@bounded-sh/client 0.0.37 → 0.0.39

package/dist/index.native.mjs

@@ -1,9 +1,9 @@
-import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction } from '@bounded-sh/core';
+import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature, getConfig, convertRemainingAccounts, buildSetDocumentsTransaction, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, getIdToken as getIdToken$1 } from '@bounded-sh/core';
 export * from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, aggregate, count, deriveDecline, dispatchDeclineEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
-import * as React from 'react';
-import { VersionedTransaction, Transaction, Connection, PublicKey } from '@solana/web3.js';
+import { Connection, PublicKey, VersionedTransaction, Transaction } from '@solana/web3.js';
 import * as anchor from '@coral-xyz/anchor';
+import * as React from 'react';
 
 /**
  * Platform abstraction layer for React Native compatibility.
@@ -3425,7 +3425,7 @@ const IDB_STORE = 'keys';
 const IDB_KEY = 'ed25519';
 const GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +
     'stored-secret guest credentials are disabled.';
-function toBase64$1(bytes) {
+function toBase64(bytes) {
     let bin = '';
     for (let i = 0; i < bytes.length; i++)
         bin += String.fromCharCode(bytes[i]);
@@ -3489,7 +3489,7 @@ async function webCryptoKey() {
             async sign(message) {
                 const data = new TextEncoder().encode(message);
                 const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));
-                return toBase64$1(sig);
+                return toBase64(sig);
             },
         };
     }
@@ -3765,19 +3765,22 @@ async function signViaSignerPopup(action) {
         } }, 5 * 60 * 1000);
     });
 }
-function toBase64(bytes) {
-    return bufferExports.Buffer.from(bytes).toString('base64');
-}
-// Serialize a legacy or versioned Solana transaction to base64 for the signer
-// page. We do NOT require existing signatures (the smart wallet signs on the
-// page); Crossmint extracts the instructions and wraps them for the smart wallet.
+// Serialize a legacy or versioned Solana transaction to BASE58 for the signer
+// page. Crossmint's smart-wallet createTransaction endpoint requires the
+// `serializedTransaction` string to be base58 — it rejects base64 with
+// "Invalid base58 string" (verified against Crossmint staging 2026-07-07). The
+// `wallets-sdk` object path bs58-encodes internally, so base58 is the contract.
+//
+// We do NOT require existing signatures (the smart wallet signs on the page);
+// Crossmint extracts the instructions, overrides the fee payer to its sponsor,
+// and re-wraps them for the smart wallet.
 function serializeTransaction(transaction) {
     const isLegacy = 'recentBlockhash' in transaction &&
         !('message' in transaction && 'staticAccountKeys' in transaction.message);
     const bytes = isLegacy
         ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
         : transaction.serialize();
-    return toBase64(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+    return bs58.encode(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
 }
 /**
  * Whether the active session carries an embedded wallet (so the provider should
@@ -3903,6 +3906,306 @@ function resolveSolanaRpcUrl(explicitRpcUrl, network, context) {
     throw new Error(`${context} requires an explicit Solana RPC URL. Pass config.rpcUrl before signing or submitting onchain transactions.`);
 }
 
+/**
+ * Extracts a human-readable error message from Solana transaction logs.
+ */
+function extractTransactionError(err, logMessages) {
+    if (logMessages) {
+        return JSON.stringify(logMessages);
+    }
+    if (err) {
+        try {
+            return JSON.stringify(err);
+        }
+        catch (_a) {
+            return String(err);
+        }
+    }
+    return 'Unknown transaction error';
+}
+/**
+ * Polls getSignatureStatuses until the transaction is confirmed, then checks for errors.
+ * Throws if the transaction failed on-chain. Returns parsed transaction info on success.
+ */
+async function confirmAndCheckTransaction(connection, signature) {
+    var _a;
+    const maxAttempts = 15;
+    for (let i = 0; i < maxAttempts; i++) {
+        const { value } = await connection.getSignatureStatuses([signature]);
+        const status = value[0];
+        if (status) {
+            if (status.err) {
+                const txInfo = await connection.getParsedTransaction(signature, {
+                    maxSupportedTransactionVersion: 0,
+                    commitment: 'confirmed'
+                });
+                const errorMessage = extractTransactionError(status.err, (_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _a === void 0 ? void 0 : _a.logMessages);
+                throw new Error(`Transaction failed: ${errorMessage}`);
+            }
+            if (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized') {
+                return await connection.getParsedTransaction(signature, {
+                    maxSupportedTransactionVersion: 0,
+                    commitment: 'confirmed'
+                });
+            }
+        }
+        await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+    throw new Error('Transaction confirmation timeout');
+}
+
+/**
+ * Default provider discovery: Phantom-first, then any Wallet-Standard
+ * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
+ * a user gesture and can be eagerly exported from the SDK entry.
+ */
+function defaultInjectedProvider() {
+    var _a;
+    if (typeof window === 'undefined')
+        return null;
+    const w = window;
+    const phantom = (_a = w === null || w === void 0 ? void 0 : w.phantom) === null || _a === void 0 ? void 0 : _a.solana;
+    if (phantom && typeof phantom.signMessage === 'function')
+        return phantom;
+    const generic = w === null || w === void 0 ? void 0 : w.solana;
+    if (generic && typeof generic.signMessage === 'function')
+        return generic;
+    return null;
+}
+
+const STORED_AUTH_METHOD_KEY$2 = 'bounded_last_auth_method';
+const INJECTED_AUTH_METHOD = 'phantom';
+const NO_WALLET_ERR = 'No injected Solana wallet found. Install a wallet like Phantom (phantom.app) and try again, ' +
+    'or pass config.injectedWalletConfig.getProvider to point at your wallet.';
+class InjectedWalletProvider {
+    constructor(config = {}, networkUrl = null, configuredNetwork = null) {
+        var _a, _b;
+        if (typeof window === 'undefined') {
+            throw new Error('InjectedWalletProvider can only be instantiated in a browser environment');
+        }
+        // Singleton so the SDK reuses one instance (mirrors the other providers).
+        if (InjectedWalletProvider.instance) {
+            InjectedWalletProvider.instance.config = Object.assign(Object.assign({}, InjectedWalletProvider.instance.config), config);
+            return InjectedWalletProvider.instance;
+        }
+        this.config = config;
+        this.networkUrl = (_a = config.rpcUrl) !== null && _a !== void 0 ? _a : networkUrl;
+        this.configuredNetwork = (_b = config.network) !== null && _b !== void 0 ? _b : configuredNetwork;
+        InjectedWalletProvider.instance = this;
+    }
+    resolveProvider() {
+        var _a;
+        const provider = (_a = (this.config.getProvider ? this.config.getProvider() : null)) !== null && _a !== void 0 ? _a : defaultInjectedProvider();
+        if (!provider)
+            throw new Error(NO_WALLET_ERR);
+        return provider;
+    }
+    /** Connect the injected wallet (if needed) and return its Solana address. */
+    async connectAddress(provider, onlyIfTrusted = false) {
+        var _a, _b;
+        // Already connected — reuse the pubkey.
+        if (provider.publicKey && ((_a = provider.isConnected) !== null && _a !== void 0 ? _a : true)) {
+            return provider.publicKey.toString();
+        }
+        const res = await provider.connect(onlyIfTrusted ? { onlyIfTrusted: true } : undefined);
+        const pk = (_b = res === null || res === void 0 ? void 0 : res.publicKey) !== null && _b !== void 0 ? _b : provider.publicKey;
+        if (!pk)
+            throw new Error('Wallet did not return a public key on connect');
+        return pk.toString();
+    }
+    async login() {
+        var _a;
+        setAuthLoading(true);
+        try {
+            const provider = this.resolveProvider();
+            const address = await this.connectAddress(provider);
+            // Reuse a still-valid session for THIS wallet.
+            const existing = await getActiveSessionManager().getSession();
+            if (existing && existing.address === address) {
+                const user = { address, id: address, provider: this };
+                setCurrentUser(user);
+                this.markAuthMethod();
+                return user;
+            }
+            // SIWS: nonce -> canonical prompt -> the wallet signs it locally.
+            const nonce = await genAuthNonce();
+            const message = await genSolanaMessage(address, nonce);
+            const messageBytes = getPlatform().textEncode(message);
+            const signResult = await provider.signMessage(messageBytes, 'utf8');
+            const signatureBytes = (_a = signResult === null || signResult === void 0 ? void 0 : signResult.signature) !== null && _a !== void 0 ? _a : signResult;
+            // base64 detached ed25519 signature — matches guest/privy providers and
+            // the bounded-auth issuer's base64ToBytes() verify path.
+            const signature = bufferExports.Buffer.from(signatureBytes).toString('base64');
+            const result = await createSessionWithSignature(address, message, signature);
+            await getActiveSessionManager().storeSession(address, result.accessToken, result.idToken, result.refreshToken);
+            this.markAuthMethod();
+            const user = { address, id: address, provider: this };
+            setCurrentUser(user);
+            return user;
+        }
+        finally {
+            setAuthLoading(false);
+        }
+    }
+    markAuthMethod() {
+        // Mark the auth method so clearIncompatibleSession() doesn't wipe this
+        // wallet session on the next init().
+        try {
+            getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$2, INJECTED_AUTH_METHOD);
+        }
+        catch ( /* no storage */_a) { /* no storage */ }
+    }
+    async restoreSession() {
+        const session = await getActiveSessionManager().getSession();
+        if (!session)
+            return null;
+        const user = { address: session.address, id: session.address, provider: this };
+        setCurrentUser(user);
+        return user;
+    }
+    async logout() {
+        // Clear the Bounded session; best-effort disconnect the wallet.
+        getActiveSessionManager().clearSession();
+        try {
+            const provider = this.config.getProvider ? this.config.getProvider() : defaultInjectedProvider();
+            if (provider && typeof provider.disconnect === 'function')
+                await provider.disconnect();
+        }
+        catch ( /* ignore */_a) { /* ignore */ }
+        setCurrentUser(null);
+    }
+    // --- Full local-keypair signing surface (the wallet's OWN methods) --------
+    async signMessage(message) {
+        var _a;
+        const provider = this.resolveProvider();
+        await this.connectAddress(provider, true).catch(() => this.connectAddress(provider));
+        const messageBytes = getPlatform().textEncode(message);
+        const res = await provider.signMessage(messageBytes, 'utf8');
+        const signatureBytes = (_a = res === null || res === void 0 ? void 0 : res.signature) !== null && _a !== void 0 ? _a : res;
+        // base58 is the standard Solana signature encoding for app-facing signMessage.
+        return bs58.encode(signatureBytes instanceof Uint8Array ? signatureBytes : new Uint8Array(signatureBytes));
+    }
+    async signTransaction(transaction) {
+        const provider = this.resolveProvider();
+        await this.connectAddress(provider, true).catch(() => this.connectAddress(provider));
+        return provider.signTransaction(transaction);
+    }
+    async signAndSubmitTransaction(transaction, _feePayer) {
+        const provider = this.resolveProvider();
+        const address = await this.connectAddress(provider, true).catch(() => this.connectAddress(provider));
+        const rpcUrl = this.getRpcUrl();
+        const connection = new Connection(rpcUrl, 'confirmed');
+        const isSurfnet = rpcUrl === SURFNET_RPC_URL;
+        // Set a fresh blockhash on the tx (mirrors the other providers).
+        const { blockhash } = await connection.getLatestBlockhash('confirmed');
+        const isLegacy = 'recentBlockhash' in transaction &&
+            !('message' in transaction && 'staticAccountKeys' in transaction.message);
+        if (isLegacy) {
+            const legacy = transaction;
+            legacy.recentBlockhash = blockhash;
+            if (!legacy.feePayer)
+                legacy.feePayer = new PublicKey(address);
+        }
+        else {
+            transaction.message.recentBlockhash = blockhash;
+        }
+        // Prefer the wallet's native signAndSend on live networks; fall back to
+        // sign + manual submit (needed for surfnet / wallets without send).
+        if (!isSurfnet && typeof provider.signAndSendTransaction === 'function') {
+            const res = await provider.signAndSendTransaction(transaction);
+            const signature = res.signature;
+            await confirmAndCheckTransaction(connection, signature);
+            return signature;
+        }
+        const signed = await provider.signTransaction(transaction);
+        const raw = signed.serialize();
+        const signature = await connection.sendRawTransaction(raw);
+        await confirmAndCheckTransaction(connection, signature);
+        return signature;
+    }
+    /**
+     * Onchain write path (mirrors the other wallet providers): build the Bounded
+     * set-documents transaction with the injected wallet as payer, then sign +
+     * submit with the wallet's own keypair.
+     */
+    async runTransaction(_evmTransactionData, solTransactionData, options) {
+        var _a, _b;
+        if (!solTransactionData) {
+            throw new Error('Solana transaction data is required for wallet login');
+        }
+        const provider = this.resolveProvider();
+        const address = await this.connectAddress(provider, true).catch(() => this.connectAddress(provider));
+        const publicKey = new PublicKey(address);
+        const rpcUrl = this.getRpcUrl(solTransactionData.network);
+        const connection = new Connection(rpcUrl, 'confirmed');
+        const isSurfnet = rpcUrl === SURFNET_RPC_URL;
+        const app_id = solTransactionData.appId;
+        if (!app_id)
+            throw new Error('App ID is required');
+        const walletAdapter = {
+            publicKey,
+            signTransaction: async (tx) => provider.signTransaction(tx),
+            signAllTransactions: async (txs) => provider.signAllTransactions
+                ? provider.signAllTransactions(txs)
+                : Promise.all(txs.map((t) => provider.signTransaction(t))),
+        };
+        const anchorProvider = new anchor.AnchorProvider(connection, walletAdapter, anchor.AnchorProvider.defaultOptions());
+        const remainingAccounts = convertRemainingAccounts(solTransactionData.txArgs[0].remainingAccounts);
+        const finalDeduped = [];
+        for (const acc of remainingAccounts) {
+            const existing = finalDeduped.find((d) => d.pubkey.equals(acc.pubkey));
+            if (existing) {
+                existing.isSigner = existing.isSigner || acc.isSigner;
+                existing.isWritable = existing.isWritable || acc.isWritable;
+            }
+            else {
+                finalDeduped.push(acc);
+            }
+        }
+        let tx;
+        if (solTransactionData.signedTransaction) {
+            // Server co-signed (CPI attestation) — just add the wallet signature.
+            tx = VersionedTransaction.deserialize(bufferExports.Buffer.from(solTransactionData.signedTransaction, 'base64'));
+        }
+        else {
+            const result = await buildSetDocumentsTransaction(connection, solTransactionData.txArgs[0].idl, anchorProvider, publicKey, {
+                app_id,
+                documents: solTransactionData.txArgs[0].setDocumentData,
+                delete_paths: solTransactionData.txArgs[0].deletePaths,
+                txData: solTransactionData.txArgs[0].txData,
+            }, finalDeduped, solTransactionData.lutKey, solTransactionData.preInstructions, false, solTransactionData.additionalLutAddresses);
+            tx = result.tx;
+        }
+        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+            const signedTx = await walletAdapter.signTransaction(tx);
+            return { signedTransaction: signedTx, blockNumber: 0, gasUsed: '0', data: '' };
+        }
+        let signature;
+        if (!isSurfnet && typeof provider.signAndSendTransaction === 'function') {
+            const res = await provider.signAndSendTransaction(tx);
+            signature = res.signature;
+        }
+        else {
+            const signedTx = await walletAdapter.signTransaction(tx);
+            signature = await connection.sendRawTransaction(signedTx.serialize());
+        }
+        const txInfo = await confirmAndCheckTransaction(connection, signature);
+        return {
+            transactionSignature: signature,
+            blockNumber: (txInfo === null || txInfo === void 0 ? void 0 : txInfo.slot) || 0,
+            gasUsed: ((_b = (_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _a === void 0 ? void 0 : _a.fee) === null || _b === void 0 ? void 0 : _b.toString()) || '0',
+            data: txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta,
+        };
+    }
+    async getNativeMethods() {
+        return this.resolveProvider();
+    }
+    getRpcUrl(network) {
+        return resolveSolanaRpcUrl(this.networkUrl, network !== null && network !== void 0 ? network : this.configuredNetwork, 'Wallet-login Solana transaction');
+    }
+}
+InjectedWalletProvider.instance = null;
+
 // Same message the email provider uses when a hosted (OIDC) login has no
 // embedded wallet — enable `auth.wallets` in policy to get one.
 const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
@@ -4394,7 +4697,7 @@ function stableConfigValue(value, seen = new WeakSet()) {
     return String(value);
 }
 function authProviderConfigKey(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
     return JSON.stringify({
         authMethod: (_a = config.authMethod) !== null && _a !== void 0 ? _a : null,
         chain: (_b = config.chain) !== null && _b !== void 0 ? _b : null,
@@ -4402,9 +4705,11 @@ function authProviderConfigKey(config) {
         name: (_c = config.name) !== null && _c !== void 0 ? _c : null,
         logoUrl: (_d = config.logoUrl) !== null && _d !== void 0 ? _d : null,
         phantomConfig: stableConfigValue((_e = config.phantomConfig) !== null && _e !== void 0 ? _e : null),
-        privyConfig: stableConfigValue((_f = config.privyConfig) !== null && _f !== void 0 ? _f : null),
-        mobileWalletConfig: stableConfigValue((_g = config.mobileWalletConfig) !== null && _g !== void 0 ? _g : null),
-        privyExpoProvider: objectIdentityKey((_h = config.privyExpoProvider) !== null && _h !== void 0 ? _h : null),
+        walletLogin: stableConfigValue((_f = config.walletLogin) !== null && _f !== void 0 ? _f : null),
+        injectedWalletConfig: stableConfigValue((_g = config.injectedWalletConfig) !== null && _g !== void 0 ? _g : null),
+        privyConfig: stableConfigValue((_h = config.privyConfig) !== null && _h !== void 0 ? _h : null),
+        mobileWalletConfig: stableConfigValue((_j = config.mobileWalletConfig) !== null && _j !== void 0 ? _j : null),
+        privyExpoProvider: objectIdentityKey((_k = config.privyExpoProvider) !== null && _k !== void 0 ? _k : null),
     });
 }
 /**
@@ -4437,6 +4742,47 @@ function getConfiguredSolanaNetwork(config) {
         return null;
     return chain;
 }
+// Error thrown when an app tries wallet login WITHOUT opting in at init().
+// Wallet login is OFF by default — most apps never support wallets, so the
+// wallet choice is only usable when the developer explicitly asked for it.
+function walletLoginNotEnabledError(method) {
+    return new Error(`Bounded: Solana wallet login (authMethod:"${method}") is OFF by default and not enabled for this app. ` +
+        `Wallet login is opt-in — pass \`walletLogin: true\` (or a \`walletLogin\` / \`injectedWalletConfig\` object) ` +
+        `to init() to enable the "connect wallet" choice. Most apps don't need it; use hosted login ` +
+        `loginWithRedirect(...) for email/social, or signInAnonymously() for zero-friction guests.`);
+}
+/**
+ * Whether the app opted into Solana WALLET LOGIN at init(). OPT-IN, default OFF:
+ * enabled only when the developer explicitly passes `walletLogin: true` (or a
+ * `walletLogin` / `injectedWalletConfig` object). This gate is what keeps wallet
+ * login from being usable (or advertised) by the vast majority of apps that
+ * never want it — existing apps that don't opt in see ZERO behavior change.
+ */
+function isWalletLoginEnabled(config) {
+    const wl = config.walletLogin;
+    if (wl === true)
+        return true;
+    if (wl && typeof wl === 'object')
+        return true;
+    if (config.injectedWalletConfig && typeof config.injectedWalletConfig === 'object')
+        return true;
+    return false;
+}
+/**
+ * Resolve the injected-wallet-config the provider should use, merging the
+ * `walletLogin` object form (if the app passed one) over `injectedWalletConfig`.
+ * `walletLogin: true` (bare boolean) enables login with default provider
+ * discovery (Phantom-first) and no RPC override.
+ */
+function resolveInjectedWalletConfig(config) {
+    const base = (config.injectedWalletConfig && typeof config.injectedWalletConfig === 'object')
+        ? config.injectedWalletConfig
+        : {};
+    const wl = config.walletLogin;
+    if (wl && typeof wl === 'object')
+        return Object.assign(Object.assign({}, base), wl);
+    return base;
+}
 function optionalProviderError(method) {
     return new Error(`Bounded authMethod "${method}" uses an optional wallet/provider SDK that is no longer ` +
         `pulled into the default @bounded-sh/client entry. Use hosted login ` +
@@ -4459,8 +4805,8 @@ async function getAuthProvider(config) {
     }
     initConfig = config;
     const authMethod = (_a = config.authMethod) !== null && _a !== void 0 ? _a : "email";
-    normalizeSolanaRpcUrl(config.rpcUrl);
-    getConfiguredSolanaNetwork(config);
+    const rpcUrl = normalizeSolanaRpcUrl(config.rpcUrl);
+    const configuredNetwork = getConfiguredSolanaNetwork(config);
     currentAuthMethod = authMethod;
     // Clear, actionable error when the BROWSER build (`bounded-sh`) is loaded in a
     // non-browser (Node) runtime. The wallet providers below need `window`; without
@@ -4468,7 +4814,7 @@ async function getAuthProvider(config) {
     // browser environment" deep in init(). The server build (`bounded-sh/server`)
     // never resolves these methods (it signs with a keypair), so this can't fire for
     // it — it only converts the cryptic browser-in-Node crash into a useful message.
-    const browserWalletMethods = ['phantom', 'rainbowkit', 'coinbase-smart-wallet', 'onboard', 'mobile-wallet-adapter', 'privy'];
+    const browserWalletMethods = ['phantom', 'wallet', 'rainbowkit', 'coinbase-smart-wallet', 'onboard', 'mobile-wallet-adapter', 'privy'];
     if (typeof window === 'undefined' && browserWalletMethods.includes(authMethod)) {
         throw new Error(`bounded-sh: '${authMethod}' auth requires a browser, but no \`window\` was found ` +
             `(you're likely running in Node). In server/Node code, import from 'bounded-sh/server' ` +
@@ -4484,14 +4830,28 @@ async function getAuthProvider(config) {
             currentAuthProvider = new EmailAuthProvider();
             break;
         case "wallet":
-            console.warn("Wallet auth is not yet supported.");
+        case "phantom": {
+            // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
+            // wallet" choice). Slim path: rides the injected Solana provider a
+            // browser wallet exposes (Phantom's window.phantom.solana, or any
+            // Wallet-Standard window.solana). The user's REAL wallet becomes
+            // @user.address; login = SIWS; full local signing surface. No React
+            // and no heavy wallet-SDK peer dep. 'wallet' is an alias for the same
+            // path.
+            //
+            // OPT-IN, DEFAULT OFF: only usable when the app explicitly enabled it
+            // at init() (walletLogin: true). Otherwise throw a clear, actionable
+            // error — most apps never support wallets, so we never construct the
+            // provider (or pay its lazy chunk) for them.
+            if (!isWalletLoginEnabled(config)) {
+                throw walletLoginNotEnabledError(authMethod);
+            }
+            currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
+        }
         case "rainbowkit":
             console.warn("Rainbow Kit auth is not yet supported.");
             break;
-        case "phantom": {
-            throw optionalProviderError("phantom");
-        }
         case "privy": {
             throw optionalProviderError("privy");
         }
@@ -4937,54 +5297,6 @@ async function getIdToken() {
     return getIdToken$1(false);
 }
 
-/**
- * Extracts a human-readable error message from Solana transaction logs.
- */
-function extractTransactionError(err, logMessages) {
-    if (logMessages) {
-        return JSON.stringify(logMessages);
-    }
-    if (err) {
-        try {
-            return JSON.stringify(err);
-        }
-        catch (_a) {
-            return String(err);
-        }
-    }
-    return 'Unknown transaction error';
-}
-/**
- * Polls getSignatureStatuses until the transaction is confirmed, then checks for errors.
- * Throws if the transaction failed on-chain. Returns parsed transaction info on success.
- */
-async function confirmAndCheckTransaction(connection, signature) {
-    var _a;
-    const maxAttempts = 15;
-    for (let i = 0; i < maxAttempts; i++) {
-        const { value } = await connection.getSignatureStatuses([signature]);
-        const status = value[0];
-        if (status) {
-            if (status.err) {
-                const txInfo = await connection.getParsedTransaction(signature, {
-                    maxSupportedTransactionVersion: 0,
-                    commitment: 'confirmed'
-                });
-                const errorMessage = extractTransactionError(status.err, (_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _a === void 0 ? void 0 : _a.logMessages);
-                throw new Error(`Transaction failed: ${errorMessage}`);
-            }
-            if (status.confirmationStatus === 'confirmed' || status.confirmationStatus === 'finalized') {
-                return await connection.getParsedTransaction(signature, {
-                    maxSupportedTransactionVersion: 0,
-                    commitment: 'confirmed'
-                });
-            }
-        }
-        await new Promise(resolve => setTimeout(resolve, 1000));
-    }
-    throw new Error('Transaction confirmation timeout');
-}
-
 /**
  * Privy Expo Auth Provider — React Native implementation of AuthProvider.
  *