@bounded-sh/core 0.0.120 → 0.0.121-openapps.0

package/dist/client/openapps-hosts.d.ts

@@ -0,0 +1,9 @@
+/** True in a browser page served on openapps.xyz or one of its subdomains. */
+export declare function onOpenAppsPage(): boolean;
+/** The openapps.xyz name of a platform URL, or the URL unchanged. */
+export declare function openAppsTwinUrl(url: string): string;
+/**
+ * The issuer a token from this auth base carries: the bounded.sh name for an
+ * openapps.xyz auth host, else the base itself. Without a trailing slash.
+ */
+export declare function canonicalIssuer(url: string): string;

package/dist/{index-D7-5ecyu.js → index-CanW0BzM.js}

@@ -4,6 +4,30 @@ var axios = require('axios');
 var nacl = require('tweetnacl');
 var ReconnectingWebSocket = require('reconnecting-websocket');
 
+// Each shared platform host's openapps.xyz name (the monorepo's
+// packages/cdk/cloudflare/shared/openapps-twin-hosts.ts): the same name on
+// openapps.xyz, with dev-api (an alias of platform) answering as platform. Both names reach the same
+// service, users and signing keys. A page served on openapps.xyz talks to the
+// openapps.xyz names; tokens keep the bounded.sh issuer either way.
+const BOUNDED_HOST = /^(wss?|https):\/\/(auth|wallet-auth|realtime|functions|dev-api|platform)(-staging)?\.bounded\.sh(\/?)$/;
+const TWIN_HOST = /^(https):\/\/(auth|wallet-auth)(-staging)?\.openapps\.xyz\/?$/;
+/** True in a browser page served on openapps.xyz or one of its subdomains. */
+function onOpenAppsPage() {
+    const host = typeof location !== 'undefined' && typeof location.hostname === 'string' ? location.hostname : '';
+    return host === 'openapps.xyz' || host.endsWith('.openapps.xyz');
+}
+/** The openapps.xyz name of a platform URL, or the URL unchanged. */
+function openAppsTwinUrl(url) {
+    return url.replace(BOUNDED_HOST, (_, scheme, name, staging = '', slash) => `${scheme}://${name === 'dev-api' ? 'platform' : name}${staging}.openapps.xyz${slash}`);
+}
+/**
+ * The issuer a token from this auth base carries: the bounded.sh name for an
+ * openapps.xyz auth host, else the base itself. Without a trailing slash.
+ */
+function canonicalIssuer(url) {
+    return url.replace(TWIN_HOST, '$1://$2$3.bounded.sh').replace(/\/+$/, '');
+}
+
 // The pristine default config. `clientConfig` (the module global) starts as a
 // copy of this and is mutated by init(); createClient() resolves fresh scoped
 // configs from this pristine template so a scoped instance never inherits a
@@ -90,7 +114,8 @@ function getWebhookKeysUrl() {
  * app's shared-key-signed delivery.
  */
 function getConfiguredSessionNamespace() {
-    return JSON.stringify([(clientConfig.humanAuthApiUrl || "https://auth.bounded.sh").replace(/\/$/, ""), clientConfig.appId]);
+    // Keyed by the issuer, not the host, so a session survives a page moving to the openapps.xyz names.
+    return JSON.stringify([canonicalIssuer(clientConfig.humanAuthApiUrl || "https://auth.bounded.sh"), clientConfig.appId]);
 }
 function getConfiguredAppId() {
     return clientConfig.appId || undefined;
@@ -126,7 +151,13 @@ function resolveClientConfig(base, newConfig) {
         throw new Error(`Unsupported Bounded network "${String(newConfig.network)}". Expected bounded, bounded-staging, or bounded-production.`);
     }
     const preset = newConfig.network ? BOUNDED_NETWORKS[newConfig.network] : {};
-    return Object.assign(Object.assign(Object.assign({}, base), preset), newConfig);
+    const resolved = Object.assign(Object.assign(Object.assign({}, base), preset), newConfig);
+    return onOpenAppsPage() ? withOpenAppsHosts(resolved) : resolved;
+}
+// A page on openapps.xyz reaches every platform service through its openapps.xyz name, so the
+// browser never talks to a bounded.sh host there. Same services, users and keys.
+function withOpenAppsHosts(config) {
+    return Object.assign(Object.assign({}, config), { wsApiUrl: openAppsTwinUrl(config.wsApiUrl), apiUrl: openAppsTwinUrl(config.apiUrl), authApiUrl: openAppsTwinUrl(config.authApiUrl), humanAuthApiUrl: config.humanAuthApiUrl && openAppsTwinUrl(config.humanAuthApiUrl), functionsUrl: config.functionsUrl && openAppsTwinUrl(config.functionsUrl), devApiUrl: config.devApiUrl && openAppsTwinUrl(config.devApiUrl) });
 }
 function init(newConfig) {
     return new Promise((resolve, reject) => {
@@ -523,9 +554,12 @@ function recordRefreshOutcome(key, err, now = Date.now()) {
 function resolveIssuerBase(issuer, cfg) {
     const norm = (u) => (u || '').replace(/\/$/, '');
     const allow = [norm(cfg.authApiUrl), norm(cfg.humanAuthApiUrl)].filter(Boolean);
-    const want = norm(issuer);
-    if (want && allow.includes(want))
-        return want;
+    // Matched by issuer, so a session minted on a bounded.sh name refreshes through the
+    // configured openapps.xyz name of the same issuer (and the other way round).
+    const want = issuer ? canonicalIssuer(issuer) : '';
+    const match = want && allow.find((base) => canonicalIssuer(base) === want);
+    if (match)
+        return match;
     return norm(cfg.authApiUrl);
 }
 // #062: key the auth client by its baseURL. The old single memoized client froze the FIRST
@@ -4307,7 +4341,7 @@ class ServerSessionManager {
         const sessionConfig = (_a = this.sessionConfig) !== null && _a !== void 0 ? _a : undefined;
         /* fetch nonce from auth API (bound to the snapshotted app+issuer) */
         const nonce = await genAuthNonce(sessionConfig);
-        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-CPotom18.js'); });
+        const { genSolanaMessage } = await Promise.resolve().then(function () { return require('./solana-message-7ppe_p4J.js'); });
         const message = await genSolanaMessage(address, nonce, sessionConfig === null || sessionConfig === void 0 ? void 0 : sessionConfig.appId);
         /* sign the message */
         const sigBytes = nacl.sign.detached(new TextEncoder().encode(message), kp.secretKey);
@@ -7679,7 +7713,7 @@ async function doReconnectWithNewAuth() {
         console.warn('[WS v2] Failed to clear HTTP read cache on auth change:', error);
     }
     try {
-        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-C2Jz8YM0.js'); });
+        const { reconnectRealtimeStoreWithNewAuth } = await Promise.resolve().then(function () { return require('./realtime-store-DSJXTRaT.js'); });
         await reconnectRealtimeStoreWithNewAuth();
     }
     catch (error) {
@@ -8898,7 +8932,7 @@ function buildRequestedDocuments(documents) {
 /** Best-effort readback, including a failure to load its lazy implementation. */
 async function attemptMirrorSync(paths, options, transactionSignature) {
     try {
-        const mirror = await Promise.resolve().then(function () { return require('./mirror-sync-DzbDh6G_.js'); });
+        const mirror = await Promise.resolve().then(function () { return require('./mirror-sync-DHyXt6zH.js'); });
         return await mirror.attemptMirrorSync(paths, options, transactionSignature);
     }
     catch (error) {
@@ -9168,7 +9202,7 @@ async function completePreparedWrite(setResponse, documents, config, authProvide
             if (typeof curTx.serializedTransaction !== 'string' || typeof curTx.poofnetIntentId !== 'string') {
                 throw new Error('Unsupported 202 transaction shape: a poofnet write needs serializedTransaction and poofnetIntentId');
             }
-            const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-DsT1303T.js'); });
+            const { signPoofnetTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-DBAQEi1q.js'); });
             const signedTransaction = await signPoofnetTransaction(curTx.serializedTransaction, authProvider, options, buildExpectedWriteIntent(documents));
             // Signing-only, exactly as on a real chain: signed and NOT committed.
             if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
@@ -9206,7 +9240,7 @@ async function completePreparedWrite(setResponse, documents, config, authProvide
                     'Nothing was signed or submitted.');
             }
             const solanaChain = workerChain;
-            const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-DsT1303T.js'); });
+            const { handlePreBuiltTransaction, buildExpectedWriteIntent } = await Promise.resolve().then(function () { return require('./solana-operations-DBAQEi1q.js'); });
             // OA-0001: derive the expected intent from OUR OWN request (the one
             // ground truth a tampered builder response cannot change) so the
             // validator can reject any transaction whose operation semantics
@@ -9264,7 +9298,7 @@ async function completePreparedWrite(setResponse, documents, config, authProvide
     catch (error) {
         // The blockhash died before the send: the RPC refused the bytes in preflight, so nothing
         // entered the network. The worker builds a fresh one and the wallet signs it again.
-        if (rebuilds.expiry && (await Promise.resolve().then(function () { return require('./solana-operations-DsT1303T.js'); })).isExpiredBlockhashRejection(error))
+        if (rebuilds.expiry && (await Promise.resolve().then(function () { return require('./solana-operations-DBAQEi1q.js'); })).isExpiredBlockhashRejection(error))
             return { rebuild: 'expiry' };
         // The Solana lane tags its own broadcast and on-chain failures; anything
         // untagged from it, and every poofnet step before the commit PUT, failed
@@ -11105,7 +11139,7 @@ function toMillis(seconds) {
 
 /** SIWS message creation is async already, so its onchain module can be lazy. */
 async function genSolanaMessage(address, nonce) {
-    const implementation = await Promise.resolve().then(function () { return require('./solana-message-CPotom18.js'); });
+    const implementation = await Promise.resolve().then(function () { return require('./solana-message-7ppe_p4J.js'); });
     return implementation.genSolanaMessage(address, nonce);
 }
 
@@ -11761,4 +11795,4 @@ exports.toSeconds = toSeconds;
 exports.waitForSetResult = waitForSetResult;
 exports.withEffects = withEffects;
 exports.writeNotAppliedPhase = writeNotAppliedPhase;
-//# sourceMappingURL=index-D7-5ecyu.js.map
+//# sourceMappingURL=index-CanW0BzM.js.map