@bounded-sh/client 0.0.62 → 0.0.64

package/dist/{index.native-BIUs8t7F.mjs → index.native-CWcQMPZd.mjs}

@@ -1,4 +1,4 @@
-import { assertCanonicalBoundedRuntimeWriteCalldata, getActiveSessionManager, getConfig, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, onSessionCleared, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
+import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, onSessionCleared, reconnectWithNewAuth, deriveUserIdentityFromIdToken, subscribe, getIdToken as getIdToken$1, convertRemainingAccounts, buildSetDocumentsTransaction, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
 /**
@@ -847,6 +847,8 @@ function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
 
+var safeBuffer = {exports: {}};
+
 var buffer = {};
 
 var base64Js = {};
@@ -3216,10 +3218,6 @@ function requireBuffer () {
 	return buffer;
 }
 
-var bufferExports = requireBuffer();
-
-var safeBuffer = {exports: {}};
-
 /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
 
 var hasRequiredSafeBuffer;
@@ -3433,173 +3431,448 @@ var basex = /*@__PURE__*/getDefaultExportFromCjs(srcExports);
 var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
 var bs58 = basex(ALPHABET);
 
-// crossmint-signer-bridge.ts — routes embedded-wallet signing through the
-// Bounded-owned signer popup (auth.bounded.sh/wallet/signer).
+var bufferExports = requireBuffer();
+
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because a WebAuthn passkey is bound to one origin).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$3() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
+}
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
+}
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
+    }
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
+    };
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
+    });
+    modal = m;
+    return m;
+}
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    window.setTimeout(() => {
+        m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin) {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
+    // inside the frame from the user's click (transient activation stays in-frame).
+    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.onIframeMessage = null;
+}
+
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app card plus
+// the OS Face ID / Touch ID sheet, never a jarring popup.
+//
+// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
+// MUST run on the single Bounded signer origin. The iframe carries the
+// publickey-credentials-{get,create} permission policy and the user's click lands
+// INSIDE it, giving WebAuthn the transient activation it needs.
+//
+// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
+// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
+// SAME request through `popupFallback` (a real window). Callers pass a popup
+// implementation and never see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
+ * (Safari cross-origin create) or cannot be mounted.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$3())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        let settled = false;
+        let usedFallback = false;
+        const iframe = ensureIframe(m, url, signerOrigin);
+        const send = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                m.iframeReady = true;
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
+                goFallback();
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
+// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
+// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
 //
-// Slice-1 attached a non-custodial Crossmint smart wallet to email logins and
-// populated `@user.address`. This bridge is the slice-2 counterpart: a user
-// whose address came from `auth.wallets` can APPROVE transactions with that
-// wallet from ANY app, non-custodially, by having the Crossmint client SDK run
-// ONLY on the Bounded signer page (one whitelisted origin) and talking to it via
-// postMessage.
+// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
+// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
+// look + motion, so signing feels native. Safari (unreliable at iframe passkey
+// CREATE) and any environment where the frame cannot mount fall back to a real
+// popup window; both transports speak the same postMessage protocol.
 //
-// SEMANTICS (Crossmint Solana smart wallets): these wallets cannot produce raw
-// detached signatures — there is no signMessage and no sign-without-submit. The
-// only honest primitive is EXECUTION (sign + submit) via the wallet's email-OTP
-// authorization. So this bridge implements `signAndSubmitTransaction` and a
-// token-send; `signMessage` / `signTransaction` throw a clear unsupported error.
-const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets — Crossmint Solana smart wallets sign ' +
-    'and submit atomically. Use signAndSubmitTransaction() (or bounded.sendWalletToken) ' +
-    'instead of signMessage/signTransaction.';
-const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so email logins get a non-custodial wallet (@user.address), ' +
-    'then sign from a user gesture.';
+// Turnkey wallets produce raw detached signatures. The signer runs the Turnkey
+// browser SDK on the single Bounded origin and stamps an ed25519 signRawPayload
+// with the user's passkey. The app retains the transaction itself.
+//
+// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
+// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
+// every user one wallet + one passkey that roams across every app.
 function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
+// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
+// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
+// fail - and a post-failure popup would no longer have a user gesture to open with.
+// There we pick the popup up front, from the original click, so enrollment is solid.
+// Everywhere else the inline widget is used (buttery in-app modal).
+function preferPopup() {
+    if (!hasDOM$2() || typeof navigator === 'undefined')
+        return true;
+    const ua = navigator.userAgent || '';
+    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+}
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (Safari enrollment, or the frame never loads).
+async function deliver(url, origin, ex) {
+    const popup = () => runPopup(url, origin, ex);
+    if (preferPopup())
+        return popup();
+    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+}
+async function turnkeySignerPage() {
+    const cfg = await getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+function toHex(bytes) {
+    let h = '';
+    for (const b of bytes)
+        h += b.toString(16).padStart(2, '0');
+    return h;
+}
+function fromHex(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(clean.substr(i * 2, 2), 16);
+    return out;
+}
 function decodeJwt$1(token) {
     try {
-        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
-        const pad = b64.length % 4;
-        if (pad === 2)
-            b64 += '==';
-        else if (pad === 3)
-            b64 += '=';
-        return JSON.parse(bufferExports.Buffer.from(b64, 'base64').toString('utf8'));
+        let value = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padding = value.length % 4;
+        if (padding === 2)
+            value += '==';
+        else if (padding === 3)
+            value += '=';
+        return JSON.parse(getPlatform().atob(value));
     }
     catch (_a) {
         return {};
     }
 }
-// Pull the embedded-wallet identity out of the active session's id token.
-// Returns null when this session has no wallet (so callers can throw the
-// informative NO_EMBEDDED_WALLET error).
-function walletClaimsFromSession(chain = 'solana') {
-    let idToken = null;
+function activeTurnkeyAddress() {
+    let token = null;
     try {
-        idToken = getActiveSessionManager().getIdToken();
+        token = getActiveSessionManager().getIdToken();
     }
     catch (_a) {
-        idToken = null;
+        token = null;
     }
-    if (!idToken)
-        return null;
-    const c = decodeJwt$1(idToken);
-    const address = c['custom:walletAddress'];
-    const evmAddress = c['custom:evmWalletAddress'];
-    const email = c['email'];
-    if (typeof email !== 'string' || !email)
+    if (!token)
         return null;
-    if (chain === 'solana' && (typeof address !== 'string' || !address))
-        return null;
-    if (chain === 'evm' && (typeof evmAddress !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(evmAddress)))
-        return null;
-    const envClaim = c['custom:walletEnvironment'];
-    const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
-    return Object.assign(Object.assign(Object.assign({ email }, (typeof address === 'string' && address ? { address } : {})), (typeof evmAddress === 'string' ? { evmAddress: evmAddress.toLowerCase() } : {})), { environment });
-}
-async function signerPageUrl() {
-    const cfg = await getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
+    const claims = decodeJwt$1(token);
+    const address = claims['custom:walletAddress'];
+    const provider = claims['custom:walletProvider'];
+    return provider === 'turnkey' && typeof address === 'string' && address
+        ? address
+        : null;
 }
 let requestSeq = 0;
-/**
- * Open the Bounded signer popup, send `action` to it, and resolve with the
- * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
- * the browser will block the popup — in which case this rejects with a clear
- * "Popup blocked" error telling the app to call from a user gesture.
- *
- * Non-custodial: the popup gates signing behind an email OTP delivered to the
- * wallet's owner, and validates that the wallet address matches the account.
- */
-async function signViaSignerPopup(action) {
-    if (!hasDOM$2()) {
-        throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
-    }
-    const isEvm = action.kind === 'evmTransaction';
-    const claims = walletClaimsFromSession(isEvm ? 'evm' : 'solana');
-    if (!claims)
-        throw new Error(NO_EMBEDDED_WALLET);
-    const { url, origin: signerOrigin } = await signerPageUrl();
-    const requestId = `bsign_${Date.now()}_${++requestSeq}`;
-    // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
-    const w = 420, h = 600;
+// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
+// resolve when `onResult` accepts a result message. Origin + source are pinned.
+async function runPopup(url, signerOrigin, ex) {
+    var _a, _b;
+    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
     const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
     const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-wallet-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup) {
-        throw new Error('Popup blocked — call signAndSubmitTransaction() from a user gesture (e.g. a click handler) so the wallet approval window can open.');
-    }
-    const request = {
-        type: 'bounded:sign',
-        requestId,
-        environment: claims.environment, // may be undefined → page auto-detects
-        email: claims.email,
-        address: isEvm ? claims.evmAddress : claims.address,
-        action,
-    };
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+    }
     return await new Promise((resolve, reject) => {
         let settled = false;
-        let closeTimer;
         let sentRequest = false;
-        const cleanup = () => {
-            settled = true;
-            window.removeEventListener('message', onMsg);
-            if (closeTimer)
-                clearInterval(closeTimer);
-        };
-        const sendRequest = () => {
-            if (sentRequest)
+        let closeTimer;
+        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
+            clearInterval(closeTimer); };
+        const sendRequest = () => { if (sentRequest)
+            return; sentRequest = true; try {
+            popup.postMessage(ex.request, signerOrigin);
+        }
+        catch ( /* popup gone */_a) { /* popup gone */ } };
+        const onMsg = (event) => {
+            if (event.origin !== signerOrigin)
                 return;
-            sentRequest = true;
-            try {
-                popup.postMessage(request, signerOrigin);
-            }
-            catch ( /* popup gone */_a) { /* popup gone */ }
-        };
-        const onMsg = (ev) => {
-            if (ev.origin !== signerOrigin)
-                return; // only trust the signer page origin
-            if (ev.source !== popup)
-                return; // only trust this signer popup window
-            const d = ev.data;
+            if (event.source !== popup)
+                return;
+            const d = event.data;
             if (!d || typeof d !== 'object')
                 return;
-            if (d.type === 'bounded:signer:ready') {
+            if (d.type === 'bounded:turnkey:ready') {
                 sendRequest();
                 return;
             }
-            if (d.type === 'bounded:signer:result' && d.requestId === requestId) {
-                cleanup();
-                try {
-                    popup.close();
+            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
+                const outcome = ex.onResult(d);
+                if ('error' in outcome) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    reject(new Error(outcome.error));
+                    return;
+                }
+                if (outcome.done) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
+                    resolve(outcome.value);
                 }
-                catch ( /* ignore */_a) { /* ignore */ }
-                if (d.ok)
-                    resolve({ hash: d.hash, explorerLink: d.explorerLink, transactionId: d.transactionId });
-                else
-                    reject(new Error(String(d.error || 'Wallet signing failed')));
             }
         };
         window.addEventListener('message', onMsg);
-        // Fallback: if the ready ping was missed (fast load / focus race), push the
-        // request shortly after opening. The page ignores it until a bounded:sign
-        // arrives and only acts on the first one, so a duplicate is harmless.
         setTimeout(sendRequest, 1200);
-        // If the user closes the popup before completing, reject (unless a result
-        // just arrived — give any in-flight message a beat to settle first).
         closeTimer = setInterval(() => {
             if (popup.closed) {
                 clearInterval(closeTimer);
                 setTimeout(() => { if (!settled) {
                     cleanup();
-                    reject(new Error('Wallet approval window was closed before signing completed.'));
+                    reject(new Error('Wallet approval window was closed before it completed.'));
                 } }, 400);
             }
         }, 500);
-        // Overall safety timeout (OTP + signing). Generous — the user may take a
-        // while to fetch the code from their email.
         setTimeout(() => { if (!settled) {
             cleanup();
             try {
@@ -3610,80 +3883,105 @@ async function signViaSignerPopup(action) {
         } }, 5 * 60 * 1000);
     });
 }
-// Serialize a legacy or versioned Solana transaction to BASE58 for the signer
-// page. Crossmint's smart-wallet createTransaction endpoint requires the
-// `serializedTransaction` string to be base58 — it rejects base64 with
-// "Invalid base58 string" (verified against Crossmint staging 2026-07-07). The
-// `wallets-sdk` object path bs58-encodes internally, so base58 is the contract.
-//
-// We do NOT require existing signatures (the smart wallet signs on the page);
-// Crossmint extracts the instructions, overrides the fee payer to its sponsor,
-// and re-wraps them for the smart wallet.
-function serializeTransaction(transaction) {
-    const isLegacy = 'recentBlockhash' in transaction &&
-        !('message' in transaction && 'staticAccountKeys' in transaction.message);
-    const bytes = isLegacy
-        ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
-        : transaction.serialize();
-    return bs58.encode(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+function hasTurnkeyWallet() {
+    return activeTurnkeyAddress() !== null;
 }
 /**
- * Whether the active session carries an embedded wallet (so the provider should
- * route signing through the popup rather than throw "no wallet").
+ * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
+ * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
+ * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
+ * browser blocks the popup.
+ *
+ * On the user's FIRST signature the popup transparently enrolls a device passkey
+ * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
+ * signatures are just a passkey approval.
  */
-function hasEmbeddedWallet() {
-    return walletClaimsFromSession() != null;
-}
-/** Whether the active email/social session carries an embedded Crossmint EVM wallet. */
-function hasEmbeddedEvmWallet() {
-    return walletClaimsFromSession('evm') != null;
-}
-/** signAndSubmitTransaction for embedded wallets: serialize + route through the
- *  signer popup, resolve with the on-chain transaction signature/hash. */
-async function embeddedSignAndSubmit(transaction) {
-    const serializedTransaction = serializeTransaction(transaction);
-    const result = await signViaSignerPopup({ kind: 'transaction', serializedTransaction });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no transaction hash.');
-    return hash;
-}
-/** Submit a validated BoundedRuntime EVM write through the user's email signer. */
-async function embeddedRunEvmTransaction(transaction) {
-    var _a, _b;
-    if (!transaction.to || !transaction.data || !transaction.chainId)
-        throw new Error('Incomplete embedded EVM transaction');
-    if (!/^0x[0-9a-fA-F]{40}$/.test(transaction.to))
-        throw new Error('Invalid embedded EVM runtime address');
-    assertCanonicalBoundedRuntimeWriteCalldata(transaction.data);
-    if (!Number.isSafeInteger(transaction.chainId) || transaction.chainId <= 0)
-        throw new Error('Invalid embedded EVM chain id');
-    if (transaction.nonce !== undefined)
-        throw new Error('Server-supplied EVM nonces are not accepted');
-    try {
-        if (BigInt((_a = transaction.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
-            throw new Error('Bounded EVM writes cannot transfer native value');
+async function signSolanaMessageViaTurnkey(message) {
+    if (!hasDOM$2()) {
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
+    const messageHex = toHex(message);
+    return await deliver(url, origin, {
+        request: { type: 'bounded:turnkey:sign', requestId, messageHex },
+        onResult: (d) => {
+            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
+            }
+            return { error: String(d.error || 'Turnkey signing failed') };
+        },
+    });
+}
+function requireMatchingAddress(result) {
+    const expected = activeTurnkeyAddress();
+    if (!expected)
+        throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+    if (result.address !== expected)
+        throw new Error('Turnkey signer returned a different wallet address than the active session.');
+    return expected;
+}
+async function signMessageWithTurnkey(message) {
+    const result = await signSolanaMessageViaTurnkey(getPlatform().textEncode(message));
+    requireMatchingAddress(result);
+    return bs58.encode(result.signature);
+}
+async function signTransactionWithTurnkey(transaction) {
+    const isLegacy = 'serializeMessage' in transaction;
+    const message = isLegacy
+        ? transaction.serializeMessage()
+        : transaction.message.serialize();
+    const result = await signSolanaMessageViaTurnkey(new Uint8Array(message));
+    const address = requireMatchingAddress(result);
+    const { PublicKey } = await import('@solana/web3.js');
+    if (isLegacy) {
+        transaction.addSignature(new PublicKey(address), bufferExports.Buffer.from(result.signature));
     }
-    catch (error) {
-        if (error instanceof Error && error.message.includes('cannot transfer'))
-            throw error;
-        throw new Error('Invalid embedded EVM transaction value');
+    else {
+        transaction.addSignature(new PublicKey(address), result.signature);
+    }
+    return transaction;
+}
+async function signAndSubmitTransactionWithTurnkey(transaction, feePayer) {
+    var _a;
+    const config = await getConfig();
+    const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+    if (!rpcUrl)
+        throw new Error('Turnkey transaction submission requires init({ rpcUrl }).');
+    const { Connection, PublicKey } = await import('@solana/web3.js');
+    const connection = new Connection(rpcUrl, 'confirmed');
+    const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
+    const isLegacy = 'serializeMessage' in transaction;
+    if (isLegacy) {
+        const legacy = transaction;
+        legacy.recentBlockhash = blockhash;
+        legacy.lastValidBlockHeight = lastValidBlockHeight;
+        if (!legacy.feePayer) {
+            const address = activeTurnkeyAddress();
+            if (!address)
+                throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+            legacy.feePayer = feePayer !== null && feePayer !== void 0 ? feePayer : new PublicKey(address);
+        }
     }
-    const result = await signViaSignerPopup({
-        kind: 'evmTransaction',
-        transaction: { to: transaction.to, data: transaction.data, value: (_b = transaction.value) !== null && _b !== void 0 ? _b : '0', chainId: transaction.chainId },
+    else {
+        transaction.message.recentBlockhash = blockhash;
+    }
+    const signed = await signTransactionWithTurnkey(transaction);
+    const signature = await connection.sendRawTransaction(signed.serialize(), {
+        skipPreflight: false,
+        maxRetries: 3,
     });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no EVM transaction hash.');
-    return { transactionSignature: hash, blockNumber: 0, gasUsed: '0', data: result };
+    const confirmation = await connection.confirmTransaction({ signature, blockhash, lastValidBlockHeight }, 'confirmed');
+    if (confirmation.value.err) {
+        throw new Error(`Turnkey transaction failed: ${JSON.stringify(confirmation.value.err)}`);
+    }
+    return signature;
 }
 
 // Same message the email provider uses when a hosted (OIDC) login has no
 // embedded wallet — enable `auth.wallets` in policy to get one.
-const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so logins get a non-custodial Crossmint wallet (@user.address), ' +
-    'then sign from a user gesture.';
+const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +
+    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';
 const PKCE_STORE_KEY = 'bounded.oidc.pkce';
 const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
@@ -3709,10 +4007,8 @@ function decodeJwt(token) {
     }
 }
 // A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
-// Signing surface (slice 2): a hosted login on a wallets-enabled app carries an
-// embedded Crossmint wallet (@user.address). signAndSubmitTransaction routes
-// through the Bounded signer popup; signMessage/signTransaction are structurally
-// unsupported for Crossmint smart wallets (sign+submit atomically, no raw sig).
+// Turnkey supplies the default Solana wallet and supports raw message and transaction
+// signatures through the Bounded signer window.
 const oidcProviderSingleton = {
     async login() {
         const idToken = sessionManager().getIdToken();
@@ -3723,37 +4019,38 @@ const oidcProviderSingleton = {
         return idToken ? userFromIdToken(idToken) : null;
     },
     async logout() { await sessionManager().clearSession(); },
-    async signMessage(_message) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signMessage(message) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signMessageWithTurnkey(message);
     },
-    async signTransaction(_t) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signTransaction(transaction) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signTransactionWithTurnkey(transaction);
     },
-    async runTransaction(evm, sol, options) {
+    async runTransaction(evm, sol, _options) {
         if (evm && sol)
             throw new Error('A transaction cannot target EVM and Solana at the same time.');
-        if (!evm)
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
-            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');
-        if (!hasEmbeddedEvmWallet())
-            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');
-        return embeddedRunEvmTransaction(evm);
+        if (evm)
+            throw new Error('Turnkey embedded wallets currently support Solana only. Connect an EVM wallet for EVM transactions.');
+        throw new Error('This Solana transaction shape is not supported by the Turnkey provider. Use a pre-built transaction.');
     },
-    async signAndSubmitTransaction(transaction, _feePayer) {
-        if (!hasEmbeddedWallet())
+    async signAndSubmitTransaction(transaction, feePayer) {
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        return embeddedSignAndSubmit(transaction);
+        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);
     },
 };
 function userFromIdToken(idToken) {
     const c = decodeJwt(idToken);
     const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';
     return {
-        id, address: (c['custom:walletAddress'] || null),
-        evmAddress: typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])
-            ? c['custom:evmWalletAddress'].toLowerCase()
-            : null,
+        id,
+        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),
+        evmAddress: null,
         email: (c.email || null), provider: oidcProviderSingleton,
     };
 }
@@ -4476,7 +4773,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-Cb4VKA1E.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-h0fPnU76.mjs')).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4495,7 +4792,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-ZkPzVj5W.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dd7ij6bc.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4508,7 +4805,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-DnOrVMDX.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-xvZq9Zli.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4536,7 +4833,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-BBPpydtM.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-Dmup2WIL.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4592,7 +4889,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-BBPpydtM.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-Dmup2WIL.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -6418,5 +6715,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { useAuth as A, useQuery as B, useBuildRun as C, apps as D, EMBEDDED_WALLET_UNSUPPORTED as E, deserializeTransaction as F, getIdToken as G, onramp as H, onrampQuote as I, onrampStatus as J, setPlatform as K, builds as L, BuildsApiError as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, PARK_REASONS as Q, RUN_STATES as R, FAILURE_REASONS as S, TERMINAL_STATES as T, BUILD_REVIEW_CAPABILITY_SCHEMA as U, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as V, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as W, hasEmbeddedEvmWallet as a, embeddedSignAndSubmit as b, setAuthLoading as c, bufferExports as d, embeddedRunEvmTransaction as e, bs58 as f, getPlatform as g, hasEmbeddedWallet as h, confirmAndCheckTransaction as i, init as j, getCurrentUser as k, onAuthLoadingChanged as l, getAuthLoading as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, login as p, logout as q, resolveSolanaRpcUrl as r, setCurrentUser as s, getAuthProvider as t, signInAnonymously as u, loginWithPrivy as v, loginWithRedirect as w, completeLoginFromRedirect as x, loginWithPopup as y, completeLoginInPopup as z };
-//# sourceMappingURL=index.native-BIUs8t7F.mjs.map
+export { useAuth as A, useQuery as B, useBuildRun as C, apps as D, deserializeTransaction as E, getIdToken as F, onramp as G, onrampQuote as H, onrampStatus as I, setPlatform as J, builds as K, BuildsApiError as L, PARK_REASONS as M, NON_TERMINAL_STATES as N, OffchainAuthProvider as O, PrivyExpoProvider as P, FAILURE_REASONS as Q, RUN_STATES as R, BUILD_REVIEW_CAPABILITY_SCHEMA as S, TERMINAL_STATES as T, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as U, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as V, signMessageWithTurnkey as a, signTransactionWithTurnkey as b, signAndSubmitTransactionWithTurnkey as c, setAuthLoading as d, bufferExports as e, bs58 as f, getPlatform as g, hasTurnkeyWallet as h, confirmAndCheckTransaction as i, init as j, getCurrentUser as k, onAuthLoadingChanged as l, getAuthLoading as m, normalizeSolanaRpcUrl as n, onAuthStateChanged as o, login as p, logout as q, resolveSolanaRpcUrl as r, setCurrentUser as s, getAuthProvider as t, signInAnonymously as u, loginWithPrivy as v, loginWithRedirect as w, completeLoginFromRedirect as x, loginWithPopup as y, completeLoginInPopup as z };
+//# sourceMappingURL=index.native-CWcQMPZd.mjs.map