@bounded-sh/client 0.0.114 → 0.0.115

package/dist/{index-BZ0X1Z9X.js → index-nU0ZSfWs.js}

@@ -615,6 +615,37 @@ class OffchainAuthProvider {
     }
 }
 
+const SELECTED_WALLET_UNAVAILABLE_ERR = 'The selected Solana wallet is unavailable. Select it again before continuing.';
+/** Check login capabilities without connecting, signing, or loading a wallet SDK.
+ *  This checks login only; it does not promise message or transaction signing. */
+function supportsWalletSignIn(provider) {
+    if (typeof provider !== 'object' || provider === null)
+        return false;
+    const wallet = provider;
+    return typeof wallet.connect === 'function' && typeof wallet.signIn === 'function';
+}
+/**
+ * Default provider discovery: Phantom-first, then any Wallet-Standard
+ * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
+ * a user gesture and can be eagerly exported from the SDK entry. This names the
+ * default wallet even when it cannot sign in: login must refuse that wallet,
+ * never silently replace it with a different identity. Custom pickers can use
+ * supportsWalletSignIn() to decide which providers to offer for login.
+ */
+function defaultInjectedProvider() {
+    var _a;
+    if (typeof window === 'undefined')
+        return null;
+    const w = window;
+    const phantom = (_a = w === null || w === void 0 ? void 0 : w.phantom) === null || _a === void 0 ? void 0 : _a.solana;
+    if (phantom && typeof phantom.signMessage === 'function')
+        return phantom;
+    const generic = w === null || w === void 0 ? void 0 : w.solana;
+    if (generic && typeof generic.signMessage === 'function')
+        return generic;
+    return null;
+}
+
 // issuer-logout-bounce.ts - commit the top-level navigation that ends the hosted
 // issuer's browser session (the Better Auth cookie on auth.bounded.sh).
 //
@@ -4554,6 +4585,108 @@ async function openHiddenSignerFrame(page) {
     };
 }
 
+// turnkey-signer-window.ts - the top-level Bounded signer window: opening it, and reserving it
+// inside a click for an approval that is reached only after awaits.
+//
+// A cross-app Turnkey signature (the capability says `transport: 'popup'`) cannot run in the
+// in-app frame, so it opens in its own window, and a browser opens a window only inside the
+// user's click. The click handler therefore calls `reserveSignerPopup()` first, before any
+// `await`, and the exchange in turnkey-signer-bridge.ts navigates that window to the signer later.
+//
+// Kept out of the bridge on purpose: the bridge is loaded lazily as a whole module, so a bundler
+// keeps every one of its exports in every app that signs, while this reservation is needed only
+// by an app that funds an escrow.
+function openSignerWindow(url, w = 420, h = 620) {
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    return window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+}
+// One slot: the next popup exchange takes it, and a new reservation replaces an unused earlier one.
+// A property of a const rather than a reassigned `let`, which a bundler would keep every assignment
+// to, dragging the reservation into apps that never reserve.
+const reserved = { popup: null };
+/** Write `text` into the window; false when the window is not ours to write (it still works: it is navigated to the signer next). */
+function paint(popup, text) {
+    try {
+        const { document: doc } = popup;
+        doc.title = 'Bounded';
+        doc.documentElement.style.colorScheme = 'light dark';
+        doc.body.style.cssText = 'margin:0;padding:24px;box-sizing:border-box;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;font:15px system-ui,sans-serif;background:Canvas;color:CanvasText';
+        doc.body.textContent = text;
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Open the signer window NOW, synchronously, showing a neutral "Preparing your approval..."
+ * page (a blank document with local text, no remote content). Call it from a user gesture,
+ * before any `await`, and `release()` it when the flow ends. A cross-app Turnkey signature
+ * then runs in this window instead of needing a fresh gesture.
+ * Returns null when there is no DOM or the browser blocked the window.
+ */
+function reserveSignerPopup() {
+    var _a;
+    if (typeof window === 'undefined' || typeof document === 'undefined')
+        return null;
+    try {
+        (_a = reserved.popup) === null || _a === void 0 ? void 0 : _a.close();
+    }
+    catch ( /* already closed */_b) { /* already closed */ }
+    let popup = null;
+    try {
+        popup = openSignerWindow('');
+    }
+    catch ( /* a sandboxed page may throw instead of returning null */_c) { /* a sandboxed page may throw instead of returning null */ }
+    reserved.popup = popup;
+    if (!popup)
+        return null;
+    paint(popup, 'Preparing your approval...');
+    return {
+        release(message) {
+            const unused = reserved.popup === popup;
+            if (unused)
+                reserved.popup = null;
+            try {
+                if (!message || !unused || popup.closed)
+                    return popup.close();
+                const text = message.slice(0, 160);
+                if (!paint(popup, text))
+                    return popup.close(); // not a window of ours to write on, so no message to linger on
+                // Close it only while it still shows this text: a window that was reserved again or sent on to
+                // the signer in the meantime is no longer ours to close.
+                setTimeout(() => { try {
+                    if (popup.document.body.textContent === text)
+                        popup.close();
+                }
+                catch ( /* sent on to the signer */_a) { /* sent on to the signer */ } }, 1500);
+            }
+            catch ( /* already closed */_a) { /* already closed */ }
+        },
+    };
+}
+/** Hand the reserved window, if one is held, to an exchange: navigated to the signer page at `url`. */
+function takeReservedPopup(url) {
+    const popup = reserved.popup;
+    reserved.popup = null;
+    if (!popup)
+        return null;
+    if (popup.closed)
+        throw new Error('Wallet approval window was closed before it completed.');
+    try {
+        popup.location.replace(url);
+    }
+    catch (_a) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw new Error('Wallet approval window could not open the signer - retry from a click.');
+    }
+    return popup;
+}
+
 // turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
 // kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
 //
@@ -4565,9 +4698,10 @@ async function openHiddenSignerFrame(page) {
 // so a regression here (a dropped capability, a wrong route, a swallowed error) is
 // caught without a browser.
 // POST the Bounded id token + payload hash to the issuer's capability mint route and
-// return the issuer-signed capability for exactly these bytes. Credential-free: identity
-// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
-// would not carry). Throws with the same stable messages the bridge relied on inline.
+// return the issuer-signed capability for exactly these bytes, with the transport the
+// issuer requires for them. Credential-free: identity is proven with the id token in the
+// body (not an ambient cookie the cross-origin fetch would not carry). Throws with the same
+// stable messages the bridge relied on inline.
 async function requestTurnkeySigningCapability(opts) {
     const base = opts.baseUrl.replace(/\/$/, '');
     let res;
@@ -4597,7 +4731,7 @@ async function requestTurnkeySigningCapability(opts) {
     if (!d || typeof d.capability !== 'string' || !d.capability) {
         throw new Error('Turnkey signing capability was malformed.');
     }
-    return d.capability;
+    return d.transport === 'popup' ? { capability: d.capability, transport: 'popup' } : { capability: d.capability };
 }
 // Assemble the `bounded:turnkey:sign` postMessage request, carrying the issuer-signed
 // capability for the same bytes. Without the capability the hosted signer refuses
@@ -4688,12 +4822,16 @@ function hasDOM$3() {
 // when we cannot embed (no DOM, or the frame never mounts/loads). Nothing in the
 // email-session flow needs a popup by preference: the code entry and the approval
 // click both run fine inside a cross-origin iframe on every engine (the old
-// Safari popup preference existed only for in-iframe WebAuthn CREATE).
+// Safari popup preference existed only for in-iframe WebAuthn CREATE). The one
+// exception is a signature the issuer marks `transport: 'popup'` (a cross-app
+// write): the hosted signer refuses it inside any frame, so it never touches the widget.
 async function deliver(url, origin, ex) {
     var _a, _b;
     const popup = () => runPopup(url, origin, ex);
     (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
-    const result = await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
+    const result = ex.transport === 'popup'
+        ? await popup()
+        : await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
     (_b = ex.assertCurrent) === null || _b === void 0 ? void 0 : _b.call(ex);
     return result;
 }
@@ -4765,14 +4903,12 @@ function activeTurnkeyAddress() {
         : null;
 }
 let requestSeq = 0;
-// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
-// resolve when `onResult` accepts a result message. Origin + source are pinned.
+// Shared popup driver: open the signer page (in the reserved window when one is held), do the
+// ready/postMessage handshake, and resolve when `onResult` accepts a result message. Origin +
+// source are pinned.
 async function runPopup(url, signerOrigin, ex) {
-    var _a, _b;
-    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
-    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
-    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    var _a;
+    const popup = (_a = takeReservedPopup(url)) !== null && _a !== void 0 ? _a : openSignerWindow(url, ex.width, ex.height);
     if (!popup) {
         throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the wallet approval window can open.');
     }
@@ -5022,7 +5158,7 @@ async function signSolanaMessageViaTurnkey(message) {
     const messageHex = toHex(message);
     // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
     // refuse (capability_required) without it. Fetched per signature (each is single-payload).
-    const capability = await fetchSigningCapability(messageHex, context);
+    const { capability, transport } = await fetchSigningCapability(messageHex, context);
     // Inline (authMode:"turnkey") sessions plant no Better Auth cookie on the issuer, so the
     // signer's same-origin status/create fetches need a bearer session proof: attach the
     // createWallet action authorization (it covers the sign flow's get-or-create too). Minted
@@ -5031,11 +5167,20 @@ async function signSolanaMessageViaTurnkey(message) {
     return await deliver(url, origin, {
         context: context.key, assertCurrent: context.assertCurrent,
         request: buildTurnkeySignRequest({ requestId, messageHex, capability, authorization }),
+        transport,
         onResult: (d) => {
             if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
-                setWalletSessionState(context.key, { status: 'ready', expiresAt: Number(d.signingSessionExpiresAt) });
+                // A top-level popup keeps its signing session in the signer origin's own storage, which the
+                // warm in-app frame (a partitioned context) cannot see, so it says nothing about that frame.
+                if (transport !== 'popup')
+                    setWalletSessionState(context.key, { status: 'ready', expiresAt: Number(d.signingSessionExpiresAt) });
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
             }
+            // The hosted signer refuses a cross-app signature inside a frame. Never retry it from here:
+            // the top-level window needs the user's own click.
+            if (d.error === 'top_level_required') {
+                return { error: 'top_level_required: an approval that writes to another app must open in its own window. Start it from a click handler.' };
+            }
             return { error: String(d.error || 'Turnkey signing failed') };
         },
     });
@@ -6351,7 +6496,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-DeORQbTK.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-CPHrcy_b.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6393,7 +6538,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B9jvzDM5.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BXFicWTx.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6406,7 +6551,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-D06arDQD.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-D1JA3cL4.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6431,7 +6576,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-5bX-xt6K.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-d6dk97x6.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6493,7 +6638,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-5bX-xt6K.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-d6dk97x6.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6664,7 +6809,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-B9jvzDM5.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-BXFicWTx.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6746,10 +6891,12 @@ async function loginWithWallet(options) {
     // one that yields nothing and then a wallet prepares the mobile registry
     // after the tap for a wallet it never uses.
     const pinnedProvider = (_b = (_a = injectedConfig.getProvider) === null || _a === void 0 ? void 0 : _a.call(injectedConfig)) !== null && _b !== void 0 ? _b : null;
+    if (injectedConfig.getProvider && !pinnedProvider)
+        throw new Error(SELECTED_WALLET_UNAVAILABLE_ERR);
     const attemptConfig = Object.assign(Object.assign({}, injectedConfig), { 
-        // Still a fallthrough when it resolved nothing, exactly as before - the
-        // difference is that the answer is now fixed for this attempt.
-        getProvider: () => pinnedProvider });
+        // An explicit choice stays pinned. With no getter, retain default
+        // discovery rather than manufacturing an unavailable explicit choice.
+        getProvider: injectedConfig.getProvider ? () => pinnedProvider : undefined });
     // Idempotent: a caller that prepared the lane (the widget, or an app that
     // awaited ensureWalletLoginReady before enabling its button) has already
     // paid for this, so nothing activation-sensitive happens after the tap. A
@@ -6758,16 +6905,16 @@ async function loginWithWallet(options) {
     //
     // "Pinned" is about the EFFECTIVE resolution, not whether a getter was
     // passed: a configured walletLogin.getProvider pins just as much as a
-    // per-call one, and a getter that returns nothing falls through to discovery
-    // (and so to the mobile wallet). With a real wallet in hand only the shared
-    // half is needed - re-attempting a failed mobile registration would be
+    // per-call one. An unavailable explicit choice was refused above. With a
+    // real wallet in hand only the shared half is needed - re-attempting a
+    // failed mobile registration would be
     // exactly the work-after-the-tap this exists to avoid, for a wallet this
     // login is not even using.
     if (pinnedProvider)
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B9jvzDM5.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BXFicWTx.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -7595,15 +7742,28 @@ function hasFeature(wallet, name) {
 function supportsSolana(wallet) {
     return wallet.chains.some((c) => c.startsWith("solana:"));
 }
-/** A wallet is LISTED for Bounded login when it can connect + sign a message on a
- *  Solana chain. Login itself needs the `solana:signIn` feature (SEC-01); that is
- *  checked at login time in InjectedWalletProvider, where a wallet without it is
- *  refused with the reason spelled out rather than silently missing from the list.
- *  Transaction features are optional and checked lazily at call time. */
-function isLoginCapable(wallet) {
+/** A Solana wallet the SDK can connect and use for message signing. */
+function isSolanaWallet(wallet) {
+    var _a, _b;
     return (supportsSolana(wallet) &&
-        hasFeature(wallet, StandardConnect) &&
-        hasFeature(wallet, SolanaSignMessage));
+        typeof ((_a = feature(wallet, StandardConnect)) === null || _a === void 0 ? void 0 : _a.connect) === "function" &&
+        typeof ((_b = feature(wallet, SolanaSignMessage)) === null || _b === void 0 ? void 0 : _b.signMessage) === "function");
+}
+/** Login choices must support the same SIWS operation login() requires.
+ *  Transaction features remain optional and are checked at call time. */
+function isLoginCapable(wallet) {
+    var _a, _b;
+    return isSolanaWallet(wallet) && supportsWalletSignIn({
+        connect: (_a = feature(wallet, StandardConnect)) === null || _a === void 0 ? void 0 : _a.connect,
+        signIn: (_b = feature(wallet, SolanaSignIn)) === null || _b === void 0 ? void 0 : _b.signIn,
+    });
+}
+/** Distinguish unsupported installed wallets from an empty registry in the UI. */
+function hasUnsupportedStandardWallets(configuredNetwork) {
+    if (typeof window === "undefined")
+        return false;
+    const chain = configuredNetwork ? solanaChainOrNull(configuredNetwork) : null;
+    return getWallets().get().some((wallet) => (isSolanaWallet(wallet) && (!chain || wallet.chains.includes(chain)) && !isLoginCapable(wallet)));
 }
 /** The Wallet-Standard chain id for a configured network, or null when it is
  *  absent/unsupported. Ordering must never throw - failing closed on an
@@ -7632,6 +7792,7 @@ function feature(wallet, name) {
  * an unconfigured network fails closed at sign time rather than defaulting.
  */
 function standardWalletToInjectedProvider(wallet, configuredNetwork) {
+    var _a;
     // The adapter holds NO account of its own: `wallet.accounts` is the Wallet
     // Standard's live authorized-account view, kept in sync by the wallet itself
     // (it emits standard:events 'change' when it moves). Reading it on every
@@ -7731,12 +7892,12 @@ function standardWalletToInjectedProvider(wallet, configuredNetwork) {
             const disconnect = feature(wallet, StandardDisconnect);
             if (disconnect)
                 await disconnect.disconnect();
-        } }, (hasFeature(wallet, SolanaSignIn)
+        } }, (typeof ((_a = feature(wallet, SolanaSignIn)) === null || _a === void 0 ? void 0 : _a.signIn) === "function"
         ? {
             async signIn(input) {
                 var _a;
                 const sign = feature(wallet, SolanaSignIn);
-                if (!sign)
+                if (typeof (sign === null || sign === void 0 ? void 0 : sign.signIn) !== "function")
                     throw new Error("Wallet does not support solana:signIn");
                 const open = currentAccount();
                 if (open && !accountSupports(open, SolanaSignIn))
@@ -8284,14 +8445,12 @@ function walletGlyph() {
     return svg;
 }
 function isInjectedProvider(v) {
-    return (typeof v === "object" &&
-        v !== null &&
-        typeof v.signMessage === "function");
+    return supportsWalletSignIn(v);
 }
 // Enumerate native wallets via the Solana Wallet Standard registry (NOT a
-// hardcoded name list) - every wallet that registered itself shows up with its
-// real name + icon - and ALSO an older wallet that never registers and only
-// exposes `window.solana`.
+// hardcoded name list) - wallets that support Bounded sign-in show up with
+// their real name + icon - and ALSO an eligible older wallet that never
+// registers and only exposes `window.solana`.
 //
 // The legacy `window.solana` probe fills in for a wallet too old to register
 // itself. The rule it has always encoded is "no BROWSER wallet registered", and
@@ -8326,7 +8485,11 @@ const BUSY_MSG = "A sign-in is already in progress - finish or cancel it first."
 // no wallet in this browser). A phone browser never sees installed wallet apps
 // as injected providers, so the honest advice there is a different browser,
 // not "install a wallet".
-function noLaneCopy(mobile) {
+function noLaneCopy(mobile, unsupportedWallets) {
+    if (unsupportedWallets) {
+        return "The wallets detected in this browser cannot sign in to Bounded. " +
+            "Use a wallet that supports Sign In With Solana, then reload this page.";
+    }
     return mobile
         ? "No wallet is available in this browser. Open this page in your wallet app's " +
             "browser, or on a desktop browser with a wallet extension, then try again."
@@ -8524,6 +8687,9 @@ async function prepareAndOpen(opts, pending) {
     // button with no wallet behind it.
     if (wallets.length === 0)
         walletEnabled = false;
+    const defaultWallet = defaultInjectedProvider();
+    const unsupportedWallets = !lane.hardOff && lane.requested !== false && (hasUnsupportedStandardWallets(network) ||
+        (defaultWallet !== null && !supportsWalletSignIn(defaultWallet)));
     const authMode = (_b = opts.authMode) !== null && _b !== void 0 ? _b : authApi.resolveAuthMode(initCfg);
     // Widget text: per-call options win, then init() loginWidget config, then the
     // defaults ("Sign in" / the Bounded subline; "" suppresses the subline).
@@ -8902,14 +9068,19 @@ async function prepareAndOpen(opts, pending) {
             // screen, and name the usual cause once in the console, where the
             // developer's own preview run will show it.
             if (!hasEmail && social.length === 0 && !walletEnabled) {
-                card.appendChild(el("p", "sub", noLaneCopy(detectMobile())));
+                card.appendChild(el("p", "sub", noLaneCopy(detectMobile(), unsupportedWallets)));
                 console.warn("[Bounded] openBoundedWidget has no sign-in lane to show: the app asked for " +
-                    "no email or social method and no wallet is available in this browser. " +
-                    (offerMobile
+                    "no email or social method and " +
+                    (unsupportedWallets
+                        ? "the detected wallets do not support Sign In With Solana. "
+                        : "no wallet is available in this browser. ") +
+                    (offerMobile && !unsupportedWallets
                         ? "On Android the Solana Mobile wallet is offered only when the app installs " +
                             "'@solana-mobile/wallet-standard-mobile' (see the warning above if registration failed); "
                         : "") +
-                    "Add a method, or make sure wallet login is enabled and the mobile adapter is installed.");
+                    (unsupportedWallets
+                        ? "Add another sign-in method, or use a wallet that supports Sign In With Solana."
+                        : "Add a method, or make sure wallet login is enabled and the mobile adapter is installed."));
             }
             card.appendChild(status);
             const foot = el("div", "foot");
@@ -10496,7 +10667,7 @@ async function onrampStatus(sinceMs) {
 function isSuccess(t) {
     return /SUCCESS|COMPLETED/i.test(t.status);
 }
-function isPending(t) {
+function isPending$1(t) {
     return /PROGRESS|PENDING|CREATED/i.test(t.status);
 }
 async function verifyCompletion(openedAt, asset, timeoutMs) {
@@ -10510,7 +10681,7 @@ async function verifyCompletion(openedAt, asset, timeoutMs) {
             const done = txs.find((t) => isSuccess(t) && (t.asset === null || t.asset === asset));
             if (done)
                 return done;
-            sawPending = txs.some(isPending);
+            sawPending = txs.some(isPending$1);
         }
         catch ( /* transient - keep polling until the deadline */_a) { /* transient - keep polling until the deadline */ }
         // No completed fill and nothing in flight: one grace poll cycle still
@@ -10616,6 +10787,570 @@ async function onramp(options = {}) {
     return Object.assign(Object.assign({}, base), { status: 'closed' });
 }
 
+// venue-escrow.ts - fund and dispute a venue escrow from inside an OpenApps app (VENUE-GRANT-DESIGN.md).
+//
+// An OpenApps app's escrow lives in its venue (`agentescrows/<rootAppId>/e/<escrowId>`), and this
+// app's session cannot write another app's data. Bounded Auth therefore mints a 5 minute,
+// single-use GRANT for exactly one create (`POST {humanAuthApiUrl}/app-token/venue-grant`;
+// contract: packages/cdk/cloudflare/shared/venue-grant.ts, which the SDK cannot import because the
+// packages publish separately, so only what is needed is mirrored here), and the venue builds the
+// transaction for the wallet signed in here. The money's only authority is that wallet's
+// signature, checked onchain by the venue's own rule; the grant adds no power to the app.
+//
+// Funding moves money, so it keeps the recovery semantics oapps-fun's retired escrow page proved:
+// a pending record is saved BEFORE any network call and checked before ever funding again; the
+// escrow id is stable across retries; an uncertain broadcast is settled by its signature or the
+// public receipt and never re-sent; one tab funds at a time; and a row that does not match every
+// term is `taken`, never funded.
+/** Thrown by every venue escrow call. Branch on `code`; `error.name === 'VenueEscrowError'` also holds across bundled SDK copies. */
+class VenueEscrowError extends Error {
+    constructor(code, message, details = {}) {
+        super(message);
+        this.name = 'VenueEscrowError';
+        this.code = code;
+        if (details.escrowId !== undefined)
+            this.escrowId = details.escrowId;
+        if (details.cause !== undefined)
+            this.cause = details.cause;
+    }
+}
+const ESCROW_SCHEMA = 'openapps.agent-escrow.v1';
+const STORAGE_PREFIX = 'bounded.venue-escrow-funding.v1';
+/** A saved funding that shows no row and no signature this long after its save can no longer land. */
+const ABANDONED_MS = 5 * 60000;
+const RECEIPT_POLL_MS = [0, 250, 500, 1000, 1500, 2500, 4000];
+const ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+const APP_ID = /^[0-9a-f]{24}$/;
+const RECORD_ID = /^[0-9a-f]{32}$/;
+/**
+ * Bounded Auth's own refusals of a grant mint, passed through as codes, with what each means to a
+ * person: the error's message, and so what the reserved signer window shows before it closes.
+ */
+const GRANT_REFUSALS = {
+    invalid_request: 'The request was not accepted. Update the app and try again.',
+    invalid_token: 'Your session expired. Sign in again.',
+    origin_not_allowed: "This site isn't allowed to fund escrows for this app.",
+    not_an_openapps_app: "This app can't fund escrows.",
+    wallet_required: 'Sign in with a wallet to fund escrows.',
+    agent_wallet_refused: "An agent's wallet can't fund escrows here.",
+    rate_limited: 'Too many attempts. Try again in a minute.',
+    venue_grant_unavailable: 'Escrows are unavailable right now. Try again shortly.',
+};
+const nowSeconds = () => Math.floor(Date.now() / 1000);
+/** A v0 dispute transaction stops fitting past about 513 reason bytes; this keeps a margin. */
+const MAX_DISPUTE_REASON_BYTES = 400;
+const isCount = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+const newRecordId = () => Array.from(getPlatform().getRandomBytes(16), (byte) => byte.toString(16).padStart(2, '0')).join('');
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Mirrors `venueGrantPath` in shared/venue-grant.ts: the one path a grant of this kind may create. */
+function recordPath(kind, rootAppId, id) {
+    return kind === 'escrow' ? `agentescrows/${rootAppId}/e/${id}` : `agentescrowdisputes/${rootAppId}/d/${id}`;
+}
+/** Who is signed in, read synchronously: the click handler must not await before it reserves the signer window. */
+function sessionIdentity() {
+    const appId = core.getConfiguredAppId();
+    let idToken = null;
+    try {
+        idToken = core.getActiveSessionManager().getIdToken();
+    }
+    catch ( /* no session store */_a) { /* no session store */ }
+    if (!appId || !idToken)
+        throw new VenueEscrowError('sign_in_required', 'Sign in before using venue escrows.');
+    const wallet = core.deriveUserIdentityFromIdToken(idToken).address;
+    if (!wallet)
+        throw new VenueEscrowError('wallet_required', 'This session has no wallet to sign with.');
+    return { appId, wallet };
+}
+async function mintGrant(kind, id, wallet) {
+    var _a;
+    let idToken = null;
+    try {
+        idToken = await core.getFreshAuthToken(false);
+    }
+    catch ( /* an expired session reads as signed out */_b) { /* an expired session reads as signed out */ }
+    if (!idToken)
+        throw new VenueEscrowError('sign_in_required', 'Your session expired. Sign in again.');
+    if (core.deriveUserIdentityFromIdToken(idToken).address !== wallet) {
+        throw new VenueEscrowError('wallet_changed', 'The signed-in wallet changed. Start again.');
+    }
+    const base = ((await core.getConfig()).humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    let response;
+    try {
+        response = await fetch(`${base}/app-token/venue-grant`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ idToken, kind, id, walletProtocol: 2 }),
+        });
+    }
+    catch (cause) {
+        throw new VenueEscrowError('venue_grant_unavailable', 'Could not reach Bounded Auth to authorize this write.', { cause });
+    }
+    const body = (await response.json().catch(() => null));
+    if (!response.ok) {
+        const error = typeof (body === null || body === void 0 ? void 0 : body.error) === 'string' ? body.error : '';
+        const code = Object.keys(GRANT_REFUSALS).includes(error) ? error : response.status >= 500 ? 'venue_grant_unavailable' : 'venue_grant_refused';
+        throw new VenueEscrowError(code, (_a = GRANT_REFUSALS[code]) !== null && _a !== void 0 ? _a : `Bounded Auth refused the venue grant (${error || response.status}).`);
+    }
+    const fields = body !== null && body !== void 0 ? body : {};
+    const { grant, venueAppId, rootAppId, walletAddress, path } = fields;
+    if (typeof grant !== 'string' || !grant || typeof venueAppId !== 'string' || !APP_ID.test(venueAppId)
+        || typeof rootAppId !== 'string' || !APP_ID.test(rootAppId) || walletAddress !== wallet || path !== recordPath(kind, rootAppId, id)) {
+        throw new VenueEscrowError('venue_grant_unavailable', 'Bounded Auth answered with a grant that does not match this write.');
+    }
+    return { grant, venueAppId, rootAppId, path };
+}
+/* ------------------------------- reading -------------------------------- */
+/**
+ * Read one venue escrow from the public record: its terms and its state (`pending` until the
+ * venue's hook completes, `failed` when it did not). Resolves null when no such escrow exists.
+ * No sign-in is needed.
+ */
+async function getVenueEscrow(input) {
+    var _a;
+    const { rootAppId, escrowId } = input !== null && input !== void 0 ? input : {};
+    if (!APP_ID.test(String(rootAppId)) || !RECORD_ID.test(String(escrowId))) {
+        throw new VenueEscrowError('invalid_input', 'getVenueEscrow needs a rootAppId (24 hex characters) and an escrowId (32 hex characters).');
+    }
+    const base = (_a = (await core.getConfig()).devApiUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/$/, '');
+    if (!base)
+        throw new VenueEscrowError('read_unavailable', 'The Bounded developer API is not configured. Pass a Bounded network to init().');
+    let response;
+    try {
+        // The 200 is cacheable for a minute, and a funding is polled through `pending`.
+        response = await fetch(`${base}/public/oapp/${rootAppId}/escrows/${escrowId}`, { cache: 'no-store' });
+    }
+    catch (cause) {
+        throw new VenueEscrowError('read_unavailable', 'Could not reach the Bounded developer API.', { cause });
+    }
+    if (response.status === 404)
+        return null;
+    const body = (await response.json().catch(() => null));
+    if (!response.ok || (body === null || body === void 0 ? void 0 : body.ok) !== true || !body.escrow || typeof body.escrow !== 'object') {
+        throw new VenueEscrowError('read_unavailable', `The escrow could not be read (${response.status}).`);
+    }
+    return body.escrow;
+}
+/**
+ * The overrides that point a receipt's reconciliation at the venue it was issued for and the RPC of
+ * the chain it ran on (the same one the write was broadcast through), with no credential.
+ */
+async function venueReadOverrides(venueAppId, chain) {
+    var _a;
+    const config = await core.getConfig();
+    const rpcUrl = (_a = core.resolveVenueRpcUrl(config, chain, defaultSolanaRpcUrl)) !== null && _a !== void 0 ? _a : config.rpcUrl;
+    return { _config: Object.assign(Object.assign({}, config), { appId: venueAppId, rpcUrl }), _readOnly: true };
+}
+const TERM_KEYS = ['payee', 'amountUsdc', 'challengeSeconds', 'expiresAt', 'ref'];
+/** Every term the funder signed, which a row must carry in full to be this funding. */
+const ROW_KEYS = ['schemaVersion', 'funder', 'payee', 'amountUsdc', 'challengeSeconds', 'expiresAt', 'ref', 'at'];
+/** The first thing wrong with these terms, or null. Shapes only: the venue's rule owns every bound. */
+function termsProblem(terms, wallet) {
+    if (!terms || typeof terms.payee !== 'string' || !ADDRESS.test(terms.payee))
+        return 'payee must be a Solana address';
+    if (terms.payee === wallet)
+        return 'payee must not be the wallet that is funding';
+    for (const key of ['amountUsdc', 'challengeSeconds', 'expiresAt']) {
+        if (!isCount(terms[key]))
+            return `${key} must be a non-negative integer`;
+    }
+    if (typeof terms.ref !== 'string' || terms.ref.length < 1 || terms.ref.length > 128)
+        return 'ref must be 1 to 128 characters';
+    return null;
+}
+function isSavedSubmission(value) {
+    var _a, _b;
+    const saved = value;
+    return !!saved && saved.status === 'submitted' && typeof saved.appId === 'string' && typeof saved.chain === 'string'
+        && typeof saved.transactionId === 'string' && saved.transactionId.length > 0
+        && typeof saved.signedTransaction === 'string' && Array.isArray(saved.requestedDocuments)
+        && typeof ((_a = saved.fence) === null || _a === void 0 ? void 0 : _a.blockhash) === 'string' && Number.isSafeInteger((_b = saved.fence) === null || _b === void 0 ? void 0 : _b.lastValidBlockHeight);
+}
+function isPending(value, wallet) {
+    const doc = value === null || value === void 0 ? void 0 : value.document;
+    const sent = (value === null || value === void 0 ? void 0 : value.path) !== undefined;
+    return RECORD_ID.test(String(value === null || value === void 0 ? void 0 : value.escrowId)) && Number.isSafeInteger(value.savedAtMs) && value.savedAtMs > 0
+        && !!doc && doc.schemaVersion === ESCROW_SCHEMA && doc.funder === wallet && termsProblem(doc, wallet) === null && isCount(doc.at)
+        && [doc.approvedAt, doc.approvedKind, doc.approvalId, doc.disputedAt, doc.disputedBy, doc.settledAt, doc.settledKind, doc.settledBy].every((field) => field === null)
+        && (!sent || (APP_ID.test(String(value.rootAppId)) && APP_ID.test(String(value.venueAppId)) && value.path === recordPath('escrow', value.rootAppId, value.escrowId)))
+        && (value.submission === undefined || isSavedSubmission(value.submission));
+}
+function store() {
+    const storage = getPlatform().storage;
+    // A volatile fallback would forget a funding that may have landed, and the next click would send a second one.
+    if (isVolatileStorage(storage))
+        throw new VenueEscrowError('storage_unavailable', 'Venue escrow funding needs durable browser storage.');
+    return storage;
+}
+function loadPending(key, wallet) {
+    const storage = store();
+    try {
+        const raw = storage.getItem(key);
+        if (!raw)
+            return null;
+        const value = JSON.parse(raw);
+        if (!isPending(value, wallet))
+            throw new Error('malformed');
+        return value;
+    }
+    catch (_a) {
+        throw new VenueEscrowError('storage_unavailable', 'The saved escrow funding could not be read, so another one will not be started.');
+    }
+}
+function savePending(key, pending) {
+    const storage = store();
+    try {
+        storage.setItem(key, JSON.stringify(pending));
+    }
+    catch (_a) {
+        throw new VenueEscrowError('storage_unavailable', 'The escrow funding could not be saved, so it was not sent.');
+    }
+}
+function clearPending(key, escrowId) {
+    try {
+        const raw = store().getItem(key);
+        if (raw && JSON.parse(raw).escrowId === escrowId)
+            store().removeItem(key);
+    }
+    catch ( /* unreadable: the next call refuses to fund over it */_a) { /* unreadable: the next call refuses to fund over it */ }
+}
+function rowVerdict(pending, row) {
+    var _a, _b;
+    if (!ROW_KEYS.every((key) => row[key] === pending.document[key]))
+        return { state: 'taken' };
+    if (row.state === 'failed')
+        return { state: 'failed' };
+    if (row.state === 'pending')
+        return { state: 'pending' };
+    return { state: 'completed', transactionId: (_b = (_a = pending.submission) === null || _a === void 0 ? void 0 : _a.transactionId) !== null && _b !== void 0 ? _b : null };
+}
+/** Settle a saved funding without sending anything: the public row first, then its signature, then its age. */
+async function checkPending(pending) {
+    if (!pending.path)
+        return { state: 'not_applied', reason: 'it was interrupted before the venue was asked.' };
+    let row;
+    try {
+        row = await getVenueEscrow({ rootAppId: pending.rootAppId, escrowId: pending.escrowId });
+    }
+    catch (_a) {
+        return { state: 'pending' };
+    }
+    if (row)
+        return rowVerdict(pending, row);
+    if (pending.submission) {
+        try {
+            const settled = await core.reconcileSetResult(pending.submission, { _overrides: await venueReadOverrides(pending.venueAppId, pending.submission.chain) });
+            if (settled.status === 'confirmed')
+                return { state: 'completed', transactionId: settled.transactionId };
+            if (settled.status === 'expired_not_landed')
+                return { state: 'not_applied', reason: 'it expired before it reached the chain.' };
+        }
+        catch (error) {
+            if (core.writeNotAppliedPhase(error) !== null)
+                return { state: 'not_applied', reason: 'the transaction failed onchain.' };
+        }
+        return { state: 'pending' };
+    }
+    return Date.now() - pending.savedAtMs >= ABANDONED_MS
+        ? { state: 'not_applied', reason: 'no transaction was ever recorded for it, and it can no longer land.' }
+        : { state: 'pending' };
+}
+/** Poll the public row until it settles: a direct poofnet commit is not funded until the venue's hook stamps it. */
+async function awaitRow(pending) {
+    for (const delay of RECEIPT_POLL_MS) {
+        if (delay)
+            await pause(delay);
+        let row = null;
+        try {
+            row = await getVenueEscrow({ rootAppId: pending.rootAppId, escrowId: pending.escrowId });
+        }
+        catch ( /* keep polling */_a) { /* keep polling */ }
+        const verdict = row ? rowVerdict(pending, row) : null;
+        if (verdict && verdict.state !== 'pending')
+            return verdict;
+    }
+    return { state: 'pending' };
+}
+/** The one place a funding ends: return its result, or release the saved record and throw why not. */
+function conclude(key, pending, verdict, terms) {
+    const { escrowId } = pending;
+    if (verdict.state === 'pending') {
+        throw new VenueEscrowError('pending', 'The funding is not confirmed yet. Call fundVenueEscrow again with the same terms to check it; do not start another.', { escrowId });
+    }
+    clearPending(key, escrowId);
+    switch (verdict.state) {
+        case 'completed':
+            if (terms && !TERM_KEYS.every((term) => pending.document[term] === terms[term])) {
+                throw new VenueEscrowError('funded_other_terms', `An earlier, interrupted funding with different terms landed as escrow ${escrowId}. Check it with getVenueEscrow before funding again.`, { escrowId });
+            }
+            return { escrowId, rootAppId: pending.rootAppId, venueAppId: pending.venueAppId, transactionId: verdict.transactionId };
+        case 'taken':
+            throw new VenueEscrowError('taken', 'A different record already holds this escrow id, so this funding did not land.', { escrowId });
+        case 'failed':
+            throw new VenueEscrowError('failed', 'The venue accepted the funding but its hook failed, so nothing moved. Try again.', { escrowId });
+        default:
+            throw new VenueEscrowError('not_applied', `The funding did not go through: ${verdict.reason} nothing moved. Try again.`, { escrowId });
+    }
+}
+/**
+ * Read a thrown write: what the SDK, the wallet or the venue said, as a code. The venue's own code
+ * is read before its status, because a 403 is not always its rule: a grant outside its scope
+ * (`venue_grant_scope`), a forbidden precondition or a signer that does not match the signing
+ * request are not, and only a decline (or the program's own rule rejection) is `rule_refused`.
+ */
+function mapWriteError(error) {
+    var _a;
+    if (error instanceof VenueEscrowError)
+        return error;
+    const e = (error !== null && error !== void 0 ? error : {});
+    const text = typeof e.message === 'string' ? e.message : String(error);
+    const code = e.code === 'chain_mismatch' || e.code === 'chain_not_configured' || e.code === 'sponsorship_refused' || e.code === 'sponsorship_unavailable' ? e.code
+        : e.name === 'InsufficientBalanceError' ? 'insufficient_balance'
+            : e.code === 'venue_grant_scope' || e.statusCode === 401 ? 'grant_rejected'
+                : e.isBoundedDecline === true || e.boundedRuleRejection === true ? 'rule_refused'
+                    : e.statusCode === 429 ? 'rate_limited'
+                        : /^top_level_required/.test(text) ? 'top_level_required'
+                            : /popup blocked/i.test(text) ? 'popup_blocked'
+                                // The wallet's or the window's own words only: a venue answer that happens to say "denied" is not the user declining.
+                                : e.statusCode === undefined && /user rejected|rejected the request|declined|denied|cancel|window was closed/i.test(text) ? 'declined'
+                                    : 'write_failed';
+    const message = code === 'rule_refused' && typeof ((_a = e.decline) === null || _a === void 0 ? void 0 : _a.message) === 'string' ? e.decline.message
+        : e.boundedRuleRejection === true ? 'The venue\'s onchain rules refused this write, usually because the approval took longer than the two minutes a write stays valid. Start again.'
+            : text;
+    return new VenueEscrowError(code, message, { cause: error });
+}
+/** What a write that returned, rather than threw, means for this funding. */
+async function settleResult(key, pending, result, terms) {
+    var _a;
+    let current = result;
+    if (current.status === 'submitted') {
+        try {
+            current = await core.waitForSetResult(current, { _overrides: await venueReadOverrides(pending.venueAppId, current.chain), timeoutMs: 60000 });
+        }
+        catch (error) {
+            if (core.writeNotAppliedPhase(error) !== null) {
+                clearPending(key, pending.escrowId);
+                throw mapWriteError(error);
+            }
+        }
+    }
+    switch (current.status) {
+        case 'confirmed':
+            return conclude(key, pending, { state: 'completed', transactionId: current.transactionId }, terms);
+        case 'committed': {
+            const verdict = await awaitRow(pending);
+            return conclude(key, pending, verdict.state === 'completed' ? { state: 'completed', transactionId: (_a = current.transactionId) !== null && _a !== void 0 ? _a : verdict.transactionId } : verdict, terms);
+        }
+        case 'expired_not_landed':
+            return conclude(key, pending, { state: 'not_applied', reason: 'it expired before it reached the chain.' }, terms);
+        case 'signed':
+            return conclude(key, pending, { state: 'not_applied', reason: 'it was signed but never sent.' }, terms);
+        default:
+            return conclude(key, pending, { state: 'pending' }, terms);
+    }
+}
+async function fundOrCheck(key, wallet, terms) {
+    const saved = loadPending(key, wallet);
+    if (saved)
+        return conclude(key, saved, await checkPending(saved), terms);
+    let pending = {
+        escrowId: newRecordId(),
+        savedAtMs: Date.now(),
+        document: {
+            payee: terms.payee, amountUsdc: terms.amountUsdc, challengeSeconds: terms.challengeSeconds, expiresAt: terms.expiresAt, ref: terms.ref,
+            schemaVersion: ESCROW_SCHEMA, funder: wallet, at: nowSeconds(),
+            approvedAt: null, approvedKind: null, approvalId: null, disputedAt: null, disputedBy: null,
+            settledAt: null, settledKind: null, settledBy: null,
+        },
+    };
+    const { escrowId } = pending;
+    savePending(key, pending); // before any network call: the id must survive a lost answer
+    let minted;
+    try {
+        minted = await mintGrant('escrow', escrowId, wallet);
+        // The venue's rule holds `at` within two minutes of the chain clock, and the venue bakes it into the
+        // transaction it builds from this write, so it is taken as late as it can be: after the mint, in the save
+        // that adds the venue path, right before the write. The id and document were already saved before any
+        // network call, and nothing has reached the venue yet, so recovery is unchanged.
+        pending = Object.assign(Object.assign({}, pending), { document: Object.assign(Object.assign({}, pending.document), { at: nowSeconds() }), rootAppId: minted.rootAppId, venueAppId: minted.venueAppId, path: minted.path });
+        savePending(key, pending);
+    }
+    catch (error) {
+        clearPending(key, escrowId); // the venue was never asked, so there is nothing to settle
+        throw error;
+    }
+    let result;
+    try {
+        result = await core.setWithVenueGrant(minted.path, pending.document, {
+            venueAppId: minted.venueAppId,
+            grant: minted.grant,
+            commitGrant: async () => (await mintGrant('escrow', escrowId, wallet)).grant,
+            resolveRpcUrl: defaultSolanaRpcUrl,
+            onBroadcast: (submission) => {
+                const next = Object.assign(Object.assign({}, pending), { submission });
+                savePending(key, next);
+                pending = next;
+            },
+        });
+    }
+    catch (error) {
+        if (core.writeNotAppliedPhase(error) !== null) {
+            clearPending(key, escrowId);
+            throw mapWriteError(error);
+        }
+        // Anything else may follow a commit or broadcast whose answer was lost: settle it by the public
+        // row, then by the saved signature. Never send again.
+        const verdict = await awaitRow(pending);
+        return conclude(key, pending, verdict.state === 'pending' && pending.submission ? await checkPending(pending) : verdict, terms);
+    }
+    return settleResult(key, pending, result, terms);
+}
+/** Poll the escrow until it shows disputed: a direct poofnet commit is not a dispute until the venue's hook stamps it. */
+async function awaitDisputed(rootAppId, escrowId) {
+    for (const delay of RECEIPT_POLL_MS) {
+        if (delay)
+            await pause(delay);
+        const row = await getVenueEscrow({ rootAppId, escrowId }).catch(() => null);
+        if (row && row.disputedAt !== null)
+            return true;
+    }
+    return false;
+}
+async function dispute(wallet, escrowId, reason) {
+    const disputeId = newRecordId();
+    const minted = await mintGrant('dispute', disputeId, wallet);
+    let result = null;
+    try {
+        result = await core.setWithVenueGrant(minted.path, { escrowId, reason, at: nowSeconds() }, {
+            venueAppId: minted.venueAppId,
+            grant: minted.grant,
+            commitGrant: async () => (await mintGrant('dispute', disputeId, wallet)).grant,
+            resolveRpcUrl: defaultSolanaRpcUrl,
+        });
+        if (result.status === 'submitted')
+            result = await core.waitForSetResult(result, { _overrides: await venueReadOverrides(minted.venueAppId, result.chain), timeoutMs: 60000 });
+    }
+    catch (error) {
+        if (core.writeNotAppliedPhase(error) !== null)
+            throw mapWriteError(error);
+        // Anything else may follow a commit or broadcast whose answer was lost: the escrow says.
+    }
+    const done = { disputeId, rootAppId: minted.rootAppId, venueAppId: minted.venueAppId };
+    if ((result === null || result === void 0 ? void 0 : result.status) === 'confirmed')
+        return Object.assign(Object.assign({}, done), { transactionId: result.transactionId });
+    if ((result === null || result === void 0 ? void 0 : result.status) === 'expired_not_landed' || (result === null || result === void 0 ? void 0 : result.status) === 'signed') {
+        throw new VenueEscrowError('not_applied', 'The dispute never reached the chain, so nothing was sent. Try again.', { escrowId });
+    }
+    if (await awaitDisputed(minted.rootAppId, escrowId)) {
+        return Object.assign(Object.assign({}, done), { transactionId: (result === null || result === void 0 ? void 0 : result.status) === 'committed' ? result.transactionId : null });
+    }
+    throw new VenueEscrowError('pending', 'The dispute was sent but is not confirmed yet. Read the escrow with getVenueEscrow to see whether it shows as disputed.', { escrowId });
+}
+/* ----------------------------- one call at a time ------------------------------ */
+const flights = new Map();
+/**
+ * Run `run` unless an identical call is already in flight (a double click shares its result) or a
+ * different one is (refused, never silently answered with the other's result). A Turnkey session's
+ * signer window is reserved here, synchronously, because this runs inside the click.
+ */
+function startFlow(key, fingerprint, needsSigner, run) {
+    let reservation = null;
+    try {
+        const current = flights.get(key);
+        if (current) {
+            if (current.fingerprint === fingerprint)
+                return current.promise;
+            throw new VenueEscrowError('in_progress', 'A different venue escrow request is already in progress for this wallet.');
+        }
+        if (hasTurnkeyWallet() && needsSigner()) {
+            reservation = reserveSignerPopup();
+            if (!reservation)
+                throw new VenueEscrowError('popup_blocked', 'Call this from a click handler so the wallet approval window can open, and allow popups for this site.');
+        }
+        // A flow that fails before the signer loads (a grant the venue refuses, a rule) leaves the reserved
+        // window to explain itself with the error's words for a moment; one that signed has closed it already.
+        const settled = (error) => {
+            var _a;
+            if (((_a = flights.get(key)) === null || _a === void 0 ? void 0 : _a.promise) === promise)
+                flights.delete(key);
+            reservation === null || reservation === void 0 ? void 0 : reservation.release(error instanceof Error ? error.message : undefined);
+        };
+        const promise = run().then((value) => { settled(); return value; }, (error) => { settled(error); throw error; });
+        flights.set(key, { fingerprint, promise });
+        return promise;
+    }
+    catch (error) {
+        reservation === null || reservation === void 0 ? void 0 : reservation.release(error instanceof Error ? error.message : undefined);
+        return Promise.reject(error);
+    }
+}
+/** One tab funds at a time: the saved record is shared by every tab of this browser. */
+function withLock(key, run) {
+    var _a;
+    const locks = (_a = globalThis.navigator) === null || _a === void 0 ? void 0 : _a.locks;
+    if (!(locks === null || locks === void 0 ? void 0 : locks.request))
+        return Promise.reject(new VenueEscrowError('lock_unavailable', 'Venue escrow funding needs the Web Locks API, so that one tab funds at a time.'));
+    return locks.request(key, { ifAvailable: true }, async (lock) => {
+        if (!lock)
+            throw new VenueEscrowError('in_progress', 'This escrow is already being funded in another tab.');
+        return run();
+    });
+}
+/* --------------------------------- public API ---------------------------------- */
+/**
+ * Lock USDC in the venue escrow for `terms.payee`, signed by the wallet signed in here.
+ * MUST be called from a user click: an email (Turnkey) wallet's approval opens in its own Bounded
+ * window, which a browser only allows inside the click (it is opened here, before anything is
+ * awaited), and the approval shows the decoded terms. A Phantom or Wallet Standard wallet keeps
+ * its own prompt. On a real-chain venue the transaction is broadcast on the VENUE's chain: through
+ * the app's own `rpcUrl` when the app configured that same `chain` too (an `rpcUrl` alone does not
+ * say which chain it speaks), otherwise through the platform's default RPC for the venue's chain, so
+ * an app that never configured a chain just works. An app that configured a different `chain` is
+ * refused (`chain_mismatch`) before anything is signed.
+ *
+ * Funding is made safe to retry: a funding that was interrupted (page closed, answer lost) is
+ * saved before anything is sent, and the next call checks it instead of funding again, so pass
+ * the same terms and it resolves to the same `escrowId`. Store `escrowId` on your own record.
+ * See {@link VenueEscrowErrorCode} for the failures, and `pending` in particular.
+ */
+function fundVenueEscrow(terms) {
+    try {
+        const { appId, wallet } = sessionIdentity();
+        const problem = termsProblem(terms, wallet);
+        if (problem)
+            throw new VenueEscrowError('invalid_input', `fundVenueEscrow: ${problem}.`);
+        const checked = {
+            payee: terms.payee, amountUsdc: terms.amountUsdc, challengeSeconds: terms.challengeSeconds, expiresAt: terms.expiresAt, ref: terms.ref,
+        };
+        const key = `${STORAGE_PREFIX}:${appId}:${wallet}`;
+        return startFlow(key, JSON.stringify(checked), () => !loadPending(key, wallet), () => withLock(key, () => fundOrCheck(key, wallet, checked)));
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+}
+/**
+ * Dispute a funded venue escrow as its funder (or payee), signed by the wallet signed in here.
+ * MUST be called from a user click, for the same reason as {@link fundVenueEscrow}. `reason` is
+ * 1 to 400 bytes of UTF-8: the venue allows 1000 characters, but a longer reason does not fit one
+ * legacy-format transaction. Nothing is saved: a dispute that already landed makes the venue refuse
+ * a second one (`rule_refused`).
+ */
+function disputeVenueEscrow(input) {
+    try {
+        const { appId, wallet } = sessionIdentity();
+        const { escrowId, reason } = input !== null && input !== void 0 ? input : {};
+        if (!RECORD_ID.test(String(escrowId)))
+            throw new VenueEscrowError('invalid_input', 'disputeVenueEscrow: escrowId must be 32 hex characters.');
+        if (typeof reason !== 'string' || reason.length < 1 || new TextEncoder().encode(reason).length > MAX_DISPUTE_REASON_BYTES) {
+            throw new VenueEscrowError('invalid_input', `disputeVenueEscrow: reason must be 1 to ${MAX_DISPUTE_REASON_BYTES} bytes.`);
+        }
+        return startFlow(`dispute:${appId}:${wallet}:${escrowId}`, reason, () => true, () => dispute(wallet, escrowId, reason));
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+}
+
 /**
  * DS3-0414: does the transaction already carry a REAL signer signature? A Solana
  * signature is computed over the compiled message, which INCLUDES recentBlockhash, so
@@ -11017,25 +11752,6 @@ class PrivyExpoProvider {
     }
 }
 
-/**
- * Default provider discovery: Phantom-first, then any Wallet-Standard
- * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
- * a user gesture and can be eagerly exported from the SDK entry.
- */
-function defaultInjectedProvider() {
-    var _a;
-    if (typeof window === 'undefined')
-        return null;
-    const w = window;
-    const phantom = (_a = w === null || w === void 0 ? void 0 : w.phantom) === null || _a === void 0 ? void 0 : _a.solana;
-    if (phantom && typeof phantom.signMessage === 'function')
-        return phantom;
-    const generic = w === null || w === void 0 ? void 0 : w.solana;
-    if (generic && typeof generic.signMessage === 'function')
-        return generic;
-    return null;
-}
-
 // injected-evm-wallet-types.ts — tiny, dependency-free surface for the EVM
 // WALLET LOGIN path (BYO wallet via SIWE). The EVM twin of
 // injected-wallet-types.ts: kept separate from injected-evm-wallet-provider.ts
@@ -11435,7 +12151,9 @@ exports.OffchainAuthProvider = OffchainAuthProvider;
 exports.PARK_REASONS = PARK_REASONS;
 exports.PrivyExpoProvider = PrivyExpoProvider;
 exports.RUN_STATES = RUN_STATES;
+exports.SELECTED_WALLET_UNAVAILABLE_ERR = SELECTED_WALLET_UNAVAILABLE_ERR;
 exports.TERMINAL_STATES = TERMINAL_STATES;
+exports.VenueEscrowError = VenueEscrowError;
 exports.WalletConfigError = WalletConfigError;
 exports.apps = apps;
 exports.bs58 = bs58;
@@ -11447,10 +12165,12 @@ exports.connectBroadcast = connectBroadcast;
 exports.connectServiceSession = connectServiceSession;
 exports.defaultInjectedEvmProvider = defaultInjectedEvmProvider;
 exports.defaultInjectedProvider = defaultInjectedProvider;
+exports.disputeVenueEscrow = disputeVenueEscrow;
 exports.ensureSharedWalletLoginReady = ensureSharedWalletLoginReady;
 exports.ensureSignedIn = ensureSignedIn;
 exports.ensureWalletLoginReady = ensureWalletLoginReady;
 exports.firstStandardWalletProvider = firstStandardWalletProvider;
+exports.fundVenueEscrow = fundVenueEscrow;
 exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
@@ -11460,6 +12180,7 @@ exports.getOrCreateTurnkeyWallet = getOrCreateTurnkeyWallet;
 exports.getPlatform = getPlatform;
 exports.getTurnkeyWalletRecoveryUrl = getTurnkeyWalletRecoveryUrl;
 exports.getTurnkeyWalletSessionState = getTurnkeyWalletSessionState;
+exports.getVenueEscrow = getVenueEscrow;
 exports.hasTurnkeyWallet = hasTurnkeyWallet;
 exports.init = init;
 exports.login = login;
@@ -11491,9 +12212,10 @@ exports.signSolanaMessageViaTurnkey = signSolanaMessageViaTurnkey;
 exports.signTransactionV1WithTurnkey = signTransactionV1WithTurnkey;
 exports.signTransactionWithTurnkey = signTransactionWithTurnkey;
 exports.startTurnkeyEmailLogin = startTurnkeyEmailLogin;
+exports.supportsWalletSignIn = supportsWalletSignIn;
 exports.transactionHasSignature = transactionHasSignature;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-BZ0X1Z9X.js.map
+//# sourceMappingURL=index-nU0ZSfWs.js.map