@bounded-sh/client 0.0.113 → 0.0.115

package/dist/auth/providers/injected-wallet-types.d.ts

@@ -116,7 +116,9 @@ export interface InjectedWalletConfig {
      * Resolve/pick the injected provider. Defaults to Phantom
      * (`window.phantom.solana`) then a generic `window.solana`. Pass this to
      * point at a specific wallet, or to bridge a custom/mock provider (e.g. an
-     * app that already discovered a Wallet-Standard wallet).
+     * app that already discovered a Wallet-Standard wallet). A supplied getter
+     * that returns nothing fails: an explicit choice is never replaced by a
+     * different wallet. Omit the getter to use default discovery.
      */
     getProvider?: () => InjectedSolanaProvider | null | undefined;
     /**
@@ -144,9 +146,16 @@ export interface InjectedWalletConfig {
     /** Explicit RPC URL override (wins over `network`). */
     rpcUrl?: string | null;
 }
+export declare const SELECTED_WALLET_UNAVAILABLE_ERR = "The selected Solana wallet is unavailable. Select it again before continuing.";
+/** Check login capabilities without connecting, signing, or loading a wallet SDK.
+ *  This checks login only; it does not promise message or transaction signing. */
+export declare function supportsWalletSignIn(provider: unknown): provider is Pick<InjectedSolanaProvider, 'connect'> & Required<Pick<InjectedSolanaProvider, 'signIn'>>;
 /**
  * Default provider discovery: Phantom-first, then any Wallet-Standard
  * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
- * a user gesture and can be eagerly exported from the SDK entry.
+ * a user gesture and can be eagerly exported from the SDK entry. This names the
+ * default wallet even when it cannot sign in: login must refuse that wallet,
+ * never silently replace it with a different identity. Custom pickers can use
+ * supportsWalletSignIn() to decide which providers to offer for login.
  */
 export declare function defaultInjectedProvider(): InjectedSolanaProvider | null;

package/dist/auth/providers/wallet-standard-discovery.d.ts

@@ -12,6 +12,8 @@ export interface StandardWalletChoice {
     /** Adapt the registered wallet to the slim injected-provider shape. */
     getProvider: () => InjectedSolanaProvider;
 }
+/** Distinguish unsupported installed wallets from an empty registry in the UI. */
+export declare function hasUnsupportedStandardWallets(configuredNetwork?: string | null): boolean;
 /**
  * Adapt a Wallet Standard wallet to the slim `InjectedSolanaProvider` the SDK's
  * wallet-login + signing path consumes. Connect resolves (and caches) the active

package/dist/auth/turnkey-signer-window.d.ts

@@ -0,0 +1,19 @@
+export interface SignerPopupReservation {
+    /**
+     * Close the reserved window if no exchange has used it. Given a `message`, show it in the window
+     * first and close it about a second and a half later, so a flow that fails before the signer loads
+     * explains the window that flashed instead of vanishing. Safe to call more than once, and after use.
+     */
+    release(message?: string): void;
+}
+export declare function openSignerWindow(url: string, w?: number, h?: number): Window | null;
+/**
+ * Open the signer window NOW, synchronously, showing a neutral "Preparing your approval..."
+ * page (a blank document with local text, no remote content). Call it from a user gesture,
+ * before any `await`, and `release()` it when the flow ends. A cross-app Turnkey signature
+ * then runs in this window instead of needing a fresh gesture.
+ * Returns null when there is no DOM or the browser blocked the window.
+ */
+export declare function reserveSignerPopup(): SignerPopupReservation | null;
+/** Hand the reserved window, if one is held, to an exchange: navigated to the signer page at `url`. */
+export declare function takeReservedPopup(url: string): Window | null;

package/dist/auth/turnkey-signing-capability.d.ts

@@ -8,12 +8,16 @@ export type CapabilityFetch = (url: string, init: {
     body: string;
 }) => Promise<CapabilityFetchResponse>;
 export type TurnkeyWalletAction = 'getAddress' | 'createWallet' | 'exportWallet';
+export type SignerTransport = 'popup';
 export declare function requestTurnkeySigningCapability(opts: {
     baseUrl: string;
     idToken: string;
     messageHex: string;
     fetchImpl: CapabilityFetch;
-}): Promise<string>;
+}): Promise<{
+    capability: string;
+    transport?: SignerTransport;
+}>;
 export declare function buildTurnkeySignRequest(opts: {
     requestId: string;
     messageHex: string;

package/dist/{email-auth-provider-nDZjRDpj.mjs → email-auth-provider-ByNBWdfi.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager } from '@bounded-sh/core';
-import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index-BAiLpNEQ.mjs';
+import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index-C63ceG_z.mjs';
 import 'react';
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -94,4 +94,4 @@ class EmailAuthProvider {
 const emailProviderSingleton = new EmailAuthProvider();
 
 export { EmailAuthProvider, emailProviderSingleton };
-//# sourceMappingURL=email-auth-provider-nDZjRDpj.mjs.map
+//# sourceMappingURL=email-auth-provider-ByNBWdfi.mjs.map

package/dist/{email-auth-provider-Bk5GSpYT.mjs.map → email-auth-provider-ByNBWdfi.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-Bk5GSpYT.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}
+{"version":3,"file":"email-auth-provider-ByNBWdfi.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}

package/dist/{email-auth-provider-Bk5GSpYT.mjs → email-auth-provider-CODHCC3h.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager } from '@bounded-sh/core';
-import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index.native-DcW2klyn.mjs';
+import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index.native-DLAEWwuZ.mjs';
 import 'react';
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -94,4 +94,4 @@ class EmailAuthProvider {
 const emailProviderSingleton = new EmailAuthProvider();
 
 export { EmailAuthProvider, emailProviderSingleton };
-//# sourceMappingURL=email-auth-provider-Bk5GSpYT.mjs.map
+//# sourceMappingURL=email-auth-provider-CODHCC3h.mjs.map

package/dist/{email-auth-provider-nDZjRDpj.mjs.map → email-auth-provider-CODHCC3h.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-nDZjRDpj.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}
+{"version":3,"file":"email-auth-provider-CODHCC3h.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}

package/dist/{email-auth-provider-DeORQbTK.js → email-auth-provider-CPHrcy_b.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index = require('./index-BZ0X1Z9X.js');
+var index = require('./index-nU0ZSfWs.js');
 require('react');
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -97,4 +97,4 @@ const emailProviderSingleton = new EmailAuthProvider();
 
 exports.EmailAuthProvider = EmailAuthProvider;
 exports.emailProviderSingleton = emailProviderSingleton;
-//# sourceMappingURL=email-auth-provider-DeORQbTK.js.map
+//# sourceMappingURL=email-auth-provider-CPHrcy_b.js.map

package/dist/{email-auth-provider-DeORQbTK.js.map → email-auth-provider-CPHrcy_b.js.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-DeORQbTK.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,4BAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,gCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,kCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,sBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,yCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}
+{"version":3,"file":"email-auth-provider-CPHrcy_b.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,4BAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,gCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,kCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,sBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,yCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}

package/dist/{email-auth-provider-Cr66GaKw.js → email-auth-provider-CwG04f4u.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index_native = require('./index.native-DJSOqyKQ.js');
+var index_native = require('./index.native-BBLBnqal.js');
 require('react');
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -97,4 +97,4 @@ const emailProviderSingleton = new EmailAuthProvider();
 
 exports.EmailAuthProvider = EmailAuthProvider;
 exports.emailProviderSingleton = emailProviderSingleton;
-//# sourceMappingURL=email-auth-provider-Cr66GaKw.js.map
+//# sourceMappingURL=email-auth-provider-CwG04f4u.js.map

package/dist/{email-auth-provider-Cr66GaKw.js.map → email-auth-provider-CwG04f4u.js.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-Cr66GaKw.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,mCAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,uCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,yCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,6BAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,gDAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}
+{"version":3,"file":"email-auth-provider-CwG04f4u.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession(beforeCommit) {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,mCAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,uCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,yCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,6BAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,gDAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}

package/dist/{guest-auth-provider-CUNkZVFK.js → guest-auth-provider-3rfSwq3f.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index_native = require('./index.native-DJSOqyKQ.js');
+var index_native = require('./index.native-BBLBnqal.js');
 require('react');
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -339,4 +339,4 @@ class GuestAuthProvider {
 }
 
 exports.GuestAuthProvider = GuestAuthProvider;
-//# sourceMappingURL=guest-auth-provider-CUNkZVFK.js.map
+//# sourceMappingURL=guest-auth-provider-3rfSwq3f.js.map

package/dist/{guest-auth-provider-CUNkZVFK.js.map → guest-auth-provider-3rfSwq3f.js.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-CUNkZVFK.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-3rfSwq3f.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}

package/dist/{guest-auth-provider-ejUTbjCC.mjs → guest-auth-provider-CGN4k_LG.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager, genAuthNonce, browserSignInDomain, genSolanaSignInMessage, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
-import { g as getPlatform, e as bs58, j as setAuthLoading, s as setCurrentUser } from './index-BAiLpNEQ.mjs';
+import { g as getPlatform, e as bs58, j as setAuthLoading, s as setCurrentUser } from './index-C63ceG_z.mjs';
 import 'react';
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -337,4 +337,4 @@ class GuestAuthProvider {
 }
 
 export { GuestAuthProvider };
-//# sourceMappingURL=guest-auth-provider-ejUTbjCC.mjs.map
+//# sourceMappingURL=guest-auth-provider-CGN4k_LG.mjs.map

package/dist/{guest-auth-provider-DDudqqxY.mjs.map → guest-auth-provider-CGN4k_LG.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-DDudqqxY.mjs","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["SessionManager"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQ,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMA,uBAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,uBAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoB,cAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAG,mBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAM,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMA,uBAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgB,cAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgB,cAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGA,uBAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMA,uBAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMA,uBAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-CGN4k_LG.mjs","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["SessionManager"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQ,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMA,uBAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,uBAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoB,cAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAG,mBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAM,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMA,uBAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgB,cAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgB,cAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGA,uBAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMA,uBAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMA,uBAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}