@bounded-sh/client 0.0.96 → 0.0.97

package/dist/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var index = require('./index-DWUx-v0z.js');
+var index = require('./index-Bb7I-AoO.js');
 var core = require('@bounded-sh/core');
 require('react');
 

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { ab as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, aa as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, a9 as BUILD_REVIEW_CAPABILITY_SCHEMA, a3 as BuildsApiError, a8 as FAILURE_REASONS, a4 as NON_TERMINAL_STATES, $ as OffchainAuthProvider, a7 as PARK_REASONS, a0 as PrivyExpoProvider, a6 as RUN_STATES, a5 as TERMINAL_STATES, W as WalletConfigError, Q as apps, a2 as builds, I as completeLoginFromRedirect, K as completeLoginInPopup, o as defaultInjectedEvmProvider, f as defaultInjectedProvider, F as ensureSharedWalletLoginReady, M as ensureSignedIn, E as ensureWalletLoginReady, w as getAuthLoading, A as getAuthProvider, q as getCurrentUser, V as getIdToken, S as getOrCreateTurnkeyWallet, g as getPlatform, p as init, y as login, J as loginWithPopup, C as loginWithPrivy, H as loginWithRedirect, D as loginWithWallet, z as logout, v as onAuthLoadingChanged, u as onAuthStateChanged, X as onramp, Y as onrampQuote, Z as onrampStatus, L as openBoundedWidget, T as openTurnkeyKeyExport, G as preloadWalletLogin, a1 as requestEip6963Providers, _ as setPlatform, B as signInAnonymously, R as signSolanaMessageViaTurnkey, U as startTurnkeyEmailLogin, N as useAuth, P as useBuildRun, O as useQuery, x as waitForAuthReady } from './index-B5Luqobz.mjs';
+export { ab as BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA, aa as BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA, a9 as BUILD_REVIEW_CAPABILITY_SCHEMA, a3 as BuildsApiError, a8 as FAILURE_REASONS, a4 as NON_TERMINAL_STATES, $ as OffchainAuthProvider, a7 as PARK_REASONS, a0 as PrivyExpoProvider, a6 as RUN_STATES, a5 as TERMINAL_STATES, W as WalletConfigError, Q as apps, a2 as builds, I as completeLoginFromRedirect, K as completeLoginInPopup, o as defaultInjectedEvmProvider, f as defaultInjectedProvider, F as ensureSharedWalletLoginReady, M as ensureSignedIn, E as ensureWalletLoginReady, w as getAuthLoading, A as getAuthProvider, q as getCurrentUser, V as getIdToken, S as getOrCreateTurnkeyWallet, g as getPlatform, p as init, y as login, J as loginWithPopup, C as loginWithPrivy, H as loginWithRedirect, D as loginWithWallet, z as logout, v as onAuthLoadingChanged, u as onAuthStateChanged, X as onramp, Y as onrampQuote, Z as onrampStatus, L as openBoundedWidget, T as openTurnkeyKeyExport, G as preloadWalletLogin, a1 as requestEip6963Providers, _ as setPlatform, B as signInAnonymously, R as signSolanaMessageViaTurnkey, U as startTurnkeyEmailLogin, N as useAuth, P as useBuildRun, O as useQuery, x as waitForAuthReady } from './index-C01Q7k1A.mjs';
 export * from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, RATE_LIMIT_EVENT_NAME, ScopedClientReadOnlyError, aggregate, count, createClient, deriveDecline, dispatchDeclineEvent, dispatchRateLimitEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, reconcileSetResult, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe, waitForSetResult } from '@bounded-sh/core';
 import 'react';

package/dist/{index.native-DVMCCbwq.js → index.native-BZOWS_sR.js}

@@ -4188,322 +4188,6 @@ async function ensureSolanaMobileWalletRegistered(config, network) {
 
 var bufferExports = requireBuffer();
 
-// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
-// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
-// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
-// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
-//
-// It hosts EITHER:
-//   - NATIVE content (the login card the SDK renders itself), or
-//   - an IFRAME (the Bounded-owned signer page, which must run on the single
-//     signer origin because the wallet's 24h signing session lives in that
-//     origin's storage, out of every app's reach).
-//
-// The modal is a warm singleton: it stays mounted (hidden) between uses so a
-// second open - or a signature right after login - is instant and, when it is
-// already open, a clean in-place view swap rather than a reopen.
-function hasDOM$4() {
-    return typeof window !== "undefined" && typeof document !== "undefined";
-}
-const OVERLAY_CSS = `
-:host{all:initial}
-*{box-sizing:border-box}
-.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
-.bw-ov.mounted{display:block}
-.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
-  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
-.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
-.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
-  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
-  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
-  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
-  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
-    height .3s cubic-bezier(.2,.8,.2,1)}
-.bw-ov.show .bw-back{opacity:1}
-.bw-ov.show .bw-panel{opacity:1;transform:none}
-.bw-ov.closing .bw-back{opacity:0}
-.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
-.bw-content{position:absolute;inset:0;overflow:hidden}
-.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
-/* editorial corner crop-marks, matching the reference frame */
-.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
-  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
-.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
-.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
-.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
-.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
-@media(max-width:560px){
-  .bw-wrap{align-items:flex-end;padding:0}
-  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
-  .bw-content{overflow-y:auto}
-  .bw-ov.show .bw-panel{transform:none}
-  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
-}
-@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
-`;
-let modal = null;
-function getModal() {
-    if (modal)
-        return modal;
-    const root = document.createElement("div");
-    root.setAttribute("data-bounded-widget", "");
-    const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
-    const overlay = document.createElement("div");
-    overlay.className = "bw-ov";
-    const back = document.createElement("div");
-    back.className = "bw-back";
-    const wrap = document.createElement("div");
-    wrap.className = "bw-wrap";
-    const panel = document.createElement("div");
-    panel.className = "bw-panel";
-    const content = document.createElement("div");
-    content.className = "bw-content";
-    panel.appendChild(content);
-    for (const corner of ["tl", "tr", "bl", "br"]) {
-        const mk = document.createElement("span");
-        mk.className = "bw-mk " + corner;
-        panel.appendChild(mk);
-    }
-    wrap.appendChild(panel);
-    overlay.appendChild(back);
-    overlay.appendChild(wrap);
-    shadow.appendChild(overlay);
-    (document.body || document.documentElement).appendChild(root);
-    const m = {
-        root,
-        overlay,
-        panel,
-        content,
-        iframe: null,
-        iframeOrigin: "",
-        iframeReady: false,
-        onBackdrop: null,
-        onIframeMessage: null,
-        chain: Promise.resolve(),
-        fitObserver: null,
-        generation: 0,
-        onSupersede: null,
-    };
-    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
-    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
-    // outside the panel. Fire only when the click lands on the wrap itself, never
-    // when it bubbles up from the panel or its content.
-    wrap.addEventListener("click", (event) => {
-        if (event.target === wrap && m.onBackdrop)
-            m.onBackdrop();
-    });
-    window.addEventListener("message", (event) => {
-        if (!m.iframe)
-            return;
-        if (event.origin !== m.iframeOrigin)
-            return;
-        if (event.source !== m.iframe.contentWindow)
-            return;
-        const d = event.data;
-        if (!d || typeof d !== "object")
-            return;
-        if (m.onIframeMessage)
-            m.onIframeMessage(d);
-    });
-    modal = m;
-    return m;
-}
-function showModal(m) {
-    m.overlay.classList.remove("closing");
-    m.overlay.classList.add("mounted");
-    // Force a reflow so the .show transition runs from the hidden state every open.
-    void m.panel.offsetWidth;
-    m.overlay.classList.add("show");
-}
-function hideModal(m, after) {
-    m.overlay.classList.remove("show");
-    m.overlay.classList.add("closing");
-    // Capture the generation at hide time. If a newer open re-shows the modal within
-    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the
-    // freshly reopened widget - only tear down when we are still the same open.
-    const gen = m.generation;
-    window.setTimeout(() => {
-        if (m.generation === gen)
-            m.overlay.classList.remove("mounted", "closing");
-    }, 260);
-}
-function setPanelHeight(m, px) {
-    const h = Math.max(140, Math.min(680, Math.round(px)));
-    m.panel.style.height = h + "px";
-}
-/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
-function ensureIframe(m, url, origin) {
-    var _a;
-    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
-        return m.iframe;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.style.display = "none";
-    const iframe = document.createElement("iframe");
-    iframe.className = "bw-frame";
-    iframe.setAttribute("title", "Bounded");
-    iframe.setAttribute("allow", "clipboard-write");
-    iframe.src = url;
-    m.iframeOrigin = origin;
-    m.iframeReady = false;
-    m.panel.appendChild(iframe);
-    m.iframe = iframe;
-    return iframe;
-}
-/**
- * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
- * whether there was one. Logout needs this: a signing session can live in that document's
- * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
- * throwaway iframe opened by the sweep can only ever clear the shared store, never another
- * document's memory. Removing the iframe discards its browsing context, which takes the
- * mirror with it.
- *
- * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
- * every logout of every app, most of which never mounted one.
- */
-function detachWarmSignerIframe(origin) {
-    if (!modal || !modal.iframe || modal.iframeOrigin !== origin)
-        return false;
-    detachIframe(modal);
-    return true;
-}
-function detachIframe(m) {
-    if (m.iframe) {
-        try {
-            m.iframe.remove();
-        }
-        catch (_a) {
-            /* ignore */
-        }
-    }
-    m.iframe = null;
-    m.iframeReady = false;
-    m.iframeOrigin = "";
-    m.onIframeMessage = null;
-}
-
-var boundedWidgetModal = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    detachIframe: detachIframe,
-    detachWarmSignerIframe: detachWarmSignerIframe,
-    ensureIframe: ensureIframe,
-    getModal: getModal,
-    hasDOM: hasDOM$4,
-    hideModal: hideModal,
-    setPanelHeight: setPanelHeight,
-    showModal: showModal
-});
-
-// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
-// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
-// in a warm iframe behind the modal so signing feels native: an in-app approve
-// card (with inline code entry when the 24h signing session must first be
-// established), never a jarring popup.
-//
-// WHY AN IFRAME: the wallet's signing session lives in the single Bounded signer
-// origin's storage, out of every app's reach, so signing MUST run on that origin;
-// the iframe brings it in-app.
-//
-// Restricted embedders: if the frame never loads, the SAME request reruns through
-// `popupFallback` (a real window). Callers pass a popup implementation and never
-// see the difference.
-/**
- * Run one signer exchange through the in-app widget. Resolves when `onResult`
- * accepts a result; falls back to `popupFallback` if the frame cannot be mounted
- * or never loads.
- */
-async function runWidget(url, signerOrigin, ex, popupFallback) {
-    if (!hasDOM$4())
-        return popupFallback();
-    const m = getModal();
-    const requestId = String(ex.request.requestId);
-    // Serialize: the approve card is modal, and one warm frame handles one request at a time.
-    const run = m.chain.then(() => new Promise((resolve, reject) => {
-        let settled = false;
-        let usedFallback = false;
-        const iframe = ensureIframe(m, url, signerOrigin);
-        const send = () => {
-            if (!iframe.contentWindow)
-                return;
-            try {
-                iframe.contentWindow.postMessage(ex.request, signerOrigin);
-            }
-            catch (_a) {
-                /* frame gone */
-            }
-        };
-        let loadTimer = 0;
-        let ceilingTimer = 0;
-        const finish = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            m.onIframeMessage = null;
-            m.onBackdrop = null;
-            window.clearTimeout(loadTimer);
-            window.clearTimeout(ceilingTimer);
-            fn();
-        };
-        const goFallback = () => {
-            if (usedFallback || settled)
-                return;
-            usedFallback = true;
-            hideModal(m);
-            finish(() => popupFallback().then(resolve, reject));
-        };
-        m.onBackdrop = () => {
-            hideModal(m);
-            finish(() => reject(new Error("cancelled")));
-        };
-        m.onIframeMessage = (d) => {
-            if (d.type === "bounded:turnkey:ready") {
-                m.iframeReady = true;
-                send();
-                return;
-            }
-            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
-                setPanelHeight(m, d.height);
-                return;
-            }
-            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
-                const outcome = ex.onResult(d);
-                if ("error" in outcome) {
-                    hideModal(m);
-                    finish(() => reject(new Error(outcome.error)));
-                    return;
-                }
-                if (outcome.done) {
-                    hideModal(m);
-                    finish(() => resolve(outcome.value));
-                }
-            }
-        };
-        showModal(m);
-        if (m.iframeReady)
-            send();
-        // If the frame never loads, degrade to the popup (best-effort - a post-load
-        // popup may be blocked without a gesture, in which case the fallback rejects).
-        loadTimer = window.setTimeout(() => {
-            if (!m.iframeReady && !settled)
-                goFallback();
-        }, 8000);
-        // Absolute ceiling so a stuck flow cannot hang forever.
-        ceilingTimer = window.setTimeout(() => {
-            if (!settled) {
-                hideModal(m);
-                finish(() => reject(new Error("Wallet approval timed out.")));
-            }
-        }, 5 * 60 * 1000);
-    }));
-    m.chain = run.then(() => undefined, () => undefined);
-    return run;
-}
-
 // turnkey-signer-frame.ts - a HIDDEN, offscreen iframe of the Bounded signer page
 // for UI-less signer exchanges: sealing a login code (bounded:turnkey:encryptOtp),
 // establishing the 24h signing session right after login
@@ -4720,14 +4404,14 @@ async function requestTurnkeyActionAuthorization(opts) {
 function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
-// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
-// when we cannot embed (no DOM, or the frame never mounts/loads). Nothing in the
-// email-session flow needs a popup by preference: the code entry and the approval
-// click both run fine inside a cross-origin iframe on every engine (the old
-// Safari popup preference existed only for in-iframe WebAuthn CREATE).
+// BSA-2026-006: dispatch every signing / get-or-create exchange through a TOP-LEVEL
+// POPUP the caller opened from the user gesture - NEVER a framed widget. An authorized
+// tenant that embedded the signer could overlay its predictable Approve control and steal
+// one concealed click into a fund-moving signature; a top-level window it cannot reach or
+// visually redress closes that. A blocked popup surfaces `popup_blocked` (runPopup) and we
+// never silently fall back to an iframe.
 async function deliver(url, origin, ex) {
-    const popup = () => runPopup(url, origin, ex);
-    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+    return runPopup(url, origin, ex);
 }
 async function turnkeySignerPage() {
     const cfg = await core.getConfig();
@@ -4788,7 +4472,7 @@ async function runPopup(url, signerOrigin, ex) {
     const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
     const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup) {
-        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the wallet approval window can open.');
+        throw new Error('popup_blocked - the wallet approval window was blocked. Call this from a user gesture (e.g. a click handler) so it can open; we never fall back to an in-page frame.');
     }
     return await new Promise((resolve, reject) => {
         let settled = false;
@@ -4944,7 +4628,7 @@ async function clearTurnkeySigningSession() {
     // Done first, and synchronously, so it lands even if the frame exchange below fails.
     try {
         const { origin } = await turnkeySignerPage();
-        (await Promise.resolve().then(function () { return boundedWidgetModal; })).detachWarmSignerIframe(origin);
+        (await Promise.resolve().then(function () { return require('./bounded-widget-modal-s0PL86Y-.js'); })).detachWarmSignerIframe(origin);
     }
     catch (_a) {
         /* no modal module / no warm frame: nothing to take */
@@ -6021,7 +5705,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-B1wYw68c.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BhYzRN0r.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6063,7 +5747,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-DBWcA9tW.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CG3oKdp_.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6076,7 +5760,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CgUCo_6H.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-C3MwUTRd.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6101,7 +5785,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BGBcSwsM.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BiM35KHb.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6163,7 +5847,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BGBcSwsM.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BiM35KHb.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6334,7 +6018,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-DBWcA9tW.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-CG3oKdp_.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -8355,4 +8039,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index.native-DVMCCbwq.js.map
+//# sourceMappingURL=index.native-BZOWS_sR.js.map