@bounded-sh/client 0.0.115 → 0.0.117-sync.0

package/dist/{guest-auth-provider-d6dk97x6.js.map → guest-auth-provider-DJD3zkBU.js.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-d6dk97x6.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,UAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,iBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,oBAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,oBAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,oBAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-DJD3zkBU.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,UAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,iBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,oBAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,oBAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,oBAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}

package/dist/{guest-auth-provider-3rfSwq3f.js → guest-auth-provider-_jdqZKUo.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index_native = require('./index.native-BBLBnqal.js');
+var index_native = require('./index.native-CMNMw3Pe.js');
 require('react');
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -339,4 +339,4 @@ class GuestAuthProvider {
 }
 
 exports.GuestAuthProvider = GuestAuthProvider;
-//# sourceMappingURL=guest-auth-provider-3rfSwq3f.js.map
+//# sourceMappingURL=guest-auth-provider-_jdqZKUo.js.map

package/dist/{guest-auth-provider-3rfSwq3f.js.map → guest-auth-provider-_jdqZKUo.js.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-3rfSwq3f.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-_jdqZKUo.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState, beforeCommit) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n            await manager.clearSession();\n            return null;\n        }\n        beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession(beforeCommit) {\n        return this.restoreSessionInternal(true, beforeCommit);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,EAAE;AAClE,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AACtF,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,GAAG,MAAM,GAAG,YAAY,EAAE;AAClF,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,YAAY,EAAE;AACvC,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;AAC9D,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}

package/dist/{index-C63ceG_z.mjs → index-BmBLsYn2.mjs}

@@ -1,4 +1,4 @@
-import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, deriveUserIdentityFromIdToken, init as init$2, onSessionCleared, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, getConfiguredAppId, setWithVenueGrant, writeNotAppliedPhase, waitForSetResult, reconcileSetResult, resolveVenueRpcUrl, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, reconnectWithNewAuth, deriveUserIdentityFromIdToken, init as init$2, onSessionCleared, onSessionChange, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, getConfiguredAppId, setWithVenueGrant, writeNotAppliedPhase, waitForSetResult, reconcileSetResult, resolveVenueRpcUrl, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
@@ -6475,7 +6475,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-ByNBWdfi.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-CmbRj-_I.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6517,7 +6517,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BLRrB2rb.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DwozZ926.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6530,7 +6530,7 @@ async function getAuthProvider(config, fromStorage = false) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-C4vNOS4P.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-B2xteR2I.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6555,7 +6555,7 @@ async function getAuthProvider(config, fromStorage = false) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-CGN4k_LG.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-Bvoaq-zC.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6617,7 +6617,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-CGN4k_LG.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-Bvoaq-zC.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6788,7 +6788,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-BLRrB2rb.mjs');
+            await import('./injected-wallet-provider-DwozZ926.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6893,7 +6893,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-BLRrB2rb.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-DwozZ926.mjs');
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -7259,6 +7259,14 @@ function registerStorageBridge() {
             return;
         void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
     });
+    // `storage` fires only in other tabs. Another SDK copy in THIS tab (the hosted widget beside
+    // the app, or the app beside the widget) announces its sign-in and sign-out on the session
+    // channel instead; the nudge carries no authority, the record is re-read the same way.
+    onSessionChange(() => {
+        if (!initializedConfig)
+            return;
+        void syncStoredSession().catch((error) => console.warn('Bounded session synchronization failed:', error));
+    });
 }
 function sameSessionIdentity(next, previous) {
     if (!next || !previous)
@@ -12121,4 +12129,4 @@ function init(config = {}) {
 }
 
 export { onramp as $, logout as A, getAuthProvider as B, signInAnonymously as C, loginWithPrivy as D, loginWithWallet as E, ensureWalletLoginReady as F, ensureSharedWalletLoginReady as G, preloadWalletLogin as H, loginWithRedirect as I, completeLoginFromRedirect as J, getLoginReturnError as K, loginWithPopup as L, openBoundedWidget as M, ensureSignedIn as N, useAuth as O, useQuery as P, useBuildRun as Q, apps as R, SELECTED_WALLET_UNAVAILABLE_ERR as S, signSolanaMessageViaTurnkey as T, getOrCreateTurnkeyWallet as U, openTurnkeyKeyExport as V, WalletConfigError as W, getTurnkeyWalletSessionState as X, getTurnkeyWalletRecoveryUrl as Y, startTurnkeyEmailLogin as Z, getIdToken as _, signMessageWithTurnkey as a, onrampQuote as a0, onrampStatus as a1, fundVenueEscrow as a2, disputeVenueEscrow as a3, getVenueEscrow as a4, VenueEscrowError as a5, setPlatform as a6, OffchainAuthProvider as a7, PrivyExpoProvider as a8, requestEip6963Providers as a9, connectBroadcast as aa, connectServiceSession as ab, builds as ac, BuildsApiError as ad, mediaAgentTools as ae, NON_TERMINAL_STATES as af, TERMINAL_STATES as ag, RUN_STATES as ah, PARK_REASONS as ai, FAILURE_REASONS as aj, BUILD_REVIEW_CAPABILITY_SCHEMA as ak, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as al, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as am, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, supportsWalletSignIn as k, bufferExports as l, setStoredAuthMethod as m, normalizeSolanaRpcUrl as n, confirmAndCheckTransaction as o, defaultInjectedEvmProvider as p, init as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, waitForAuthReady as y, login as z };
-//# sourceMappingURL=index-C63ceG_z.mjs.map
+//# sourceMappingURL=index-BmBLsYn2.mjs.map