@bounded-sh/client 0.0.28 → 0.0.30

package/dist/index.native.js

@@ -3596,10 +3596,15 @@ class GuestAuthProvider {
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
 // ReactNativeSessionManager. getActiveSessionManager() picks the right one by
-// whether the RN manager was configured.
+// whether the RN manager was configured (NOT `typeof window`, which is truthy on
+// RN too and would wrongly route to localStorage). Same selector the core
+// request path uses, so headless email OTP persists + authenticates on BOTH.
 const sessionManager$1 = core.getActiveSessionManager;
-const NO_WALLET = 'Email login is offchain - it has no Solana wallet and cannot sign/submit ' +
+const NO_WALLET = 'Email login is offchain — it has no Solana wallet and cannot sign/submit ' +
     'transactions. Use a wallet provider for onchain actions, or link a wallet later.';
+// ---------------------------------------------------------------------------
+// token / session helpers
+// ---------------------------------------------------------------------------
 function decodeJwt$1(token) {
     try {
         let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
@@ -3608,6 +3613,7 @@ function decodeJwt$1(token) {
             b64 += '==';
         else if (pad === 3)
             b64 += '=';
+        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).
         return JSON.parse(getPlatform().atob(b64));
     }
     catch (_a) {
@@ -3618,12 +3624,194 @@ function userFromIdToken$1(idToken, fallbackEmail) {
     const c = decodeJwt$1(idToken);
     const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';
     const email = (c.email || fallbackEmail || null);
+    // Email logins have no wallet — address is null (the User type allows it).
     return { id, address: (c['custom:walletAddress'] || null), email, provider: emailProviderSingleton };
 }
+async function humanAuthBase() {
+    const cfg = await core.getConfig();
+    const base = cfg.humanAuthApiUrl || 'https://auth.bounded.sh';
+    return base.replace(/\/$/, '');
+}
+async function post(path, body) {
+    const base = await humanAuthBase();
+    let res;
+    try {
+        // Credential-free + no custom header: /email and /verify are open-CORS
+        // (ACAO:*) public OTP routes, so this works inline from ANY app origin (no
+        // popup, no redirect). The OTP is the body secret; the token returns in the
+        // body. Adding credentials or a custom header would break the open-CORS
+        // preflight — keep this a simple JSON POST.
+        res = await fetch(base + path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        throw new Error(`Bounded auth request to ${path} failed: ${(err === null || err === void 0 ? void 0 : err.message) || err}`);
+    }
+    let data = null;
+    try {
+        data = await res.json();
+    }
+    catch ( /* non-JSON */_a) { /* non-JSON */ }
+    if (!res.ok) {
+        const msg = (data && (data.error || data.message)) || `HTTP ${res.status}`;
+        throw new Error(String(msg));
+    }
+    return data || {};
+}
+// ---------------------------------------------------------------------------
+// headless primitives (used by the modal AND exported for custom UIs)
+// ---------------------------------------------------------------------------
+function normalizePhoneNumber(value) {
+    const compact = String(value || '').trim().replace(/[()\s.-]/g, '');
+    return compact.startsWith('00') ? `+${compact.slice(2)}` : compact;
+}
+function assertPhoneNumber(value) {
+    const phoneNumber = normalizePhoneNumber(value);
+    if (!/^\+[1-9]\d{7,14}$/.test(phoneNumber)) {
+        throw new Error('phoneNumber must be in E.164 format, e.g. +14155550132');
+    }
+    return phoneNumber;
+}
+/** Send a login code to `email`. Step 1 of the inline email-OTP flow. */
+async function sendEmailOtp$1(email) {
+    const cfg = await core.getConfig();
+    const e = (email || '').trim().toLowerCase();
+    if (!e)
+        throw new Error('email is required');
+    const data = await post('/email', { email: e, appId: cfg.appId });
+    return { ok: true, expiresInSeconds: data === null || data === void 0 ? void 0 : data.expiresInSeconds };
+}
+/** Send a login code by text message. Requires the Bounded issuer to have text OTP explicitly enabled and SMS configured. */
+async function sendTextOtp$1(phoneNumber) {
+    const cfg = await core.getConfig();
+    const phone = assertPhoneNumber(phoneNumber);
+    const data = await post('/text', { phoneNumber: phone, appId: cfg.appId });
+    return { ok: true, expiresInSeconds: data === null || data === void 0 ? void 0 : data.expiresInSeconds };
+}
+/**
+ * Verify the code for `email` and establish the session. Step 2 of the flow.
+ * Stores the Bounded id token (the realtime bearer) and sets the current user.
+ */
+async function verifyEmailOtp$1(email, otp) {
+    setAuthLoading(true);
+    try {
+        const cfg = await core.getConfig();
+        const e = (email || '').trim().toLowerCase();
+        const code = (otp || '').trim();
+        if (!e || !code)
+            throw new Error('email and code are required');
+        const data = await post('/verify', { email: e, appId: cfg.appId, otp: code });
+        const idToken = data === null || data === void 0 ? void 0 : data.idToken;
+        if (!idToken)
+            throw new Error('No token returned from verification.');
+        const user = userFromIdToken$1(idToken, e);
+        // Store the idToken as BOTH id + access (it is the JWT the realtime worker
+        // verifies and carries `exp`, so the session-manager expiry check works).
+        // address is "" for email (no wallet); the realtime bearer is the idToken.
+        // Persist the rotating refresh token + the issuer base (humanAuthApiUrl) so the
+        // session manager can silently renew via {issuer}/session/refresh — sessions now
+        // live as long as the 30d refresh token instead of dying at the access TTL.
+        const refreshToken = typeof (data === null || data === void 0 ? void 0 : data.refreshToken) === 'string' ? data.refreshToken : '';
+        const issuer = (cfg.humanAuthApiUrl || '').replace(/\/$/, '');
+        await sessionManager$1().storeSession(String(user.address || ''), idToken, idToken, refreshToken, issuer);
+        setCurrentUser(user);
+        return user;
+    }
+    finally {
+        setAuthLoading(false);
+    }
+}
+/**
+ * Verify the text-message code for `phoneNumber` and establish the session.
+ * Phone-only users have `user.email === null`; use `user.id` for ownership.
+ */
+async function verifyTextOtp$1(phoneNumber, otp) {
+    setAuthLoading(true);
+    try {
+        const cfg = await core.getConfig();
+        const phone = assertPhoneNumber(phoneNumber);
+        const code = (otp || '').trim();
+        if (!code)
+            throw new Error('code is required');
+        const data = await post('/text/verify', { phoneNumber: phone, appId: cfg.appId, otp: code });
+        const idToken = data === null || data === void 0 ? void 0 : data.idToken;
+        if (!idToken)
+            throw new Error('No token returned from verification.');
+        const user = userFromIdToken$1(idToken);
+        const refreshToken = typeof (data === null || data === void 0 ? void 0 : data.refreshToken) === 'string' ? data.refreshToken : '';
+        const issuer = (cfg.humanAuthApiUrl || '').replace(/\/$/, '');
+        await sessionManager$1().storeSession(String(user.address || ''), idToken, idToken, refreshToken, issuer);
+        setCurrentUser(user);
+        return user;
+    }
+    finally {
+        setAuthLoading(false);
+    }
+}
+/**
+ * UPGRADE an anonymous (guest) session by LINKING an email credential — Firebase
+ * `linkWithCredential` parity. The guest's `guestToken` is sent to the auth issuer
+ * which, IF the email is brand-new, makes the new account ADOPT the guest's id so
+ * `@user.id` is preserved and the guest's data carries over. If the email already
+ * exists, the user just signs into it (stays separate; `linked:false`). On success
+ * the upgraded session replaces the guest session and the user is no longer
+ * anonymous. `guestToken` is captured by the caller BEFORE switching auth methods.
+ */
+async function linkEmailWithGuest(email, otp, guestToken) {
+    var _a;
+    setAuthLoading(true);
+    try {
+        const cfg = await core.getConfig();
+        const e = (email || '').trim().toLowerCase();
+        const code = (otp || '').trim();
+        if (!e || !code)
+            throw new Error('email and code are required');
+        if (!guestToken)
+            throw new Error('an active anonymous session is required to link an email');
+        // Capture the OLD guest session's refresh token + issuer BEFORE it's overwritten,
+        // so we can revoke the guest refresh family after the upgrade. Otherwise a stolen
+        // guest refresh token would keep minting access to the now-upgraded identity.
+        const oldRefreshToken = sessionManager$1().getRefreshToken();
+        const oldIssuer = (_a = sessionManager$1().getIssuer()) !== null && _a !== void 0 ? _a : undefined;
+        const data = await post('/link/email', { email: e, appId: cfg.appId, otp: code, guestToken });
+        const idToken = data === null || data === void 0 ? void 0 : data.idToken;
+        if (!idToken)
+            throw new Error('No token returned from link.');
+        const user = userFromIdToken$1(idToken, e);
+        // Persist the REAL rotating refresh token + human issuer so the upgraded session
+        // silently renews (was previously stored as '' -> upgraded users couldn't refresh).
+        const refreshToken = typeof (data === null || data === void 0 ? void 0 : data.refreshToken) === 'string' ? data.refreshToken : '';
+        const issuer = (cfg.humanAuthApiUrl || '').replace(/\/$/, '');
+        await sessionManager$1().storeSession(String(user.address || ''), idToken, idToken, refreshToken, issuer);
+        setCurrentUser(user);
+        // Best-effort revoke of the old guest refresh family (upgrade is already committed;
+        // a revoke failure must not break the new session).
+        if (oldRefreshToken && oldRefreshToken !== refreshToken) {
+            try {
+                await core.revokeSession(oldRefreshToken, oldIssuer);
+            }
+            catch ( /* best-effort */_b) { /* best-effort */ }
+        }
+        return { user, linked: !!(data === null || data === void 0 ? void 0 : data.linked), isNewAccount: !!(data === null || data === void 0 ? void 0 : data.isNewAccount) };
+    }
+    finally {
+        setAuthLoading(false);
+    }
+}
+// ---------------------------------------------------------------------------
+// provider
+// ---------------------------------------------------------------------------
 class EmailAuthProvider {
     async login() {
-        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri, methods: ["email"] }) ' +
-            'or loginWithPopup({ methods: ["email"] }) instead.');
+        if (!getPlatform().hasDOM) {
+            throw new Error('Email login on this platform (e.g. React Native) is headless: call ' +
+                "sendEmailOtp(email) then verifyEmailOtp(email, code), or, when text OTP is enabled, " +
+                "sendTextOtp(phone) then verifyTextOtp(phone, code). Render your own OTP inputs. The built-in modal is web-only.");
+        }
+        return openEmailModal();
     }
     async restoreSession() {
         const sm = sessionManager$1();
@@ -3641,23 +3829,290 @@ class EmailAuthProvider {
         sessionManager$1().clearSession();
         setCurrentUser(null);
     }
-    async signMessage(_message) {
-        throw new Error(NO_WALLET);
-    }
-    async runTransaction(_evm, _sol, _options) {
-        throw new Error(NO_WALLET);
-    }
-    async signTransaction(_transaction) {
-        throw new Error(NO_WALLET);
-    }
-    async signAndSubmitTransaction() {
-        throw new Error(NO_WALLET);
-    }
-    async getNativeMethods() {
-        return {};
-    }
+    async signMessage(_message) { throw new Error(NO_WALLET); }
+    async runTransaction(_evm, _sol, _options) { throw new Error(NO_WALLET); }
+    async signTransaction(_t) { throw new Error(NO_WALLET); }
+    async signAndSubmitTransaction() { throw new Error(NO_WALLET); }
+    async getNativeMethods() { return {}; }
 }
 const emailProviderSingleton = new EmailAuthProvider();
+// ---------------------------------------------------------------------------
+// inline modal (web only) — mobile-first, no popup, no redirect
+// ---------------------------------------------------------------------------
+function openEmailModal() {
+    return new Promise((resolve) => {
+        var _a;
+        const root = createEmailModalTree();
+        const style = document.createElement('style');
+        style.textContent = MODAL_CSS;
+        root.appendChild(style);
+        document.body.appendChild(root);
+        const $ = (id) => root.querySelector('#' + id);
+        const emailStep = $('ba-email-step');
+        const otpStep = $('ba-otp-step');
+        const emailInput = $('ba-email');
+        const otpInput = $('ba-otp');
+        const sentTo = $('ba-sent-to');
+        const msg = $('ba-msg');
+        const emailBtn = $('ba-email-btn');
+        const otpBtn = $('ba-otp-btn');
+        let email = '';
+        let done = false;
+        const setMsg = (t, err = false) => { msg.textContent = t; msg.className = 'ba-msg' + (err ? ' err' : ''); };
+        const close = (user) => {
+            var _a;
+            if (done)
+                return;
+            done = true;
+            document.removeEventListener('keydown', onEsc);
+            (_a = root.querySelector('.ba-overlay')) === null || _a === void 0 ? void 0 : _a.classList.add('out');
+            setTimeout(() => root.remove(), 160);
+            resolve(user);
+        };
+        const onEsc = (e) => { if (e.key === 'Escape')
+            close(null); };
+        document.addEventListener('keydown', onEsc);
+        (_a = root.querySelector('.ba-overlay')) === null || _a === void 0 ? void 0 : _a.addEventListener('click', (e) => {
+            if (e.target.classList.contains('ba-overlay'))
+                close(null);
+        });
+        $('ba-close').addEventListener('click', () => close(null));
+        requestAnimationFrame(() => emailInput.focus());
+        emailBtn.addEventListener('click', async () => {
+            email = emailInput.value.trim();
+            if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+                setMsg('Enter a valid email.', true);
+                return;
+            }
+            emailBtn.disabled = true;
+            setMsg('Sending code…');
+            try {
+                await sendEmailOtp$1(email);
+                sentTo.textContent = email;
+                emailStep.classList.add('hidden');
+                otpStep.classList.remove('hidden');
+                setMsg('');
+                otpInput.focus();
+            }
+            catch (err) {
+                setMsg((err === null || err === void 0 ? void 0 : err.message) || 'Could not send the code.', true);
+            }
+            finally {
+                emailBtn.disabled = false;
+            }
+        });
+        emailInput.addEventListener('keydown', (e) => { if (e.key === 'Enter')
+            emailBtn.click(); });
+        otpBtn.addEventListener('click', async () => {
+            const code = otpInput.value.trim();
+            if (!/^\d{4,8}$/.test(code)) {
+                setMsg('Enter the code from your email.', true);
+                return;
+            }
+            otpBtn.disabled = true;
+            setMsg('Verifying…');
+            try {
+                const user = await verifyEmailOtp$1(email, code);
+                close(user);
+            }
+            catch (err) {
+                setMsg((err === null || err === void 0 ? void 0 : err.message) || 'That code did not work.', true);
+                otpBtn.disabled = false;
+            }
+        });
+        otpInput.addEventListener('keydown', (e) => { if (e.key === 'Enter')
+            otpBtn.click(); });
+        $('ba-back').addEventListener('click', () => {
+            otpStep.classList.add('hidden');
+            emailStep.classList.remove('hidden');
+            setMsg('');
+            emailInput.focus();
+        });
+    });
+}
+function createEmailModalTree() {
+    const root = document.createElement('div');
+    root.id = 'bounded-auth-modal';
+    const overlay = document.createElement('div');
+    overlay.className = 'ba-overlay';
+    root.appendChild(overlay);
+    const card = document.createElement('div');
+    card.className = 'ba-card';
+    card.setAttribute('role', 'dialog');
+    card.setAttribute('aria-modal', 'true');
+    card.setAttribute('aria-label', 'Sign in');
+    overlay.appendChild(card);
+    const close = document.createElement('button');
+    close.id = 'ba-close';
+    close.className = 'ba-x';
+    close.setAttribute('aria-label', 'Close');
+    close.type = 'button';
+    close.textContent = '×';
+    card.appendChild(close);
+    // Brand row — the real Bounded mark (same geometry as bounded.sh) + wordmark.
+    const brand = document.createElement('div');
+    brand.className = 'ba-brand';
+    const mark = document.createElement('span');
+    mark.className = 'ba-mark';
+    mark.setAttribute('aria-hidden', 'true');
+    const svgNs = 'http://www.w3.org/2000/svg';
+    const markSvg = document.createElementNS(svgNs, 'svg');
+    markSvg.setAttribute('width', '24');
+    markSvg.setAttribute('height', '24');
+    markSvg.setAttribute('viewBox', '0 0 32 32');
+    markSvg.setAttribute('fill', 'none');
+    for (const [className, d] of [
+        ['ba-c ba-c1', 'M16 5 H5 V16'],
+        ['ba-c ba-c2', 'M16 5 H27 V16'],
+        ['ba-c ba-c3', 'M5 16 V27 H16'],
+        ['ba-c ba-c4', 'M27 16 V27 H16'],
+    ]) {
+        const path = document.createElementNS(svgNs, 'path');
+        path.setAttribute('class', className);
+        path.setAttribute('d', d);
+        markSvg.appendChild(path);
+    }
+    mark.appendChild(markSvg);
+    brand.appendChild(mark);
+    const word = document.createElement('span');
+    word.className = 'ba-word';
+    word.textContent = 'bounded';
+    brand.appendChild(word);
+    card.appendChild(brand);
+    const title = document.createElement('h1');
+    title.className = 'ba-title';
+    title.textContent = 'Sign in';
+    card.appendChild(title);
+    const sub = document.createElement('p');
+    sub.className = 'ba-subtitle';
+    sub.textContent = 'Continue with your email — no wallet needed.';
+    card.appendChild(sub);
+    const emailStep = document.createElement('div');
+    emailStep.id = 'ba-email-step';
+    card.appendChild(emailStep);
+    const emailLabel = document.createElement('label');
+    emailLabel.className = 'ba-label';
+    emailLabel.htmlFor = 'ba-email';
+    emailLabel.textContent = 'Email';
+    emailStep.appendChild(emailLabel);
+    const emailInput = document.createElement('input');
+    emailInput.id = 'ba-email';
+    emailInput.className = 'ba-input';
+    emailInput.type = 'email';
+    emailInput.inputMode = 'email';
+    emailInput.autocomplete = 'email';
+    emailInput.placeholder = 'you@example.com';
+    emailStep.appendChild(emailInput);
+    const emailButton = document.createElement('button');
+    emailButton.id = 'ba-email-btn';
+    emailButton.className = 'ba-btn';
+    emailButton.type = 'button';
+    emailButton.textContent = 'Continue with email';
+    emailStep.appendChild(emailButton);
+    const otpStep = document.createElement('div');
+    otpStep.id = 'ba-otp-step';
+    otpStep.className = 'hidden';
+    card.appendChild(otpStep);
+    const otpLabel = document.createElement('label');
+    otpLabel.className = 'ba-label';
+    otpLabel.htmlFor = 'ba-otp';
+    otpLabel.appendChild(document.createTextNode('Enter the code sent to '));
+    const sentTo = document.createElement('span');
+    sentTo.id = 'ba-sent-to';
+    sentTo.className = 'ba-em';
+    otpLabel.appendChild(sentTo);
+    otpStep.appendChild(otpLabel);
+    const otpInput = document.createElement('input');
+    otpInput.id = 'ba-otp';
+    otpInput.className = 'ba-input ba-code';
+    otpInput.inputMode = 'numeric';
+    otpInput.autocomplete = 'one-time-code';
+    otpInput.maxLength = 8;
+    otpInput.placeholder = '······';
+    otpStep.appendChild(otpInput);
+    const otpButton = document.createElement('button');
+    otpButton.id = 'ba-otp-btn';
+    otpButton.className = 'ba-btn';
+    otpButton.type = 'button';
+    otpButton.textContent = 'Verify & continue';
+    otpStep.appendChild(otpButton);
+    const backButton = document.createElement('button');
+    backButton.id = 'ba-back';
+    backButton.className = 'ba-link';
+    backButton.type = 'button';
+    backButton.textContent = 'Use a different email';
+    otpStep.appendChild(backButton);
+    const msg = document.createElement('div');
+    msg.id = 'ba-msg';
+    msg.className = 'ba-msg';
+    card.appendChild(msg);
+    const foot = document.createElement('div');
+    foot.className = 'ba-foot';
+    foot.textContent = 'Secured by Bounded';
+    card.appendChild(foot);
+    return root;
+}
+// Design language matches the hosted Bounded login (auth.bounded.sh) and bounded.sh:
+// dark editorial panel, green accent, Schibsted Grotesk / Newsreader / JetBrains Mono,
+// the Bounded mark drawing itself in. Fonts load best-effort (scoped @import); every
+// rule has a system fallback so the modal looks right even if Google Fonts is blocked.
+// All selectors are scoped under #bounded-auth-modal so we never leak into the host page.
+const MODAL_CSS = `
+@import url('https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap');
+#bounded-auth-modal{--ba-bg:#0a0a0b;--ba-panel:#0e0f11;--ba-inset:#060607;--ba-raise:#131416;
+ --ba-line:rgba(232,230,222,.08);--ba-line-strong:rgba(232,230,222,.16);
+ --ba-text:#e8e6de;--ba-dim:#9b9991;--ba-faint:#85837c;--ba-green:#58c98f;
+ --ba-green-bg:rgba(88,201,143,.09);--ba-green-line:rgba(88,201,143,.28);--ba-red:#ec8488;
+ --ba-body:'Schibsted Grotesk',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
+ --ba-display:'Newsreader','Iowan Old Style',Georgia,serif;
+ --ba-mono:'JetBrains Mono',ui-monospace,'SF Mono',Menlo,monospace;}
+#bounded-auth-modal .ba-overlay{position:fixed;inset:0;background:rgba(6,6,7,.66);backdrop-filter:blur(4px);
+ display:flex;align-items:center;justify-content:center;z-index:2147483000;opacity:1;transition:opacity .16s ease;
+ font-family:var(--ba-body);padding:16px;}
+#bounded-auth-modal .ba-overlay.out{opacity:0;}
+#bounded-auth-modal *{box-sizing:border-box;}
+#bounded-auth-modal .ba-card{width:100%;max-width:372px;background:var(--ba-panel);color:var(--ba-text);
+ border:1px solid var(--ba-line);border-radius:12px;padding:28px 28px 22px;position:relative;
+ box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 30px 80px -40px rgba(0,0,0,.8);animation:ba-in .18s ease;}
+@keyframes ba-in{from{transform:translateY(8px);opacity:.5}to{transform:translateY(0);opacity:1}}
+#bounded-auth-modal .ba-x{position:absolute;top:14px;right:14px;width:28px;height:28px;border:1px solid var(--ba-line);
+ background:var(--ba-raise);color:var(--ba-faint);border-radius:7px;font-size:18px;line-height:1;cursor:pointer;
+ transition:color .15s,border-color .15s;}
+#bounded-auth-modal .ba-x:hover{color:var(--ba-text);border-color:var(--ba-faint);}
+#bounded-auth-modal .ba-brand{display:flex;align-items:center;gap:10px;margin:0 0 24px;}
+#bounded-auth-modal .ba-mark{display:flex;color:var(--ba-text);}
+#bounded-auth-modal .ba-mark svg{overflow:visible;display:block;}
+#bounded-auth-modal .ba-c{stroke:currentColor;stroke-width:2.4;fill:none;}
+@media (prefers-reduced-motion:no-preference){
+ #bounded-auth-modal .ba-c{stroke-dasharray:23;stroke-dashoffset:23;animation:ba-draw .4s cubic-bezier(.45,0,.2,1) forwards;}
+ #bounded-auth-modal .ba-c1{animation-delay:.1s}#bounded-auth-modal .ba-c2{animation-delay:.38s}
+ #bounded-auth-modal .ba-c3{animation-delay:.66s}#bounded-auth-modal .ba-c4{animation-delay:.94s}}
+@keyframes ba-draw{to{stroke-dashoffset:0}}
+#bounded-auth-modal .ba-word{font-family:var(--ba-body);font-weight:500;font-size:15px;letter-spacing:.2px;color:var(--ba-text);}
+#bounded-auth-modal .ba-title{font-family:var(--ba-display);font-weight:400;font-size:25px;letter-spacing:-.01em;margin:0 0 5px;}
+#bounded-auth-modal .ba-subtitle{color:var(--ba-dim);font-size:14px;margin:0 0 22px;}
+#bounded-auth-modal .ba-label{display:block;font-size:12px;color:var(--ba-dim);margin:0 0 7px;}
+#bounded-auth-modal .ba-em{color:var(--ba-text);font-weight:600;}
+#bounded-auth-modal .ba-input{width:100%;background:var(--ba-inset);border:1px solid var(--ba-line-strong);color:var(--ba-text);
+ border-radius:6px;padding:11px 13px;font-family:var(--ba-body);font-size:15px;outline:none;transition:border-color .15s,box-shadow .15s;}
+#bounded-auth-modal .ba-input::placeholder{color:var(--ba-faint);}
+#bounded-auth-modal .ba-input:focus{border-color:var(--ba-green-line);box-shadow:0 0 0 3px var(--ba-green-bg);}
+#bounded-auth-modal .ba-code{font-family:var(--ba-mono);letter-spacing:8px;text-align:center;font-size:21px;padding-left:8px;}
+#bounded-auth-modal .ba-btn{width:100%;margin-top:16px;background:var(--ba-text);color:var(--ba-bg);
+ border:0;border-radius:6px;padding:12px;font-family:var(--ba-body);font-size:14px;font-weight:600;cursor:pointer;
+ transition:opacity .15s,transform .04s;}
+#bounded-auth-modal .ba-btn:hover{opacity:.9;}
+#bounded-auth-modal .ba-btn:active{transform:translateY(.5px);}
+#bounded-auth-modal .ba-btn:disabled{opacity:.45;cursor:default;}
+#bounded-auth-modal .ba-link{width:100%;margin-top:14px;background:none;border:none;color:var(--ba-dim);
+ font-family:var(--ba-body);font-size:12.5px;cursor:pointer;}
+#bounded-auth-modal .ba-link:hover{color:var(--ba-text);}
+#bounded-auth-modal .ba-msg{min-height:16px;margin-top:16px;font-size:12.5px;color:var(--ba-dim);text-align:center;}
+#bounded-auth-modal .ba-msg.err{color:var(--ba-red);}
+#bounded-auth-modal .ba-foot{margin-top:26px;padding-top:16px;border-top:1px solid var(--ba-line);
+ text-align:center;font-size:11px;color:var(--ba-faint);}
+#bounded-auth-modal .hidden{display:none;}
+@media (max-width:480px){#bounded-auth-modal .ba-card{max-width:none;}}`;
 
 const SURFNET_RPC_URL = "https://surfpool.fly.dev";
 const SUPPORTED_SOLANA_NETWORKS = new Set([
@@ -3795,7 +4250,11 @@ async function buildAuthorize(opts, guestHint) {
     const cfg = await core.getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
-    const redirectUri = opts.redirectUri;
+    // Web: default to the current page so callers don't have to pass redirectUri. Native has no
+    // window — it MUST pass an https universal link (the system auth session needs a real URL).
+    const redirectUri = opts.redirectUri || (hasDOM() ? window.location.origin + window.location.pathname : undefined);
+    if (!redirectUri)
+        throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
     const state = randomState();
     const base = await issuerBase();
@@ -3954,6 +4413,21 @@ async function completeLoginFromRedirect() {
     const returnedState = url.searchParams.get('state');
     if (!code)
         return null;
+    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
+    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
+    // The opener is the same app/origin, so post to our own origin (the opener's message
+    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
+    if (window.opener && window.opener !== window) {
+        try {
+            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
+        }
+        catch ( /* ignore */_a) { /* ignore */ }
+        try {
+            window.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        return null;
+    }
     setAuthLoading(true);
     try {
         const raw = sessionStorage.getItem(PKCE_STORE_KEY);
@@ -3987,7 +4461,9 @@ async function loginWithPopup(opts) {
     const popup = window.open(url, 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup)
         throw new Error('Popup blocked — use loginWithRedirect() instead');
-    const expectedOrigin = new URL(opts.redirectUri).origin;
+    // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
+    // not opts.redirectUri which may be undefined.
+    const expectedOrigin = new URL(pkce.redirectUri).origin;
     return await new Promise((resolve, reject) => {
         const onMsg = async (ev) => {
             if (ev.origin !== expectedOrigin)
@@ -4359,43 +4835,77 @@ async function loginWithPrivy(options) {
     const result = await provider.login();
     return result ? Object.assign(Object.assign({}, result), { provider }) : null;
 }
+// Activate the inline email provider (method=email so reload-restore + logout work),
+// mirroring signInAnonymously. Used by verifyEmailOtp/verifyTextOtp/linkEmail.
+async function activateEmailProvider() {
+    const provider = new EmailAuthProvider();
+    currentAuthProvider = provider;
+    currentAuthMethod = 'email';
+    currentAuthProviderConfigKey = 'direct:email';
+    const coreConfig = await core.getConfig();
+    coreConfig.authProvider = provider;
+    coreConfig.authMethod = 'email';
+    setAuthProviderInstance(provider);
+    setStoredAuthMethod('email');
+    return provider;
+}
 /**
- * @deprecated Inline app-origin OTP is retired. Use
- * `loginWithRedirect({ redirectUri, methods: ["email"] })` so the credential is
- * entered on the Bounded hosted issuer.
+ * Send a 6-digit login code to `email` (Bounded Better Auth). Step 1 of the
+ * inline email flow — build your own email/code UI for full control over the
+ * look, or just call `login()` for the built-in modal. Works on web AND React
+ * Native (no DOM needed). Prefer `loginWithRedirect()`/`loginWithPopup()` if you
+ * want the credential entered on Bounded's hosted page instead.
  */
 async function sendEmailOtp(email) {
-    throw new Error('sendEmailOtp is retired. Use loginWithRedirect({ redirectUri, methods: ["email"] }) instead.');
+    assertBrowserAuthEnv('sendEmailOtp');
+    return sendEmailOtp$1(email);
 }
 /**
- * @deprecated Inline app-origin text OTP is retired. Use hosted login with
- * `provider: "text"` or `methods: ["text"]` when text OTP is enabled.
+ * Send a 6-digit login code by text message. Requires the configured Bounded
+ * auth issuer to have text OTP explicitly enabled and SMS delivery configured.
+ * Works on web AND React Native.
  */
 async function sendTextOtp(phoneNumber) {
-    throw new Error('sendTextOtp is retired. Use loginWithRedirect({ redirectUri, provider: "text" }) instead.');
+    assertBrowserAuthEnv('sendTextOtp');
+    return sendTextOtp$1(phoneNumber);
 }
 /**
- * @deprecated Inline app-origin OTP is retired. Finish hosted login with
- * `completeLoginFromRedirect()` on web; React Native `loginWithRedirect()`
- * resolves inline.
+ * Verify the `code` for `email`, establish the session, and return the user.
+ * Step 2 of the inline email flow. Coexists with signInAnonymously()/wallets.
  */
 async function verifyEmailOtp(email, code) {
-    throw new Error('verifyEmailOtp is retired. Use hosted loginWithRedirect instead.');
+    assertBrowserAuthEnv('verifyEmailOtp');
+    await activateEmailProvider();
+    return verifyEmailOtp$1(email, code);
 }
 /**
- * @deprecated Inline app-origin text OTP is retired. Finish hosted login with
- * `completeLoginFromRedirect()` on web; React Native `loginWithRedirect()`
- * resolves inline.
+ * Verify the text-message `code`, establish the session, and return the user.
+ * Phone-only users have no `user.email`; use `user.id` for app identity.
  */
 async function verifyTextOtp(phoneNumber, code) {
-    throw new Error('verifyTextOtp is retired. Use hosted loginWithRedirect instead.');
+    assertBrowserAuthEnv('verifyTextOtp');
+    await activateEmailProvider();
+    return verifyTextOtp$1(phoneNumber, code);
 }
 /**
- * @deprecated Inline app-origin guest upgrade is retired. Send the user through
- * hosted login and transfer guest-owned data explicitly.
+ * UPGRADE the current anonymous (guest) session by linking an email — Firebase
+ * `linkWithCredential` parity. Send the code first with `sendEmailOtp(email)`,
+ * then call `linkEmail(email, code)`. If the email is brand-new the guest's
+ * `@user.id` (and its data) is preserved; if the email already exists the user
+ * just signs into it (no merge). Requires an active guest session, and the issuer
+ * refuses if the wallet is already linked. Browser/React-Native only.
  */
 async function linkEmail(email, code) {
-    throw new Error('linkEmail is retired. Use hosted login and transfer guest-owned data explicitly.');
+    assertBrowserAuthEnv('linkEmail');
+    // Capture the GUEST token BEFORE switching auth methods — the issuer needs it
+    // to prove guest ownership and adopt its id into the new email account.
+    const guestToken = core.getActiveSessionManager().getIdToken();
+    if (!guestToken) {
+        throw new Error('linkEmail requires an active anonymous session — call signInAnonymously() first.');
+    }
+    await activateEmailProvider(); // method=email so the upgraded user is no longer anonymous
+    const { user } = await linkEmailWithGuest(email, code, guestToken);
+    return user;
 }
 async function login$1(options) {
     // Re-initialize provider if it was cleared by logout