@bounded-sh/client 0.0.56 → 0.0.58

package/REACT_NATIVE.md

@@ -9,22 +9,45 @@ The SDK ships a dedicated React Native entry (`react-native` condition ->
 React Native has no `localStorage`, no `document`, and no reliable browser
 base64 helpers, so configure the SDK platform once at app startup:
 
+> **Security: store login tokens ENCRYPTED, never in plaintext.** The SDK persists
+> whatever adapter you give it, as-is - it adds no encryption of its own. A plain
+> `createMMKV()` (or `AsyncStorage`) leaves the user's session tokens readable to
+> anyone with device/backup/filesystem access. Back the store with the OS secure
+> vault: an MMKV `encryptionKey` kept in the Keychain/Keystore (shown below), or a
+> Keychain-backed adapter directly.
+
 ```ts
 import "react-native-get-random-values";
 import "react-native-url-polyfill/auto";
 import { setPlatform, ReactNativeSessionManager } from "@bounded-sh/client";
 import { createMMKV } from "react-native-mmkv";
+import * as Keychain from "react-native-keychain";
 import { decode as atob, encode as btoa } from "base-64";
 
-const store = createMMKV();
-const storage = {
-  getItem: (key: string) => store.getString(key) ?? null,
-  setItem: (key: string, value: string) => store.set(key, value),
-  removeItem: (key: string) => store.remove(key),
-};
+// Load (or create) a random MMKV encryption key and keep it in the OS secure vault
+// (Keychain on iOS / Keystore-backed on Android) - NEVER hardcode a key in source.
+async function loadEncryptionKey(): Promise<string> {
+  const service = "sh.bounded.session";
+  const existing = await Keychain.getGenericPassword({ service });
+  if (existing) return existing.password;
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes); // from react-native-get-random-values, imported above
+  const key = btoa(String.fromCharCode(...bytes));
+  await Keychain.setGenericPassword("bounded", key, { service });
+  return key;
+}
 
-setPlatform({ storage, sessionStorage: storage, atob, btoa, hasDOM: false });
-ReactNativeSessionManager.configure({ storage, atob });
+// Call this once at startup BEFORE using the SDK (e.g. gate your app on it).
+export async function configureBoundedStorage() {
+  const store = createMMKV({ id: "sh.bounded.session", encryptionKey: await loadEncryptionKey() });
+  const storage = {
+    getItem: (key: string) => store.getString(key) ?? null,
+    setItem: (key: string, value: string) => store.set(key, value),
+    removeItem: (key: string) => store.remove(key),
+  };
+  setPlatform({ storage, sessionStorage: storage, atob, btoa, hasDOM: false });
+  ReactNativeSessionManager.configure({ storage, atob });
+}
 ```
 
 `setPlatform` fills general browser API gaps. `ReactNativeSessionManager.configure`

package/dist/auth/bounded-login-widget.d.ts

@@ -0,0 +1,25 @@
+import type { User } from "@bounded-sh/core";
+import type { HostedAuthMethod } from "./oidc-auth";
+export interface BoundedWidgetOptions {
+    /** Which hosted methods to surface as buttons. Defaults to ['email','google']. */
+    methods?: readonly HostedAuthMethod[];
+    /** Show the "Continue with wallet" option. Defaults to auto (on if a wallet is
+     *  detected or wallet-login is enabled in init config). */
+    wallet?: boolean;
+    redirectUri?: string;
+    title?: string;
+    subtitle?: string;
+    /**
+     * Login mode. Defaults to the app's init() `authMode` (usually "bounded"). In
+     * "turnkey" mode the email lane runs Turnkey-native OTP INLINE in the widget
+     * (no OIDC popup); social + wallet lanes are unchanged. The widget shape and
+     * look are identical in both modes.
+     */
+    authMode?: "bounded" | "turnkey";
+}
+/**
+ * Open the unified Bounded login widget and resolve with the signed-in `User`.
+ * Rejects with `Error("cancelled")` if the user dismisses it. `init()` must have
+ * run first; call from a user gesture so social/wallet popups are allowed.
+ */
+export declare function openBoundedWidget(opts?: BoundedWidgetOptions): Promise<User>;

package/dist/auth/bounded-widget-modal.d.ts

@@ -0,0 +1,33 @@
+declare function hasDOM(): boolean;
+export interface BoundedModal {
+    root: HTMLElement;
+    overlay: HTMLElement;
+    panel: HTMLElement;
+    content: HTMLElement;
+    iframe: HTMLIFrameElement | null;
+    iframeOrigin: string;
+    iframeReady: boolean;
+    onBackdrop: (() => void) | null;
+    onIframeMessage: ((d: Record<string, unknown>) => void) | null;
+    chain: Promise<unknown>;
+    fitObserver: ResizeObserver | null;
+}
+export declare function getModal(): BoundedModal;
+export declare function modalIsMounted(): boolean;
+export declare function showModal(m: BoundedModal): void;
+export declare function hideModal(m: BoundedModal, after?: () => void): void;
+export declare function setPanelHeight(m: BoundedModal, px: number): void;
+/**
+ * Measure the currently mounted native content and tween the panel to fit it.
+ * Re-fits automatically when the card's intrinsic height changes - notably after
+ * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
+ * after first paint) and on inline view swaps (email -> OTP code -> success).
+ */
+export declare function fitPanelToContent(m: BoundedModal): void;
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
+export declare function mountContent(m: BoundedModal, node: HTMLElement): void;
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+export declare function ensureIframe(m: BoundedModal, url: string, origin: string): HTMLIFrameElement;
+export declare function detachIframe(m: BoundedModal): void;
+export declare function ensureFonts(): void;
+export { hasDOM };

package/dist/auth/index.d.ts

@@ -1,4 +1,5 @@
 import type { AuthProvider, User, ClientConfig } from "@bounded-sh/core";
+import type { InjectedSolanaProvider } from "./providers/injected-wallet-types";
 /**
  * Clears the session if it was created by a different auth method.
  * Returns true if the session was cleared, false if the session is compatible.
@@ -16,6 +17,32 @@ export declare function clearIncompatibleSession(): boolean;
  * never want it — existing apps that don't opt in see ZERO behavior change.
  */
 export declare function isWalletLoginEnabled(config: Partial<ClientConfig>): boolean;
+/**
+ * Whether the app explicitly turned the "connect wallet" lane OFF at init()
+ * (`walletLogin: false`). This is the hard opt-OUT the unified widget honors: it
+ * hides the wallet option entirely even when an injected wallet is detected and
+ * even if a per-call `openBoundedWidget({ wallet: true })` asked for it.
+ */
+export declare function isWalletLoginDisabled(config: Partial<ClientConfig>): boolean;
+/**
+ * Site policy: the app requires an email on file for every user (`requireEmail:
+ * true`). Native wallet login carries no email, so the unified widget suppresses
+ * the wallet lane when this is set - email/social (which yields an email) remain.
+ * This lets a policy deny wallet-only accounts without touching per-call options.
+ */
+export declare function isEmailRequired(config: Partial<ClientConfig>): boolean;
+/** The config passed to the last `init()`, or null before init. Read-only view
+ *  for runtime surfaces (e.g. the unified login widget) that need wallet/rpc
+ *  settings without re-plumbing them through every call. */
+export declare function getInitConfig(): Partial<ClientConfig> | null;
+/**
+ * Which LOGIN mode the app runs (default "bounded"). "turnkey" opts the app into
+ * Turnkey-native email OTP: the unified widget runs the code entry INLINE (no OIDC
+ * popup) via startTurnkeyEmailLogin(), and Bounded mints the session from Turnkey's
+ * verification. The value comes from init() config (`authMode`); a `openBoundedWidget`
+ * option can override it per call. Anything other than "turnkey" is "bounded".
+ */
+export declare function resolveAuthMode(config: Partial<ClientConfig>): 'bounded' | 'turnkey';
 export { SOLANA_DEVNET_RPC_URL, SOLANA_MAINNET_RPC_URL, } from "./solana-rpc";
 export declare function getAuthProvider(config?: Partial<ClientConfig>): Promise<AuthProvider>;
 /** Per-call overrides forwarded to the active auth provider's modal. */
@@ -50,6 +77,21 @@ export declare function signInAnonymously(): Promise<User | null>;
  * (web localStorage / RN storage) and identity model. `init()` must have run first.
  */
 export declare function loginWithPrivy(options?: LoginOptions): Promise<User | null>;
+/**
+ * Log in with an injected Solana WALLET (Phantom / Solflare / Backpack / any
+ * Wallet-Standard `window.solana`) as a co-equal RUNTIME route - selectable
+ * alongside `login()` / hosted `loginWithPopup()` / `signInAnonymously()` WITHOUT
+ * re-`init()`. This is the "Continue with wallet" choice the unified Bounded
+ * login widget offers: it NEVER touches Better Auth - the user's real wallet
+ * becomes `@user.address` and login is a SIWS signature.
+ *
+ * `getProvider` pins a specific discovered wallet (e.g. when the widget lists
+ * several); omit it to use Phantom-first discovery. Must be called from a user
+ * gesture so the wallet's connect prompt is allowed. `init()` must have run first.
+ */
+export declare function loginWithWallet(options?: {
+    getProvider?: () => InjectedSolanaProvider | null | undefined;
+}): Promise<User | null>;
 export declare function login(options?: LoginOptions): Promise<User | null>;
 export declare function getCurrentAuthMethod(): string | null;
 export interface LogoutOptions {

package/dist/auth/oidc-auth.d.ts

@@ -29,6 +29,12 @@ export interface OidcLoginOptions {
      * silently re-signed-in as the same one. `'select_account'` behaves the same.
      */
     prompt?: 'login' | 'select_account' | 'consent' | 'none' | (string & {});
+    /**
+     * Standard OIDC `login_hint` - prefill the identifier (e.g. the email the user
+     * already typed in the unified widget's card) so the hosted page can skip
+     * straight to the OTP step instead of asking for it again.
+     */
+    loginHint?: string;
 }
 export interface PopupLoginOptions extends OidcLoginOptions {
     width?: number;
@@ -60,3 +66,15 @@ export declare function loginWithPopup(opts: PopupLoginOptions): Promise<User>;
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 export declare function completeLoginInPopup(openerOrigin: string): void;
+export declare function establishInlineSession(data: {
+    idToken?: string;
+    id_token?: string;
+    accessToken?: string;
+    access_token?: string;
+    refreshToken?: string;
+    bounded_refresh_token?: string;
+}): Promise<User>;
+export declare function inlineAuthEndpoint(): Promise<{
+    base: string;
+    appId: string;
+}>;

package/dist/auth/providers/wallet-login-finalize.d.ts

@@ -0,0 +1,17 @@
+export interface WalletLoginFinalizeDeps {
+    /** The wallet address that just signed in (the identity the app should end up as). */
+    finalAddress: string;
+    /** Read the currently stored Bounded session (null if none). */
+    getSession: () => Promise<{
+        address?: string | null;
+    } | null>;
+    /** Mint + store a Bounded session for `finalAddress`. Rejects on failure. */
+    createSession: () => Promise<void>;
+    /** Drop any stored session (used to clear a stale/mismatched one on failure). */
+    clearSession: () => Promise<void> | void;
+    /** Called exactly once when the login is confirmed: set current user + resolve. */
+    onSuccess: () => void;
+    /** Called exactly once when the login must fail: reject with this error. */
+    onFailure: (error: unknown) => void;
+}
+export declare function finalizeWalletLogin(deps: WalletLoginFinalizeDeps): Promise<void>;

package/dist/auth/providers/wallet-standard-discovery.d.ts

@@ -0,0 +1,23 @@
+import type { Wallet } from "@wallet-standard/base";
+import type { InjectedSolanaProvider } from "./injected-wallet-types";
+export interface StandardWalletChoice {
+    name: string;
+    /** data: URI the wallet advertises, or undefined. */
+    icon?: string;
+    /** Adapt the registered wallet to the slim injected-provider shape. */
+    getProvider: () => InjectedSolanaProvider;
+}
+/**
+ * Adapt a Wallet Standard wallet to the slim `InjectedSolanaProvider` the SDK's
+ * wallet-login + signing path consumes. Connect resolves (and caches) the active
+ * account; sign* delegate to the wallet's own Solana features. Nothing is
+ * wallet-name specific.
+ */
+export declare function standardWalletToInjectedProvider(wallet: Wallet): InjectedSolanaProvider;
+/**
+ * Enumerate every Solana-capable wallet currently registered with the Wallet
+ * Standard, newest registrations included. Returns login-ready choices (name +
+ * icon + provider factory). Empty array off-browser or when no wallet is present;
+ * the widget then falls back to the legacy injected `window.solana` probe.
+ */
+export declare function discoverStandardWallets(): StandardWalletChoice[];

package/dist/auth/providers/wallet-standard-tx.d.ts

@@ -0,0 +1,7 @@
+import { Transaction, VersionedTransaction } from "@solana/web3.js";
+/** Serialize an unsigned Transaction/VersionedTransaction to the wire bytes the
+ *  wallet-standard sign features expect (legacy skips signature verification). */
+export declare function serializeUnsignedTx(tx: Transaction | VersionedTransaction): Uint8Array;
+/** Deserialize the signed bytes a wallet returns, round-tripping legacy or
+ *  versioned transactions correctly. */
+export declare function deserializeSignedTx(bytes: Uint8Array): Transaction | VersionedTransaction;

package/dist/auth/turnkey-auth.d.ts

@@ -0,0 +1,17 @@
+import type { User } from '@bounded-sh/core';
+export interface TurnkeyEmailLoginHandle {
+    /** The email the code was sent to (echo, for the widget's "code sent to ..." line). */
+    email: string;
+    /**
+     * Complete login with the 6-digit code the user received. Seals the code to Turnkey,
+     * verifies it server-side, and resolves with the signed-in User. Rejects with a
+     * user-safe Error on an invalid/expired code (the handle stays usable for a retry).
+     */
+    verify(code: string): Promise<User>;
+}
+/**
+ * Begin authMode:"turnkey" login: ask Turnkey to email a one-time code to `email`.
+ * Resolves with a handle whose `verify(code)` finishes the login. Web-only (the sealing
+ * step needs the signer iframe); on React Native use loginWithRedirect() instead.
+ */
+export declare function startTurnkeyEmailLogin(email: string): Promise<TurnkeyEmailLoginHandle>;

package/dist/auth/turnkey-signer-bridge.d.ts

@@ -0,0 +1,32 @@
+export interface TurnkeySignResult {
+    /** 64-byte ed25519 signature. */
+    signature: Uint8Array;
+    /** The signer's Solana address (base58). */
+    address: string;
+    /** The user's Turnkey sub-org id. */
+    subOrgId: string;
+}
+export interface TurnkeyWallet {
+    address: string;
+    subOrgId: string;
+}
+/**
+ * Get-or-create the user's non-custodial Turnkey wallet, resolving with its stable
+ * Solana address. On first use the popup enrolls a device passkey (Face ID / Touch ID)
+ * and creates the wallet (lazy) with no email code; if the wallet already exists it
+ * resolves immediately without a prompt. Call from a USER GESTURE.
+ *
+ * Use this to learn the fee-payer address BEFORE building a transaction to sign.
+ */
+export declare function getOrCreateTurnkeyWallet(): Promise<TurnkeyWallet>;
+/**
+ * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
+ * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
+ * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
+ * browser blocks the popup.
+ *
+ * On the user's FIRST signature the popup transparently enrolls a device passkey
+ * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
+ * signatures are just a passkey approval.
+ */
+export declare function signSolanaMessageViaTurnkey(message: Uint8Array): Promise<TurnkeySignResult>;

package/dist/auth/turnkey-wallet-widget.d.ts

@@ -0,0 +1,17 @@
+export interface WidgetExchange {
+    request: Record<string, unknown>;
+    onResult: (d: Record<string, unknown>) => {
+        done: true;
+        value: unknown;
+    } | {
+        done: false;
+    } | {
+        error: string;
+    };
+}
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
+ * (Safari cross-origin create) or cannot be mounted.
+ */
+export declare function runWidget<T>(url: string, signerOrigin: string, ex: WidgetExchange, popupFallback: () => Promise<T>): Promise<T>;

package/dist/{email-auth-provider-4Df8dFOh.js → email-auth-provider-BHtR1H_E.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index = require('./index-B_uRc6gn.js');
+var index = require('./index-MKE9tHpl.js');
 require('react');
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -99,4 +99,4 @@ const emailProviderSingleton = new EmailAuthProvider();
 
 exports.EmailAuthProvider = EmailAuthProvider;
 exports.emailProviderSingleton = emailProviderSingleton;
-//# sourceMappingURL=email-auth-provider-4Df8dFOh.js.map
+//# sourceMappingURL=email-auth-provider-BHtR1H_E.js.map

package/dist/{email-auth-provider-4Df8dFOh.js.map → email-auth-provider-BHtR1H_E.js.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-4Df8dFOh.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasEmbeddedWallet","EMBEDDED_WALLET_UNSUPPORTED","hasEmbeddedEvmWallet","embeddedRunEvmTransaction","embeddedSignAndSubmit"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQA,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAACC,uBAAiB,EAAE,GAAGC,iCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAACC,0BAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAOC,+BAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAACH,uBAAiB,EAAE,GAAGC,iCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAACD,uBAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,2BAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}
+{"version":3,"file":"email-auth-provider-BHtR1H_E.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasEmbeddedWallet","EMBEDDED_WALLET_UNSUPPORTED","hasEmbeddedEvmWallet","embeddedRunEvmTransaction","embeddedSignAndSubmit"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQA,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAACC,uBAAiB,EAAE,GAAGC,iCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAACC,0BAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAOC,+BAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAACH,uBAAiB,EAAE,GAAGC,iCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAACD,uBAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,2BAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}

package/dist/{email-auth-provider-CZ-xYVln.js → email-auth-provider-BlJI-8w9.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index_native = require('./index.native-BqK-14S8.js');
+var index_native = require('./index.native-hu3o3zXU.js');
 require('react');
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -99,4 +99,4 @@ const emailProviderSingleton = new EmailAuthProvider();
 
 exports.EmailAuthProvider = EmailAuthProvider;
 exports.emailProviderSingleton = emailProviderSingleton;
-//# sourceMappingURL=email-auth-provider-CZ-xYVln.js.map
+//# sourceMappingURL=email-auth-provider-BlJI-8w9.js.map

package/dist/{email-auth-provider-CZ-xYVln.js.map → email-auth-provider-BlJI-8w9.js.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-CZ-xYVln.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasEmbeddedWallet","EMBEDDED_WALLET_UNSUPPORTED","hasEmbeddedEvmWallet","embeddedRunEvmTransaction","embeddedSignAndSubmit"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQA,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAACC,8BAAiB,EAAE,GAAGC,wCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAACC,iCAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAOC,sCAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAACH,8BAAiB,EAAE,GAAGC,wCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAACD,8BAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,kCAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}
+{"version":3,"file":"email-auth-provider-BlJI-8w9.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasEmbeddedWallet","EMBEDDED_WALLET_UNSUPPORTED","hasEmbeddedEvmWallet","embeddedRunEvmTransaction","embeddedSignAndSubmit"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQA,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAACC,8BAAiB,EAAE,GAAGC,wCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAACC,iCAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAOC,sCAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAACH,8BAAiB,EAAE,GAAGC,wCAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAACD,8BAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,kCAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}

package/dist/{email-auth-provider-By6SL0YS.mjs → email-auth-provider-CX7foEhA.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager } from '@bounded-sh/core';
-import { s as setCurrentUser, E as EMBEDDED_WALLET_UNSUPPORTED, h as hasEmbeddedWallet, a as hasEmbeddedEvmWallet, e as embeddedRunEvmTransaction, b as embeddedSignAndSubmit, g as getPlatform } from './index--jrXqxte.mjs';
+import { s as setCurrentUser, E as EMBEDDED_WALLET_UNSUPPORTED, h as hasEmbeddedWallet, a as hasEmbeddedEvmWallet, e as embeddedRunEvmTransaction, b as embeddedSignAndSubmit, g as getPlatform } from './index-DWodlTFG.mjs';
 import 'react';
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -96,4 +96,4 @@ class EmailAuthProvider {
 const emailProviderSingleton = new EmailAuthProvider();
 
 export { EmailAuthProvider, emailProviderSingleton };
-//# sourceMappingURL=email-auth-provider-By6SL0YS.mjs.map
+//# sourceMappingURL=email-auth-provider-CX7foEhA.mjs.map

package/dist/{email-auth-provider-By6SL0YS.mjs.map → email-auth-provider-CX7foEhA.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-By6SL0YS.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAAC,oBAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAO,yBAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAAC,iBAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,qBAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}
+{"version":3,"file":"email-auth-provider-CX7foEhA.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAAC,oBAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAO,yBAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAAC,iBAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,qBAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}

package/dist/{email-auth-provider-BqX-o_sJ.mjs → email-auth-provider-CfNSS8Du.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager } from '@bounded-sh/core';
-import { s as setCurrentUser, E as EMBEDDED_WALLET_UNSUPPORTED, h as hasEmbeddedWallet, a as hasEmbeddedEvmWallet, e as embeddedRunEvmTransaction, b as embeddedSignAndSubmit, g as getPlatform } from './index.native-CTVEq0VY.mjs';
+import { s as setCurrentUser, E as EMBEDDED_WALLET_UNSUPPORTED, h as hasEmbeddedWallet, a as hasEmbeddedEvmWallet, e as embeddedRunEvmTransaction, b as embeddedSignAndSubmit, g as getPlatform } from './index.native-CQiw9baS.mjs';
 import 'react';
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -96,4 +96,4 @@ class EmailAuthProvider {
 const emailProviderSingleton = new EmailAuthProvider();
 
 export { EmailAuthProvider, emailProviderSingleton };
-//# sourceMappingURL=email-auth-provider-BqX-o_sJ.mjs.map
+//# sourceMappingURL=email-auth-provider-CfNSS8Du.mjs.map

package/dist/{email-auth-provider-BqX-o_sJ.mjs.map → email-auth-provider-CfNSS8Du.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-BqX-o_sJ.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAAC,oBAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAO,yBAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAAC,iBAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,qBAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}
+{"version":3,"file":"email-auth-provider-CfNSS8Du.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasEmbeddedWallet, hasEmbeddedEvmWallet, embeddedSignAndSubmit, embeddedRunEvmTransaction, EMBEDDED_WALLET_UNSUPPORTED, } from '../crossmint-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'Email login has no embedded wallet. Enable `\"auth\": { \"wallets\": true }` in ' +\n    'the app policy so email logins get a non-custodial Crossmint wallet ' +\n    '(@user.address), then sign from a user gesture. Otherwise use a wallet ' +\n    'provider (e.g. Phantom) for onchain actions.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    // Email logins have no wallet — address is null (the User type allows it).\n    const evmAddress = typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])\n        ? c['custom:evmWalletAddress'].toLowerCase()\n        : null;\n    return { id, address: (c['custom:walletAddress'] || null), evmAddress, email, provider: emailProviderSingleton };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    // Crossmint Solana smart wallets sign+submit atomically and cannot produce a\n    // raw signature — signMessage/signTransaction are structurally unsupported\n    // (throw the clear \"use signAndSubmitTransaction\" error when a wallet exists;\n    // the no-wallet error otherwise). signAndSubmitTransaction routes through the\n    // Bounded signer popup for wallets-enabled email logins.\n    async signMessage(_message) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async runTransaction(evm, sol, options) {\n        if (evm && sol)\n            throw new Error('A transaction cannot target EVM and Solana at the same time.');\n        if (!evm)\n            throw new Error(NO_WALLET);\n        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)\n            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');\n        if (!hasEmbeddedEvmWallet())\n            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');\n        return embeddedRunEvmTransaction(evm);\n    }\n    async signTransaction(_t) {\n        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : NO_WALLET);\n    }\n    async signAndSubmitTransaction(transaction, _feePayer) {\n        if (!hasEmbeddedWallet())\n            throw new Error(NO_WALLET);\n        return embeddedSignAndSubmit(transaction);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,8EAA8E;AAChG,IAAI,sEAAsE;AAC1E,IAAI,yEAAyE;AAC7E,IAAI,8CAA8C;AAClD;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD;AACA,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAClI,UAAU,CAAC,CAAC,yBAAyB,CAAC,CAAC,WAAW;AAClD,UAAU,IAAI;AACd,IAAI,OAAO,EAAE,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE;AACpH;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,cAAc,EAAE,CAAC,YAAY,EAAE;AACvC,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE;AAChC,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;AAC5C,QAAQ,IAAI,GAAG,IAAI,GAAG;AACtB,YAAY,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC;AAC3F,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,MAAM,KAAK;AAChG,YAAY,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACpH,QAAQ,IAAI,CAAC,oBAAoB,EAAE;AACnC,YAAY,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC;AAC7I,QAAQ,OAAO,yBAAyB,CAAC,GAAG,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,2BAA2B,GAAG,SAAS,CAAC;AACtF,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE;AAC3D,QAAQ,IAAI,CAAC,iBAAiB,EAAE;AAChC,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,qBAAqB,CAAC,WAAW,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}

package/dist/{guest-auth-provider-DWcdRvLW.js → guest-auth-provider-BPXDJoEQ.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index = require('./index-B_uRc6gn.js');
+var index = require('./index-MKE9tHpl.js');
 require('react');
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -274,4 +274,4 @@ class GuestAuthProvider {
 }
 
 exports.GuestAuthProvider = GuestAuthProvider;
-//# sourceMappingURL=guest-auth-provider-DWcdRvLW.js.map
+//# sourceMappingURL=guest-auth-provider-BPXDJoEQ.js.map