@bounded-sh/client 0.0.55 → 0.0.57

package/dist/{index.native-CouprxZp.js → index-CnObYQhV.js}

@@ -3475,7 +3475,7 @@ const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets —
 const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
     'the app policy so email logins get a non-custodial wallet (@user.address), ' +
     'then sign from a user gesture.';
-function hasDOM$1() {
+function hasDOM$4() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt$1(token) {
@@ -3524,7 +3524,7 @@ async function signerPageUrl() {
     const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
     return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
 }
-let requestSeq = 0;
+let requestSeq$1 = 0;
 /**
  * Open the Bounded signer popup, send `action` to it, and resolve with the
  * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
@@ -3535,7 +3535,7 @@ let requestSeq = 0;
  * wallet's owner, and validates that the wallet address matches the account.
  */
 async function signViaSignerPopup(action) {
-    if (!hasDOM$1()) {
+    if (!hasDOM$4()) {
         throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
     }
     const isEvm = action.kind === 'evmTransaction';
@@ -3543,7 +3543,7 @@ async function signViaSignerPopup(action) {
     if (!claims)
         throw new Error(NO_EMBEDDED_WALLET);
     const { url, origin: signerOrigin } = await signerPageUrl();
-    const requestId = `bsign_${Date.now()}_${++requestSeq}`;
+    const requestId = `bsign_${Date.now()}_${++requestSeq$1}`;
     // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
     const w = 420, h = 600;
     const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
@@ -3711,7 +3711,7 @@ const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = core.getActiveSessionManager;
-function hasDOM() {
+function hasDOM$3() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -3830,6 +3830,11 @@ function appendHostedLoginHints(params, opts) {
     const provider = normalizeMethod(opts.provider);
     if (provider)
         params.set('bounded_provider', provider);
+    // login_hint: an identifier (usually an email) to prefill on the hosted page.
+    // Kept short and free of control chars; the hosted page validates before use.
+    const hint = String(opts.loginHint || '').trim();
+    if (hint && hint.length <= 320 && !/[\s<>"']/.test(hint))
+        params.set('login_hint', hint);
     // Standard OIDC prompt (e.g. 'login' to force a fresh sign-in / account choice).
     const prompt = normalizeMethod(opts.prompt);
     if (prompt)
@@ -3846,7 +3851,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$3() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3954,7 +3959,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM())
+    if (!hasDOM$3())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3970,7 +3975,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM())
+    if (!hasDOM$3())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4016,7 +4021,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM())
+    if (!hasDOM$3())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4156,7 +4161,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM() || !window.opener)
+    if (!hasDOM$3() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4172,6 +4177,34 @@ function completeLoginInPopup(openerOrigin) {
     }
     catch ( /* ignore */_b) { /* ignore */ }
 }
+// Establish a Bounded session from a server-minted inline-session response (the same
+// { idToken, accessToken, refreshToken } shape as /session/refresh). Used by the
+// Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
+// after Turnkey verifies the email OTP - there is no OIDC code to exchange. Wiring is
+// identical to exchangeCode's tail so the realtime worker cannot tell them apart.
+async function establishInlineSession(data) {
+    const base = await issuerBase();
+    const idToken = tokenField(data, 'id_token', 'idToken');
+    if (!idToken)
+        throw new Error('No id_token in the inline session response');
+    const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
+    const refreshToken = boundedRefreshTokenField(data);
+    const user = userFromIdToken(idToken);
+    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    try {
+        getPlatform().storage.setItem(STORED_AUTH_METHOD_KEY$1, 'email');
+    }
+    catch ( /* storage unavailable */_a) { /* storage unavailable */ }
+    setCurrentUser(user);
+    setAuthProviderInstance(oidcProviderSingleton);
+    return user;
+}
+// Auth base + appId for the Turnkey-native inline OTP endpoints, resolved through the
+// same config the OIDC flow uses.
+async function inlineAuthEndpoint() {
+    const cfg = await core.getConfig();
+    return { base: await issuerBase(), appId: cfg.appId };
+}
 async function exchangeCode(code, verifier, redirectUri) {
     const cfg = await core.getConfig();
     const base = await issuerBase();
@@ -4405,6 +4438,40 @@ function isWalletLoginEnabled(config) {
         return true;
     return false;
 }
+/**
+ * Whether the app explicitly turned the "connect wallet" lane OFF at init()
+ * (`walletLogin: false`). This is the hard opt-OUT the unified widget honors: it
+ * hides the wallet option entirely even when an injected wallet is detected and
+ * even if a per-call `openBoundedWidget({ wallet: true })` asked for it.
+ */
+function isWalletLoginDisabled(config) {
+    return config.walletLogin === false;
+}
+/**
+ * Site policy: the app requires an email on file for every user (`requireEmail:
+ * true`). Native wallet login carries no email, so the unified widget suppresses
+ * the wallet lane when this is set - email/social (which yields an email) remain.
+ * This lets a policy deny wallet-only accounts without touching per-call options.
+ */
+function isEmailRequired(config) {
+    return config.requireEmail === true;
+}
+/** The config passed to the last `init()`, or null before init. Read-only view
+ *  for runtime surfaces (e.g. the unified login widget) that need wallet/rpc
+ *  settings without re-plumbing them through every call. */
+function getInitConfig() {
+    return initConfig;
+}
+/**
+ * Which LOGIN mode the app runs (default "bounded"). "turnkey" opts the app into
+ * Turnkey-native email OTP: the unified widget runs the code entry INLINE (no OIDC
+ * popup) via startTurnkeyEmailLogin(), and Bounded mints the session from Turnkey's
+ * verification. The value comes from init() config (`authMode`); a `openBoundedWidget`
+ * option can override it per call. Anything other than "turnkey" is "bounded".
+ */
+function resolveAuthMode(config) {
+    return config.authMode === 'turnkey' ? 'turnkey' : 'bounded';
+}
 /**
  * Resolve the injected-wallet-config the provider should use, merging the
  * `walletLogin` object form (if the app passed one) over `injectedWalletConfig`.
@@ -4464,7 +4531,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-lVwM8vRR.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-8k8iBIQL.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4483,7 +4550,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CST-B9EE.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B_jQFifE.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4496,7 +4563,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CiCeS1n2.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-CcwS6p3o.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4524,7 +4591,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DhN9PoAi.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BjfjrpdW.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4580,7 +4647,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DhN9PoAi.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BjfjrpdW.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4710,6 +4777,44 @@ async function loginWithPrivy(options) {
     const result = await provider.login();
     return result ? Object.assign(Object.assign({}, result), { provider }) : null;
 }
+/**
+ * Log in with an injected Solana WALLET (Phantom / Solflare / Backpack / any
+ * Wallet-Standard `window.solana`) as a co-equal RUNTIME route - selectable
+ * alongside `login()` / hosted `loginWithPopup()` / `signInAnonymously()` WITHOUT
+ * re-`init()`. This is the "Continue with wallet" choice the unified Bounded
+ * login widget offers: it NEVER touches Better Auth - the user's real wallet
+ * becomes `@user.address` and login is a SIWS signature.
+ *
+ * `getProvider` pins a specific discovered wallet (e.g. when the widget lists
+ * several); omit it to use Phantom-first discovery. Must be called from a user
+ * gesture so the wallet's connect prompt is allowed. `init()` must have run first.
+ */
+async function loginWithWallet(options) {
+    assertBrowserAuthEnv('loginWithWallet');
+    const coreConfig = await core.getConfig();
+    const cfg = initConfig !== null && initConfig !== void 0 ? initConfig : {};
+    const base = resolveInjectedWalletConfig(cfg);
+    const injectedConfig = (options === null || options === void 0 ? void 0 : options.getProvider)
+        ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
+    const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
+    const network = getConfiguredSolanaNetwork(cfg);
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B_jQFifE.js'); });
+    let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
+    if (coreConfig.chain === 'offchain')
+        provider = new OffchainAuthProvider(provider);
+    // The provider stores the session + user + auth-method marker itself on success.
+    const user = await provider.login();
+    if (!user)
+        return null;
+    currentAuthProvider = provider;
+    currentAuthMethod = 'phantom';
+    currentAuthProviderConfigKey = authProviderConfigKey(Object.assign(Object.assign({}, cfg), { authMethod: 'phantom' }));
+    coreConfig.authProvider = provider;
+    coreConfig.authMethod = 'phantom';
+    setAuthProviderInstance(provider);
+    setStoredAuthMethod('phantom');
+    return Object.assign(Object.assign({}, user), { provider });
+}
 async function login$1(options) {
     // Re-initialize provider if it was cleared by logout
     if (!currentAuthProvider && initConfig) {
@@ -4846,6 +4951,27 @@ async function logout$1(options) {
     }
 }
 
+var index = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    clearIncompatibleSession: clearIncompatibleSession,
+    completeLoginFromRedirect: completeLoginFromRedirect,
+    completeLoginInPopup: completeLoginInPopup,
+    getAuthProvider: getAuthProvider,
+    getCurrentAuthMethod: getCurrentAuthMethod,
+    getInitConfig: getInitConfig,
+    isEmailRequired: isEmailRequired,
+    isWalletLoginDisabled: isWalletLoginDisabled,
+    isWalletLoginEnabled: isWalletLoginEnabled,
+    login: login$1,
+    loginWithPopup: loginWithPopup,
+    loginWithPrivy: loginWithPrivy,
+    loginWithRedirect: loginWithRedirect,
+    loginWithWallet: loginWithWallet,
+    logout: logout$1,
+    resolveAuthMode: resolveAuthMode,
+    signInAnonymously: signInAnonymously
+});
+
 /**
  * Read the active session's idToken synchronously from whichever store is live
  * for this runtime (WebSessionManager on web, ReactNativeSessionManager on RN —
@@ -5024,17 +5150,1150 @@ function setAuthProviderInstance(provider) {
     authProviderInstance = provider;
 }
 
-var _a$1;
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because a WebAuthn passkey is bound to one origin).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$2() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
+}
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
+}
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
+    }
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
+    };
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
+    });
+    modal = m;
+    return m;
+}
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    window.setTimeout(() => {
+        m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+// True outer height of the mounted card: the max of its padding-box scroll height
+// (catches overflowing descendants) and its border-box height plus own vertical
+// margins (catches border + margins, which scrollHeight omits). Ceiled so a
+// sub-pixel row is never clipped under `overflow:hidden`.
+function measureOuterHeight(target) {
+    var _a;
+    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
+    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
+    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
+    const rect = target.getBoundingClientRect().height;
+    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
+}
+/**
+ * Measure the currently mounted native content and tween the panel to fit it.
+ * Re-fits automatically when the card's intrinsic height changes - notably after
+ * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
+ * after first paint) and on inline view swaps (email -> OTP code -> success).
+ */
+function fitPanelToContent(m) {
+    var _a, _b;
+    const first = m.content.firstElementChild;
+    const target = first || m.content;
+    const apply = () => {
+        // Only fit while this exact node is still the mounted card.
+        if (m.content.firstElementChild !== first && first)
+            return;
+        const h = measureOuterHeight(target);
+        if (h > 0)
+            setPanelHeight(m, h);
+    };
+    apply();
+    const view = target.ownerDocument.defaultView;
+    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
+    // have painted, so the height never lags a late reflow.
+    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
+    const fonts = target.ownerDocument.fonts;
+    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
+        fonts.ready.then(apply).catch(() => { });
+    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
+    m.fitObserver = null;
+    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
+        const ro = new view.ResizeObserver(() => apply());
+        ro.observe(first);
+        m.fitObserver = ro;
+    }
+}
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
+function mountContent(m, node) {
+    var _a;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.replaceChildren(node);
+    m.content.style.display = "block";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin) {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
+    // inside the frame from the user's click (transient activation stays in-frame).
+    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.onIframeMessage = null;
+}
+// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
+// JetBrains Mono) once at the document level so they apply inside the shadow root. A
+// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
+const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+function ensureFonts() {
+    if (!hasDOM$2())
+        return;
+    if (document.querySelector('link[data-bounded-fonts="1"]'))
+        return;
+    const pre1 = document.createElement("link");
+    pre1.rel = "preconnect";
+    pre1.href = "https://fonts.googleapis.com";
+    const pre2 = document.createElement("link");
+    pre2.rel = "preconnect";
+    pre2.href = "https://fonts.gstatic.com";
+    pre2.crossOrigin = "anonymous";
+    const link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = FONTS_HREF;
+    link.setAttribute("data-bounded-fonts", "1");
+    document.head.append(pre1, pre2, link);
+}
+
+var __classPrivateFieldGet = (undefined && undefined.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (undefined && undefined.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AppReadyEvent_detail;
+let wallets = undefined;
+const registeredWalletsSet = new Set();
+function addRegisteredWallet(wallet) {
+    cachedWalletsArray = undefined;
+    registeredWalletsSet.add(wallet);
+}
+function removeRegisteredWallet(wallet) {
+    cachedWalletsArray = undefined;
+    registeredWalletsSet.delete(wallet);
+}
+const listeners = {};
+/**
+ * Get an API for {@link Wallets.get | getting}, {@link Wallets.on | listening for}, and
+ * {@link Wallets.register | registering} {@link "@wallet-standard/base".Wallet | Wallets}.
+ *
+ * When called for the first time --
+ *
+ * This dispatches a {@link "@wallet-standard/base".WindowAppReadyEvent} to notify each Wallet that the app is ready
+ * to register it.
+ *
+ * This also adds a listener for {@link "@wallet-standard/base".WindowRegisterWalletEvent} to listen for a notification
+ * from each Wallet that the Wallet is ready to be registered by the app.
+ *
+ * This combination of event dispatch and listener guarantees that each Wallet will be registered synchronously as soon
+ * as the app is ready whether the app loads before or after each Wallet.
+ *
+ * @return API for getting, listening for, and registering Wallets.
+ *
+ * @group App
+ */
+function getWallets() {
+    if (wallets)
+        return wallets;
+    wallets = Object.freeze({ register, get: get$1, on });
+    if (typeof window === 'undefined')
+        return wallets;
+    const api = Object.freeze({ register });
+    try {
+        window.addEventListener('wallet-standard:register-wallet', ({ detail: callback }) => callback(api));
+    }
+    catch (error) {
+        console.error('wallet-standard:register-wallet event listener could not be added\n', error);
+    }
+    try {
+        window.dispatchEvent(new AppReadyEvent(api));
+    }
+    catch (error) {
+        console.error('wallet-standard:app-ready event could not be dispatched\n', error);
+    }
+    return wallets;
+}
+function register(...wallets) {
+    // Filter out wallets that have already been registered.
+    // This prevents the same wallet from being registered twice, but it also prevents wallets from being
+    // unregistered by reusing a reference to the wallet to obtain the unregister function for it.
+    wallets = wallets.filter((wallet) => !registeredWalletsSet.has(wallet));
+    // If there are no new wallets to register, just return a no-op unregister function.
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    if (!wallets.length)
+        return () => { };
+    wallets.forEach((wallet) => addRegisteredWallet(wallet));
+    listeners['register']?.forEach((listener) => guard(() => listener(...wallets)));
+    // Return a function that unregisters the registered wallets.
+    return function unregister() {
+        wallets.forEach((wallet) => removeRegisteredWallet(wallet));
+        listeners['unregister']?.forEach((listener) => guard(() => listener(...wallets)));
+    };
+}
+let cachedWalletsArray;
+function get$1() {
+    if (!cachedWalletsArray) {
+        cachedWalletsArray = [...registeredWalletsSet];
+    }
+    return cachedWalletsArray;
+}
+function on(event, listener) {
+    listeners[event]?.push(listener) || (listeners[event] = [listener]);
+    // Return a function that removes the event listener.
+    return function off() {
+        listeners[event] = listeners[event]?.filter((existingListener) => listener !== existingListener);
+    };
+}
+function guard(callback) {
+    try {
+        callback();
+    }
+    catch (error) {
+        console.error(error);
+    }
+}
+class AppReadyEvent extends Event {
+    get detail() {
+        return __classPrivateFieldGet(this, _AppReadyEvent_detail, "f");
+    }
+    get type() {
+        return 'wallet-standard:app-ready';
+    }
+    constructor(api) {
+        super('wallet-standard:app-ready', {
+            bubbles: false,
+            cancelable: false,
+            composed: false,
+        });
+        _AppReadyEvent_detail.set(this, void 0);
+        __classPrivateFieldSet(this, _AppReadyEvent_detail, api, "f");
+    }
+    /** @deprecated */
+    preventDefault() {
+        throw new Error('preventDefault cannot be called');
+    }
+    /** @deprecated */
+    stopImmediatePropagation() {
+        throw new Error('stopImmediatePropagation cannot be called');
+    }
+    /** @deprecated */
+    stopPropagation() {
+        throw new Error('stopPropagation cannot be called');
+    }
+}
+_AppReadyEvent_detail = new WeakMap();
+
+/** Name of the feature. */
+const SolanaSignAndSendTransaction = 'solana:signAndSendTransaction';
+
+/** Name of the feature. */
+const SolanaSignMessage = 'solana:signMessage';
+
+/** Name of the feature. */
+const SolanaSignTransaction = 'solana:signTransaction';
+
+/** Name of the feature. */
+const StandardConnect = 'standard:connect';
+
+/** Name of the feature. */
+const StandardDisconnect = 'standard:disconnect';
+
+// wallet-standard-discovery.ts - PROPER native-wallet enumeration for the unified
+// login widget. We do NOT hand-maintain a list of wallet names (Phantom / Solflare
+// / Backpack / ...); instead we read the Solana Wallet Standard registry
+// (`@wallet-standard/app` getWallets(), fed by each wallet's
+// `wallet-standard:register-wallet` event) and surface every wallet that advertises
+// the Solana features we need. New wallets appear automatically, with their real
+// name + icon, and nothing is hardcoded.
+//
+// Each discovered wallet is adapted to the SDK's tiny `InjectedSolanaProvider`
+// shape so the existing wallet-login path (loginWithWallet -> InjectedWalletProvider,
+// SIWS) and the full app signing surface work unchanged. web3.js is only imported
+// lazily inside the transaction methods, so listing wallets and message-signing
+// login stay off the heavy chunk.
+function hasFeature(wallet, name) {
+    return Object.prototype.hasOwnProperty.call(wallet.features, name);
+}
+function supportsSolana(wallet) {
+    return wallet.chains.some((c) => c.startsWith("solana:"));
+}
+/** A wallet is usable for Bounded login when it can connect + sign a SIWS message
+ *  on a Solana chain. Transaction features are optional and checked lazily at
+ *  call time, so a message-signing-only wallet still qualifies for login. */
+function isLoginCapable(wallet) {
+    return (supportsSolana(wallet) &&
+        hasFeature(wallet, StandardConnect) &&
+        hasFeature(wallet, SolanaSignMessage));
+}
+function feature(wallet, name) {
+    return wallet.features[name];
+}
+function firstSolanaChain(wallet, account) {
+    var _a;
+    const fromAccount = account.chains.find((c) => c.startsWith("solana:"));
+    const fromWallet = wallet.chains.find((c) => c.startsWith("solana:"));
+    return ((_a = fromAccount !== null && fromAccount !== void 0 ? fromAccount : fromWallet) !== null && _a !== void 0 ? _a : "solana:mainnet");
+}
+/**
+ * Adapt a Wallet Standard wallet to the slim `InjectedSolanaProvider` the SDK's
+ * wallet-login + signing path consumes. Connect resolves (and caches) the active
+ * account; sign* delegate to the wallet's own Solana features. Nothing is
+ * wallet-name specific.
+ */
+function standardWalletToInjectedProvider(wallet) {
+    let account = null;
+    const requireAccount = () => {
+        if (!account)
+            throw new Error("Wallet not connected");
+        return account;
+    };
+    return {
+        get isConnected() {
+            return account !== null;
+        },
+        get publicKey() {
+            // Wallet Standard account.address is already the base58 Solana address.
+            return account ? { toString: () => account.address } : null;
+        },
+        async connect() {
+            var _a;
+            const connect = feature(wallet, StandardConnect);
+            if (!connect)
+                throw new Error("Wallet does not support standard:connect");
+            const res = await connect.connect();
+            const acc = (_a = res.accounts.find((a) => a.chains.some((c) => c.startsWith("solana:")))) !== null && _a !== void 0 ? _a : res.accounts[0];
+            if (!acc)
+                throw new Error("Wallet returned no account on connect");
+            account = acc;
+            return { publicKey: { toString: () => acc.address } };
+        },
+        async disconnect() {
+            const disconnect = feature(wallet, StandardDisconnect);
+            if (disconnect)
+                await disconnect.disconnect();
+            account = null;
+        },
+        async signMessage(message) {
+            const acc = requireAccount();
+            const sign = feature(wallet, SolanaSignMessage);
+            if (!sign)
+                throw new Error("Wallet does not support solana:signMessage");
+            const [out] = await sign.signMessage({ account: acc, message });
+            return { signature: out.signature, publicKey: { toString: () => acc.address } };
+        },
+        async signTransaction(tx) {
+            const acc = requireAccount();
+            const sign = feature(wallet, SolanaSignTransaction);
+            if (!sign)
+                throw new Error("Wallet does not support solana:signTransaction");
+            const { serializeUnsignedTx, deserializeSignedTx } = await Promise.resolve().then(function () { return require('./wallet-standard-tx-C1HJFLjC.js'); });
+            const [out] = await sign.signTransaction({ account: acc, transaction: serializeUnsignedTx(tx) });
+            return deserializeSignedTx(out.signedTransaction);
+        },
+        async signAllTransactions(txs) {
+            const acc = requireAccount();
+            const sign = feature(wallet, SolanaSignTransaction);
+            if (!sign)
+                throw new Error("Wallet does not support solana:signTransaction");
+            const { serializeUnsignedTx, deserializeSignedTx } = await Promise.resolve().then(function () { return require('./wallet-standard-tx-C1HJFLjC.js'); });
+            const outs = await sign.signTransaction(...txs.map((tx) => ({ account: acc, transaction: serializeUnsignedTx(tx) })));
+            return outs.map((o) => deserializeSignedTx(o.signedTransaction));
+        },
+        async signAndSendTransaction(tx) {
+            const acc = requireAccount();
+            const sas = feature(wallet, SolanaSignAndSendTransaction);
+            if (!sas)
+                throw new Error("Wallet does not support solana:signAndSendTransaction");
+            const { serializeUnsignedTx } = await Promise.resolve().then(function () { return require('./wallet-standard-tx-C1HJFLjC.js'); });
+            const [out] = await sas.signAndSendTransaction({
+                account: acc,
+                transaction: serializeUnsignedTx(tx),
+                chain: firstSolanaChain(wallet, acc),
+            });
+            return { signature: bs58.encode(out.signature) };
+        },
+    };
+}
+/**
+ * Enumerate every Solana-capable wallet currently registered with the Wallet
+ * Standard, newest registrations included. Returns login-ready choices (name +
+ * icon + provider factory). Empty array off-browser or when no wallet is present;
+ * the widget then falls back to the legacy injected `window.solana` probe.
+ */
+function discoverStandardWallets() {
+    if (typeof window === "undefined")
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const wallet of getWallets().get()) {
+        if (!isLoginCapable(wallet) || seen.has(wallet.name))
+            continue;
+        seen.add(wallet.name);
+        out.push({
+            name: wallet.name,
+            icon: wallet.icon,
+            getProvider: () => standardWalletToInjectedProvider(wallet),
+        });
+    }
+    return out;
+}
+
+function hasDOM$1() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+async function signerOrigin() {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+let encryptSeq = 0;
+// Seal the OTP in a HIDDEN, offscreen signer iframe on the Bounded origin. The signer page
+// runs the vendored @turnkey/crypto encryptOtpCodeToBundle (which verifies the enclave's
+// signature on the target bundle first). Origin + source + requestId are all pinned.
+function sealOtpInIframe(code, otpEncryptionTargetBundle) {
+    return new Promise((resolve, reject) => {
+        signerOrigin().then(({ url, origin }) => {
+            const requestId = `tkotp_${Date.now()}_${++encryptSeq}`;
+            const frame = document.createElement('iframe');
+            frame.setAttribute('aria-hidden', 'true');
+            frame.setAttribute('allow', 'publickey-credentials-get; publickey-credentials-create; clipboard-write');
+            frame.style.cssText =
+                'position:fixed;width:1px;height:1px;left:-9999px;top:-9999px;border:0;opacity:0;pointer-events:none';
+            let settled = false;
+            let timer;
+            const cleanup = () => {
+                settled = true;
+                window.removeEventListener('message', onMsg);
+                if (timer)
+                    clearTimeout(timer);
+                try {
+                    frame.remove();
+                }
+                catch ( /* already gone */_a) { /* already gone */ }
+            };
+            const onMsg = (event) => {
+                var _a;
+                if (event.origin !== origin || event.source !== frame.contentWindow)
+                    return;
+                const d = event.data;
+                if (!d || typeof d !== 'object')
+                    return;
+                if (d.type === 'bounded:turnkey:ready') {
+                    try {
+                        (_a = frame.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage({ type: 'bounded:turnkey:encryptOtp', requestId, otpCode: code, otpEncryptionTargetBundle }, origin);
+                    }
+                    catch ( /* frame gone */_b) { /* frame gone */ }
+                    return;
+                }
+                if (d.type === 'bounded:turnkey:result' && d.requestId === requestId) {
+                    if (d.ok && typeof d.encryptedOtpBundle === 'string' && d.encryptedOtpBundle) {
+                        const bundle = d.encryptedOtpBundle;
+                        cleanup();
+                        resolve(bundle);
+                    }
+                    else {
+                        cleanup();
+                        reject(new Error(String(d.error || 'Could not secure the code. Please try again.')));
+                    }
+                }
+            };
+            window.addEventListener('message', onMsg);
+            timer = setTimeout(() => {
+                if (!settled) {
+                    cleanup();
+                    reject(new Error('Securing the code timed out. Please try again.'));
+                }
+            }, 30000);
+            frame.src = url;
+            document.body.appendChild(frame);
+        }).catch(reject);
+    });
+}
+/**
+ * Begin authMode:"turnkey" login: ask Turnkey to email a one-time code to `email`.
+ * Resolves with a handle whose `verify(code)` finishes the login. Web-only (the sealing
+ * step needs the signer iframe); on React Native use loginWithRedirect() instead.
+ */
+async function startTurnkeyEmailLogin(email) {
+    if (!hasDOM$1()) {
+        throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
+    }
+    const trimmed = email.trim();
+    if (!trimmed)
+        throw new Error('Enter your email to continue.');
+    const { base, appId } = await inlineAuthEndpoint();
+    if (!appId)
+        throw new Error('appId is not configured (init the SDK with your appId)');
+    const res = await fetch(`${base}/wallet/turnkey/auth/init`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ email: trimmed, appId }),
+    });
+    const data = await res.json().catch(() => null);
+    if (!res.ok || !data || typeof data.otpId !== 'string' || typeof data.otpEncryptionTargetBundle !== 'string') {
+        throw new Error(String((data && data.error) || 'Could not send a code. Please try again.'));
+    }
+    const otpId = data.otpId;
+    const otpEncryptionTargetBundle = data.otpEncryptionTargetBundle;
+    return {
+        email: trimmed,
+        async verify(code) {
+            const trimmedCode = (code || '').trim();
+            if (!trimmedCode)
+                throw new Error('Enter the code from your email.');
+            const encryptedOtpBundle = await sealOtpInIframe(trimmedCode, otpEncryptionTargetBundle);
+            const vres = await fetch(`${base}/wallet/turnkey/auth/verify`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ email: trimmed, appId, otpId, encryptedOtpBundle }),
+            });
+            const vdata = await vres.json().catch(() => null);
+            if (!vres.ok || !vdata) {
+                throw new Error(String((vdata && vdata.error) || 'Invalid or expired code.'));
+            }
+            return establishInlineSession(vdata);
+        },
+    };
+}
+
+// bounded-login-widget.ts - the UNIFIED Bounded login surface: one in-app card
+// (Shadow-DOM modal from bounded-widget-modal.ts, Bounded look + motion) that folds
+// together every login lane the SDK supports:
+//   - Email / social (Google, ...) -> the hosted Better Auth OIDC flow, run in a
+//     brief FIRST-PARTY popup (loginWithPopup). A cross-origin auth IFRAME cannot
+//     hold the Better Auth session cookie (third-party-cookie blocking in Safari /
+//     Chrome), so the session handshake pops; the card itself stays in-app.
+//   - "Continue with wallet" -> native injected wallets (Phantom / Solflare /
+//     Backpack) via loginWithWallet(), run ENTIRELY on the app page (injected
+//     providers only exist there, never inside a cross-origin frame).
+//
+// Redirect stays available as the popup-blocked fallback (loginWithRedirect).
+// The same modal is reused for Turnkey passkey signing, so login -> first
+// signature is one continuous surface.
+// Palette + type ladder mirror the hosted auth page (login-page.ts): dark editorial
+// panel, Newsreader display serif for the title, Schibsted Grotesk body, a light
+// (paper) primary button and inset inputs. This is the same look/feel as
+// auth.bounded, brought inline into the in-app widget.
+const CARD_CSS = `
+:host,*{box-sizing:border-box}
+.c{--bg-inset:#060607;--bg-raise:#131416;
+  --line:rgba(232,230,222,.08);--line-strong:rgba(232,230,222,.16);
+  --text:#e8e6de;--dim:#9b9991;--faint:#85837c;
+  --green:#58c98f;--green-bg:rgba(88,201,143,.09);--green-line:rgba(88,201,143,.28);--red:#ec8488;
+  --disp:"Newsreader","Iowan Old Style",Georgia,serif;
+  --body:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif;
+  position:relative;padding:34px 32px 20px;color:var(--text);font-family:var(--body);
+  -webkit-font-smoothing:antialiased}
+.x{position:absolute;top:20px;right:24px;border:0;background:transparent;color:var(--faint);
+  font-family:var(--body);font-size:13px;line-height:1;cursor:pointer;padding:4px}
+.x:hover{color:var(--text)}
+h1{font-family:var(--disp);font-weight:400;font-size:27px;line-height:1.12;letter-spacing:-.01em;margin:0 0 6px;max-width:88%}
+.sub{margin:0 0 24px;color:var(--dim);font-size:13.5px}
+label{display:block;font-size:12px;color:var(--dim);margin:0 0 7px}
+input{width:100%;padding:11px 13px;border-radius:6px;border:1px solid var(--line-strong);
+  background:var(--bg-inset);color:var(--text);font-size:15px;font-family:var(--body);outline:none;
+  transition:border-color .15s,box-shadow .15s}
+input::placeholder{color:var(--faint)}
+input:focus{border-color:var(--green-line);box-shadow:0 0 0 3px var(--green-bg)}
+input.otp{font-family:var(--mono,ui-monospace,monospace);letter-spacing:8px;text-align:center;font-size:21px;padding-left:8px}
+.btn{width:100%;padding:12px 14px;border-radius:6px;font-size:14px;font-weight:600;
+  cursor:pointer;font-family:var(--body);display:flex;align-items:center;justify-content:center;gap:9px;
+  transition:opacity .15s ease,background .15s ease,border-color .15s ease,transform .04s}
+.btn:disabled{opacity:.45;cursor:default}
+.primary{border:0;background:var(--text);color:#0a0a0b;margin-top:16px}
+.primary:hover:not(:disabled){opacity:.9}
+.primary:active:not(:disabled){transform:translateY(.5px)}
+.ghost{border:1px solid var(--line-strong);background:var(--bg-raise);color:var(--text);margin-top:9px}
+.ghost:hover:not(:disabled){background:#17181b}
+.ghost svg{width:16px;height:16px;flex:none}
+.wicon{width:18px;height:18px;border-radius:4px;flex:none}
+.or{display:flex;align-items:center;gap:12px;margin:20px 0 14px;color:var(--faint);
+  font-size:11px;letter-spacing:.08em;text-transform:uppercase}
+.or::before,.or::after{content:"";flex:1;height:1px;background:var(--line)}
+.status{margin-top:16px;min-height:16px;font-size:12.5px;color:var(--dim)}
+.status.err{color:var(--red)}
+.foot{margin-top:24px;padding-top:15px;border-top:1px solid var(--line);
+  color:var(--faint);font-size:11px;text-align:center;letter-spacing:.02em}
+.foot a{color:var(--dim);text-decoration:none}
+.foot a:hover{color:var(--text)}
+.back{background:transparent;border:0;color:var(--dim);font-size:12.5px;cursor:pointer;padding:0;margin-bottom:16px}
+.back:hover{color:var(--text)}
+.spin{width:15px;height:15px;border-radius:50%;border:2px solid rgba(10,10,11,.3);
+  border-top-color:#0a0a0b;animation:bwspin .7s linear infinite}
+.ghost .spin,.primary.wallet-busy .spin{border:2px solid var(--line-strong);border-top-color:var(--text)}
+@keyframes bwspin{to{transform:rotate(360deg)}}
+`;
+// Brand glyphs, built as SVG DOM (never innerHTML) so the buttons match the hosted page.
+function googleGlyph() {
+    const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    svg.setAttribute("viewBox", "0 0 48 48");
+    svg.setAttribute("aria-hidden", "true");
+    const paths = [
+        ["#EA4335", "M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z"],
+        ["#4285F4", "M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z"],
+        ["#FBBC05", "M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z"],
+        ["#34A853", "M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z"],
+    ];
+    for (const [fill, d] of paths) {
+        const path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+        path.setAttribute("fill", fill);
+        path.setAttribute("d", d);
+        svg.appendChild(path);
+    }
+    return svg;
+}
+function walletGlyph() {
+    const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    svg.setAttribute("viewBox", "0 0 24 24");
+    svg.setAttribute("fill", "none");
+    svg.setAttribute("aria-hidden", "true");
+    const rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+    rect.setAttribute("x", "3");
+    rect.setAttribute("y", "6");
+    rect.setAttribute("width", "18");
+    rect.setAttribute("height", "13");
+    rect.setAttribute("rx", "2.5");
+    rect.setAttribute("stroke", "currentColor");
+    rect.setAttribute("stroke-width", "1.6");
+    const dot = document.createElementNS("http://www.w3.org/2000/svg", "circle");
+    dot.setAttribute("cx", "16.5");
+    dot.setAttribute("cy", "12.5");
+    dot.setAttribute("r", "1.4");
+    dot.setAttribute("fill", "currentColor");
+    svg.append(rect, dot);
+    return svg;
+}
+function isInjectedProvider(v) {
+    return (typeof v === "object" &&
+        v !== null &&
+        typeof v.signMessage === "function");
+}
+// Enumerate native wallets via the Solana Wallet Standard registry (NOT a
+// hardcoded name list) - every wallet that registered itself shows up with its
+// real name + icon. Only when the registry is empty (an older wallet that never
+// registers, exposing just `window.solana`) do we fall back to the injected probe.
+function discoverWallets() {
+    if (typeof window === "undefined")
+        return [];
+    const standard = discoverStandardWallets();
+    if (standard.length > 0) {
+        return standard.map((w) => ({ name: w.name, icon: w.icon, get: () => w.getProvider() }));
+    }
+    const generic = window.solana;
+    if (isInjectedProvider(generic))
+        return [{ name: "Wallet", get: () => generic }];
+    return [];
+}
+const METHOD_LABEL = {
+    google: "Continue with Google",
+    apple: "Continue with Apple",
+    github: "Continue with GitHub",
+};
+function el(tag, cls, text) {
+    const n = document.createElement(tag);
+    if (cls)
+        n.className = cls;
+    if (text != null)
+        n.textContent = text;
+    return n;
+}
+/**
+ * Open the unified Bounded login widget and resolve with the signed-in `User`.
+ * Rejects with `Error("cancelled")` if the user dismisses it. `init()` must have
+ * run first; call from a user gesture so social/wallet popups are allowed.
+ */
+async function openBoundedWidget(opts = {}) {
+    var _a, _b, _c, _d;
+    if (!hasDOM$2()) {
+        throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
+    }
+    // Imported lazily to avoid a static cycle with the auth index barrel.
+    const authApi = await Promise.resolve().then(function () { return index; });
+    const initCfg = (_a = authApi.getInitConfig()) !== null && _a !== void 0 ? _a : {};
+    const methods = ((_b = opts.methods) !== null && _b !== void 0 ? _b : ["email", "google"]).map(String);
+    const hasEmail = methods.includes("email") || methods.includes("text");
+    const social = methods.filter((m) => m !== "email" && m !== "text");
+    const wallets = discoverWallets();
+    // Policy first: an app whose site requires an email on file, or that explicitly
+    // set `walletLogin: false`, hides the wallet lane entirely - this OVERRIDES a
+    // per-call `opts.wallet` and any detected injected wallet.
+    const walletHardOff = authApi.isWalletLoginDisabled(initCfg) || authApi.isEmailRequired(initCfg);
+    const walletEnabled = walletHardOff
+        ? false
+        : ((_c = opts.wallet) !== null && _c !== void 0 ? _c : (wallets.length > 0 || authApi.isWalletLoginEnabled(initCfg)));
+    const authMode = (_d = opts.authMode) !== null && _d !== void 0 ? _d : authApi.resolveAuthMode(initCfg);
+    ensureFonts();
+    const m = getModal();
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const done = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onBackdrop = null;
+            fn();
+        };
+        const succeed = (u) => {
+            hideModal(m);
+            done(() => resolve(u));
+        };
+        const cancel = () => {
+            hideModal(m);
+            done(() => reject(new Error("cancelled")));
+        };
+        m.onBackdrop = cancel;
+        const style = el("style");
+        style.textContent = CARD_CSS;
+        const renderChoose = () => {
+            var _a, _b;
+            const card = el("div", "c");
+            card.appendChild(style.cloneNode(true));
+            const x = el("button", "x", "Close");
+            x.type = "button";
+            x.setAttribute("aria-label", "Close");
+            x.addEventListener("click", cancel);
+            card.appendChild(x);
+            card.appendChild(el("h1", undefined, (_a = opts.title) !== null && _a !== void 0 ? _a : "Sign in"));
+            if (opts.subtitle !== "") {
+                card.appendChild(el("p", "sub", (_b = opts.subtitle) !== null && _b !== void 0 ? _b : "One account and wallet across every Bounded app."));
+            }
+            const status = el("div", "status");
+            const setErr = (msg) => {
+                status.textContent = msg;
+                status.classList.add("err");
+            };
+            const setBusy = (btn, label) => {
+                status.classList.remove("err");
+                status.textContent = "";
+                btn.disabled = true;
+                btn.replaceChildren(el("span", "spin"), document.createTextNode(label));
+            };
+            if (hasEmail) {
+                const form = el("form");
+                const label = el("label");
+                label.htmlFor = "bw-email";
+                label.textContent = "Email";
+                const input = el("input");
+                input.id = "bw-email";
+                input.type = "email";
+                input.autocomplete = "email";
+                input.placeholder = "you@example.com";
+                input.required = true;
+                const submit = el("button", "btn primary");
+                submit.type = "submit";
+                submit.textContent = "Continue";
+                form.append(label, input, submit);
+                form.addEventListener("submit", (e) => {
+                    e.preventDefault();
+                    if (!input.value)
+                        return;
+                    if (authMode === "turnkey") {
+                        // Turnkey-native: ask Turnkey to email a code, then collect it INLINE.
+                        setBusy(submit, "Sending code\u2026");
+                        startTurnkeyEmailLogin(input.value)
+                            .then((handle) => swap(renderOtp(handle)))
+                            .catch((err) => {
+                            submit.disabled = false;
+                            submit.textContent = "Continue";
+                            setErr(errText(err));
+                        });
+                        return;
+                    }
+                    setBusy(submit, "Opening secure sign-in\u2026");
+                    authApi
+                        .loginWithPopup({
+                        provider: "email",
+                        loginHint: input.value,
+                        redirectUri: opts.redirectUri,
+                    })
+                        .then(succeed)
+                        .catch((err) => {
+                        submit.disabled = false;
+                        submit.textContent = "Continue";
+                        setErr(errText(err));
+                    });
+                });
+                card.appendChild(form);
+            }
+            if (social.length || walletEnabled) {
+                card.appendChild(el("div", "or", "OR"));
+            }
+            const labelFor = (method) => { var _a; return (_a = METHOD_LABEL[method]) !== null && _a !== void 0 ? _a : `Continue with ${cap(method)}`; };
+            const glyphFor = (method) => method === "google" ? googleGlyph() : null;
+            const setLabel = (b, method) => {
+                const glyph = glyphFor(method);
+                const text = document.createTextNode(labelFor(method));
+                if (glyph)
+                    b.replaceChildren(glyph, text);
+                else
+                    b.replaceChildren(text);
+            };
+            for (const method of social) {
+                const b = el("button", "btn ghost");
+                b.type = "button";
+                setLabel(b, method);
+                b.addEventListener("click", () => {
+                    setBusy(b, "Opening secure sign-in\u2026");
+                    authApi
+                        .loginWithPopup({ provider: method, redirectUri: opts.redirectUri })
+                        .then(succeed)
+                        .catch((err) => {
+                        b.disabled = false;
+                        setLabel(b, method);
+                        setErr(errText(err));
+                    });
+                });
+                card.appendChild(b);
+            }
+            if (walletEnabled) {
+                const b = el("button", "btn ghost");
+                b.type = "button";
+                const walletLabel = () => b.replaceChildren(walletGlyph(), document.createTextNode("Continue with wallet"));
+                walletLabel();
+                b.addEventListener("click", () => {
+                    if (wallets.length <= 1) {
+                        connectWallet(wallets[0]);
+                    }
+                    else {
+                        swap(renderWallets());
+                    }
+                });
+                card.appendChild(b);
+                const connectWallet = (choice) => {
+                    setBusy(b, "Approve in your wallet\u2026");
+                    authApi
+                        .loginWithWallet(choice ? { getProvider: choice.get } : undefined)
+                        .then((u) => {
+                        if (u)
+                            succeed(u);
+                        else {
+                            b.disabled = false;
+                            walletLabel();
+                            setErr("Wallet login was cancelled.");
+                        }
+                    })
+                        .catch((err) => {
+                        b.disabled = false;
+                        walletLabel();
+                        setErr(errText(err));
+                    });
+                };
+            }
+            card.appendChild(status);
+            const foot = el("div", "foot");
+            const poweredBy = el("a", undefined, "Powered by Bounded");
+            poweredBy.href = "https://bounded.sh";
+            poweredBy.target = "_blank";
+            poweredBy.rel = "noopener";
+            foot.appendChild(poweredBy);
+            card.appendChild(foot);
+            return card;
+        };
+        const renderWallets = () => {
+            const card = el("div", "c");
+            card.appendChild(style.cloneNode(true));
+            const back = el("button", "back", "\u2190 Back");
+            back.type = "button";
+            back.addEventListener("click", () => swap(renderChoose()));
+            card.appendChild(back);
+            card.appendChild(el("h1", undefined, "Connect a wallet"));
+            card.appendChild(el("p", "sub", "Choose your Solana wallet."));
+            const status = el("div", "status");
+            // Icon (the wallet's own, from the Wallet Standard registry) + name.
+            const setWalletLabel = (b, choice) => {
+                const text = document.createTextNode(choice.name);
+                if (choice.icon) {
+                    const img = el("img", "wicon");
+                    img.src = choice.icon;
+                    img.alt = "";
+                    b.replaceChildren(img, text);
+                }
+                else {
+                    b.replaceChildren(text);
+                }
+            };
+            for (const choice of wallets) {
+                const b = el("button", "btn ghost");
+                b.type = "button";
+                setWalletLabel(b, choice);
+                b.addEventListener("click", () => {
+                    status.classList.remove("err");
+                    b.disabled = true;
+                    b.replaceChildren(el("span", "spin"), document.createTextNode("Approve in your wallet\u2026"));
+                    authApi
+                        .loginWithWallet({ getProvider: choice.get })
+                        .then((u) => {
+                        if (u)
+                            succeed(u);
+                        else {
+                            b.disabled = false;
+                            setWalletLabel(b, choice);
+                        }
+                    })
+                        .catch((err) => {
+                        b.disabled = false;
+                        setWalletLabel(b, choice);
+                        status.textContent = errText(err);
+                        status.classList.add("err");
+                    });
+                });
+                card.appendChild(b);
+            }
+            card.appendChild(status);
+            return card;
+        };
+        // authMode:"turnkey" inline code entry. Same editorial card; the code is sealed
+        // on the Bounded signer origin and verified server-side by Turnkey.
+        const renderOtp = (handle) => {
+            const card = el("div", "c");
+            card.appendChild(style.cloneNode(true));
+            const back = el("button", "back", "\u2190 Back");
+            back.type = "button";
+            back.addEventListener("click", () => swap(renderChoose()));
+            card.appendChild(back);
+            card.appendChild(el("h1", undefined, "Enter your code"));
+            card.appendChild(el("p", "sub", `We sent a 6-digit code to ${handle.email}.`));
+            const status = el("div", "status");
+            const setErr = (msg) => { status.textContent = msg; status.classList.add("err"); };
+            const form = el("form");
+            const label = el("label");
+            label.htmlFor = "bw-otp";
+            label.textContent = "Verification code";
+            const input = el("input", "otp");
+            input.id = "bw-otp";
+            input.type = "text";
+            input.inputMode = "numeric";
+            input.autocomplete = "one-time-code";
+            input.maxLength = 6;
+            input.placeholder = "000000";
+            input.required = true;
+            const submit = el("button", "btn primary");
+            submit.type = "submit";
+            submit.textContent = "Verify";
+            form.append(label, input, submit);
+            const verify = () => {
+                const code = input.value.replace(/\D+/g, "");
+                if (code.length < 6) {
+                    setErr("Enter the 6-digit code.");
+                    return;
+                }
+                status.classList.remove("err");
+                status.textContent = "";
+                submit.disabled = true;
+                input.disabled = true;
+                submit.replaceChildren(el("span", "spin"), document.createTextNode("Verifying\u2026"));
+                handle
+                    .verify(code)
+                    .then(succeed)
+                    .catch((err) => {
+                    submit.disabled = false;
+                    input.disabled = false;
+                    submit.textContent = "Verify";
+                    input.value = "";
+                    input.focus();
+                    setErr(errText(err));
+                });
+            };
+            form.addEventListener("submit", (e) => { e.preventDefault(); verify(); });
+            // Auto-submit once six digits are in - the buttery one-shot paste/type path.
+            input.addEventListener("input", () => {
+                if (input.value.replace(/\D+/g, "").length === 6 && !submit.disabled)
+                    verify();
+            });
+            card.appendChild(form);
+            card.appendChild(status);
+            const foot = el("div", "foot");
+            const poweredBy = el("a", undefined, "Powered by Bounded");
+            poweredBy.href = "https://bounded.sh";
+            poweredBy.target = "_blank";
+            poweredBy.rel = "noopener";
+            foot.appendChild(poweredBy);
+            card.appendChild(foot);
+            requestAnimationFrame(() => input.focus());
+            return card;
+        };
+        const swap = (node) => {
+            mountContent(m, node);
+            requestAnimationFrame(() => fitPanelToContent(m));
+        };
+        swap(renderChoose());
+        showModal(m);
+    });
+}
+function cap(s) {
+    return s ? s[0].toUpperCase() + s.slice(1) : s;
+}
+function errText(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/blocked/i.test(msg))
+        return "Popup blocked - allow popups and try again.";
+    return msg || "Something went wrong. Try again.";
+}
+
+var _a$2;
 // Whether we're in a server-side rendering context (no hooks allowed).
 // React Native has no `window` but DOES support hooks.
 // We detect Node SSR specifically via process.versions.node to avoid
 // false positives from Node 21+ which defines `navigator` globally.
-const isSSR$1 = typeof window === 'undefined'
+const isSSR$2 = typeof window === 'undefined'
     && typeof process !== 'undefined'
-    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
+    && !!((_a$2 = process.versions) === null || _a$2 === void 0 ? void 0 : _a$2.node);
 function useAuth() {
     // Provide a fallback so server render doesn't break
-    if (isSSR$1) {
+    if (isSSR$2) {
         return {
             login: async (_options) => undefined,
             logout: async () => undefined,
@@ -5096,6 +6355,72 @@ function useAuth() {
     };
 }
 
+var _a$1;
+// SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
+// React Native has no `window` but DOES support hooks, so detect Node SSR
+// specifically via process.versions.node.
+const isSSR$1 = typeof window === 'undefined'
+    && typeof process !== 'undefined'
+    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
+function useQuery(path, options) {
+    if (isSSR$1) {
+        return { data: undefined, loading: true, error: null };
+    }
+    const [data, setData] = React__namespace.useState(undefined);
+    const [loading, setLoading] = React__namespace.useState(true);
+    const [error, setError] = React__namespace.useState(null);
+    // Re-subscribe only when the query actually changes (not on every render).
+    const optionsKey = options ? JSON.stringify(options) : '';
+    React__namespace.useEffect(() => {
+        if (!path) {
+            setData(undefined);
+            setLoading(false);
+            setError(null);
+            return;
+        }
+        let active = true;
+        let unsubscribe;
+        setLoading(true);
+        setError(null);
+        core.subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
+                if (!active)
+                    return;
+                // A reconnect can legitimately surface a transport error before the
+                // socket re-authenticates and sends a new authorized snapshot. That
+                // fresh snapshot is the recovery boundary: keep the error visible
+                // until data arrives, then clear it so React does not remain stuck on
+                // a failure page after realtime has recovered.
+                setError(null);
+                setData(d);
+                setLoading(false);
+            }, onError: (e) => {
+                if (!active)
+                    return;
+                setError(e instanceof Error ? e : new Error(String(e)));
+                setLoading(false);
+            } }))
+            .then((unsub) => {
+            if (active)
+                unsubscribe = unsub;
+            else
+                void unsub(); // unmounted before subscribe resolved
+        })
+            .catch((e) => {
+            if (!active)
+                return;
+            setError(e instanceof Error ? e : new Error(String(e)));
+            setLoading(false);
+        });
+        return () => {
+            active = false;
+            void (unsubscribe === null || unsubscribe === void 0 ? void 0 : unsubscribe());
+        };
+        // optionsKey captures the option object's contents; path is the other input.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [path, optionsKey]);
+    return { data, loading, error };
+}
+
 // Wrapper for getIdToken - passes isServer=false for client-side usage
 async function getIdToken() {
     return core.getIdToken(false);
@@ -5376,9 +6701,11 @@ const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
 const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
 const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
 
+const FAST_POLL_MS = 1000;
 const NORMAL_POLL_MS = 2000;
 const PARKED_POLL_MS = 5000;
 const LONG_RUNNING_POLL_MS = 10000;
+const THIRTY_SECONDS_MS = 30000;
 const TWO_MINUTES_MS = 2 * 60000;
 const TEN_MINUTES_MS = 10 * 60000;
 const terminalStates = new Set(TERMINAL_STATES);
@@ -5387,6 +6714,10 @@ function pollCadence(state, elapsedMs) {
         return LONG_RUNNING_POLL_MS;
     if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
         return PARKED_POLL_MS;
+    // The first 30s is where the user is staring at "waiting for a build slot" /
+    // "building" and every transition matters most; poll fast, then relax.
+    if (elapsedMs < THIRTY_SECONDS_MS)
+        return FAST_POLL_MS;
     return NORMAL_POLL_MS;
 }
 function retryCadence(error, state, elapsedMs) {
@@ -5472,9 +6803,18 @@ function watch(appId, runId, onUpdate, options = {}) {
     const poll = async () => {
         if (!active)
             return;
+        // Fire the view and the events page concurrently: the events cursor (lastSeq)
+        // does not depend on the run view, so there is no reason to pay two serial
+        // round-trips per tick. Error semantics below are unchanged — the run result
+        // still gates, and a failed events page still publishes the run with no rows.
+        const runPromise = get(appId, runId);
+        const eventsPromise = events(appId, runId, lastSeq);
+        // Keep the in-flight events page from becoming an unhandled rejection if the
+        // run result makes us bail before awaiting it; the real await below still sees it.
+        eventsPromise.catch(() => { });
         let run;
         try {
-            const view = await get(appId, runId);
+            const view = await runPromise;
             if (!active)
                 return;
             run = view.run;
@@ -5492,7 +6832,7 @@ function watch(appId, runId, onUpdate, options = {}) {
             return;
         }
         try {
-            const response = await events(appId, runId, lastSeq);
+            const response = await eventsPromise;
             if (!active)
                 return;
             const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
@@ -5701,6 +7041,302 @@ async function deserializeTransaction(tx) {
     }
 }
 
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app card plus
+// the OS Face ID / Touch ID sheet, never a jarring popup.
+//
+// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
+// MUST run on the single Bounded signer origin. The iframe carries the
+// publickey-credentials-{get,create} permission policy and the user's click lands
+// INSIDE it, giving WebAuthn the transient activation it needs.
+//
+// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
+// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
+// SAME request through `popupFallback` (a real window). Callers pass a popup
+// implementation and never see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
+ * (Safari cross-origin create) or cannot be mounted.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$2())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        let settled = false;
+        let usedFallback = false;
+        const iframe = ensureIframe(m, url, signerOrigin);
+        const send = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                m.iframeReady = true;
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
+                goFallback();
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
+// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
+// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
+//
+// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
+// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
+// look + motion, so signing feels native. Safari (unreliable at iframe passkey
+// CREATE) and any environment where the frame cannot mount fall back to a real
+// popup window; both transports speak the same postMessage protocol.
+//
+// Unlike the Crossmint bridge (crossmint-signer-bridge.ts), Turnkey wallets DO
+// produce raw detached signatures: the signer runs the Turnkey browser SDK on the
+// single Bounded origin, enrolls the user's passkey on first use (lazy - the
+// sub-org is created with the passkey + email attached at that moment), and stamps
+// an ed25519 signRawPayload with that passkey. So this bridge exposes a
+// `signSolanaMessage` primitive; the app builds + submits the transaction itself.
+//
+// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
+// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
+// every user one wallet + one passkey that roams across every app.
+function hasDOM() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
+// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
+// fail - and a post-failure popup would no longer have a user gesture to open with.
+// There we pick the popup up front, from the original click, so enrollment is solid.
+// Everywhere else the inline widget is used (buttery in-app modal).
+function preferPopup() {
+    if (!hasDOM() || typeof navigator === 'undefined')
+        return true;
+    const ua = navigator.userAgent || '';
+    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+}
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (Safari enrollment, or the frame never loads).
+async function deliver(url, origin, ex) {
+    const popup = () => runPopup(url, origin, ex);
+    if (preferPopup())
+        return popup();
+    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+}
+async function turnkeySignerPage() {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+function toHex(bytes) {
+    let h = '';
+    for (const b of bytes)
+        h += b.toString(16).padStart(2, '0');
+    return h;
+}
+function fromHex(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(clean.substr(i * 2, 2), 16);
+    return out;
+}
+let requestSeq = 0;
+// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
+// resolve when `onResult` accepts a result message. Origin + source are pinned.
+async function runPopup(url, signerOrigin, ex) {
+    var _a, _b;
+    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    if (!popup) {
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+    }
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let sentRequest = false;
+        let closeTimer;
+        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
+            clearInterval(closeTimer); };
+        const sendRequest = () => { if (sentRequest)
+            return; sentRequest = true; try {
+            popup.postMessage(ex.request, signerOrigin);
+        }
+        catch ( /* popup gone */_a) { /* popup gone */ } };
+        const onMsg = (event) => {
+            if (event.origin !== signerOrigin)
+                return;
+            if (event.source !== popup)
+                return;
+            const d = event.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:turnkey:ready') {
+                sendRequest();
+                return;
+            }
+            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
+                const outcome = ex.onResult(d);
+                if ('error' in outcome) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    reject(new Error(outcome.error));
+                    return;
+                }
+                if (outcome.done) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
+                    resolve(outcome.value);
+                }
+            }
+        };
+        window.addEventListener('message', onMsg);
+        setTimeout(sendRequest, 1200);
+        closeTimer = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(closeTimer);
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Wallet approval window was closed before it completed.'));
+                } }, 400);
+            }
+        }, 500);
+        setTimeout(() => { if (!settled) {
+            cleanup();
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+            reject(new Error('Wallet approval timed out.'));
+        } }, 5 * 60 * 1000);
+    });
+}
+/**
+ * Get-or-create the user's non-custodial Turnkey wallet, resolving with its stable
+ * Solana address. On first use the popup enrolls a device passkey (Face ID / Touch ID)
+ * and creates the wallet (lazy) with no email code; if the wallet already exists it
+ * resolves immediately without a prompt. Call from a USER GESTURE.
+ *
+ * Use this to learn the fee-payer address BEFORE building a transaction to sign.
+ */
+async function getOrCreateTurnkeyWallet() {
+    if (!hasDOM())
+        throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:createWallet', requestId },
+        onResult: (d) => {
+            if (d.ok && typeof d.address === 'string')
+                return { done: true, value: { address: d.address, subOrgId: String(d.subOrgId || '') } };
+            return { error: String(d.error || 'Wallet setup failed') };
+        },
+    });
+}
+/**
+ * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
+ * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
+ * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
+ * browser blocks the popup.
+ *
+ * On the user's FIRST signature the popup transparently enrolls a device passkey
+ * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
+ * signatures are just a passkey approval.
+ */
+async function signSolanaMessageViaTurnkey(message) {
+    if (!hasDOM()) {
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
+    const messageHex = toHex(message);
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
+        onResult: (d) => {
+            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
+            }
+            return { error: String(d.error || 'Turnkey signing failed') };
+        },
+    });
+}
+
 /**
  * Extracts a human-readable error message from Solana transaction logs.
  */
@@ -6084,6 +7720,91 @@ class PrivyExpoProvider {
     }
 }
 
+/**
+ * Default provider discovery: Phantom-first, then any Wallet-Standard
+ * `window.solana`. Kept tiny + synchronous (no heavy imports) so it works inside
+ * a user gesture and can be eagerly exported from the SDK entry.
+ */
+function defaultInjectedProvider() {
+    var _a;
+    if (typeof window === 'undefined')
+        return null;
+    const w = window;
+    const phantom = (_a = w === null || w === void 0 ? void 0 : w.phantom) === null || _a === void 0 ? void 0 : _a.solana;
+    if (phantom && typeof phantom.signMessage === 'function')
+        return phantom;
+    const generic = w === null || w === void 0 ? void 0 : w.solana;
+    if (generic && typeof generic.signMessage === 'function')
+        return generic;
+    return null;
+}
+
+// injected-evm-wallet-types.ts — tiny, dependency-free surface for the EVM
+// WALLET LOGIN path (BYO wallet via SIWE). The EVM twin of
+// injected-wallet-types.ts: kept separate from injected-evm-wallet-provider.ts
+// so the SDK entry can eagerly export the type surface + the provider-discovery
+// helper WITHOUT dragging the provider class into the default bundle. The
+// provider is lazy-loaded by getAuthProvider() when an app opts into
+// authMethod:'evm-wallet'.
+//
+// It rides the standard EIP-1193 injected provider a browser wallet exposes
+// (MetaMask / Rabby / Coinbase Wallet / any window.ethereum), discovered via
+// EIP-6963 (multi-wallet, collision-free) with a window.ethereum fallback. It
+// needs NO viem/ethers and NO React — EIP-1193 request() + hex strings suffice.
+// EIP-6963 is announcement-based: wallets add an `eip6963:requestProvider`
+// listener and synchronously dispatch `eip6963:announceProvider` in response. We
+// keep a persistent collector so announcements (including late ones) are
+// captured, and re-request on demand.
+const announcedProviders = [];
+let announceListenerAttached = false;
+function attachAnnounceListener() {
+    if (announceListenerAttached || typeof window === 'undefined')
+        return;
+    announceListenerAttached = true;
+    window.addEventListener('eip6963:announceProvider', (event) => {
+        const detail = event === null || event === void 0 ? void 0 : event.detail;
+        if (detail &&
+            detail.provider &&
+            typeof detail.provider.request === 'function' &&
+            !announcedProviders.some((d) => { var _a, _b; return ((_a = d.info) === null || _a === void 0 ? void 0 : _a.uuid) === ((_b = detail.info) === null || _b === void 0 ? void 0 : _b.uuid); })) {
+            announcedProviders.push(detail);
+        }
+    });
+}
+/**
+ * Request + collect EIP-6963 providers. Dispatches `eip6963:requestProvider`
+ * (synchronous — already-loaded wallets announce in the same tick) and returns
+ * every wallet announced so far. Kept synchronous so it works inside a user
+ * gesture and can be eagerly exported from the SDK entry.
+ */
+function requestEip6963Providers() {
+    if (typeof window === 'undefined')
+        return [];
+    attachAnnounceListener();
+    try {
+        window.dispatchEvent(new Event('eip6963:requestProvider'));
+    }
+    catch (_a) {
+        /* older browsers without Event constructor — fall through to window.ethereum */
+    }
+    return announcedProviders.slice();
+}
+/**
+ * Default EVM provider discovery: EIP-6963 first (multi-wallet, collision-free),
+ * then legacy `window.ethereum`. Returns null when no injected wallet is present.
+ */
+function defaultInjectedEvmProvider() {
+    if (typeof window === 'undefined')
+        return null;
+    const details = requestEip6963Providers();
+    if (details.length > 0)
+        return details[0].provider;
+    const eth = window.ethereum;
+    if (eth && typeof eth.request === 'function')
+        return eth;
+    return null;
+}
+
 exports.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA;
 exports.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA;
 exports.BUILD_REVIEW_CAPABILITY_SCHEMA = BUILD_REVIEW_CAPABILITY_SCHEMA;
@@ -6103,6 +7824,8 @@ exports.builds = builds;
 exports.completeLoginFromRedirect = completeLoginFromRedirect;
 exports.completeLoginInPopup = completeLoginInPopup;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
+exports.defaultInjectedEvmProvider = defaultInjectedEvmProvider;
+exports.defaultInjectedProvider = defaultInjectedProvider;
 exports.deserializeTransaction = deserializeTransaction;
 exports.embeddedRunEvmTransaction = embeddedRunEvmTransaction;
 exports.embeddedSignAndSubmit = embeddedSignAndSubmit;
@@ -6110,6 +7833,7 @@ exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
+exports.getOrCreateTurnkeyWallet = getOrCreateTurnkeyWallet;
 exports.getPlatform = getPlatform;
 exports.hasEmbeddedEvmWallet = hasEmbeddedEvmWallet;
 exports.hasEmbeddedWallet = hasEmbeddedWallet;
@@ -6118,15 +7842,21 @@ exports.login = login;
 exports.loginWithPopup = loginWithPopup;
 exports.loginWithPrivy = loginWithPrivy;
 exports.loginWithRedirect = loginWithRedirect;
+exports.loginWithWallet = loginWithWallet;
 exports.logout = logout;
 exports.normalizeSolanaRpcUrl = normalizeSolanaRpcUrl;
 exports.onAuthLoadingChanged = onAuthLoadingChanged;
 exports.onAuthStateChanged = onAuthStateChanged;
+exports.openBoundedWidget = openBoundedWidget;
+exports.requestEip6963Providers = requestEip6963Providers;
 exports.resolveSolanaRpcUrl = resolveSolanaRpcUrl;
 exports.setAuthLoading = setAuthLoading;
 exports.setCurrentUser = setCurrentUser;
 exports.setPlatform = setPlatform;
 exports.signInAnonymously = signInAnonymously;
+exports.signSolanaMessageViaTurnkey = signSolanaMessageViaTurnkey;
+exports.startTurnkeyEmailLogin = startTurnkeyEmailLogin;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
-//# sourceMappingURL=index.native-CouprxZp.js.map
+exports.useQuery = useQuery;
+//# sourceMappingURL=index-CnObYQhV.js.map