Documento original do Skill
Renderizado do repositório de origem, preservando títulos, exemplos, código, tabelas, links e imagens.
Bounded frontend
The client side of a Bounded app: the SDK your web or mobile app calls, how end users authenticate, and how the hosted frontend is served. Policy still governs every write from the client, so pair this with the bounded-backend skill when a client action needs a rule or invariant, and bounded-deploy for hosting and domains. To route across the family, see the root bounded skill.
Reference Router
Read only the row matching the current task or term.
| Task or term | Read |
|---|---|
SDK reads, writes, subscriptions, paging, queryAggregate, count, filters, sort, cursor, setMany, set(path, null) | SDK reference |
| Build a web frontend | web app guide |
Local dev server (npm run dev, Vite, localhost), login popup fails, redirect_uri origin is not a registered origin, CORS during local development | develop on localhost |
| Build for React Native / mobile | React Native guide |
App-user email OTP, OAuth, openBoundedWidget, unified login widget, default Turnkey auth | app auth |
Bring-your-own wallet login; walletLogin, authMethod:'phantom', Phantom / Wallet-Standard | wallet login |
Wallet login lost on refresh, getCurrentUser() null after reload, bounded_last_auth_method, session restore method | wallet login - "Wallet sessions survive reloads" |
| Guests, anonymous users, invite links, account upgrade | anonymous accounts |
| Hosted frontend and app URLs | frontend hosting |
CLI developer login or bounded login | developer accounts |
Embedded wallet, auth.wallets, @user.address after email/social login | embedded wallets |
onramp(), buy SOL/USDC by card, Coinbase Onramp, wallet top-up | onramp |
Rules Of Thumb
- Every client write is governed by policy; a
403on a write is a rule denial, not a client bug. See the bounded-backend skill for the rule. - Denied reads return empty
200responses, never403. - Batch reads for lists of computed values with
runQueryMany; never maprunQueryover a list. See sdk-reference.md. - Put provider API keys in Bounded secrets (backend), never in frontend code.
- A moderate `uuid` advisory (GHSA-w5hq-g745-h8pq) rides in transitively through `@solana/web3.js -> jayson`, with no upstream fix. Do not chase it through dependency bumps; add the app-level
overrides/resolutionssnippet in sdk-reference.md, which makesnpm audit --omit=devexit 0. The vulnerable code path is unreachable through the SDK. - Keep the auth defaults for most apps. Do not add
authModeorauth.walletsto "enable wallets": default Turnkey email/social login already carries@user.address. Deploy"auth": { "wallets": true }only for an EXTERNAL-keypair session (bring-your-own wallet login, a server-SDK keypair client, the CLI keypair data lane). Full rule and the opt-outs: embedded-wallets.md. - `@user.id` (the account id) is identity/ownership; `@user.address` is the wallet. Key ownership, membership, and auth guards on
@user.id(always present). Reach for@user.addressonly for wallet/onchain semantics - never as the identity key.
