@bounded-sh/client 0.0.64 → 0.0.65

package/dist/{index.native-CWcQMPZd.mjs → index.native-wyaknPBR.mjs}

@@ -1,4 +1,4 @@
-import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, onSessionCleared, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, onSessionCleared, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 /**
@@ -3719,6 +3719,63 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
     return run;
 }
 
+// turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
+// kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
+//
+// The hosted Turnkey signer refuses to sign unless the request carries an issuer-signed
+// SIGNING CAPABILITY bound to the app id, the requesting origin, and the EXACT payload
+// hash. `requestTurnkeySigningCapability` mints one for the given bytes and
+// `buildTurnkeySignRequest` assembles the signer request that carries it. The bridge
+// (turnkey-signer-bridge.ts) supplies the base url + id token and routes through both,
+// so a regression here (a dropped capability, a wrong route, a swallowed error) is
+// caught without a browser.
+// POST the Bounded id token + payload hash to the issuer's capability mint route and
+// return the issuer-signed capability for exactly these bytes. Credential-free: identity
+// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
+// would not carry). Throws with the same stable messages the bridge relied on inline.
+async function requestTurnkeySigningCapability(opts) {
+    const base = opts.baseUrl.replace(/\/$/, '');
+    let res;
+    try {
+        res = await opts.fetchImpl(`${base}/wallet/turnkey/capability`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ idToken: opts.idToken, messageHex: opts.messageHex }),
+        });
+    }
+    catch (_a) {
+        throw new Error('Could not reach the Bounded signer to authorize this signature.');
+    }
+    if (!res.ok) {
+        let error = 'signing_capability_denied';
+        try {
+            const d = (await res.json());
+            if (d && typeof d.error === 'string')
+                error = d.error;
+        }
+        catch (_b) {
+            /* keep the default marker */
+        }
+        throw new Error(`Turnkey signing was not authorized (${error}).`);
+    }
+    const d = (await res.json());
+    if (!d || typeof d.capability !== 'string' || !d.capability) {
+        throw new Error('Turnkey signing capability was malformed.');
+    }
+    return d.capability;
+}
+// Assemble the `bounded:turnkey:sign` postMessage request, carrying the issuer-signed
+// capability for the same bytes. Without the capability the hosted signer refuses
+// (capability_required), so it is a required field of every sign request.
+function buildTurnkeySignRequest(opts) {
+    return {
+        type: 'bounded:turnkey:sign',
+        requestId: opts.requestId,
+        messageHex: opts.messageHex,
+        capability: opts.capability,
+    };
+}
+
 // turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
 // through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
 //
@@ -3883,6 +3940,33 @@ async function runPopup(url, signerOrigin, ex) {
         } }, 5 * 60 * 1000);
     });
 }
+// AS-02: the hosted signer refuses to sign unless the request carries an issuer-signed
+// SIGNING CAPABILITY bound to the app id, this origin, and the EXACT bytes (a bare postMessage
+// from any peer can no longer consent-phish a signature). Fetch one from the human-auth issuer
+// for exactly these bytes before posting the sign request. Credential-free: the caller proves
+// identity with the Bounded id token WE minted (a body secret, RS256-verified server-side), not
+// an ambient cookie - the issuer's session cookie is SameSite-scoped to its own origin and is
+// not sent on this cross-origin fetch, so the token is what carries the session's wallet.
+async function fetchSigningCapability(messageHex) {
+    const cfg = await getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    let idToken = null;
+    try {
+        idToken = getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        idToken = null;
+    }
+    if (!idToken) {
+        throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+    }
+    return requestTurnkeySigningCapability({
+        baseUrl: base,
+        idToken,
+        messageHex,
+        fetchImpl: (url, init) => fetch(url, init),
+    });
+}
 function hasTurnkeyWallet() {
     return activeTurnkeyAddress() !== null;
 }
@@ -3903,8 +3987,11 @@ async function signSolanaMessageViaTurnkey(message) {
     const { url, origin } = await turnkeySignerPage();
     const requestId = `tksign_${Date.now()}_${++requestSeq}`;
     const messageHex = toHex(message);
+    // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
+    // refuse (capability_required) without it. Fetched per signature (each is single-payload).
+    const capability = await fetchSigningCapability(messageHex);
     return await deliver(url, origin, {
-        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
+        request: buildTurnkeySignRequest({ requestId, messageHex, capability }),
         onResult: (d) => {
             if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
@@ -4773,7 +4860,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-h0fPnU76.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-wqNimboO.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4792,7 +4879,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dd7ij6bc.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-5NeXEzui.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4805,7 +4892,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-xvZq9Zli.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-B8x7dNuL.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4833,7 +4920,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-Dmup2WIL.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-C3EGlSSp.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4889,7 +4976,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-Dmup2WIL.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-C3EGlSSp.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -6127,18 +6214,6 @@ async function list() {
  */
 const apps = { create, list, buildCreateRedirectUrl };
 
-async function deserializeTransaction(tx) {
-    // Literal specifier so bundlers can code-split the lazy chunk.
-    const { Transaction, VersionedTransaction } = await import('@solana/web3.js');
-    const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
-    if ((buf[0] & 0x80) !== 0) {
-        return VersionedTransaction.deserialize(buf);
-    }
-    else {
-        return Transaction.from(buf);
-    }
-}
-
 // bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
 //
 // Web-only. Opens Coinbase's hosted checkout (pay.coinbase.com) in a popup
@@ -6180,16 +6255,16 @@ async function readError(res) {
     }
 }
 function sessionBody(options, extra) {
-    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.address ? { address: options.address } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
+    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
 }
-function resolveAddress(options) {
-    var _a, _b;
+function resolveAddress() {
+    var _a;
     const user = getCurrentUser();
-    const address = (_b = (_a = options.address) !== null && _a !== void 0 ? _a : user === null || user === void 0 ? void 0 : user.address) !== null && _b !== void 0 ? _b : undefined;
+    const address = (_a = user === null || user === void 0 ? void 0 : user.address) !== null && _a !== void 0 ? _a : undefined;
     if (!address) {
         throw new Error(user
-            ? 'onramp: the signed-in account has no wallet address - pass { address } explicitly'
-            : 'onramp: no signed-in user - call login() first or pass { address }');
+            ? 'onramp: the signed-in account has no wallet address (create one via the embedded wallet flow)'
+            : 'onramp: no signed-in user - call login() first');
     }
     return address;
 }
@@ -6200,7 +6275,7 @@ function resolveAddress(options) {
 async function onrampQuote(options = {}) {
     if (!hasDOM())
         throw new Error('onrampQuote is web-only');
-    resolveAddress(options);
+    resolveAddress();
     const res = await authedFetch('/__bounded/onramp/session', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -6258,7 +6333,7 @@ async function onramp(options = {}) {
     var _a;
     if (!hasDOM())
         throw new Error('onramp() is web-only');
-    resolveAddress(options);
+    resolveAddress();
     // Open the window synchronously so the click's user-activation window is not
     // consumed by the fetch below (same hard-won pattern as loginWithPopup).
     let popup = null;
@@ -6481,84 +6556,12 @@ class PrivyExpoProvider {
         setCurrentUser(user);
         return user;
     }
-    async runTransaction(_evmTransactionData, solTransactionData, options) {
-        var _a;
-        await this.ensureReady();
-        const [{ Connection, PublicKey }, programSdk] = await Promise.all([
-            import('@solana/web3.js'),
-            import('@coral-xyz/anchor'),
-        ]);
-        if (!solTransactionData) {
-            throw new Error('Solana transaction data is required');
-        }
-        const wallet = await this.getWalletOrThrow();
-        const rpcUrl = this.getRpcUrl(solTransactionData.network);
-        const connection = new Connection(rpcUrl, 'confirmed');
-        const remainingAccounts = convertRemainingAccounts(solTransactionData.txArgs[0].remainingAccounts);
-        const app_id = solTransactionData.appId;
-        if (!app_id) {
-            throw new Error('App ID is required');
-        }
-        // Create a mock wallet adapter for Anchor (only publicKey needed for building TX)
-        const walletPublicKey = new PublicKey(wallet.address);
-        const walletAdapter = {
-            publicKey: walletPublicKey,
-            signTransaction: async (tx) => tx,
-            signAllTransactions: async (txs) => txs,
-        };
-        const ProviderClass = programSdk[['Anch', 'orProvider'].join('')];
-        const programProvider = new ProviderClass(connection, walletAdapter, ProviderClass.defaultOptions());
-        const finalDeduped = [];
-        for (const acc of remainingAccounts) {
-            const existing = finalDeduped.find((d) => d.pubkey.equals(acc.pubkey));
-            if (existing) {
-                existing.isSigner = existing.isSigner || acc.isSigner;
-                existing.isWritable = existing.isWritable || acc.isWritable;
-            }
-            else {
-                finalDeduped.push(acc);
-            }
-        }
-        const { tx, blockhash, lastValidBlockHeight } = await buildSetDocumentsTransaction(connection, solTransactionData.txArgs[0].idl, programProvider, walletPublicKey, {
-            app_id,
-            documents: solTransactionData.txArgs[0].setDocumentData,
-            delete_paths: solTransactionData.txArgs[0].deletePaths,
-            txData: solTransactionData.txArgs[0].txData,
-        }, finalDeduped, solTransactionData.lutKey, solTransactionData.preInstructions, false, solTransactionData.additionalLutAddresses);
-        // Set blockhash
-        const isLegacyTx = 'recentBlockhash' in tx &&
-            !('message' in tx && 'staticAccountKeys' in tx.message);
-        if (isLegacyTx) {
-            tx.recentBlockhash = blockhash;
-            tx.lastValidBlockHeight = lastValidBlockHeight;
-        }
-        else {
-            tx.message.recentBlockhash = blockhash;
-        }
-        try {
-            if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
-                // Sign only — don't submit
-                const signed = await wallet.signTransaction(tx);
-                return {
-                    signedTransaction: signed.signedTransaction,
-                    blockNumber: 0,
-                    gasUsed: '0',
-                    data: '',
-                };
-            }
-            // Sign and submit
-            const { signature, txInfo } = await this.signAndSubmitInternal(tx, wallet, connection);
-            return {
-                transactionSignature: signature,
-                blockNumber: (txInfo === null || txInfo === void 0 ? void 0 : txInfo.slot) || 0,
-                gasUsed: ((_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _a === void 0 ? void 0 : _a.fee.toString()) || '0',
-                data: txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta,
-            };
-        }
-        catch (err) {
-            console.error(err);
-            throw err;
-        }
+    async runTransaction(_evmTransactionData, _solTransactionData, _options) {
+        // Client-side Solana transaction building is retired: the realtime
+        // worker returns a fully-built (and, when sponsored, partially-signed)
+        // transaction on its 202, which the SDK validates and signs via
+        // signTransaction. This provider serves no EVM payload either.
+        throw new Error('runTransaction is not supported by this provider; Bounded returns pre-built Solana transactions that are signed with signTransaction.');
     }
     async signMessage(message) {
         await this.ensureReady();
@@ -6715,5 +6718,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { useAuth as A, useQuery as B, useBuildRun as C, apps as D, deserializeTransaction as E, getIdToken as F, onramp as G, onrampQuote as H, onrampStatus as I, setPlatform as J, builds as K, BuildsApiError as L, PARK_REASONS as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, FAILURE_REASONS as Q, RUN_STATES as R, BUILD_REVIEW_CAPABILITY_SCHEMA as S, TERMINAL_STATES as T, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as U, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as V, signMessageWithTurnkey as a, signTransactionWithTurnkey as b, signAndSubmitTransactionWithTurnkey as c, setAuthLoading as d, bufferExports as e, bs58 as f, getPlatform as g, hasTurnkeyWallet as h, confirmAndCheckTransaction as i, init as j, getCurrentUser as k, onAuthLoadingChanged as l, getAuthLoading as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, login as p, logout as q, resolveSolanaRpcUrl as r, setCurrentUser as s, getAuthProvider as t, signInAnonymously as u, loginWithPrivy as v, loginWithRedirect as w, completeLoginFromRedirect as x, loginWithPopup as y, completeLoginInPopup as z };
-//# sourceMappingURL=index.native-CWcQMPZd.mjs.map
+export { useAuth as A, useQuery as B, useBuildRun as C, apps as D, getIdToken as E, onramp as F, onrampQuote as G, onrampStatus as H, setPlatform as I, builds as J, BuildsApiError as K, PARK_REASONS as L, FAILURE_REASONS as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, BUILD_REVIEW_CAPABILITY_SCHEMA as Q, RUN_STATES as R, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as S, TERMINAL_STATES as T, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as U, signMessageWithTurnkey as a, signTransactionWithTurnkey as b, signAndSubmitTransactionWithTurnkey as c, setAuthLoading as d, bufferExports as e, bs58 as f, getPlatform as g, hasTurnkeyWallet as h, confirmAndCheckTransaction as i, init as j, getCurrentUser as k, onAuthLoadingChanged as l, getAuthLoading as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, login as p, logout as q, resolveSolanaRpcUrl as r, setCurrentUser as s, getAuthProvider as t, signInAnonymously as u, loginWithPrivy as v, loginWithRedirect as w, completeLoginFromRedirect as x, loginWithPopup as y, completeLoginInPopup as z };
+//# sourceMappingURL=index.native-wyaknPBR.mjs.map