@bounded-sh/client 0.0.31 → 0.0.33

package/dist/index.native.mjs

@@ -1,4 +1,4 @@
-import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature, getConfig, revokeSession, WebSessionManager, ReactNativeSessionManager, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction } from '@bounded-sh/core';
+import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction } from '@bounded-sh/core';
 export * from '@bounded-sh/core';
 export { aggregate, count, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
 import * as React from 'react';
@@ -3578,7 +3578,7 @@ class GuestAuthProvider {
 // ReactNativeSessionManager. getActiveSessionManager() picks the right one by
 // whether the RN manager was configured (NOT `typeof window`, which is truthy on
 // RN too and would wrongly route to localStorage). Same selector the core
-// request path uses, so headless email OTP persists + authenticates on BOTH.
+// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.
 const sessionManager$1 = getActiveSessionManager;
 const NO_WALLET = 'Email login is offchain — it has no Solana wallet and cannot sign/submit ' +
     'transactions. Use a wallet provider for onchain actions, or link a wallet later.';
@@ -3607,191 +3607,13 @@ function userFromIdToken$1(idToken, fallbackEmail) {
     // Email logins have no wallet — address is null (the User type allows it).
     return { id, address: (c['custom:walletAddress'] || null), email, provider: emailProviderSingleton };
 }
-async function humanAuthBase() {
-    const cfg = await getConfig();
-    const base = cfg.humanAuthApiUrl || 'https://auth.bounded.sh';
-    return base.replace(/\/$/, '');
-}
-async function post(path, body) {
-    const base = await humanAuthBase();
-    let res;
-    try {
-        // Credential-free + no custom header: /email and /verify are open-CORS
-        // (ACAO:*) public OTP routes, so this works inline from ANY app origin (no
-        // popup, no redirect). The OTP is the body secret; the token returns in the
-        // body. Adding credentials or a custom header would break the open-CORS
-        // preflight — keep this a simple JSON POST.
-        res = await fetch(base + path, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(body),
-        });
-    }
-    catch (err) {
-        throw new Error(`Bounded auth request to ${path} failed: ${(err === null || err === void 0 ? void 0 : err.message) || err}`);
-    }
-    let data = null;
-    try {
-        data = await res.json();
-    }
-    catch ( /* non-JSON */_a) { /* non-JSON */ }
-    if (!res.ok) {
-        const msg = (data && (data.error || data.message)) || `HTTP ${res.status}`;
-        throw new Error(String(msg));
-    }
-    return data || {};
-}
-// ---------------------------------------------------------------------------
-// headless primitives (used by the modal AND exported for custom UIs)
-// ---------------------------------------------------------------------------
-function normalizePhoneNumber(value) {
-    const compact = String(value || '').trim().replace(/[()\s.-]/g, '');
-    return compact.startsWith('00') ? `+${compact.slice(2)}` : compact;
-}
-function assertPhoneNumber(value) {
-    const phoneNumber = normalizePhoneNumber(value);
-    if (!/^\+[1-9]\d{7,14}$/.test(phoneNumber)) {
-        throw new Error('phoneNumber must be in E.164 format, e.g. +14155550132');
-    }
-    return phoneNumber;
-}
-/** Send a login code to `email`. Step 1 of the inline email-OTP flow. */
-async function sendEmailOtp$1(email) {
-    const cfg = await getConfig();
-    const e = (email || '').trim().toLowerCase();
-    if (!e)
-        throw new Error('email is required');
-    const data = await post('/email', { email: e, appId: cfg.appId });
-    return { ok: true, expiresInSeconds: data === null || data === void 0 ? void 0 : data.expiresInSeconds };
-}
-/** Send a login code by text message. Requires the Bounded issuer to have text OTP explicitly enabled and SMS configured. */
-async function sendTextOtp$1(phoneNumber) {
-    const cfg = await getConfig();
-    const phone = assertPhoneNumber(phoneNumber);
-    const data = await post('/text', { phoneNumber: phone, appId: cfg.appId });
-    return { ok: true, expiresInSeconds: data === null || data === void 0 ? void 0 : data.expiresInSeconds };
-}
-/**
- * Verify the code for `email` and establish the session. Step 2 of the flow.
- * Stores the Bounded id token (the realtime bearer) and sets the current user.
- */
-async function verifyEmailOtp$1(email, otp) {
-    setAuthLoading(true);
-    try {
-        const cfg = await getConfig();
-        const e = (email || '').trim().toLowerCase();
-        const code = (otp || '').trim();
-        if (!e || !code)
-            throw new Error('email and code are required');
-        const data = await post('/verify', { email: e, appId: cfg.appId, otp: code });
-        const idToken = data === null || data === void 0 ? void 0 : data.idToken;
-        if (!idToken)
-            throw new Error('No token returned from verification.');
-        const user = userFromIdToken$1(idToken, e);
-        // Store the idToken as BOTH id + access (it is the JWT the realtime worker
-        // verifies and carries `exp`, so the session-manager expiry check works).
-        // address is "" for email (no wallet); the realtime bearer is the idToken.
-        // Persist the rotating refresh token + the issuer base (humanAuthApiUrl) so the
-        // session manager can silently renew via {issuer}/session/refresh — sessions now
-        // live as long as the 30d refresh token instead of dying at the access TTL.
-        const refreshToken = typeof (data === null || data === void 0 ? void 0 : data.refreshToken) === 'string' ? data.refreshToken : '';
-        const issuer = (cfg.humanAuthApiUrl || '').replace(/\/$/, '');
-        await sessionManager$1().storeSession(String(user.address || ''), idToken, idToken, refreshToken, issuer);
-        setCurrentUser(user);
-        return user;
-    }
-    finally {
-        setAuthLoading(false);
-    }
-}
-/**
- * Verify the text-message code for `phoneNumber` and establish the session.
- * Phone-only users have `user.email === null`; use `user.id` for ownership.
- */
-async function verifyTextOtp$1(phoneNumber, otp) {
-    setAuthLoading(true);
-    try {
-        const cfg = await getConfig();
-        const phone = assertPhoneNumber(phoneNumber);
-        const code = (otp || '').trim();
-        if (!code)
-            throw new Error('code is required');
-        const data = await post('/text/verify', { phoneNumber: phone, appId: cfg.appId, otp: code });
-        const idToken = data === null || data === void 0 ? void 0 : data.idToken;
-        if (!idToken)
-            throw new Error('No token returned from verification.');
-        const user = userFromIdToken$1(idToken);
-        const refreshToken = typeof (data === null || data === void 0 ? void 0 : data.refreshToken) === 'string' ? data.refreshToken : '';
-        const issuer = (cfg.humanAuthApiUrl || '').replace(/\/$/, '');
-        await sessionManager$1().storeSession(String(user.address || ''), idToken, idToken, refreshToken, issuer);
-        setCurrentUser(user);
-        return user;
-    }
-    finally {
-        setAuthLoading(false);
-    }
-}
-/**
- * UPGRADE an anonymous (guest) session by LINKING an email credential — Firebase
- * `linkWithCredential` parity. The guest's `guestToken` is sent to the auth issuer
- * which, IF the email is brand-new, makes the new account ADOPT the guest's id so
- * `@user.id` is preserved and the guest's data carries over. If the email already
- * exists, the user just signs into it (stays separate; `linked:false`). On success
- * the upgraded session replaces the guest session and the user is no longer
- * anonymous. `guestToken` is captured by the caller BEFORE switching auth methods.
- */
-async function linkEmailWithGuest(email, otp, guestToken) {
-    var _a;
-    setAuthLoading(true);
-    try {
-        const cfg = await getConfig();
-        const e = (email || '').trim().toLowerCase();
-        const code = (otp || '').trim();
-        if (!e || !code)
-            throw new Error('email and code are required');
-        if (!guestToken)
-            throw new Error('an active anonymous session is required to link an email');
-        // Capture the OLD guest session's refresh token + issuer BEFORE it's overwritten,
-        // so we can revoke the guest refresh family after the upgrade. Otherwise a stolen
-        // guest refresh token would keep minting access to the now-upgraded identity.
-        const oldRefreshToken = sessionManager$1().getRefreshToken();
-        const oldIssuer = (_a = sessionManager$1().getIssuer()) !== null && _a !== void 0 ? _a : undefined;
-        const data = await post('/link/email', { email: e, appId: cfg.appId, otp: code, guestToken });
-        const idToken = data === null || data === void 0 ? void 0 : data.idToken;
-        if (!idToken)
-            throw new Error('No token returned from link.');
-        const user = userFromIdToken$1(idToken, e);
-        // Persist the REAL rotating refresh token + human issuer so the upgraded session
-        // silently renews (was previously stored as '' -> upgraded users couldn't refresh).
-        const refreshToken = typeof (data === null || data === void 0 ? void 0 : data.refreshToken) === 'string' ? data.refreshToken : '';
-        const issuer = (cfg.humanAuthApiUrl || '').replace(/\/$/, '');
-        await sessionManager$1().storeSession(String(user.address || ''), idToken, idToken, refreshToken, issuer);
-        setCurrentUser(user);
-        // Best-effort revoke of the old guest refresh family (upgrade is already committed;
-        // a revoke failure must not break the new session).
-        if (oldRefreshToken && oldRefreshToken !== refreshToken) {
-            try {
-                await revokeSession(oldRefreshToken, oldIssuer);
-            }
-            catch ( /* best-effort */_b) { /* best-effort */ }
-        }
-        return { user, linked: !!(data === null || data === void 0 ? void 0 : data.linked), isNewAccount: !!(data === null || data === void 0 ? void 0 : data.isNewAccount) };
-    }
-    finally {
-        setAuthLoading(false);
-    }
-}
 // ---------------------------------------------------------------------------
 // provider
 // ---------------------------------------------------------------------------
 class EmailAuthProvider {
     async login() {
-        if (!getPlatform().hasDOM) {
-            throw new Error('Email login on this platform (e.g. React Native) is headless: call ' +
-                "sendEmailOtp(email) then verifyEmailOtp(email, code), or, when text OTP is enabled, " +
-                "sendTextOtp(phone) then verifyTextOtp(phone, code). Render your own OTP inputs. The built-in modal is web-only.");
-        }
-        return openEmailModal();
+        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +
+            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');
     }
     async restoreSession() {
         const sm = sessionManager$1();
@@ -3816,283 +3638,6 @@ class EmailAuthProvider {
     async getNativeMethods() { return {}; }
 }
 const emailProviderSingleton = new EmailAuthProvider();
-// ---------------------------------------------------------------------------
-// inline modal (web only) — mobile-first, no popup, no redirect
-// ---------------------------------------------------------------------------
-function openEmailModal() {
-    return new Promise((resolve) => {
-        var _a;
-        const root = createEmailModalTree();
-        const style = document.createElement('style');
-        style.textContent = MODAL_CSS;
-        root.appendChild(style);
-        document.body.appendChild(root);
-        const $ = (id) => root.querySelector('#' + id);
-        const emailStep = $('ba-email-step');
-        const otpStep = $('ba-otp-step');
-        const emailInput = $('ba-email');
-        const otpInput = $('ba-otp');
-        const sentTo = $('ba-sent-to');
-        const msg = $('ba-msg');
-        const emailBtn = $('ba-email-btn');
-        const otpBtn = $('ba-otp-btn');
-        let email = '';
-        let done = false;
-        const setMsg = (t, err = false) => { msg.textContent = t; msg.className = 'ba-msg' + (err ? ' err' : ''); };
-        const close = (user) => {
-            var _a;
-            if (done)
-                return;
-            done = true;
-            document.removeEventListener('keydown', onEsc);
-            (_a = root.querySelector('.ba-overlay')) === null || _a === void 0 ? void 0 : _a.classList.add('out');
-            setTimeout(() => root.remove(), 160);
-            resolve(user);
-        };
-        const onEsc = (e) => { if (e.key === 'Escape')
-            close(null); };
-        document.addEventListener('keydown', onEsc);
-        (_a = root.querySelector('.ba-overlay')) === null || _a === void 0 ? void 0 : _a.addEventListener('click', (e) => {
-            if (e.target.classList.contains('ba-overlay'))
-                close(null);
-        });
-        $('ba-close').addEventListener('click', () => close(null));
-        requestAnimationFrame(() => emailInput.focus());
-        emailBtn.addEventListener('click', async () => {
-            email = emailInput.value.trim();
-            if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
-                setMsg('Enter a valid email.', true);
-                return;
-            }
-            emailBtn.disabled = true;
-            setMsg('Sending code…');
-            try {
-                await sendEmailOtp$1(email);
-                sentTo.textContent = email;
-                emailStep.classList.add('hidden');
-                otpStep.classList.remove('hidden');
-                setMsg('');
-                otpInput.focus();
-            }
-            catch (err) {
-                setMsg((err === null || err === void 0 ? void 0 : err.message) || 'Could not send the code.', true);
-            }
-            finally {
-                emailBtn.disabled = false;
-            }
-        });
-        emailInput.addEventListener('keydown', (e) => { if (e.key === 'Enter')
-            emailBtn.click(); });
-        otpBtn.addEventListener('click', async () => {
-            const code = otpInput.value.trim();
-            if (!/^\d{4,8}$/.test(code)) {
-                setMsg('Enter the code from your email.', true);
-                return;
-            }
-            otpBtn.disabled = true;
-            setMsg('Verifying…');
-            try {
-                const user = await verifyEmailOtp$1(email, code);
-                close(user);
-            }
-            catch (err) {
-                setMsg((err === null || err === void 0 ? void 0 : err.message) || 'That code did not work.', true);
-                otpBtn.disabled = false;
-            }
-        });
-        otpInput.addEventListener('keydown', (e) => { if (e.key === 'Enter')
-            otpBtn.click(); });
-        $('ba-back').addEventListener('click', () => {
-            otpStep.classList.add('hidden');
-            emailStep.classList.remove('hidden');
-            setMsg('');
-            emailInput.focus();
-        });
-    });
-}
-function createEmailModalTree() {
-    const root = document.createElement('div');
-    root.id = 'bounded-auth-modal';
-    const overlay = document.createElement('div');
-    overlay.className = 'ba-overlay';
-    root.appendChild(overlay);
-    const card = document.createElement('div');
-    card.className = 'ba-card';
-    card.setAttribute('role', 'dialog');
-    card.setAttribute('aria-modal', 'true');
-    card.setAttribute('aria-label', 'Sign in');
-    overlay.appendChild(card);
-    const close = document.createElement('button');
-    close.id = 'ba-close';
-    close.className = 'ba-x';
-    close.setAttribute('aria-label', 'Close');
-    close.type = 'button';
-    close.textContent = '×';
-    card.appendChild(close);
-    // Brand row — the real Bounded mark (same geometry as bounded.sh) + wordmark.
-    const brand = document.createElement('div');
-    brand.className = 'ba-brand';
-    const mark = document.createElement('span');
-    mark.className = 'ba-mark';
-    mark.setAttribute('aria-hidden', 'true');
-    const svgNs = 'http://www.w3.org/2000/svg';
-    const markSvg = document.createElementNS(svgNs, 'svg');
-    markSvg.setAttribute('width', '24');
-    markSvg.setAttribute('height', '24');
-    markSvg.setAttribute('viewBox', '0 0 32 32');
-    markSvg.setAttribute('fill', 'none');
-    for (const [className, d] of [
-        ['ba-c ba-c1', 'M16 5 H5 V16'],
-        ['ba-c ba-c2', 'M16 5 H27 V16'],
-        ['ba-c ba-c3', 'M5 16 V27 H16'],
-        ['ba-c ba-c4', 'M27 16 V27 H16'],
-    ]) {
-        const path = document.createElementNS(svgNs, 'path');
-        path.setAttribute('class', className);
-        path.setAttribute('d', d);
-        markSvg.appendChild(path);
-    }
-    mark.appendChild(markSvg);
-    brand.appendChild(mark);
-    const word = document.createElement('span');
-    word.className = 'ba-word';
-    word.textContent = 'bounded';
-    brand.appendChild(word);
-    card.appendChild(brand);
-    const title = document.createElement('h1');
-    title.className = 'ba-title';
-    title.textContent = 'Sign in';
-    card.appendChild(title);
-    const sub = document.createElement('p');
-    sub.className = 'ba-subtitle';
-    sub.textContent = 'Continue with your email — no wallet needed.';
-    card.appendChild(sub);
-    const emailStep = document.createElement('div');
-    emailStep.id = 'ba-email-step';
-    card.appendChild(emailStep);
-    const emailLabel = document.createElement('label');
-    emailLabel.className = 'ba-label';
-    emailLabel.htmlFor = 'ba-email';
-    emailLabel.textContent = 'Email';
-    emailStep.appendChild(emailLabel);
-    const emailInput = document.createElement('input');
-    emailInput.id = 'ba-email';
-    emailInput.className = 'ba-input';
-    emailInput.type = 'email';
-    emailInput.inputMode = 'email';
-    emailInput.autocomplete = 'email';
-    emailInput.placeholder = 'you@example.com';
-    emailStep.appendChild(emailInput);
-    const emailButton = document.createElement('button');
-    emailButton.id = 'ba-email-btn';
-    emailButton.className = 'ba-btn';
-    emailButton.type = 'button';
-    emailButton.textContent = 'Continue with email';
-    emailStep.appendChild(emailButton);
-    const otpStep = document.createElement('div');
-    otpStep.id = 'ba-otp-step';
-    otpStep.className = 'hidden';
-    card.appendChild(otpStep);
-    const otpLabel = document.createElement('label');
-    otpLabel.className = 'ba-label';
-    otpLabel.htmlFor = 'ba-otp';
-    otpLabel.appendChild(document.createTextNode('Enter the code sent to '));
-    const sentTo = document.createElement('span');
-    sentTo.id = 'ba-sent-to';
-    sentTo.className = 'ba-em';
-    otpLabel.appendChild(sentTo);
-    otpStep.appendChild(otpLabel);
-    const otpInput = document.createElement('input');
-    otpInput.id = 'ba-otp';
-    otpInput.className = 'ba-input ba-code';
-    otpInput.inputMode = 'numeric';
-    otpInput.autocomplete = 'one-time-code';
-    otpInput.maxLength = 8;
-    otpInput.placeholder = '······';
-    otpStep.appendChild(otpInput);
-    const otpButton = document.createElement('button');
-    otpButton.id = 'ba-otp-btn';
-    otpButton.className = 'ba-btn';
-    otpButton.type = 'button';
-    otpButton.textContent = 'Verify & continue';
-    otpStep.appendChild(otpButton);
-    const backButton = document.createElement('button');
-    backButton.id = 'ba-back';
-    backButton.className = 'ba-link';
-    backButton.type = 'button';
-    backButton.textContent = 'Use a different email';
-    otpStep.appendChild(backButton);
-    const msg = document.createElement('div');
-    msg.id = 'ba-msg';
-    msg.className = 'ba-msg';
-    card.appendChild(msg);
-    const foot = document.createElement('div');
-    foot.className = 'ba-foot';
-    foot.textContent = 'Secured by Bounded';
-    card.appendChild(foot);
-    return root;
-}
-// Design language matches the hosted Bounded login (auth.bounded.sh) and bounded.sh:
-// dark editorial panel, green accent, Schibsted Grotesk / Newsreader / JetBrains Mono,
-// the Bounded mark drawing itself in. Fonts load best-effort (scoped @import); every
-// rule has a system fallback so the modal looks right even if Google Fonts is blocked.
-// All selectors are scoped under #bounded-auth-modal so we never leak into the host page.
-const MODAL_CSS = `
-@import url('https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap');
-#bounded-auth-modal{--ba-bg:#0a0a0b;--ba-panel:#0e0f11;--ba-inset:#060607;--ba-raise:#131416;
- --ba-line:rgba(232,230,222,.08);--ba-line-strong:rgba(232,230,222,.16);
- --ba-text:#e8e6de;--ba-dim:#9b9991;--ba-faint:#85837c;--ba-green:#58c98f;
- --ba-green-bg:rgba(88,201,143,.09);--ba-green-line:rgba(88,201,143,.28);--ba-red:#ec8488;
- --ba-body:'Schibsted Grotesk',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
- --ba-display:'Newsreader','Iowan Old Style',Georgia,serif;
- --ba-mono:'JetBrains Mono',ui-monospace,'SF Mono',Menlo,monospace;}
-#bounded-auth-modal .ba-overlay{position:fixed;inset:0;background:rgba(6,6,7,.66);backdrop-filter:blur(4px);
- display:flex;align-items:center;justify-content:center;z-index:2147483000;opacity:1;transition:opacity .16s ease;
- font-family:var(--ba-body);padding:16px;}
-#bounded-auth-modal .ba-overlay.out{opacity:0;}
-#bounded-auth-modal *{box-sizing:border-box;}
-#bounded-auth-modal .ba-card{width:100%;max-width:372px;background:var(--ba-panel);color:var(--ba-text);
- border:1px solid var(--ba-line);border-radius:12px;padding:28px 28px 22px;position:relative;
- box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 30px 80px -40px rgba(0,0,0,.8);animation:ba-in .18s ease;}
-@keyframes ba-in{from{transform:translateY(8px);opacity:.5}to{transform:translateY(0);opacity:1}}
-#bounded-auth-modal .ba-x{position:absolute;top:14px;right:14px;width:28px;height:28px;border:1px solid var(--ba-line);
- background:var(--ba-raise);color:var(--ba-faint);border-radius:7px;font-size:18px;line-height:1;cursor:pointer;
- transition:color .15s,border-color .15s;}
-#bounded-auth-modal .ba-x:hover{color:var(--ba-text);border-color:var(--ba-faint);}
-#bounded-auth-modal .ba-brand{display:flex;align-items:center;gap:10px;margin:0 0 24px;}
-#bounded-auth-modal .ba-mark{display:flex;color:var(--ba-text);}
-#bounded-auth-modal .ba-mark svg{overflow:visible;display:block;}
-#bounded-auth-modal .ba-c{stroke:currentColor;stroke-width:2.4;fill:none;}
-@media (prefers-reduced-motion:no-preference){
- #bounded-auth-modal .ba-c{stroke-dasharray:23;stroke-dashoffset:23;animation:ba-draw .4s cubic-bezier(.45,0,.2,1) forwards;}
- #bounded-auth-modal .ba-c1{animation-delay:.1s}#bounded-auth-modal .ba-c2{animation-delay:.38s}
- #bounded-auth-modal .ba-c3{animation-delay:.66s}#bounded-auth-modal .ba-c4{animation-delay:.94s}}
-@keyframes ba-draw{to{stroke-dashoffset:0}}
-#bounded-auth-modal .ba-word{font-family:var(--ba-body);font-weight:500;font-size:15px;letter-spacing:.2px;color:var(--ba-text);}
-#bounded-auth-modal .ba-title{font-family:var(--ba-display);font-weight:400;font-size:25px;letter-spacing:-.01em;margin:0 0 5px;}
-#bounded-auth-modal .ba-subtitle{color:var(--ba-dim);font-size:14px;margin:0 0 22px;}
-#bounded-auth-modal .ba-label{display:block;font-size:12px;color:var(--ba-dim);margin:0 0 7px;}
-#bounded-auth-modal .ba-em{color:var(--ba-text);font-weight:600;}
-#bounded-auth-modal .ba-input{width:100%;background:var(--ba-inset);border:1px solid var(--ba-line-strong);color:var(--ba-text);
- border-radius:6px;padding:11px 13px;font-family:var(--ba-body);font-size:15px;outline:none;transition:border-color .15s,box-shadow .15s;}
-#bounded-auth-modal .ba-input::placeholder{color:var(--ba-faint);}
-#bounded-auth-modal .ba-input:focus{border-color:var(--ba-green-line);box-shadow:0 0 0 3px var(--ba-green-bg);}
-#bounded-auth-modal .ba-code{font-family:var(--ba-mono);letter-spacing:8px;text-align:center;font-size:21px;padding-left:8px;}
-#bounded-auth-modal .ba-btn{width:100%;margin-top:16px;background:var(--ba-text);color:var(--ba-bg);
- border:0;border-radius:6px;padding:12px;font-family:var(--ba-body);font-size:14px;font-weight:600;cursor:pointer;
- transition:opacity .15s,transform .04s;}
-#bounded-auth-modal .ba-btn:hover{opacity:.9;}
-#bounded-auth-modal .ba-btn:active{transform:translateY(.5px);}
-#bounded-auth-modal .ba-btn:disabled{opacity:.45;cursor:default;}
-#bounded-auth-modal .ba-link{width:100%;margin-top:14px;background:none;border:none;color:var(--ba-dim);
- font-family:var(--ba-body);font-size:12.5px;cursor:pointer;}
-#bounded-auth-modal .ba-link:hover{color:var(--ba-text);}
-#bounded-auth-modal .ba-msg{min-height:16px;margin-top:16px;font-size:12.5px;color:var(--ba-dim);text-align:center;}
-#bounded-auth-modal .ba-msg.err{color:var(--ba-red);}
-#bounded-auth-modal .ba-foot{margin-top:26px;padding-top:16px;border-top:1px solid var(--ba-line);
- text-align:center;font-size:11px;color:var(--ba-faint);}
-#bounded-auth-modal .hidden{display:none;}
-@media (max-width:480px){#bounded-auth-modal .ba-card{max-width:none;}}`;
 
 const SURFNET_RPC_URL = "https://surfpool.fly.dev";
 const SUPPORTED_SOLANA_NETWORKS = new Set([
@@ -4243,14 +3788,35 @@ async function buildAuthorize(opts, guestHint) {
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    // Anonymous→real UPGRADE (linkWithRedirect): carry the guest's signed id-token THROUGH
-    // the authorize request as a hint. The issuer signature-verifies it and binds it to this
-    // request's PKCE code_challenge, so the link is completed single-use during the normal
-    // code→token exchange — no retired /link/social, and the appId stays bound to client_id.
+    // Anonymous→real UPGRADE (linkWithRedirect): the issuer needs the guest identity bound to
+    // this request's PKCE code_challenge so the link completes single-use at the code→token
+    // exchange. We do NOT put the raw guest id-token in the URL (it would land in server logs /
+    // browser history — a replayable identity-capture primitive). Instead we exchange it for an
+    // OPAQUE single-use handle server-side and carry only that.
     if (guestHint)
-        params.set('bounded_guest_hint', guestHint);
+        params.set('bounded_guest_hint', await guestHintFor(guestHint));
     return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
 }
+/** Exchange a guest id-token for an opaque single-use handle via the issuer, so the raw token
+ *  never rides the authorize URL. Falls back to the raw token if the mint endpoint is
+ *  unavailable — the issuer accepts both, so an upgrade never breaks during rollout. */
+async function guestHintFor(guestToken) {
+    try {
+        const base = await issuerBase();
+        const res = await fetch(`${base}/link/guest-handle`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ guestToken }),
+        });
+        if (res.ok) {
+            const data = await res.json().catch(() => null);
+            if (data && typeof data.handle === 'string' && data.handle)
+                return data.handle;
+        }
+    }
+    catch ( /* fall through to the raw-token fallback */_a) { /* fall through to the raw-token fallback */ }
+    return guestToken;
+}
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
 function isNative() {
@@ -4352,7 +3918,8 @@ async function loginWithRedirect(opts) {
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake.
     sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
-    window.location.href = url;
+    setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
+    window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
 }
 /** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
  *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
@@ -4445,51 +4012,57 @@ async function loginWithPopup(opts) {
     // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
     // not opts.redirectUri which may be undefined.
     const expectedOrigin = new URL(pkce.redirectUri).origin;
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        let timer;
-        const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
-        const onMsg = async (ev) => {
-            if (ev.origin !== expectedOrigin)
-                return; // only trust the redirect_uri origin
-            const d = ev.data;
-            if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
-                return;
-            cleanup();
-            try {
-                const raw = sessionStorage.getItem(PKCE_STORE_KEY);
-                if (!raw)
-                    throw new Error('Missing PKCE state');
-                const pkce = JSON.parse(raw);
-                if (d.state !== pkce.state)
-                    throw new Error('OAuth state mismatch');
-                const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
-                sessionStorage.removeItem(PKCE_STORE_KEY);
+    setAuthLoading(true); // reflect "signing in…" while the popup is open
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            let timer;
+            const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
+            const onMsg = async (ev) => {
+                if (ev.origin !== expectedOrigin)
+                    return; // only trust the redirect_uri origin
+                const d = ev.data;
+                if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
+                    return;
+                cleanup();
                 try {
-                    popup.close();
+                    const raw = sessionStorage.getItem(PKCE_STORE_KEY);
+                    if (!raw)
+                        throw new Error('Missing PKCE state');
+                    const pkce = JSON.parse(raw);
+                    if (d.state !== pkce.state)
+                        throw new Error('OAuth state mismatch');
+                    const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
+                    sessionStorage.removeItem(PKCE_STORE_KEY);
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    resolve(user);
                 }
-                catch ( /* ignore */_a) { /* ignore */ }
-                resolve(user);
-            }
-            catch (e) {
-                reject(e);
-            }
-        };
-        window.addEventListener('message', onMsg);
-        // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
-        // races the just-posted message and would report a spurious "Login window closed" on a
-        // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
-        // before declaring the window closed.
-        timer = setInterval(() => {
-            if (popup.closed) {
-                clearInterval(timer);
-                setTimeout(() => { if (!settled) {
-                    cleanup();
-                    reject(new Error('Login window closed'));
-                } }, 500);
-            }
-        }, 500);
-    });
+                catch (e) {
+                    reject(e);
+                }
+            };
+            window.addEventListener('message', onMsg);
+            // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
+            // races the just-posted message and would report a spurious "Login window closed" on a
+            // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
+            // before declaring the window closed.
+            timer = setInterval(() => {
+                if (popup.closed) {
+                    clearInterval(timer);
+                    setTimeout(() => { if (!settled) {
+                        cleanup();
+                        reject(new Error('Login window closed'));
+                    } }, 500);
+                }
+            }, 500);
+        });
+    }
+    finally {
+        setAuthLoading(false);
+    }
 }
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
@@ -4748,6 +4321,12 @@ async function getAuthProvider(config) {
     currentAuthProviderConfigKey = nextProviderConfigKey;
     return currentAuthProvider;
 }
+function retiredInlineAuthError(method) {
+    return new Error(`bounded-sh: ${method} is retired. Human login must use the hosted OAuth2 + PKCE flow: ` +
+        `loginWithRedirect({ redirectUri }) or loginWithPopup({ redirectUri }). ` +
+        `For guests use signInAnonymously(); for guest-to-real-account data continuity, ` +
+        `transfer ownership in app data after hosted login.`);
+}
 /**
  * Browser/React-Native-only auth flows (guest, email) persist their session via
  * WebSessionManager, which is gated to environments that have `window` /
@@ -4781,7 +4360,13 @@ async function signInAnonymously() {
     coreConfig.authMethod = 'guest';
     setAuthProviderInstance(provider);
     setStoredAuthMethod('guest');
-    return provider.login();
+    setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
+    try {
+        return await provider.login();
+    }
+    finally {
+        setAuthLoading(false);
+    }
 }
 /**
  * Log in with Privy as a co-equal route — selectable at runtime alongside
@@ -4825,77 +4410,40 @@ async function loginWithPrivy(options) {
     const result = await provider.login();
     return result ? Object.assign(Object.assign({}, result), { provider }) : null;
 }
-// Activate the inline email provider (method=email so reload-restore + logout work),
-// mirroring signInAnonymously. Used by verifyEmailOtp/verifyTextOtp/linkEmail.
-async function activateEmailProvider() {
-    const provider = new EmailAuthProvider();
-    currentAuthProvider = provider;
-    currentAuthMethod = 'email';
-    currentAuthProviderConfigKey = 'direct:email';
-    const coreConfig = await getConfig();
-    coreConfig.authProvider = provider;
-    coreConfig.authMethod = 'email';
-    setAuthProviderInstance(provider);
-    setStoredAuthMethod('email');
-    return provider;
-}
 /**
- * Send a 6-digit login code to `email` (Bounded Better Auth). Step 1 of the
- * inline email flow — build your own email/code UI for full control over the
- * look, or just call `login()` for the built-in modal. Works on web AND React
- * Native (no DOM needed). Prefer `loginWithRedirect()`/`loginWithPopup()` if you
- * want the credential entered on Bounded's hosted page instead.
+ * Retired. Use `loginWithRedirect({ redirectUri, methods: ['email'] })` or
+ * `loginWithPopup(...)`; app-origin OTP helpers fail closed.
  */
 async function sendEmailOtp(email) {
-    assertBrowserAuthEnv('sendEmailOtp');
-    return sendEmailOtp$1(email);
+    throw retiredInlineAuthError('sendEmailOtp');
 }
 /**
- * Send a 6-digit login code by text message. Requires the configured Bounded
- * auth issuer to have text OTP explicitly enabled and SMS delivery configured.
- * Works on web AND React Native.
+ * Retired. Use hosted login with `methods: ['text']` or `provider: 'text'`
+ * when text OTP is enabled for the app.
  */
 async function sendTextOtp(phoneNumber) {
-    assertBrowserAuthEnv('sendTextOtp');
-    return sendTextOtp$1(phoneNumber);
+    throw retiredInlineAuthError('sendTextOtp');
 }
 /**
- * Verify the `code` for `email`, establish the session, and return the user.
- * Step 2 of the inline email flow. Coexists with signInAnonymously()/wallets.
+ * Retired. Complete hosted login on the callback page with
+ * `completeLoginFromRedirect()`.
  */
 async function verifyEmailOtp(email, code) {
-    assertBrowserAuthEnv('verifyEmailOtp');
-    await activateEmailProvider();
-    return verifyEmailOtp$1(email, code);
+    throw retiredInlineAuthError('verifyEmailOtp');
 }
 /**
- * Verify the text-message `code`, establish the session, and return the user.
- * Phone-only users have no `user.email`; use `user.id` for app identity.
+ * Retired. Complete hosted login on the callback page with
+ * `completeLoginFromRedirect()`.
  */
 async function verifyTextOtp(phoneNumber, code) {
-    assertBrowserAuthEnv('verifyTextOtp');
-    await activateEmailProvider();
-    return verifyTextOtp$1(phoneNumber, code);
+    throw retiredInlineAuthError('verifyTextOtp');
 }
 /**
- * UPGRADE the current anonymous (guest) session by linking an email — Firebase
- * `linkWithCredential` parity. Send the code first with `sendEmailOtp(email)`,
- * then call `linkEmail(email, code)`. If the email is brand-new the guest's
- * `@user.id` (and its data) is preserved; if the email already exists the user
- * just signs into it (no merge). Requires an active guest session, and the issuer
- * refuses if the wallet is already linked. Browser/React-Native only.
+ * Retired. Guest upgrade is no longer an inline id-preserving auth operation;
+ * send the user through hosted login and transfer data explicitly in app state.
  */
 async function linkEmail(email, code) {
-    assertBrowserAuthEnv('linkEmail');
-    // Capture the GUEST token BEFORE switching auth methods — the issuer needs it
-    // to prove guest ownership and adopt its id into the new email account.
-    const guestToken = getActiveSessionManager().getIdToken();
-    if (!guestToken) {
-        throw new Error('linkEmail requires an active anonymous session — call signInAnonymously() first.');
-    }
-    await activateEmailProvider(); // method=email so the upgraded user is no longer anonymous
-    const { user } = await linkEmailWithGuest(email, code, guestToken);
-    return user;
+    throw retiredInlineAuthError('linkEmail');
 }
 async function login$1(options) {
     // Re-initialize provider if it was cleared by logout