@bounded-sh/client 0.0.61 → 0.0.64

package/dist/{index-L2R6C5Vl.mjs → index-7yz-Olrm.mjs}

@@ -1,4 +1,4 @@
-import { assertCanonicalBoundedRuntimeWriteCalldata, getActiveSessionManager, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, onSessionCleared, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, onSessionCleared, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 /**
@@ -847,6 +847,8 @@ function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
 
+var safeBuffer = {exports: {}};
+
 var buffer = {};
 
 var base64Js = {};
@@ -3216,10 +3218,6 @@ function requireBuffer () {
 	return buffer;
 }
 
-var bufferExports = requireBuffer();
-
-var safeBuffer = {exports: {}};
-
 /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
 
 var hasRequiredSafeBuffer;
@@ -3433,327 +3431,725 @@ var basex = /*@__PURE__*/getDefaultExportFromCjs(srcExports);
 var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
 var bs58 = basex(ALPHABET);
 
-// crossmint-signer-bridge.ts — routes embedded-wallet signing through the
-// Bounded-owned signer popup (auth.bounded.sh/wallet/signer).
+var bufferExports = requireBuffer();
+
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
 //
-// Slice-1 attached a non-custodial Crossmint smart wallet to email logins and
-// populated `@user.address`. This bridge is the slice-2 counterpart: a user
-// whose address came from `auth.wallets` can APPROVE transactions with that
-// wallet from ANY app, non-custodially, by having the Crossmint client SDK run
-// ONLY on the Bounded signer page (one whitelisted origin) and talking to it via
-// postMessage.
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because a WebAuthn passkey is bound to one origin).
 //
-// SEMANTICS (Crossmint Solana smart wallets): these wallets cannot produce raw
-// detached signatures — there is no signMessage and no sign-without-submit. The
-// only honest primitive is EXECUTION (sign + submit) via the wallet's email-OTP
-// authorization. So this bridge implements `signAndSubmitTransaction` and a
-// token-send; `signMessage` / `signTransaction` throw a clear unsupported error.
-const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets — Crossmint Solana smart wallets sign ' +
-    'and submit atomically. Use signAndSubmitTransaction() (or bounded.sendWalletToken) ' +
-    'instead of signMessage/signTransaction.';
-const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so email logins get a non-custodial wallet (@user.address), ' +
-    'then sign from a user gesture.';
-function hasDOM$5() {
-    return typeof window !== 'undefined' && typeof document !== 'undefined';
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$4() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
 }
-function decodeJwt$1(token) {
-    try {
-        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
-        const pad = b64.length % 4;
-        if (pad === 2)
-            b64 += '==';
-        else if (pad === 3)
-            b64 += '=';
-        return JSON.parse(bufferExports.Buffer.from(b64, 'base64').toString('utf8'));
-    }
-    catch (_a) {
-        return {};
-    }
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
 }
-// Pull the embedded-wallet identity out of the active session's id token.
-// Returns null when this session has no wallet (so callers can throw the
-// informative NO_EMBEDDED_WALLET error).
-function walletClaimsFromSession(chain = 'solana') {
-    let idToken = null;
-    try {
-        idToken = getActiveSessionManager().getIdToken();
-    }
-    catch (_a) {
-        idToken = null;
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
     }
-    if (!idToken)
-        return null;
-    const c = decodeJwt$1(idToken);
-    const address = c['custom:walletAddress'];
-    const evmAddress = c['custom:evmWalletAddress'];
-    const email = c['email'];
-    if (typeof email !== 'string' || !email)
-        return null;
-    if (chain === 'solana' && (typeof address !== 'string' || !address))
-        return null;
-    if (chain === 'evm' && (typeof evmAddress !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(evmAddress)))
-        return null;
-    const envClaim = c['custom:walletEnvironment'];
-    const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
-    return Object.assign(Object.assign(Object.assign({ email }, (typeof address === 'string' && address ? { address } : {})), (typeof evmAddress === 'string' ? { evmAddress: evmAddress.toLowerCase() } : {})), { environment });
-}
-async function signerPageUrl() {
-    const cfg = await getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
-}
-let requestSeq$1 = 0;
-/**
- * Open the Bounded signer popup, send `action` to it, and resolve with the
- * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
- * the browser will block the popup — in which case this rejects with a clear
- * "Popup blocked" error telling the app to call from a user gesture.
- *
- * Non-custodial: the popup gates signing behind an email OTP delivered to the
- * wallet's owner, and validates that the wallet address matches the account.
- */
-async function signViaSignerPopup(action) {
-    if (!hasDOM$5()) {
-        throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
-    }
-    const isEvm = action.kind === 'evmTransaction';
-    const claims = walletClaimsFromSession(isEvm ? 'evm' : 'solana');
-    if (!claims)
-        throw new Error(NO_EMBEDDED_WALLET);
-    const { url, origin: signerOrigin } = await signerPageUrl();
-    const requestId = `bsign_${Date.now()}_${++requestSeq$1}`;
-    // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
-    const w = 420, h = 600;
-    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
-    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-wallet-signer', `width=${w},height=${h},left=${left},top=${top}`);
-    if (!popup) {
-        throw new Error('Popup blocked — call signAndSubmitTransaction() from a user gesture (e.g. a click handler) so the wallet approval window can open.');
-    }
-    const request = {
-        type: 'bounded:sign',
-        requestId,
-        environment: claims.environment, // may be undefined → page auto-detects
-        email: claims.email,
-        address: isEvm ? claims.evmAddress : claims.address,
-        action,
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
     };
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        let closeTimer;
-        let sentRequest = false;
-        const cleanup = () => {
-            settled = true;
-            window.removeEventListener('message', onMsg);
-            if (closeTimer)
-                clearInterval(closeTimer);
-        };
-        const sendRequest = () => {
-            if (sentRequest)
-                return;
-            sentRequest = true;
-            try {
-                popup.postMessage(request, signerOrigin);
-            }
-            catch ( /* popup gone */_a) { /* popup gone */ }
-        };
-        const onMsg = (ev) => {
-            if (ev.origin !== signerOrigin)
-                return; // only trust the signer page origin
-            if (ev.source !== popup)
-                return; // only trust this signer popup window
-            const d = ev.data;
-            if (!d || typeof d !== 'object')
-                return;
-            if (d.type === 'bounded:signer:ready') {
-                sendRequest();
-                return;
-            }
-            if (d.type === 'bounded:signer:result' && d.requestId === requestId) {
-                cleanup();
-                try {
-                    popup.close();
-                }
-                catch ( /* ignore */_a) { /* ignore */ }
-                if (d.ok)
-                    resolve({ hash: d.hash, explorerLink: d.explorerLink, transactionId: d.transactionId });
-                else
-                    reject(new Error(String(d.error || 'Wallet signing failed')));
-            }
-        };
-        window.addEventListener('message', onMsg);
-        // Fallback: if the ready ping was missed (fast load / focus race), push the
-        // request shortly after opening. The page ignores it until a bounded:sign
-        // arrives and only acts on the first one, so a duplicate is harmless.
-        setTimeout(sendRequest, 1200);
-        // If the user closes the popup before completing, reject (unless a result
-        // just arrived — give any in-flight message a beat to settle first).
-        closeTimer = setInterval(() => {
-            if (popup.closed) {
-                clearInterval(closeTimer);
-                setTimeout(() => { if (!settled) {
-                    cleanup();
-                    reject(new Error('Wallet approval window was closed before signing completed.'));
-                } }, 400);
-            }
-        }, 500);
-        // Overall safety timeout (OTP + signing). Generous — the user may take a
-        // while to fetch the code from their email.
-        setTimeout(() => { if (!settled) {
-            cleanup();
-            try {
-                popup.close();
-            }
-            catch ( /* ignore */_a) { /* ignore */ }
-            reject(new Error('Wallet approval timed out.'));
-        } }, 5 * 60 * 1000);
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
     });
+    modal = m;
+    return m;
 }
-// Serialize a legacy or versioned Solana transaction to BASE58 for the signer
-// page. Crossmint's smart-wallet createTransaction endpoint requires the
-// `serializedTransaction` string to be base58 — it rejects base64 with
-// "Invalid base58 string" (verified against Crossmint staging 2026-07-07). The
-// `wallets-sdk` object path bs58-encodes internally, so base58 is the contract.
-//
-// We do NOT require existing signatures (the smart wallet signs on the page);
-// Crossmint extracts the instructions, overrides the fee payer to its sponsor,
-// and re-wraps them for the smart wallet.
-function serializeTransaction(transaction) {
-    const isLegacy = 'recentBlockhash' in transaction &&
-        !('message' in transaction && 'staticAccountKeys' in transaction.message);
-    const bytes = isLegacy
-        ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
-        : transaction.serialize();
-    return bs58.encode(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    window.setTimeout(() => {
+        m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+// True outer height of the mounted card: the max of its padding-box scroll height
+// (catches overflowing descendants) and its border-box height plus own vertical
+// margins (catches border + margins, which scrollHeight omits). Ceiled so a
+// sub-pixel row is never clipped under `overflow:hidden`.
+function measureOuterHeight(target) {
+    var _a;
+    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
+    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
+    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
+    const rect = target.getBoundingClientRect().height;
+    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
 }
 /**
- * Whether the active session carries an embedded wallet (so the provider should
- * route signing through the popup rather than throw "no wallet").
+ * Measure the currently mounted native content and tween the panel to fit it.
+ * Re-fits automatically when the card's intrinsic height changes - notably after
+ * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
+ * after first paint) and on inline view swaps (email -> OTP code -> success).
  */
-function hasEmbeddedWallet() {
-    return walletClaimsFromSession() != null;
-}
-/** Whether the active email/social session carries an embedded Crossmint EVM wallet. */
-function hasEmbeddedEvmWallet() {
-    return walletClaimsFromSession('evm') != null;
-}
-/** signAndSubmitTransaction for embedded wallets: serialize + route through the
- *  signer popup, resolve with the on-chain transaction signature/hash. */
-async function embeddedSignAndSubmit(transaction) {
-    const serializedTransaction = serializeTransaction(transaction);
-    const result = await signViaSignerPopup({ kind: 'transaction', serializedTransaction });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no transaction hash.');
-    return hash;
-}
-/** Submit a validated BoundedRuntime EVM write through the user's email signer. */
-async function embeddedRunEvmTransaction(transaction) {
+function fitPanelToContent(m) {
     var _a, _b;
-    if (!transaction.to || !transaction.data || !transaction.chainId)
-        throw new Error('Incomplete embedded EVM transaction');
-    if (!/^0x[0-9a-fA-F]{40}$/.test(transaction.to))
-        throw new Error('Invalid embedded EVM runtime address');
-    assertCanonicalBoundedRuntimeWriteCalldata(transaction.data);
-    if (!Number.isSafeInteger(transaction.chainId) || transaction.chainId <= 0)
-        throw new Error('Invalid embedded EVM chain id');
-    if (transaction.nonce !== undefined)
-        throw new Error('Server-supplied EVM nonces are not accepted');
-    try {
-        if (BigInt((_a = transaction.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
-            throw new Error('Bounded EVM writes cannot transfer native value');
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.includes('cannot transfer'))
-            throw error;
-        throw new Error('Invalid embedded EVM transaction value');
+    const first = m.content.firstElementChild;
+    const target = first || m.content;
+    const apply = () => {
+        // Only fit while this exact node is still the mounted card.
+        if (m.content.firstElementChild !== first && first)
+            return;
+        const h = measureOuterHeight(target);
+        if (h > 0)
+            setPanelHeight(m, h);
+    };
+    apply();
+    const view = target.ownerDocument.defaultView;
+    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
+    // have painted, so the height never lags a late reflow.
+    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
+    const fonts = target.ownerDocument.fonts;
+    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
+        fonts.ready.then(apply).catch(() => { });
+    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
+    m.fitObserver = null;
+    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
+        const ro = new view.ResizeObserver(() => apply());
+        ro.observe(first);
+        m.fitObserver = ro;
     }
-    const result = await signViaSignerPopup({
-        kind: 'evmTransaction',
-        transaction: { to: transaction.to, data: transaction.data, value: (_b = transaction.value) !== null && _b !== void 0 ? _b : '0', chainId: transaction.chainId },
-    });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no EVM transaction hash.');
-    return { transactionSignature: hash, blockNumber: 0, gasUsed: '0', data: result };
+}
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
+function mountContent(m, node) {
+    var _a;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.replaceChildren(node);
+    m.content.style.display = "block";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin) {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
+    // inside the frame from the user's click (transient activation stays in-frame).
+    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.onIframeMessage = null;
+}
+// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
+// JetBrains Mono) once at the document level so they apply inside the shadow root. A
+// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
+const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+function ensureFonts() {
+    if (!hasDOM$4())
+        return;
+    if (document.querySelector('link[data-bounded-fonts="1"]'))
+        return;
+    const pre1 = document.createElement("link");
+    pre1.rel = "preconnect";
+    pre1.href = "https://fonts.googleapis.com";
+    const pre2 = document.createElement("link");
+    pre2.rel = "preconnect";
+    pre2.href = "https://fonts.gstatic.com";
+    pre2.crossOrigin = "anonymous";
+    const link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = FONTS_HREF;
+    link.setAttribute("data-bounded-fonts", "1");
+    document.head.append(pre1, pre2, link);
 }
 
-// Same message the email provider uses when a hosted (OIDC) login has no
-// embedded wallet — enable `auth.wallets` in policy to get one.
-const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so logins get a non-custodial Crossmint wallet (@user.address), ' +
-    'then sign from a user gesture.';
-const PKCE_STORE_KEY = 'bounded.oidc.pkce';
-const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
-const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
-// Active session store (Web on web, RN on React Native) — selected by config,
-// not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
-// session it mints is read back through this same selector everywhere.
-const sessionManager = getActiveSessionManager;
-function hasDOM$4() {
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app card plus
+// the OS Face ID / Touch ID sheet, never a jarring popup.
+//
+// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
+// MUST run on the single Bounded signer origin. The iframe carries the
+// publickey-credentials-{get,create} permission policy and the user's click lands
+// INSIDE it, giving WebAuthn the transient activation it needs.
+//
+// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
+// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
+// SAME request through `popupFallback` (a real window). Callers pass a popup
+// implementation and never see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
+ * (Safari cross-origin create) or cannot be mounted.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$4())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        let settled = false;
+        let usedFallback = false;
+        const iframe = ensureIframe(m, url, signerOrigin);
+        const send = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                m.iframeReady = true;
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
+                goFallback();
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
+// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
+// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
+//
+// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
+// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
+// look + motion, so signing feels native. Safari (unreliable at iframe passkey
+// CREATE) and any environment where the frame cannot mount fall back to a real
+// popup window; both transports speak the same postMessage protocol.
+//
+// Turnkey wallets produce raw detached signatures. The signer runs the Turnkey
+// browser SDK on the single Bounded origin and stamps an ed25519 signRawPayload
+// with the user's passkey. The app retains the transaction itself.
+//
+// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
+// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
+// every user one wallet + one passkey that roams across every app.
+function hasDOM$3() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
-function decodeJwt(token) {
+// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
+// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
+// fail - and a post-failure popup would no longer have a user gesture to open with.
+// There we pick the popup up front, from the original click, so enrollment is solid.
+// Everywhere else the inline widget is used (buttery in-app modal).
+function preferPopup() {
+    if (!hasDOM$3() || typeof navigator === 'undefined')
+        return true;
+    const ua = navigator.userAgent || '';
+    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+}
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (Safari enrollment, or the frame never loads).
+async function deliver(url, origin, ex) {
+    const popup = () => runPopup(url, origin, ex);
+    if (preferPopup())
+        return popup();
+    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+}
+async function turnkeySignerPage() {
+    const cfg = await getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+function toHex(bytes) {
+    let h = '';
+    for (const b of bytes)
+        h += b.toString(16).padStart(2, '0');
+    return h;
+}
+function fromHex(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(clean.substr(i * 2, 2), 16);
+    return out;
+}
+function decodeJwt$1(token) {
     try {
-        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
-        const pad = b64.length % 4;
-        if (pad === 2)
-            b64 += '==';
-        else if (pad === 3)
-            b64 += '=';
-        return JSON.parse(getPlatform().atob(b64));
+        let value = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padding = value.length % 4;
+        if (padding === 2)
+            value += '==';
+        else if (padding === 3)
+            value += '=';
+        return JSON.parse(getPlatform().atob(value));
     }
     catch (_a) {
         return {};
     }
 }
-// A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
-// Signing surface (slice 2): a hosted login on a wallets-enabled app carries an
-// embedded Crossmint wallet (@user.address). signAndSubmitTransaction routes
-// through the Bounded signer popup; signMessage/signTransaction are structurally
-// unsupported for Crossmint smart wallets (sign+submit atomically, no raw sig).
-const oidcProviderSingleton = {
-    async login() {
-        const idToken = sessionManager().getIdToken();
-        return idToken ? userFromIdToken(idToken) : null;
-    },
-    async getUser() {
-        const idToken = sessionManager().getIdToken();
-        return idToken ? userFromIdToken(idToken) : null;
+function activeTurnkeyAddress() {
+    let token = null;
+    try {
+        token = getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        token = null;
+    }
+    if (!token)
+        return null;
+    const claims = decodeJwt$1(token);
+    const address = claims['custom:walletAddress'];
+    const provider = claims['custom:walletProvider'];
+    return provider === 'turnkey' && typeof address === 'string' && address
+        ? address
+        : null;
+}
+let requestSeq = 0;
+// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
+// resolve when `onResult` accepts a result message. Origin + source are pinned.
+async function runPopup(url, signerOrigin, ex) {
+    var _a, _b;
+    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    if (!popup) {
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+    }
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let sentRequest = false;
+        let closeTimer;
+        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
+            clearInterval(closeTimer); };
+        const sendRequest = () => { if (sentRequest)
+            return; sentRequest = true; try {
+            popup.postMessage(ex.request, signerOrigin);
+        }
+        catch ( /* popup gone */_a) { /* popup gone */ } };
+        const onMsg = (event) => {
+            if (event.origin !== signerOrigin)
+                return;
+            if (event.source !== popup)
+                return;
+            const d = event.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:turnkey:ready') {
+                sendRequest();
+                return;
+            }
+            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
+                const outcome = ex.onResult(d);
+                if ('error' in outcome) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    reject(new Error(outcome.error));
+                    return;
+                }
+                if (outcome.done) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
+                    resolve(outcome.value);
+                }
+            }
+        };
+        window.addEventListener('message', onMsg);
+        setTimeout(sendRequest, 1200);
+        closeTimer = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(closeTimer);
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Wallet approval window was closed before it completed.'));
+                } }, 400);
+            }
+        }, 500);
+        setTimeout(() => { if (!settled) {
+            cleanup();
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+            reject(new Error('Wallet approval timed out.'));
+        } }, 5 * 60 * 1000);
+    });
+}
+function hasTurnkeyWallet() {
+    return activeTurnkeyAddress() !== null;
+}
+/**
+ * Get-or-create the user's non-custodial Turnkey wallet, resolving with its stable
+ * Solana address. On first use the popup enrolls a device passkey (Face ID / Touch ID)
+ * and creates the wallet (lazy) with no email code; if the wallet already exists it
+ * resolves immediately without a prompt. Call from a USER GESTURE.
+ *
+ * Use this to learn the fee-payer address BEFORE building a transaction to sign.
+ */
+async function getOrCreateTurnkeyWallet() {
+    if (!hasDOM$3())
+        throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:createWallet', requestId },
+        onResult: (d) => {
+            if (d.ok && typeof d.address === 'string')
+                return { done: true, value: { address: d.address, subOrgId: String(d.subOrgId || '') } };
+            return { error: String(d.error || 'Wallet setup failed') };
+        },
+    });
+}
+/**
+ * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
+ * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
+ * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
+ * browser blocks the popup.
+ *
+ * On the user's FIRST signature the popup transparently enrolls a device passkey
+ * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
+ * signatures are just a passkey approval.
+ */
+async function signSolanaMessageViaTurnkey(message) {
+    if (!hasDOM$3()) {
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
+    const messageHex = toHex(message);
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
+        onResult: (d) => {
+            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
+            }
+            return { error: String(d.error || 'Turnkey signing failed') };
+        },
+    });
+}
+function requireMatchingAddress(result) {
+    const expected = activeTurnkeyAddress();
+    if (!expected)
+        throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+    if (result.address !== expected)
+        throw new Error('Turnkey signer returned a different wallet address than the active session.');
+    return expected;
+}
+async function signMessageWithTurnkey(message) {
+    const result = await signSolanaMessageViaTurnkey(getPlatform().textEncode(message));
+    requireMatchingAddress(result);
+    return bs58.encode(result.signature);
+}
+async function signTransactionWithTurnkey(transaction) {
+    const isLegacy = 'serializeMessage' in transaction;
+    const message = isLegacy
+        ? transaction.serializeMessage()
+        : transaction.message.serialize();
+    const result = await signSolanaMessageViaTurnkey(new Uint8Array(message));
+    const address = requireMatchingAddress(result);
+    const { PublicKey } = await import('@solana/web3.js');
+    if (isLegacy) {
+        transaction.addSignature(new PublicKey(address), bufferExports.Buffer.from(result.signature));
+    }
+    else {
+        transaction.addSignature(new PublicKey(address), result.signature);
+    }
+    return transaction;
+}
+async function signAndSubmitTransactionWithTurnkey(transaction, feePayer) {
+    var _a;
+    const config = await getConfig();
+    const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+    if (!rpcUrl)
+        throw new Error('Turnkey transaction submission requires init({ rpcUrl }).');
+    const { Connection, PublicKey } = await import('@solana/web3.js');
+    const connection = new Connection(rpcUrl, 'confirmed');
+    const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
+    const isLegacy = 'serializeMessage' in transaction;
+    if (isLegacy) {
+        const legacy = transaction;
+        legacy.recentBlockhash = blockhash;
+        legacy.lastValidBlockHeight = lastValidBlockHeight;
+        if (!legacy.feePayer) {
+            const address = activeTurnkeyAddress();
+            if (!address)
+                throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+            legacy.feePayer = feePayer !== null && feePayer !== void 0 ? feePayer : new PublicKey(address);
+        }
+    }
+    else {
+        transaction.message.recentBlockhash = blockhash;
+    }
+    const signed = await signTransactionWithTurnkey(transaction);
+    const signature = await connection.sendRawTransaction(signed.serialize(), {
+        skipPreflight: false,
+        maxRetries: 3,
+    });
+    const confirmation = await connection.confirmTransaction({ signature, blockhash, lastValidBlockHeight }, 'confirmed');
+    if (confirmation.value.err) {
+        throw new Error(`Turnkey transaction failed: ${JSON.stringify(confirmation.value.err)}`);
+    }
+    return signature;
+}
+
+// Same message the email provider uses when a hosted (OIDC) login has no
+// embedded wallet — enable `auth.wallets` in policy to get one.
+const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +
+    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';
+const PKCE_STORE_KEY = 'bounded.oidc.pkce';
+const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
+const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
+// Active session store (Web on web, RN on React Native) — selected by config,
+// not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
+// session it mints is read back through this same selector everywhere.
+const sessionManager = getActiveSessionManager;
+function hasDOM$2() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+function decodeJwt(token) {
+    try {
+        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const pad = b64.length % 4;
+        if (pad === 2)
+            b64 += '==';
+        else if (pad === 3)
+            b64 += '=';
+        return JSON.parse(getPlatform().atob(b64));
+    }
+    catch (_a) {
+        return {};
+    }
+}
+// A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
+// Turnkey supplies the default Solana wallet and supports raw message and transaction
+// signatures through the Bounded signer window.
+const oidcProviderSingleton = {
+    async login() {
+        const idToken = sessionManager().getIdToken();
+        return idToken ? userFromIdToken(idToken) : null;
+    },
+    async getUser() {
+        const idToken = sessionManager().getIdToken();
+        return idToken ? userFromIdToken(idToken) : null;
     },
     async logout() { await sessionManager().clearSession(); },
-    async signMessage(_message) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signMessage(message) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signMessageWithTurnkey(message);
     },
-    async signTransaction(_t) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signTransaction(transaction) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signTransactionWithTurnkey(transaction);
     },
-    async runTransaction(evm, sol, options) {
+    async runTransaction(evm, sol, _options) {
         if (evm && sol)
             throw new Error('A transaction cannot target EVM and Solana at the same time.');
-        if (!evm)
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
-            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');
-        if (!hasEmbeddedEvmWallet())
-            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');
-        return embeddedRunEvmTransaction(evm);
+        if (evm)
+            throw new Error('Turnkey embedded wallets currently support Solana only. Connect an EVM wallet for EVM transactions.');
+        throw new Error('This Solana transaction shape is not supported by the Turnkey provider. Use a pre-built transaction.');
     },
-    async signAndSubmitTransaction(transaction, _feePayer) {
-        if (!hasEmbeddedWallet())
+    async signAndSubmitTransaction(transaction, feePayer) {
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        return embeddedSignAndSubmit(transaction);
+        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);
     },
 };
 function userFromIdToken(idToken) {
     const c = decodeJwt(idToken);
     const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';
     return {
-        id, address: (c['custom:walletAddress'] || null),
-        evmAddress: typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])
-            ? c['custom:evmWalletAddress'].toLowerCase()
-            : null,
+        id,
+        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),
+        evmAddress: null,
         email: (c.email || null), provider: oidcProviderSingleton,
     };
 }
@@ -3831,7 +4227,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM$4() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$2() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3939,7 +4335,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM$4())
+    if (!hasDOM$2())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3955,7 +4351,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM$4())
+    if (!hasDOM$2())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4001,7 +4397,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM$4())
+    if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4141,7 +4537,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$4() || !window.opener)
+    if (!hasDOM$2() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4477,14 +4873,13 @@ function getInitConfig() {
     return initConfig;
 }
 /**
- * Which LOGIN mode the app runs (default "bounded"). "turnkey" opts the app into
- * Turnkey-native email OTP: the unified widget runs the code entry INLINE (no OIDC
- * popup) via startTurnkeyEmailLogin(), and Bounded mints the session from Turnkey's
- * verification. The value comes from init() config (`authMode`); a `openBoundedWidget`
- * option can override it per call. Anything other than "turnkey" is "bounded".
+ * Which LOGIN mode the app runs (default "turnkey"). Turnkey-native email OTP keeps
+ * code entry inline in the unified widget (no OIDC popup), and Bounded mints the
+ * session from Turnkey's verification. Apps can explicitly select "bounded" for the
+ * legacy Better Auth email flow. A per-call openBoundedWidget option can override it.
  */
 function resolveAuthMode(config) {
-    return config.authMode === 'turnkey' ? 'turnkey' : 'bounded';
+    return config.authMode === 'bounded' ? 'bounded' : 'turnkey';
 }
 /**
  * Resolve the injected-wallet-config the provider should use, merging the
@@ -4545,7 +4940,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-B3XaJw-G.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-v9xvY0Ky.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4564,7 +4959,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DfJvN3sV.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-YHhhFzsj.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4577,7 +4972,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-DSFDC8fh.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-DlPsOmik.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4605,7 +5000,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-BBSFawAr.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-BLRbjAv2.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4661,7 +5056,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-BBSFawAr.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-BLRbjAv2.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4812,7 +5207,7 @@ async function loginWithWallet(options) {
         ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
     const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
     const network = getConfiguredSolanaNetwork(cfg);
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-DfJvN3sV.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-YHhhFzsj.mjs');
     let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
     if (coreConfig.chain === 'offchain')
         provider = new OffchainAuthProvider(provider);
@@ -5212,276 +5607,23 @@ function setAuthProviderInstance(provider) {
     authProviderInstance = provider;
 }
 
-// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
-// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
-// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
-// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
-//
-// It hosts EITHER:
-//   - NATIVE content (the login card the SDK renders itself), or
-//   - an IFRAME (the Bounded-owned signer page, which must run on the single
-//     signer origin because a WebAuthn passkey is bound to one origin).
-//
-// The modal is a warm singleton: it stays mounted (hidden) between uses so a
-// second open - or a signature right after login - is instant and, when it is
-// already open, a clean in-place view swap rather than a reopen.
-function hasDOM$3() {
-    return typeof window !== "undefined" && typeof document !== "undefined";
-}
-const OVERLAY_CSS = `
-:host{all:initial}
-*{box-sizing:border-box}
-.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
-.bw-ov.mounted{display:block}
-.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
-  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
-.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
-.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
-  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
-  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
-  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
-  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
-    height .3s cubic-bezier(.2,.8,.2,1)}
-.bw-ov.show .bw-back{opacity:1}
-.bw-ov.show .bw-panel{opacity:1;transform:none}
-.bw-ov.closing .bw-back{opacity:0}
-.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
-.bw-content{position:absolute;inset:0;overflow:hidden}
-.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
-/* editorial corner crop-marks, matching the reference frame */
-.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
-  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
-.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
-.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
-.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
-.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
-@media(max-width:560px){
-  .bw-wrap{align-items:flex-end;padding:0}
-  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
-  .bw-content{overflow-y:auto}
-  .bw-ov.show .bw-panel{transform:none}
-  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
-}
-@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
-`;
-let modal = null;
-function getModal() {
-    if (modal)
-        return modal;
-    const root = document.createElement("div");
-    root.setAttribute("data-bounded-widget", "");
-    const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
-    const overlay = document.createElement("div");
-    overlay.className = "bw-ov";
-    const back = document.createElement("div");
-    back.className = "bw-back";
-    const wrap = document.createElement("div");
-    wrap.className = "bw-wrap";
-    const panel = document.createElement("div");
-    panel.className = "bw-panel";
-    const content = document.createElement("div");
-    content.className = "bw-content";
-    panel.appendChild(content);
-    for (const corner of ["tl", "tr", "bl", "br"]) {
-        const mk = document.createElement("span");
-        mk.className = "bw-mk " + corner;
-        panel.appendChild(mk);
-    }
-    wrap.appendChild(panel);
-    overlay.appendChild(back);
-    overlay.appendChild(wrap);
-    shadow.appendChild(overlay);
-    (document.body || document.documentElement).appendChild(root);
-    const m = {
-        root,
-        overlay,
-        panel,
-        content,
-        iframe: null,
-        iframeOrigin: "",
-        iframeReady: false,
-        onBackdrop: null,
-        onIframeMessage: null,
-        chain: Promise.resolve(),
-        fitObserver: null,
-    };
-    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
-    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
-    // outside the panel. Fire only when the click lands on the wrap itself, never
-    // when it bubbles up from the panel or its content.
-    wrap.addEventListener("click", (event) => {
-        if (event.target === wrap && m.onBackdrop)
-            m.onBackdrop();
-    });
-    window.addEventListener("message", (event) => {
-        if (!m.iframe)
-            return;
-        if (event.origin !== m.iframeOrigin)
-            return;
-        if (event.source !== m.iframe.contentWindow)
-            return;
-        const d = event.data;
-        if (!d || typeof d !== "object")
-            return;
-        if (m.onIframeMessage)
-            m.onIframeMessage(d);
-    });
-    modal = m;
-    return m;
-}
-function showModal(m) {
-    m.overlay.classList.remove("closing");
-    m.overlay.classList.add("mounted");
-    // Force a reflow so the .show transition runs from the hidden state every open.
-    void m.panel.offsetWidth;
-    m.overlay.classList.add("show");
-}
-function hideModal(m, after) {
-    m.overlay.classList.remove("show");
-    m.overlay.classList.add("closing");
-    window.setTimeout(() => {
-        m.overlay.classList.remove("mounted", "closing");
-    }, 260);
-}
-function setPanelHeight(m, px) {
-    const h = Math.max(140, Math.min(680, Math.round(px)));
-    m.panel.style.height = h + "px";
-}
-// True outer height of the mounted card: the max of its padding-box scroll height
-// (catches overflowing descendants) and its border-box height plus own vertical
-// margins (catches border + margins, which scrollHeight omits). Ceiled so a
-// sub-pixel row is never clipped under `overflow:hidden`.
-function measureOuterHeight(target) {
-    var _a;
-    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
-    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
-    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
-    const rect = target.getBoundingClientRect().height;
-    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
-}
-/**
- * Measure the currently mounted native content and tween the panel to fit it.
- * Re-fits automatically when the card's intrinsic height changes - notably after
- * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
- * after first paint) and on inline view swaps (email -> OTP code -> success).
- */
-function fitPanelToContent(m) {
-    var _a, _b;
-    const first = m.content.firstElementChild;
-    const target = first || m.content;
-    const apply = () => {
-        // Only fit while this exact node is still the mounted card.
-        if (m.content.firstElementChild !== first && first)
-            return;
-        const h = measureOuterHeight(target);
-        if (h > 0)
-            setPanelHeight(m, h);
-    };
-    apply();
-    const view = target.ownerDocument.defaultView;
-    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
-    // have painted, so the height never lags a late reflow.
-    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
-    const fonts = target.ownerDocument.fonts;
-    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
-        fonts.ready.then(apply).catch(() => { });
-    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
-    m.fitObserver = null;
-    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
-        const ro = new view.ResizeObserver(() => apply());
-        ro.observe(first);
-        m.fitObserver = ro;
-    }
-}
-/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
-function mountContent(m, node) {
-    var _a;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.replaceChildren(node);
-    m.content.style.display = "block";
-}
-/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
-function ensureIframe(m, url, origin) {
-    var _a;
-    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
-        return m.iframe;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.style.display = "none";
-    const iframe = document.createElement("iframe");
-    iframe.className = "bw-frame";
-    iframe.setAttribute("title", "Bounded");
-    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
-    // inside the frame from the user's click (transient activation stays in-frame).
-    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
-    iframe.src = url;
-    m.iframeOrigin = origin;
-    m.iframeReady = false;
-    m.panel.appendChild(iframe);
-    m.iframe = iframe;
-    return iframe;
-}
-function detachIframe(m) {
-    if (m.iframe) {
-        try {
-            m.iframe.remove();
-        }
-        catch (_a) {
-            /* ignore */
-        }
-    }
-    m.iframe = null;
-    m.iframeReady = false;
-    m.iframeOrigin = "";
-    m.onIframeMessage = null;
-}
-// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
-// JetBrains Mono) once at the document level so they apply inside the shadow root. A
-// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
-const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
-function ensureFonts() {
-    if (!hasDOM$3())
-        return;
-    if (document.querySelector('link[data-bounded-fonts="1"]'))
-        return;
-    const pre1 = document.createElement("link");
-    pre1.rel = "preconnect";
-    pre1.href = "https://fonts.googleapis.com";
-    const pre2 = document.createElement("link");
-    pre2.rel = "preconnect";
-    pre2.href = "https://fonts.gstatic.com";
-    pre2.crossOrigin = "anonymous";
-    const link = document.createElement("link");
-    link.rel = "stylesheet";
-    link.href = FONTS_HREF;
-    link.setAttribute("data-bounded-fonts", "1");
-    document.head.append(pre1, pre2, link);
-}
-
-var __classPrivateFieldGet = (undefined && undefined.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var __classPrivateFieldSet = (undefined && undefined.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var _AppReadyEvent_detail;
-let wallets = undefined;
-const registeredWalletsSet = new Set();
-function addRegisteredWallet(wallet) {
-    cachedWalletsArray = undefined;
-    registeredWalletsSet.add(wallet);
+var __classPrivateFieldGet = (undefined && undefined.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (undefined && undefined.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AppReadyEvent_detail;
+let wallets = undefined;
+const registeredWalletsSet = new Set();
+function addRegisteredWallet(wallet) {
+    cachedWalletsArray = undefined;
+    registeredWalletsSet.add(wallet);
 }
 function removeRegisteredWallet(wallet) {
     cachedWalletsArray = undefined;
@@ -5753,7 +5895,7 @@ function discoverStandardWallets() {
     return out;
 }
 
-function hasDOM$2() {
+function hasDOM$1() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 async function signerOrigin() {
@@ -5830,7 +5972,7 @@ function sealOtpInIframe(code, otpEncryptionTargetBundle) {
  * step needs the signer iframe); on React Native use loginWithRedirect() instead.
  */
 async function startTurnkeyEmailLogin(email) {
-    if (!hasDOM$2()) {
+    if (!hasDOM$1()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
     const trimmed = email.trim();
@@ -6019,7 +6161,7 @@ function el(tag, cls, text) {
  */
 async function openBoundedWidget(opts = {}) {
     var _a, _b, _c, _d, _e, _f, _g, _h;
-    if (!hasDOM$3()) {
+    if (!hasDOM$4()) {
         throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
     }
     // Imported lazily to avoid a static cycle with the auth index barrel.
@@ -6392,1014 +6534,718 @@ function useAuth() {
             // Only log errors that aren't user-initiated cancellations
             if (error !== 'exited_auth_flow' && (error === null || error === void 0 ? void 0 : error.message) !== 'exited_auth_flow') {
                 console.error('Error logging in:', error);
-            }
-            setUser(null);
-        }
-        finally {
-            setLoading(false);
-        }
-    };
-    const logout$1 = async () => {
-        try {
-            setLoading(true);
-            await logout();
-            setUser(null);
-        }
-        catch (error) {
-            console.error('Error logging out:', error);
-        }
-        finally {
-            setLoading(false);
-        }
-    };
-    return {
-        login: login$1,
-        logout: logout$1,
-        loading: loading || sdkLoading,
-        user,
-    };
-}
-
-var _a$1;
-// SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
-// React Native has no `window` but DOES support hooks, so detect Node SSR
-// specifically via process.versions.node.
-const isSSR$1 = typeof window === 'undefined'
-    && typeof process !== 'undefined'
-    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
-function useQuery(path, options) {
-    if (isSSR$1) {
-        return { data: undefined, loading: true, error: null };
-    }
-    const [data, setData] = React.useState(undefined);
-    const [loading, setLoading] = React.useState(true);
-    const [error, setError] = React.useState(null);
-    // Re-subscribe only when the query actually changes (not on every render).
-    const optionsKey = options ? JSON.stringify(options) : '';
-    React.useEffect(() => {
-        if (!path) {
-            setData(undefined);
-            setLoading(false);
-            setError(null);
-            return;
-        }
-        let active = true;
-        let unsubscribe;
-        setLoading(true);
-        setError(null);
-        subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
-                if (!active)
-                    return;
-                // A reconnect can legitimately surface a transport error before the
-                // socket re-authenticates and sends a new authorized snapshot. That
-                // fresh snapshot is the recovery boundary: keep the error visible
-                // until data arrives, then clear it so React does not remain stuck on
-                // a failure page after realtime has recovered.
-                setError(null);
-                setData(d);
-                setLoading(false);
-            }, onError: (e) => {
-                if (!active)
-                    return;
-                setError(e instanceof Error ? e : new Error(String(e)));
-                setLoading(false);
-            } }))
-            .then((unsub) => {
-            if (active)
-                unsubscribe = unsub;
-            else
-                void unsub(); // unmounted before subscribe resolved
-        })
-            .catch((e) => {
-            if (!active)
-                return;
-            setError(e instanceof Error ? e : new Error(String(e)));
-            setLoading(false);
-        });
-        return () => {
-            active = false;
-            void (unsubscribe === null || unsubscribe === void 0 ? void 0 : unsubscribe());
-        };
-        // optionsKey captures the option object's contents; path is the other input.
-        // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [path, optionsKey]);
-    return { data, loading, error };
-}
-
-// Wrapper for getIdToken - passes isServer=false for client-side usage
-async function getIdToken() {
-    return getIdToken$1(false);
-}
-
-var __rest = (undefined && undefined.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-/** A structured non-2xx response from the developer API. */
-class BuildsApiError extends Error {
-    constructor(init) {
-        super(init.message);
-        this.name = 'BuildsApiError';
-        this.code = init.code;
-        this.retryable = init.retryable;
-        this.status = init.status;
-        this.details = init.details;
-        this.retryAfterMs = init.retryAfterMs;
-    }
-}
-const memoryIdempotencyKeys = new Map();
-const IDEMPOTENCY_STORAGE_PREFIX = 'bounded:build:idempotency:';
-function retryAfterMs(response) {
-    var _a, _b;
-    const value = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'Retry-After');
-    if (!value)
-        return undefined;
-    const seconds = Number(value);
-    if (Number.isFinite(seconds) && seconds >= 0)
-        return Math.ceil(seconds * 1000);
-    const at = Date.parse(value);
-    if (!Number.isFinite(at))
-        return undefined;
-    return Math.max(0, at - Date.now());
-}
-async function responseBody(response) {
-    const text = await response.text();
-    if (!text)
-        return {};
-    try {
-        return JSON.parse(text);
-    }
-    catch (_a) {
-        return { raw: text };
-    }
-}
-function apiError(response, body) {
-    const envelope = body;
-    const nested = (envelope === null || envelope === void 0 ? void 0 : envelope.error) && typeof envelope.error === 'object'
-        ? envelope.error
-        : undefined;
-    const hasNestedDetails = !!nested && Object.prototype.hasOwnProperty.call(nested, 'details');
-    const hasTopLevelDetails = !!body
-        && typeof body === 'object'
-        && Object.prototype.hasOwnProperty.call(body, 'details');
-    const legacyCode = typeof (body === null || body === void 0 ? void 0 : body.error) === 'string' ? body.error : undefined;
-    const code = typeof (nested === null || nested === void 0 ? void 0 : nested.code) === 'string'
-        ? nested.code
-        : legacyCode !== null && legacyCode !== void 0 ? legacyCode : `http_${response.status}`;
-    const message = typeof (nested === null || nested === void 0 ? void 0 : nested.message) === 'string'
-        ? nested.message
-        : typeof (body === null || body === void 0 ? void 0 : body.message) === 'string'
-            ? body.message
-            : `Developer API request failed with HTTP ${response.status}`;
-    const retryable = typeof (nested === null || nested === void 0 ? void 0 : nested.retryable) === 'boolean'
-        ? nested.retryable
-        : response.status === 429 || response.status >= 500;
-    return new BuildsApiError(Object.assign(Object.assign({ code,
-        message,
-        retryable, status: response.status }, (hasNestedDetails
-        ? { details: nested === null || nested === void 0 ? void 0 : nested.details }
-        : hasTopLevelDetails
-            ? { details: body.details }
-            : {})), (response.status === 429 ? { retryAfterMs: retryAfterMs(response) } : {})));
-}
-/** @internal Shared authenticated developer-api transport for builds and apps. */
-async function requestDevApi(path, request = {}) {
-    var _a, _b;
-    const config = await getConfig();
-    const base = (_a = config.devApiUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/$/, '');
-    if (!base) {
-        throw new Error('Bounded developer API is not configured. Pass devApiUrl or a Bounded network to init().');
-    }
-    // Reuse the exact accessor exposed publicly as getIdToken().
-    const token = await getIdToken();
-    if (!token) {
-        throw new BuildsApiError({
-            code: 'auth_required',
-            message: 'Sign in before calling the Bounded developer API.',
-            retryable: false,
-            status: 401,
-        });
-    }
-    const hasBody = request.body !== undefined;
-    const response = await fetch(`${base}${path}`, Object.assign({ method: (_b = request.method) !== null && _b !== void 0 ? _b : 'GET', headers: Object.assign({ Authorization: `Bearer ${token}` }, (hasBody ? { 'Content-Type': 'application/json' } : {})) }, (hasBody ? { body: JSON.stringify(request.body) } : {})));
-    const body = await responseBody(response);
-    if (!response.ok)
-        throw apiError(response, body);
-    return body;
-}
-function intentStorageKey(intentKey) {
-    return `${IDEMPOTENCY_STORAGE_PREFIX}${intentKey}`;
-}
-function isValidIdempotencyKey(value) {
-    return typeof value === 'string' && value.length > 0 && value.length <= 256;
-}
-function readPersistedIdempotencyKey(intentKey) {
-    var _a;
-    const storageKey = intentStorageKey(intentKey);
-    try {
-        const stored = (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.getItem(storageKey);
-        if (isValidIdempotencyKey(stored))
-            return stored;
-    }
-    catch (_b) {
-        // Storage can be disabled by browser privacy policy; use module memory.
-    }
-    const inMemory = memoryIdempotencyKeys.get(storageKey);
-    return isValidIdempotencyKey(inMemory) ? inMemory : undefined;
-}
-function persistIdempotencyKey(intentKey, idempotencyKey) {
-    var _a;
-    const storageKey = intentStorageKey(intentKey);
-    memoryIdempotencyKeys.set(storageKey, idempotencyKey);
-    try {
-        (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.setItem(storageKey, idempotencyKey);
-    }
-    catch (_b) {
-        // The in-memory write above is the React Native / disabled-storage fallback.
-    }
-}
-function randomHex(bytes) {
-    const cryptoObject = globalThis.crypto;
-    if (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.getRandomValues) {
-        const values = new Uint8Array(bytes);
-        cryptoObject.getRandomValues(values);
-        return Array.from(values, (value) => value.toString(16).padStart(2, '0')).join('');
-    }
-    let value = '';
-    for (let index = 0; index < bytes; index += 1) {
-        value += Math.floor(Math.random() * 256).toString(16).padStart(2, '0');
-    }
-    return value;
-}
-function mintIdempotencyKey() {
-    const cryptoObject = globalThis.crypto;
-    if (typeof (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.randomUUID) === 'function') {
-        return `build_${cryptoObject.randomUUID()}`;
-    }
-    return `build_${Date.now().toString(36)}_${randomHex(16)}`;
-}
-function actionIdempotencyKey(options, action) {
-    const supplied = options.idempotencyKey;
-    if (supplied !== undefined) {
-        if (!isValidIdempotencyKey(supplied)) {
-            throw new TypeError('idempotencyKey must be between 1 and 256 characters.');
-        }
-        if (options.intentKey)
-            persistIdempotencyKey(options.intentKey, supplied);
-        return supplied;
-    }
-    if (!options.intentKey) {
-        throw new TypeError(`intentKey is required when ${action} auto-mints an idempotency key.`);
-    }
-    const existing = readPersistedIdempotencyKey(options.intentKey);
-    if (existing)
-        return existing;
-    const minted = mintIdempotencyKey();
-    // This is deliberately synchronous and happens before requestDevApi can fetch.
-    persistIdempotencyKey(options.intentKey, minted);
-    return minted;
-}
-function appPath(appId) {
-    return `/app/${encodeURIComponent(appId)}/builds`;
-}
-async function submit(appId, options) {
-    const idempotencyKey = actionIdempotencyKey(options, 'submit()');
-    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, submission = __rest(options, ["intentKey", "idempotencyKey"]);
-    return requestDevApi(appPath(appId), {
-        method: 'POST',
-        body: Object.assign(Object.assign({}, submission), { idempotencyKey }),
-    });
-}
-async function get(appId, runId) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}`);
-}
-async function events(appId, runId, after = 0) {
-    const cursor = Number.isFinite(after) ? Math.max(0, Math.floor(after)) : 0;
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/events?after=${cursor}`);
-}
-async function cancel(appId, runId) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/cancel`, { method: 'POST' });
-}
-async function decideGate(appId, runId, gateId, options) {
-    const idempotencyKey = actionIdempotencyKey(options, 'decideGate()');
-    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, decision = __rest(options, ["intentKey", "idempotencyKey"]);
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/decision`, { method: 'POST', body: Object.assign(Object.assign({}, decision), { idempotencyKey }) });
-}
-async function refreshReviewCapability(appId, runId, gateId, options) {
-    const idempotencyKey = actionIdempotencyKey(options, 'refreshReviewCapability()');
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability/refresh`, {
-        method: 'POST',
-        body: {
-            expectedGeneration: options.expectedGeneration,
-            expectedExpiresAtMs: options.expectedExpiresAtMs,
-            expectedRecoveryUntilMs: options.expectedRecoveryUntilMs,
-            expectedAudience: options.expectedAudience,
-            expectedReviewerBindingHash: options.expectedReviewerBindingHash,
-            idempotencyKey,
-        },
-    });
-}
-/**
- * Read one exact delegated-review capability and its narrow lifecycle result.
- * This does not refresh or extend the window and exposes no generic run-view
- * authority.
- */
-async function getReviewCapability(appId, runId, gateId, options) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability`, {
-        method: 'POST',
-        body: { expectedPreviewUrl: options.expectedPreviewUrl },
-    });
-}
-async function topup(appId, runId, options) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/topup`, { method: 'POST', body: options });
-}
-async function list$1(appId, limit = 20) {
-    const requestedLimit = Number.isFinite(limit) ? Math.max(1, Math.floor(limit)) : 20;
-    return requestDevApi(`${appPath(appId)}?limit=${requestedLimit}`);
-}
-
-// Source of truth for these strings:
-// packages/cdk/cloudflare/bounded-build/src/types.ts. Keep them string-pinned;
-// wire:1 remains additive and callers must tolerate unknown response strings.
-const NON_TERMINAL_STATES = [
-    'queued',
-    'admitted',
-    'executing',
-    'preview_ready',
-    'parked',
-    'resuming',
-    'promoting',
-    'quarantined',
-];
-const TERMINAL_STATES = [
-    'promoted',
-    'failed',
-    'canceled',
-    'rejected',
-    'expired',
-    'rebase_required',
-    'reported',
-];
-const RUN_STATES = [
-    ...NON_TERMINAL_STATES,
-    ...TERMINAL_STATES,
-];
-const PARK_REASONS = ['gate', 'funding'];
-const FAILURE_REASONS = [
-    'admission_rejected',
-    'dispatch_timeout',
-    'auth_revoked',
-    'owner_changed',
-    'policy_changed',
-    'quarantine_forced',
-    'bind_failed',
-    'internal_error',
-];
-const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
-const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
-const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
-
-const FAST_POLL_MS = 1000;
-const NORMAL_POLL_MS = 2000;
-const PARKED_POLL_MS = 5000;
-const LONG_RUNNING_POLL_MS = 10000;
-const THIRTY_SECONDS_MS = 30000;
-const TWO_MINUTES_MS = 2 * 60000;
-const TEN_MINUTES_MS = 10 * 60000;
-const terminalStates = new Set(TERMINAL_STATES);
-function pollCadence(state, elapsedMs) {
-    if (elapsedMs >= TEN_MINUTES_MS)
-        return LONG_RUNNING_POLL_MS;
-    if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
-        return PARKED_POLL_MS;
-    // The first 30s is where the user is staring at "waiting for a build slot" /
-    // "building" and every transition matters most; poll fast, then relax.
-    if (elapsedMs < THIRTY_SECONDS_MS)
-        return FAST_POLL_MS;
-    return NORMAL_POLL_MS;
-}
-function retryCadence(error, state, elapsedMs) {
-    const cadence = pollCadence(state, elapsedMs);
-    if (error instanceof BuildsApiError && error.status === 429 && error.retryAfterMs !== undefined) {
-        return Math.max(cadence, error.retryAfterMs);
-    }
-    return cadence;
-}
-function hasRetryAfter(error) {
-    return error instanceof BuildsApiError
-        && error.status === 429
-        && error.retryAfterMs !== undefined;
-}
-// A permanent API refusal (expired session, revoked access, unknown run) will
-// never heal by re-polling; the loop must stop and surface it instead of
-// retrying forever. 429 stays retryable regardless of the server envelope.
-function isPermanentError(error) {
-    return error instanceof BuildsApiError
-        && error.status !== 429
-        && error.retryable === false;
-}
-function newEvents(rows, lastSeq, seen) {
-    const cursorBeforePoll = lastSeq;
-    const fresh = [];
-    let nextCursor = lastSeq;
-    for (const event of rows) {
-        if (!Number.isFinite(event === null || event === void 0 ? void 0 : event.seq))
-            continue;
-        nextCursor = Math.max(nextCursor, event.seq);
-        if (event.seq <= cursorBeforePoll || seen.has(event.seq))
-            continue;
-        seen.add(event.seq);
-        fresh.push(event);
-    }
-    return { events: fresh, lastSeq: nextCursor };
-}
-/**
- * Poll a build view and its event cursor until stopped or the run reaches a
- * known terminal state. Unknown state strings remain untouched and nonterminal.
- */
-function watch(appId, runId, onUpdate, options = {}) {
-    const startedAt = Date.now();
-    const seenSeqs = new Set();
-    let lastSeq = Number.isFinite(options.after)
-        ? Math.max(0, Math.floor(options.after))
-        : 0;
-    let timer;
-    let active = true;
-    let lastState;
-    const stop = () => {
-        active = false;
-        if (timer !== undefined) {
-            clearTimeout(timer);
-            timer = undefined;
-        }
-    };
-    const schedule = (delayMs) => {
-        if (!active)
-            return;
-        timer = setTimeout(() => {
-            timer = undefined;
-            void poll();
-        }, delayMs);
-    };
-    const reportError = (error) => {
-        var _a;
-        try {
-            (_a = options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
-        }
-        catch (_b) {
-            // A consumer error callback must not break the transport loop.
-        }
-    };
-    const publish = (run, events) => {
-        try {
-            onUpdate({ run, events });
-        }
-        catch (_a) {
-            // Polling is transport state; consumer render errors must not strand it.
-        }
-    };
-    const poll = async () => {
-        if (!active)
-            return;
-        // Fire the view and the events page concurrently: the events cursor (lastSeq)
-        // does not depend on the run view, so there is no reason to pay two serial
-        // round-trips per tick. Error semantics below are unchanged — the run result
-        // still gates, and a failed events page still publishes the run with no rows.
-        const runPromise = get(appId, runId);
-        const eventsPromise = events(appId, runId, lastSeq);
-        // Keep the in-flight events page from becoming an unhandled rejection if the
-        // run result makes us bail before awaiting it; the real await below still sees it.
-        eventsPromise.catch(() => { });
-        let run;
-        try {
-            const view = await runPromise;
-            if (!active)
-                return;
-            run = view.run;
-            lastState = run.state;
-        }
-        catch (error) {
-            if (!active)
-                return;
-            reportError(error);
-            if (isPermanentError(error)) {
-                stop();
-                return;
-            }
-            schedule(retryCadence(error, lastState, Date.now() - startedAt));
-            return;
-        }
-        try {
-            const response = await eventsPromise;
-            if (!active)
-                return;
-            const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
-            lastSeq = deduped.lastSeq;
-            publish(run, deduped.events);
-        }
-        catch (error) {
-            if (!active)
-                return;
-            // The view still advances UI state even when event replay is rate-limited.
-            publish(run, []);
-            reportError(error);
-            if (terminalStates.has(run.state)) {
-                // The run itself is done, but a rate-limited final event replay still
-                // owes the caller its unseen seq rows. Honor Retry-After, retry the
-                // piggyback once the limiter permits it, then stop after a successful
-                // replay. Other terminal replay failures stop normally.
-                if (hasRetryAfter(error)) {
-                    schedule(retryCadence(error, run.state, Date.now() - startedAt));
-                    return;
-                }
-                stop();
-                return;
-            }
-            if (isPermanentError(error)) {
-                stop();
-                return;
-            }
-            schedule(retryCadence(error, run.state, Date.now() - startedAt));
-            return;
-        }
-        if (!active)
-            return;
-        if (terminalStates.has(run.state)) {
-            // Drain the remaining event pages before stopping: a resumed terminal
-            // watch may owe the caller more rows than one page returns. Each page
-            // advances the cursor, so the loop terminates; the cap is a backstop.
-            for (let page = 0; page < 50 && active; page += 1) {
-                let drained;
-                try {
-                    const response = await events(appId, runId, lastSeq);
-                    if (!active)
-                        return;
-                    drained = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
-                }
-                catch (error) {
-                    reportError(error);
-                    break;
-                }
-                if (drained.events.length === 0)
-                    break;
-                lastSeq = drained.lastSeq;
-                publish(run, drained.events);
-            }
-            stop();
-            return;
+            }
+            setUser(null);
+        }
+        finally {
+            setLoading(false);
         }
-        schedule(pollCadence(run.state, Date.now() - startedAt));
     };
-    void poll();
-    return { stop };
+    const logout$1 = async () => {
+        try {
+            setLoading(true);
+            await logout();
+            setUser(null);
+        }
+        catch (error) {
+            console.error('Error logging out:', error);
+        }
+        finally {
+            setLoading(false);
+        }
+    };
+    return {
+        login: login$1,
+        logout: logout$1,
+        loading: loading || sdkLoading,
+        user,
+    };
 }
 
-var _a;
+var _a$1;
 // SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
 // React Native has no `window` but DOES support hooks, so detect Node SSR
 // specifically via process.versions.node.
-const isSSR = typeof window === 'undefined'
+const isSSR$1 = typeof window === 'undefined'
     && typeof process !== 'undefined'
-    && !!((_a = process.versions) === null || _a === void 0 ? void 0 : _a.node);
-function useBuildRun(appId, runId, options) {
-    if (isSSR) {
-        return { run: null, events: [], loading: true, error: null };
+    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
+function useQuery(path, options) {
+    if (isSSR$1) {
+        return { data: undefined, loading: true, error: null };
     }
-    const [run, setRun] = React.useState(null);
-    const [events, setEvents] = React.useState([]);
+    const [data, setData] = React.useState(undefined);
     const [loading, setLoading] = React.useState(true);
     const [error, setError] = React.useState(null);
+    // Re-subscribe only when the query actually changes (not on every render).
     const optionsKey = options ? JSON.stringify(options) : '';
     React.useEffect(() => {
-        setRun(null);
-        setEvents([]);
-        setError(null);
-        if (!appId || !runId) {
+        if (!path) {
+            setData(undefined);
             setLoading(false);
+            setError(null);
             return;
         }
         let active = true;
+        let unsubscribe;
         setLoading(true);
-        const handle = watch(appId, runId, ({ run: nextRun, events: nextEvents }) => {
-            if (!active)
-                return;
-            setRun(nextRun);
-            if (nextEvents.length > 0) {
-                setEvents((current) => {
-                    const seen = new Set(current.map((event) => event.seq));
-                    return [...current, ...nextEvents.filter((event) => !seen.has(event.seq))];
-                });
-            }
-            setError(null);
-            setLoading(false);
-        }, Object.assign(Object.assign({}, options), { onError: (value) => {
+        setError(null);
+        subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
                 if (!active)
                     return;
-                setError(value instanceof Error ? value : new Error(String(value)));
+                // A reconnect can legitimately surface a transport error before the
+                // socket re-authenticates and sends a new authorized snapshot. That
+                // fresh snapshot is the recovery boundary: keep the error visible
+                // until data arrives, then clear it so React does not remain stuck on
+                // a failure page after realtime has recovered.
+                setError(null);
+                setData(d);
                 setLoading(false);
-            } }));
+            }, onError: (e) => {
+                if (!active)
+                    return;
+                setError(e instanceof Error ? e : new Error(String(e)));
+                setLoading(false);
+            } }))
+            .then((unsub) => {
+            if (active)
+                unsubscribe = unsub;
+            else
+                void unsub(); // unmounted before subscribe resolved
+        })
+            .catch((e) => {
+            if (!active)
+                return;
+            setError(e instanceof Error ? e : new Error(String(e)));
+            setLoading(false);
+        });
         return () => {
             active = false;
-            handle.stop();
+            void (unsubscribe === null || unsubscribe === void 0 ? void 0 : unsubscribe());
         };
-        // optionsKey captures the option object's contents; ids are the other inputs.
+        // optionsKey captures the option object's contents; path is the other input.
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [appId, runId, optionsKey]);
-    return { run, events, loading, error };
+    }, [path, optionsKey]);
+    return { data, loading, error };
+}
+
+// Wrapper for getIdToken - passes isServer=false for client-side usage
+async function getIdToken() {
+    return getIdToken$1(false);
+}
+
+var __rest = (undefined && undefined.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+/** A structured non-2xx response from the developer API. */
+class BuildsApiError extends Error {
+    constructor(init) {
+        super(init.message);
+        this.name = 'BuildsApiError';
+        this.code = init.code;
+        this.retryable = init.retryable;
+        this.status = init.status;
+        this.details = init.details;
+        this.retryAfterMs = init.retryAfterMs;
+    }
+}
+const memoryIdempotencyKeys = new Map();
+const IDEMPOTENCY_STORAGE_PREFIX = 'bounded:build:idempotency:';
+function retryAfterMs(response) {
+    var _a, _b;
+    const value = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'Retry-After');
+    if (!value)
+        return undefined;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0)
+        return Math.ceil(seconds * 1000);
+    const at = Date.parse(value);
+    if (!Number.isFinite(at))
+        return undefined;
+    return Math.max(0, at - Date.now());
+}
+async function responseBody(response) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch (_a) {
+        return { raw: text };
+    }
+}
+function apiError(response, body) {
+    const envelope = body;
+    const nested = (envelope === null || envelope === void 0 ? void 0 : envelope.error) && typeof envelope.error === 'object'
+        ? envelope.error
+        : undefined;
+    const hasNestedDetails = !!nested && Object.prototype.hasOwnProperty.call(nested, 'details');
+    const hasTopLevelDetails = !!body
+        && typeof body === 'object'
+        && Object.prototype.hasOwnProperty.call(body, 'details');
+    const legacyCode = typeof (body === null || body === void 0 ? void 0 : body.error) === 'string' ? body.error : undefined;
+    const code = typeof (nested === null || nested === void 0 ? void 0 : nested.code) === 'string'
+        ? nested.code
+        : legacyCode !== null && legacyCode !== void 0 ? legacyCode : `http_${response.status}`;
+    const message = typeof (nested === null || nested === void 0 ? void 0 : nested.message) === 'string'
+        ? nested.message
+        : typeof (body === null || body === void 0 ? void 0 : body.message) === 'string'
+            ? body.message
+            : `Developer API request failed with HTTP ${response.status}`;
+    const retryable = typeof (nested === null || nested === void 0 ? void 0 : nested.retryable) === 'boolean'
+        ? nested.retryable
+        : response.status === 429 || response.status >= 500;
+    return new BuildsApiError(Object.assign(Object.assign({ code,
+        message,
+        retryable, status: response.status }, (hasNestedDetails
+        ? { details: nested === null || nested === void 0 ? void 0 : nested.details }
+        : hasTopLevelDetails
+            ? { details: body.details }
+            : {})), (response.status === 429 ? { retryAfterMs: retryAfterMs(response) } : {})));
+}
+/** @internal Shared authenticated developer-api transport for builds and apps. */
+async function requestDevApi(path, request = {}) {
+    var _a, _b;
+    const config = await getConfig();
+    const base = (_a = config.devApiUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/$/, '');
+    if (!base) {
+        throw new Error('Bounded developer API is not configured. Pass devApiUrl or a Bounded network to init().');
+    }
+    // Reuse the exact accessor exposed publicly as getIdToken().
+    const token = await getIdToken();
+    if (!token) {
+        throw new BuildsApiError({
+            code: 'auth_required',
+            message: 'Sign in before calling the Bounded developer API.',
+            retryable: false,
+            status: 401,
+        });
+    }
+    const hasBody = request.body !== undefined;
+    const response = await fetch(`${base}${path}`, Object.assign({ method: (_b = request.method) !== null && _b !== void 0 ? _b : 'GET', headers: Object.assign({ Authorization: `Bearer ${token}` }, (hasBody ? { 'Content-Type': 'application/json' } : {})) }, (hasBody ? { body: JSON.stringify(request.body) } : {})));
+    const body = await responseBody(response);
+    if (!response.ok)
+        throw apiError(response, body);
+    return body;
+}
+function intentStorageKey(intentKey) {
+    return `${IDEMPOTENCY_STORAGE_PREFIX}${intentKey}`;
+}
+function isValidIdempotencyKey(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 256;
+}
+function readPersistedIdempotencyKey(intentKey) {
+    var _a;
+    const storageKey = intentStorageKey(intentKey);
+    try {
+        const stored = (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.getItem(storageKey);
+        if (isValidIdempotencyKey(stored))
+            return stored;
+    }
+    catch (_b) {
+        // Storage can be disabled by browser privacy policy; use module memory.
+    }
+    const inMemory = memoryIdempotencyKeys.get(storageKey);
+    return isValidIdempotencyKey(inMemory) ? inMemory : undefined;
+}
+function persistIdempotencyKey(intentKey, idempotencyKey) {
+    var _a;
+    const storageKey = intentStorageKey(intentKey);
+    memoryIdempotencyKeys.set(storageKey, idempotencyKey);
+    try {
+        (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.setItem(storageKey, idempotencyKey);
+    }
+    catch (_b) {
+        // The in-memory write above is the React Native / disabled-storage fallback.
+    }
+}
+function randomHex(bytes) {
+    const cryptoObject = globalThis.crypto;
+    if (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.getRandomValues) {
+        const values = new Uint8Array(bytes);
+        cryptoObject.getRandomValues(values);
+        return Array.from(values, (value) => value.toString(16).padStart(2, '0')).join('');
+    }
+    let value = '';
+    for (let index = 0; index < bytes; index += 1) {
+        value += Math.floor(Math.random() * 256).toString(16).padStart(2, '0');
+    }
+    return value;
+}
+function mintIdempotencyKey() {
+    const cryptoObject = globalThis.crypto;
+    if (typeof (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.randomUUID) === 'function') {
+        return `build_${cryptoObject.randomUUID()}`;
+    }
+    return `build_${Date.now().toString(36)}_${randomHex(16)}`;
 }
-
-/**
- * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost), with
- * one exact Drafted exception for delegated review/decision routes. Other
- * generated-app origins remain blocked; server-side callers are unaffected.
- */
-const builds = {
-    submit,
-    get,
-    getReviewCapability,
-    events,
-    cancel,
-    decideGate,
-    refreshReviewCapability,
-    topup,
-    list: list$1,
-    watch,
-};
-
-async function create(options = {}) {
-    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.idempotencyKey !== undefined ? { idempotencyKey: options.idempotencyKey } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
-    const app = await requestDevApi('/apps/new', {
+function actionIdempotencyKey(options, action) {
+    const supplied = options.idempotencyKey;
+    if (supplied !== undefined) {
+        if (!isValidIdempotencyKey(supplied)) {
+            throw new TypeError('idempotencyKey must be between 1 and 256 characters.');
+        }
+        if (options.intentKey)
+            persistIdempotencyKey(options.intentKey, supplied);
+        return supplied;
+    }
+    if (!options.intentKey) {
+        throw new TypeError(`intentKey is required when ${action} auto-mints an idempotency key.`);
+    }
+    const existing = readPersistedIdempotencyKey(options.intentKey);
+    if (existing)
+        return existing;
+    const minted = mintIdempotencyKey();
+    // This is deliberately synchronous and happens before requestDevApi can fetch.
+    persistIdempotencyKey(options.intentKey, minted);
+    return minted;
+}
+function appPath(appId) {
+    return `/app/${encodeURIComponent(appId)}/builds`;
+}
+async function submit(appId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'submit()');
+    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, submission = __rest(options, ["intentKey", "idempotencyKey"]);
+    return requestDevApi(appPath(appId), {
         method: 'POST',
-        body,
+        body: Object.assign(Object.assign({}, submission), { idempotencyKey }),
     });
-    return Object.assign(Object.assign(Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url }), (typeof app.prompt === 'string' && app.prompt ? { prompt: app.prompt } : {})), (typeof app.handoff === 'string' && app.handoff ? { handoff: app.handoff } : {}));
 }
-/**
- * F-1200: build the create-flow redirect the owner is sent to after `create()`, with the
- * prompt and handoff carried in the URL FRAGMENT (never the query - fragments never reach
- * servers, logs, or Referer). Encoding is byte-exact so the widget's `URLSearchParams`
- * parse + `.trim()` reproduces the SAME prompt string dev-api hashed into the handoff;
- * getting this wrong would make the widget reject a genuine token and degrade to prefill.
- * Callers (bounded.sh, oapps.fun) should use this instead of hand-building the URL.
- *
- * Returns `${url}#bounded_prompt=<prompt>` with no `&bounded_handoff=` when the server
- * minted no handoff (HANDOFF_SECRET unset) - the widget then prefills without auto-running.
- */
-function buildCreateRedirectUrl(app) {
-    const base = app.url;
-    const prompt = typeof app.prompt === 'string' ? app.prompt.trim() : '';
-    if (!prompt)
-        return base;
-    const params = `bounded_prompt=${encodeURIComponent(prompt)}`
-        + (app.handoff ? `&bounded_handoff=${encodeURIComponent(app.handoff)}` : '');
-    return `${base}#${params}`;
+async function get(appId, runId) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}`);
 }
-async function list() {
-    // This legacy-compatible action shape is also used by oapps.fun listMyApps.
-    const response = await requestDevApi('/', {
+async function events(appId, runId, after = 0) {
+    const cursor = Number.isFinite(after) ? Math.max(0, Math.floor(after)) : 0;
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/events?after=${cursor}`);
+}
+async function cancel(appId, runId) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/cancel`, { method: 'POST' });
+}
+async function decideGate(appId, runId, gateId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'decideGate()');
+    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, decision = __rest(options, ["intentKey", "idempotencyKey"]);
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/decision`, { method: 'POST', body: Object.assign(Object.assign({}, decision), { idempotencyKey }) });
+}
+async function refreshReviewCapability(appId, runId, gateId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'refreshReviewCapability()');
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability/refresh`, {
         method: 'POST',
-        body: { action: 'listApps' },
+        body: {
+            expectedGeneration: options.expectedGeneration,
+            expectedExpiresAtMs: options.expectedExpiresAtMs,
+            expectedRecoveryUntilMs: options.expectedRecoveryUntilMs,
+            expectedAudience: options.expectedAudience,
+            expectedReviewerBindingHash: options.expectedReviewerBindingHash,
+            idempotencyKey,
+        },
     });
-    const rows = Array.isArray(response.apps) ? response.apps : [];
-    return rows
-        .map((value) => {
-        var _a, _b, _c, _d;
-        const row = value && typeof value === 'object'
-            ? value
-            : {};
-        const appId = String((_c = (_b = (_a = row._id) !== null && _a !== void 0 ? _a : row.id) !== null && _b !== void 0 ? _b : row.appId) !== null && _c !== void 0 ? _c : '');
-        if (!/^[a-f0-9]{24}$/i.test(appId))
-            return null;
-        const name = String((_d = row.name) !== null && _d !== void 0 ? _d : '').trim() || '(unnamed app)';
-        const slug = typeof row.slug === 'string' && row.slug ? row.slug : undefined;
-        const url = typeof row.url === 'string' && row.url.trim() ? row.url.trim() : undefined;
-        const buildStatus = row.buildStatus === 'building' || row.buildStatus === 'build_failed'
-            ? row.buildStatus
-            : undefined;
-        return Object.assign(Object.assign(Object.assign({ appId,
-            name }, (slug ? { slug } : {})), (url ? { url } : {})), (buildStatus ? { buildStatus } : {}));
-    })
-        .filter((app) => app !== null);
-}
-/**
- * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
- * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
- */
-const apps = { create, list, buildCreateRedirectUrl };
-
-async function deserializeTransaction(tx) {
-    // Literal specifier so bundlers can code-split the lazy chunk.
-    const { Transaction, VersionedTransaction } = await import('@solana/web3.js');
-    const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
-    if ((buf[0] & 0x80) !== 0) {
-        return VersionedTransaction.deserialize(buf);
-    }
-    else {
-        return Transaction.from(buf);
-    }
 }
-
-// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
-// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
-// in a warm iframe behind the modal so signing feels native: an in-app card plus
-// the OS Face ID / Touch ID sheet, never a jarring popup.
-//
-// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
-// MUST run on the single Bounded signer origin. The iframe carries the
-// publickey-credentials-{get,create} permission policy and the user's click lands
-// INSIDE it, giving WebAuthn the transient activation it needs.
-//
-// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
-// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
-// SAME request through `popupFallback` (a real window). Callers pass a popup
-// implementation and never see the difference.
 /**
- * Run one signer exchange through the in-app widget. Resolves when `onResult`
- * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
- * (Safari cross-origin create) or cannot be mounted.
+ * Read one exact delegated-review capability and its narrow lifecycle result.
+ * This does not refresh or extend the window and exposes no generic run-view
+ * authority.
  */
-async function runWidget(url, signerOrigin, ex, popupFallback) {
-    if (!hasDOM$3())
-        return popupFallback();
-    const m = getModal();
-    const requestId = String(ex.request.requestId);
-    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
-    const run = m.chain.then(() => new Promise((resolve, reject) => {
-        let settled = false;
-        let usedFallback = false;
-        const iframe = ensureIframe(m, url, signerOrigin);
-        const send = () => {
-            if (!iframe.contentWindow)
-                return;
-            try {
-                iframe.contentWindow.postMessage(ex.request, signerOrigin);
-            }
-            catch (_a) {
-                /* frame gone */
-            }
-        };
-        let loadTimer = 0;
-        let ceilingTimer = 0;
-        const finish = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            m.onIframeMessage = null;
-            m.onBackdrop = null;
-            window.clearTimeout(loadTimer);
-            window.clearTimeout(ceilingTimer);
-            fn();
-        };
-        const goFallback = () => {
-            if (usedFallback || settled)
-                return;
-            usedFallback = true;
-            hideModal(m);
-            finish(() => popupFallback().then(resolve, reject));
-        };
-        m.onBackdrop = () => {
-            hideModal(m);
-            finish(() => reject(new Error("cancelled")));
-        };
-        m.onIframeMessage = (d) => {
-            if (d.type === "bounded:turnkey:ready") {
-                m.iframeReady = true;
-                send();
-                return;
-            }
-            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
-                setPanelHeight(m, d.height);
-                return;
-            }
-            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
-                goFallback();
-                return;
-            }
-            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
-                const outcome = ex.onResult(d);
-                if ("error" in outcome) {
-                    hideModal(m);
-                    finish(() => reject(new Error(outcome.error)));
-                    return;
-                }
-                if (outcome.done) {
-                    hideModal(m);
-                    finish(() => resolve(outcome.value));
-                }
-            }
-        };
-        showModal(m);
-        if (m.iframeReady)
-            send();
-        // If the frame never loads, degrade to the popup (best-effort - a post-load
-        // popup may be blocked without a gesture, in which case the fallback rejects).
-        loadTimer = window.setTimeout(() => {
-            if (!m.iframeReady && !settled)
-                goFallback();
-        }, 8000);
-        // Absolute ceiling so a stuck flow cannot hang forever.
-        ceilingTimer = window.setTimeout(() => {
-            if (!settled) {
-                hideModal(m);
-                finish(() => reject(new Error("Wallet approval timed out.")));
-            }
-        }, 5 * 60 * 1000);
-    }));
-    m.chain = run.then(() => undefined, () => undefined);
-    return run;
+async function getReviewCapability(appId, runId, gateId, options) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability`, {
+        method: 'POST',
+        body: { expectedPreviewUrl: options.expectedPreviewUrl },
+    });
 }
-
-// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
-// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
-//
-// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
-// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
-// look + motion, so signing feels native. Safari (unreliable at iframe passkey
-// CREATE) and any environment where the frame cannot mount fall back to a real
-// popup window; both transports speak the same postMessage protocol.
-//
-// Unlike the Crossmint bridge (crossmint-signer-bridge.ts), Turnkey wallets DO
-// produce raw detached signatures: the signer runs the Turnkey browser SDK on the
-// single Bounded origin, enrolls the user's passkey on first use (lazy - the
-// sub-org is created with the passkey + email attached at that moment), and stamps
-// an ed25519 signRawPayload with that passkey. So this bridge exposes a
-// `signSolanaMessage` primitive; the app builds + submits the transaction itself.
-//
-// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
-// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
-// every user one wallet + one passkey that roams across every app.
-function hasDOM$1() {
-    return typeof window !== 'undefined' && typeof document !== 'undefined';
+async function topup(appId, runId, options) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/topup`, { method: 'POST', body: options });
 }
-// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
-// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
-// fail - and a post-failure popup would no longer have a user gesture to open with.
-// There we pick the popup up front, from the original click, so enrollment is solid.
-// Everywhere else the inline widget is used (buttery in-app modal).
-function preferPopup() {
-    if (!hasDOM$1() || typeof navigator === 'undefined')
-        return true;
-    const ua = navigator.userAgent || '';
-    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+async function list$1(appId, limit = 20) {
+    const requestedLimit = Number.isFinite(limit) ? Math.max(1, Math.floor(limit)) : 20;
+    return requestDevApi(`${appPath(appId)}?limit=${requestedLimit}`);
 }
-// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
-// when we cannot embed (Safari enrollment, or the frame never loads).
-async function deliver(url, origin, ex) {
-    const popup = () => runPopup(url, origin, ex);
-    if (preferPopup())
-        return popup();
-    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+
+// Source of truth for these strings:
+// packages/cdk/cloudflare/bounded-build/src/types.ts. Keep them string-pinned;
+// wire:1 remains additive and callers must tolerate unknown response strings.
+const NON_TERMINAL_STATES = [
+    'queued',
+    'admitted',
+    'executing',
+    'preview_ready',
+    'parked',
+    'resuming',
+    'promoting',
+    'quarantined',
+];
+const TERMINAL_STATES = [
+    'promoted',
+    'failed',
+    'canceled',
+    'rejected',
+    'expired',
+    'rebase_required',
+    'reported',
+];
+const RUN_STATES = [
+    ...NON_TERMINAL_STATES,
+    ...TERMINAL_STATES,
+];
+const PARK_REASONS = ['gate', 'funding'];
+const FAILURE_REASONS = [
+    'admission_rejected',
+    'dispatch_timeout',
+    'auth_revoked',
+    'owner_changed',
+    'policy_changed',
+    'quarantine_forced',
+    'bind_failed',
+    'internal_error',
+];
+const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
+const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
+const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
+
+const FAST_POLL_MS = 1000;
+const NORMAL_POLL_MS = 2000;
+const PARKED_POLL_MS = 5000;
+const LONG_RUNNING_POLL_MS = 10000;
+const THIRTY_SECONDS_MS = 30000;
+const TWO_MINUTES_MS = 2 * 60000;
+const TEN_MINUTES_MS = 10 * 60000;
+const terminalStates = new Set(TERMINAL_STATES);
+function pollCadence(state, elapsedMs) {
+    if (elapsedMs >= TEN_MINUTES_MS)
+        return LONG_RUNNING_POLL_MS;
+    if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
+        return PARKED_POLL_MS;
+    // The first 30s is where the user is staring at "waiting for a build slot" /
+    // "building" and every transition matters most; poll fast, then relax.
+    if (elapsedMs < THIRTY_SECONDS_MS)
+        return FAST_POLL_MS;
+    return NORMAL_POLL_MS;
 }
-async function turnkeySignerPage() {
-    const cfg = await getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+function retryCadence(error, state, elapsedMs) {
+    const cadence = pollCadence(state, elapsedMs);
+    if (error instanceof BuildsApiError && error.status === 429 && error.retryAfterMs !== undefined) {
+        return Math.max(cadence, error.retryAfterMs);
+    }
+    return cadence;
 }
-function toHex(bytes) {
-    let h = '';
-    for (const b of bytes)
-        h += b.toString(16).padStart(2, '0');
-    return h;
+function hasRetryAfter(error) {
+    return error instanceof BuildsApiError
+        && error.status === 429
+        && error.retryAfterMs !== undefined;
 }
-function fromHex(hex) {
-    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
-    const out = new Uint8Array(clean.length / 2);
-    for (let i = 0; i < out.length; i++)
-        out[i] = parseInt(clean.substr(i * 2, 2), 16);
-    return out;
+// A permanent API refusal (expired session, revoked access, unknown run) will
+// never heal by re-polling; the loop must stop and surface it instead of
+// retrying forever. 429 stays retryable regardless of the server envelope.
+function isPermanentError(error) {
+    return error instanceof BuildsApiError
+        && error.status !== 429
+        && error.retryable === false;
 }
-let requestSeq = 0;
-// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
-// resolve when `onResult` accepts a result message. Origin + source are pinned.
-async function runPopup(url, signerOrigin, ex) {
-    var _a, _b;
-    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
-    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
-    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
-    if (!popup) {
-        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+function newEvents(rows, lastSeq, seen) {
+    const cursorBeforePoll = lastSeq;
+    const fresh = [];
+    let nextCursor = lastSeq;
+    for (const event of rows) {
+        if (!Number.isFinite(event === null || event === void 0 ? void 0 : event.seq))
+            continue;
+        nextCursor = Math.max(nextCursor, event.seq);
+        if (event.seq <= cursorBeforePoll || seen.has(event.seq))
+            continue;
+        seen.add(event.seq);
+        fresh.push(event);
     }
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        let sentRequest = false;
-        let closeTimer;
-        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
-            clearInterval(closeTimer); };
-        const sendRequest = () => { if (sentRequest)
-            return; sentRequest = true; try {
-            popup.postMessage(ex.request, signerOrigin);
+    return { events: fresh, lastSeq: nextCursor };
+}
+/**
+ * Poll a build view and its event cursor until stopped or the run reaches a
+ * known terminal state. Unknown state strings remain untouched and nonterminal.
+ */
+function watch(appId, runId, onUpdate, options = {}) {
+    const startedAt = Date.now();
+    const seenSeqs = new Set();
+    let lastSeq = Number.isFinite(options.after)
+        ? Math.max(0, Math.floor(options.after))
+        : 0;
+    let timer;
+    let active = true;
+    let lastState;
+    const stop = () => {
+        active = false;
+        if (timer !== undefined) {
+            clearTimeout(timer);
+            timer = undefined;
         }
-        catch ( /* popup gone */_a) { /* popup gone */ } };
-        const onMsg = (event) => {
-            if (event.origin !== signerOrigin)
+    };
+    const schedule = (delayMs) => {
+        if (!active)
+            return;
+        timer = setTimeout(() => {
+            timer = undefined;
+            void poll();
+        }, delayMs);
+    };
+    const reportError = (error) => {
+        var _a;
+        try {
+            (_a = options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
+        }
+        catch (_b) {
+            // A consumer error callback must not break the transport loop.
+        }
+    };
+    const publish = (run, events) => {
+        try {
+            onUpdate({ run, events });
+        }
+        catch (_a) {
+            // Polling is transport state; consumer render errors must not strand it.
+        }
+    };
+    const poll = async () => {
+        if (!active)
+            return;
+        // Fire the view and the events page concurrently: the events cursor (lastSeq)
+        // does not depend on the run view, so there is no reason to pay two serial
+        // round-trips per tick. Error semantics below are unchanged — the run result
+        // still gates, and a failed events page still publishes the run with no rows.
+        const runPromise = get(appId, runId);
+        const eventsPromise = events(appId, runId, lastSeq);
+        // Keep the in-flight events page from becoming an unhandled rejection if the
+        // run result makes us bail before awaiting it; the real await below still sees it.
+        eventsPromise.catch(() => { });
+        let run;
+        try {
+            const view = await runPromise;
+            if (!active)
                 return;
-            if (event.source !== popup)
+            run = view.run;
+            lastState = run.state;
+        }
+        catch (error) {
+            if (!active)
                 return;
-            const d = event.data;
-            if (!d || typeof d !== 'object')
+            reportError(error);
+            if (isPermanentError(error)) {
+                stop();
+                return;
+            }
+            schedule(retryCadence(error, lastState, Date.now() - startedAt));
+            return;
+        }
+        try {
+            const response = await eventsPromise;
+            if (!active)
+                return;
+            const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
+            lastSeq = deduped.lastSeq;
+            publish(run, deduped.events);
+        }
+        catch (error) {
+            if (!active)
+                return;
+            // The view still advances UI state even when event replay is rate-limited.
+            publish(run, []);
+            reportError(error);
+            if (terminalStates.has(run.state)) {
+                // The run itself is done, but a rate-limited final event replay still
+                // owes the caller its unseen seq rows. Honor Retry-After, retry the
+                // piggyback once the limiter permits it, then stop after a successful
+                // replay. Other terminal replay failures stop normally.
+                if (hasRetryAfter(error)) {
+                    schedule(retryCadence(error, run.state, Date.now() - startedAt));
+                    return;
+                }
+                stop();
                 return;
-            if (d.type === 'bounded:turnkey:ready') {
-                sendRequest();
+            }
+            if (isPermanentError(error)) {
+                stop();
                 return;
             }
-            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
-                const outcome = ex.onResult(d);
-                if ('error' in outcome) {
-                    cleanup();
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    reject(new Error(outcome.error));
-                    return;
+            schedule(retryCadence(error, run.state, Date.now() - startedAt));
+            return;
+        }
+        if (!active)
+            return;
+        if (terminalStates.has(run.state)) {
+            // Drain the remaining event pages before stopping: a resumed terminal
+            // watch may owe the caller more rows than one page returns. Each page
+            // advances the cursor, so the loop terminates; the cap is a backstop.
+            for (let page = 0; page < 50 && active; page += 1) {
+                let drained;
+                try {
+                    const response = await events(appId, runId, lastSeq);
+                    if (!active)
+                        return;
+                    drained = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
                 }
-                if (outcome.done) {
-                    cleanup();
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_b) { /* ignore */ }
-                    resolve(outcome.value);
+                catch (error) {
+                    reportError(error);
+                    break;
                 }
+                if (drained.events.length === 0)
+                    break;
+                lastSeq = drained.lastSeq;
+                publish(run, drained.events);
             }
-        };
-        window.addEventListener('message', onMsg);
-        setTimeout(sendRequest, 1200);
-        closeTimer = setInterval(() => {
-            if (popup.closed) {
-                clearInterval(closeTimer);
-                setTimeout(() => { if (!settled) {
-                    cleanup();
-                    reject(new Error('Wallet approval window was closed before it completed.'));
-                } }, 400);
-            }
-        }, 500);
-        setTimeout(() => { if (!settled) {
-            cleanup();
-            try {
-                popup.close();
+            stop();
+            return;
+        }
+        schedule(pollCadence(run.state, Date.now() - startedAt));
+    };
+    void poll();
+    return { stop };
+}
+
+var _a;
+// SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
+// React Native has no `window` but DOES support hooks, so detect Node SSR
+// specifically via process.versions.node.
+const isSSR = typeof window === 'undefined'
+    && typeof process !== 'undefined'
+    && !!((_a = process.versions) === null || _a === void 0 ? void 0 : _a.node);
+function useBuildRun(appId, runId, options) {
+    if (isSSR) {
+        return { run: null, events: [], loading: true, error: null };
+    }
+    const [run, setRun] = React.useState(null);
+    const [events, setEvents] = React.useState([]);
+    const [loading, setLoading] = React.useState(true);
+    const [error, setError] = React.useState(null);
+    const optionsKey = options ? JSON.stringify(options) : '';
+    React.useEffect(() => {
+        setRun(null);
+        setEvents([]);
+        setError(null);
+        if (!appId || !runId) {
+            setLoading(false);
+            return;
+        }
+        let active = true;
+        setLoading(true);
+        const handle = watch(appId, runId, ({ run: nextRun, events: nextEvents }) => {
+            if (!active)
+                return;
+            setRun(nextRun);
+            if (nextEvents.length > 0) {
+                setEvents((current) => {
+                    const seen = new Set(current.map((event) => event.seq));
+                    return [...current, ...nextEvents.filter((event) => !seen.has(event.seq))];
+                });
             }
-            catch ( /* ignore */_a) { /* ignore */ }
-            reject(new Error('Wallet approval timed out.'));
-        } }, 5 * 60 * 1000);
+            setError(null);
+            setLoading(false);
+        }, Object.assign(Object.assign({}, options), { onError: (value) => {
+                if (!active)
+                    return;
+                setError(value instanceof Error ? value : new Error(String(value)));
+                setLoading(false);
+            } }));
+        return () => {
+            active = false;
+            handle.stop();
+        };
+        // optionsKey captures the option object's contents; ids are the other inputs.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [appId, runId, optionsKey]);
+    return { run, events, loading, error };
+}
+
+/**
+ * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost), with
+ * one exact Drafted exception for delegated review/decision routes. Other
+ * generated-app origins remain blocked; server-side callers are unaffected.
+ */
+const builds = {
+    submit,
+    get,
+    getReviewCapability,
+    events,
+    cancel,
+    decideGate,
+    refreshReviewCapability,
+    topup,
+    list: list$1,
+    watch,
+};
+
+async function create(options = {}) {
+    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.idempotencyKey !== undefined ? { idempotencyKey: options.idempotencyKey } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
+    const app = await requestDevApi('/apps/new', {
+        method: 'POST',
+        body,
     });
+    return Object.assign(Object.assign(Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url }), (typeof app.prompt === 'string' && app.prompt ? { prompt: app.prompt } : {})), (typeof app.handoff === 'string' && app.handoff ? { handoff: app.handoff } : {}));
 }
 /**
- * Get-or-create the user's non-custodial Turnkey wallet, resolving with its stable
- * Solana address. On first use the popup enrolls a device passkey (Face ID / Touch ID)
- * and creates the wallet (lazy) with no email code; if the wallet already exists it
- * resolves immediately without a prompt. Call from a USER GESTURE.
+ * F-1200: build the create-flow redirect the owner is sent to after `create()`, with the
+ * prompt and handoff carried in the URL FRAGMENT (never the query - fragments never reach
+ * servers, logs, or Referer). Encoding is byte-exact so the widget's `URLSearchParams`
+ * parse + `.trim()` reproduces the SAME prompt string dev-api hashed into the handoff;
+ * getting this wrong would make the widget reject a genuine token and degrade to prefill.
+ * Callers (bounded.sh, oapps.fun) should use this instead of hand-building the URL.
  *
- * Use this to learn the fee-payer address BEFORE building a transaction to sign.
+ * Returns `${url}#bounded_prompt=<prompt>` with no `&bounded_handoff=` when the server
+ * minted no handoff (HANDOFF_SECRET unset) - the widget then prefills without auto-running.
  */
-async function getOrCreateTurnkeyWallet() {
-    if (!hasDOM$1())
-        throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
-    const { url, origin } = await turnkeySignerPage();
-    const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
-    return await deliver(url, origin, {
-        request: { type: 'bounded:turnkey:createWallet', requestId },
-        onResult: (d) => {
-            if (d.ok && typeof d.address === 'string')
-                return { done: true, value: { address: d.address, subOrgId: String(d.subOrgId || '') } };
-            return { error: String(d.error || 'Wallet setup failed') };
-        },
+function buildCreateRedirectUrl(app) {
+    const base = app.url;
+    const prompt = typeof app.prompt === 'string' ? app.prompt.trim() : '';
+    if (!prompt)
+        return base;
+    const params = `bounded_prompt=${encodeURIComponent(prompt)}`
+        + (app.handoff ? `&bounded_handoff=${encodeURIComponent(app.handoff)}` : '');
+    return `${base}#${params}`;
+}
+async function list() {
+    // This legacy-compatible action shape is also used by oapps.fun listMyApps.
+    const response = await requestDevApi('/', {
+        method: 'POST',
+        body: { action: 'listApps' },
     });
+    const rows = Array.isArray(response.apps) ? response.apps : [];
+    return rows
+        .map((value) => {
+        var _a, _b, _c, _d;
+        const row = value && typeof value === 'object'
+            ? value
+            : {};
+        const appId = String((_c = (_b = (_a = row._id) !== null && _a !== void 0 ? _a : row.id) !== null && _b !== void 0 ? _b : row.appId) !== null && _c !== void 0 ? _c : '');
+        if (!/^[a-f0-9]{24}$/i.test(appId))
+            return null;
+        const name = String((_d = row.name) !== null && _d !== void 0 ? _d : '').trim() || '(unnamed app)';
+        const slug = typeof row.slug === 'string' && row.slug ? row.slug : undefined;
+        const url = typeof row.url === 'string' && row.url.trim() ? row.url.trim() : undefined;
+        const buildStatus = row.buildStatus === 'building' || row.buildStatus === 'build_failed'
+            ? row.buildStatus
+            : undefined;
+        return Object.assign(Object.assign(Object.assign({ appId,
+            name }, (slug ? { slug } : {})), (url ? { url } : {})), (buildStatus ? { buildStatus } : {}));
+    })
+        .filter((app) => app !== null);
 }
 /**
- * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
- * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
- * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
- * browser blocks the popup.
- *
- * On the user's FIRST signature the popup transparently enrolls a device passkey
- * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
- * signatures are just a passkey approval.
+ * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
+ * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
  */
-async function signSolanaMessageViaTurnkey(message) {
-    if (!hasDOM$1()) {
-        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+const apps = { create, list, buildCreateRedirectUrl };
+
+async function deserializeTransaction(tx) {
+    // Literal specifier so bundlers can code-split the lazy chunk.
+    const { Transaction, VersionedTransaction } = await import('@solana/web3.js');
+    const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
+    if ((buf[0] & 0x80) !== 0) {
+        return VersionedTransaction.deserialize(buf);
+    }
+    else {
+        return Transaction.from(buf);
     }
-    const { url, origin } = await turnkeySignerPage();
-    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
-    const messageHex = toHex(message);
-    return await deliver(url, origin, {
-        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
-        onResult: (d) => {
-            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
-                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
-            }
-            return { error: String(d.error || 'Turnkey signing failed') };
-        },
-    });
 }
 
 // bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
@@ -8063,5 +7909,5 @@ function defaultInjectedEvmProvider() {
     return null;
 }
 
-export { FAILURE_REASONS as $, completeLoginFromRedirect as A, loginWithPopup as B, completeLoginInPopup as C, openBoundedWidget as D, EMBEDDED_WALLET_UNSUPPORTED as E, useAuth as F, useQuery as G, useBuildRun as H, apps as I, deserializeTransaction as J, signSolanaMessageViaTurnkey as K, getOrCreateTurnkeyWallet as L, startTurnkeyEmailLogin as M, getIdToken as N, onramp as O, onrampQuote as P, onrampStatus as Q, setPlatform as R, OffchainAuthProvider as S, PrivyExpoProvider as T, requestEip6963Providers as U, builds as V, BuildsApiError as W, NON_TERMINAL_STATES as X, TERMINAL_STATES as Y, RUN_STATES as Z, PARK_REASONS as _, hasEmbeddedEvmWallet as a, BUILD_REVIEW_CAPABILITY_SCHEMA as a0, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a1, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a2, embeddedSignAndSubmit as b, setAuthLoading as c, defaultInjectedProvider as d, embeddedRunEvmTransaction as e, bufferExports as f, getPlatform as g, hasEmbeddedWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithWallet as y, loginWithRedirect as z };
-//# sourceMappingURL=index-L2R6C5Vl.mjs.map
+export { BUILD_REVIEW_CAPABILITY_SCHEMA as $, completeLoginFromRedirect as A, loginWithPopup as B, completeLoginInPopup as C, openBoundedWidget as D, useAuth as E, useQuery as F, useBuildRun as G, apps as H, deserializeTransaction as I, signSolanaMessageViaTurnkey as J, getOrCreateTurnkeyWallet as K, startTurnkeyEmailLogin as L, getIdToken as M, onramp as N, onrampQuote as O, onrampStatus as P, setPlatform as Q, OffchainAuthProvider as R, PrivyExpoProvider as S, requestEip6963Providers as T, builds as U, BuildsApiError as V, NON_TERMINAL_STATES as W, TERMINAL_STATES as X, RUN_STATES as Y, PARK_REASONS as Z, FAILURE_REASONS as _, signMessageWithTurnkey as a, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a0, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a1, signTransactionWithTurnkey as b, signAndSubmitTransactionWithTurnkey as c, defaultInjectedProvider as d, setAuthLoading as e, bufferExports as f, getPlatform as g, hasTurnkeyWallet as h, bs58 as i, confirmAndCheckTransaction as j, defaultInjectedEvmProvider as k, init as l, getCurrentUser as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, onAuthLoadingChanged as p, getAuthLoading as q, resolveSolanaRpcUrl as r, setCurrentUser as s, login as t, logout as u, getAuthProvider as v, signInAnonymously as w, loginWithPrivy as x, loginWithWallet as y, loginWithRedirect as z };
+//# sourceMappingURL=index-7yz-Olrm.mjs.map