@bounded-sh/client 0.0.42 → 0.0.44

package/dist/index.native.mjs

@@ -1,4 +1,4 @@
-import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature, getConfig, convertRemainingAccounts, buildSetDocumentsTransaction, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, getIdToken as getIdToken$1 } from '@bounded-sh/core';
+import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature, assertCanonicalBoundedRuntimeWriteCalldata, getConfig, convertRemainingAccounts, buildSetDocumentsTransaction, normalizeEvmAddress, genSiweMessage, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, getIdToken as getIdToken$1 } from '@bounded-sh/core';
 export * from '@bounded-sh/core';
 export { BoundedDeclineError, DECLINE_EVENT_NAME, aggregate, count, deriveDecline, dispatchDeclineEvent, docId, get, getConfig, getFiles, getMany, queryAggregate, runExpression, runExpressionMany, runQuery, runQueryMany, search, set, setFile, setMany, signAndSubmitTransaction, signMessage, signTransaction, subscribe } from '@bounded-sh/core';
 import { Connection, PublicKey, VersionedTransaction, Transaction } from '@solana/web3.js';
@@ -3635,7 +3635,7 @@ function decodeJwt$2(token) {
 // Pull the embedded-wallet identity out of the active session's id token.
 // Returns null when this session has no wallet (so callers can throw the
 // informative NO_EMBEDDED_WALLET error).
-function walletClaimsFromSession() {
+function walletClaimsFromSession(chain = 'solana') {
     let idToken = null;
     try {
         idToken = getActiveSessionManager().getIdToken();
@@ -3647,14 +3647,17 @@ function walletClaimsFromSession() {
         return null;
     const c = decodeJwt$2(idToken);
     const address = c['custom:walletAddress'];
+    const evmAddress = c['custom:evmWalletAddress'];
     const email = c['email'];
-    if (typeof address !== 'string' || !address)
-        return null;
     if (typeof email !== 'string' || !email)
         return null;
+    if (chain === 'solana' && (typeof address !== 'string' || !address))
+        return null;
+    if (chain === 'evm' && (typeof evmAddress !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(evmAddress)))
+        return null;
     const envClaim = c['custom:walletEnvironment'];
     const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
-    return { email, address, environment };
+    return Object.assign(Object.assign(Object.assign({ email }, (typeof address === 'string' && address ? { address } : {})), (typeof evmAddress === 'string' ? { evmAddress: evmAddress.toLowerCase() } : {})), { environment });
 }
 async function signerPageUrl() {
     const cfg = await getConfig();
@@ -3675,7 +3678,8 @@ async function signViaSignerPopup(action) {
     if (!hasDOM$1()) {
         throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
     }
-    const claims = walletClaimsFromSession();
+    const isEvm = action.kind === 'evmTransaction';
+    const claims = walletClaimsFromSession(isEvm ? 'evm' : 'solana');
     if (!claims)
         throw new Error(NO_EMBEDDED_WALLET);
     const { url, origin: signerOrigin } = await signerPageUrl();
@@ -3693,7 +3697,7 @@ async function signViaSignerPopup(action) {
         requestId,
         environment: claims.environment, // may be undefined → page auto-detects
         email: claims.email,
-        address: claims.address,
+        address: isEvm ? claims.evmAddress : claims.address,
         action,
     };
     return await new Promise((resolve, reject) => {
@@ -3718,6 +3722,8 @@ async function signViaSignerPopup(action) {
         const onMsg = (ev) => {
             if (ev.origin !== signerOrigin)
                 return; // only trust the signer page origin
+            if (ev.source !== popup)
+                return; // only trust this signer popup window
             const d = ev.data;
             if (!d || typeof d !== 'object')
                 return;
@@ -3789,6 +3795,10 @@ function serializeTransaction(transaction) {
 function hasEmbeddedWallet() {
     return walletClaimsFromSession() != null;
 }
+/** Whether the active email/social session carries an embedded Crossmint EVM wallet. */
+function hasEmbeddedEvmWallet() {
+    return walletClaimsFromSession('evm') != null;
+}
 /** signAndSubmitTransaction for embedded wallets: serialize + route through the
  *  signer popup, resolve with the on-chain transaction signature/hash. */
 async function embeddedSignAndSubmit(transaction) {
@@ -3799,6 +3809,36 @@ async function embeddedSignAndSubmit(transaction) {
         throw new Error('Signer returned no transaction hash.');
     return hash;
 }
+/** Submit a validated BoundedRuntime EVM write through the user's email signer. */
+async function embeddedRunEvmTransaction(transaction) {
+    var _a, _b;
+    if (!transaction.to || !transaction.data || !transaction.chainId)
+        throw new Error('Incomplete embedded EVM transaction');
+    if (!/^0x[0-9a-fA-F]{40}$/.test(transaction.to))
+        throw new Error('Invalid embedded EVM runtime address');
+    assertCanonicalBoundedRuntimeWriteCalldata(transaction.data);
+    if (!Number.isSafeInteger(transaction.chainId) || transaction.chainId <= 0)
+        throw new Error('Invalid embedded EVM chain id');
+    if (transaction.nonce !== undefined)
+        throw new Error('Server-supplied EVM nonces are not accepted');
+    try {
+        if (BigInt((_a = transaction.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
+            throw new Error('Bounded EVM writes cannot transfer native value');
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('cannot transfer'))
+            throw error;
+        throw new Error('Invalid embedded EVM transaction value');
+    }
+    const result = await signViaSignerPopup({
+        kind: 'evmTransaction',
+        transaction: { to: transaction.to, data: transaction.data, value: (_b = transaction.value) !== null && _b !== void 0 ? _b : '0', chainId: transaction.chainId },
+    });
+    const hash = result.hash || result.transactionId;
+    if (!hash)
+        throw new Error('Signer returned no EVM transaction hash.');
+    return { transactionSignature: hash, blockNumber: 0, gasUsed: '0', data: result };
+}
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
 // ReactNativeSessionManager. getActiveSessionManager() picks the right one by
@@ -3833,7 +3873,10 @@ function userFromIdToken$1(idToken, fallbackEmail) {
     const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';
     const email = (c.email || fallbackEmail || null);
     // Email logins have no wallet — address is null (the User type allows it).
-    return { id, address: (c['custom:walletAddress'] || null), email, provider: emailProviderSingleton };
+    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])
+        ? c['custom:evmWalletAddress'].toLowerCase()
+        : null;
+    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };
 }
 // ---------------------------------------------------------------------------
 // provider
@@ -3867,7 +3910,17 @@ class EmailAuthProvider {
     async signMessage(_message) {
         throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
     }
-    async runTransaction(_evm, _sol, _options) { throw new Error(NO_WALLET); }
+    async runTransaction(evm, sol, options) {
+        if (evm && sol)
+            throw new Error('A transaction cannot target EVM and Solana at the same time.');
+        if (!evm)
+            throw new Error(NO_WALLET);
+        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
+            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');
+        if (!hasEmbeddedEvmWallet())
+            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');
+        return embeddedRunEvmTransaction(evm);
+    }
     async signTransaction(_t) {
         throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);
     }
@@ -3973,31 +4026,45 @@ function defaultInjectedProvider() {
     return null;
 }
 
-const STORED_AUTH_METHOD_KEY$2 = 'bounded_last_auth_method';
+const STORED_AUTH_METHOD_KEY$3 = 'bounded_last_auth_method';
 const INJECTED_AUTH_METHOD = 'phantom';
-const NO_WALLET_ERR = 'No injected Solana wallet found. Install a wallet like Phantom (phantom.app) and try again, ' +
+const NO_WALLET_ERR$1 = 'No injected Solana wallet found. Install a wallet like Phantom (phantom.app) and try again, ' +
     'or pass config.injectedWalletConfig.getProvider to point at your wallet.';
 class InjectedWalletProvider {
     constructor(config = {}, networkUrl = null, configuredNetwork = null) {
-        var _a, _b;
+        var _a;
         if (typeof window === 'undefined') {
             throw new Error('InjectedWalletProvider can only be instantiated in a browser environment');
         }
+        // `config.rpcUrl` is the legacy wallet-login-local override. Normalize
+        // it before precedence so an empty legacy value cannot shadow the
+        // current top-level config.rpcUrl. Re-initialization must also replace
+        // every singleton field; otherwise a previous app's provider/RPC can
+        // survive getAuthProvider()'s config-key rotation.
+        const resolvedNetworkUrl = (_a = normalizeSolanaRpcUrl(config.rpcUrl)) !== null && _a !== void 0 ? _a : normalizeSolanaRpcUrl(networkUrl);
+        const localNetwork = typeof config.network === 'string' && config.network.trim() !== ''
+            ? config.network.trim()
+            : null;
+        const resolvedConfiguredNetwork = localNetwork !== null && localNetwork !== void 0 ? localNetwork : (typeof configuredNetwork === 'string' && configuredNetwork.trim() !== ''
+            ? configuredNetwork.trim()
+            : null);
         // Singleton so the SDK reuses one instance (mirrors the other providers).
         if (InjectedWalletProvider.instance) {
-            InjectedWalletProvider.instance.config = Object.assign(Object.assign({}, InjectedWalletProvider.instance.config), config);
+            InjectedWalletProvider.instance.config = Object.assign({}, config);
+            InjectedWalletProvider.instance.networkUrl = resolvedNetworkUrl;
+            InjectedWalletProvider.instance.configuredNetwork = resolvedConfiguredNetwork;
             return InjectedWalletProvider.instance;
         }
-        this.config = config;
-        this.networkUrl = (_a = config.rpcUrl) !== null && _a !== void 0 ? _a : networkUrl;
-        this.configuredNetwork = (_b = config.network) !== null && _b !== void 0 ? _b : configuredNetwork;
+        this.config = Object.assign({}, config);
+        this.networkUrl = resolvedNetworkUrl;
+        this.configuredNetwork = resolvedConfiguredNetwork;
         InjectedWalletProvider.instance = this;
     }
     resolveProvider() {
         var _a;
         const provider = (_a = (this.config.getProvider ? this.config.getProvider() : null)) !== null && _a !== void 0 ? _a : defaultInjectedProvider();
         if (!provider)
-            throw new Error(NO_WALLET_ERR);
+            throw new Error(NO_WALLET_ERR$1);
         return provider;
     }
     /** Connect the injected wallet (if needed) and return its Solana address. */
@@ -4051,7 +4118,7 @@ class InjectedWalletProvider {
         // Mark the auth method so clearIncompatibleSession() doesn't wipe this
         // wallet session on the next init().
         try {
-            getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$2, INJECTED_AUTH_METHOD);
+            getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$3, INJECTED_AUTH_METHOD);
         }
         catch ( /* no storage */_a) { /* no storage */ }
     }
@@ -4206,6 +4273,406 @@ class InjectedWalletProvider {
 }
 InjectedWalletProvider.instance = null;
 
+// injected-evm-wallet-types.ts — tiny, dependency-free surface for the EVM
+// WALLET LOGIN path (BYO wallet via SIWE). The EVM twin of
+// injected-wallet-types.ts: kept separate from injected-evm-wallet-provider.ts
+// so the SDK entry can eagerly export the type surface + the provider-discovery
+// helper WITHOUT dragging the provider class into the default bundle. The
+// provider is lazy-loaded by getAuthProvider() when an app opts into
+// authMethod:'evm-wallet'.
+//
+// It rides the standard EIP-1193 injected provider a browser wallet exposes
+// (MetaMask / Rabby / Coinbase Wallet / any window.ethereum), discovered via
+// EIP-6963 (multi-wallet, collision-free) with a window.ethereum fallback. It
+// needs NO viem/ethers and NO React — EIP-1193 request() + hex strings suffice.
+// EIP-6963 is announcement-based: wallets add an `eip6963:requestProvider`
+// listener and synchronously dispatch `eip6963:announceProvider` in response. We
+// keep a persistent collector so announcements (including late ones) are
+// captured, and re-request on demand.
+const announcedProviders = [];
+let announceListenerAttached = false;
+function attachAnnounceListener() {
+    if (announceListenerAttached || typeof window === 'undefined')
+        return;
+    announceListenerAttached = true;
+    window.addEventListener('eip6963:announceProvider', (event) => {
+        const detail = event === null || event === void 0 ? void 0 : event.detail;
+        if (detail &&
+            detail.provider &&
+            typeof detail.provider.request === 'function' &&
+            !announcedProviders.some((d) => { var _a, _b; return ((_a = d.info) === null || _a === void 0 ? void 0 : _a.uuid) === ((_b = detail.info) === null || _b === void 0 ? void 0 : _b.uuid); })) {
+            announcedProviders.push(detail);
+        }
+    });
+}
+/**
+ * Request + collect EIP-6963 providers. Dispatches `eip6963:requestProvider`
+ * (synchronous — already-loaded wallets announce in the same tick) and returns
+ * every wallet announced so far. Kept synchronous so it works inside a user
+ * gesture and can be eagerly exported from the SDK entry.
+ */
+function requestEip6963Providers() {
+    if (typeof window === 'undefined')
+        return [];
+    attachAnnounceListener();
+    try {
+        window.dispatchEvent(new Event('eip6963:requestProvider'));
+    }
+    catch (_a) {
+        /* older browsers without Event constructor — fall through to window.ethereum */
+    }
+    return announcedProviders.slice();
+}
+/**
+ * Default EVM provider discovery: EIP-6963 first (multi-wallet, collision-free),
+ * then legacy `window.ethereum`. Returns null when no injected wallet is present.
+ */
+function defaultInjectedEvmProvider() {
+    if (typeof window === 'undefined')
+        return null;
+    const details = requestEip6963Providers();
+    if (details.length > 0)
+        return details[0].provider;
+    const eth = window.ethereum;
+    if (eth && typeof eth.request === 'function')
+        return eth;
+    return null;
+}
+
+const STORED_AUTH_METHOD_KEY$2 = 'bounded_last_auth_method';
+// Must equal the authMethod the registry (auth/index.ts) sets as currentAuthMethod,
+// so clearIncompatibleSession() keeps (not wipes) this session on the next init().
+const INJECTED_EVM_AUTH_METHOD = 'evm-wallet';
+// The /session issuer's discriminator for the SIWE (EIP-4361 secp256k1) exchange.
+const SIWE_SESSION_METHOD = 'siwe';
+const NO_WALLET_ERR = 'No injected EVM wallet found. Install a wallet like MetaMask (metamask.io) or Rabby and try again, ' +
+    'or pass config.evmWalletConfig.getProvider to point at your wallet.';
+const NO_SOL_TX_ERR = 'EVM wallet login signs+submits transactions in one step (eth_sendTransaction) and has no Solana ' +
+    'transaction surface. Use an onchain WRITE (setMany) — the worker returns a pre-built EVM tx that ' +
+    'runTransaction submits — instead of signTransaction/signAndSubmitTransaction.';
+// Bounded polling for the tx receipt: ~60s at 2s cadence (L2 blocks are seconds).
+const RECEIPT_POLL_ATTEMPTS = 30;
+const RECEIPT_POLL_INTERVAL_MS = 2000;
+function normalizeConfig(config) {
+    var _a;
+    if (config.chainId !== undefined && (!Number.isSafeInteger(config.chainId) || config.chainId <= 0)) {
+        throw new Error('EVM wallet chainId must be a positive safe integer');
+    }
+    let runtimeAddress;
+    if (config.runtimeAddress !== undefined) {
+        runtimeAddress = (_a = normalizeEvmAddress(config.runtimeAddress)) !== null && _a !== void 0 ? _a : undefined;
+        if (!runtimeAddress)
+            throw new Error('EVM wallet runtimeAddress is invalid');
+        if (config.chainId === undefined)
+            throw new Error('EVM wallet runtimeAddress requires an explicit chainId');
+    }
+    let runtimeAddresses;
+    if (config.runtimeAddresses !== undefined) {
+        runtimeAddresses = {};
+        for (const [rawChainId, rawAddress] of Object.entries(config.runtimeAddresses)) {
+            const chainId = Number(rawChainId);
+            const address = normalizeEvmAddress(rawAddress);
+            if (!Number.isSafeInteger(chainId) || chainId <= 0 || String(chainId) !== rawChainId || !address) {
+                throw new Error(`Invalid EVM runtime allowlist entry for chain ${rawChainId}`);
+            }
+            runtimeAddresses[rawChainId] = address;
+        }
+    }
+    return Object.assign(Object.assign({}, config), { runtimeAddress, runtimeAddresses });
+}
+class InjectedEvmWalletProvider {
+    constructor(config = {}) {
+        this.authenticatedAddress = null;
+        if (typeof window === 'undefined') {
+            throw new Error('InjectedEvmWalletProvider can only be instantiated in a browser environment');
+        }
+        const normalized = normalizeConfig(config);
+        // Singleton so the SDK reuses one instance (mirrors the other providers).
+        if (InjectedEvmWalletProvider.instance) {
+            InjectedEvmWalletProvider.instance.config = normalized;
+            InjectedEvmWalletProvider.instance.authenticatedAddress = null;
+            return InjectedEvmWalletProvider.instance;
+        }
+        this.config = normalized;
+        InjectedEvmWalletProvider.instance = this;
+    }
+    // @user.address (the Solana wallet) is null for an EVM-wallet login. User.address
+    // is typed `string` for legacy reasons — email logins cast the same null the same
+    // way (email-auth-provider.ts) — so the null is cast here in one place.
+    evmUser(address) {
+        return { id: address, address: null, evmAddress: address, provider: this };
+    }
+    resolveProvider() {
+        var _a;
+        const provider = (_a = (this.config.getProvider ? this.config.getProvider() : null)) !== null && _a !== void 0 ? _a : defaultInjectedEvmProvider();
+        if (!provider)
+            throw new Error(NO_WALLET_ERR);
+        return provider;
+    }
+    /** Connect the injected wallet and return its canonical lowercase EVM address. */
+    async connectAddress(provider) {
+        const accounts = await provider.request({ method: 'eth_requestAccounts' });
+        const raw = Array.isArray(accounts) ? accounts[0] : undefined;
+        const address = normalizeEvmAddress(raw);
+        if (!address)
+            throw new Error('Wallet did not return a valid EVM address on connect');
+        return address;
+    }
+    /** Current chain id the wallet is connected to (EIP-155 number), or null. */
+    async currentChainId(provider) {
+        try {
+            const hex = await provider.request({ method: 'eth_chainId' });
+            if (typeof hex !== 'string' || !/^0x[0-9a-fA-F]+$/.test(hex))
+                return null;
+            const n = Number(BigInt(hex));
+            return Number.isSafeInteger(n) && n > 0 ? n : null;
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    async login() {
+        var _a;
+        setAuthLoading(true);
+        try {
+            const provider = this.resolveProvider();
+            const address = await this.connectAddress(provider);
+            // Reuse a still-valid session for THIS wallet.
+            const existing = await getActiveSessionManager().getSession();
+            if (existing && existing.address === address) {
+                const user = this.evmUser(address);
+                this.authenticatedAddress = address;
+                setCurrentUser(user);
+                this.markAuthMethod();
+                return user;
+            }
+            // SIWE: nonce -> canonical EIP-4361 prompt -> the wallet personal_sign's it.
+            const nonce = await genAuthNonce();
+            const appId = (await getConfig()).appId;
+            const chainId = (_a = this.config.chainId) !== null && _a !== void 0 ? _a : await this.currentChainId(provider);
+            if (chainId === null)
+                throw new Error('Could not verify the EVM wallet chain for SIWE login');
+            const message = genSiweMessage(address, nonce, appId, this.resolveDomain(), this.resolveUri(), { chainId });
+            // personal_sign(message, address) -> 0x r‖s‖v hex (the shape the
+            // bounded-auth verifier's recoverSiweSigner consumes). The raw UTF-8
+            // message is signed under the EIP-191 envelope the verifier hashes.
+            const signature = await provider.request({
+                method: 'personal_sign',
+                params: [message, address],
+            });
+            const result = await createSessionWithSignature(address, message, signature, SIWE_SESSION_METHOD);
+            await getActiveSessionManager().storeSession(address, result.accessToken, result.idToken, result.refreshToken);
+            this.markAuthMethod();
+            const user = this.evmUser(address);
+            this.authenticatedAddress = address;
+            setCurrentUser(user);
+            return user;
+        }
+        finally {
+            setAuthLoading(false);
+        }
+    }
+    resolveDomain() {
+        const actual = window.location.host.toLowerCase();
+        if (this.config.domain && this.config.domain.toLowerCase() !== actual) {
+            throw new Error('SIWE domain override must match the current browser origin');
+        }
+        return actual;
+    }
+    resolveUri() {
+        const actual = window.location.origin.toLowerCase();
+        if (this.config.uri) {
+            let configured;
+            try {
+                configured = new URL(this.config.uri).origin.toLowerCase();
+            }
+            catch (_a) {
+                throw new Error('SIWE URI override must be an absolute URL');
+            }
+            if (configured !== actual)
+                throw new Error('SIWE URI override must match the current browser origin');
+        }
+        return actual;
+    }
+    markAuthMethod() {
+        try {
+            getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$2, INJECTED_EVM_AUTH_METHOD);
+        }
+        catch ( /* no storage */_a) { /* no storage */ }
+    }
+    async restoreSession() {
+        const session = await getActiveSessionManager().getSession();
+        if (!session)
+            return null;
+        // An EVM-wallet session stores the EVM address as its address; @user.address
+        // (the Solana wallet) is null for this login.
+        const address = normalizeEvmAddress(session.address);
+        if (!address) {
+            getActiveSessionManager().clearSession();
+            return null;
+        }
+        this.authenticatedAddress = address;
+        const user = this.evmUser(address);
+        setCurrentUser(user);
+        return user;
+    }
+    async logout() {
+        // EIP-1193 has no standard disconnect; clearing the Bounded session is the
+        // logout. (wallet_revokePermissions is non-standard/opt-in — skip it.)
+        getActiveSessionManager().clearSession();
+        this.authenticatedAddress = null;
+        setCurrentUser(null);
+    }
+    // --- Signing surface -------------------------------------------------------
+    /** App-facing message signing: EIP-191 personal_sign, returns 0x r‖s‖v hex. */
+    async signMessage(message) {
+        const provider = this.resolveProvider();
+        const address = await this.connectAddress(provider);
+        if (!this.authenticatedAddress || address !== this.authenticatedAddress) {
+            throw new Error('The connected EVM wallet account changed after login. Sign in again before signing.');
+        }
+        return provider.request({ method: 'personal_sign', params: [message, address] });
+    }
+    // Solana-typed methods are structurally unsupported on an EVM wallet — the
+    // EVM onchain write goes through runTransaction (eth_sendTransaction).
+    async signTransaction(_transaction) {
+        throw new Error(NO_SOL_TX_ERR);
+    }
+    async signAndSubmitTransaction(_transaction, _feePayer) {
+        throw new Error(NO_SOL_TX_ERR);
+    }
+    /**
+     * Onchain write path: submit the worker's PRE-BUILT EIP-1559 tx via
+     * eth_sendTransaction (the injected wallet signs + submits in one step), then
+     * poll for the receipt. The EVM branch of operations.ts's 202 dispatch calls
+     * this with the pre-built payload in the EVM slot and the Solana slot undefined.
+     */
+    async runTransaction(evmTransactionData, solTransactionData, options) {
+        var _a, _b, _c;
+        const evmTx = evmTransactionData;
+        if (evmTx && solTransactionData) {
+            throw new Error('A transaction cannot target EVM and Solana at the same time.');
+        }
+        if (!evmTx || !normalizeEvmAddress(evmTx.to) || typeof evmTx.data !== 'string' || !/^0x(?:[0-9a-fA-F]{2})+$/.test(evmTx.data)) {
+            throw new Error('EVM transaction data (pre-built { to, data, chainId }) is required for an EVM onchain write');
+        }
+        // Exact decode, rather than a four-byte prefix check: permits the
+        // ordinary and attested document-write entrypoints while rejecting
+        // malformed/trailing calldata before the wallet sees a signing prompt.
+        assertCanonicalBoundedRuntimeWriteCalldata(evmTx.data);
+        if (!Number.isSafeInteger(evmTx.chainId) || evmTx.chainId <= 0) {
+            throw new Error('EVM transaction chainId is required and must be a positive safe integer');
+        }
+        const chainId = evmTx.chainId;
+        const trustedRuntime = (_b = (_a = this.config.runtimeAddresses) === null || _a === void 0 ? void 0 : _a[String(chainId)]) !== null && _b !== void 0 ? _b : (this.config.chainId === chainId ? this.config.runtimeAddress : undefined);
+        if (!trustedRuntime)
+            throw new Error(`No trusted BoundedRuntime address configured for EVM chain ${chainId}`);
+        if (normalizeEvmAddress(evmTx.to) !== trustedRuntime) {
+            throw new Error('EVM transaction target is not the configured BoundedRuntime');
+        }
+        if (evmTx.nonce !== undefined) {
+            throw new Error('Server-supplied EVM nonces are not accepted');
+        }
+        try {
+            if (BigInt((_c = evmTx.value) !== null && _c !== void 0 ? _c : '0') !== BigInt(0)) {
+                throw new Error('BoundedRuntime.setDocuments cannot transfer native value');
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('cannot transfer'))
+                throw error;
+            throw new Error('Invalid EVM transaction value');
+        }
+        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
+            // Injected EVM wallets sign+submit atomically; eth_signTransaction is not
+            // broadly supported (MetaMask removed it), so we cannot return a signed-
+            // but-unsubmitted tx here. Fail clearly instead of silently submitting.
+            throw new Error('shouldSubmitTx:false is unsupported for injected EVM wallets (they sign and submit atomically).');
+        }
+        const provider = this.resolveProvider();
+        const from = await this.connectAddress(provider);
+        if (!this.authenticatedAddress || from !== this.authenticatedAddress) {
+            throw new Error('The connected EVM wallet account changed after login. Sign in again before submitting this write.');
+        }
+        // Chain-switch guard: the pre-built tx names the chain it MUST execute on.
+        if (typeof evmTx.chainId === 'number') {
+            const current = await this.currentChainId(provider);
+            if (current === null)
+                throw new Error('Could not verify the EVM wallet chain; refusing to submit the transaction.');
+            if (current !== evmTx.chainId) {
+                const targetHex = '0x' + evmTx.chainId.toString(16);
+                try {
+                    await provider.request({
+                        method: 'wallet_switchEthereumChain',
+                        params: [{ chainId: targetHex }],
+                    });
+                }
+                catch (err) {
+                    throw new Error(`EVM wallet is on chain ${current} but this write targets chain ${evmTx.chainId}, ` +
+                        `and the chain switch was rejected or failed${(err === null || err === void 0 ? void 0 : err.message) ? `: ${err.message}` : ''}. ` +
+                        `Switch your wallet to chain ${evmTx.chainId} and retry.`);
+                }
+                const switched = await this.currentChainId(provider);
+                if (switched !== evmTx.chainId) {
+                    throw new Error(`EVM wallet did not switch to required chain ${evmTx.chainId}; refusing to submit.`);
+                }
+            }
+        }
+        const txParams = { from, to: normalizeEvmAddress(evmTx.to), data: evmTx.data.toLowerCase() };
+        txParams.value = '0x0';
+        // Gas, fee and nonce hints come from the server and are not part of the
+        // governed action. Deliberately omit them: the wallet estimates locally,
+        // preventing a compromised response from forcing an abusive fee/nonce.
+        const txHash = await provider.request({
+            method: 'eth_sendTransaction',
+            params: [txParams],
+        });
+        if (typeof txHash !== 'string' || !/^0x[0-9a-fA-F]{64}$/.test(txHash)) {
+            throw new Error('EVM wallet returned an invalid transaction hash');
+        }
+        const receipt = await this.waitForReceipt(provider, txHash);
+        if (!receipt || typeof receipt.status !== 'string' || !/^0x[0-9a-fA-F]+$/.test(receipt.status)) {
+            throw new Error(`EVM transaction ${txHash} returned an invalid receipt status`);
+        }
+        if (BigInt(receipt.status) !== BigInt(1)) {
+            throw new Error(`EVM transaction ${txHash} reverted on-chain`);
+        }
+        if (typeof receipt.blockNumber !== 'string' || !/^0x[0-9a-fA-F]+$/.test(receipt.blockNumber)) {
+            throw new Error(`EVM transaction ${txHash} returned an invalid block number`);
+        }
+        const blockNumber = BigInt(receipt.blockNumber);
+        if (blockNumber > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new Error('EVM receipt block number exceeds the SDK safe-integer range');
+        if (typeof receipt.gasUsed !== 'string' || !/^0x[0-9a-fA-F]+$/.test(receipt.gasUsed)) {
+            throw new Error(`EVM transaction ${txHash} returned invalid gas usage`);
+        }
+        return {
+            transactionSignature: txHash,
+            blockNumber: Number(blockNumber),
+            gasUsed: BigInt(receipt.gasUsed).toString(),
+            data: receipt,
+        };
+    }
+    /** Poll eth_getTransactionReceipt until it lands (bounded retries) or throw. */
+    async waitForReceipt(provider, txHash) {
+        for (let attempt = 0; attempt < RECEIPT_POLL_ATTEMPTS; attempt++) {
+            const receipt = await provider.request({
+                method: 'eth_getTransactionReceipt',
+                params: [txHash],
+            });
+            if (receipt)
+                return receipt;
+            await new Promise((r) => setTimeout(r, RECEIPT_POLL_INTERVAL_MS));
+        }
+        throw new Error(`EVM transaction ${txHash} was submitted but no receipt confirmed within ` +
+            `${(RECEIPT_POLL_ATTEMPTS * RECEIPT_POLL_INTERVAL_MS) / 1000}s. It may still land; check the explorer.`);
+    }
+    async getNativeMethods() {
+        return this.resolveProvider();
+    }
+}
+InjectedEvmWalletProvider.instance = null;
+
 // Same message the email provider uses when a hosted (OIDC) login has no
 // embedded wallet — enable `auth.wallets` in policy to get one.
 const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
@@ -4255,6 +4722,17 @@ const oidcProviderSingleton = {
     async signTransaction(_t) {
         throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
     },
+    async runTransaction(evm, sol, options) {
+        if (evm && sol)
+            throw new Error('A transaction cannot target EVM and Solana at the same time.');
+        if (!evm)
+            throw new Error(OIDC_NO_WALLET);
+        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
+            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');
+        if (!hasEmbeddedEvmWallet())
+            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');
+        return embeddedRunEvmTransaction(evm);
+    },
     async signAndSubmitTransaction(transaction, _feePayer) {
         if (!hasEmbeddedWallet())
             throw new Error(OIDC_NO_WALLET);
@@ -4266,6 +4744,9 @@ function userFromIdToken(idToken) {
     const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';
     return {
         id, address: (c['custom:walletAddress'] || null),
+        evmAddress: typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])
+            ? c['custom:evmWalletAddress'].toLowerCase()
+            : null,
         email: (c.email || null), provider: oidcProviderSingleton,
     };
 }
@@ -4510,23 +4991,74 @@ async function completeLoginFromRedirect() {
 async function loginWithPopup(opts) {
     if (!hasDOM())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
-    const { url, pkce } = await buildAuthorize(opts);
-    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    // Open synchronously, before PKCE/config awaits consume the click's user-
+    // activation window. Opening only after buildAuthorize() intermittently
+    // left Chrome with a real named window stranded at about:blank (or blocked
+    // it entirely), while callers waited forever for an OAuth message.
     const w = opts.width || 480, h = opts.height || 720;
     const left = window.screenX + (window.outerWidth - w) / 2;
     const top = window.screenY + (window.outerHeight - h) / 2;
-    const popup = window.open(url, 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
+    const popup = window.open('', 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup)
         throw new Error('Popup blocked — use loginWithRedirect() instead');
-    // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
-    // not opts.redirectUri which may be undefined.
-    const expectedOrigin = new URL(pkce.redirectUri).origin;
+    let authorization;
+    try {
+        authorization = await buildAuthorize(opts);
+    }
+    catch (error) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_a) { /* ignore */ }
+        throw error;
+    }
+    const { url, pkce } = authorization;
+    // Validate every remaining synchronous setup step before navigating. Both
+    // URL parsing and sessionStorage can throw (malformed caller input, blocked
+    // storage, quota/privacy mode); because the popup is already open to retain
+    // user activation, close it on either failure instead of orphaning a blank
+    // window with no listener or watchdog attached.
+    let expectedOrigin;
+    try {
+        expectedOrigin = new URL(pkce.redirectUri).origin;
+        sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    }
+    catch (error) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw error;
+    }
+    try {
+        popup.location.replace(url);
+    }
+    catch (_c) {
+        try {
+            popup.location.href = url;
+        }
+        catch (_d) {
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_e) { /* ignore */ }
+            throw new Error('Popup failed to navigate — use loginWithRedirect() instead');
+        }
+    }
+    // expectedOrigin came from the RESOLVED redirect_uri (buildAuthorize defaulted it to the
+    // current page on web), not opts.redirectUri which may be undefined.
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
             let settled = false;
             let timer;
-            const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
+            let navigationTimer;
+            const cleanup = () => {
+                settled = true;
+                clearInterval(timer);
+                clearTimeout(navigationTimer);
+                window.removeEventListener('message', onMsg);
+            };
             const onMsg = async (ev) => {
                 if (ev.origin !== expectedOrigin)
                     return; // only trust the redirect_uri origin
@@ -4554,6 +5086,27 @@ async function loginWithPopup(opts) {
                 }
             };
             window.addEventListener('message', onMsg);
+            // Some browser/extension combinations can return a real popup handle but
+            // strand the window at about:blank instead of navigating to the hosted
+            // authorize URL. The old code then waited forever because the popup was
+            // open and no message could ever arrive. Once the popup becomes
+            // cross-origin, reading location throws — that is positive evidence that
+            // navigation succeeded, so only a still-readable about:blank is rejected.
+            navigationTimer = setTimeout(() => {
+                if (settled || popup.closed)
+                    return;
+                try {
+                    if (popup.location.href === 'about:blank') {
+                        cleanup();
+                        try {
+                            popup.close();
+                        }
+                        catch ( /* ignore */_a) { /* ignore */ }
+                        reject(new Error('Popup stalled at about:blank — use loginWithRedirect() instead'));
+                    }
+                }
+                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+            }, 4000);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
             // races the just-posted message and would report a spurious "Login window closed" on a
             // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
@@ -4697,7 +5250,7 @@ function stableConfigValue(value, seen = new WeakSet()) {
     return String(value);
 }
 function authProviderConfigKey(config) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
     return JSON.stringify({
         authMethod: (_a = config.authMethod) !== null && _a !== void 0 ? _a : null,
         chain: (_b = config.chain) !== null && _b !== void 0 ? _b : null,
@@ -4707,9 +5260,10 @@ function authProviderConfigKey(config) {
         phantomConfig: stableConfigValue((_e = config.phantomConfig) !== null && _e !== void 0 ? _e : null),
         walletLogin: stableConfigValue((_f = config.walletLogin) !== null && _f !== void 0 ? _f : null),
         injectedWalletConfig: stableConfigValue((_g = config.injectedWalletConfig) !== null && _g !== void 0 ? _g : null),
-        privyConfig: stableConfigValue((_h = config.privyConfig) !== null && _h !== void 0 ? _h : null),
-        mobileWalletConfig: stableConfigValue((_j = config.mobileWalletConfig) !== null && _j !== void 0 ? _j : null),
-        privyExpoProvider: objectIdentityKey((_k = config.privyExpoProvider) !== null && _k !== void 0 ? _k : null),
+        evmWalletConfig: stableConfigValue((_h = config.evmWalletConfig) !== null && _h !== void 0 ? _h : null),
+        privyConfig: stableConfigValue((_j = config.privyConfig) !== null && _j !== void 0 ? _j : null),
+        mobileWalletConfig: stableConfigValue((_k = config.mobileWalletConfig) !== null && _k !== void 0 ? _k : null),
+        privyExpoProvider: objectIdentityKey((_l = config.privyExpoProvider) !== null && _l !== void 0 ? _l : null),
     });
 }
 /**
@@ -4790,7 +5344,7 @@ function optionalProviderError(method) {
         `or install/import an explicit wallet-provider entry once your app opts into "${method}".`);
 }
 async function getAuthProvider(config) {
-    var _a;
+    var _a, _b;
     const nextProviderConfigKey = config ? authProviderConfigKey(config) : null;
     if (currentAuthProvider && (!config || currentAuthProviderConfigKey === nextProviderConfigKey)) {
         return currentAuthProvider;
@@ -4814,7 +5368,7 @@ async function getAuthProvider(config) {
     // browser environment" deep in init(). The server build (`bounded-sh/server`)
     // never resolves these methods (it signs with a keypair), so this can't fire for
     // it — it only converts the cryptic browser-in-Node crash into a useful message.
-    const browserWalletMethods = ['phantom', 'wallet', 'rainbowkit', 'coinbase-smart-wallet', 'onboard', 'mobile-wallet-adapter', 'privy'];
+    const browserWalletMethods = ['phantom', 'wallet', 'evm-wallet', 'rainbowkit', 'coinbase-smart-wallet', 'onboard', 'mobile-wallet-adapter', 'privy'];
     if (typeof window === 'undefined' && browserWalletMethods.includes(authMethod)) {
         throw new Error(`bounded-sh: '${authMethod}' auth requires a browser, but no \`window\` was found ` +
             `(you're likely running in Node). In server/Node code, import from 'bounded-sh/server' ` +
@@ -4849,6 +5403,18 @@ async function getAuthProvider(config) {
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
+        case "evm-wallet": {
+            // First-class EVM WALLET LOGIN (BYO Ethereum wallet via SIWE). Slim
+            // path: rides the EIP-1193 injected provider a browser wallet exposes
+            // (MetaMask / Rabby / Coinbase Wallet / any window.ethereum), discovered
+            // via EIP-6963. The user's REAL EVM wallet becomes @user.evmAddress;
+            // login = SIWE (EIP-4361 personal_sign). No viem/ethers and no React.
+            // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
+            // to point at a specific wallet or set chainId/domain.
+            const evmWalletConfig = ((_b = config.evmWalletConfig) !== null && _b !== void 0 ? _b : {});
+            currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
+            break;
+        }
         case "rainbowkit":
             console.warn("Rainbow Kit auth is not yet supported.");
             break;