@bounded-sh/client 0.0.114 → 0.0.115

package/dist/{index-BAiLpNEQ.mjs → index-C63ceG_z.mjs}

@@ -1,4 +1,4 @@
-import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, deriveUserIdentityFromIdToken, init as init$2, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, deriveUserIdentityFromIdToken, init as init$2, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, getConfiguredAppId, setWithVenueGrant, writeNotAppliedPhase, waitForSetResult, reconcileSetResult, resolveVenueRpcUrl, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
@@ -594,6 +594,37 @@ class OffchainAuthProvider {
     }
 }
 
+const SELECTED_WALLET_UNAVAILABLE_ERR = 'The selected Solana wallet is unavailable. Select it again before continuing.';
+/** Check login capabilities without connecting, signing, or loading a wallet SDK.
+ *  This checks login only; it does not promise message or transaction signing. */
+function supportsWalletSignIn(provider) {
+    if (typeof provider !== 'object' || provider === null)
+        return false;
+    const wallet = provider;
+    return typeof wallet.connect === 'function' && typeof wallet.signIn === 'function';
+}
+/**
+ * Default provider discovery: Phantom-first, then any Wallet-Standard
+ * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
+ * a user gesture and can be eagerly exported from the SDK entry. This names the
+ * default wallet even when it cannot sign in: login must refuse that wallet,
+ * never silently replace it with a different identity. Custom pickers can use
+ * supportsWalletSignIn() to decide which providers to offer for login.
+ */
+function defaultInjectedProvider() {
+    var _a;
+    if (typeof window === 'undefined')
+        return null;
+    const w = window;
+    const phantom = (_a = w === null || w === void 0 ? void 0 : w.phantom) === null || _a === void 0 ? void 0 : _a.solana;
+    if (phantom && typeof phantom.signMessage === 'function')
+        return phantom;
+    const generic = w === null || w === void 0 ? void 0 : w.solana;
+    if (generic && typeof generic.signMessage === 'function')
+        return generic;
+    return null;
+}
+
 // issuer-logout-bounce.ts - commit the top-level navigation that ends the hosted
 // issuer's browser session (the Better Auth cookie on auth.bounded.sh).
 //
@@ -4533,6 +4564,108 @@ async function openHiddenSignerFrame(page) {
     };
 }
 
+// turnkey-signer-window.ts - the top-level Bounded signer window: opening it, and reserving it
+// inside a click for an approval that is reached only after awaits.
+//
+// A cross-app Turnkey signature (the capability says `transport: 'popup'`) cannot run in the
+// in-app frame, so it opens in its own window, and a browser opens a window only inside the
+// user's click. The click handler therefore calls `reserveSignerPopup()` first, before any
+// `await`, and the exchange in turnkey-signer-bridge.ts navigates that window to the signer later.
+//
+// Kept out of the bridge on purpose: the bridge is loaded lazily as a whole module, so a bundler
+// keeps every one of its exports in every app that signs, while this reservation is needed only
+// by an app that funds an escrow.
+function openSignerWindow(url, w = 420, h = 620) {
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    return window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+}
+// One slot: the next popup exchange takes it, and a new reservation replaces an unused earlier one.
+// A property of a const rather than a reassigned `let`, which a bundler would keep every assignment
+// to, dragging the reservation into apps that never reserve.
+const reserved = { popup: null };
+/** Write `text` into the window; false when the window is not ours to write (it still works: it is navigated to the signer next). */
+function paint(popup, text) {
+    try {
+        const { document: doc } = popup;
+        doc.title = 'Bounded';
+        doc.documentElement.style.colorScheme = 'light dark';
+        doc.body.style.cssText = 'margin:0;padding:24px;box-sizing:border-box;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;font:15px system-ui,sans-serif;background:Canvas;color:CanvasText';
+        doc.body.textContent = text;
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Open the signer window NOW, synchronously, showing a neutral "Preparing your approval..."
+ * page (a blank document with local text, no remote content). Call it from a user gesture,
+ * before any `await`, and `release()` it when the flow ends. A cross-app Turnkey signature
+ * then runs in this window instead of needing a fresh gesture.
+ * Returns null when there is no DOM or the browser blocked the window.
+ */
+function reserveSignerPopup() {
+    var _a;
+    if (typeof window === 'undefined' || typeof document === 'undefined')
+        return null;
+    try {
+        (_a = reserved.popup) === null || _a === void 0 ? void 0 : _a.close();
+    }
+    catch ( /* already closed */_b) { /* already closed */ }
+    let popup = null;
+    try {
+        popup = openSignerWindow('');
+    }
+    catch ( /* a sandboxed page may throw instead of returning null */_c) { /* a sandboxed page may throw instead of returning null */ }
+    reserved.popup = popup;
+    if (!popup)
+        return null;
+    paint(popup, 'Preparing your approval...');
+    return {
+        release(message) {
+            const unused = reserved.popup === popup;
+            if (unused)
+                reserved.popup = null;
+            try {
+                if (!message || !unused || popup.closed)
+                    return popup.close();
+                const text = message.slice(0, 160);
+                if (!paint(popup, text))
+                    return popup.close(); // not a window of ours to write on, so no message to linger on
+                // Close it only while it still shows this text: a window that was reserved again or sent on to
+                // the signer in the meantime is no longer ours to close.
+                setTimeout(() => { try {
+                    if (popup.document.body.textContent === text)
+                        popup.close();
+                }
+                catch ( /* sent on to the signer */_a) { /* sent on to the signer */ } }, 1500);
+            }
+            catch ( /* already closed */_a) { /* already closed */ }
+        },
+    };
+}
+/** Hand the reserved window, if one is held, to an exchange: navigated to the signer page at `url`. */
+function takeReservedPopup(url) {
+    const popup = reserved.popup;
+    reserved.popup = null;
+    if (!popup)
+        return null;
+    if (popup.closed)
+        throw new Error('Wallet approval window was closed before it completed.');
+    try {
+        popup.location.replace(url);
+    }
+    catch (_a) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw new Error('Wallet approval window could not open the signer - retry from a click.');
+    }
+    return popup;
+}
+
 // turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
 // kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
 //
@@ -4544,9 +4677,10 @@ async function openHiddenSignerFrame(page) {
 // so a regression here (a dropped capability, a wrong route, a swallowed error) is
 // caught without a browser.
 // POST the Bounded id token + payload hash to the issuer's capability mint route and
-// return the issuer-signed capability for exactly these bytes. Credential-free: identity
-// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
-// would not carry). Throws with the same stable messages the bridge relied on inline.
+// return the issuer-signed capability for exactly these bytes, with the transport the
+// issuer requires for them. Credential-free: identity is proven with the id token in the
+// body (not an ambient cookie the cross-origin fetch would not carry). Throws with the same
+// stable messages the bridge relied on inline.
 async function requestTurnkeySigningCapability(opts) {
     const base = opts.baseUrl.replace(/\/$/, '');
     let res;
@@ -4576,7 +4710,7 @@ async function requestTurnkeySigningCapability(opts) {
     if (!d || typeof d.capability !== 'string' || !d.capability) {
         throw new Error('Turnkey signing capability was malformed.');
     }
-    return d.capability;
+    return d.transport === 'popup' ? { capability: d.capability, transport: 'popup' } : { capability: d.capability };
 }
 // Assemble the `bounded:turnkey:sign` postMessage request, carrying the issuer-signed
 // capability for the same bytes. Without the capability the hosted signer refuses
@@ -4667,12 +4801,16 @@ function hasDOM$3() {
 // when we cannot embed (no DOM, or the frame never mounts/loads). Nothing in the
 // email-session flow needs a popup by preference: the code entry and the approval
 // click both run fine inside a cross-origin iframe on every engine (the old
-// Safari popup preference existed only for in-iframe WebAuthn CREATE).
+// Safari popup preference existed only for in-iframe WebAuthn CREATE). The one
+// exception is a signature the issuer marks `transport: 'popup'` (a cross-app
+// write): the hosted signer refuses it inside any frame, so it never touches the widget.
 async function deliver(url, origin, ex) {
     var _a, _b;
     const popup = () => runPopup(url, origin, ex);
     (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
-    const result = await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
+    const result = ex.transport === 'popup'
+        ? await popup()
+        : await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
     (_b = ex.assertCurrent) === null || _b === void 0 ? void 0 : _b.call(ex);
     return result;
 }
@@ -4744,14 +4882,12 @@ function activeTurnkeyAddress() {
         : null;
 }
 let requestSeq = 0;
-// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
-// resolve when `onResult` accepts a result message. Origin + source are pinned.
+// Shared popup driver: open the signer page (in the reserved window when one is held), do the
+// ready/postMessage handshake, and resolve when `onResult` accepts a result message. Origin +
+// source are pinned.
 async function runPopup(url, signerOrigin, ex) {
-    var _a, _b;
-    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
-    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
-    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    var _a;
+    const popup = (_a = takeReservedPopup(url)) !== null && _a !== void 0 ? _a : openSignerWindow(url, ex.width, ex.height);
     if (!popup) {
         throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the wallet approval window can open.');
     }
@@ -5001,7 +5137,7 @@ async function signSolanaMessageViaTurnkey(message) {
     const messageHex = toHex(message);
     // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
     // refuse (capability_required) without it. Fetched per signature (each is single-payload).
-    const capability = await fetchSigningCapability(messageHex, context);
+    const { capability, transport } = await fetchSigningCapability(messageHex, context);
     // Inline (authMode:"turnkey") sessions plant no Better Auth cookie on the issuer, so the
     // signer's same-origin status/create fetches need a bearer session proof: attach the
     // createWallet action authorization (it covers the sign flow's get-or-create too). Minted
@@ -5010,11 +5146,20 @@ async function signSolanaMessageViaTurnkey(message) {
     return await deliver(url, origin, {
         context: context.key, assertCurrent: context.assertCurrent,
         request: buildTurnkeySignRequest({ requestId, messageHex, capability, authorization }),
+        transport,
         onResult: (d) => {
             if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
-                setWalletSessionState(context.key, { status: 'ready', expiresAt: Number(d.signingSessionExpiresAt) });
+                // A top-level popup keeps its signing session in the signer origin's own storage, which the
+                // warm in-app frame (a partitioned context) cannot see, so it says nothing about that frame.
+                if (transport !== 'popup')
+                    setWalletSessionState(context.key, { status: 'ready', expiresAt: Number(d.signingSessionExpiresAt) });
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
             }
+            // The hosted signer refuses a cross-app signature inside a frame. Never retry it from here:
+            // the top-level window needs the user's own click.
+            if (d.error === 'top_level_required') {
+                return { error: 'top_level_required: an approval that writes to another app must open in its own window. Start it from a click handler.' };
+            }
             return { error: String(d.error || 'Turnkey signing failed') };
         },
     });
@@ -6330,7 +6475,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-nDZjRDpj.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-ByNBWdfi.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6372,7 +6517,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dj-F69gb.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BLRrB2rb.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6385,7 +6530,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-C4aKa2v1.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-C4vNOS4P.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6410,7 +6555,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-ejUTbjCC.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-CGN4k_LG.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6472,7 +6617,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-ejUTbjCC.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-CGN4k_LG.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6643,7 +6788,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-Dj-F69gb.mjs');
+            await import('./injected-wallet-provider-BLRrB2rb.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6725,10 +6870,12 @@ async function loginWithWallet(options) {
     // one that yields nothing and then a wallet prepares the mobile registry
     // after the tap for a wallet it never uses.
     const pinnedProvider = (_b = (_a = injectedConfig.getProvider) === null || _a === void 0 ? void 0 : _a.call(injectedConfig)) !== null && _b !== void 0 ? _b : null;
+    if (injectedConfig.getProvider && !pinnedProvider)
+        throw new Error(SELECTED_WALLET_UNAVAILABLE_ERR);
     const attemptConfig = Object.assign(Object.assign({}, injectedConfig), { 
-        // Still a fallthrough when it resolved nothing, exactly as before - the
-        // difference is that the answer is now fixed for this attempt.
-        getProvider: () => pinnedProvider });
+        // An explicit choice stays pinned. With no getter, retain default
+        // discovery rather than manufacturing an unavailable explicit choice.
+        getProvider: injectedConfig.getProvider ? () => pinnedProvider : undefined });
     // Idempotent: a caller that prepared the lane (the widget, or an app that
     // awaited ensureWalletLoginReady before enabling its button) has already
     // paid for this, so nothing activation-sensitive happens after the tap. A
@@ -6737,16 +6884,16 @@ async function loginWithWallet(options) {
     //
     // "Pinned" is about the EFFECTIVE resolution, not whether a getter was
     // passed: a configured walletLogin.getProvider pins just as much as a
-    // per-call one, and a getter that returns nothing falls through to discovery
-    // (and so to the mobile wallet). With a real wallet in hand only the shared
-    // half is needed - re-attempting a failed mobile registration would be
+    // per-call one. An unavailable explicit choice was refused above. With a
+    // real wallet in hand only the shared half is needed - re-attempting a
+    // failed mobile registration would be
     // exactly the work-after-the-tap this exists to avoid, for a wallet this
     // login is not even using.
     if (pinnedProvider)
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dj-F69gb.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-BLRrB2rb.mjs');
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -7574,15 +7721,28 @@ function hasFeature(wallet, name) {
 function supportsSolana(wallet) {
     return wallet.chains.some((c) => c.startsWith("solana:"));
 }
-/** A wallet is LISTED for Bounded login when it can connect + sign a message on a
- *  Solana chain. Login itself needs the `solana:signIn` feature (SEC-01); that is
- *  checked at login time in InjectedWalletProvider, where a wallet without it is
- *  refused with the reason spelled out rather than silently missing from the list.
- *  Transaction features are optional and checked lazily at call time. */
-function isLoginCapable(wallet) {
+/** A Solana wallet the SDK can connect and use for message signing. */
+function isSolanaWallet(wallet) {
+    var _a, _b;
     return (supportsSolana(wallet) &&
-        hasFeature(wallet, StandardConnect) &&
-        hasFeature(wallet, SolanaSignMessage));
+        typeof ((_a = feature(wallet, StandardConnect)) === null || _a === void 0 ? void 0 : _a.connect) === "function" &&
+        typeof ((_b = feature(wallet, SolanaSignMessage)) === null || _b === void 0 ? void 0 : _b.signMessage) === "function");
+}
+/** Login choices must support the same SIWS operation login() requires.
+ *  Transaction features remain optional and are checked at call time. */
+function isLoginCapable(wallet) {
+    var _a, _b;
+    return isSolanaWallet(wallet) && supportsWalletSignIn({
+        connect: (_a = feature(wallet, StandardConnect)) === null || _a === void 0 ? void 0 : _a.connect,
+        signIn: (_b = feature(wallet, SolanaSignIn)) === null || _b === void 0 ? void 0 : _b.signIn,
+    });
+}
+/** Distinguish unsupported installed wallets from an empty registry in the UI. */
+function hasUnsupportedStandardWallets(configuredNetwork) {
+    if (typeof window === "undefined")
+        return false;
+    const chain = configuredNetwork ? solanaChainOrNull(configuredNetwork) : null;
+    return getWallets().get().some((wallet) => (isSolanaWallet(wallet) && (!chain || wallet.chains.includes(chain)) && !isLoginCapable(wallet)));
 }
 /** The Wallet-Standard chain id for a configured network, or null when it is
  *  absent/unsupported. Ordering must never throw - failing closed on an
@@ -7611,6 +7771,7 @@ function feature(wallet, name) {
  * an unconfigured network fails closed at sign time rather than defaulting.
  */
 function standardWalletToInjectedProvider(wallet, configuredNetwork) {
+    var _a;
     // The adapter holds NO account of its own: `wallet.accounts` is the Wallet
     // Standard's live authorized-account view, kept in sync by the wallet itself
     // (it emits standard:events 'change' when it moves). Reading it on every
@@ -7710,12 +7871,12 @@ function standardWalletToInjectedProvider(wallet, configuredNetwork) {
             const disconnect = feature(wallet, StandardDisconnect);
             if (disconnect)
                 await disconnect.disconnect();
-        } }, (hasFeature(wallet, SolanaSignIn)
+        } }, (typeof ((_a = feature(wallet, SolanaSignIn)) === null || _a === void 0 ? void 0 : _a.signIn) === "function"
         ? {
             async signIn(input) {
                 var _a;
                 const sign = feature(wallet, SolanaSignIn);
-                if (!sign)
+                if (typeof (sign === null || sign === void 0 ? void 0 : sign.signIn) !== "function")
                     throw new Error("Wallet does not support solana:signIn");
                 const open = currentAccount();
                 if (open && !accountSupports(open, SolanaSignIn))
@@ -8263,14 +8424,12 @@ function walletGlyph() {
     return svg;
 }
 function isInjectedProvider(v) {
-    return (typeof v === "object" &&
-        v !== null &&
-        typeof v.signMessage === "function");
+    return supportsWalletSignIn(v);
 }
 // Enumerate native wallets via the Solana Wallet Standard registry (NOT a
-// hardcoded name list) - every wallet that registered itself shows up with its
-// real name + icon - and ALSO an older wallet that never registers and only
-// exposes `window.solana`.
+// hardcoded name list) - wallets that support Bounded sign-in show up with
+// their real name + icon - and ALSO an eligible older wallet that never
+// registers and only exposes `window.solana`.
 //
 // The legacy `window.solana` probe fills in for a wallet too old to register
 // itself. The rule it has always encoded is "no BROWSER wallet registered", and
@@ -8305,7 +8464,11 @@ const BUSY_MSG = "A sign-in is already in progress - finish or cancel it first."
 // no wallet in this browser). A phone browser never sees installed wallet apps
 // as injected providers, so the honest advice there is a different browser,
 // not "install a wallet".
-function noLaneCopy(mobile) {
+function noLaneCopy(mobile, unsupportedWallets) {
+    if (unsupportedWallets) {
+        return "The wallets detected in this browser cannot sign in to Bounded. " +
+            "Use a wallet that supports Sign In With Solana, then reload this page.";
+    }
     return mobile
         ? "No wallet is available in this browser. Open this page in your wallet app's " +
             "browser, or on a desktop browser with a wallet extension, then try again."
@@ -8503,6 +8666,9 @@ async function prepareAndOpen(opts, pending) {
     // button with no wallet behind it.
     if (wallets.length === 0)
         walletEnabled = false;
+    const defaultWallet = defaultInjectedProvider();
+    const unsupportedWallets = !lane.hardOff && lane.requested !== false && (hasUnsupportedStandardWallets(network) ||
+        (defaultWallet !== null && !supportsWalletSignIn(defaultWallet)));
     const authMode = (_b = opts.authMode) !== null && _b !== void 0 ? _b : authApi.resolveAuthMode(initCfg);
     // Widget text: per-call options win, then init() loginWidget config, then the
     // defaults ("Sign in" / the Bounded subline; "" suppresses the subline).
@@ -8881,14 +9047,19 @@ async function prepareAndOpen(opts, pending) {
             // screen, and name the usual cause once in the console, where the
             // developer's own preview run will show it.
             if (!hasEmail && social.length === 0 && !walletEnabled) {
-                card.appendChild(el("p", "sub", noLaneCopy(detectMobile())));
+                card.appendChild(el("p", "sub", noLaneCopy(detectMobile(), unsupportedWallets)));
                 console.warn("[Bounded] openBoundedWidget has no sign-in lane to show: the app asked for " +
-                    "no email or social method and no wallet is available in this browser. " +
-                    (offerMobile
+                    "no email or social method and " +
+                    (unsupportedWallets
+                        ? "the detected wallets do not support Sign In With Solana. "
+                        : "no wallet is available in this browser. ") +
+                    (offerMobile && !unsupportedWallets
                         ? "On Android the Solana Mobile wallet is offered only when the app installs " +
                             "'@solana-mobile/wallet-standard-mobile' (see the warning above if registration failed); "
                         : "") +
-                    "Add a method, or make sure wallet login is enabled and the mobile adapter is installed.");
+                    (unsupportedWallets
+                        ? "Add another sign-in method, or use a wallet that supports Sign In With Solana."
+                        : "Add a method, or make sure wallet login is enabled and the mobile adapter is installed."));
             }
             card.appendChild(status);
             const foot = el("div", "foot");
@@ -10475,7 +10646,7 @@ async function onrampStatus(sinceMs) {
 function isSuccess(t) {
     return /SUCCESS|COMPLETED/i.test(t.status);
 }
-function isPending(t) {
+function isPending$1(t) {
     return /PROGRESS|PENDING|CREATED/i.test(t.status);
 }
 async function verifyCompletion(openedAt, asset, timeoutMs) {
@@ -10489,7 +10660,7 @@ async function verifyCompletion(openedAt, asset, timeoutMs) {
             const done = txs.find((t) => isSuccess(t) && (t.asset === null || t.asset === asset));
             if (done)
                 return done;
-            sawPending = txs.some(isPending);
+            sawPending = txs.some(isPending$1);
         }
         catch ( /* transient - keep polling until the deadline */_a) { /* transient - keep polling until the deadline */ }
         // No completed fill and nothing in flight: one grace poll cycle still
@@ -10595,6 +10766,570 @@ async function onramp(options = {}) {
     return Object.assign(Object.assign({}, base), { status: 'closed' });
 }
 
+// venue-escrow.ts - fund and dispute a venue escrow from inside an OpenApps app (VENUE-GRANT-DESIGN.md).
+//
+// An OpenApps app's escrow lives in its venue (`agentescrows/<rootAppId>/e/<escrowId>`), and this
+// app's session cannot write another app's data. Bounded Auth therefore mints a 5 minute,
+// single-use GRANT for exactly one create (`POST {humanAuthApiUrl}/app-token/venue-grant`;
+// contract: packages/cdk/cloudflare/shared/venue-grant.ts, which the SDK cannot import because the
+// packages publish separately, so only what is needed is mirrored here), and the venue builds the
+// transaction for the wallet signed in here. The money's only authority is that wallet's
+// signature, checked onchain by the venue's own rule; the grant adds no power to the app.
+//
+// Funding moves money, so it keeps the recovery semantics oapps-fun's retired escrow page proved:
+// a pending record is saved BEFORE any network call and checked before ever funding again; the
+// escrow id is stable across retries; an uncertain broadcast is settled by its signature or the
+// public receipt and never re-sent; one tab funds at a time; and a row that does not match every
+// term is `taken`, never funded.
+/** Thrown by every venue escrow call. Branch on `code`; `error.name === 'VenueEscrowError'` also holds across bundled SDK copies. */
+class VenueEscrowError extends Error {
+    constructor(code, message, details = {}) {
+        super(message);
+        this.name = 'VenueEscrowError';
+        this.code = code;
+        if (details.escrowId !== undefined)
+            this.escrowId = details.escrowId;
+        if (details.cause !== undefined)
+            this.cause = details.cause;
+    }
+}
+const ESCROW_SCHEMA = 'openapps.agent-escrow.v1';
+const STORAGE_PREFIX = 'bounded.venue-escrow-funding.v1';
+/** A saved funding that shows no row and no signature this long after its save can no longer land. */
+const ABANDONED_MS = 5 * 60000;
+const RECEIPT_POLL_MS = [0, 250, 500, 1000, 1500, 2500, 4000];
+const ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+const APP_ID = /^[0-9a-f]{24}$/;
+const RECORD_ID = /^[0-9a-f]{32}$/;
+/**
+ * Bounded Auth's own refusals of a grant mint, passed through as codes, with what each means to a
+ * person: the error's message, and so what the reserved signer window shows before it closes.
+ */
+const GRANT_REFUSALS = {
+    invalid_request: 'The request was not accepted. Update the app and try again.',
+    invalid_token: 'Your session expired. Sign in again.',
+    origin_not_allowed: "This site isn't allowed to fund escrows for this app.",
+    not_an_openapps_app: "This app can't fund escrows.",
+    wallet_required: 'Sign in with a wallet to fund escrows.',
+    agent_wallet_refused: "An agent's wallet can't fund escrows here.",
+    rate_limited: 'Too many attempts. Try again in a minute.',
+    venue_grant_unavailable: 'Escrows are unavailable right now. Try again shortly.',
+};
+const nowSeconds = () => Math.floor(Date.now() / 1000);
+/** A v0 dispute transaction stops fitting past about 513 reason bytes; this keeps a margin. */
+const MAX_DISPUTE_REASON_BYTES = 400;
+const isCount = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+const newRecordId = () => Array.from(getPlatform().getRandomBytes(16), (byte) => byte.toString(16).padStart(2, '0')).join('');
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Mirrors `venueGrantPath` in shared/venue-grant.ts: the one path a grant of this kind may create. */
+function recordPath(kind, rootAppId, id) {
+    return kind === 'escrow' ? `agentescrows/${rootAppId}/e/${id}` : `agentescrowdisputes/${rootAppId}/d/${id}`;
+}
+/** Who is signed in, read synchronously: the click handler must not await before it reserves the signer window. */
+function sessionIdentity() {
+    const appId = getConfiguredAppId();
+    let idToken = null;
+    try {
+        idToken = getActiveSessionManager().getIdToken();
+    }
+    catch ( /* no session store */_a) { /* no session store */ }
+    if (!appId || !idToken)
+        throw new VenueEscrowError('sign_in_required', 'Sign in before using venue escrows.');
+    const wallet = deriveUserIdentityFromIdToken(idToken).address;
+    if (!wallet)
+        throw new VenueEscrowError('wallet_required', 'This session has no wallet to sign with.');
+    return { appId, wallet };
+}
+async function mintGrant(kind, id, wallet) {
+    var _a;
+    let idToken = null;
+    try {
+        idToken = await getFreshAuthToken(false);
+    }
+    catch ( /* an expired session reads as signed out */_b) { /* an expired session reads as signed out */ }
+    if (!idToken)
+        throw new VenueEscrowError('sign_in_required', 'Your session expired. Sign in again.');
+    if (deriveUserIdentityFromIdToken(idToken).address !== wallet) {
+        throw new VenueEscrowError('wallet_changed', 'The signed-in wallet changed. Start again.');
+    }
+    const base = ((await getConfig()).humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    let response;
+    try {
+        response = await fetch(`${base}/app-token/venue-grant`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ idToken, kind, id, walletProtocol: 2 }),
+        });
+    }
+    catch (cause) {
+        throw new VenueEscrowError('venue_grant_unavailable', 'Could not reach Bounded Auth to authorize this write.', { cause });
+    }
+    const body = (await response.json().catch(() => null));
+    if (!response.ok) {
+        const error = typeof (body === null || body === void 0 ? void 0 : body.error) === 'string' ? body.error : '';
+        const code = Object.keys(GRANT_REFUSALS).includes(error) ? error : response.status >= 500 ? 'venue_grant_unavailable' : 'venue_grant_refused';
+        throw new VenueEscrowError(code, (_a = GRANT_REFUSALS[code]) !== null && _a !== void 0 ? _a : `Bounded Auth refused the venue grant (${error || response.status}).`);
+    }
+    const fields = body !== null && body !== void 0 ? body : {};
+    const { grant, venueAppId, rootAppId, walletAddress, path } = fields;
+    if (typeof grant !== 'string' || !grant || typeof venueAppId !== 'string' || !APP_ID.test(venueAppId)
+        || typeof rootAppId !== 'string' || !APP_ID.test(rootAppId) || walletAddress !== wallet || path !== recordPath(kind, rootAppId, id)) {
+        throw new VenueEscrowError('venue_grant_unavailable', 'Bounded Auth answered with a grant that does not match this write.');
+    }
+    return { grant, venueAppId, rootAppId, path };
+}
+/* ------------------------------- reading -------------------------------- */
+/**
+ * Read one venue escrow from the public record: its terms and its state (`pending` until the
+ * venue's hook completes, `failed` when it did not). Resolves null when no such escrow exists.
+ * No sign-in is needed.
+ */
+async function getVenueEscrow(input) {
+    var _a;
+    const { rootAppId, escrowId } = input !== null && input !== void 0 ? input : {};
+    if (!APP_ID.test(String(rootAppId)) || !RECORD_ID.test(String(escrowId))) {
+        throw new VenueEscrowError('invalid_input', 'getVenueEscrow needs a rootAppId (24 hex characters) and an escrowId (32 hex characters).');
+    }
+    const base = (_a = (await getConfig()).devApiUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/$/, '');
+    if (!base)
+        throw new VenueEscrowError('read_unavailable', 'The Bounded developer API is not configured. Pass a Bounded network to init().');
+    let response;
+    try {
+        // The 200 is cacheable for a minute, and a funding is polled through `pending`.
+        response = await fetch(`${base}/public/oapp/${rootAppId}/escrows/${escrowId}`, { cache: 'no-store' });
+    }
+    catch (cause) {
+        throw new VenueEscrowError('read_unavailable', 'Could not reach the Bounded developer API.', { cause });
+    }
+    if (response.status === 404)
+        return null;
+    const body = (await response.json().catch(() => null));
+    if (!response.ok || (body === null || body === void 0 ? void 0 : body.ok) !== true || !body.escrow || typeof body.escrow !== 'object') {
+        throw new VenueEscrowError('read_unavailable', `The escrow could not be read (${response.status}).`);
+    }
+    return body.escrow;
+}
+/**
+ * The overrides that point a receipt's reconciliation at the venue it was issued for and the RPC of
+ * the chain it ran on (the same one the write was broadcast through), with no credential.
+ */
+async function venueReadOverrides(venueAppId, chain) {
+    var _a;
+    const config = await getConfig();
+    const rpcUrl = (_a = resolveVenueRpcUrl(config, chain, defaultSolanaRpcUrl)) !== null && _a !== void 0 ? _a : config.rpcUrl;
+    return { _config: Object.assign(Object.assign({}, config), { appId: venueAppId, rpcUrl }), _readOnly: true };
+}
+const TERM_KEYS = ['payee', 'amountUsdc', 'challengeSeconds', 'expiresAt', 'ref'];
+/** Every term the funder signed, which a row must carry in full to be this funding. */
+const ROW_KEYS = ['schemaVersion', 'funder', 'payee', 'amountUsdc', 'challengeSeconds', 'expiresAt', 'ref', 'at'];
+/** The first thing wrong with these terms, or null. Shapes only: the venue's rule owns every bound. */
+function termsProblem(terms, wallet) {
+    if (!terms || typeof terms.payee !== 'string' || !ADDRESS.test(terms.payee))
+        return 'payee must be a Solana address';
+    if (terms.payee === wallet)
+        return 'payee must not be the wallet that is funding';
+    for (const key of ['amountUsdc', 'challengeSeconds', 'expiresAt']) {
+        if (!isCount(terms[key]))
+            return `${key} must be a non-negative integer`;
+    }
+    if (typeof terms.ref !== 'string' || terms.ref.length < 1 || terms.ref.length > 128)
+        return 'ref must be 1 to 128 characters';
+    return null;
+}
+function isSavedSubmission(value) {
+    var _a, _b;
+    const saved = value;
+    return !!saved && saved.status === 'submitted' && typeof saved.appId === 'string' && typeof saved.chain === 'string'
+        && typeof saved.transactionId === 'string' && saved.transactionId.length > 0
+        && typeof saved.signedTransaction === 'string' && Array.isArray(saved.requestedDocuments)
+        && typeof ((_a = saved.fence) === null || _a === void 0 ? void 0 : _a.blockhash) === 'string' && Number.isSafeInteger((_b = saved.fence) === null || _b === void 0 ? void 0 : _b.lastValidBlockHeight);
+}
+function isPending(value, wallet) {
+    const doc = value === null || value === void 0 ? void 0 : value.document;
+    const sent = (value === null || value === void 0 ? void 0 : value.path) !== undefined;
+    return RECORD_ID.test(String(value === null || value === void 0 ? void 0 : value.escrowId)) && Number.isSafeInteger(value.savedAtMs) && value.savedAtMs > 0
+        && !!doc && doc.schemaVersion === ESCROW_SCHEMA && doc.funder === wallet && termsProblem(doc, wallet) === null && isCount(doc.at)
+        && [doc.approvedAt, doc.approvedKind, doc.approvalId, doc.disputedAt, doc.disputedBy, doc.settledAt, doc.settledKind, doc.settledBy].every((field) => field === null)
+        && (!sent || (APP_ID.test(String(value.rootAppId)) && APP_ID.test(String(value.venueAppId)) && value.path === recordPath('escrow', value.rootAppId, value.escrowId)))
+        && (value.submission === undefined || isSavedSubmission(value.submission));
+}
+function store() {
+    const storage = getPlatform().storage;
+    // A volatile fallback would forget a funding that may have landed, and the next click would send a second one.
+    if (isVolatileStorage(storage))
+        throw new VenueEscrowError('storage_unavailable', 'Venue escrow funding needs durable browser storage.');
+    return storage;
+}
+function loadPending(key, wallet) {
+    const storage = store();
+    try {
+        const raw = storage.getItem(key);
+        if (!raw)
+            return null;
+        const value = JSON.parse(raw);
+        if (!isPending(value, wallet))
+            throw new Error('malformed');
+        return value;
+    }
+    catch (_a) {
+        throw new VenueEscrowError('storage_unavailable', 'The saved escrow funding could not be read, so another one will not be started.');
+    }
+}
+function savePending(key, pending) {
+    const storage = store();
+    try {
+        storage.setItem(key, JSON.stringify(pending));
+    }
+    catch (_a) {
+        throw new VenueEscrowError('storage_unavailable', 'The escrow funding could not be saved, so it was not sent.');
+    }
+}
+function clearPending(key, escrowId) {
+    try {
+        const raw = store().getItem(key);
+        if (raw && JSON.parse(raw).escrowId === escrowId)
+            store().removeItem(key);
+    }
+    catch ( /* unreadable: the next call refuses to fund over it */_a) { /* unreadable: the next call refuses to fund over it */ }
+}
+function rowVerdict(pending, row) {
+    var _a, _b;
+    if (!ROW_KEYS.every((key) => row[key] === pending.document[key]))
+        return { state: 'taken' };
+    if (row.state === 'failed')
+        return { state: 'failed' };
+    if (row.state === 'pending')
+        return { state: 'pending' };
+    return { state: 'completed', transactionId: (_b = (_a = pending.submission) === null || _a === void 0 ? void 0 : _a.transactionId) !== null && _b !== void 0 ? _b : null };
+}
+/** Settle a saved funding without sending anything: the public row first, then its signature, then its age. */
+async function checkPending(pending) {
+    if (!pending.path)
+        return { state: 'not_applied', reason: 'it was interrupted before the venue was asked.' };
+    let row;
+    try {
+        row = await getVenueEscrow({ rootAppId: pending.rootAppId, escrowId: pending.escrowId });
+    }
+    catch (_a) {
+        return { state: 'pending' };
+    }
+    if (row)
+        return rowVerdict(pending, row);
+    if (pending.submission) {
+        try {
+            const settled = await reconcileSetResult(pending.submission, { _overrides: await venueReadOverrides(pending.venueAppId, pending.submission.chain) });
+            if (settled.status === 'confirmed')
+                return { state: 'completed', transactionId: settled.transactionId };
+            if (settled.status === 'expired_not_landed')
+                return { state: 'not_applied', reason: 'it expired before it reached the chain.' };
+        }
+        catch (error) {
+            if (writeNotAppliedPhase(error) !== null)
+                return { state: 'not_applied', reason: 'the transaction failed onchain.' };
+        }
+        return { state: 'pending' };
+    }
+    return Date.now() - pending.savedAtMs >= ABANDONED_MS
+        ? { state: 'not_applied', reason: 'no transaction was ever recorded for it, and it can no longer land.' }
+        : { state: 'pending' };
+}
+/** Poll the public row until it settles: a direct poofnet commit is not funded until the venue's hook stamps it. */
+async function awaitRow(pending) {
+    for (const delay of RECEIPT_POLL_MS) {
+        if (delay)
+            await pause(delay);
+        let row = null;
+        try {
+            row = await getVenueEscrow({ rootAppId: pending.rootAppId, escrowId: pending.escrowId });
+        }
+        catch ( /* keep polling */_a) { /* keep polling */ }
+        const verdict = row ? rowVerdict(pending, row) : null;
+        if (verdict && verdict.state !== 'pending')
+            return verdict;
+    }
+    return { state: 'pending' };
+}
+/** The one place a funding ends: return its result, or release the saved record and throw why not. */
+function conclude(key, pending, verdict, terms) {
+    const { escrowId } = pending;
+    if (verdict.state === 'pending') {
+        throw new VenueEscrowError('pending', 'The funding is not confirmed yet. Call fundVenueEscrow again with the same terms to check it; do not start another.', { escrowId });
+    }
+    clearPending(key, escrowId);
+    switch (verdict.state) {
+        case 'completed':
+            if (terms && !TERM_KEYS.every((term) => pending.document[term] === terms[term])) {
+                throw new VenueEscrowError('funded_other_terms', `An earlier, interrupted funding with different terms landed as escrow ${escrowId}. Check it with getVenueEscrow before funding again.`, { escrowId });
+            }
+            return { escrowId, rootAppId: pending.rootAppId, venueAppId: pending.venueAppId, transactionId: verdict.transactionId };
+        case 'taken':
+            throw new VenueEscrowError('taken', 'A different record already holds this escrow id, so this funding did not land.', { escrowId });
+        case 'failed':
+            throw new VenueEscrowError('failed', 'The venue accepted the funding but its hook failed, so nothing moved. Try again.', { escrowId });
+        default:
+            throw new VenueEscrowError('not_applied', `The funding did not go through: ${verdict.reason} nothing moved. Try again.`, { escrowId });
+    }
+}
+/**
+ * Read a thrown write: what the SDK, the wallet or the venue said, as a code. The venue's own code
+ * is read before its status, because a 403 is not always its rule: a grant outside its scope
+ * (`venue_grant_scope`), a forbidden precondition or a signer that does not match the signing
+ * request are not, and only a decline (or the program's own rule rejection) is `rule_refused`.
+ */
+function mapWriteError(error) {
+    var _a;
+    if (error instanceof VenueEscrowError)
+        return error;
+    const e = (error !== null && error !== void 0 ? error : {});
+    const text = typeof e.message === 'string' ? e.message : String(error);
+    const code = e.code === 'chain_mismatch' || e.code === 'chain_not_configured' || e.code === 'sponsorship_refused' || e.code === 'sponsorship_unavailable' ? e.code
+        : e.name === 'InsufficientBalanceError' ? 'insufficient_balance'
+            : e.code === 'venue_grant_scope' || e.statusCode === 401 ? 'grant_rejected'
+                : e.isBoundedDecline === true || e.boundedRuleRejection === true ? 'rule_refused'
+                    : e.statusCode === 429 ? 'rate_limited'
+                        : /^top_level_required/.test(text) ? 'top_level_required'
+                            : /popup blocked/i.test(text) ? 'popup_blocked'
+                                // The wallet's or the window's own words only: a venue answer that happens to say "denied" is not the user declining.
+                                : e.statusCode === undefined && /user rejected|rejected the request|declined|denied|cancel|window was closed/i.test(text) ? 'declined'
+                                    : 'write_failed';
+    const message = code === 'rule_refused' && typeof ((_a = e.decline) === null || _a === void 0 ? void 0 : _a.message) === 'string' ? e.decline.message
+        : e.boundedRuleRejection === true ? 'The venue\'s onchain rules refused this write, usually because the approval took longer than the two minutes a write stays valid. Start again.'
+            : text;
+    return new VenueEscrowError(code, message, { cause: error });
+}
+/** What a write that returned, rather than threw, means for this funding. */
+async function settleResult(key, pending, result, terms) {
+    var _a;
+    let current = result;
+    if (current.status === 'submitted') {
+        try {
+            current = await waitForSetResult(current, { _overrides: await venueReadOverrides(pending.venueAppId, current.chain), timeoutMs: 60000 });
+        }
+        catch (error) {
+            if (writeNotAppliedPhase(error) !== null) {
+                clearPending(key, pending.escrowId);
+                throw mapWriteError(error);
+            }
+        }
+    }
+    switch (current.status) {
+        case 'confirmed':
+            return conclude(key, pending, { state: 'completed', transactionId: current.transactionId }, terms);
+        case 'committed': {
+            const verdict = await awaitRow(pending);
+            return conclude(key, pending, verdict.state === 'completed' ? { state: 'completed', transactionId: (_a = current.transactionId) !== null && _a !== void 0 ? _a : verdict.transactionId } : verdict, terms);
+        }
+        case 'expired_not_landed':
+            return conclude(key, pending, { state: 'not_applied', reason: 'it expired before it reached the chain.' }, terms);
+        case 'signed':
+            return conclude(key, pending, { state: 'not_applied', reason: 'it was signed but never sent.' }, terms);
+        default:
+            return conclude(key, pending, { state: 'pending' }, terms);
+    }
+}
+async function fundOrCheck(key, wallet, terms) {
+    const saved = loadPending(key, wallet);
+    if (saved)
+        return conclude(key, saved, await checkPending(saved), terms);
+    let pending = {
+        escrowId: newRecordId(),
+        savedAtMs: Date.now(),
+        document: {
+            payee: terms.payee, amountUsdc: terms.amountUsdc, challengeSeconds: terms.challengeSeconds, expiresAt: terms.expiresAt, ref: terms.ref,
+            schemaVersion: ESCROW_SCHEMA, funder: wallet, at: nowSeconds(),
+            approvedAt: null, approvedKind: null, approvalId: null, disputedAt: null, disputedBy: null,
+            settledAt: null, settledKind: null, settledBy: null,
+        },
+    };
+    const { escrowId } = pending;
+    savePending(key, pending); // before any network call: the id must survive a lost answer
+    let minted;
+    try {
+        minted = await mintGrant('escrow', escrowId, wallet);
+        // The venue's rule holds `at` within two minutes of the chain clock, and the venue bakes it into the
+        // transaction it builds from this write, so it is taken as late as it can be: after the mint, in the save
+        // that adds the venue path, right before the write. The id and document were already saved before any
+        // network call, and nothing has reached the venue yet, so recovery is unchanged.
+        pending = Object.assign(Object.assign({}, pending), { document: Object.assign(Object.assign({}, pending.document), { at: nowSeconds() }), rootAppId: minted.rootAppId, venueAppId: minted.venueAppId, path: minted.path });
+        savePending(key, pending);
+    }
+    catch (error) {
+        clearPending(key, escrowId); // the venue was never asked, so there is nothing to settle
+        throw error;
+    }
+    let result;
+    try {
+        result = await setWithVenueGrant(minted.path, pending.document, {
+            venueAppId: minted.venueAppId,
+            grant: minted.grant,
+            commitGrant: async () => (await mintGrant('escrow', escrowId, wallet)).grant,
+            resolveRpcUrl: defaultSolanaRpcUrl,
+            onBroadcast: (submission) => {
+                const next = Object.assign(Object.assign({}, pending), { submission });
+                savePending(key, next);
+                pending = next;
+            },
+        });
+    }
+    catch (error) {
+        if (writeNotAppliedPhase(error) !== null) {
+            clearPending(key, escrowId);
+            throw mapWriteError(error);
+        }
+        // Anything else may follow a commit or broadcast whose answer was lost: settle it by the public
+        // row, then by the saved signature. Never send again.
+        const verdict = await awaitRow(pending);
+        return conclude(key, pending, verdict.state === 'pending' && pending.submission ? await checkPending(pending) : verdict, terms);
+    }
+    return settleResult(key, pending, result, terms);
+}
+/** Poll the escrow until it shows disputed: a direct poofnet commit is not a dispute until the venue's hook stamps it. */
+async function awaitDisputed(rootAppId, escrowId) {
+    for (const delay of RECEIPT_POLL_MS) {
+        if (delay)
+            await pause(delay);
+        const row = await getVenueEscrow({ rootAppId, escrowId }).catch(() => null);
+        if (row && row.disputedAt !== null)
+            return true;
+    }
+    return false;
+}
+async function dispute(wallet, escrowId, reason) {
+    const disputeId = newRecordId();
+    const minted = await mintGrant('dispute', disputeId, wallet);
+    let result = null;
+    try {
+        result = await setWithVenueGrant(minted.path, { escrowId, reason, at: nowSeconds() }, {
+            venueAppId: minted.venueAppId,
+            grant: minted.grant,
+            commitGrant: async () => (await mintGrant('dispute', disputeId, wallet)).grant,
+            resolveRpcUrl: defaultSolanaRpcUrl,
+        });
+        if (result.status === 'submitted')
+            result = await waitForSetResult(result, { _overrides: await venueReadOverrides(minted.venueAppId, result.chain), timeoutMs: 60000 });
+    }
+    catch (error) {
+        if (writeNotAppliedPhase(error) !== null)
+            throw mapWriteError(error);
+        // Anything else may follow a commit or broadcast whose answer was lost: the escrow says.
+    }
+    const done = { disputeId, rootAppId: minted.rootAppId, venueAppId: minted.venueAppId };
+    if ((result === null || result === void 0 ? void 0 : result.status) === 'confirmed')
+        return Object.assign(Object.assign({}, done), { transactionId: result.transactionId });
+    if ((result === null || result === void 0 ? void 0 : result.status) === 'expired_not_landed' || (result === null || result === void 0 ? void 0 : result.status) === 'signed') {
+        throw new VenueEscrowError('not_applied', 'The dispute never reached the chain, so nothing was sent. Try again.', { escrowId });
+    }
+    if (await awaitDisputed(minted.rootAppId, escrowId)) {
+        return Object.assign(Object.assign({}, done), { transactionId: (result === null || result === void 0 ? void 0 : result.status) === 'committed' ? result.transactionId : null });
+    }
+    throw new VenueEscrowError('pending', 'The dispute was sent but is not confirmed yet. Read the escrow with getVenueEscrow to see whether it shows as disputed.', { escrowId });
+}
+/* ----------------------------- one call at a time ------------------------------ */
+const flights = new Map();
+/**
+ * Run `run` unless an identical call is already in flight (a double click shares its result) or a
+ * different one is (refused, never silently answered with the other's result). A Turnkey session's
+ * signer window is reserved here, synchronously, because this runs inside the click.
+ */
+function startFlow(key, fingerprint, needsSigner, run) {
+    let reservation = null;
+    try {
+        const current = flights.get(key);
+        if (current) {
+            if (current.fingerprint === fingerprint)
+                return current.promise;
+            throw new VenueEscrowError('in_progress', 'A different venue escrow request is already in progress for this wallet.');
+        }
+        if (hasTurnkeyWallet() && needsSigner()) {
+            reservation = reserveSignerPopup();
+            if (!reservation)
+                throw new VenueEscrowError('popup_blocked', 'Call this from a click handler so the wallet approval window can open, and allow popups for this site.');
+        }
+        // A flow that fails before the signer loads (a grant the venue refuses, a rule) leaves the reserved
+        // window to explain itself with the error's words for a moment; one that signed has closed it already.
+        const settled = (error) => {
+            var _a;
+            if (((_a = flights.get(key)) === null || _a === void 0 ? void 0 : _a.promise) === promise)
+                flights.delete(key);
+            reservation === null || reservation === void 0 ? void 0 : reservation.release(error instanceof Error ? error.message : undefined);
+        };
+        const promise = run().then((value) => { settled(); return value; }, (error) => { settled(error); throw error; });
+        flights.set(key, { fingerprint, promise });
+        return promise;
+    }
+    catch (error) {
+        reservation === null || reservation === void 0 ? void 0 : reservation.release(error instanceof Error ? error.message : undefined);
+        return Promise.reject(error);
+    }
+}
+/** One tab funds at a time: the saved record is shared by every tab of this browser. */
+function withLock(key, run) {
+    var _a;
+    const locks = (_a = globalThis.navigator) === null || _a === void 0 ? void 0 : _a.locks;
+    if (!(locks === null || locks === void 0 ? void 0 : locks.request))
+        return Promise.reject(new VenueEscrowError('lock_unavailable', 'Venue escrow funding needs the Web Locks API, so that one tab funds at a time.'));
+    return locks.request(key, { ifAvailable: true }, async (lock) => {
+        if (!lock)
+            throw new VenueEscrowError('in_progress', 'This escrow is already being funded in another tab.');
+        return run();
+    });
+}
+/* --------------------------------- public API ---------------------------------- */
+/**
+ * Lock USDC in the venue escrow for `terms.payee`, signed by the wallet signed in here.
+ * MUST be called from a user click: an email (Turnkey) wallet's approval opens in its own Bounded
+ * window, which a browser only allows inside the click (it is opened here, before anything is
+ * awaited), and the approval shows the decoded terms. A Phantom or Wallet Standard wallet keeps
+ * its own prompt. On a real-chain venue the transaction is broadcast on the VENUE's chain: through
+ * the app's own `rpcUrl` when the app configured that same `chain` too (an `rpcUrl` alone does not
+ * say which chain it speaks), otherwise through the platform's default RPC for the venue's chain, so
+ * an app that never configured a chain just works. An app that configured a different `chain` is
+ * refused (`chain_mismatch`) before anything is signed.
+ *
+ * Funding is made safe to retry: a funding that was interrupted (page closed, answer lost) is
+ * saved before anything is sent, and the next call checks it instead of funding again, so pass
+ * the same terms and it resolves to the same `escrowId`. Store `escrowId` on your own record.
+ * See {@link VenueEscrowErrorCode} for the failures, and `pending` in particular.
+ */
+function fundVenueEscrow(terms) {
+    try {
+        const { appId, wallet } = sessionIdentity();
+        const problem = termsProblem(terms, wallet);
+        if (problem)
+            throw new VenueEscrowError('invalid_input', `fundVenueEscrow: ${problem}.`);
+        const checked = {
+            payee: terms.payee, amountUsdc: terms.amountUsdc, challengeSeconds: terms.challengeSeconds, expiresAt: terms.expiresAt, ref: terms.ref,
+        };
+        const key = `${STORAGE_PREFIX}:${appId}:${wallet}`;
+        return startFlow(key, JSON.stringify(checked), () => !loadPending(key, wallet), () => withLock(key, () => fundOrCheck(key, wallet, checked)));
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+}
+/**
+ * Dispute a funded venue escrow as its funder (or payee), signed by the wallet signed in here.
+ * MUST be called from a user click, for the same reason as {@link fundVenueEscrow}. `reason` is
+ * 1 to 400 bytes of UTF-8: the venue allows 1000 characters, but a longer reason does not fit one
+ * legacy-format transaction. Nothing is saved: a dispute that already landed makes the venue refuse
+ * a second one (`rule_refused`).
+ */
+function disputeVenueEscrow(input) {
+    try {
+        const { appId, wallet } = sessionIdentity();
+        const { escrowId, reason } = input !== null && input !== void 0 ? input : {};
+        if (!RECORD_ID.test(String(escrowId)))
+            throw new VenueEscrowError('invalid_input', 'disputeVenueEscrow: escrowId must be 32 hex characters.');
+        if (typeof reason !== 'string' || reason.length < 1 || new TextEncoder().encode(reason).length > MAX_DISPUTE_REASON_BYTES) {
+            throw new VenueEscrowError('invalid_input', `disputeVenueEscrow: reason must be 1 to ${MAX_DISPUTE_REASON_BYTES} bytes.`);
+        }
+        return startFlow(`dispute:${appId}:${wallet}:${escrowId}`, reason, () => true, () => dispute(wallet, escrowId, reason));
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+}
+
 /**
  * DS3-0414: does the transaction already carry a REAL signer signature? A Solana
  * signature is computed over the compiled message, which INCLUDES recentBlockhash, so
@@ -10996,25 +11731,6 @@ class PrivyExpoProvider {
     }
 }
 
-/**
- * Default provider discovery: Phantom-first, then any Wallet-Standard
- * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
- * a user gesture and can be eagerly exported from the SDK entry.
- */
-function defaultInjectedProvider() {
-    var _a;
-    if (typeof window === 'undefined')
-        return null;
-    const w = window;
-    const phantom = (_a = w === null || w === void 0 ? void 0 : w.phantom) === null || _a === void 0 ? void 0 : _a.solana;
-    if (phantom && typeof phantom.signMessage === 'function')
-        return phantom;
-    const generic = w === null || w === void 0 ? void 0 : w.solana;
-    if (generic && typeof generic.signMessage === 'function')
-        return generic;
-    return null;
-}
-
 // injected-evm-wallet-types.ts — tiny, dependency-free surface for the EVM
 // WALLET LOGIN path (BYO wallet via SIWE). The EVM twin of
 // injected-wallet-types.ts: kept separate from injected-evm-wallet-provider.ts
@@ -11404,5 +12120,5 @@ function init(config = {}) {
     return init$1(resolved);
 }
 
-export { onrampStatus as $, getAuthProvider as A, signInAnonymously as B, loginWithPrivy as C, loginWithWallet as D, ensureWalletLoginReady as E, ensureSharedWalletLoginReady as F, preloadWalletLogin as G, loginWithRedirect as H, completeLoginFromRedirect as I, getLoginReturnError as J, loginWithPopup as K, openBoundedWidget as L, ensureSignedIn as M, useAuth as N, useQuery as O, useBuildRun as P, apps as Q, signSolanaMessageViaTurnkey as R, getOrCreateTurnkeyWallet as S, openTurnkeyKeyExport as T, getTurnkeyWalletSessionState as U, getTurnkeyWalletRecoveryUrl as V, WalletConfigError as W, startTurnkeyEmailLogin as X, getIdToken as Y, onramp as Z, onrampQuote as _, signMessageWithTurnkey as a, setPlatform as a0, OffchainAuthProvider as a1, PrivyExpoProvider as a2, requestEip6963Providers as a3, connectBroadcast as a4, connectServiceSession as a5, builds as a6, BuildsApiError as a7, mediaAgentTools as a8, NON_TERMINAL_STATES as a9, TERMINAL_STATES as aa, RUN_STATES as ab, PARK_REASONS as ac, FAILURE_REASONS as ad, BUILD_REVIEW_CAPABILITY_SCHEMA as ae, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as af, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as ag, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, bufferExports as k, setStoredAuthMethod as l, confirmAndCheckTransaction as m, normalizeSolanaRpcUrl as n, defaultInjectedEvmProvider as o, init as p, getCurrentUser as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, onAuthStateChanged as u, onAuthLoadingChanged as v, getAuthLoading as w, waitForAuthReady as x, login as y, logout as z };
-//# sourceMappingURL=index-BAiLpNEQ.mjs.map
+export { onramp as $, logout as A, getAuthProvider as B, signInAnonymously as C, loginWithPrivy as D, loginWithWallet as E, ensureWalletLoginReady as F, ensureSharedWalletLoginReady as G, preloadWalletLogin as H, loginWithRedirect as I, completeLoginFromRedirect as J, getLoginReturnError as K, loginWithPopup as L, openBoundedWidget as M, ensureSignedIn as N, useAuth as O, useQuery as P, useBuildRun as Q, apps as R, SELECTED_WALLET_UNAVAILABLE_ERR as S, signSolanaMessageViaTurnkey as T, getOrCreateTurnkeyWallet as U, openTurnkeyKeyExport as V, WalletConfigError as W, getTurnkeyWalletSessionState as X, getTurnkeyWalletRecoveryUrl as Y, startTurnkeyEmailLogin as Z, getIdToken as _, signMessageWithTurnkey as a, onrampQuote as a0, onrampStatus as a1, fundVenueEscrow as a2, disputeVenueEscrow as a3, getVenueEscrow as a4, VenueEscrowError as a5, setPlatform as a6, OffchainAuthProvider as a7, PrivyExpoProvider as a8, requestEip6963Providers as a9, connectBroadcast as aa, connectServiceSession as ab, builds as ac, BuildsApiError as ad, mediaAgentTools as ae, NON_TERMINAL_STATES as af, TERMINAL_STATES as ag, RUN_STATES as ah, PARK_REASONS as ai, FAILURE_REASONS as aj, BUILD_REVIEW_CAPABILITY_SCHEMA as ak, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as al, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as am, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, supportsWalletSignIn as k, bufferExports as l, setStoredAuthMethod as m, normalizeSolanaRpcUrl as n, confirmAndCheckTransaction as o, defaultInjectedEvmProvider as p, init as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, waitForAuthReady as y, login as z };
+//# sourceMappingURL=index-C63ceG_z.mjs.map