capability;
+}
+// Assemble the `bounded:turnkey:sign` postMessage request, carrying the issuer-signed
+// capability for the same bytes. Without the capability the hosted signer refuses
+// (capability_required), so it is a required field of every sign request.
+function buildTurnkeySignRequest(opts) {
+    return {
+        type: 'bounded:turnkey:sign',
+        requestId: opts.requestId,
+        messageHex: opts.messageHex,
+        capability: opts.capability,
+    };
+}
+
 // turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
 // through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
 //
@@ -3981,6 +4038,33 @@ async function runPopup(url, signerOrigin, ex) {
         } }, 5 * 60 * 1000);
     });
 }
+// AS-02: the hosted signer refuses to sign unless the request carries an issuer-signed
+// SIGNING CAPABILITY bound to the app id, this origin, and the EXACT bytes (a bare postMessage
+// from any peer can no longer consent-phish a signature). Fetch one from the human-auth issuer
+// for exactly these bytes before posting the sign request. Credential-free: the caller proves
+// identity with the Bounded id token WE minted (a body secret, RS256-verified server-side), not
+// an ambient cookie - the issuer's session cookie is SameSite-scoped to its own origin and is
+// not sent on this cross-origin fetch, so the token is what carries the session's wallet.
+async function fetchSigningCapability(messageHex) {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    let idToken = null;
+    try {
+        idToken = core.getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        idToken = null;
+    }
+    if (!idToken) {
+        throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+    }
+    return requestTurnkeySigningCapability({
+        baseUrl: base,
+        idToken,
+        messageHex,
+        fetchImpl: (url, init) => fetch(url, init),
+    });
+}
 function hasTurnkeyWallet() {
     return activeTurnkeyAddress() !== null;
 }
@@ -4023,8 +4107,11 @@ async function signSolanaMessageViaTurnkey(message) {
     const { url, origin } = await turnkeySignerPage();
     const requestId = `tksign_${Date.now()}_${++requestSeq}`;
     const messageHex = toHex(message);
+    // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
+    // refuse (capability_required) without it. Fetched per signature (each is single-payload).
+    const capability = await fetchSigningCapability(messageHex);
     return await deliver(url, origin, {
-        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
+        request: buildTurnkeySignRequest({ requestId, messageHex, capability }),
         onResult: (d) => {
             if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
@@ -4961,7 +5048,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-97CluDlZ.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CJVJsWXv.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4980,7 +5067,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CSj0lY9H.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-28GE3rH9.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4993,7 +5080,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-B5MA0w8I.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-D-7Eg6TS.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -5021,7 +5108,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BvIf5W5c.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-UMP8Z_bK.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -5077,7 +5164,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BvIf5W5c.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-UMP8Z_bK.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -5228,7 +5315,7 @@ async function loginWithWallet(options) {
         ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
     const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
     const network = getConfiguredSolanaNetwork(cfg);
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CSj0lY9H.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-28GE3rH9.js'); });
     let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
     if (coreConfig.chain === 'offchain')
         provider = new OffchainAuthProvider(provider);
@@ -7257,18 +7344,6 @@ async function list() {
  */
 const apps = { create, list, buildCreateRedirectUrl };
 
-async function deserializeTransaction(tx) {
-    // Literal specifier so bundlers can code-split the lazy chunk.
-    const { Transaction, VersionedTransaction } = await import('@solana/web3.js');
-    const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
-    if ((buf[0] & 0x80) !== 0) {
-        return VersionedTransaction.deserialize(buf);
-    }
-    else {
-        return Transaction.from(buf);
-    }
-}
-
 // bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
 //
 // Web-only. Opens Coinbase's hosted checkout (pay.coinbase.com) in a popup
@@ -7310,16 +7385,16 @@ async function readError(res) {
     }
 }
 function sessionBody(options, extra) {
-    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.address ? { address: options.address } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
+    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
 }
-function resolveAddress(options) {
-    var _a, _b;
+function resolveAddress() {
+    var _a;
     const user = getCurrentUser();
-    const address = (_b = (_a = options.address) !== null && _a !== void 0 ? _a : user === null || user === void 0 ? void 0 : user.address) !== null && _b !== void 0 ? _b : undefined;
+    const address = (_a = user === null || user === void 0 ? void 0 : user.address) !== null && _a !== void 0 ? _a : undefined;
     if (!address) {
         throw new Error(user
-            ? 'onramp: the signed-in account has no wallet address - pass { address } explicitly'
-            : 'onramp: no signed-in user - call login() first or pass { address }');
+            ? 'onramp: the signed-in account has no wallet address (create one via the embedded wallet flow)'
+            : 'onramp: no signed-in user - call login() first');
     }
     return address;
 }
@@ -7330,7 +7405,7 @@ function resolveAddress(options) {
 async function onrampQuote(options = {}) {
     if (!hasDOM())
         throw new Error('onrampQuote is web-only');
-    resolveAddress(options);
+    resolveAddress();
     const res = await authedFetch('/__bounded/onramp/session', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -7388,7 +7463,7 @@ async function onramp(options = {}) {
     var _a;
     if (!hasDOM())
         throw new Error('onramp() is web-only');
-    resolveAddress(options);
+    resolveAddress();
     // Open the window synchronously so the click's user-activation window is not
     // consumed by the fetch below (same hard-won pattern as loginWithPopup).
     let popup = null;
@@ -7611,84 +7686,12 @@ class PrivyExpoProvider {
         setCurrentUser(user);
         return user;
     }
-    async runTransaction(_evmTransactionData, solTransactionData, options) {
-        var _a;
-        await this.ensureReady();
-        const [{ Connection, PublicKey }, programSdk] = await Promise.all([
-            import('@solana/web3.js'),
-            import('@coral-xyz/anchor'),
-        ]);
-        if (!solTransactionData) {
-            throw new Error('Solana transaction data is required');
-        }
-        const wallet = await this.getWalletOrThrow();
-        const rpcUrl = this.getRpcUrl(solTransactionData.network);
-        const connection = new Connection(rpcUrl, 'confirmed');
-        const remainingAccounts = core.convertRemainingAccounts(solTransactionData.txArgs[0].remainingAccounts);
-        const app_id = solTransactionData.appId;
-        if (!app_id) {
-            throw new Error('App ID is required');
-        }
-        // Create a mock wallet adapter for Anchor (only publicKey needed for building TX)
-        const walletPublicKey = new PublicKey(wallet.address);
-        const walletAdapter = {
-            publicKey: walletPublicKey,
-            signTransaction: async (tx) => tx,
-            signAllTransactions: async (txs) => txs,
-        };
-        const ProviderClass = programSdk[['Anch', 'orProvider'].join('')];
-        const programProvider = new ProviderClass(connection, walletAdapter, ProviderClass.defaultOptions());
-        const finalDeduped = [];
-        for (const acc of remainingAccounts) {
-            const existing = finalDeduped.find((d) => d.pubkey.equals(acc.pubkey));
-            if (existing) {
-                existing.isSigner = existing.isSigner || acc.isSigner;
-                existing.isWritable = existing.isWritable || acc.isWritable;
-            }
-            else {
-                finalDeduped.push(acc);
-            }
-        }
-        const { tx, blockhash, lastValidBlockHeight } = await core.buildSetDocumentsTransaction(connection, solTransactionData.txArgs[0].idl, programProvider, walletPublicKey, {
-            app_id,
-            documents: solTransactionData.txArgs[0].setDocumentData,
-            delete_paths: solTransactionData.txArgs[0].deletePaths,
-            txData: solTransactionData.txArgs[0].txData,
-        }, finalDeduped, solTransactionData.lutKey, solTransactionData.preInstructions, false, solTransactionData.additionalLutAddresses);
-        // Set blockhash
-        const isLegacyTx = 'recentBlockhash' in tx &&
-            !('message' in tx && 'staticAccountKeys' in tx.message);
-        if (isLegacyTx) {
-            tx.recentBlockhash = blockhash;
-            tx.lastValidBlockHeight = lastValidBlockHeight;
-        }
-        else {
-            tx.message.recentBlockhash = blockhash;
-        }
-        try {
-            if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
-                // Sign only — don't submit
-                const signed = await wallet.signTransaction(tx);
-                return {
-                    signedTransaction: signed.signedTransaction,
-                    blockNumber: 0,
-                    gasUsed: '0',
-                    data: '',
-                };
-            }
-            // Sign and submit
-            const { signature, txInfo } = await this.signAndSubmitInternal(tx, wallet, connection);
-            return {
-                transactionSignature: signature,
-                blockNumber: (txInfo === null || txInfo === void 0 ? void 0 : txInfo.slot) || 0,
-                gasUsed: ((_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _a === void 0 ? void 0 : _a.fee.toString()) || '0',
-                data: txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta,
-            };
-        }
-        catch (err) {
-            console.error(err);
-            throw err;
-        }
+    async runTransaction(_evmTransactionData, _solTransactionData, _options) {
+        // Client-side Solana transaction building is retired: the realtime
+        // worker returns a fully-built (and, when sponsored, partially-signed)
+        // transaction on its 202, which the SDK validates and signs via
+        // signTransaction. This provider serves no EVM payload either.
+        throw new Error('runTransaction is not supported by this provider; Bounded returns pre-built Solana transactions that are signed with signTransaction.');
     }
     async signMessage(message) {
         await this.ensureReady();
@@ -7950,7 +7953,6 @@ exports.completeLoginInPopup = completeLoginInPopup;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
 exports.defaultInjectedEvmProvider = defaultInjectedEvmProvider;
 exports.defaultInjectedProvider = defaultInjectedProvider;
-exports.deserializeTransaction = deserializeTransaction;
 exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
@@ -7986,4 +7988,4 @@ exports.startTurnkeyEmailLogin = startTurnkeyEmailLogin;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index-Bk0nEjB6.js.map
+//# sourceMappingURL=index-FkEGh6dx.js.map