@bounded-sh/client 0.0.55 → 0.0.57

package/dist/{index.native-aSo8M0A8.mjs → index-C7rOe6B2.mjs}

@@ -1,4 +1,4 @@
-import { assertCanonicalBoundedRuntimeWriteCalldata, getActiveSessionManager, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { assertCanonicalBoundedRuntimeWriteCalldata, getActiveSessionManager, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 /**
@@ -3454,7 +3454,7 @@ const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets —
 const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
     'the app policy so email logins get a non-custodial wallet (@user.address), ' +
     'then sign from a user gesture.';
-function hasDOM$1() {
+function hasDOM$4() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt$1(token) {
@@ -3503,7 +3503,7 @@ async function signerPageUrl() {
     const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
     return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
 }
-let requestSeq = 0;
+let requestSeq$1 = 0;
 /**
  * Open the Bounded signer popup, send `action` to it, and resolve with the
  * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
@@ -3514,7 +3514,7 @@ let requestSeq = 0;
  * wallet's owner, and validates that the wallet address matches the account.
  */
 async function signViaSignerPopup(action) {
-    if (!hasDOM$1()) {
+    if (!hasDOM$4()) {
         throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
     }
     const isEvm = action.kind === 'evmTransaction';
@@ -3522,7 +3522,7 @@ async function signViaSignerPopup(action) {
     if (!claims)
         throw new Error(NO_EMBEDDED_WALLET);
     const { url, origin: signerOrigin } = await signerPageUrl();
-    const requestId = `bsign_${Date.now()}_${++requestSeq}`;
+    const requestId = `bsign_${Date.now()}_${++requestSeq$1}`;
     // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
     const w = 420, h = 600;
     const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
@@ -3690,7 +3690,7 @@ const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = getActiveSessionManager;
-function hasDOM() {
+function hasDOM$3() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -3809,6 +3809,11 @@ function appendHostedLoginHints(params, opts) {
     const provider = normalizeMethod(opts.provider);
     if (provider)
         params.set('bounded_provider', provider);
+    // login_hint: an identifier (usually an email) to prefill on the hosted page.
+    // Kept short and free of control chars; the hosted page validates before use.
+    const hint = String(opts.loginHint || '').trim();
+    if (hint && hint.length <= 320 && !/[\s<>"']/.test(hint))
+        params.set('login_hint', hint);
     // Standard OIDC prompt (e.g. 'login' to force a fresh sign-in / account choice).
     const prompt = normalizeMethod(opts.prompt);
     if (prompt)
@@ -3825,7 +3830,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$3() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3933,7 +3938,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM())
+    if (!hasDOM$3())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3949,7 +3954,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM())
+    if (!hasDOM$3())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -3995,7 +4000,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM())
+    if (!hasDOM$3())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4135,7 +4140,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM() || !window.opener)
+    if (!hasDOM$3() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4151,6 +4156,34 @@ function completeLoginInPopup(openerOrigin) {
     }
     catch ( /* ignore */_b) { /* ignore */ }
 }
+// Establish a Bounded session from a server-minted inline-session response (the same
+// { idToken, accessToken, refreshToken } shape as /session/refresh). Used by the
+// Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
+// after Turnkey verifies the email OTP - there is no OIDC code to exchange. Wiring is
+// identical to exchangeCode's tail so the realtime worker cannot tell them apart.
+async function establishInlineSession(data) {
+    const base = await issuerBase();
+    const idToken = tokenField(data, 'id_token', 'idToken');
+    if (!idToken)
+        throw new Error('No id_token in the inline session response');
+    const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
+    const refreshToken = boundedRefreshTokenField(data);
+    const user = userFromIdToken(idToken);
+    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    try {
+        getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$1, 'email');
+    }
+    catch ( /* storage unavailable */_a) { /* storage unavailable */ }
+    setCurrentUser(user);
+    setAuthProviderInstance(oidcProviderSingleton);
+    return user;
+}
+// Auth base + appId for the Turnkey-native inline OTP endpoints, resolved through the
+// same config the OIDC flow uses.
+async function inlineAuthEndpoint() {
+    const cfg = await getConfig();
+    return { base: await issuerBase(), appId: cfg.appId };
+}
 async function exchangeCode(code, verifier, redirectUri) {
     const cfg = await getConfig();
     const base = await issuerBase();
@@ -4384,6 +4417,40 @@ function isWalletLoginEnabled(config) {
         return true;
     return false;
 }
+/**
+ * Whether the app explicitly turned the "connect wallet" lane OFF at init()
+ * (`walletLogin: false`). This is the hard opt-OUT the unified widget honors: it
+ * hides the wallet option entirely even when an injected wallet is detected and
+ * even if a per-call `openBoundedWidget({ wallet: true })` asked for it.
+ */
+function isWalletLoginDisabled(config) {
+    return config.walletLogin === false;
+}
+/**
+ * Site policy: the app requires an email on file for every user (`requireEmail:
+ * true`). Native wallet login carries no email, so the unified widget suppresses
+ * the wallet lane when this is set - email/social (which yields an email) remain.
+ * This lets a policy deny wallet-only accounts without touching per-call options.
+ */
+function isEmailRequired(config) {
+    return config.requireEmail === true;
+}
+/** The config passed to the last `init()`, or null before init. Read-only view
+ *  for runtime surfaces (e.g. the unified login widget) that need wallet/rpc
+ *  settings without re-plumbing them through every call. */
+function getInitConfig() {
+    return initConfig;
+}
+/**
+ * Which LOGIN mode the app runs (default "bounded"). "turnkey" opts the app into
+ * Turnkey-native email OTP: the unified widget runs the code entry INLINE (no OIDC
+ * popup) via startTurnkeyEmailLogin(), and Bounded mints the session from Turnkey's
+ * verification. The value comes from init() config (`authMode`); a `openBoundedWidget`
+ * option can override it per call. Anything other than "turnkey" is "bounded".
+ */
+function resolveAuthMode(config) {
+    return config.authMode === 'turnkey' ? 'turnkey' : 'bounded';
+}
 /**
  * Resolve the injected-wallet-config the provider should use, merging the
  * `walletLogin` object form (if the app passed one) over `injectedWalletConfig`.
@@ -4443,7 +4510,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-BKl9GgHV.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-Bmah1GWS.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4462,7 +4529,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CRG9TaA9.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CFnqSsHy.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4475,7 +4542,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-BgiFW_kf.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-DIWeWiAN.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4503,7 +4570,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-Dgs8zcnC.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-D6h4eAtx.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4559,7 +4626,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-Dgs8zcnC.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-D6h4eAtx.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4689,6 +4756,44 @@ async function loginWithPrivy(options) {
     const result = await provider.login();
     return result ? Object.assign(Object.assign({}, result), { provider }) : null;
 }
+/**
+ * Log in with an injected Solana WALLET (Phantom / Solflare / Backpack / any
+ * Wallet-Standard `window.solana`) as a co-equal RUNTIME route - selectable
+ * alongside `login()` / hosted `loginWithPopup()` / `signInAnonymously()` WITHOUT
+ * re-`init()`. This is the "Continue with wallet" choice the unified Bounded
+ * login widget offers: it NEVER touches Better Auth - the user's real wallet
+ * becomes `@user.address` and login is a SIWS signature.
+ *
+ * `getProvider` pins a specific discovered wallet (e.g. when the widget lists
+ * several); omit it to use Phantom-first discovery. Must be called from a user
+ * gesture so the wallet's connect prompt is allowed. `init()` must have run first.
+ */
+async function loginWithWallet(options) {
+    assertBrowserAuthEnv('loginWithWallet');
+    const coreConfig = await getConfig();
+    const cfg = initConfig !== null && initConfig !== void 0 ? initConfig : {};
+    const base = resolveInjectedWalletConfig(cfg);
+    const injectedConfig = (options === null || options === void 0 ? void 0 : options.getProvider)
+        ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
+    const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
+    const network = getConfiguredSolanaNetwork(cfg);
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-CFnqSsHy.mjs');
+    let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
+    if (coreConfig.chain === 'offchain')
+        provider = new OffchainAuthProvider(provider);
+    // The provider stores the session + user + auth-method marker itself on success.
+    const user = await provider.login();
+    if (!user)
+        return null;
+    currentAuthProvider = provider;
+    currentAuthMethod = 'phantom';
+    currentAuthProviderConfigKey = authProviderConfigKey(Object.assign(Object.assign({}, cfg), { authMethod: 'phantom' }));
+    coreConfig.authProvider = provider;
+    coreConfig.authMethod = 'phantom';
+    setAuthProviderInstance(provider);
+    setStoredAuthMethod('phantom');
+    return Object.assign(Object.assign({}, user), { provider });
+}
 async function login$1(options) {
     // Re-initialize provider if it was cleared by logout
     if (!currentAuthProvider && initConfig) {
@@ -4825,6 +4930,27 @@ async function logout$1(options) {
     }
 }
 
+var index = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    clearIncompatibleSession: clearIncompatibleSession,
+    completeLoginFromRedirect: completeLoginFromRedirect,
+    completeLoginInPopup: completeLoginInPopup,
+    getAuthProvider: getAuthProvider,
+    getCurrentAuthMethod: getCurrentAuthMethod,
+    getInitConfig: getInitConfig,
+    isEmailRequired: isEmailRequired,
+    isWalletLoginDisabled: isWalletLoginDisabled,
+    isWalletLoginEnabled: isWalletLoginEnabled,
+    login: login$1,
+    loginWithPopup: loginWithPopup,
+    loginWithPrivy: loginWithPrivy,
+    loginWithRedirect: loginWithRedirect,
+    loginWithWallet: loginWithWallet,
+    logout: logout$1,
+    resolveAuthMode: resolveAuthMode,
+    signInAnonymously: signInAnonymously
+});
+
 /**
  * Read the active session's idToken synchronously from whichever store is live
  * for this runtime (WebSessionManager on web, ReactNativeSessionManager on RN —
@@ -5003,17 +5129,1150 @@ function setAuthProviderInstance(provider) {
     authProviderInstance = provider;
 }
 
-var _a$1;
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because a WebAuthn passkey is bound to one origin).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$2() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
+}
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
+}
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
+    }
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
+    };
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
+    });
+    modal = m;
+    return m;
+}
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    window.setTimeout(() => {
+        m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+// True outer height of the mounted card: the max of its padding-box scroll height
+// (catches overflowing descendants) and its border-box height plus own vertical
+// margins (catches border + margins, which scrollHeight omits). Ceiled so a
+// sub-pixel row is never clipped under `overflow:hidden`.
+function measureOuterHeight(target) {
+    var _a;
+    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
+    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
+    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
+    const rect = target.getBoundingClientRect().height;
+    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
+}
+/**
+ * Measure the currently mounted native content and tween the panel to fit it.
+ * Re-fits automatically when the card's intrinsic height changes - notably after
+ * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
+ * after first paint) and on inline view swaps (email -> OTP code -> success).
+ */
+function fitPanelToContent(m) {
+    var _a, _b;
+    const first = m.content.firstElementChild;
+    const target = first || m.content;
+    const apply = () => {
+        // Only fit while this exact node is still the mounted card.
+        if (m.content.firstElementChild !== first && first)
+            return;
+        const h = measureOuterHeight(target);
+        if (h > 0)
+            setPanelHeight(m, h);
+    };
+    apply();
+    const view = target.ownerDocument.defaultView;
+    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
+    // have painted, so the height never lags a late reflow.
+    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
+    const fonts = target.ownerDocument.fonts;
+    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
+        fonts.ready.then(apply).catch(() => { });
+    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
+    m.fitObserver = null;
+    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
+        const ro = new view.ResizeObserver(() => apply());
+        ro.observe(first);
+        m.fitObserver = ro;
+    }
+}
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
+function mountContent(m, node) {
+    var _a;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.replaceChildren(node);
+    m.content.style.display = "block";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin) {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
+    // inside the frame from the user's click (transient activation stays in-frame).
+    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.onIframeMessage = null;
+}
+// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
+// JetBrains Mono) once at the document level so they apply inside the shadow root. A
+// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
+const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+function ensureFonts() {
+    if (!hasDOM$2())
+        return;
+    if (document.querySelector('link[data-bounded-fonts="1"]'))
+        return;
+    const pre1 = document.createElement("link");
+    pre1.rel = "preconnect";
+    pre1.href = "https://fonts.googleapis.com";
+    const pre2 = document.createElement("link");
+    pre2.rel = "preconnect";
+    pre2.href = "https://fonts.gstatic.com";
+    pre2.crossOrigin = "anonymous";
+    const link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = FONTS_HREF;
+    link.setAttribute("data-bounded-fonts", "1");
+    document.head.append(pre1, pre2, link);
+}
+
+var __classPrivateFieldGet = (undefined && undefined.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (undefined && undefined.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AppReadyEvent_detail;
+let wallets = undefined;
+const registeredWalletsSet = new Set();
+function addRegisteredWallet(wallet) {
+    cachedWalletsArray = undefined;
+    registeredWalletsSet.add(wallet);
+}
+function removeRegisteredWallet(wallet) {
+    cachedWalletsArray = undefined;
+    registeredWalletsSet.delete(wallet);
+}
+const listeners = {};
+/**
+ * Get an API for {@link Wallets.get | getting}, {@link Wallets.on | listening for}, and
+ * {@link Wallets.register | registering} {@link "@wallet-standard/base".Wallet | Wallets}.
+ *
+ * When called for the first time --
+ *
+ * This dispatches a {@link "@wallet-standard/base".WindowAppReadyEvent} to notify each Wallet that the app is ready
+ * to register it.
+ *
+ * This also adds a listener for {@link "@wallet-standard/base".WindowRegisterWalletEvent} to listen for a notification
+ * from each Wallet that the Wallet is ready to be registered by the app.
+ *
+ * This combination of event dispatch and listener guarantees that each Wallet will be registered synchronously as soon
+ * as the app is ready whether the app loads before or after each Wallet.
+ *
+ * @return API for getting, listening for, and registering Wallets.
+ *
+ * @group App
+ */
+function getWallets() {
+    if (wallets)
+        return wallets;
+    wallets = Object.freeze({ register, get: get$1, on });
+    if (typeof window === 'undefined')
+        return wallets;
+    const api = Object.freeze({ register });
+    try {
+        window.addEventListener('wallet-standard:register-wallet', ({ detail: callback }) => callback(api));
+    }
+    catch (error) {
+        console.error('wallet-standard:register-wallet event listener could not be added\n', error);
+    }
+    try {
+        window.dispatchEvent(new AppReadyEvent(api));
+    }
+    catch (error) {
+        console.error('wallet-standard:app-ready event could not be dispatched\n', error);
+    }
+    return wallets;
+}
+function register(...wallets) {
+    // Filter out wallets that have already been registered.
+    // This prevents the same wallet from being registered twice, but it also prevents wallets from being
+    // unregistered by reusing a reference to the wallet to obtain the unregister function for it.
+    wallets = wallets.filter((wallet) => !registeredWalletsSet.has(wallet));
+    // If there are no new wallets to register, just return a no-op unregister function.
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    if (!wallets.length)
+        return () => { };
+    wallets.forEach((wallet) => addRegisteredWallet(wallet));
+    listeners['register']?.forEach((listener) => guard(() => listener(...wallets)));
+    // Return a function that unregisters the registered wallets.
+    return function unregister() {
+        wallets.forEach((wallet) => removeRegisteredWallet(wallet));
+        listeners['unregister']?.forEach((listener) => guard(() => listener(...wallets)));
+    };
+}
+let cachedWalletsArray;
+function get$1() {
+    if (!cachedWalletsArray) {
+        cachedWalletsArray = [...registeredWalletsSet];
+    }
+    return cachedWalletsArray;
+}
+function on(event, listener) {
+    listeners[event]?.push(listener) || (listeners[event] = [listener]);
+    // Return a function that removes the event listener.
+    return function off() {
+        listeners[event] = listeners[event]?.filter((existingListener) => listener !== existingListener);
+    };
+}
+function guard(callback) {
+    try {
+        callback();
+    }
+    catch (error) {
+        console.error(error);
+    }
+}
+class AppReadyEvent extends Event {
+    get detail() {
+        return __classPrivateFieldGet(this, _AppReadyEvent_detail, "f");
+    }
+    get type() {
+        return 'wallet-standard:app-ready';
+    }
+    constructor(api) {
+        super('wallet-standard:app-ready', {
+            bubbles: false,
+            cancelable: false,
+            composed: false,
+        });
+        _AppReadyEvent_detail.set(this, void 0);
+        __classPrivateFieldSet(this, _AppReadyEvent_detail, api, "f");
+    }
+    /** @deprecated */
+    preventDefault() {
+        throw new Error('preventDefault cannot be called');
+    }
+    /** @deprecated */
+    stopImmediatePropagation() {
+        throw new Error('stopImmediatePropagation cannot be called');
+    }
+    /** @deprecated */
+    stopPropagation() {
+        throw new Error('stopPropagation cannot be called');
+    }
+}
+_AppReadyEvent_detail = new WeakMap();
+
+/** Name of the feature. */
+const SolanaSignAndSendTransaction = 'solana:signAndSendTransaction';
+
+/** Name of the feature. */
+const SolanaSignMessage = 'solana:signMessage';
+
+/** Name of the feature. */
+const SolanaSignTransaction = 'solana:signTransaction';
+
+/** Name of the feature. */
+const StandardConnect = 'standard:connect';
+
+/** Name of the feature. */
+const StandardDisconnect = 'standard:disconnect';
+
+// wallet-standard-discovery.ts - PROPER native-wallet enumeration for the unified
+// login widget. We do NOT hand-maintain a list of wallet names (Phantom / Solflare
+// / Backpack / ...); instead we read the Solana Wallet Standard registry
+// (`@wallet-standard/app` getWallets(), fed by each wallet's
+// `wallet-standard:register-wallet` event) and surface every wallet that advertises
+// the Solana features we need. New wallets appear automatically, with their real
+// name + icon, and nothing is hardcoded.
+//
+// Each discovered wallet is adapted to the SDK's tiny `InjectedSolanaProvider`
+// shape so the existing wallet-login path (loginWithWallet -> InjectedWalletProvider,
+// SIWS) and the full app signing surface work unchanged. web3.js is only imported
+// lazily inside the transaction methods, so listing wallets and message-signing
+// login stay off the heavy chunk.
+function hasFeature(wallet, name) {
+    return Object.prototype.hasOwnProperty.call(wallet.features, name);
+}
+function supportsSolana(wallet) {
+    return wallet.chains.some((c) => c.startsWith("solana:"));
+}
+/** A wallet is usable for Bounded login when it can connect + sign a SIWS message
+ *  on a Solana chain. Transaction features are optional and checked lazily at
+ *  call time, so a message-signing-only wallet still qualifies for login. */
+function isLoginCapable(wallet) {
+    return (supportsSolana(wallet) &&
+        hasFeature(wallet, StandardConnect) &&
+        hasFeature(wallet, SolanaSignMessage));
+}
+function feature(wallet, name) {
+    return wallet.features[name];
+}
+function firstSolanaChain(wallet, account) {
+    var _a;
+    const fromAccount = account.chains.find((c) => c.startsWith("solana:"));
+    const fromWallet = wallet.chains.find((c) => c.startsWith("solana:"));
+    return ((_a = fromAccount !== null && fromAccount !== void 0 ? fromAccount : fromWallet) !== null && _a !== void 0 ? _a : "solana:mainnet");
+}
+/**
+ * Adapt a Wallet Standard wallet to the slim `InjectedSolanaProvider` the SDK's
+ * wallet-login + signing path consumes. Connect resolves (and caches) the active
+ * account; sign* delegate to the wallet's own Solana features. Nothing is
+ * wallet-name specific.
+ */
+function standardWalletToInjectedProvider(wallet) {
+    let account = null;
+    const requireAccount = () => {
+        if (!account)
+            throw new Error("Wallet not connected");
+        return account;
+    };
+    return {
+        get isConnected() {
+            return account !== null;
+        },
+        get publicKey() {
+            // Wallet Standard account.address is already the base58 Solana address.
+            return account ? { toString: () => account.address } : null;
+        },
+        async connect() {
+            var _a;
+            const connect = feature(wallet, StandardConnect);
+            if (!connect)
+                throw new Error("Wallet does not support standard:connect");
+            const res = await connect.connect();
+            const acc = (_a = res.accounts.find((a) => a.chains.some((c) => c.startsWith("solana:")))) !== null && _a !== void 0 ? _a : res.accounts[0];
+            if (!acc)
+                throw new Error("Wallet returned no account on connect");
+            account = acc;
+            return { publicKey: { toString: () => acc.address } };
+        },
+        async disconnect() {
+            const disconnect = feature(wallet, StandardDisconnect);
+            if (disconnect)
+                await disconnect.disconnect();
+            account = null;
+        },
+        async signMessage(message) {
+            const acc = requireAccount();
+            const sign = feature(wallet, SolanaSignMessage);
+            if (!sign)
+                throw new Error("Wallet does not support solana:signMessage");
+            const [out] = await sign.signMessage({ account: acc, message });
+            return { signature: out.signature, publicKey: { toString: () => acc.address } };
+        },
+        async signTransaction(tx) {
+            const acc = requireAccount();
+            const sign = feature(wallet, SolanaSignTransaction);
+            if (!sign)
+                throw new Error("Wallet does not support solana:signTransaction");
+            const { serializeUnsignedTx, deserializeSignedTx } = await import('./wallet-standard-tx-DBliTUWH.mjs');
+            const [out] = await sign.signTransaction({ account: acc, transaction: serializeUnsignedTx(tx) });
+            return deserializeSignedTx(out.signedTransaction);
+        },
+        async signAllTransactions(txs) {
+            const acc = requireAccount();
+            const sign = feature(wallet, SolanaSignTransaction);
+            if (!sign)
+                throw new Error("Wallet does not support solana:signTransaction");
+            const { serializeUnsignedTx, deserializeSignedTx } = await import('./wallet-standard-tx-DBliTUWH.mjs');
+            const outs = await sign.signTransaction(...txs.map((tx) => ({ account: acc, transaction: serializeUnsignedTx(tx) })));
+            return outs.map((o) => deserializeSignedTx(o.signedTransaction));
+        },
+        async signAndSendTransaction(tx) {
+            const acc = requireAccount();
+            const sas = feature(wallet, SolanaSignAndSendTransaction);
+            if (!sas)
+                throw new Error("Wallet does not support solana:signAndSendTransaction");
+            const { serializeUnsignedTx } = await import('./wallet-standard-tx-DBliTUWH.mjs');
+            const [out] = await sas.signAndSendTransaction({
+                account: acc,
+                transaction: serializeUnsignedTx(tx),
+                chain: firstSolanaChain(wallet, acc),
+            });
+            return { signature: bs58.encode(out.signature) };
+        },
+    };
+}
+/**
+ * Enumerate every Solana-capable wallet currently registered with the Wallet
+ * Standard, newest registrations included. Returns login-ready choices (name +
+ * icon + provider factory). Empty array off-browser or when no wallet is present;
+ * the widget then falls back to the legacy injected `window.solana` probe.
+ */
+function discoverStandardWallets() {
+    if (typeof window === "undefined")
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const wallet of getWallets().get()) {
+        if (!isLoginCapable(wallet) || seen.has(wallet.name))
+            continue;
+        seen.add(wallet.name);
+        out.push({
+            name: wallet.name,
+            icon: wallet.icon,
+            getProvider: () => standardWalletToInjectedProvider(wallet),
+        });
+    }
+    return out;
+}
+
+function hasDOM$1() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+async function signerOrigin() {
+    const cfg = await getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+let encryptSeq = 0;
+// Seal the OTP in a HIDDEN, offscreen signer iframe on the Bounded origin. The signer page
+// runs the vendored @turnkey/crypto encryptOtpCodeToBundle (which verifies the enclave's
+// signature on the target bundle first). Origin + source + requestId are all pinned.
+function sealOtpInIframe(code, otpEncryptionTargetBundle) {
+    return new Promise((resolve, reject) => {
+        signerOrigin().then(({ url, origin }) => {
+            const requestId = `tkotp_${Date.now()}_${++encryptSeq}`;
+            const frame = document.createElement('iframe');
+            frame.setAttribute('aria-hidden', 'true');
+            frame.setAttribute('allow', 'publickey-credentials-get; publickey-credentials-create; clipboard-write');
+            frame.style.cssText =
+                'position:fixed;width:1px;height:1px;left:-9999px;top:-9999px;border:0;opacity:0;pointer-events:none';
+            let settled = false;
+            let timer;
+            const cleanup = () => {
+                settled = true;
+                window.removeEventListener('message', onMsg);
+                if (timer)
+                    clearTimeout(timer);
+                try {
+                    frame.remove();
+                }
+                catch ( /* already gone */_a) { /* already gone */ }
+            };
+            const onMsg = (event) => {
+                var _a;
+                if (event.origin !== origin || event.source !== frame.contentWindow)
+                    return;
+                const d = event.data;
+                if (!d || typeof d !== 'object')
+                    return;
+                if (d.type === 'bounded:turnkey:ready') {
+                    try {
+                        (_a = frame.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage({ type: 'bounded:turnkey:encryptOtp', requestId, otpCode: code, otpEncryptionTargetBundle }, origin);
+                    }
+                    catch ( /* frame gone */_b) { /* frame gone */ }
+                    return;
+                }
+                if (d.type === 'bounded:turnkey:result' && d.requestId === requestId) {
+                    if (d.ok && typeof d.encryptedOtpBundle === 'string' && d.encryptedOtpBundle) {
+                        const bundle = d.encryptedOtpBundle;
+                        cleanup();
+                        resolve(bundle);
+                    }
+                    else {
+                        cleanup();
+                        reject(new Error(String(d.error || 'Could not secure the code. Please try again.')));
+                    }
+                }
+            };
+            window.addEventListener('message', onMsg);
+            timer = setTimeout(() => {
+                if (!settled) {
+                    cleanup();
+                    reject(new Error('Securing the code timed out. Please try again.'));
+                }
+            }, 30000);
+            frame.src = url;
+            document.body.appendChild(frame);
+        }).catch(reject);
+    });
+}
+/**
+ * Begin authMode:"turnkey" login: ask Turnkey to email a one-time code to `email`.
+ * Resolves with a handle whose `verify(code)` finishes the login. Web-only (the sealing
+ * step needs the signer iframe); on React Native use loginWithRedirect() instead.
+ */
+async function startTurnkeyEmailLogin(email) {
+    if (!hasDOM$1()) {
+        throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
+    }
+    const trimmed = email.trim();
+    if (!trimmed)
+        throw new Error('Enter your email to continue.');
+    const { base, appId } = await inlineAuthEndpoint();
+    if (!appId)
+        throw new Error('appId is not configured (init the SDK with your appId)');
+    const res = await fetch(`${base}/wallet/turnkey/auth/init`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ email: trimmed, appId }),
+    });
+    const data = await res.json().catch(() => null);
+    if (!res.ok || !data || typeof data.otpId !== 'string' || typeof data.otpEncryptionTargetBundle !== 'string') {
+        throw new Error(String((data && data.error) || 'Could not send a code. Please try again.'));
+    }
+    const otpId = data.otpId;
+    const otpEncryptionTargetBundle = data.otpEncryptionTargetBundle;
+    return {
+        email: trimmed,
+        async verify(code) {
+            const trimmedCode = (code || '').trim();
+            if (!trimmedCode)
+                throw new Error('Enter the code from your email.');
+            const encryptedOtpBundle = await sealOtpInIframe(trimmedCode, otpEncryptionTargetBundle);
+            const vres = await fetch(`${base}/wallet/turnkey/auth/verify`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ email: trimmed, appId, otpId, encryptedOtpBundle }),
+            });
+            const vdata = await vres.json().catch(() => null);
+            if (!vres.ok || !vdata) {
+                throw new Error(String((vdata && vdata.error) || 'Invalid or expired code.'));
+            }
+            return establishInlineSession(vdata);
+        },
+    };
+}
+
+// bounded-login-widget.ts - the UNIFIED Bounded login surface: one in-app card
+// (Shadow-DOM modal from bounded-widget-modal.ts, Bounded look + motion) that folds
+// together every login lane the SDK supports:
+//   - Email / social (Google, ...) -> the hosted Better Auth OIDC flow, run in a
+//     brief FIRST-PARTY popup (loginWithPopup). A cross-origin auth IFRAME cannot
+//     hold the Better Auth session cookie (third-party-cookie blocking in Safari /
+//     Chrome), so the session handshake pops; the card itself stays in-app.
+//   - "Continue with wallet" -> native injected wallets (Phantom / Solflare /
+//     Backpack) via loginWithWallet(), run ENTIRELY on the app page (injected
+//     providers only exist there, never inside a cross-origin frame).
+//
+// Redirect stays available as the popup-blocked fallback (loginWithRedirect).
+// The same modal is reused for Turnkey passkey signing, so login -> first
+// signature is one continuous surface.
+// Palette + type ladder mirror the hosted auth page (login-page.ts): dark editorial
+// panel, Newsreader display serif for the title, Schibsted Grotesk body, a light
+// (paper) primary button and inset inputs. This is the same look/feel as
+// auth.bounded, brought inline into the in-app widget.
+const CARD_CSS = `
+:host,*{box-sizing:border-box}
+.c{--bg-inset:#060607;--bg-raise:#131416;
+  --line:rgba(232,230,222,.08);--line-strong:rgba(232,230,222,.16);
+  --text:#e8e6de;--dim:#9b9991;--faint:#85837c;
+  --green:#58c98f;--green-bg:rgba(88,201,143,.09);--green-line:rgba(88,201,143,.28);--red:#ec8488;
+  --disp:"Newsreader","Iowan Old Style",Georgia,serif;
+  --body:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif;
+  position:relative;padding:34px 32px 20px;color:var(--text);font-family:var(--body);
+  -webkit-font-smoothing:antialiased}
+.x{position:absolute;top:20px;right:24px;border:0;background:transparent;color:var(--faint);
+  font-family:var(--body);font-size:13px;line-height:1;cursor:pointer;padding:4px}
+.x:hover{color:var(--text)}
+h1{font-family:var(--disp);font-weight:400;font-size:27px;line-height:1.12;letter-spacing:-.01em;margin:0 0 6px;max-width:88%}
+.sub{margin:0 0 24px;color:var(--dim);font-size:13.5px}
+label{display:block;font-size:12px;color:var(--dim);margin:0 0 7px}
+input{width:100%;padding:11px 13px;border-radius:6px;border:1px solid var(--line-strong);
+  background:var(--bg-inset);color:var(--text);font-size:15px;font-family:var(--body);outline:none;
+  transition:border-color .15s,box-shadow .15s}
+input::placeholder{color:var(--faint)}
+input:focus{border-color:var(--green-line);box-shadow:0 0 0 3px var(--green-bg)}
+input.otp{font-family:var(--mono,ui-monospace,monospace);letter-spacing:8px;text-align:center;font-size:21px;padding-left:8px}
+.btn{width:100%;padding:12px 14px;border-radius:6px;font-size:14px;font-weight:600;
+  cursor:pointer;font-family:var(--body);display:flex;align-items:center;justify-content:center;gap:9px;
+  transition:opacity .15s ease,background .15s ease,border-color .15s ease,transform .04s}
+.btn:disabled{opacity:.45;cursor:default}
+.primary{border:0;background:var(--text);color:#0a0a0b;margin-top:16px}
+.primary:hover:not(:disabled){opacity:.9}
+.primary:active:not(:disabled){transform:translateY(.5px)}
+.ghost{border:1px solid var(--line-strong);background:var(--bg-raise);color:var(--text);margin-top:9px}
+.ghost:hover:not(:disabled){background:#17181b}
+.ghost svg{width:16px;height:16px;flex:none}
+.wicon{width:18px;height:18px;border-radius:4px;flex:none}
+.or{display:flex;align-items:center;gap:12px;margin:20px 0 14px;color:var(--faint);
+  font-size:11px;letter-spacing:.08em;text-transform:uppercase}
+.or::before,.or::after{content:"";flex:1;height:1px;background:var(--line)}
+.status{margin-top:16px;min-height:16px;font-size:12.5px;color:var(--dim)}
+.status.err{color:var(--red)}
+.foot{margin-top:24px;padding-top:15px;border-top:1px solid var(--line);
+  color:var(--faint);font-size:11px;text-align:center;letter-spacing:.02em}
+.foot a{color:var(--dim);text-decoration:none}
+.foot a:hover{color:var(--text)}
+.back{background:transparent;border:0;color:var(--dim);font-size:12.5px;cursor:pointer;padding:0;margin-bottom:16px}
+.back:hover{color:var(--text)}
+.spin{width:15px;height:15px;border-radius:50%;border:2px solid rgba(10,10,11,.3);
+  border-top-color:#0a0a0b;animation:bwspin .7s linear infinite}
+.ghost .spin,.primary.wallet-busy .spin{border:2px solid var(--line-strong);border-top-color:var(--text)}
+@keyframes bwspin{to{transform:rotate(360deg)}}
+`;
+// Brand glyphs, built as SVG DOM (never innerHTML) so the buttons match the hosted page.
+function googleGlyph() {
+    const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    svg.setAttribute("viewBox", "0 0 48 48");
+    svg.setAttribute("aria-hidden", "true");
+    const paths = [
+        ["#EA4335", "M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z"],
+        ["#4285F4", "M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z"],
+        ["#FBBC05", "M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z"],
+        ["#34A853", "M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z"],
+    ];
+    for (const [fill, d] of paths) {
+        const path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+        path.setAttribute("fill", fill);
+        path.setAttribute("d", d);
+        svg.appendChild(path);
+    }
+    return svg;
+}
+function walletGlyph() {
+    const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    svg.setAttribute("viewBox", "0 0 24 24");
+    svg.setAttribute("fill", "none");
+    svg.setAttribute("aria-hidden", "true");
+    const rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+    rect.setAttribute("x", "3");
+    rect.setAttribute("y", "6");
+    rect.setAttribute("width", "18");
+    rect.setAttribute("height", "13");
+    rect.setAttribute("rx", "2.5");
+    rect.setAttribute("stroke", "currentColor");
+    rect.setAttribute("stroke-width", "1.6");
+    const dot = document.createElementNS("http://www.w3.org/2000/svg", "circle");
+    dot.setAttribute("cx", "16.5");
+    dot.setAttribute("cy", "12.5");
+    dot.setAttribute("r", "1.4");
+    dot.setAttribute("fill", "currentColor");
+    svg.append(rect, dot);
+    return svg;
+}
+function isInjectedProvider(v) {
+    return (typeof v === "object" &&
+        v !== null &&
+        typeof v.signMessage === "function");
+}
+// Enumerate native wallets via the Solana Wallet Standard registry (NOT a
+// hardcoded name list) - every wallet that registered itself shows up with its
+// real name + icon. Only when the registry is empty (an older wallet that never
+// registers, exposing just `window.solana`) do we fall back to the injected probe.
+function discoverWallets() {
+    if (typeof window === "undefined")
+        return [];
+    const standard = discoverStandardWallets();
+    if (standard.length > 0) {
+        return standard.map((w) => ({ name: w.name, icon: w.icon, get: () => w.getProvider() }));
+    }
+    const generic = window.solana;
+    if (isInjectedProvider(generic))
+        return [{ name: "Wallet", get: () => generic }];
+    return [];
+}
+const METHOD_LABEL = {
+    google: "Continue with Google",
+    apple: "Continue with Apple",
+    github: "Continue with GitHub",
+};
+function el(tag, cls, text) {
+    const n = document.createElement(tag);
+    if (cls)
+        n.className = cls;
+    if (text != null)
+        n.textContent = text;
+    return n;
+}
+/**
+ * Open the unified Bounded login widget and resolve with the signed-in `User`.
+ * Rejects with `Error("cancelled")` if the user dismisses it. `init()` must have
+ * run first; call from a user gesture so social/wallet popups are allowed.
+ */
+async function openBoundedWidget(opts = {}) {
+    var _a, _b, _c, _d;
+    if (!hasDOM$2()) {
+        throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
+    }
+    // Imported lazily to avoid a static cycle with the auth index barrel.
+    const authApi = await Promise.resolve().then(function () { return index; });
+    const initCfg = (_a = authApi.getInitConfig()) !== null && _a !== void 0 ? _a : {};
+    const methods = ((_b = opts.methods) !== null && _b !== void 0 ? _b : ["email", "google"]).map(String);
+    const hasEmail = methods.includes("email") || methods.includes("text");
+    const social = methods.filter((m) => m !== "email" && m !== "text");
+    const wallets = discoverWallets();
+    // Policy first: an app whose site requires an email on file, or that explicitly
+    // set `walletLogin: false`, hides the wallet lane entirely - this OVERRIDES a
+    // per-call `opts.wallet` and any detected injected wallet.
+    const walletHardOff = authApi.isWalletLoginDisabled(initCfg) || authApi.isEmailRequired(initCfg);
+    const walletEnabled = walletHardOff
+        ? false
+        : ((_c = opts.wallet) !== null && _c !== void 0 ? _c : (wallets.length > 0 || authApi.isWalletLoginEnabled(initCfg)));
+    const authMode = (_d = opts.authMode) !== null && _d !== void 0 ? _d : authApi.resolveAuthMode(initCfg);
+    ensureFonts();
+    const m = getModal();
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const done = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onBackdrop = null;
+            fn();
+        };
+        const succeed = (u) => {
+            hideModal(m);
+            done(() => resolve(u));
+        };
+        const cancel = () => {
+            hideModal(m);
+            done(() => reject(new Error("cancelled")));
+        };
+        m.onBackdrop = cancel;
+        const style = el("style");
+        style.textContent = CARD_CSS;
+        const renderChoose = () => {
+            var _a, _b;
+            const card = el("div", "c");
+            card.appendChild(style.cloneNode(true));
+            const x = el("button", "x", "Close");
+            x.type = "button";
+            x.setAttribute("aria-label", "Close");
+            x.addEventListener("click", cancel);
+            card.appendChild(x);
+            card.appendChild(el("h1", undefined, (_a = opts.title) !== null && _a !== void 0 ? _a : "Sign in"));
+            if (opts.subtitle !== "") {
+                card.appendChild(el("p", "sub", (_b = opts.subtitle) !== null && _b !== void 0 ? _b : "One account and wallet across every Bounded app."));
+            }
+            const status = el("div", "status");
+            const setErr = (msg) => {
+                status.textContent = msg;
+                status.classList.add("err");
+            };
+            const setBusy = (btn, label) => {
+                status.classList.remove("err");
+                status.textContent = "";
+                btn.disabled = true;
+                btn.replaceChildren(el("span", "spin"), document.createTextNode(label));
+            };
+            if (hasEmail) {
+                const form = el("form");
+                const label = el("label");
+                label.htmlFor = "bw-email";
+                label.textContent = "Email";
+                const input = el("input");
+                input.id = "bw-email";
+                input.type = "email";
+                input.autocomplete = "email";
+                input.placeholder = "you@example.com";
+                input.required = true;
+                const submit = el("button", "btn primary");
+                submit.type = "submit";
+                submit.textContent = "Continue";
+                form.append(label, input, submit);
+                form.addEventListener("submit", (e) => {
+                    e.preventDefault();
+                    if (!input.value)
+                        return;
+                    if (authMode === "turnkey") {
+                        // Turnkey-native: ask Turnkey to email a code, then collect it INLINE.
+                        setBusy(submit, "Sending code\u2026");
+                        startTurnkeyEmailLogin(input.value)
+                            .then((handle) => swap(renderOtp(handle)))
+                            .catch((err) => {
+                            submit.disabled = false;
+                            submit.textContent = "Continue";
+                            setErr(errText(err));
+                        });
+                        return;
+                    }
+                    setBusy(submit, "Opening secure sign-in\u2026");
+                    authApi
+                        .loginWithPopup({
+                        provider: "email",
+                        loginHint: input.value,
+                        redirectUri: opts.redirectUri,
+                    })
+                        .then(succeed)
+                        .catch((err) => {
+                        submit.disabled = false;
+                        submit.textContent = "Continue";
+                        setErr(errText(err));
+                    });
+                });
+                card.appendChild(form);
+            }
+            if (social.length || walletEnabled) {
+                card.appendChild(el("div", "or", "OR"));
+            }
+            const labelFor = (method) => { var _a; return (_a = METHOD_LABEL[method]) !== null && _a !== void 0 ? _a : `Continue with ${cap(method)}`; };
+            const glyphFor = (method) => method === "google" ? googleGlyph() : null;
+            const setLabel = (b, method) => {
+                const glyph = glyphFor(method);
+                const text = document.createTextNode(labelFor(method));
+                if (glyph)
+                    b.replaceChildren(glyph, text);
+                else
+                    b.replaceChildren(text);
+            };
+            for (const method of social) {
+                const b = el("button", "btn ghost");
+                b.type = "button";
+                setLabel(b, method);
+                b.addEventListener("click", () => {
+                    setBusy(b, "Opening secure sign-in\u2026");
+                    authApi
+                        .loginWithPopup({ provider: method, redirectUri: opts.redirectUri })
+                        .then(succeed)
+                        .catch((err) => {
+                        b.disabled = false;
+                        setLabel(b, method);
+                        setErr(errText(err));
+                    });
+                });
+                card.appendChild(b);
+            }
+            if (walletEnabled) {
+                const b = el("button", "btn ghost");
+                b.type = "button";
+                const walletLabel = () => b.replaceChildren(walletGlyph(), document.createTextNode("Continue with wallet"));
+                walletLabel();
+                b.addEventListener("click", () => {
+                    if (wallets.length <= 1) {
+                        connectWallet(wallets[0]);
+                    }
+                    else {
+                        swap(renderWallets());
+                    }
+                });
+                card.appendChild(b);
+                const connectWallet = (choice) => {
+                    setBusy(b, "Approve in your wallet\u2026");
+                    authApi
+                        .loginWithWallet(choice ? { getProvider: choice.get } : undefined)
+                        .then((u) => {
+                        if (u)
+                            succeed(u);
+                        else {
+                            b.disabled = false;
+                            walletLabel();
+                            setErr("Wallet login was cancelled.");
+                        }
+                    })
+                        .catch((err) => {
+                        b.disabled = false;
+                        walletLabel();
+                        setErr(errText(err));
+                    });
+                };
+            }
+            card.appendChild(status);
+            const foot = el("div", "foot");
+            const poweredBy = el("a", undefined, "Powered by Bounded");
+            poweredBy.href = "https://bounded.sh";
+            poweredBy.target = "_blank";
+            poweredBy.rel = "noopener";
+            foot.appendChild(poweredBy);
+            card.appendChild(foot);
+            return card;
+        };
+        const renderWallets = () => {
+            const card = el("div", "c");
+            card.appendChild(style.cloneNode(true));
+            const back = el("button", "back", "\u2190 Back");
+            back.type = "button";
+            back.addEventListener("click", () => swap(renderChoose()));
+            card.appendChild(back);
+            card.appendChild(el("h1", undefined, "Connect a wallet"));
+            card.appendChild(el("p", "sub", "Choose your Solana wallet."));
+            const status = el("div", "status");
+            // Icon (the wallet's own, from the Wallet Standard registry) + name.
+            const setWalletLabel = (b, choice) => {
+                const text = document.createTextNode(choice.name);
+                if (choice.icon) {
+                    const img = el("img", "wicon");
+                    img.src = choice.icon;
+                    img.alt = "";
+                    b.replaceChildren(img, text);
+                }
+                else {
+                    b.replaceChildren(text);
+                }
+            };
+            for (const choice of wallets) {
+                const b = el("button", "btn ghost");
+                b.type = "button";
+                setWalletLabel(b, choice);
+                b.addEventListener("click", () => {
+                    status.classList.remove("err");
+                    b.disabled = true;
+                    b.replaceChildren(el("span", "spin"), document.createTextNode("Approve in your wallet\u2026"));
+                    authApi
+                        .loginWithWallet({ getProvider: choice.get })
+                        .then((u) => {
+                        if (u)
+                            succeed(u);
+                        else {
+                            b.disabled = false;
+                            setWalletLabel(b, choice);
+                        }
+                    })
+                        .catch((err) => {
+                        b.disabled = false;
+                        setWalletLabel(b, choice);
+                        status.textContent = errText(err);
+                        status.classList.add("err");
+                    });
+                });
+                card.appendChild(b);
+            }
+            card.appendChild(status);
+            return card;
+        };
+        // authMode:"turnkey" inline code entry. Same editorial card; the code is sealed
+        // on the Bounded signer origin and verified server-side by Turnkey.
+        const renderOtp = (handle) => {
+            const card = el("div", "c");
+            card.appendChild(style.cloneNode(true));
+            const back = el("button", "back", "\u2190 Back");
+            back.type = "button";
+            back.addEventListener("click", () => swap(renderChoose()));
+            card.appendChild(back);
+            card.appendChild(el("h1", undefined, "Enter your code"));
+            card.appendChild(el("p", "sub", `We sent a 6-digit code to ${handle.email}.`));
+            const status = el("div", "status");
+            const setErr = (msg) => { status.textContent = msg; status.classList.add("err"); };
+            const form = el("form");
+            const label = el("label");
+            label.htmlFor = "bw-otp";
+            label.textContent = "Verification code";
+            const input = el("input", "otp");
+            input.id = "bw-otp";
+            input.type = "text";
+            input.inputMode = "numeric";
+            input.autocomplete = "one-time-code";
+            input.maxLength = 6;
+            input.placeholder = "000000";
+            input.required = true;
+            const submit = el("button", "btn primary");
+            submit.type = "submit";
+            submit.textContent = "Verify";
+            form.append(label, input, submit);
+            const verify = () => {
+                const code = input.value.replace(/\D+/g, "");
+                if (code.length < 6) {
+                    setErr("Enter the 6-digit code.");
+                    return;
+                }
+                status.classList.remove("err");
+                status.textContent = "";
+                submit.disabled = true;
+                input.disabled = true;
+                submit.replaceChildren(el("span", "spin"), document.createTextNode("Verifying\u2026"));
+                handle
+                    .verify(code)
+                    .then(succeed)
+                    .catch((err) => {
+                    submit.disabled = false;
+                    input.disabled = false;
+                    submit.textContent = "Verify";
+                    input.value = "";
+                    input.focus();
+                    setErr(errText(err));
+                });
+            };
+            form.addEventListener("submit", (e) => { e.preventDefault(); verify(); });
+            // Auto-submit once six digits are in - the buttery one-shot paste/type path.
+            input.addEventListener("input", () => {
+                if (input.value.replace(/\D+/g, "").length === 6 && !submit.disabled)
+                    verify();
+            });
+            card.appendChild(form);
+            card.appendChild(status);
+            const foot = el("div", "foot");
+            const poweredBy = el("a", undefined, "Powered by Bounded");
+            poweredBy.href = "https://bounded.sh";
+            poweredBy.target = "_blank";
+            poweredBy.rel = "noopener";
+            foot.appendChild(poweredBy);
+            card.appendChild(foot);
+            requestAnimationFrame(() => input.focus());
+            return card;
+        };
+        const swap = (node) => {
+            mountContent(m, node);
+            requestAnimationFrame(() => fitPanelToContent(m));
+        };
+        swap(renderChoose());
+        showModal(m);
+    });
+}
+function cap(s) {
+    return s ? s[0].toUpperCase() + s.slice(1) : s;
+}
+function errText(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/blocked/i.test(msg))
+        return "Popup blocked - allow popups and try again.";
+    return msg || "Something went wrong. Try again.";
+}
+
+var _a$2;
 // Whether we're in a server-side rendering context (no hooks allowed).
 // React Native has no `window` but DOES support hooks.
 // We detect Node SSR specifically via process.versions.node to avoid
 // false positives from Node 21+ which defines `navigator` globally.
-const isSSR$1 = typeof window === 'undefined'
+const isSSR$2 = typeof window === 'undefined'
     && typeof process !== 'undefined'
-    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
+    && !!((_a$2 = process.versions) === null || _a$2 === void 0 ? void 0 : _a$2.node);
 function useAuth() {
     // Provide a fallback so server render doesn't break
-    if (isSSR$1) {
+    if (isSSR$2) {
         return {
             login: async (_options) => undefined,
             logout: async () => undefined,
@@ -5075,6 +6334,72 @@ function useAuth() {
     };
 }
 
+var _a$1;
+// SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
+// React Native has no `window` but DOES support hooks, so detect Node SSR
+// specifically via process.versions.node.
+const isSSR$1 = typeof window === 'undefined'
+    && typeof process !== 'undefined'
+    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
+function useQuery(path, options) {
+    if (isSSR$1) {
+        return { data: undefined, loading: true, error: null };
+    }
+    const [data, setData] = React.useState(undefined);
+    const [loading, setLoading] = React.useState(true);
+    const [error, setError] = React.useState(null);
+    // Re-subscribe only when the query actually changes (not on every render).
+    const optionsKey = options ? JSON.stringify(options) : '';
+    React.useEffect(() => {
+        if (!path) {
+            setData(undefined);
+            setLoading(false);
+            setError(null);
+            return;
+        }
+        let active = true;
+        let unsubscribe;
+        setLoading(true);
+        setError(null);
+        subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
+                if (!active)
+                    return;
+                // A reconnect can legitimately surface a transport error before the
+                // socket re-authenticates and sends a new authorized snapshot. That
+                // fresh snapshot is the recovery boundary: keep the error visible
+                // until data arrives, then clear it so React does not remain stuck on
+                // a failure page after realtime has recovered.
+                setError(null);
+                setData(d);
+                setLoading(false);
+            }, onError: (e) => {
+                if (!active)
+                    return;
+                setError(e instanceof Error ? e : new Error(String(e)));
+                setLoading(false);
+            } }))
+            .then((unsub) => {
+            if (active)
+                unsubscribe = unsub;
+            else
+                void unsub(); // unmounted before subscribe resolved
+        })
+            .catch((e) => {
+            if (!active)
+                return;
+            setError(e instanceof Error ? e : new Error(String(e)));
+            setLoading(false);
+        });
+        return () => {
+            active = false;
+            void (unsubscribe === null || unsubscribe === void 0 ? void 0 : unsubscribe());
+        };
+        // optionsKey captures the option object's contents; path is the other input.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [path, optionsKey]);
+    return { data, loading, error };
+}
+
 // Wrapper for getIdToken - passes isServer=false for client-side usage
 async function getIdToken() {
     return getIdToken$1(false);
@@ -5355,9 +6680,11 @@ const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
 const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
 const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
 
+const FAST_POLL_MS = 1000;
 const NORMAL_POLL_MS = 2000;
 const PARKED_POLL_MS = 5000;
 const LONG_RUNNING_POLL_MS = 10000;
+const THIRTY_SECONDS_MS = 30000;
 const TWO_MINUTES_MS = 2 * 60000;
 const TEN_MINUTES_MS = 10 * 60000;
 const terminalStates = new Set(TERMINAL_STATES);
@@ -5366,6 +6693,10 @@ function pollCadence(state, elapsedMs) {
         return LONG_RUNNING_POLL_MS;
     if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
         return PARKED_POLL_MS;
+    // The first 30s is where the user is staring at "waiting for a build slot" /
+    // "building" and every transition matters most; poll fast, then relax.
+    if (elapsedMs < THIRTY_SECONDS_MS)
+        return FAST_POLL_MS;
     return NORMAL_POLL_MS;
 }
 function retryCadence(error, state, elapsedMs) {
@@ -5451,9 +6782,18 @@ function watch(appId, runId, onUpdate, options = {}) {
     const poll = async () => {
         if (!active)
             return;
+        // Fire the view and the events page concurrently: the events cursor (lastSeq)
+        // does not depend on the run view, so there is no reason to pay two serial
+        // round-trips per tick. Error semantics below are unchanged — the run result
+        // still gates, and a failed events page still publishes the run with no rows.
+        const runPromise = get(appId, runId);
+        const eventsPromise = events(appId, runId, lastSeq);
+        // Keep the in-flight events page from becoming an unhandled rejection if the
+        // run result makes us bail before awaiting it; the real await below still sees it.
+        eventsPromise.catch(() => { });
         let run;
         try {
-            const view = await get(appId, runId);
+            const view = await runPromise;
             if (!active)
                 return;
             run = view.run;
@@ -5471,7 +6811,7 @@ function watch(appId, runId, onUpdate, options = {}) {
             return;
         }
         try {
-            const response = await events(appId, runId, lastSeq);
+            const response = await eventsPromise;
             if (!active)
                 return;
             const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
@@ -5680,6 +7020,302 @@ async function deserializeTransaction(tx) {
     }
 }
 
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app card plus
+// the OS Face ID / Touch ID sheet, never a jarring popup.
+//
+// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
+// MUST run on the single Bounded signer origin. The iframe carries the
+// publickey-credentials-{get,create} permission policy and the user's click lands
+// INSIDE it, giving WebAuthn the transient activation it needs.
+//
+// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
+// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
+// SAME request through `popupFallback` (a real window). Callers pass a popup
+// implementation and never see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
+ * (Safari cross-origin create) or cannot be mounted.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$2())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        let settled = false;
+        let usedFallback = false;
+        const iframe = ensureIframe(m, url, signerOrigin);
+        const send = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                m.iframeReady = true;
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
+                goFallback();
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
+// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
+// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
+//
+// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
+// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
+// look + motion, so signing feels native. Safari (unreliable at iframe passkey
+// CREATE) and any environment where the frame cannot mount fall back to a real
+// popup window; both transports speak the same postMessage protocol.
+//
+// Unlike the Crossmint bridge (crossmint-signer-bridge.ts), Turnkey wallets DO
+// produce raw detached signatures: the signer runs the Turnkey browser SDK on the
+// single Bounded origin, enrolls the user's passkey on first use (lazy - the
+// sub-org is created with the passkey + email attached at that moment), and stamps
+// an ed25519 signRawPayload with that passkey. So this bridge exposes a
+// `signSolanaMessage` primitive; the app builds + submits the transaction itself.
+//
+// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
+// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
+// every user one wallet + one passkey that roams across every app.
+function hasDOM() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
+// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
+// fail - and a post-failure popup would no longer have a user gesture to open with.
+// There we pick the popup up front, from the original click, so enrollment is solid.
+// Everywhere else the inline widget is used (buttery in-app modal).
+function preferPopup() {
+    if (!hasDOM() || typeof navigator === 'undefined')
+        return true;
+    const ua = navigator.userAgent || '';
+    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+}
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (Safari enrollment, or the frame never loads).
+async function deliver(url, origin, ex) {
+    const popup = () => runPopup(url, origin, ex);
+    if (preferPopup())
+        return popup();
+    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+}
+async function turnkeySignerPage() {
+    const cfg = await getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+function toHex(bytes) {
+    let h = '';
+    for (const b of bytes)
+        h += b.toString(16).padStart(2, '0');
+    return h;
+}
+function fromHex(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(clean.substr(i * 2, 2), 16);
+    return out;
+}
+let requestSeq = 0;
+// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
+// resolve when `onResult` accepts a result message. Origin + source are pinned.
+async function runPopup(url, signerOrigin, ex) {
+    var _a, _b;
+    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    if (!popup) {
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+    }
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let sentRequest = false;
+        let closeTimer;
+        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
+            clearInterval(closeTimer); };
+        const sendRequest = () => { if (sentRequest)
+            return; sentRequest = true; try {
+            popup.postMessage(ex.request, signerOrigin);
+        }
+        catch ( /* popup gone */_a) { /* popup gone */ } };
+        const onMsg = (event) => {
+            if (event.origin !== signerOrigin)
+                return;
+            if (event.source !== popup)
+                return;
+            const d = event.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:turnkey:ready') {
+                sendRequest();
+                return;
+            }
+            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
+                const outcome = ex.onResult(d);
+                if ('error' in outcome) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    reject(new Error(outcome.error));
+                    return;
+                }
+                if (outcome.done) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
+                    resolve(outcome.value);
+                }
+            }
+        };
+        window.addEventListener('message', onMsg);
+        setTimeout(sendRequest, 1200);
+        closeTimer = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(closeTimer);
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Wallet approval window was closed before it completed.'));
+                } }, 400);
+            }
+        }, 500);
+        setTimeout(() => { if (!settled) {
+            cleanup();
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+            reject(new Error('Wallet approval timed out.'));
+        } }, 5 * 60 * 1000);
+    });
+}
+/**
+ * Get-or-create the user's non-custodial Turnkey wallet, resolving with its stable
+ * Solana address. On first use the popup enrolls a device passkey (Face ID / Touch ID)
+ * and creates the wallet (lazy) with no email code; if the wallet already exists it
+ * resolves immediately without a prompt. Call from a USER GESTURE.
+ *
+ * Use this to learn the fee-payer address BEFORE building a transaction to sign.
+ */
+async function getOrCreateTurnkeyWallet() {
+    if (!hasDOM())
+        throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:createWallet', requestId },
+        onResult: (d) => {
+            if (d.ok && typeof d.address === 'string')
+                return { done: true, value: { address: d.address, subOrgId: String(d.subOrgId || '') } };
+            return { error: String(d.error || 'Wallet setup failed') };
+        },
+    });
+}
+/**
+ * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
+ * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
+ * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
+ * browser blocks the popup.
+ *
+ * On the user's FIRST signature the popup transparently enrolls a device passkey
+ * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
+ * signatures are just a passkey approval.
+ */
+async function signSolanaMessageViaTurnkey(message) {
+    if (!hasDOM()) {
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
+    const messageHex = toHex(message);
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
+        onResult: (d) => {
+            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
+            }
+            return { error: String(d.error || 'Turnkey signing failed') };
+        },
+    });
+}
+
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */
@@ -6063,5 +7699,90 @@ class PrivyExpoProvider {
     }
 }
 
-export { useAuth as A, useBuildRun as B, apps as C, deserializeTransaction as D, EMBEDDED_WALLET_UNSUPPORTED as E, getIdToken as F, setPlatform as G, builds as H, BuildsApiError as I, PARK_REASONS as J, FAILURE_REASONS as K, BUILD_REVIEW_CAPABILITY_SCHEMA as L, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as Q, RUN_STATES as R, TERMINAL_STATES as T, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, bufferExports as d, embeddedRunEvmTransaction as e, bs58 as f, getPlatform as g, hasEmbeddedWallet as h, confirmAndCheckTransaction as i, init as j, getCurrentUser as k, onAuthLoadingChanged as l, getAuthLoading as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, login as p, logout as q, resolveSolanaRpcUrl as r, setCurrentUser as s, getAuthProvider as t, signInAnonymously as u, loginWithPrivy as v, loginWithRedirect as w, completeLoginFromRedirect as x, loginWithPopup as y, completeLoginInPopup as z };
-//# sourceMappingURL=index.native-aSo8M0A8.mjs.map
+/**
+ * Default provider discovery: Phantom-first, then any Wallet-Standard
+ * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
+ * a user gesture and can be eagerly exported from the SDK entry.
+ */
+function defaultInjectedProvider() {
+    var _a;
+    if (typeof window === 'undefined')
+        return null;
+    const w = window;
+    const phantom = (_a = w === null || w === void 0 ? void 0 : w.phantom) === null || _a === void 0 ? void 0 : _a.solana;
+    if (phantom && typeof phantom.signMessage === 'function')
+        return phantom;
+    const generic = w === null || w === void 0 ? void 0 : w.solana;
+    if (generic && typeof generic.signMessage === 'function')
+        return generic;
+    return null;
+}
+
+// injected-evm-wallet-types.ts — tiny, dependency-free surface for the EVM
+// WALLET LOGIN path (BYO wallet via SIWE). The EVM twin of
+// injected-wallet-types.ts: kept separate from injected-evm-wallet-provider.ts
+// so the SDK entry can eagerly export the type surface + the provider-discovery
+// helper WITHOUT dragging the provider class into the default bundle. The
+// provider is lazy-loaded by getAuthProvider() when an app opts into
+// authMethod:'evm-wallet'.
+//
+// It rides the standard EIP-1193 injected provider a browser wallet exposes
+// (MetaMask / Rabby / Coinbase Wallet / any window.ethereum), discovered via
+// EIP-6963 (multi-wallet, collision-free) with a window.ethereum fallback. It
+// needs NO viem/ethers and NO React — EIP-1193 request() + hex strings suffice.
+// EIP-6963 is announcement-based: wallets add an `eip6963:requestProvider`
+// listener and synchronously dispatch `eip6963:announceProvider` in response. We
+// keep a persistent collector so announcements (including late ones) are
+// captured, and re-request on demand.
+const announcedProviders = [];
+let announceListenerAttached = false;
+function attachAnnounceListener() {
+    if (announceListenerAttached || typeof window === 'undefined')
+        return;
+    announceListenerAttached = true;
+    window.addEventListener('eip6963:announceProvider', (event) => {
+        const detail = event === null || event === void 0 ? void 0 : event.detail;
+        if (detail &&
+            detail.provider &&
+            typeof detail.provider.request === 'function' &&
+            !announcedProviders.some((d) => { var _a, _b; return ((_a = d.info) === null || _a === void 0 ? void 0 : _a.uuid) === ((_b = detail.info) === null || _b === void 0 ? void 0 : _b.uuid); })) {
+            announcedProviders.push(detail);
+        }
+    });
+}
+/**
+ * Request + collect EIP-6963 providers. Dispatches `eip6963:requestProvider`
+ * (synchronous — already-loaded wallets announce in the same tick) and returns
+ * every wallet announced so far. Kept synchronous so it works inside a user
+ * gesture and can be eagerly exported from the SDK entry.
+ */
+function requestEip6963Providers() {
+    if (typeof window === 'undefined')
+        return [];
+    attachAnnounceListener();
+    try {
+        window.dispatchEvent(new Event('eip6963:requestProvider'));
+    }
+    catch (_a) {
+        /* older browsers without Event constructor — fall through to window.ethereum */
+    }
+    return announcedProviders.slice();
+}
+/**
+ * Default EVM provider discovery: EIP-6963 first (multi-wallet, collision-free),
+ * then legacy `window.ethereum`. Returns null when no injected wallet is present.
+ */
+function defaultInjectedEvmProvider() {
+    if (typeof window === 'undefined')
+        return null;
+    const details = requestEip6963Providers();
+    if (details.length > 0)
+        return details[0].provider;
+    const eth = window.ethereum;
+    if (eth && typeof eth.request === 'function')
+        return eth;
+    return null;
+}
+
+export { BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as $, completeLoginFromRedirect as A, loginWithPopup as B, completeLoginInPopup as C, openBoundedWidget as D, EMBEDDED_WALLET_UNSUPPORTED as E, useAuth as F, useQuery as G, useBuildRun as H, apps as I, deserializeTransaction as J, signSolanaMessageViaTurnkey as K, getOrCreateTurnkeyWallet as L, startTurnkeyEmailLogin as M, getIdToken as N, setPlatform as O, OffchainAuthProvider as P, PrivyExpoProvider as Q, requestEip6963Providers as R, builds as S, BuildsApiError as T, NON_TERMINAL_STATES as U, TERMINAL_STATES as V, RUN_STATES as W, PARK_REASONS as X, FAILURE_REASONS as Y, BUILD_REVIEW_CAPABILITY_SCHEMA as Z, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as _, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, defaultInjectedProvider as d, embeddedRunEvmTransaction as e, bufferExports as f, getPlatform as g, hasEmbeddedWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithWallet as y, loginWithRedirect as z };
+//# sourceMappingURL=index-C7rOe6B2.mjs.map