@bounded-sh/client 0.0.112-ux-audit.1 → 0.0.112

package/dist/{index-Brdwqgqs.js → index-BmNNZlTl.js}

@@ -56,6 +56,13 @@ function walletOperationGuard() {
             throw new Error('wallet_session_changed');
     };
 }
+function walletLoginGuard(signal) {
+    const generation = ++loginGeneration;
+    return () => {
+        if ((signal === null || signal === void 0 ? void 0 : signal.aborted) || generation !== loginGeneration)
+            throw new Error('wallet_login_cancelled');
+    };
+}
 // This realm owns one active SDK session and one retained signer frame.
 let activeWalletState;
 function setWalletSessionState(key, state) { activeWalletState = { key, state }; }
@@ -3890,9 +3897,13 @@ async function ensureSolanaMobileWalletRegistered(config, network) {
             }
             catch (_e) {
                 throw new WalletConfigError(`Bounded: Solana Mobile wallet support needs the optional peer dependency ` +
-                    `'@solana-mobile/wallet-standard-mobile', which is not installed. Install it ` +
-                    `in your app to enable the mobile wallet, or leave the Solana Mobile wallet ` +
-                    `out of this app's wallet configuration.`);
+                    `'@solana-mobile/wallet-standard-mobile', which is not installed. Until it is, ` +
+                    `Android users (Seeker, Saga, any phone browser) get NO wallet to connect: ` +
+                    `installed wallet apps are never injected into a page there, the mobile adapter ` +
+                    `is the only route. Fix: npm install @solana-mobile/wallet-standard-mobile ` +
+                    `(a web app also needs legacy-peer-deps=true in its .npmrc, because the adapter's ` +
+                    `protocol package declares react-native as a peer). Or leave the Solana Mobile ` +
+                    `wallet out of this app's wallet configuration on purpose.`);
             }
             const { registerMwa, createDefaultChainSelector, SolanaMobileWalletAdapterWalletName, SolanaMobileWalletAdapterRemoteWalletName, } = mwa;
             const before = new Set(getWallets().get());
@@ -3979,7 +3990,7 @@ const OVERLAY_CSS = `
 :host{all:initial}
 *{box-sizing:border-box}
 .bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+  font-family:"Bounded Schibsted Grotesk","Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
 .bw-ov.mounted{display:block}
 .bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
   transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
@@ -4012,6 +4023,29 @@ const OVERLAY_CSS = `
 }
 @media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
 `;
+/**
+ * Style the shadow tree with `css` as constructed stylesheets, and say whether it could. A host
+ * CSP whose style-src lacks 'unsafe-inline' refuses an inline <style> even inside a shadow root,
+ * which left the widget unstyled (the Bounded router compiles exactly `style-src 'self'` for an
+ * app that declares browser boundaries and names no style sources); CSP does not govern
+ * constructed sheets. A browser without them (they shipped with adoptedStyleSheets everywhere)
+ * gets <style> elements instead (styleTag).
+ */
+function adoptStyles(shadow, css) {
+    if (!("adoptedStyleSheets" in shadow))
+        return false;
+    shadow.adoptedStyleSheets = css.map((text) => {
+        const sheet = new CSSStyleSheet();
+        sheet.replaceSync(text);
+        return sheet;
+    });
+    return true;
+}
+function styleTag(css) {
+    const style = document.createElement("style");
+    style.textContent = css;
+    return style;
+}
 let modal = null;
 function getModal() {
     if (modal)
@@ -4019,9 +4053,8 @@ function getModal() {
     const root = document.createElement("div");
     root.setAttribute("data-bounded-widget", "");
     const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
+    if (!adoptStyles(shadow, [OVERLAY_CSS]))
+        shadow.appendChild(styleTag(OVERLAY_CSS));
     const overlay = document.createElement("div");
     overlay.className = "bw-ov";
     const back = document.createElement("div");
@@ -4156,12 +4189,15 @@ function fitPanelToContent(m) {
         m.fitObserver = ro;
     }
 }
-/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
-function mountContent(m, node) {
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`, styled by `css` until the next mount. */
+function mountContent(m, node, css) {
     var _a;
     detachIframe(m);
     (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
     m.fitObserver = null;
+    const shadow = m.root.shadowRoot;
+    if (!(shadow && adoptStyles(shadow, [OVERLAY_CSS, css] )) && css)
+        node.prepend(styleTag(css));
     m.content.replaceChildren(node);
     m.content.style.display = "block";
 }
@@ -4223,27 +4259,39 @@ function detachIframe(m) {
     m.iframeContext = "";
     m.onIframeMessage = null;
 }
-// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
-// JetBrains Mono) once at the document level so they apply inside the shadow root. A
-// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
-const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+/**
+ * The Bounded editorial typefaces the hosted auth page uses (Newsreader display, Schibsted
+ * Grotesk body), registered once at the document level so they apply inside the shadow root.
+ *
+ * The Bounded router serves them same-origin at /__bounded/fonts/*.woff2 on every site it
+ * serves (bounded-router scripts/build-widget-styles.cjs), and they load through the FontFace
+ * API: no stylesheet, so a host CSP's style-src never applies, and the only fetch is same-origin,
+ * which font-src 'self' admits. Google Fonts CSS injected here was refused by strict hosts such
+ * as the OpenApps venue (style-src 'self'), with a CSP error on every page. A page the router
+ * does not serve has none of its /__bounded/ scripts: nothing is fetched there, and the widget's
+ * font stacks fall back to the page's own faces or system ones. The Bounded-prefixed family
+ * names never restyle the host page's own text.
+ */
+const WIDGET_FONT_FACES = [
+    { family: "Bounded Newsreader", url: "/__bounded/fonts/newsreader.woff2", weight: "200 800" },
+    { family: "Bounded Schibsted Grotesk", url: "/__bounded/fonts/schibsted.woff2", weight: "400 900" },
+];
 function ensureFonts() {
-    if (!hasDOM$5())
+    if (!hasDOM$5() || typeof FontFace === "undefined" || !document.fonts)
         return;
-    if (document.querySelector('link[data-bounded-fonts="1"]'))
+    if (!document.querySelector('script[src^="/__bounded/"]'))
         return;
-    const pre1 = document.createElement("link");
-    pre1.rel = "preconnect";
-    pre1.href = "https://fonts.googleapis.com";
-    const pre2 = document.createElement("link");
-    pre2.rel = "preconnect";
-    pre2.href = "https://fonts.gstatic.com";
-    pre2.crossOrigin = "anonymous";
-    const link = document.createElement("link");
-    link.rel = "stylesheet";
-    link.href = FONTS_HREF;
-    link.setAttribute("data-bounded-fonts", "1");
-    document.head.append(pre1, pre2, link);
+    const registered = new Set();
+    document.fonts.forEach((face) => registered.add(face.family.replace(/^["']|["']$/g, "")));
+    for (const { family, url, weight } of WIDGET_FONT_FACES) {
+        if (registered.has(family))
+            continue;
+        // Against the page's origin, not its base URL: a <base href> elsewhere must not move the fetch off this origin.
+        const face = new FontFace(family, `url("${location.origin}${url}") format("woff2")`, { weight, display: "swap" });
+        document.fonts.add(face);
+        // A face that cannot load is taken back out; the font stack falls back to the next face.
+        face.load().catch(() => { document.fonts.delete(face); });
+    }
 }
 
 // turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
@@ -5781,20 +5829,21 @@ async function loginWithPopup(opts) {
 // Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
 // after Turnkey verifies the email OTP - there is no OIDC code to exchange. Wiring is
 // identical to exchangeCode's tail so the realtime worker cannot tell them apart.
-async function establishInlineSession(data, beforeCommit, beforeStore) {
+async function establishInlineSession(data, beforeCommit, beforeStore, onCommitting) {
     const base = await issuerBase();
+    beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
     const idToken = tokenField(data, 'id_token', 'idToken');
     if (!idToken)
         throw new Error('No id_token in the inline session response');
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, () => { });
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, () => { beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit(); });
     // Adopt the OIDC provider on EVERY session surface - including core's signing
     // pointer (getConfig().authProvider), which this path used to skip, leaving
     // onchain writes routed through a previous (e.g. logged-out wallet) provider.
     try {
-        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit: () => { beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit(); onCommitting === null || onCommitting === void 0 ? void 0 : onCommitting(); } });
     }
     catch (error) {
         if (typeof rollback === 'function')
@@ -6262,7 +6311,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CG5cxOj0.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CyFsnSzx.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6304,7 +6353,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-LTnqoaYD.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-D8vIsUHf.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6317,7 +6366,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CwOGXCDt.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-C8YItSiB.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6342,7 +6391,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Dtl1J-2F.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-B4WIWOjV.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6404,7 +6453,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Dtl1J-2F.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-B4WIWOjV.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6575,7 +6624,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-LTnqoaYD.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-D8vIsUHf.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6678,7 +6727,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-LTnqoaYD.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-D8vIsUHf.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -7045,6 +7094,13 @@ function registerStorageBridge() {
         void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
     });
 }
+function sameSessionIdentity(next, previous) {
+    if (!next || !previous)
+        return false;
+    const a = core.deriveUserIdentityFromIdToken(next);
+    const b = core.deriveUserIdentityFromIdToken(previous);
+    return !!a.id && a.id === b.id && a.address === b.address && a.email === b.email && a.evmAddress === b.evmAddress;
+}
 async function syncStoredSession() {
     const config = initializedConfig;
     if (!config)
@@ -7053,6 +7109,18 @@ async function syncStoredSession() {
     const issuer = core.WebSessionManager.getIssuer();
     if (token === observedIdToken && issuer === observedIssuer)
         return;
+    // Another tab refreshed this same session (tokens rotate every few minutes):
+    // who is signed in did not change, so keep the user and its live reads, whose
+    // sockets take the new token on their own, instead of hiding and restoring it.
+    if (currentUser && issuer === observedIssuer && sameSessionIdentity(token, observedIdToken)) {
+        const record = await core.WebSessionManager.readSessionWithGeneration();
+        if (config !== initializedConfig || core.WebSessionManager.getIdToken() !== token)
+            return;
+        if ((record === null || record === void 0 ? void 0 : record.idToken) === token && (!record.appId || record.appId === config.appId)) {
+            observedIdToken = token;
+            return;
+        }
+    }
     observedIdToken = token;
     observedIssuer = issuer;
     const generation = ++initializationGeneration;
@@ -7847,10 +7915,18 @@ async function startTurnkeyEmailLogin(email) {
     if (!hasDOM$1()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
+    const generation = getInitializationGeneration();
+    const walletGuard = walletOperationGuard();
+    const assertContext = () => {
+        walletGuard();
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
     const trimmed = email.trim();
     if (!trimmed)
         throw new Error('Enter your email to continue.');
     const { base, appId } = await inlineAuthEndpoint();
+    assertContext();
     if (!appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
     const res = await fetch(`${base}/wallet/turnkey/auth/init`, {
@@ -7862,6 +7938,7 @@ async function startTurnkeyEmailLogin(email) {
     if (!res.ok || !data || typeof data.otpId !== 'string' || typeof data.otpEncryptionTargetBundle !== 'string') {
         throw new Error(String((data && data.error) || 'Could not send a code. Please try again.'));
     }
+    assertContext();
     const otpId = data.otpId;
     const otpEncryptionTargetBundle = data.otpEncryptionTargetBundle;
     // A tenant-origin login always gets a ceremony id; without one the OTP frame refuses to run
@@ -7877,14 +7954,20 @@ async function startTurnkeyEmailLogin(email) {
         : undefined;
     return {
         email: trimmed, frameUrl, signerOrigin,
-        run(iframe, _signal) {
+        run(iframe, signal) {
+            try {
+                assertContext();
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
             if (!ceremonyId) {
                 return Promise.reject(new Error('This app is not configured for in-frame wallet login. Please try again.'));
             }
-            const run = { iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId };
+            const run = { iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId, generation };
             // BSA-2026-004: the login code is typed only in /wallet/turnkey/otp-frame.
             // The scoped signer URL is for post-login signing, not OTP entry.
-            return runOtpFrame(run);
+            return runOtpFrame(run, signal);
         },
     };
 }
@@ -7893,7 +7976,7 @@ async function startTurnkeyEmailLogin(email) {
 //   frame 'result' {session} -> we establish the inline session and resolve the User.
 // When the frame asks for the signing-session authorization ('need-authorization') we mint a
 // createWallet action authorization on THIS (registered) origin and post it in - never a key.
-function runOtpFrame(run) {
+function runOtpFrame(run, signal) {
     const tenantOrigin = window.location.origin;
     const url = `${run.base.replace(/\/$/, '')}/wallet/turnkey/otp-frame`
         + `?appId=${encodeURIComponent(run.appId)}`
@@ -7903,13 +7986,48 @@ function runOtpFrame(run) {
     return new Promise((resolve, reject) => {
         let settled = false;
         let started = false;
-        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); window.clearTimeout(timer); };
+        let receivingResult = false;
+        let committing = false;
+        const walletGuard = walletLoginGuard(signal);
+        const beforeCommit = () => {
+            if (settled)
+                throw new Error('wallet_login_cancelled');
+            walletGuard();
+            if (run.generation !== getInitializationGeneration())
+                throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+        };
+        const finish = (error, user) => {
+            if (settled)
+                return;
+            settled = true;
+            window.removeEventListener('message', onMsg);
+            window.clearTimeout(timer);
+            signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', onAbort);
+            if (error) {
+                // Destroy the expired frame's code/key realm as well as its parent listener.
+                run.iframe.src = 'about:blank';
+                reject(error);
+            }
+            else
+                resolve(user);
+        };
+        const onAbort = () => { if (!committing)
+            finish(new Error('cancelled')); };
         const onMsg = async (event) => {
             if (settled)
                 return;
             // Trust ONLY the signer origin and the frame's own window.
             if (event.origin !== run.signerOrigin || event.source !== run.iframe.contentWindow)
                 return;
+            if (!committing) {
+                try {
+                    beforeCommit();
+                }
+                catch (error) {
+                    finish(error instanceof Error ? error : new Error(String(error)));
+                    return;
+                }
+            }
             const d = event.data;
             if (!d || typeof d !== 'object')
                 return;
@@ -7952,40 +8070,56 @@ function runOtpFrame(run) {
                 return;
             }
             if (d.type === 'bounded:otp:result') {
+                if (receivingResult)
+                    return;
+                receivingResult = true;
                 if (d.ok && d.session && typeof d.session === 'object') {
                     try {
-                        const user = await establishInlineSession(d.session);
-                        cleanup();
-                        resolve(user);
+                        const user = await establishInlineSession(d.session, beforeCommit, undefined, () => { committing = true; });
+                        finish(undefined, user);
                     }
                     catch (error) {
-                        cleanup();
-                        reject(error instanceof Error ? error : new Error(String(error)));
+                        finish(error instanceof Error ? error : new Error(String(error)));
                     }
                     return;
                 }
-                cleanup();
-                reject(new Error(String((d && d.error) || 'Invalid or expired code.')));
+                finish(new Error(String((d && d.error) || 'Invalid or expired code.')));
                 return;
             }
             // 'bounded:otp:registered' is advisory; login does not depend on it.
         };
         const post = (msg) => {
             var _a;
+            if (settled)
+                return;
+            if (!committing) {
+                try {
+                    beforeCommit();
+                }
+                catch (_b) {
+                    return;
+                }
+            }
             try {
                 (_a = run.iframe.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(msg, run.signerOrigin);
             }
-            catch ( /* frame gone */_b) { /* frame gone */ }
+            catch ( /* frame gone */_c) { /* frame gone */ }
         };
         window.addEventListener('message', onMsg);
         // 3 minutes: the human must read the email and type the code. A frame that never reports is a
         // failed login the user can retry.
         const timer = window.setTimeout(() => {
-            if (settled)
-                return;
-            cleanup();
-            reject(new Error('The sign-in code entry timed out. Please try again.'));
+            if (!committing)
+                finish(new Error('The sign-in code entry timed out. Please try again.'));
         }, 3 * 60 * 1000);
+        signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', onAbort, { once: true });
+        try {
+            beforeCommit();
+        }
+        catch (error) {
+            finish(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
         run.iframe.src = url;
     });
 }
@@ -8014,8 +8148,8 @@ const CARD_CSS = `
   --line:rgba(232,230,222,.08);--line-strong:rgba(232,230,222,.16);
   --text:#e8e6de;--dim:#9b9991;--faint:#85837c;
   --green:#58c98f;--green-bg:rgba(88,201,143,.09);--green-line:rgba(88,201,143,.28);--red:#ec8488;
-  --disp:"Newsreader","Iowan Old Style",Georgia,serif;
-  --body:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif;
+  --disp:"Bounded Newsreader","Newsreader","Iowan Old Style",Georgia,serif;
+  --body:"Bounded Schibsted Grotesk","Schibsted Grotesk","Helvetica Neue",Arial,sans-serif;
   position:relative;padding:34px 32px 20px;color:var(--text);font-family:var(--body);
   -webkit-font-smoothing:antialiased}
 .x{position:absolute;top:20px;right:24px;border:0;background:transparent;color:var(--faint);
@@ -8136,6 +8270,17 @@ function discoverWallets(configuredNetwork) {
 // beats a click that does nothing, which is what "one at a time" looks like from
 // the outside.
 const BUSY_MSG = "A sign-in is already in progress - finish or cancel it first.";
+// Shown instead of an empty card when no lane can be offered (wallet-only app,
+// no wallet in this browser). A phone browser never sees installed wallet apps
+// as injected providers, so the honest advice there is a different browser,
+// not "install a wallet".
+function noLaneCopy(mobile) {
+    return mobile
+        ? "No wallet is available in this browser. Open this page in your wallet app's " +
+            "browser, or on a desktop browser with a wallet extension, then try again."
+        : "No wallet was found in this browser. Install a Solana wallet extension such as " +
+            "Phantom or Solflare, reload the page, then try again.";
+}
 const METHOD_LABEL = {
     google: "Continue with Google",
     apple: "Continue with Apple",
@@ -8477,12 +8622,9 @@ async function prepareAndOpen(opts, pending) {
             cancelPendingOpens();
         };
         m.onBackdrop = cancel;
-        const style = el("style");
-        style.textContent = CARD_CSS;
         let emailDraft = "";
         const renderChoose = (initialError) => {
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const x = el("button", "x", "Close");
             x.type = "button";
             x.setAttribute("aria-label", "Close");
@@ -8699,6 +8841,24 @@ async function prepareAndOpen(opts, pending) {
                     });
                 };
             }
+            // A card with no lane at all. It happens when an app asks for wallet-only
+            // (`methods: []`, `wallet: true`) and this browser has no wallet to offer:
+            // no injected wallet, and no Solana Mobile wallet (off-Android, or the app
+            // never installed the adapter). A blank card between the title and the
+            // footer was the shipped behaviour, and it reads as "the site is broken"
+            // to the person and tells the developer nothing. Say what is missing on
+            // screen, and name the usual cause once in the console, where the
+            // developer's own preview run will show it.
+            if (!hasEmail && social.length === 0 && !walletEnabled) {
+                card.appendChild(el("p", "sub", noLaneCopy(detectMobile())));
+                console.warn("[Bounded] openBoundedWidget has no sign-in lane to show: the app asked for " +
+                    "no email or social method and no wallet is available in this browser. " +
+                    (offerMobile
+                        ? "On Android the Solana Mobile wallet is offered only when the app installs " +
+                            "'@solana-mobile/wallet-standard-mobile' (see the warning above if registration failed); "
+                        : "") +
+                    "Add a method, or make sure wallet login is enabled and the mobile adapter is installed.");
+            }
             card.appendChild(status);
             const foot = el("div", "foot");
             const poweredBy = el("a", undefined, "Powered by Bounded");
@@ -8745,7 +8905,6 @@ async function prepareAndOpen(opts, pending) {
         const renderSignInGesture = (choice, done) => {
             var _a;
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const x = el("button", "x", "Close");
             x.type = "button";
             x.setAttribute("aria-label", "Close");
@@ -8766,7 +8925,6 @@ async function prepareAndOpen(opts, pending) {
         };
         const renderWallets = (initialError) => {
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const back = el("button", "back", "\u2190 Back");
             back.type = "button";
             // Leaving the wallet list supersedes any attempt still preparing, so it
@@ -8846,7 +9004,6 @@ async function prepareAndOpen(opts, pending) {
         // experience still feels native; the code input, sealing, and verify all live behind the frame.
         const renderOtpFrame = (handle) => {
             const card = el("div", "c");
-            card.appendChild(style.cloneNode(true));
             const back = el("button", "back", "\u2190 Back");
             back.type = "button";
             card.appendChild(back);
@@ -8874,14 +9031,16 @@ async function prepareAndOpen(opts, pending) {
                 setErr(BUSY_MSG);
                 return card;
             }
-            back.addEventListener("click", () => { settleAttempt(attempt); invalidateAttempts(); swap(renderChoose()); });
+            back.addEventListener("click", () => { invalidateAttempts(); swap(renderChoose()); });
+            const controller = new AbortController();
+            abortScopedLogin = () => controller.abort();
             handle
-                .run(frame)
+                .run(frame, controller.signal)
                 .then((u) => { settleAttempt(attempt); succeed(u); })
                 .catch((err) => {
                 if (!settleAttempt(attempt))
                     return;
-                setErr(errText(err));
+                swap(renderChoose(errText(err)));
             });
             return card;
         };
@@ -8891,7 +9050,7 @@ async function prepareAndOpen(opts, pending) {
             // land after a newer open has taken over the DOM.
             if (!owner.owns())
                 return;
-            mountContent(m, node);
+            mountContent(m, node, CARD_CSS);
             requestAnimationFrame(() => {
                 if (owner.owns())
                     fitPanelToContent(m);
@@ -11283,4 +11442,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-Brdwqgqs.js.map
+//# sourceMappingURL=index-BmNNZlTl.js.map