@bounded-sh/client 0.0.50 → 0.0.52

package/dist/{guest-auth-provider-B5sgg-q5.js.map → guest-auth-provider-BrSO-CUp.js.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-B5sgg-q5.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction idbPut(db, key, val) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).put(val, key);\n        r.onsuccess = () => resolve();\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            pair = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            await idbPut(db, IDB_KEY, pair); // CryptoKey is structured-cloneable; bytes never exposed\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(true);\n    if (!cached)\n        throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n    return cached;\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    try {\n        if (typeof globalThis.indexedDB !== 'undefined') {\n            const db = await idb();\n            await new Promise((res) => {\n                const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).delete(IDB_KEY);\n                r.onsuccess = () => res();\n                r.onerror = () => res();\n            });\n        }\n    }\n    catch (_b) { }\n}\n","import { getActiveSessionManager as SessionManager, createSessionWithSignature, genAuthNonce, genSolanaMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> canonical message -> local signature.\n            const nonce = await genAuthNonce();\n            const message = await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    // --- offchain guest: no Solana transaction surface -------------------------\n    async runTransaction(_evm, _sol, _options) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;AAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7F,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,EAAE;AACrC,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACtF,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf,YAAY,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,UAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AACrC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACnF,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,IAAI;AACR,QAAQC,iBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB,IAAI,IAAI;AACR,QAAQ,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACzD,YAAY,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAClC,YAAY,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK;AACvC,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACvG,gBAAgB,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,EAAE;AACzC,gBAAgB,CAAC,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE;AACvC,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;;AC7HA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,oBAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,OAAO,GAAG,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AACtE,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMJ,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,oBAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,oBAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ;AACA,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC/C,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-BrSO-CUp.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction idbPut(db, key, val) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).put(val, key);\n        r.onsuccess = () => resolve();\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            pair = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            await idbPut(db, IDB_KEY, pair); // CryptoKey is structured-cloneable; bytes never exposed\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(true);\n    if (!cached)\n        throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n    return cached;\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    try {\n        if (typeof globalThis.indexedDB !== 'undefined') {\n            const db = await idb();\n            await new Promise((res) => {\n                const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).delete(IDB_KEY);\n                r.onsuccess = () => res();\n                r.onerror = () => res();\n            });\n        }\n    }\n    catch (_b) { }\n}\n","import { getActiveSessionManager as SessionManager, createSessionWithSignature, genAuthNonce, genSolanaMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> canonical message -> local signature.\n            const nonce = await genAuthNonce();\n            const message = await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    // --- offchain guest: no Solana transaction surface -------------------------\n    async runTransaction(_evm, _sol, _options) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;AAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7F,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,EAAE;AACrC,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACtF,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf,YAAY,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,UAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AACrC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACnF,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,IAAI;AACR,QAAQC,iBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB,IAAI,IAAI;AACR,QAAQ,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACzD,YAAY,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAClC,YAAY,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK;AACvC,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACvG,gBAAgB,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,EAAE;AACzC,gBAAgB,CAAC,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE;AACvC,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;;AC7HA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,oBAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,OAAO,GAAG,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AACtE,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMJ,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,oBAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,oBAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,oBAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ;AACA,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC/C,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}

package/dist/{guest-auth-provider-CxsLCznO.js → guest-auth-provider-DY-u2wpK.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index_native = require('./index.native-BfoLJCZg.js');
+var index_native = require('./index.native-2Mmuh7RB.js');
 require('react');
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -274,4 +274,4 @@ class GuestAuthProvider {
 }
 
 exports.GuestAuthProvider = GuestAuthProvider;
-//# sourceMappingURL=guest-auth-provider-CxsLCznO.js.map
+//# sourceMappingURL=guest-auth-provider-DY-u2wpK.js.map

package/dist/{guest-auth-provider-CxsLCznO.js.map → guest-auth-provider-DY-u2wpK.js.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-CxsLCznO.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction idbPut(db, key, val) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).put(val, key);\n        r.onsuccess = () => resolve();\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            pair = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            await idbPut(db, IDB_KEY, pair); // CryptoKey is structured-cloneable; bytes never exposed\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(true);\n    if (!cached)\n        throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n    return cached;\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    try {\n        if (typeof globalThis.indexedDB !== 'undefined') {\n            const db = await idb();\n            await new Promise((res) => {\n                const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).delete(IDB_KEY);\n                r.onsuccess = () => res();\n                r.onerror = () => res();\n            });\n        }\n    }\n    catch (_b) { }\n}\n","import { getActiveSessionManager as SessionManager, createSessionWithSignature, genAuthNonce, genSolanaMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> canonical message -> local signature.\n            const nonce = await genAuthNonce();\n            const message = await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    // --- offchain guest: no Solana transaction surface -------------------------\n    async runTransaction(_evm, _sol, _options) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;AAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7F,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,EAAE;AACrC,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACtF,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf,YAAY,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AACrC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACnF,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB,IAAI,IAAI;AACR,QAAQ,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACzD,YAAY,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAClC,YAAY,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK;AACvC,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACvG,gBAAgB,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,EAAE;AACzC,gBAAgB,CAAC,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE;AACvC,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;;AC7HA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,OAAO,GAAG,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AACtE,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMJ,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ;AACA,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC/C,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-DY-u2wpK.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction idbPut(db, key, val) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).put(val, key);\n        r.onsuccess = () => resolve();\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            pair = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            await idbPut(db, IDB_KEY, pair); // CryptoKey is structured-cloneable; bytes never exposed\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(true);\n    if (!cached)\n        throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n    return cached;\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    try {\n        if (typeof globalThis.indexedDB !== 'undefined') {\n            const db = await idb();\n            await new Promise((res) => {\n                const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).delete(IDB_KEY);\n                r.onsuccess = () => res();\n                r.onerror = () => res();\n            });\n        }\n    }\n    catch (_b) { }\n}\n","import { getActiveSessionManager as SessionManager, createSessionWithSignature, genAuthNonce, genSolanaMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> canonical message -> local signature.\n            const nonce = await genAuthNonce();\n            const message = await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    // --- offchain guest: no Solana transaction surface -------------------------\n    async runTransaction(_evm, _sol, _options) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;AAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7F,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,EAAE;AACrC,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACtF,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf,YAAY,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AACrC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACnF,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB,IAAI,IAAI;AACR,QAAQ,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACzD,YAAY,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAClC,YAAY,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK;AACvC,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACvG,gBAAgB,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,EAAE;AACzC,gBAAgB,CAAC,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE;AACvC,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;;AC7HA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,OAAO,GAAG,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AACtE,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMJ,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQD,4BAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ;AACA,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC/C,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}

package/dist/{guest-auth-provider-BR0_YL8z.mjs → guest-auth-provider-ShmskrcH.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
-import { g as getPlatform, i as bs58, c as setAuthLoading, s as setCurrentUser } from './index-BYy1tSkr.mjs';
+import { g as getPlatform, i as bs58, c as setAuthLoading, s as setCurrentUser } from './index-BvUrIsky.mjs';
 import 'react';
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -272,4 +272,4 @@ class GuestAuthProvider {
 }
 
 export { GuestAuthProvider };
-//# sourceMappingURL=guest-auth-provider-BR0_YL8z.mjs.map
+//# sourceMappingURL=guest-auth-provider-ShmskrcH.mjs.map

package/dist/{guest-auth-provider-BR0_YL8z.mjs.map → guest-auth-provider-ShmskrcH.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-BR0_YL8z.mjs","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction idbPut(db, key, val) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).put(val, key);\n        r.onsuccess = () => resolve();\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            pair = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            await idbPut(db, IDB_KEY, pair); // CryptoKey is structured-cloneable; bytes never exposed\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(true);\n    if (!cached)\n        throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n    return cached;\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    try {\n        if (typeof globalThis.indexedDB !== 'undefined') {\n            const db = await idb();\n            await new Promise((res) => {\n                const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).delete(IDB_KEY);\n                r.onsuccess = () => res();\n                r.onerror = () => res();\n            });\n        }\n    }\n    catch (_b) { }\n}\n","import { getActiveSessionManager as SessionManager, createSessionWithSignature, genAuthNonce, genSolanaMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> canonical message -> local signature.\n            const nonce = await genAuthNonce();\n            const message = await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    // --- offchain guest: no Solana transaction surface -------------------------\n    async runTransaction(_evm, _sol, _options) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["SessionManager"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;AAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7F,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,EAAE;AACrC,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACtF,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf,YAAY,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AACrC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACnF,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,IAAI;AACR,QAAQ,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB,IAAI,IAAI;AACR,QAAQ,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACzD,YAAY,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAClC,YAAY,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK;AACvC,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACvG,gBAAgB,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,EAAE;AACzC,gBAAgB,CAAC,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE;AACvC,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;;AC7HA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMA,uBAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,uBAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoB,cAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA,YAAY,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE;AAC9C,YAAY,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AACtE,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMA,uBAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgB,cAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgB,cAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGA,uBAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQA,uBAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQA,uBAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ;AACA,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC/C,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-ShmskrcH.mjs","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction idbPut(db, key, val) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).put(val, key);\n        r.onsuccess = () => resolve();\n        r.onerror = () => reject(r.error);\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            pair = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            await idbPut(db, IDB_KEY, pair); // CryptoKey is structured-cloneable; bytes never exposed\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(true);\n    if (!cached)\n        throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n    return cached;\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    try {\n        if (typeof globalThis.indexedDB !== 'undefined') {\n            const db = await idb();\n            await new Promise((res) => {\n                const r = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE).delete(IDB_KEY);\n                r.onsuccess = () => res();\n                r.onerror = () => res();\n            });\n        }\n    }\n    catch (_b) { }\n}\n","import { getActiveSessionManager as SessionManager, createSessionWithSignature, genAuthNonce, genSolanaMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> canonical message -> local signature.\n            const nonce = await genAuthNonce();\n            const message = await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    // --- offchain guest: no Solana transaction surface -------------------------\n    async runTransaction(_evm, _sol, _options) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["SessionManager"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;AAC9B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC;AAC7F,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,EAAE;AACrC,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,IAAI,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACtF,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf,YAAY,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AACrC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACnF,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,IAAI;AACR,QAAQ,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB,IAAI,IAAI;AACR,QAAQ,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACzD,YAAY,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAClC,YAAY,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK;AACvC,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACvG,gBAAgB,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,EAAE;AACzC,gBAAgB,CAAC,CAAC,OAAO,GAAG,MAAM,GAAG,EAAE;AACvC,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;;AC7HA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMA,uBAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,uBAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoB,cAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA,YAAY,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE;AAC9C,YAAY,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AACtE,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMA,uBAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgB,cAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgB,cAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGA,uBAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,OAAO,CAAC,YAAY,EAAE;AAClC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAY,cAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQA,uBAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQA,uBAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ;AACA,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC/C,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}

package/dist/{index-BYy1tSkr.mjs → index-BvUrIsky.mjs}

@@ -4445,7 +4445,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-DIZAETBC.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-uZbdT_Bx.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4464,7 +4464,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BfzoheDy.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CGoMdKhp.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4477,7 +4477,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-sBCSkksr.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-COM5BPuY.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4505,7 +4505,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-BR0_YL8z.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-ShmskrcH.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4561,7 +4561,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-BR0_YL8z.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-ShmskrcH.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4737,8 +4737,45 @@ async function login$1(options) {
 function getCurrentAuthMethod() {
     return currentAuthMethod;
 }
-async function logout$1() {
-    var _a;
+// The hosted issuer keeps its OWN browser session (the Better Auth cookie on
+// auth.bounded.sh) — clearing the app-local session alone leaves it alive, so
+// the next loginWithRedirect() silently re-signs the user in as the SAME
+// account: "sign out" that never lets you re-choose. The issuer ships
+// GET /logout for exactly this — it expires the session cookies and bounces
+// back — but it only redirects to https origins it trusts. Mirror that
+// allowlist here: on a trusted origin we end the issuer session with a
+// top-level bounce; anywhere else (custom domains, http dev) we keep the
+// local-only logout instead of stranding the user on the issuer origin.
+function issuerLogoutBounceUrl(issuerBase) {
+    if (typeof window === 'undefined' || typeof document === 'undefined')
+        return null; // RN/Node: no shared cookie jar to clear this way
+    try {
+        if (window.top !== window.self)
+            return null; // framed: SameSite=Lax cookies don't ride iframe navigations
+    }
+    catch (_a) {
+        return null;
+    }
+    try {
+        const here = new URL(window.location.href);
+        const host = here.hostname;
+        const isLocalhost = host === 'localhost' || host === '127.0.0.1' || host.endsWith('.localhost');
+        const trusted = here.protocol === 'https:' &&
+            (host === 'bounded.sh' ||
+                host.endsWith('.bounded.sh') ||
+                host.endsWith('.bounded.page') ||
+                host.endsWith('.oapps.fun') ||
+                isLocalhost);
+        if (!trusted)
+            return null;
+        const base = issuerBase.replace(/\/$/, '');
+        return `${base}/logout?redirect_uri=${encodeURIComponent(here.href)}`;
+    }
+    catch (_b) {
+        return null;
+    }
+}
+async function logout$1(options) {
     // Re-initialize the provider if it was cleared by a prior logout — the exact mirror
     // of login()'s self-heal above. A hosted popup/redirect login (loginWithPopup /
     // completeLoginFromRedirect) establishes a session WITHOUT touching the provider
@@ -4761,13 +4798,28 @@ async function logout$1() {
     // mistake a local-only logout for server revocation.
     const sm = getActiveSessionManager();
     const refreshToken = sm.getRefreshToken();
+    const sessionIssuer = sm.getIssuer();
     if (refreshToken)
-        await revokeSession(refreshToken, (_a = sm.getIssuer()) !== null && _a !== void 0 ? _a : undefined);
+        await revokeSession(refreshToken, sessionIssuer !== null && sessionIssuer !== void 0 ? sessionIssuer : undefined);
+    // Hosted sessions ('email' covers the whole hosted surface: email OTP +
+    // social + the OIDC redirect/popup flows) are the ones with an issuer
+    // cookie; wallet and guest sessions have nothing hosted to end.
+    const wasHosted = (currentAuthMethod !== null && currentAuthMethod !== void 0 ? currentAuthMethod : getStoredAuthMethod()) === 'email';
     await currentAuthProvider.logout();
     setStoredAuthMethod(null);
     currentAuthProvider = null;
     currentAuthMethod = null;
     currentAuthProviderConfigKey = null;
+    if (wasHosted && !(options === null || options === void 0 ? void 0 : options.keepIssuerSession)) {
+        const issuerBase = sessionIssuer
+            || (await getConfig()).humanAuthApiUrl
+            || 'https://auth.bounded.sh';
+        const bounce = issuerLogoutBounceUrl(issuerBase);
+        // Local state is already cleared, so even if the navigation is stopped
+        // (tab close, extension) the app-side logout has fully happened.
+        if (bounce)
+            window.location.href = bounce;
+    }
 }
 
 /**
@@ -4897,11 +4949,11 @@ async function login(options) {
     setCurrentUser(loggedInUser);
     return currentUser;
 }
-async function logout() {
+async function logout(options) {
     if (!authProviderInstance) {
         throw new Error('SDK not initialized. Please call init() first.');
     }
-    await logout$1();
+    await logout$1(options);
     setCurrentUser(null);
 }
 var hasRunFirstTime = false;
@@ -5292,6 +5344,31 @@ async function decideGate(appId, runId, gateId, options) {
     const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, decision = __rest(options, ["intentKey", "idempotencyKey"]);
     return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/decision`, { method: 'POST', body: Object.assign(Object.assign({}, decision), { idempotencyKey }) });
 }
+async function refreshReviewCapability(appId, runId, gateId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'refreshReviewCapability()');
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability/refresh`, {
+        method: 'POST',
+        body: {
+            expectedGeneration: options.expectedGeneration,
+            expectedExpiresAtMs: options.expectedExpiresAtMs,
+            expectedRecoveryUntilMs: options.expectedRecoveryUntilMs,
+            expectedAudience: options.expectedAudience,
+            expectedReviewerBindingHash: options.expectedReviewerBindingHash,
+            idempotencyKey,
+        },
+    });
+}
+/**
+ * Read one exact delegated-review capability and its narrow lifecycle result.
+ * This does not refresh or extend the window and exposes no generic run-view
+ * authority.
+ */
+async function getReviewCapability(appId, runId, gateId, options) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability`, {
+        method: 'POST',
+        body: { expectedPreviewUrl: options.expectedPreviewUrl },
+    });
+}
 async function topup(appId, runId, options) {
     return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/topup`, { method: 'POST', body: options });
 }
@@ -5337,6 +5414,9 @@ const FAILURE_REASONS = [
     'bind_failed',
     'internal_error',
 ];
+const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
+const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
+const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
 
 const NORMAL_POLL_MS = 2000;
 const PARKED_POLL_MS = 5000;
@@ -5573,22 +5653,25 @@ function useBuildRun(appId, runId, options) {
 }
 
 /**
- * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
- * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
+ * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost), with
+ * one exact Drafted exception for delegated review/decision routes. Other
+ * generated-app origins remain blocked; server-side callers are unaffected.
  */
 const builds = {
     submit,
     get,
+    getReviewCapability,
     events,
     cancel,
     decideGate,
+    refreshReviewCapability,
     topup,
     list: list$1,
     watch,
 };
 
 async function create(options = {}) {
-    const body = Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.clientToken !== undefined ? { clientToken: options.clientToken } : {})), (options.intent !== undefined ? { intent: options.intent } : {}));
+    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.clientToken !== undefined ? { clientToken: options.clientToken } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
     const app = await requestDevApi('/apps/new', {
         method: 'POST',
         body,
@@ -6119,5 +6202,5 @@ function defaultInjectedEvmProvider() {
     return null;
 }
 
-export { loginWithPopup as A, completeLoginInPopup as B, useAuth as C, useQuery as D, EMBEDDED_WALLET_UNSUPPORTED as E, useBuildRun as F, apps as G, deserializeTransaction as H, getIdToken as I, setPlatform as J, requestEip6963Providers as K, builds as L, BuildsApiError as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, PARK_REASONS as Q, RUN_STATES as R, SURFNET_RPC_URL as S, TERMINAL_STATES as T, FAILURE_REASONS as U, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, defaultInjectedProvider as d, embeddedRunEvmTransaction as e, bufferExports as f, getPlatform as g, hasEmbeddedWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithRedirect as y, completeLoginFromRedirect as z };
-//# sourceMappingURL=index-BYy1tSkr.mjs.map
+export { loginWithPopup as A, completeLoginInPopup as B, useAuth as C, useQuery as D, EMBEDDED_WALLET_UNSUPPORTED as E, useBuildRun as F, apps as G, deserializeTransaction as H, getIdToken as I, setPlatform as J, requestEip6963Providers as K, builds as L, BuildsApiError as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, PARK_REASONS as Q, RUN_STATES as R, SURFNET_RPC_URL as S, TERMINAL_STATES as T, FAILURE_REASONS as U, BUILD_REVIEW_CAPABILITY_SCHEMA as V, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as W, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as X, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, defaultInjectedProvider as d, embeddedRunEvmTransaction as e, bufferExports as f, getPlatform as g, hasEmbeddedWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithRedirect as y, completeLoginFromRedirect as z };
+//# sourceMappingURL=index-BvUrIsky.mjs.map