@bounded-sh/client 0.0.61 → 0.0.64

package/dist/{index-C_L497w1.js → index-Bk0nEjB6.js}

@@ -868,6 +868,8 @@ function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
 
+var safeBuffer = {exports: {}};
+
 var buffer = {};
 
 var base64Js = {};
@@ -3237,10 +3239,6 @@ function requireBuffer () {
 	return buffer;
 }
 
-var bufferExports = requireBuffer();
-
-var safeBuffer = {exports: {}};
-
 /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
 
 var hasRequiredSafeBuffer;
@@ -3454,327 +3452,725 @@ var basex = /*@__PURE__*/getDefaultExportFromCjs(srcExports);
 var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
 var bs58 = basex(ALPHABET);
 
-// crossmint-signer-bridge.ts — routes embedded-wallet signing through the
-// Bounded-owned signer popup (auth.bounded.sh/wallet/signer).
+var bufferExports = requireBuffer();
+
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
 //
-// Slice-1 attached a non-custodial Crossmint smart wallet to email logins and
-// populated `@user.address`. This bridge is the slice-2 counterpart: a user
-// whose address came from `auth.wallets` can APPROVE transactions with that
-// wallet from ANY app, non-custodially, by having the Crossmint client SDK run
-// ONLY on the Bounded signer page (one whitelisted origin) and talking to it via
-// postMessage.
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because a WebAuthn passkey is bound to one origin).
 //
-// SEMANTICS (Crossmint Solana smart wallets): these wallets cannot produce raw
-// detached signatures — there is no signMessage and no sign-without-submit. The
-// only honest primitive is EXECUTION (sign + submit) via the wallet's email-OTP
-// authorization. So this bridge implements `signAndSubmitTransaction` and a
-// token-send; `signMessage` / `signTransaction` throw a clear unsupported error.
-const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets — Crossmint Solana smart wallets sign ' +
-    'and submit atomically. Use signAndSubmitTransaction() (or bounded.sendWalletToken) ' +
-    'instead of signMessage/signTransaction.';
-const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so email logins get a non-custodial wallet (@user.address), ' +
-    'then sign from a user gesture.';
-function hasDOM$5() {
-    return typeof window !== 'undefined' && typeof document !== 'undefined';
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$4() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
 }
-function decodeJwt$1(token) {
-    try {
-        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
-        const pad = b64.length % 4;
-        if (pad === 2)
-            b64 += '==';
-        else if (pad === 3)
-            b64 += '=';
-        return JSON.parse(bufferExports.Buffer.from(b64, 'base64').toString('utf8'));
-    }
-    catch (_a) {
-        return {};
-    }
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
 }
-// Pull the embedded-wallet identity out of the active session's id token.
-// Returns null when this session has no wallet (so callers can throw the
-// informative NO_EMBEDDED_WALLET error).
-function walletClaimsFromSession(chain = 'solana') {
-    let idToken = null;
-    try {
-        idToken = core.getActiveSessionManager().getIdToken();
-    }
-    catch (_a) {
-        idToken = null;
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
     }
-    if (!idToken)
-        return null;
-    const c = decodeJwt$1(idToken);
-    const address = c['custom:walletAddress'];
-    const evmAddress = c['custom:evmWalletAddress'];
-    const email = c['email'];
-    if (typeof email !== 'string' || !email)
-        return null;
-    if (chain === 'solana' && (typeof address !== 'string' || !address))
-        return null;
-    if (chain === 'evm' && (typeof evmAddress !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(evmAddress)))
-        return null;
-    const envClaim = c['custom:walletEnvironment'];
-    const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
-    return Object.assign(Object.assign(Object.assign({ email }, (typeof address === 'string' && address ? { address } : {})), (typeof evmAddress === 'string' ? { evmAddress: evmAddress.toLowerCase() } : {})), { environment });
-}
-async function signerPageUrl() {
-    const cfg = await core.getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
-}
-let requestSeq$1 = 0;
-/**
- * Open the Bounded signer popup, send `action` to it, and resolve with the
- * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
- * the browser will block the popup — in which case this rejects with a clear
- * "Popup blocked" error telling the app to call from a user gesture.
- *
- * Non-custodial: the popup gates signing behind an email OTP delivered to the
- * wallet's owner, and validates that the wallet address matches the account.
- */
-async function signViaSignerPopup(action) {
-    if (!hasDOM$5()) {
-        throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
-    }
-    const isEvm = action.kind === 'evmTransaction';
-    const claims = walletClaimsFromSession(isEvm ? 'evm' : 'solana');
-    if (!claims)
-        throw new Error(NO_EMBEDDED_WALLET);
-    const { url, origin: signerOrigin } = await signerPageUrl();
-    const requestId = `bsign_${Date.now()}_${++requestSeq$1}`;
-    // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
-    const w = 420, h = 600;
-    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
-    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-wallet-signer', `width=${w},height=${h},left=${left},top=${top}`);
-    if (!popup) {
-        throw new Error('Popup blocked — call signAndSubmitTransaction() from a user gesture (e.g. a click handler) so the wallet approval window can open.');
-    }
-    const request = {
-        type: 'bounded:sign',
-        requestId,
-        environment: claims.environment, // may be undefined → page auto-detects
-        email: claims.email,
-        address: isEvm ? claims.evmAddress : claims.address,
-        action,
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
     };
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        let closeTimer;
-        let sentRequest = false;
-        const cleanup = () => {
-            settled = true;
-            window.removeEventListener('message', onMsg);
-            if (closeTimer)
-                clearInterval(closeTimer);
-        };
-        const sendRequest = () => {
-            if (sentRequest)
-                return;
-            sentRequest = true;
-            try {
-                popup.postMessage(request, signerOrigin);
-            }
-            catch ( /* popup gone */_a) { /* popup gone */ }
-        };
-        const onMsg = (ev) => {
-            if (ev.origin !== signerOrigin)
-                return; // only trust the signer page origin
-            if (ev.source !== popup)
-                return; // only trust this signer popup window
-            const d = ev.data;
-            if (!d || typeof d !== 'object')
-                return;
-            if (d.type === 'bounded:signer:ready') {
-                sendRequest();
-                return;
-            }
-            if (d.type === 'bounded:signer:result' && d.requestId === requestId) {
-                cleanup();
-                try {
-                    popup.close();
-                }
-                catch ( /* ignore */_a) { /* ignore */ }
-                if (d.ok)
-                    resolve({ hash: d.hash, explorerLink: d.explorerLink, transactionId: d.transactionId });
-                else
-                    reject(new Error(String(d.error || 'Wallet signing failed')));
-            }
-        };
-        window.addEventListener('message', onMsg);
-        // Fallback: if the ready ping was missed (fast load / focus race), push the
-        // request shortly after opening. The page ignores it until a bounded:sign
-        // arrives and only acts on the first one, so a duplicate is harmless.
-        setTimeout(sendRequest, 1200);
-        // If the user closes the popup before completing, reject (unless a result
-        // just arrived — give any in-flight message a beat to settle first).
-        closeTimer = setInterval(() => {
-            if (popup.closed) {
-                clearInterval(closeTimer);
-                setTimeout(() => { if (!settled) {
-                    cleanup();
-                    reject(new Error('Wallet approval window was closed before signing completed.'));
-                } }, 400);
-            }
-        }, 500);
-        // Overall safety timeout (OTP + signing). Generous — the user may take a
-        // while to fetch the code from their email.
-        setTimeout(() => { if (!settled) {
-            cleanup();
-            try {
-                popup.close();
-            }
-            catch ( /* ignore */_a) { /* ignore */ }
-            reject(new Error('Wallet approval timed out.'));
-        } }, 5 * 60 * 1000);
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
     });
+    modal = m;
+    return m;
 }
-// Serialize a legacy or versioned Solana transaction to BASE58 for the signer
-// page. Crossmint's smart-wallet createTransaction endpoint requires the
-// `serializedTransaction` string to be base58 — it rejects base64 with
-// "Invalid base58 string" (verified against Crossmint staging 2026-07-07). The
-// `wallets-sdk` object path bs58-encodes internally, so base58 is the contract.
-//
-// We do NOT require existing signatures (the smart wallet signs on the page);
-// Crossmint extracts the instructions, overrides the fee payer to its sponsor,
-// and re-wraps them for the smart wallet.
-function serializeTransaction(transaction) {
-    const isLegacy = 'recentBlockhash' in transaction &&
-        !('message' in transaction && 'staticAccountKeys' in transaction.message);
-    const bytes = isLegacy
-        ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
-        : transaction.serialize();
-    return bs58.encode(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    window.setTimeout(() => {
+        m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+// True outer height of the mounted card: the max of its padding-box scroll height
+// (catches overflowing descendants) and its border-box height plus own vertical
+// margins (catches border + margins, which scrollHeight omits). Ceiled so a
+// sub-pixel row is never clipped under `overflow:hidden`.
+function measureOuterHeight(target) {
+    var _a;
+    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
+    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
+    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
+    const rect = target.getBoundingClientRect().height;
+    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
 }
 /**
- * Whether the active session carries an embedded wallet (so the provider should
- * route signing through the popup rather than throw "no wallet").
+ * Measure the currently mounted native content and tween the panel to fit it.
+ * Re-fits automatically when the card's intrinsic height changes - notably after
+ * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
+ * after first paint) and on inline view swaps (email -> OTP code -> success).
  */
-function hasEmbeddedWallet() {
-    return walletClaimsFromSession() != null;
-}
-/** Whether the active email/social session carries an embedded Crossmint EVM wallet. */
-function hasEmbeddedEvmWallet() {
-    return walletClaimsFromSession('evm') != null;
-}
-/** signAndSubmitTransaction for embedded wallets: serialize + route through the
- *  signer popup, resolve with the on-chain transaction signature/hash. */
-async function embeddedSignAndSubmit(transaction) {
-    const serializedTransaction = serializeTransaction(transaction);
-    const result = await signViaSignerPopup({ kind: 'transaction', serializedTransaction });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no transaction hash.');
-    return hash;
-}
-/** Submit a validated BoundedRuntime EVM write through the user's email signer. */
-async function embeddedRunEvmTransaction(transaction) {
+function fitPanelToContent(m) {
     var _a, _b;
-    if (!transaction.to || !transaction.data || !transaction.chainId)
-        throw new Error('Incomplete embedded EVM transaction');
-    if (!/^0x[0-9a-fA-F]{40}$/.test(transaction.to))
-        throw new Error('Invalid embedded EVM runtime address');
-    core.assertCanonicalBoundedRuntimeWriteCalldata(transaction.data);
-    if (!Number.isSafeInteger(transaction.chainId) || transaction.chainId <= 0)
-        throw new Error('Invalid embedded EVM chain id');
-    if (transaction.nonce !== undefined)
-        throw new Error('Server-supplied EVM nonces are not accepted');
-    try {
-        if (BigInt((_a = transaction.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
-            throw new Error('Bounded EVM writes cannot transfer native value');
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.includes('cannot transfer'))
-            throw error;
-        throw new Error('Invalid embedded EVM transaction value');
+    const first = m.content.firstElementChild;
+    const target = first || m.content;
+    const apply = () => {
+        // Only fit while this exact node is still the mounted card.
+        if (m.content.firstElementChild !== first && first)
+            return;
+        const h = measureOuterHeight(target);
+        if (h > 0)
+            setPanelHeight(m, h);
+    };
+    apply();
+    const view = target.ownerDocument.defaultView;
+    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
+    // have painted, so the height never lags a late reflow.
+    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
+    const fonts = target.ownerDocument.fonts;
+    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
+        fonts.ready.then(apply).catch(() => { });
+    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
+    m.fitObserver = null;
+    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
+        const ro = new view.ResizeObserver(() => apply());
+        ro.observe(first);
+        m.fitObserver = ro;
     }
-    const result = await signViaSignerPopup({
-        kind: 'evmTransaction',
-        transaction: { to: transaction.to, data: transaction.data, value: (_b = transaction.value) !== null && _b !== void 0 ? _b : '0', chainId: transaction.chainId },
-    });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no EVM transaction hash.');
-    return { transactionSignature: hash, blockNumber: 0, gasUsed: '0', data: result };
+}
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
+function mountContent(m, node) {
+    var _a;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.replaceChildren(node);
+    m.content.style.display = "block";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin) {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
+    // inside the frame from the user's click (transient activation stays in-frame).
+    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.onIframeMessage = null;
+}
+// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
+// JetBrains Mono) once at the document level so they apply inside the shadow root. A
+// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
+const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+function ensureFonts() {
+    if (!hasDOM$4())
+        return;
+    if (document.querySelector('link[data-bounded-fonts="1"]'))
+        return;
+    const pre1 = document.createElement("link");
+    pre1.rel = "preconnect";
+    pre1.href = "https://fonts.googleapis.com";
+    const pre2 = document.createElement("link");
+    pre2.rel = "preconnect";
+    pre2.href = "https://fonts.gstatic.com";
+    pre2.crossOrigin = "anonymous";
+    const link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = FONTS_HREF;
+    link.setAttribute("data-bounded-fonts", "1");
+    document.head.append(pre1, pre2, link);
 }
 
-// Same message the email provider uses when a hosted (OIDC) login has no
-// embedded wallet — enable `auth.wallets` in policy to get one.
-const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so logins get a non-custodial Crossmint wallet (@user.address), ' +
-    'then sign from a user gesture.';
-const PKCE_STORE_KEY = 'bounded.oidc.pkce';
-const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
-const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
-// Active session store (Web on web, RN on React Native) — selected by config,
-// not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
-// session it mints is read back through this same selector everywhere.
-const sessionManager = core.getActiveSessionManager;
-function hasDOM$4() {
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app card plus
+// the OS Face ID / Touch ID sheet, never a jarring popup.
+//
+// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
+// MUST run on the single Bounded signer origin. The iframe carries the
+// publickey-credentials-{get,create} permission policy and the user's click lands
+// INSIDE it, giving WebAuthn the transient activation it needs.
+//
+// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
+// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
+// SAME request through `popupFallback` (a real window). Callers pass a popup
+// implementation and never see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
+ * (Safari cross-origin create) or cannot be mounted.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$4())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        let settled = false;
+        let usedFallback = false;
+        const iframe = ensureIframe(m, url, signerOrigin);
+        const send = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                m.iframeReady = true;
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
+                goFallback();
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
+// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
+// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
+//
+// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
+// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
+// look + motion, so signing feels native. Safari (unreliable at iframe passkey
+// CREATE) and any environment where the frame cannot mount fall back to a real
+// popup window; both transports speak the same postMessage protocol.
+//
+// Turnkey wallets produce raw detached signatures. The signer runs the Turnkey
+// browser SDK on the single Bounded origin and stamps an ed25519 signRawPayload
+// with the user's passkey. The app retains the transaction itself.
+//
+// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
+// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
+// every user one wallet + one passkey that roams across every app.
+function hasDOM$3() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
-function decodeJwt(token) {
+// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
+// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
+// fail - and a post-failure popup would no longer have a user gesture to open with.
+// There we pick the popup up front, from the original click, so enrollment is solid.
+// Everywhere else the inline widget is used (buttery in-app modal).
+function preferPopup() {
+    if (!hasDOM$3() || typeof navigator === 'undefined')
+        return true;
+    const ua = navigator.userAgent || '';
+    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+}
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (Safari enrollment, or the frame never loads).
+async function deliver(url, origin, ex) {
+    const popup = () => runPopup(url, origin, ex);
+    if (preferPopup())
+        return popup();
+    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+}
+async function turnkeySignerPage() {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+function toHex(bytes) {
+    let h = '';
+    for (const b of bytes)
+        h += b.toString(16).padStart(2, '0');
+    return h;
+}
+function fromHex(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(clean.substr(i * 2, 2), 16);
+    return out;
+}
+function decodeJwt$1(token) {
     try {
-        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
-        const pad = b64.length % 4;
-        if (pad === 2)
-            b64 += '==';
-        else if (pad === 3)
-            b64 += '=';
-        return JSON.parse(getPlatform().atob(b64));
+        let value = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padding = value.length % 4;
+        if (padding === 2)
+            value += '==';
+        else if (padding === 3)
+            value += '=';
+        return JSON.parse(getPlatform().atob(value));
     }
     catch (_a) {
         return {};
     }
 }
-// A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
-// Signing surface (slice 2): a hosted login on a wallets-enabled app carries an
-// embedded Crossmint wallet (@user.address). signAndSubmitTransaction routes
-// through the Bounded signer popup; signMessage/signTransaction are structurally
-// unsupported for Crossmint smart wallets (sign+submit atomically, no raw sig).
-const oidcProviderSingleton = {
-    async login() {
-        const idToken = sessionManager().getIdToken();
-        return idToken ? userFromIdToken(idToken) : null;
-    },
-    async getUser() {
-        const idToken = sessionManager().getIdToken();
-        return idToken ? userFromIdToken(idToken) : null;
+function activeTurnkeyAddress() {
+    let token = null;
+    try {
+        token = core.getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        token = null;
+    }
+    if (!token)
+        return null;
+    const claims = decodeJwt$1(token);
+    const address = claims['custom:walletAddress'];
+    const provider = claims['custom:walletProvider'];
+    return provider === 'turnkey' && typeof address === 'string' && address
+        ? address
+        : null;
+}
+let requestSeq = 0;
+// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
+// resolve when `onResult` accepts a result message. Origin + source are pinned.
+async function runPopup(url, signerOrigin, ex) {
+    var _a, _b;
+    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
+    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
+    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
+    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    if (!popup) {
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+    }
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let sentRequest = false;
+        let closeTimer;
+        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
+            clearInterval(closeTimer); };
+        const sendRequest = () => { if (sentRequest)
+            return; sentRequest = true; try {
+            popup.postMessage(ex.request, signerOrigin);
+        }
+        catch ( /* popup gone */_a) { /* popup gone */ } };
+        const onMsg = (event) => {
+            if (event.origin !== signerOrigin)
+                return;
+            if (event.source !== popup)
+                return;
+            const d = event.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:turnkey:ready') {
+                sendRequest();
+                return;
+            }
+            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
+                const outcome = ex.onResult(d);
+                if ('error' in outcome) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    reject(new Error(outcome.error));
+                    return;
+                }
+                if (outcome.done) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
+                    resolve(outcome.value);
+                }
+            }
+        };
+        window.addEventListener('message', onMsg);
+        setTimeout(sendRequest, 1200);
+        closeTimer = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(closeTimer);
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Wallet approval window was closed before it completed.'));
+                } }, 400);
+            }
+        }, 500);
+        setTimeout(() => { if (!settled) {
+            cleanup();
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_a) { /* ignore */ }
+            reject(new Error('Wallet approval timed out.'));
+        } }, 5 * 60 * 1000);
+    });
+}
+function hasTurnkeyWallet() {
+    return activeTurnkeyAddress() !== null;
+}
+/**
+ * Get-or-create the user's non-custodial Turnkey wallet, resolving with its stable
+ * Solana address. On first use the popup enrolls a device passkey (Face ID / Touch ID)
+ * and creates the wallet (lazy) with no email code; if the wallet already exists it
+ * resolves immediately without a prompt. Call from a USER GESTURE.
+ *
+ * Use this to learn the fee-payer address BEFORE building a transaction to sign.
+ */
+async function getOrCreateTurnkeyWallet() {
+    if (!hasDOM$3())
+        throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:createWallet', requestId },
+        onResult: (d) => {
+            if (d.ok && typeof d.address === 'string')
+                return { done: true, value: { address: d.address, subOrgId: String(d.subOrgId || '') } };
+            return { error: String(d.error || 'Wallet setup failed') };
+        },
+    });
+}
+/**
+ * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
+ * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
+ * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
+ * browser blocks the popup.
+ *
+ * On the user's FIRST signature the popup transparently enrolls a device passkey
+ * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
+ * signatures are just a passkey approval.
+ */
+async function signSolanaMessageViaTurnkey(message) {
+    if (!hasDOM$3()) {
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
+    const messageHex = toHex(message);
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
+        onResult: (d) => {
+            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
+            }
+            return { error: String(d.error || 'Turnkey signing failed') };
+        },
+    });
+}
+function requireMatchingAddress(result) {
+    const expected = activeTurnkeyAddress();
+    if (!expected)
+        throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+    if (result.address !== expected)
+        throw new Error('Turnkey signer returned a different wallet address than the active session.');
+    return expected;
+}
+async function signMessageWithTurnkey(message) {
+    const result = await signSolanaMessageViaTurnkey(getPlatform().textEncode(message));
+    requireMatchingAddress(result);
+    return bs58.encode(result.signature);
+}
+async function signTransactionWithTurnkey(transaction) {
+    const isLegacy = 'serializeMessage' in transaction;
+    const message = isLegacy
+        ? transaction.serializeMessage()
+        : transaction.message.serialize();
+    const result = await signSolanaMessageViaTurnkey(new Uint8Array(message));
+    const address = requireMatchingAddress(result);
+    const { PublicKey } = await import('@solana/web3.js');
+    if (isLegacy) {
+        transaction.addSignature(new PublicKey(address), bufferExports.Buffer.from(result.signature));
+    }
+    else {
+        transaction.addSignature(new PublicKey(address), result.signature);
+    }
+    return transaction;
+}
+async function signAndSubmitTransactionWithTurnkey(transaction, feePayer) {
+    var _a;
+    const config = await core.getConfig();
+    const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+    if (!rpcUrl)
+        throw new Error('Turnkey transaction submission requires init({ rpcUrl }).');
+    const { Connection, PublicKey } = await import('@solana/web3.js');
+    const connection = new Connection(rpcUrl, 'confirmed');
+    const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
+    const isLegacy = 'serializeMessage' in transaction;
+    if (isLegacy) {
+        const legacy = transaction;
+        legacy.recentBlockhash = blockhash;
+        legacy.lastValidBlockHeight = lastValidBlockHeight;
+        if (!legacy.feePayer) {
+            const address = activeTurnkeyAddress();
+            if (!address)
+                throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+            legacy.feePayer = feePayer !== null && feePayer !== void 0 ? feePayer : new PublicKey(address);
+        }
+    }
+    else {
+        transaction.message.recentBlockhash = blockhash;
+    }
+    const signed = await signTransactionWithTurnkey(transaction);
+    const signature = await connection.sendRawTransaction(signed.serialize(), {
+        skipPreflight: false,
+        maxRetries: 3,
+    });
+    const confirmation = await connection.confirmTransaction({ signature, blockhash, lastValidBlockHeight }, 'confirmed');
+    if (confirmation.value.err) {
+        throw new Error(`Turnkey transaction failed: ${JSON.stringify(confirmation.value.err)}`);
+    }
+    return signature;
+}
+
+// Same message the email provider uses when a hosted (OIDC) login has no
+// embedded wallet — enable `auth.wallets` in policy to get one.
+const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +
+    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';
+const PKCE_STORE_KEY = 'bounded.oidc.pkce';
+const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
+const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
+// Active session store (Web on web, RN on React Native) — selected by config,
+// not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
+// session it mints is read back through this same selector everywhere.
+const sessionManager = core.getActiveSessionManager;
+function hasDOM$2() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+function decodeJwt(token) {
+    try {
+        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const pad = b64.length % 4;
+        if (pad === 2)
+            b64 += '==';
+        else if (pad === 3)
+            b64 += '=';
+        return JSON.parse(getPlatform().atob(b64));
+    }
+    catch (_a) {
+        return {};
+    }
+}
+// A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
+// Turnkey supplies the default Solana wallet and supports raw message and transaction
+// signatures through the Bounded signer window.
+const oidcProviderSingleton = {
+    async login() {
+        const idToken = sessionManager().getIdToken();
+        return idToken ? userFromIdToken(idToken) : null;
+    },
+    async getUser() {
+        const idToken = sessionManager().getIdToken();
+        return idToken ? userFromIdToken(idToken) : null;
     },
     async logout() { await sessionManager().clearSession(); },
-    async signMessage(_message) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signMessage(message) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signMessageWithTurnkey(message);
     },
-    async signTransaction(_t) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signTransaction(transaction) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signTransactionWithTurnkey(transaction);
     },
-    async runTransaction(evm, sol, options) {
+    async runTransaction(evm, sol, _options) {
         if (evm && sol)
             throw new Error('A transaction cannot target EVM and Solana at the same time.');
-        if (!evm)
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
-            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');
-        if (!hasEmbeddedEvmWallet())
-            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');
-        return embeddedRunEvmTransaction(evm);
+        if (evm)
+            throw new Error('Turnkey embedded wallets currently support Solana only. Connect an EVM wallet for EVM transactions.');
+        throw new Error('This Solana transaction shape is not supported by the Turnkey provider. Use a pre-built transaction.');
     },
-    async signAndSubmitTransaction(transaction, _feePayer) {
-        if (!hasEmbeddedWallet())
+    async signAndSubmitTransaction(transaction, feePayer) {
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        return embeddedSignAndSubmit(transaction);
+        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);
     },
 };
 function userFromIdToken(idToken) {
     const c = decodeJwt(idToken);
     const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';
     return {
-        id, address: (c['custom:walletAddress'] || null),
-        evmAddress: typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])
-            ? c['custom:evmWalletAddress'].toLowerCase()
-            : null,
+        id,
+        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),
+        evmAddress: null,
         email: (c.email || null), provider: oidcProviderSingleton,
     };
 }
@@ -3852,7 +4248,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM$4() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$2() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -3960,7 +4356,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM$4())
+    if (!hasDOM$2())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -3976,7 +4372,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM$4())
+    if (!hasDOM$2())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4022,7 +4418,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM$4())
+    if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -4162,7 +4558,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$4() || !window.opener)
+    if (!hasDOM$2() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -4498,14 +4894,13 @@ function getInitConfig() {
     return initConfig;
 }
 /**
- * Which LOGIN mode the app runs (default "bounded"). "turnkey" opts the app into
- * Turnkey-native email OTP: the unified widget runs the code entry INLINE (no OIDC
- * popup) via startTurnkeyEmailLogin(), and Bounded mints the session from Turnkey's
- * verification. The value comes from init() config (`authMode`); a `openBoundedWidget`
- * option can override it per call. Anything other than "turnkey" is "bounded".
+ * Which LOGIN mode the app runs (default "turnkey"). Turnkey-native email OTP keeps
+ * code entry inline in the unified widget (no OIDC popup), and Bounded mints the
+ * session from Turnkey's verification. Apps can explicitly select "bounded" for the
+ * legacy Better Auth email flow. A per-call openBoundedWidget option can override it.
  */
 function resolveAuthMode(config) {
-    return config.authMode === 'turnkey' ? 'turnkey' : 'bounded';
+    return config.authMode === 'bounded' ? 'bounded' : 'turnkey';
 }
 /**
  * Resolve the injected-wallet-config the provider should use, merging the
@@ -4566,7 +4961,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-9BwSziWj.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-97CluDlZ.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4585,7 +4980,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-oCRGuls5.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CSj0lY9H.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4598,7 +4993,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-DgWUaVtt.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-B5MA0w8I.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4626,7 +5021,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Di0TRg-z.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BvIf5W5c.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4682,7 +5077,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-Di0TRg-z.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BvIf5W5c.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -4833,7 +5228,7 @@ async function loginWithWallet(options) {
         ? Object.assign(Object.assign({}, base), { getProvider: options.getProvider }) : base;
     const rpcUrl = normalizeSolanaRpcUrl(cfg.rpcUrl);
     const network = getConfiguredSolanaNetwork(cfg);
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-oCRGuls5.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CSj0lY9H.js'); });
     let provider = new InjectedWalletProvider(injectedConfig, rpcUrl, network);
     if (coreConfig.chain === 'offchain')
         provider = new OffchainAuthProvider(provider);
@@ -5233,276 +5628,23 @@ function setAuthProviderInstance(provider) {
     authProviderInstance = provider;
 }
 
-// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
-// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
-// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
-// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
-//
-// It hosts EITHER:
-//   - NATIVE content (the login card the SDK renders itself), or
-//   - an IFRAME (the Bounded-owned signer page, which must run on the single
-//     signer origin because a WebAuthn passkey is bound to one origin).
-//
-// The modal is a warm singleton: it stays mounted (hidden) between uses so a
-// second open - or a signature right after login - is instant and, when it is
-// already open, a clean in-place view swap rather than a reopen.
-function hasDOM$3() {
-    return typeof window !== "undefined" && typeof document !== "undefined";
-}
-const OVERLAY_CSS = `
-:host{all:initial}
-*{box-sizing:border-box}
-.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
-.bw-ov.mounted{display:block}
-.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
-  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
-.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
-.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
-  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
-  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
-  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
-  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
-    height .3s cubic-bezier(.2,.8,.2,1)}
-.bw-ov.show .bw-back{opacity:1}
-.bw-ov.show .bw-panel{opacity:1;transform:none}
-.bw-ov.closing .bw-back{opacity:0}
-.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
-.bw-content{position:absolute;inset:0;overflow:hidden}
-.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
-/* editorial corner crop-marks, matching the reference frame */
-.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
-  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
-.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
-.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
-.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
-.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
-@media(max-width:560px){
-  .bw-wrap{align-items:flex-end;padding:0}
-  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
-  .bw-content{overflow-y:auto}
-  .bw-ov.show .bw-panel{transform:none}
-  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
-}
-@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
-`;
-let modal = null;
-function getModal() {
-    if (modal)
-        return modal;
-    const root = document.createElement("div");
-    root.setAttribute("data-bounded-widget", "");
-    const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
-    const overlay = document.createElement("div");
-    overlay.className = "bw-ov";
-    const back = document.createElement("div");
-    back.className = "bw-back";
-    const wrap = document.createElement("div");
-    wrap.className = "bw-wrap";
-    const panel = document.createElement("div");
-    panel.className = "bw-panel";
-    const content = document.createElement("div");
-    content.className = "bw-content";
-    panel.appendChild(content);
-    for (const corner of ["tl", "tr", "bl", "br"]) {
-        const mk = document.createElement("span");
-        mk.className = "bw-mk " + corner;
-        panel.appendChild(mk);
-    }
-    wrap.appendChild(panel);
-    overlay.appendChild(back);
-    overlay.appendChild(wrap);
-    shadow.appendChild(overlay);
-    (document.body || document.documentElement).appendChild(root);
-    const m = {
-        root,
-        overlay,
-        panel,
-        content,
-        iframe: null,
-        iframeOrigin: "",
-        iframeReady: false,
-        onBackdrop: null,
-        onIframeMessage: null,
-        chain: Promise.resolve(),
-        fitObserver: null,
-    };
-    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
-    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
-    // outside the panel. Fire only when the click lands on the wrap itself, never
-    // when it bubbles up from the panel or its content.
-    wrap.addEventListener("click", (event) => {
-        if (event.target === wrap && m.onBackdrop)
-            m.onBackdrop();
-    });
-    window.addEventListener("message", (event) => {
-        if (!m.iframe)
-            return;
-        if (event.origin !== m.iframeOrigin)
-            return;
-        if (event.source !== m.iframe.contentWindow)
-            return;
-        const d = event.data;
-        if (!d || typeof d !== "object")
-            return;
-        if (m.onIframeMessage)
-            m.onIframeMessage(d);
-    });
-    modal = m;
-    return m;
-}
-function showModal(m) {
-    m.overlay.classList.remove("closing");
-    m.overlay.classList.add("mounted");
-    // Force a reflow so the .show transition runs from the hidden state every open.
-    void m.panel.offsetWidth;
-    m.overlay.classList.add("show");
-}
-function hideModal(m, after) {
-    m.overlay.classList.remove("show");
-    m.overlay.classList.add("closing");
-    window.setTimeout(() => {
-        m.overlay.classList.remove("mounted", "closing");
-    }, 260);
-}
-function setPanelHeight(m, px) {
-    const h = Math.max(140, Math.min(680, Math.round(px)));
-    m.panel.style.height = h + "px";
-}
-// True outer height of the mounted card: the max of its padding-box scroll height
-// (catches overflowing descendants) and its border-box height plus own vertical
-// margins (catches border + margins, which scrollHeight omits). Ceiled so a
-// sub-pixel row is never clipped under `overflow:hidden`.
-function measureOuterHeight(target) {
-    var _a;
-    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
-    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
-    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
-    const rect = target.getBoundingClientRect().height;
-    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
-}
-/**
- * Measure the currently mounted native content and tween the panel to fit it.
- * Re-fits automatically when the card's intrinsic height changes - notably after
- * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
- * after first paint) and on inline view swaps (email -> OTP code -> success).
- */
-function fitPanelToContent(m) {
-    var _a, _b;
-    const first = m.content.firstElementChild;
-    const target = first || m.content;
-    const apply = () => {
-        // Only fit while this exact node is still the mounted card.
-        if (m.content.firstElementChild !== first && first)
-            return;
-        const h = measureOuterHeight(target);
-        if (h > 0)
-            setPanelHeight(m, h);
-    };
-    apply();
-    const view = target.ownerDocument.defaultView;
-    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
-    // have painted, so the height never lags a late reflow.
-    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
-    const fonts = target.ownerDocument.fonts;
-    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
-        fonts.ready.then(apply).catch(() => { });
-    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
-    m.fitObserver = null;
-    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
-        const ro = new view.ResizeObserver(() => apply());
-        ro.observe(first);
-        m.fitObserver = ro;
-    }
-}
-/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
-function mountContent(m, node) {
-    var _a;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.replaceChildren(node);
-    m.content.style.display = "block";
-}
-/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
-function ensureIframe(m, url, origin) {
-    var _a;
-    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
-        return m.iframe;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.style.display = "none";
-    const iframe = document.createElement("iframe");
-    iframe.className = "bw-frame";
-    iframe.setAttribute("title", "Bounded");
-    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
-    // inside the frame from the user's click (transient activation stays in-frame).
-    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
-    iframe.src = url;
-    m.iframeOrigin = origin;
-    m.iframeReady = false;
-    m.panel.appendChild(iframe);
-    m.iframe = iframe;
-    return iframe;
-}
-function detachIframe(m) {
-    if (m.iframe) {
-        try {
-            m.iframe.remove();
-        }
-        catch (_a) {
-            /* ignore */
-        }
-    }
-    m.iframe = null;
-    m.iframeReady = false;
-    m.iframeOrigin = "";
-    m.onIframeMessage = null;
-}
-// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
-// JetBrains Mono) once at the document level so they apply inside the shadow root. A
-// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
-const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
-function ensureFonts() {
-    if (!hasDOM$3())
-        return;
-    if (document.querySelector('link[data-bounded-fonts="1"]'))
-        return;
-    const pre1 = document.createElement("link");
-    pre1.rel = "preconnect";
-    pre1.href = "https://fonts.googleapis.com";
-    const pre2 = document.createElement("link");
-    pre2.rel = "preconnect";
-    pre2.href = "https://fonts.gstatic.com";
-    pre2.crossOrigin = "anonymous";
-    const link = document.createElement("link");
-    link.rel = "stylesheet";
-    link.href = FONTS_HREF;
-    link.setAttribute("data-bounded-fonts", "1");
-    document.head.append(pre1, pre2, link);
-}
-
-var __classPrivateFieldGet = (undefined && undefined.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var __classPrivateFieldSet = (undefined && undefined.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var _AppReadyEvent_detail;
-let wallets = undefined;
-const registeredWalletsSet = new Set();
-function addRegisteredWallet(wallet) {
-    cachedWalletsArray = undefined;
-    registeredWalletsSet.add(wallet);
+var __classPrivateFieldGet = (undefined && undefined.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (undefined && undefined.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AppReadyEvent_detail;
+let wallets = undefined;
+const registeredWalletsSet = new Set();
+function addRegisteredWallet(wallet) {
+    cachedWalletsArray = undefined;
+    registeredWalletsSet.add(wallet);
 }
 function removeRegisteredWallet(wallet) {
     cachedWalletsArray = undefined;
@@ -5774,7 +5916,7 @@ function discoverStandardWallets() {
     return out;
 }
 
-function hasDOM$2() {
+function hasDOM$1() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 async function signerOrigin() {
@@ -5851,7 +5993,7 @@ function sealOtpInIframe(code, otpEncryptionTargetBundle) {
  * step needs the signer iframe); on React Native use loginWithRedirect() instead.
  */
 async function startTurnkeyEmailLogin(email) {
-    if (!hasDOM$2()) {
+    if (!hasDOM$1()) {
         throw new Error('Turnkey-native email login is web-only - on React Native use loginWithRedirect()');
     }
     const trimmed = email.trim();
@@ -6040,7 +6182,7 @@ function el(tag, cls, text) {
  */
 async function openBoundedWidget(opts = {}) {
     var _a, _b, _c, _d, _e, _f, _g, _h;
-    if (!hasDOM$3()) {
+    if (!hasDOM$4()) {
         throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
     }
     // Imported lazily to avoid a static cycle with the auth index barrel.
@@ -6413,1014 +6555,718 @@ function useAuth() {
             // Only log errors that aren't user-initiated cancellations
             if (error !== 'exited_auth_flow' && (error === null || error === void 0 ? void 0 : error.message) !== 'exited_auth_flow') {
                 console.error('Error logging in:', error);
-            }
-            setUser(null);
-        }
-        finally {
-            setLoading(false);
-        }
-    };
-    const logout$1 = async () => {
-        try {
-            setLoading(true);
-            await logout();
-            setUser(null);
-        }
-        catch (error) {
-            console.error('Error logging out:', error);
-        }
-        finally {
-            setLoading(false);
-        }
-    };
-    return {
-        login: login$1,
-        logout: logout$1,
-        loading: loading || sdkLoading,
-        user,
-    };
-}
-
-var _a$1;
-// SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
-// React Native has no `window` but DOES support hooks, so detect Node SSR
-// specifically via process.versions.node.
-const isSSR$1 = typeof window === 'undefined'
-    && typeof process !== 'undefined'
-    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
-function useQuery(path, options) {
-    if (isSSR$1) {
-        return { data: undefined, loading: true, error: null };
-    }
-    const [data, setData] = React__namespace.useState(undefined);
-    const [loading, setLoading] = React__namespace.useState(true);
-    const [error, setError] = React__namespace.useState(null);
-    // Re-subscribe only when the query actually changes (not on every render).
-    const optionsKey = options ? JSON.stringify(options) : '';
-    React__namespace.useEffect(() => {
-        if (!path) {
-            setData(undefined);
-            setLoading(false);
-            setError(null);
-            return;
-        }
-        let active = true;
-        let unsubscribe;
-        setLoading(true);
-        setError(null);
-        core.subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
-                if (!active)
-                    return;
-                // A reconnect can legitimately surface a transport error before the
-                // socket re-authenticates and sends a new authorized snapshot. That
-                // fresh snapshot is the recovery boundary: keep the error visible
-                // until data arrives, then clear it so React does not remain stuck on
-                // a failure page after realtime has recovered.
-                setError(null);
-                setData(d);
-                setLoading(false);
-            }, onError: (e) => {
-                if (!active)
-                    return;
-                setError(e instanceof Error ? e : new Error(String(e)));
-                setLoading(false);
-            } }))
-            .then((unsub) => {
-            if (active)
-                unsubscribe = unsub;
-            else
-                void unsub(); // unmounted before subscribe resolved
-        })
-            .catch((e) => {
-            if (!active)
-                return;
-            setError(e instanceof Error ? e : new Error(String(e)));
-            setLoading(false);
-        });
-        return () => {
-            active = false;
-            void (unsubscribe === null || unsubscribe === void 0 ? void 0 : unsubscribe());
-        };
-        // optionsKey captures the option object's contents; path is the other input.
-        // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [path, optionsKey]);
-    return { data, loading, error };
-}
-
-// Wrapper for getIdToken - passes isServer=false for client-side usage
-async function getIdToken() {
-    return core.getIdToken(false);
-}
-
-var __rest = (undefined && undefined.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-/** A structured non-2xx response from the developer API. */
-class BuildsApiError extends Error {
-    constructor(init) {
-        super(init.message);
-        this.name = 'BuildsApiError';
-        this.code = init.code;
-        this.retryable = init.retryable;
-        this.status = init.status;
-        this.details = init.details;
-        this.retryAfterMs = init.retryAfterMs;
-    }
-}
-const memoryIdempotencyKeys = new Map();
-const IDEMPOTENCY_STORAGE_PREFIX = 'bounded:build:idempotency:';
-function retryAfterMs(response) {
-    var _a, _b;
-    const value = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'Retry-After');
-    if (!value)
-        return undefined;
-    const seconds = Number(value);
-    if (Number.isFinite(seconds) && seconds >= 0)
-        return Math.ceil(seconds * 1000);
-    const at = Date.parse(value);
-    if (!Number.isFinite(at))
-        return undefined;
-    return Math.max(0, at - Date.now());
-}
-async function responseBody(response) {
-    const text = await response.text();
-    if (!text)
-        return {};
-    try {
-        return JSON.parse(text);
-    }
-    catch (_a) {
-        return { raw: text };
-    }
-}
-function apiError(response, body) {
-    const envelope = body;
-    const nested = (envelope === null || envelope === void 0 ? void 0 : envelope.error) && typeof envelope.error === 'object'
-        ? envelope.error
-        : undefined;
-    const hasNestedDetails = !!nested && Object.prototype.hasOwnProperty.call(nested, 'details');
-    const hasTopLevelDetails = !!body
-        && typeof body === 'object'
-        && Object.prototype.hasOwnProperty.call(body, 'details');
-    const legacyCode = typeof (body === null || body === void 0 ? void 0 : body.error) === 'string' ? body.error : undefined;
-    const code = typeof (nested === null || nested === void 0 ? void 0 : nested.code) === 'string'
-        ? nested.code
-        : legacyCode !== null && legacyCode !== void 0 ? legacyCode : `http_${response.status}`;
-    const message = typeof (nested === null || nested === void 0 ? void 0 : nested.message) === 'string'
-        ? nested.message
-        : typeof (body === null || body === void 0 ? void 0 : body.message) === 'string'
-            ? body.message
-            : `Developer API request failed with HTTP ${response.status}`;
-    const retryable = typeof (nested === null || nested === void 0 ? void 0 : nested.retryable) === 'boolean'
-        ? nested.retryable
-        : response.status === 429 || response.status >= 500;
-    return new BuildsApiError(Object.assign(Object.assign({ code,
-        message,
-        retryable, status: response.status }, (hasNestedDetails
-        ? { details: nested === null || nested === void 0 ? void 0 : nested.details }
-        : hasTopLevelDetails
-            ? { details: body.details }
-            : {})), (response.status === 429 ? { retryAfterMs: retryAfterMs(response) } : {})));
-}
-/** @internal Shared authenticated developer-api transport for builds and apps. */
-async function requestDevApi(path, request = {}) {
-    var _a, _b;
-    const config = await core.getConfig();
-    const base = (_a = config.devApiUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/$/, '');
-    if (!base) {
-        throw new Error('Bounded developer API is not configured. Pass devApiUrl or a Bounded network to init().');
-    }
-    // Reuse the exact accessor exposed publicly as getIdToken().
-    const token = await getIdToken();
-    if (!token) {
-        throw new BuildsApiError({
-            code: 'auth_required',
-            message: 'Sign in before calling the Bounded developer API.',
-            retryable: false,
-            status: 401,
-        });
-    }
-    const hasBody = request.body !== undefined;
-    const response = await fetch(`${base}${path}`, Object.assign({ method: (_b = request.method) !== null && _b !== void 0 ? _b : 'GET', headers: Object.assign({ Authorization: `Bearer ${token}` }, (hasBody ? { 'Content-Type': 'application/json' } : {})) }, (hasBody ? { body: JSON.stringify(request.body) } : {})));
-    const body = await responseBody(response);
-    if (!response.ok)
-        throw apiError(response, body);
-    return body;
-}
-function intentStorageKey(intentKey) {
-    return `${IDEMPOTENCY_STORAGE_PREFIX}${intentKey}`;
-}
-function isValidIdempotencyKey(value) {
-    return typeof value === 'string' && value.length > 0 && value.length <= 256;
-}
-function readPersistedIdempotencyKey(intentKey) {
-    var _a;
-    const storageKey = intentStorageKey(intentKey);
-    try {
-        const stored = (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.getItem(storageKey);
-        if (isValidIdempotencyKey(stored))
-            return stored;
-    }
-    catch (_b) {
-        // Storage can be disabled by browser privacy policy; use module memory.
-    }
-    const inMemory = memoryIdempotencyKeys.get(storageKey);
-    return isValidIdempotencyKey(inMemory) ? inMemory : undefined;
-}
-function persistIdempotencyKey(intentKey, idempotencyKey) {
-    var _a;
-    const storageKey = intentStorageKey(intentKey);
-    memoryIdempotencyKeys.set(storageKey, idempotencyKey);
-    try {
-        (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.setItem(storageKey, idempotencyKey);
-    }
-    catch (_b) {
-        // The in-memory write above is the React Native / disabled-storage fallback.
-    }
-}
-function randomHex(bytes) {
-    const cryptoObject = globalThis.crypto;
-    if (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.getRandomValues) {
-        const values = new Uint8Array(bytes);
-        cryptoObject.getRandomValues(values);
-        return Array.from(values, (value) => value.toString(16).padStart(2, '0')).join('');
-    }
-    let value = '';
-    for (let index = 0; index < bytes; index += 1) {
-        value += Math.floor(Math.random() * 256).toString(16).padStart(2, '0');
-    }
-    return value;
-}
-function mintIdempotencyKey() {
-    const cryptoObject = globalThis.crypto;
-    if (typeof (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.randomUUID) === 'function') {
-        return `build_${cryptoObject.randomUUID()}`;
-    }
-    return `build_${Date.now().toString(36)}_${randomHex(16)}`;
-}
-function actionIdempotencyKey(options, action) {
-    const supplied = options.idempotencyKey;
-    if (supplied !== undefined) {
-        if (!isValidIdempotencyKey(supplied)) {
-            throw new TypeError('idempotencyKey must be between 1 and 256 characters.');
-        }
-        if (options.intentKey)
-            persistIdempotencyKey(options.intentKey, supplied);
-        return supplied;
-    }
-    if (!options.intentKey) {
-        throw new TypeError(`intentKey is required when ${action} auto-mints an idempotency key.`);
-    }
-    const existing = readPersistedIdempotencyKey(options.intentKey);
-    if (existing)
-        return existing;
-    const minted = mintIdempotencyKey();
-    // This is deliberately synchronous and happens before requestDevApi can fetch.
-    persistIdempotencyKey(options.intentKey, minted);
-    return minted;
-}
-function appPath(appId) {
-    return `/app/${encodeURIComponent(appId)}/builds`;
-}
-async function submit(appId, options) {
-    const idempotencyKey = actionIdempotencyKey(options, 'submit()');
-    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, submission = __rest(options, ["intentKey", "idempotencyKey"]);
-    return requestDevApi(appPath(appId), {
-        method: 'POST',
-        body: Object.assign(Object.assign({}, submission), { idempotencyKey }),
-    });
-}
-async function get(appId, runId) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}`);
-}
-async function events(appId, runId, after = 0) {
-    const cursor = Number.isFinite(after) ? Math.max(0, Math.floor(after)) : 0;
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/events?after=${cursor}`);
-}
-async function cancel(appId, runId) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/cancel`, { method: 'POST' });
-}
-async function decideGate(appId, runId, gateId, options) {
-    const idempotencyKey = actionIdempotencyKey(options, 'decideGate()');
-    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, decision = __rest(options, ["intentKey", "idempotencyKey"]);
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/decision`, { method: 'POST', body: Object.assign(Object.assign({}, decision), { idempotencyKey }) });
-}
-async function refreshReviewCapability(appId, runId, gateId, options) {
-    const idempotencyKey = actionIdempotencyKey(options, 'refreshReviewCapability()');
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability/refresh`, {
-        method: 'POST',
-        body: {
-            expectedGeneration: options.expectedGeneration,
-            expectedExpiresAtMs: options.expectedExpiresAtMs,
-            expectedRecoveryUntilMs: options.expectedRecoveryUntilMs,
-            expectedAudience: options.expectedAudience,
-            expectedReviewerBindingHash: options.expectedReviewerBindingHash,
-            idempotencyKey,
-        },
-    });
-}
-/**
- * Read one exact delegated-review capability and its narrow lifecycle result.
- * This does not refresh or extend the window and exposes no generic run-view
- * authority.
- */
-async function getReviewCapability(appId, runId, gateId, options) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability`, {
-        method: 'POST',
-        body: { expectedPreviewUrl: options.expectedPreviewUrl },
-    });
-}
-async function topup(appId, runId, options) {
-    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/topup`, { method: 'POST', body: options });
-}
-async function list$1(appId, limit = 20) {
-    const requestedLimit = Number.isFinite(limit) ? Math.max(1, Math.floor(limit)) : 20;
-    return requestDevApi(`${appPath(appId)}?limit=${requestedLimit}`);
-}
-
-// Source of truth for these strings:
-// packages/cdk/cloudflare/bounded-build/src/types.ts. Keep them string-pinned;
-// wire:1 remains additive and callers must tolerate unknown response strings.
-const NON_TERMINAL_STATES = [
-    'queued',
-    'admitted',
-    'executing',
-    'preview_ready',
-    'parked',
-    'resuming',
-    'promoting',
-    'quarantined',
-];
-const TERMINAL_STATES = [
-    'promoted',
-    'failed',
-    'canceled',
-    'rejected',
-    'expired',
-    'rebase_required',
-    'reported',
-];
-const RUN_STATES = [
-    ...NON_TERMINAL_STATES,
-    ...TERMINAL_STATES,
-];
-const PARK_REASONS = ['gate', 'funding'];
-const FAILURE_REASONS = [
-    'admission_rejected',
-    'dispatch_timeout',
-    'auth_revoked',
-    'owner_changed',
-    'policy_changed',
-    'quarantine_forced',
-    'bind_failed',
-    'internal_error',
-];
-const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
-const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
-const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
-
-const FAST_POLL_MS = 1000;
-const NORMAL_POLL_MS = 2000;
-const PARKED_POLL_MS = 5000;
-const LONG_RUNNING_POLL_MS = 10000;
-const THIRTY_SECONDS_MS = 30000;
-const TWO_MINUTES_MS = 2 * 60000;
-const TEN_MINUTES_MS = 10 * 60000;
-const terminalStates = new Set(TERMINAL_STATES);
-function pollCadence(state, elapsedMs) {
-    if (elapsedMs >= TEN_MINUTES_MS)
-        return LONG_RUNNING_POLL_MS;
-    if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
-        return PARKED_POLL_MS;
-    // The first 30s is where the user is staring at "waiting for a build slot" /
-    // "building" and every transition matters most; poll fast, then relax.
-    if (elapsedMs < THIRTY_SECONDS_MS)
-        return FAST_POLL_MS;
-    return NORMAL_POLL_MS;
-}
-function retryCadence(error, state, elapsedMs) {
-    const cadence = pollCadence(state, elapsedMs);
-    if (error instanceof BuildsApiError && error.status === 429 && error.retryAfterMs !== undefined) {
-        return Math.max(cadence, error.retryAfterMs);
-    }
-    return cadence;
-}
-function hasRetryAfter(error) {
-    return error instanceof BuildsApiError
-        && error.status === 429
-        && error.retryAfterMs !== undefined;
-}
-// A permanent API refusal (expired session, revoked access, unknown run) will
-// never heal by re-polling; the loop must stop and surface it instead of
-// retrying forever. 429 stays retryable regardless of the server envelope.
-function isPermanentError(error) {
-    return error instanceof BuildsApiError
-        && error.status !== 429
-        && error.retryable === false;
-}
-function newEvents(rows, lastSeq, seen) {
-    const cursorBeforePoll = lastSeq;
-    const fresh = [];
-    let nextCursor = lastSeq;
-    for (const event of rows) {
-        if (!Number.isFinite(event === null || event === void 0 ? void 0 : event.seq))
-            continue;
-        nextCursor = Math.max(nextCursor, event.seq);
-        if (event.seq <= cursorBeforePoll || seen.has(event.seq))
-            continue;
-        seen.add(event.seq);
-        fresh.push(event);
-    }
-    return { events: fresh, lastSeq: nextCursor };
-}
-/**
- * Poll a build view and its event cursor until stopped or the run reaches a
- * known terminal state. Unknown state strings remain untouched and nonterminal.
- */
-function watch(appId, runId, onUpdate, options = {}) {
-    const startedAt = Date.now();
-    const seenSeqs = new Set();
-    let lastSeq = Number.isFinite(options.after)
-        ? Math.max(0, Math.floor(options.after))
-        : 0;
-    let timer;
-    let active = true;
-    let lastState;
-    const stop = () => {
-        active = false;
-        if (timer !== undefined) {
-            clearTimeout(timer);
-            timer = undefined;
-        }
-    };
-    const schedule = (delayMs) => {
-        if (!active)
-            return;
-        timer = setTimeout(() => {
-            timer = undefined;
-            void poll();
-        }, delayMs);
-    };
-    const reportError = (error) => {
-        var _a;
-        try {
-            (_a = options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
-        }
-        catch (_b) {
-            // A consumer error callback must not break the transport loop.
-        }
-    };
-    const publish = (run, events) => {
-        try {
-            onUpdate({ run, events });
-        }
-        catch (_a) {
-            // Polling is transport state; consumer render errors must not strand it.
-        }
-    };
-    const poll = async () => {
-        if (!active)
-            return;
-        // Fire the view and the events page concurrently: the events cursor (lastSeq)
-        // does not depend on the run view, so there is no reason to pay two serial
-        // round-trips per tick. Error semantics below are unchanged — the run result
-        // still gates, and a failed events page still publishes the run with no rows.
-        const runPromise = get(appId, runId);
-        const eventsPromise = events(appId, runId, lastSeq);
-        // Keep the in-flight events page from becoming an unhandled rejection if the
-        // run result makes us bail before awaiting it; the real await below still sees it.
-        eventsPromise.catch(() => { });
-        let run;
-        try {
-            const view = await runPromise;
-            if (!active)
-                return;
-            run = view.run;
-            lastState = run.state;
-        }
-        catch (error) {
-            if (!active)
-                return;
-            reportError(error);
-            if (isPermanentError(error)) {
-                stop();
-                return;
-            }
-            schedule(retryCadence(error, lastState, Date.now() - startedAt));
-            return;
-        }
-        try {
-            const response = await eventsPromise;
-            if (!active)
-                return;
-            const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
-            lastSeq = deduped.lastSeq;
-            publish(run, deduped.events);
-        }
-        catch (error) {
-            if (!active)
-                return;
-            // The view still advances UI state even when event replay is rate-limited.
-            publish(run, []);
-            reportError(error);
-            if (terminalStates.has(run.state)) {
-                // The run itself is done, but a rate-limited final event replay still
-                // owes the caller its unseen seq rows. Honor Retry-After, retry the
-                // piggyback once the limiter permits it, then stop after a successful
-                // replay. Other terminal replay failures stop normally.
-                if (hasRetryAfter(error)) {
-                    schedule(retryCadence(error, run.state, Date.now() - startedAt));
-                    return;
-                }
-                stop();
-                return;
-            }
-            if (isPermanentError(error)) {
-                stop();
-                return;
-            }
-            schedule(retryCadence(error, run.state, Date.now() - startedAt));
-            return;
-        }
-        if (!active)
-            return;
-        if (terminalStates.has(run.state)) {
-            // Drain the remaining event pages before stopping: a resumed terminal
-            // watch may owe the caller more rows than one page returns. Each page
-            // advances the cursor, so the loop terminates; the cap is a backstop.
-            for (let page = 0; page < 50 && active; page += 1) {
-                let drained;
-                try {
-                    const response = await events(appId, runId, lastSeq);
-                    if (!active)
-                        return;
-                    drained = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
-                }
-                catch (error) {
-                    reportError(error);
-                    break;
-                }
-                if (drained.events.length === 0)
-                    break;
-                lastSeq = drained.lastSeq;
-                publish(run, drained.events);
-            }
-            stop();
-            return;
+            }
+            setUser(null);
+        }
+        finally {
+            setLoading(false);
         }
-        schedule(pollCadence(run.state, Date.now() - startedAt));
     };
-    void poll();
-    return { stop };
+    const logout$1 = async () => {
+        try {
+            setLoading(true);
+            await logout();
+            setUser(null);
+        }
+        catch (error) {
+            console.error('Error logging out:', error);
+        }
+        finally {
+            setLoading(false);
+        }
+    };
+    return {
+        login: login$1,
+        logout: logout$1,
+        loading: loading || sdkLoading,
+        user,
+    };
 }
 
-var _a;
+var _a$1;
 // SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
 // React Native has no `window` but DOES support hooks, so detect Node SSR
 // specifically via process.versions.node.
-const isSSR = typeof window === 'undefined'
+const isSSR$1 = typeof window === 'undefined'
     && typeof process !== 'undefined'
-    && !!((_a = process.versions) === null || _a === void 0 ? void 0 : _a.node);
-function useBuildRun(appId, runId, options) {
-    if (isSSR) {
-        return { run: null, events: [], loading: true, error: null };
+    && !!((_a$1 = process.versions) === null || _a$1 === void 0 ? void 0 : _a$1.node);
+function useQuery(path, options) {
+    if (isSSR$1) {
+        return { data: undefined, loading: true, error: null };
     }
-    const [run, setRun] = React__namespace.useState(null);
-    const [events, setEvents] = React__namespace.useState([]);
+    const [data, setData] = React__namespace.useState(undefined);
     const [loading, setLoading] = React__namespace.useState(true);
     const [error, setError] = React__namespace.useState(null);
+    // Re-subscribe only when the query actually changes (not on every render).
     const optionsKey = options ? JSON.stringify(options) : '';
     React__namespace.useEffect(() => {
-        setRun(null);
-        setEvents([]);
-        setError(null);
-        if (!appId || !runId) {
+        if (!path) {
+            setData(undefined);
             setLoading(false);
+            setError(null);
             return;
         }
         let active = true;
+        let unsubscribe;
         setLoading(true);
-        const handle = watch(appId, runId, ({ run: nextRun, events: nextEvents }) => {
-            if (!active)
-                return;
-            setRun(nextRun);
-            if (nextEvents.length > 0) {
-                setEvents((current) => {
-                    const seen = new Set(current.map((event) => event.seq));
-                    return [...current, ...nextEvents.filter((event) => !seen.has(event.seq))];
-                });
-            }
-            setError(null);
-            setLoading(false);
-        }, Object.assign(Object.assign({}, options), { onError: (value) => {
+        setError(null);
+        core.subscribe(path, Object.assign(Object.assign({}, options), { onData: (d) => {
                 if (!active)
                     return;
-                setError(value instanceof Error ? value : new Error(String(value)));
+                // A reconnect can legitimately surface a transport error before the
+                // socket re-authenticates and sends a new authorized snapshot. That
+                // fresh snapshot is the recovery boundary: keep the error visible
+                // until data arrives, then clear it so React does not remain stuck on
+                // a failure page after realtime has recovered.
+                setError(null);
+                setData(d);
                 setLoading(false);
-            } }));
+            }, onError: (e) => {
+                if (!active)
+                    return;
+                setError(e instanceof Error ? e : new Error(String(e)));
+                setLoading(false);
+            } }))
+            .then((unsub) => {
+            if (active)
+                unsubscribe = unsub;
+            else
+                void unsub(); // unmounted before subscribe resolved
+        })
+            .catch((e) => {
+            if (!active)
+                return;
+            setError(e instanceof Error ? e : new Error(String(e)));
+            setLoading(false);
+        });
         return () => {
             active = false;
-            handle.stop();
+            void (unsubscribe === null || unsubscribe === void 0 ? void 0 : unsubscribe());
         };
-        // optionsKey captures the option object's contents; ids are the other inputs.
+        // optionsKey captures the option object's contents; path is the other input.
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [appId, runId, optionsKey]);
-    return { run, events, loading, error };
+    }, [path, optionsKey]);
+    return { data, loading, error };
+}
+
+// Wrapper for getIdToken - passes isServer=false for client-side usage
+async function getIdToken() {
+    return core.getIdToken(false);
+}
+
+var __rest = (undefined && undefined.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+/** A structured non-2xx response from the developer API. */
+class BuildsApiError extends Error {
+    constructor(init) {
+        super(init.message);
+        this.name = 'BuildsApiError';
+        this.code = init.code;
+        this.retryable = init.retryable;
+        this.status = init.status;
+        this.details = init.details;
+        this.retryAfterMs = init.retryAfterMs;
+    }
+}
+const memoryIdempotencyKeys = new Map();
+const IDEMPOTENCY_STORAGE_PREFIX = 'bounded:build:idempotency:';
+function retryAfterMs(response) {
+    var _a, _b;
+    const value = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'Retry-After');
+    if (!value)
+        return undefined;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0)
+        return Math.ceil(seconds * 1000);
+    const at = Date.parse(value);
+    if (!Number.isFinite(at))
+        return undefined;
+    return Math.max(0, at - Date.now());
+}
+async function responseBody(response) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch (_a) {
+        return { raw: text };
+    }
+}
+function apiError(response, body) {
+    const envelope = body;
+    const nested = (envelope === null || envelope === void 0 ? void 0 : envelope.error) && typeof envelope.error === 'object'
+        ? envelope.error
+        : undefined;
+    const hasNestedDetails = !!nested && Object.prototype.hasOwnProperty.call(nested, 'details');
+    const hasTopLevelDetails = !!body
+        && typeof body === 'object'
+        && Object.prototype.hasOwnProperty.call(body, 'details');
+    const legacyCode = typeof (body === null || body === void 0 ? void 0 : body.error) === 'string' ? body.error : undefined;
+    const code = typeof (nested === null || nested === void 0 ? void 0 : nested.code) === 'string'
+        ? nested.code
+        : legacyCode !== null && legacyCode !== void 0 ? legacyCode : `http_${response.status}`;
+    const message = typeof (nested === null || nested === void 0 ? void 0 : nested.message) === 'string'
+        ? nested.message
+        : typeof (body === null || body === void 0 ? void 0 : body.message) === 'string'
+            ? body.message
+            : `Developer API request failed with HTTP ${response.status}`;
+    const retryable = typeof (nested === null || nested === void 0 ? void 0 : nested.retryable) === 'boolean'
+        ? nested.retryable
+        : response.status === 429 || response.status >= 500;
+    return new BuildsApiError(Object.assign(Object.assign({ code,
+        message,
+        retryable, status: response.status }, (hasNestedDetails
+        ? { details: nested === null || nested === void 0 ? void 0 : nested.details }
+        : hasTopLevelDetails
+            ? { details: body.details }
+            : {})), (response.status === 429 ? { retryAfterMs: retryAfterMs(response) } : {})));
+}
+/** @internal Shared authenticated developer-api transport for builds and apps. */
+async function requestDevApi(path, request = {}) {
+    var _a, _b;
+    const config = await core.getConfig();
+    const base = (_a = config.devApiUrl) === null || _a === void 0 ? void 0 : _a.replace(/\/$/, '');
+    if (!base) {
+        throw new Error('Bounded developer API is not configured. Pass devApiUrl or a Bounded network to init().');
+    }
+    // Reuse the exact accessor exposed publicly as getIdToken().
+    const token = await getIdToken();
+    if (!token) {
+        throw new BuildsApiError({
+            code: 'auth_required',
+            message: 'Sign in before calling the Bounded developer API.',
+            retryable: false,
+            status: 401,
+        });
+    }
+    const hasBody = request.body !== undefined;
+    const response = await fetch(`${base}${path}`, Object.assign({ method: (_b = request.method) !== null && _b !== void 0 ? _b : 'GET', headers: Object.assign({ Authorization: `Bearer ${token}` }, (hasBody ? { 'Content-Type': 'application/json' } : {})) }, (hasBody ? { body: JSON.stringify(request.body) } : {})));
+    const body = await responseBody(response);
+    if (!response.ok)
+        throw apiError(response, body);
+    return body;
+}
+function intentStorageKey(intentKey) {
+    return `${IDEMPOTENCY_STORAGE_PREFIX}${intentKey}`;
+}
+function isValidIdempotencyKey(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 256;
+}
+function readPersistedIdempotencyKey(intentKey) {
+    var _a;
+    const storageKey = intentStorageKey(intentKey);
+    try {
+        const stored = (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.getItem(storageKey);
+        if (isValidIdempotencyKey(stored))
+            return stored;
+    }
+    catch (_b) {
+        // Storage can be disabled by browser privacy policy; use module memory.
+    }
+    const inMemory = memoryIdempotencyKeys.get(storageKey);
+    return isValidIdempotencyKey(inMemory) ? inMemory : undefined;
+}
+function persistIdempotencyKey(intentKey, idempotencyKey) {
+    var _a;
+    const storageKey = intentStorageKey(intentKey);
+    memoryIdempotencyKeys.set(storageKey, idempotencyKey);
+    try {
+        (_a = globalThis.sessionStorage) === null || _a === void 0 ? void 0 : _a.setItem(storageKey, idempotencyKey);
+    }
+    catch (_b) {
+        // The in-memory write above is the React Native / disabled-storage fallback.
+    }
+}
+function randomHex(bytes) {
+    const cryptoObject = globalThis.crypto;
+    if (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.getRandomValues) {
+        const values = new Uint8Array(bytes);
+        cryptoObject.getRandomValues(values);
+        return Array.from(values, (value) => value.toString(16).padStart(2, '0')).join('');
+    }
+    let value = '';
+    for (let index = 0; index < bytes; index += 1) {
+        value += Math.floor(Math.random() * 256).toString(16).padStart(2, '0');
+    }
+    return value;
+}
+function mintIdempotencyKey() {
+    const cryptoObject = globalThis.crypto;
+    if (typeof (cryptoObject === null || cryptoObject === void 0 ? void 0 : cryptoObject.randomUUID) === 'function') {
+        return `build_${cryptoObject.randomUUID()}`;
+    }
+    return `build_${Date.now().toString(36)}_${randomHex(16)}`;
 }
-
-/**
- * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost), with
- * one exact Drafted exception for delegated review/decision routes. Other
- * generated-app origins remain blocked; server-side callers are unaffected.
- */
-const builds = {
-    submit,
-    get,
-    getReviewCapability,
-    events,
-    cancel,
-    decideGate,
-    refreshReviewCapability,
-    topup,
-    list: list$1,
-    watch,
-};
-
-async function create(options = {}) {
-    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.idempotencyKey !== undefined ? { idempotencyKey: options.idempotencyKey } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
-    const app = await requestDevApi('/apps/new', {
+function actionIdempotencyKey(options, action) {
+    const supplied = options.idempotencyKey;
+    if (supplied !== undefined) {
+        if (!isValidIdempotencyKey(supplied)) {
+            throw new TypeError('idempotencyKey must be between 1 and 256 characters.');
+        }
+        if (options.intentKey)
+            persistIdempotencyKey(options.intentKey, supplied);
+        return supplied;
+    }
+    if (!options.intentKey) {
+        throw new TypeError(`intentKey is required when ${action} auto-mints an idempotency key.`);
+    }
+    const existing = readPersistedIdempotencyKey(options.intentKey);
+    if (existing)
+        return existing;
+    const minted = mintIdempotencyKey();
+    // This is deliberately synchronous and happens before requestDevApi can fetch.
+    persistIdempotencyKey(options.intentKey, minted);
+    return minted;
+}
+function appPath(appId) {
+    return `/app/${encodeURIComponent(appId)}/builds`;
+}
+async function submit(appId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'submit()');
+    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, submission = __rest(options, ["intentKey", "idempotencyKey"]);
+    return requestDevApi(appPath(appId), {
         method: 'POST',
-        body,
+        body: Object.assign(Object.assign({}, submission), { idempotencyKey }),
     });
-    return Object.assign(Object.assign(Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url }), (typeof app.prompt === 'string' && app.prompt ? { prompt: app.prompt } : {})), (typeof app.handoff === 'string' && app.handoff ? { handoff: app.handoff } : {}));
 }
-/**
- * F-1200: build the create-flow redirect the owner is sent to after `create()`, with the
- * prompt and handoff carried in the URL FRAGMENT (never the query - fragments never reach
- * servers, logs, or Referer). Encoding is byte-exact so the widget's `URLSearchParams`
- * parse + `.trim()` reproduces the SAME prompt string dev-api hashed into the handoff;
- * getting this wrong would make the widget reject a genuine token and degrade to prefill.
- * Callers (bounded.sh, oapps.fun) should use this instead of hand-building the URL.
- *
- * Returns `${url}#bounded_prompt=<prompt>` with no `&bounded_handoff=` when the server
- * minted no handoff (HANDOFF_SECRET unset) - the widget then prefills without auto-running.
- */
-function buildCreateRedirectUrl(app) {
-    const base = app.url;
-    const prompt = typeof app.prompt === 'string' ? app.prompt.trim() : '';
-    if (!prompt)
-        return base;
-    const params = `bounded_prompt=${encodeURIComponent(prompt)}`
-        + (app.handoff ? `&bounded_handoff=${encodeURIComponent(app.handoff)}` : '');
-    return `${base}#${params}`;
+async function get(appId, runId) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}`);
 }
-async function list() {
-    // This legacy-compatible action shape is also used by oapps.fun listMyApps.
-    const response = await requestDevApi('/', {
+async function events(appId, runId, after = 0) {
+    const cursor = Number.isFinite(after) ? Math.max(0, Math.floor(after)) : 0;
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/events?after=${cursor}`);
+}
+async function cancel(appId, runId) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/cancel`, { method: 'POST' });
+}
+async function decideGate(appId, runId, gateId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'decideGate()');
+    const { intentKey: _intentKey, idempotencyKey: _suppliedKey } = options, decision = __rest(options, ["intentKey", "idempotencyKey"]);
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/decision`, { method: 'POST', body: Object.assign(Object.assign({}, decision), { idempotencyKey }) });
+}
+async function refreshReviewCapability(appId, runId, gateId, options) {
+    const idempotencyKey = actionIdempotencyKey(options, 'refreshReviewCapability()');
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability/refresh`, {
         method: 'POST',
-        body: { action: 'listApps' },
+        body: {
+            expectedGeneration: options.expectedGeneration,
+            expectedExpiresAtMs: options.expectedExpiresAtMs,
+            expectedRecoveryUntilMs: options.expectedRecoveryUntilMs,
+            expectedAudience: options.expectedAudience,
+            expectedReviewerBindingHash: options.expectedReviewerBindingHash,
+            idempotencyKey,
+        },
     });
-    const rows = Array.isArray(response.apps) ? response.apps : [];
-    return rows
-        .map((value) => {
-        var _a, _b, _c, _d;
-        const row = value && typeof value === 'object'
-            ? value
-            : {};
-        const appId = String((_c = (_b = (_a = row._id) !== null && _a !== void 0 ? _a : row.id) !== null && _b !== void 0 ? _b : row.appId) !== null && _c !== void 0 ? _c : '');
-        if (!/^[a-f0-9]{24}$/i.test(appId))
-            return null;
-        const name = String((_d = row.name) !== null && _d !== void 0 ? _d : '').trim() || '(unnamed app)';
-        const slug = typeof row.slug === 'string' && row.slug ? row.slug : undefined;
-        const url = typeof row.url === 'string' && row.url.trim() ? row.url.trim() : undefined;
-        const buildStatus = row.buildStatus === 'building' || row.buildStatus === 'build_failed'
-            ? row.buildStatus
-            : undefined;
-        return Object.assign(Object.assign(Object.assign({ appId,
-            name }, (slug ? { slug } : {})), (url ? { url } : {})), (buildStatus ? { buildStatus } : {}));
-    })
-        .filter((app) => app !== null);
-}
-/**
- * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
- * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
- */
-const apps = { create, list, buildCreateRedirectUrl };
-
-async function deserializeTransaction(tx) {
-    // Literal specifier so bundlers can code-split the lazy chunk.
-    const { Transaction, VersionedTransaction } = await import('@solana/web3.js');
-    const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
-    if ((buf[0] & 0x80) !== 0) {
-        return VersionedTransaction.deserialize(buf);
-    }
-    else {
-        return Transaction.from(buf);
-    }
 }
-
-// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
-// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
-// in a warm iframe behind the modal so signing feels native: an in-app card plus
-// the OS Face ID / Touch ID sheet, never a jarring popup.
-//
-// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
-// MUST run on the single Bounded signer origin. The iframe carries the
-// publickey-credentials-{get,create} permission policy and the user's click lands
-// INSIDE it, giving WebAuthn the transient activation it needs.
-//
-// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
-// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
-// SAME request through `popupFallback` (a real window). Callers pass a popup
-// implementation and never see the difference.
 /**
- * Run one signer exchange through the in-app widget. Resolves when `onResult`
- * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
- * (Safari cross-origin create) or cannot be mounted.
+ * Read one exact delegated-review capability and its narrow lifecycle result.
+ * This does not refresh or extend the window and exposes no generic run-view
+ * authority.
  */
-async function runWidget(url, signerOrigin, ex, popupFallback) {
-    if (!hasDOM$3())
-        return popupFallback();
-    const m = getModal();
-    const requestId = String(ex.request.requestId);
-    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
-    const run = m.chain.then(() => new Promise((resolve, reject) => {
-        let settled = false;
-        let usedFallback = false;
-        const iframe = ensureIframe(m, url, signerOrigin);
-        const send = () => {
-            if (!iframe.contentWindow)
-                return;
-            try {
-                iframe.contentWindow.postMessage(ex.request, signerOrigin);
-            }
-            catch (_a) {
-                /* frame gone */
-            }
-        };
-        let loadTimer = 0;
-        let ceilingTimer = 0;
-        const finish = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            m.onIframeMessage = null;
-            m.onBackdrop = null;
-            window.clearTimeout(loadTimer);
-            window.clearTimeout(ceilingTimer);
-            fn();
-        };
-        const goFallback = () => {
-            if (usedFallback || settled)
-                return;
-            usedFallback = true;
-            hideModal(m);
-            finish(() => popupFallback().then(resolve, reject));
-        };
-        m.onBackdrop = () => {
-            hideModal(m);
-            finish(() => reject(new Error("cancelled")));
-        };
-        m.onIframeMessage = (d) => {
-            if (d.type === "bounded:turnkey:ready") {
-                m.iframeReady = true;
-                send();
-                return;
-            }
-            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
-                setPanelHeight(m, d.height);
-                return;
-            }
-            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
-                goFallback();
-                return;
-            }
-            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
-                const outcome = ex.onResult(d);
-                if ("error" in outcome) {
-                    hideModal(m);
-                    finish(() => reject(new Error(outcome.error)));
-                    return;
-                }
-                if (outcome.done) {
-                    hideModal(m);
-                    finish(() => resolve(outcome.value));
-                }
-            }
-        };
-        showModal(m);
-        if (m.iframeReady)
-            send();
-        // If the frame never loads, degrade to the popup (best-effort - a post-load
-        // popup may be blocked without a gesture, in which case the fallback rejects).
-        loadTimer = window.setTimeout(() => {
-            if (!m.iframeReady && !settled)
-                goFallback();
-        }, 8000);
-        // Absolute ceiling so a stuck flow cannot hang forever.
-        ceilingTimer = window.setTimeout(() => {
-            if (!settled) {
-                hideModal(m);
-                finish(() => reject(new Error("Wallet approval timed out.")));
-            }
-        }, 5 * 60 * 1000);
-    }));
-    m.chain = run.then(() => undefined, () => undefined);
-    return run;
+async function getReviewCapability(appId, runId, gateId, options) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/gates/${encodeURIComponent(gateId)}/review-capability`, {
+        method: 'POST',
+        body: { expectedPreviewUrl: options.expectedPreviewUrl },
+    });
 }
-
-// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
-// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
-//
-// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
-// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
-// look + motion, so signing feels native. Safari (unreliable at iframe passkey
-// CREATE) and any environment where the frame cannot mount fall back to a real
-// popup window; both transports speak the same postMessage protocol.
-//
-// Unlike the Crossmint bridge (crossmint-signer-bridge.ts), Turnkey wallets DO
-// produce raw detached signatures: the signer runs the Turnkey browser SDK on the
-// single Bounded origin, enrolls the user's passkey on first use (lazy - the
-// sub-org is created with the passkey + email attached at that moment), and stamps
-// an ed25519 signRawPayload with that passkey. So this bridge exposes a
-// `signSolanaMessage` primitive; the app builds + submits the transaction itself.
-//
-// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
-// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
-// every user one wallet + one passkey that roams across every app.
-function hasDOM$1() {
-    return typeof window !== 'undefined' && typeof document !== 'undefined';
+async function topup(appId, runId, options) {
+    return requestDevApi(`${appPath(appId)}/${encodeURIComponent(runId)}/topup`, { method: 'POST', body: options });
 }
-// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
-// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
-// fail - and a post-failure popup would no longer have a user gesture to open with.
-// There we pick the popup up front, from the original click, so enrollment is solid.
-// Everywhere else the inline widget is used (buttery in-app modal).
-function preferPopup() {
-    if (!hasDOM$1() || typeof navigator === 'undefined')
-        return true;
-    const ua = navigator.userAgent || '';
-    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+async function list$1(appId, limit = 20) {
+    const requestedLimit = Number.isFinite(limit) ? Math.max(1, Math.floor(limit)) : 20;
+    return requestDevApi(`${appPath(appId)}?limit=${requestedLimit}`);
 }
-// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
-// when we cannot embed (Safari enrollment, or the frame never loads).
-async function deliver(url, origin, ex) {
-    const popup = () => runPopup(url, origin, ex);
-    if (preferPopup())
-        return popup();
-    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+
+// Source of truth for these strings:
+// packages/cdk/cloudflare/bounded-build/src/types.ts. Keep them string-pinned;
+// wire:1 remains additive and callers must tolerate unknown response strings.
+const NON_TERMINAL_STATES = [
+    'queued',
+    'admitted',
+    'executing',
+    'preview_ready',
+    'parked',
+    'resuming',
+    'promoting',
+    'quarantined',
+];
+const TERMINAL_STATES = [
+    'promoted',
+    'failed',
+    'canceled',
+    'rejected',
+    'expired',
+    'rebase_required',
+    'reported',
+];
+const RUN_STATES = [
+    ...NON_TERMINAL_STATES,
+    ...TERMINAL_STATES,
+];
+const PARK_REASONS = ['gate', 'funding'];
+const FAILURE_REASONS = [
+    'admission_rejected',
+    'dispatch_timeout',
+    'auth_revoked',
+    'owner_changed',
+    'policy_changed',
+    'quarantine_forced',
+    'bind_failed',
+    'internal_error',
+];
+const BUILD_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-review-capability.v1';
+const BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = 'bounded.build-review-capability-refresh.v1';
+const BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = 'bounded.build-delegated-review-capability.v1';
+
+const FAST_POLL_MS = 1000;
+const NORMAL_POLL_MS = 2000;
+const PARKED_POLL_MS = 5000;
+const LONG_RUNNING_POLL_MS = 10000;
+const THIRTY_SECONDS_MS = 30000;
+const TWO_MINUTES_MS = 2 * 60000;
+const TEN_MINUTES_MS = 10 * 60000;
+const terminalStates = new Set(TERMINAL_STATES);
+function pollCadence(state, elapsedMs) {
+    if (elapsedMs >= TEN_MINUTES_MS)
+        return LONG_RUNNING_POLL_MS;
+    if ((state === null || state === void 0 ? void 0 : state.startsWith('parked')) || elapsedMs >= TWO_MINUTES_MS)
+        return PARKED_POLL_MS;
+    // The first 30s is where the user is staring at "waiting for a build slot" /
+    // "building" and every transition matters most; poll fast, then relax.
+    if (elapsedMs < THIRTY_SECONDS_MS)
+        return FAST_POLL_MS;
+    return NORMAL_POLL_MS;
 }
-async function turnkeySignerPage() {
-    const cfg = await core.getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+function retryCadence(error, state, elapsedMs) {
+    const cadence = pollCadence(state, elapsedMs);
+    if (error instanceof BuildsApiError && error.status === 429 && error.retryAfterMs !== undefined) {
+        return Math.max(cadence, error.retryAfterMs);
+    }
+    return cadence;
 }
-function toHex(bytes) {
-    let h = '';
-    for (const b of bytes)
-        h += b.toString(16).padStart(2, '0');
-    return h;
+function hasRetryAfter(error) {
+    return error instanceof BuildsApiError
+        && error.status === 429
+        && error.retryAfterMs !== undefined;
 }
-function fromHex(hex) {
-    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
-    const out = new Uint8Array(clean.length / 2);
-    for (let i = 0; i < out.length; i++)
-        out[i] = parseInt(clean.substr(i * 2, 2), 16);
-    return out;
+// A permanent API refusal (expired session, revoked access, unknown run) will
+// never heal by re-polling; the loop must stop and surface it instead of
+// retrying forever. 429 stays retryable regardless of the server envelope.
+function isPermanentError(error) {
+    return error instanceof BuildsApiError
+        && error.status !== 429
+        && error.retryable === false;
 }
-let requestSeq = 0;
-// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
-// resolve when `onResult` accepts a result message. Origin + source are pinned.
-async function runPopup(url, signerOrigin, ex) {
-    var _a, _b;
-    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
-    const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
-    const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
-    if (!popup) {
-        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+function newEvents(rows, lastSeq, seen) {
+    const cursorBeforePoll = lastSeq;
+    const fresh = [];
+    let nextCursor = lastSeq;
+    for (const event of rows) {
+        if (!Number.isFinite(event === null || event === void 0 ? void 0 : event.seq))
+            continue;
+        nextCursor = Math.max(nextCursor, event.seq);
+        if (event.seq <= cursorBeforePoll || seen.has(event.seq))
+            continue;
+        seen.add(event.seq);
+        fresh.push(event);
     }
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        let sentRequest = false;
-        let closeTimer;
-        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
-            clearInterval(closeTimer); };
-        const sendRequest = () => { if (sentRequest)
-            return; sentRequest = true; try {
-            popup.postMessage(ex.request, signerOrigin);
+    return { events: fresh, lastSeq: nextCursor };
+}
+/**
+ * Poll a build view and its event cursor until stopped or the run reaches a
+ * known terminal state. Unknown state strings remain untouched and nonterminal.
+ */
+function watch(appId, runId, onUpdate, options = {}) {
+    const startedAt = Date.now();
+    const seenSeqs = new Set();
+    let lastSeq = Number.isFinite(options.after)
+        ? Math.max(0, Math.floor(options.after))
+        : 0;
+    let timer;
+    let active = true;
+    let lastState;
+    const stop = () => {
+        active = false;
+        if (timer !== undefined) {
+            clearTimeout(timer);
+            timer = undefined;
         }
-        catch ( /* popup gone */_a) { /* popup gone */ } };
-        const onMsg = (event) => {
-            if (event.origin !== signerOrigin)
+    };
+    const schedule = (delayMs) => {
+        if (!active)
+            return;
+        timer = setTimeout(() => {
+            timer = undefined;
+            void poll();
+        }, delayMs);
+    };
+    const reportError = (error) => {
+        var _a;
+        try {
+            (_a = options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
+        }
+        catch (_b) {
+            // A consumer error callback must not break the transport loop.
+        }
+    };
+    const publish = (run, events) => {
+        try {
+            onUpdate({ run, events });
+        }
+        catch (_a) {
+            // Polling is transport state; consumer render errors must not strand it.
+        }
+    };
+    const poll = async () => {
+        if (!active)
+            return;
+        // Fire the view and the events page concurrently: the events cursor (lastSeq)
+        // does not depend on the run view, so there is no reason to pay two serial
+        // round-trips per tick. Error semantics below are unchanged — the run result
+        // still gates, and a failed events page still publishes the run with no rows.
+        const runPromise = get(appId, runId);
+        const eventsPromise = events(appId, runId, lastSeq);
+        // Keep the in-flight events page from becoming an unhandled rejection if the
+        // run result makes us bail before awaiting it; the real await below still sees it.
+        eventsPromise.catch(() => { });
+        let run;
+        try {
+            const view = await runPromise;
+            if (!active)
                 return;
-            if (event.source !== popup)
+            run = view.run;
+            lastState = run.state;
+        }
+        catch (error) {
+            if (!active)
                 return;
-            const d = event.data;
-            if (!d || typeof d !== 'object')
+            reportError(error);
+            if (isPermanentError(error)) {
+                stop();
+                return;
+            }
+            schedule(retryCadence(error, lastState, Date.now() - startedAt));
+            return;
+        }
+        try {
+            const response = await eventsPromise;
+            if (!active)
+                return;
+            const deduped = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
+            lastSeq = deduped.lastSeq;
+            publish(run, deduped.events);
+        }
+        catch (error) {
+            if (!active)
+                return;
+            // The view still advances UI state even when event replay is rate-limited.
+            publish(run, []);
+            reportError(error);
+            if (terminalStates.has(run.state)) {
+                // The run itself is done, but a rate-limited final event replay still
+                // owes the caller its unseen seq rows. Honor Retry-After, retry the
+                // piggyback once the limiter permits it, then stop after a successful
+                // replay. Other terminal replay failures stop normally.
+                if (hasRetryAfter(error)) {
+                    schedule(retryCadence(error, run.state, Date.now() - startedAt));
+                    return;
+                }
+                stop();
                 return;
-            if (d.type === 'bounded:turnkey:ready') {
-                sendRequest();
+            }
+            if (isPermanentError(error)) {
+                stop();
                 return;
             }
-            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
-                const outcome = ex.onResult(d);
-                if ('error' in outcome) {
-                    cleanup();
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_a) { /* ignore */ }
-                    reject(new Error(outcome.error));
-                    return;
+            schedule(retryCadence(error, run.state, Date.now() - startedAt));
+            return;
+        }
+        if (!active)
+            return;
+        if (terminalStates.has(run.state)) {
+            // Drain the remaining event pages before stopping: a resumed terminal
+            // watch may owe the caller more rows than one page returns. Each page
+            // advances the cursor, so the loop terminates; the cap is a backstop.
+            for (let page = 0; page < 50 && active; page += 1) {
+                let drained;
+                try {
+                    const response = await events(appId, runId, lastSeq);
+                    if (!active)
+                        return;
+                    drained = newEvents(Array.isArray(response.events) ? response.events : [], lastSeq, seenSeqs);
                 }
-                if (outcome.done) {
-                    cleanup();
-                    try {
-                        popup.close();
-                    }
-                    catch ( /* ignore */_b) { /* ignore */ }
-                    resolve(outcome.value);
+                catch (error) {
+                    reportError(error);
+                    break;
                 }
+                if (drained.events.length === 0)
+                    break;
+                lastSeq = drained.lastSeq;
+                publish(run, drained.events);
             }
-        };
-        window.addEventListener('message', onMsg);
-        setTimeout(sendRequest, 1200);
-        closeTimer = setInterval(() => {
-            if (popup.closed) {
-                clearInterval(closeTimer);
-                setTimeout(() => { if (!settled) {
-                    cleanup();
-                    reject(new Error('Wallet approval window was closed before it completed.'));
-                } }, 400);
-            }
-        }, 500);
-        setTimeout(() => { if (!settled) {
-            cleanup();
-            try {
-                popup.close();
+            stop();
+            return;
+        }
+        schedule(pollCadence(run.state, Date.now() - startedAt));
+    };
+    void poll();
+    return { stop };
+}
+
+var _a;
+// SSR guard (mirrors useAuth): no hooks/subscriptions during Node server render.
+// React Native has no `window` but DOES support hooks, so detect Node SSR
+// specifically via process.versions.node.
+const isSSR = typeof window === 'undefined'
+    && typeof process !== 'undefined'
+    && !!((_a = process.versions) === null || _a === void 0 ? void 0 : _a.node);
+function useBuildRun(appId, runId, options) {
+    if (isSSR) {
+        return { run: null, events: [], loading: true, error: null };
+    }
+    const [run, setRun] = React__namespace.useState(null);
+    const [events, setEvents] = React__namespace.useState([]);
+    const [loading, setLoading] = React__namespace.useState(true);
+    const [error, setError] = React__namespace.useState(null);
+    const optionsKey = options ? JSON.stringify(options) : '';
+    React__namespace.useEffect(() => {
+        setRun(null);
+        setEvents([]);
+        setError(null);
+        if (!appId || !runId) {
+            setLoading(false);
+            return;
+        }
+        let active = true;
+        setLoading(true);
+        const handle = watch(appId, runId, ({ run: nextRun, events: nextEvents }) => {
+            if (!active)
+                return;
+            setRun(nextRun);
+            if (nextEvents.length > 0) {
+                setEvents((current) => {
+                    const seen = new Set(current.map((event) => event.seq));
+                    return [...current, ...nextEvents.filter((event) => !seen.has(event.seq))];
+                });
             }
-            catch ( /* ignore */_a) { /* ignore */ }
-            reject(new Error('Wallet approval timed out.'));
-        } }, 5 * 60 * 1000);
+            setError(null);
+            setLoading(false);
+        }, Object.assign(Object.assign({}, options), { onError: (value) => {
+                if (!active)
+                    return;
+                setError(value instanceof Error ? value : new Error(String(value)));
+                setLoading(false);
+            } }));
+        return () => {
+            active = false;
+            handle.stop();
+        };
+        // optionsKey captures the option object's contents; ids are the other inputs.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [appId, runId, optionsKey]);
+    return { run, events, loading, error };
+}
+
+/**
+ * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost), with
+ * one exact Drafted exception for delegated review/decision routes. Other
+ * generated-app origins remain blocked; server-side callers are unaffected.
+ */
+const builds = {
+    submit,
+    get,
+    getReviewCapability,
+    events,
+    cancel,
+    decideGate,
+    refreshReviewCapability,
+    topup,
+    list: list$1,
+    watch,
+};
+
+async function create(options = {}) {
+    const body = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.name !== undefined ? { name: options.name } : {})), (options.prompt !== undefined ? { prompt: options.prompt } : {})), (options.idempotencyKey !== undefined ? { idempotencyKey: options.idempotencyKey } : {})), (options.intent !== undefined ? { intent: options.intent } : {})), (options.oapp === true ? { oapp: true } : {}));
+    const app = await requestDevApi('/apps/new', {
+        method: 'POST',
+        body,
     });
+    return Object.assign(Object.assign(Object.assign(Object.assign({ appId: app.appId }, (typeof app.slug === 'string' && app.slug ? { slug: app.slug } : {})), { url: app.url }), (typeof app.prompt === 'string' && app.prompt ? { prompt: app.prompt } : {})), (typeof app.handoff === 'string' && app.handoff ? { handoff: app.handoff } : {}));
 }
 /**
- * Get-or-create the user's non-custodial Turnkey wallet, resolving with its stable
- * Solana address. On first use the popup enrolls a device passkey (Face ID / Touch ID)
- * and creates the wallet (lazy) with no email code; if the wallet already exists it
- * resolves immediately without a prompt. Call from a USER GESTURE.
+ * F-1200: build the create-flow redirect the owner is sent to after `create()`, with the
+ * prompt and handoff carried in the URL FRAGMENT (never the query - fragments never reach
+ * servers, logs, or Referer). Encoding is byte-exact so the widget's `URLSearchParams`
+ * parse + `.trim()` reproduces the SAME prompt string dev-api hashed into the handoff;
+ * getting this wrong would make the widget reject a genuine token and degrade to prefill.
+ * Callers (bounded.sh, oapps.fun) should use this instead of hand-building the URL.
  *
- * Use this to learn the fee-payer address BEFORE building a transaction to sign.
+ * Returns `${url}#bounded_prompt=<prompt>` with no `&bounded_handoff=` when the server
+ * minted no handoff (HANDOFF_SECRET unset) - the widget then prefills without auto-running.
  */
-async function getOrCreateTurnkeyWallet() {
-    if (!hasDOM$1())
-        throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
-    const { url, origin } = await turnkeySignerPage();
-    const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
-    return await deliver(url, origin, {
-        request: { type: 'bounded:turnkey:createWallet', requestId },
-        onResult: (d) => {
-            if (d.ok && typeof d.address === 'string')
-                return { done: true, value: { address: d.address, subOrgId: String(d.subOrgId || '') } };
-            return { error: String(d.error || 'Wallet setup failed') };
-        },
+function buildCreateRedirectUrl(app) {
+    const base = app.url;
+    const prompt = typeof app.prompt === 'string' ? app.prompt.trim() : '';
+    if (!prompt)
+        return base;
+    const params = `bounded_prompt=${encodeURIComponent(prompt)}`
+        + (app.handoff ? `&bounded_handoff=${encodeURIComponent(app.handoff)}` : '');
+    return `${base}#${params}`;
+}
+async function list() {
+    // This legacy-compatible action shape is also used by oapps.fun listMyApps.
+    const response = await requestDevApi('/', {
+        method: 'POST',
+        body: { action: 'listApps' },
     });
+    const rows = Array.isArray(response.apps) ? response.apps : [];
+    return rows
+        .map((value) => {
+        var _a, _b, _c, _d;
+        const row = value && typeof value === 'object'
+            ? value
+            : {};
+        const appId = String((_c = (_b = (_a = row._id) !== null && _a !== void 0 ? _a : row.id) !== null && _b !== void 0 ? _b : row.appId) !== null && _c !== void 0 ? _c : '');
+        if (!/^[a-f0-9]{24}$/i.test(appId))
+            return null;
+        const name = String((_d = row.name) !== null && _d !== void 0 ? _d : '').trim() || '(unnamed app)';
+        const slug = typeof row.slug === 'string' && row.slug ? row.slug : undefined;
+        const url = typeof row.url === 'string' && row.url.trim() ? row.url.trim() : undefined;
+        const buildStatus = row.buildStatus === 'building' || row.buildStatus === 'build_failed'
+            ? row.buildStatus
+            : undefined;
+        return Object.assign(Object.assign(Object.assign({ appId,
+            name }, (slug ? { slug } : {})), (url ? { url } : {})), (buildStatus ? { buildStatus } : {}));
+    })
+        .filter((app) => app !== null);
 }
 /**
- * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
- * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
- * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
- * browser blocks the popup.
- *
- * On the user's FIRST signature the popup transparently enrolls a device passkey
- * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
- * signatures are just a passkey approval.
+ * Platform first-party surfaces only (bounded.sh, oapps.fun, localhost) —
+ * dev-api CORS blocks calls from generated-app origins. Server-side callers unaffected.
  */
-async function signSolanaMessageViaTurnkey(message) {
-    if (!hasDOM$1()) {
-        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+const apps = { create, list, buildCreateRedirectUrl };
+
+async function deserializeTransaction(tx) {
+    // Literal specifier so bundlers can code-split the lazy chunk.
+    const { Transaction, VersionedTransaction } = await import('@solana/web3.js');
+    const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
+    if ((buf[0] & 0x80) !== 0) {
+        return VersionedTransaction.deserialize(buf);
+    }
+    else {
+        return Transaction.from(buf);
     }
-    const { url, origin } = await turnkeySignerPage();
-    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
-    const messageHex = toHex(message);
-    return await deliver(url, origin, {
-        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
-        onResult: (d) => {
-            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
-                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
-            }
-            return { error: String(d.error || 'Turnkey signing failed') };
-        },
-    });
 }
 
 // bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
@@ -8088,7 +7934,6 @@ exports.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = BUILD_DELEGATED_REVIEW_CAPABI
 exports.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA;
 exports.BUILD_REVIEW_CAPABILITY_SCHEMA = BUILD_REVIEW_CAPABILITY_SCHEMA;
 exports.BuildsApiError = BuildsApiError;
-exports.EMBEDDED_WALLET_UNSUPPORTED = EMBEDDED_WALLET_UNSUPPORTED;
 exports.FAILURE_REASONS = FAILURE_REASONS;
 exports.NON_TERMINAL_STATES = NON_TERMINAL_STATES;
 exports.OffchainAuthProvider = OffchainAuthProvider;
@@ -8106,16 +7951,13 @@ exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
 exports.defaultInjectedEvmProvider = defaultInjectedEvmProvider;
 exports.defaultInjectedProvider = defaultInjectedProvider;
 exports.deserializeTransaction = deserializeTransaction;
-exports.embeddedRunEvmTransaction = embeddedRunEvmTransaction;
-exports.embeddedSignAndSubmit = embeddedSignAndSubmit;
 exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
 exports.getOrCreateTurnkeyWallet = getOrCreateTurnkeyWallet;
 exports.getPlatform = getPlatform;
-exports.hasEmbeddedEvmWallet = hasEmbeddedEvmWallet;
-exports.hasEmbeddedWallet = hasEmbeddedWallet;
+exports.hasTurnkeyWallet = hasTurnkeyWallet;
 exports.init = init;
 exports.login = login;
 exports.loginWithPopup = loginWithPopup;
@@ -8135,10 +7977,13 @@ exports.resolveSolanaRpcUrl = resolveSolanaRpcUrl;
 exports.setAuthLoading = setAuthLoading;
 exports.setCurrentUser = setCurrentUser;
 exports.setPlatform = setPlatform;
+exports.signAndSubmitTransactionWithTurnkey = signAndSubmitTransactionWithTurnkey;
 exports.signInAnonymously = signInAnonymously;
+exports.signMessageWithTurnkey = signMessageWithTurnkey;
 exports.signSolanaMessageViaTurnkey = signSolanaMessageViaTurnkey;
+exports.signTransactionWithTurnkey = signTransactionWithTurnkey;
 exports.startTurnkeyEmailLogin = startTurnkeyEmailLogin;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index-C_L497w1.js.map
+//# sourceMappingURL=index-Bk0nEjB6.js.map