@bounded-sh/client 0.0.62 → 0.0.65

package/dist/{index.native-BSheiGj2.js → index.native-CAHw3k3_.js}

@@ -868,6 +868,8 @@ function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
 
+var safeBuffer = {exports: {}};
+
 var buffer = {};
 
 var base64Js = {};
@@ -3237,10 +3239,6 @@ function requireBuffer () {
 	return buffer;
 }
 
-var bufferExports = requireBuffer();
-
-var safeBuffer = {exports: {}};
-
 /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
 
 var hasRequiredSafeBuffer;
@@ -3454,173 +3452,505 @@ var basex = /*@__PURE__*/getDefaultExportFromCjs(srcExports);
 var ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
 var bs58 = basex(ALPHABET);
 
-// crossmint-signer-bridge.ts — routes embedded-wallet signing through the
-// Bounded-owned signer popup (auth.bounded.sh/wallet/signer).
+var bufferExports = requireBuffer();
+
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because a WebAuthn passkey is bound to one origin).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$3() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
+}
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
+}
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
+    }
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
+    };
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
+    });
+    modal = m;
+    return m;
+}
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    window.setTimeout(() => {
+        m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin) {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    // Grant the framed origin WebAuthn get + create so passkey enroll/sign run
+    // inside the frame from the user's click (transient activation stays in-frame).
+    iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create; clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.onIframeMessage = null;
+}
+
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app card plus
+// the OS Face ID / Touch ID sheet, never a jarring popup.
 //
-// Slice-1 attached a non-custodial Crossmint smart wallet to email logins and
-// populated `@user.address`. This bridge is the slice-2 counterpart: a user
-// whose address came from `auth.wallets` can APPROVE transactions with that
-// wallet from ANY app, non-custodially, by having the Crossmint client SDK run
-// ONLY on the Bounded signer page (one whitelisted origin) and talking to it via
-// postMessage.
+// WHY AN IFRAME: a WebAuthn passkey is bound to ONE origin, so passkey create/sign
+// MUST run on the single Bounded signer origin. The iframe carries the
+// publickey-credentials-{get,create} permission policy and the user's click lands
+// INSIDE it, giving WebAuthn the transient activation it needs.
 //
-// SEMANTICS (Crossmint Solana smart wallets): these wallets cannot produce raw
-// detached signatures — there is no signMessage and no sign-without-submit. The
-// only honest primitive is EXECUTION (sign + submit) via the wallet's email-OTP
-// authorization. So this bridge implements `signAndSubmitTransaction` and a
-// token-send; `signMessage` / `signTransaction` throw a clear unsupported error.
-const EMBEDDED_WALLET_UNSUPPORTED = 'Unsupported for embedded smart wallets — Crossmint Solana smart wallets sign ' +
-    'and submit atomically. Use signAndSubmitTransaction() (or bounded.sendWalletToken) ' +
-    'instead of signMessage/signTransaction.';
-const NO_EMBEDDED_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so email logins get a non-custodial wallet (@user.address), ' +
-    'then sign from a user gesture.';
+// SAFARI / restricted embedders: cross-origin iframe passkey CREATE is unreliable
+// in Safari. The signer detects that and posts `fallbackPopup`; we then rerun the
+// SAME request through `popupFallback` (a real window). Callers pass a popup
+// implementation and never see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot run WebAuthn
+ * (Safari cross-origin create) or cannot be mounted.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$3())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: WebAuthn is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        let settled = false;
+        let usedFallback = false;
+        const iframe = ensureIframe(m, url, signerOrigin);
+        const send = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                m.iframeReady = true;
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:fallbackPopup" && d.requestId === requestId) {
+                goFallback();
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
+// turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
+// kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
+//
+// The hosted Turnkey signer refuses to sign unless the request carries an issuer-signed
+// SIGNING CAPABILITY bound to the app id, the requesting origin, and the EXACT payload
+// hash. `requestTurnkeySigningCapability` mints one for the given bytes and
+// `buildTurnkeySignRequest` assembles the signer request that carries it. The bridge
+// (turnkey-signer-bridge.ts) supplies the base url + id token and routes through both,
+// so a regression here (a dropped capability, a wrong route, a swallowed error) is
+// caught without a browser.
+// POST the Bounded id token + payload hash to the issuer's capability mint route and
+// return the issuer-signed capability for exactly these bytes. Credential-free: identity
+// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
+// would not carry). Throws with the same stable messages the bridge relied on inline.
+async function requestTurnkeySigningCapability(opts) {
+    const base = opts.baseUrl.replace(/\/$/, '');
+    let res;
+    try {
+        res = await opts.fetchImpl(`${base}/wallet/turnkey/capability`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ idToken: opts.idToken, messageHex: opts.messageHex }),
+        });
+    }
+    catch (_a) {
+        throw new Error('Could not reach the Bounded signer to authorize this signature.');
+    }
+    if (!res.ok) {
+        let error = 'signing_capability_denied';
+        try {
+            const d = (await res.json());
+            if (d && typeof d.error === 'string')
+                error = d.error;
+        }
+        catch (_b) {
+            /* keep the default marker */
+        }
+        throw new Error(`Turnkey signing was not authorized (${error}).`);
+    }
+    const d = (await res.json());
+    if (!d || typeof d.capability !== 'string' || !d.capability) {
+        throw new Error('Turnkey signing capability was malformed.');
+    }
+    return d.capability;
+}
+// Assemble the `bounded:turnkey:sign` postMessage request, carrying the issuer-signed
+// capability for the same bytes. Without the capability the hosted signer refuses
+// (capability_required), so it is a required field of every sign request.
+function buildTurnkeySignRequest(opts) {
+    return {
+        type: 'bounded:turnkey:sign',
+        requestId: opts.requestId,
+        messageHex: opts.messageHex,
+        capability: opts.capability,
+    };
+}
+
+// turnkey-signer-bridge.ts - routes NON-CUSTODIAL Turnkey embedded-wallet signing
+// through the Bounded-owned signer page (auth.bounded.sh/wallet/turnkey/signer).
+//
+// TRANSPORT: by default the signer runs inside the in-app WIDGET (turnkey-wallet-
+// widget.ts) - an iframe behind a Shadow-DOM modal that matches the Bounded widget
+// look + motion, so signing feels native. Safari (unreliable at iframe passkey
+// CREATE) and any environment where the frame cannot mount fall back to a real
+// popup window; both transports speak the same postMessage protocol.
+//
+// Turnkey wallets produce raw detached signatures. The signer runs the Turnkey
+// browser SDK on the single Bounded origin and stamps an ed25519 signRawPayload
+// with the user's passkey. The app retains the transaction itself.
+//
+// ONE ORIGIN, ONE PASSKEY: a WebAuthn passkey is bound to a single origin, so ALL
+// Bounded apps (any subdomain / custom domain) sign through this one origin - giving
+// every user one wallet + one passkey that roams across every app.
 function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
+// Safari (incl. iOS WebViews) is unreliable at running a WebAuthn CREATE inside a
+// cross-origin iframe, so the widget's automatic in-iframe passkey enrollment can
+// fail - and a post-failure popup would no longer have a user gesture to open with.
+// There we pick the popup up front, from the original click, so enrollment is solid.
+// Everywhere else the inline widget is used (buttery in-app modal).
+function preferPopup() {
+    if (!hasDOM$2() || typeof navigator === 'undefined')
+        return true;
+    const ua = navigator.userAgent || '';
+    return /^((?!chrome|android|crios|fxios|edg|edga|opr).)*safari/i.test(ua);
+}
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (Safari enrollment, or the frame never loads).
+async function deliver(url, origin, ex) {
+    const popup = () => runPopup(url, origin, ex);
+    if (preferPopup())
+        return popup();
+    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+}
+async function turnkeySignerPage() {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+function toHex(bytes) {
+    let h = '';
+    for (const b of bytes)
+        h += b.toString(16).padStart(2, '0');
+    return h;
+}
+function fromHex(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(clean.substr(i * 2, 2), 16);
+    return out;
+}
 function decodeJwt$1(token) {
     try {
-        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
-        const pad = b64.length % 4;
-        if (pad === 2)
-            b64 += '==';
-        else if (pad === 3)
-            b64 += '=';
-        return JSON.parse(bufferExports.Buffer.from(b64, 'base64').toString('utf8'));
+        let value = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padding = value.length % 4;
+        if (padding === 2)
+            value += '==';
+        else if (padding === 3)
+            value += '=';
+        return JSON.parse(getPlatform().atob(value));
     }
     catch (_a) {
         return {};
     }
 }
-// Pull the embedded-wallet identity out of the active session's id token.
-// Returns null when this session has no wallet (so callers can throw the
-// informative NO_EMBEDDED_WALLET error).
-function walletClaimsFromSession(chain = 'solana') {
-    let idToken = null;
+function activeTurnkeyAddress() {
+    let token = null;
     try {
-        idToken = core.getActiveSessionManager().getIdToken();
+        token = core.getActiveSessionManager().getIdToken();
     }
     catch (_a) {
-        idToken = null;
+        token = null;
     }
-    if (!idToken)
-        return null;
-    const c = decodeJwt$1(idToken);
-    const address = c['custom:walletAddress'];
-    const evmAddress = c['custom:evmWalletAddress'];
-    const email = c['email'];
-    if (typeof email !== 'string' || !email)
+    if (!token)
         return null;
-    if (chain === 'solana' && (typeof address !== 'string' || !address))
-        return null;
-    if (chain === 'evm' && (typeof evmAddress !== 'string' || !/^0x[0-9a-fA-F]{40}$/.test(evmAddress)))
-        return null;
-    const envClaim = c['custom:walletEnvironment'];
-    const environment = envClaim === 'staging' || envClaim === 'production' ? envClaim : undefined;
-    return Object.assign(Object.assign(Object.assign({ email }, (typeof address === 'string' && address ? { address } : {})), (typeof evmAddress === 'string' ? { evmAddress: evmAddress.toLowerCase() } : {})), { environment });
-}
-async function signerPageUrl() {
-    const cfg = await core.getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/signer`, origin: new URL(base).origin };
+    const claims = decodeJwt$1(token);
+    const address = claims['custom:walletAddress'];
+    const provider = claims['custom:walletProvider'];
+    return provider === 'turnkey' && typeof address === 'string' && address
+        ? address
+        : null;
 }
 let requestSeq = 0;
-/**
- * Open the Bounded signer popup, send `action` to it, and resolve with the
- * submitted transaction result. Must be called from a USER GESTURE (click/tap) or
- * the browser will block the popup — in which case this rejects with a clear
- * "Popup blocked" error telling the app to call from a user gesture.
- *
- * Non-custodial: the popup gates signing behind an email OTP delivered to the
- * wallet's owner, and validates that the wallet address matches the account.
- */
-async function signViaSignerPopup(action) {
-    if (!hasDOM$2()) {
-        throw new Error('Embedded-wallet signing is only available in the browser (popup-based).');
-    }
-    const isEvm = action.kind === 'evmTransaction';
-    const claims = walletClaimsFromSession(isEvm ? 'evm' : 'solana');
-    if (!claims)
-        throw new Error(NO_EMBEDDED_WALLET);
-    const { url, origin: signerOrigin } = await signerPageUrl();
-    const requestId = `bsign_${Date.now()}_${++requestSeq}`;
-    // Centered popup, sized for the OTP form (matches the OIDC login popup shape).
-    const w = 420, h = 600;
+// Shared popup driver: open the signer page, do the ready/postMessage handshake, and
+// resolve when `onResult` accepts a result message. Origin + source are pinned.
+async function runPopup(url, signerOrigin, ex) {
+    var _a, _b;
+    const w = (_a = ex.width) !== null && _a !== void 0 ? _a : 420, h = (_b = ex.height) !== null && _b !== void 0 ? _b : 620;
     const left = window.screenX + Math.max(0, (window.outerWidth - w) / 2);
     const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
-    const popup = window.open(url, 'bounded-wallet-signer', `width=${w},height=${h},left=${left},top=${top}`);
+    const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup) {
-        throw new Error('Popup blocked — call signAndSubmitTransaction() from a user gesture (e.g. a click handler) so the wallet approval window can open.');
-    }
-    const request = {
-        type: 'bounded:sign',
-        requestId,
-        environment: claims.environment, // may be undefined → page auto-detects
-        email: claims.email,
-        address: isEvm ? claims.evmAddress : claims.address,
-        action,
-    };
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the passkey approval window can open.');
+    }
     return await new Promise((resolve, reject) => {
         let settled = false;
-        let closeTimer;
         let sentRequest = false;
-        const cleanup = () => {
-            settled = true;
-            window.removeEventListener('message', onMsg);
-            if (closeTimer)
-                clearInterval(closeTimer);
-        };
-        const sendRequest = () => {
-            if (sentRequest)
+        let closeTimer;
+        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
+            clearInterval(closeTimer); };
+        const sendRequest = () => { if (sentRequest)
+            return; sentRequest = true; try {
+            popup.postMessage(ex.request, signerOrigin);
+        }
+        catch ( /* popup gone */_a) { /* popup gone */ } };
+        const onMsg = (event) => {
+            if (event.origin !== signerOrigin)
                 return;
-            sentRequest = true;
-            try {
-                popup.postMessage(request, signerOrigin);
-            }
-            catch ( /* popup gone */_a) { /* popup gone */ }
-        };
-        const onMsg = (ev) => {
-            if (ev.origin !== signerOrigin)
-                return; // only trust the signer page origin
-            if (ev.source !== popup)
-                return; // only trust this signer popup window
-            const d = ev.data;
+            if (event.source !== popup)
+                return;
+            const d = event.data;
             if (!d || typeof d !== 'object')
                 return;
-            if (d.type === 'bounded:signer:ready') {
+            if (d.type === 'bounded:turnkey:ready') {
                 sendRequest();
                 return;
             }
-            if (d.type === 'bounded:signer:result' && d.requestId === requestId) {
-                cleanup();
-                try {
-                    popup.close();
+            if (d.type === 'bounded:turnkey:result' && d.requestId === ex.request.requestId) {
+                const outcome = ex.onResult(d);
+                if ('error' in outcome) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_a) { /* ignore */ }
+                    reject(new Error(outcome.error));
+                    return;
+                }
+                if (outcome.done) {
+                    cleanup();
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
+                    resolve(outcome.value);
                 }
-                catch ( /* ignore */_a) { /* ignore */ }
-                if (d.ok)
-                    resolve({ hash: d.hash, explorerLink: d.explorerLink, transactionId: d.transactionId });
-                else
-                    reject(new Error(String(d.error || 'Wallet signing failed')));
             }
         };
         window.addEventListener('message', onMsg);
-        // Fallback: if the ready ping was missed (fast load / focus race), push the
-        // request shortly after opening. The page ignores it until a bounded:sign
-        // arrives and only acts on the first one, so a duplicate is harmless.
         setTimeout(sendRequest, 1200);
-        // If the user closes the popup before completing, reject (unless a result
-        // just arrived — give any in-flight message a beat to settle first).
         closeTimer = setInterval(() => {
             if (popup.closed) {
                 clearInterval(closeTimer);
                 setTimeout(() => { if (!settled) {
                     cleanup();
-                    reject(new Error('Wallet approval window was closed before signing completed.'));
+                    reject(new Error('Wallet approval window was closed before it completed.'));
                 } }, 400);
             }
         }, 500);
-        // Overall safety timeout (OTP + signing). Generous — the user may take a
-        // while to fetch the code from their email.
         setTimeout(() => { if (!settled) {
             cleanup();
             try {
@@ -3631,80 +3961,135 @@ async function signViaSignerPopup(action) {
         } }, 5 * 60 * 1000);
     });
 }
-// Serialize a legacy or versioned Solana transaction to BASE58 for the signer
-// page. Crossmint's smart-wallet createTransaction endpoint requires the
-// `serializedTransaction` string to be base58 — it rejects base64 with
-// "Invalid base58 string" (verified against Crossmint staging 2026-07-07). The
-// `wallets-sdk` object path bs58-encodes internally, so base58 is the contract.
-//
-// We do NOT require existing signatures (the smart wallet signs on the page);
-// Crossmint extracts the instructions, overrides the fee payer to its sponsor,
-// and re-wraps them for the smart wallet.
-function serializeTransaction(transaction) {
-    const isLegacy = 'recentBlockhash' in transaction &&
-        !('message' in transaction && 'staticAccountKeys' in transaction.message);
-    const bytes = isLegacy
-        ? transaction.serialize({ requireAllSignatures: false, verifySignatures: false })
-        : transaction.serialize();
-    return bs58.encode(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes));
+// AS-02: the hosted signer refuses to sign unless the request carries an issuer-signed
+// SIGNING CAPABILITY bound to the app id, this origin, and the EXACT bytes (a bare postMessage
+// from any peer can no longer consent-phish a signature). Fetch one from the human-auth issuer
+// for exactly these bytes before posting the sign request. Credential-free: the caller proves
+// identity with the Bounded id token WE minted (a body secret, RS256-verified server-side), not
+// an ambient cookie - the issuer's session cookie is SameSite-scoped to its own origin and is
+// not sent on this cross-origin fetch, so the token is what carries the session's wallet.
+async function fetchSigningCapability(messageHex) {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    let idToken = null;
+    try {
+        idToken = core.getActiveSessionManager().getIdToken();
+    }
+    catch (_a) {
+        idToken = null;
+    }
+    if (!idToken) {
+        throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+    }
+    return requestTurnkeySigningCapability({
+        baseUrl: base,
+        idToken,
+        messageHex,
+        fetchImpl: (url, init) => fetch(url, init),
+    });
+}
+function hasTurnkeyWallet() {
+    return activeTurnkeyAddress() !== null;
 }
 /**
- * Whether the active session carries an embedded wallet (so the provider should
- * route signing through the popup rather than throw "no wallet").
+ * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
+ * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
+ * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
+ * browser blocks the popup.
+ *
+ * On the user's FIRST signature the popup transparently enrolls a device passkey
+ * (Face ID / Touch ID) and creates their wallet - no email code. Subsequent
+ * signatures are just a passkey approval.
  */
-function hasEmbeddedWallet() {
-    return walletClaimsFromSession() != null;
-}
-/** Whether the active email/social session carries an embedded Crossmint EVM wallet. */
-function hasEmbeddedEvmWallet() {
-    return walletClaimsFromSession('evm') != null;
-}
-/** signAndSubmitTransaction for embedded wallets: serialize + route through the
- *  signer popup, resolve with the on-chain transaction signature/hash. */
-async function embeddedSignAndSubmit(transaction) {
-    const serializedTransaction = serializeTransaction(transaction);
-    const result = await signViaSignerPopup({ kind: 'transaction', serializedTransaction });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no transaction hash.');
-    return hash;
-}
-/** Submit a validated BoundedRuntime EVM write through the user's email signer. */
-async function embeddedRunEvmTransaction(transaction) {
-    var _a, _b;
-    if (!transaction.to || !transaction.data || !transaction.chainId)
-        throw new Error('Incomplete embedded EVM transaction');
-    if (!/^0x[0-9a-fA-F]{40}$/.test(transaction.to))
-        throw new Error('Invalid embedded EVM runtime address');
-    core.assertCanonicalBoundedRuntimeWriteCalldata(transaction.data);
-    if (!Number.isSafeInteger(transaction.chainId) || transaction.chainId <= 0)
-        throw new Error('Invalid embedded EVM chain id');
-    if (transaction.nonce !== undefined)
-        throw new Error('Server-supplied EVM nonces are not accepted');
-    try {
-        if (BigInt((_a = transaction.value) !== null && _a !== void 0 ? _a : '0') !== BigInt(0))
-            throw new Error('Bounded EVM writes cannot transfer native value');
+async function signSolanaMessageViaTurnkey(message) {
+    if (!hasDOM$2()) {
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+    }
+    const { url, origin } = await turnkeySignerPage();
+    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
+    const messageHex = toHex(message);
+    // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
+    // refuse (capability_required) without it. Fetched per signature (each is single-payload).
+    const capability = await fetchSigningCapability(messageHex);
+    return await deliver(url, origin, {
+        request: buildTurnkeySignRequest({ requestId, messageHex, capability }),
+        onResult: (d) => {
+            if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
+            }
+            return { error: String(d.error || 'Turnkey signing failed') };
+        },
+    });
+}
+function requireMatchingAddress(result) {
+    const expected = activeTurnkeyAddress();
+    if (!expected)
+        throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+    if (result.address !== expected)
+        throw new Error('Turnkey signer returned a different wallet address than the active session.');
+    return expected;
+}
+async function signMessageWithTurnkey(message) {
+    const result = await signSolanaMessageViaTurnkey(getPlatform().textEncode(message));
+    requireMatchingAddress(result);
+    return bs58.encode(result.signature);
+}
+async function signTransactionWithTurnkey(transaction) {
+    const isLegacy = 'serializeMessage' in transaction;
+    const message = isLegacy
+        ? transaction.serializeMessage()
+        : transaction.message.serialize();
+    const result = await signSolanaMessageViaTurnkey(new Uint8Array(message));
+    const address = requireMatchingAddress(result);
+    const { PublicKey } = await import('@solana/web3.js');
+    if (isLegacy) {
+        transaction.addSignature(new PublicKey(address), bufferExports.Buffer.from(result.signature));
     }
-    catch (error) {
-        if (error instanceof Error && error.message.includes('cannot transfer'))
-            throw error;
-        throw new Error('Invalid embedded EVM transaction value');
+    else {
+        transaction.addSignature(new PublicKey(address), result.signature);
+    }
+    return transaction;
+}
+async function signAndSubmitTransactionWithTurnkey(transaction, feePayer) {
+    var _a;
+    const config = await core.getConfig();
+    const rpcUrl = (_a = config.rpcUrl) === null || _a === void 0 ? void 0 : _a.trim();
+    if (!rpcUrl)
+        throw new Error('Turnkey transaction submission requires init({ rpcUrl }).');
+    const { Connection, PublicKey } = await import('@solana/web3.js');
+    const connection = new Connection(rpcUrl, 'confirmed');
+    const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
+    const isLegacy = 'serializeMessage' in transaction;
+    if (isLegacy) {
+        const legacy = transaction;
+        legacy.recentBlockhash = blockhash;
+        legacy.lastValidBlockHeight = lastValidBlockHeight;
+        if (!legacy.feePayer) {
+            const address = activeTurnkeyAddress();
+            if (!address)
+                throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
+            legacy.feePayer = feePayer !== null && feePayer !== void 0 ? feePayer : new PublicKey(address);
+        }
+    }
+    else {
+        transaction.message.recentBlockhash = blockhash;
     }
-    const result = await signViaSignerPopup({
-        kind: 'evmTransaction',
-        transaction: { to: transaction.to, data: transaction.data, value: (_b = transaction.value) !== null && _b !== void 0 ? _b : '0', chainId: transaction.chainId },
+    const signed = await signTransactionWithTurnkey(transaction);
+    const signature = await connection.sendRawTransaction(signed.serialize(), {
+        skipPreflight: false,
+        maxRetries: 3,
     });
-    const hash = result.hash || result.transactionId;
-    if (!hash)
-        throw new Error('Signer returned no EVM transaction hash.');
-    return { transactionSignature: hash, blockNumber: 0, gasUsed: '0', data: result };
+    const confirmation = await connection.confirmTransaction({ signature, blockhash, lastValidBlockHeight }, 'confirmed');
+    if (confirmation.value.err) {
+        throw new Error(`Turnkey transaction failed: ${JSON.stringify(confirmation.value.err)}`);
+    }
+    return signature;
 }
 
 // Same message the email provider uses when a hosted (OIDC) login has no
 // embedded wallet — enable `auth.wallets` in policy to get one.
-const OIDC_NO_WALLET = 'This login has no embedded wallet. Enable `"auth": { "wallets": true }` in ' +
-    'the app policy so logins get a non-custodial Crossmint wallet (@user.address), ' +
-    'then sign from a user gesture.';
+const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +
+    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';
 const PKCE_STORE_KEY = 'bounded.oidc.pkce';
 const STORED_AUTH_METHOD_KEY$1 = 'bounded_last_auth_method';
 const ISSUER_SESSION_KIND_KEY$1 = 'bounded_issuer_session_kind';
@@ -3730,10 +4115,8 @@ function decodeJwt(token) {
     }
 }
 // A minimal AuthProvider so getSession()/logout() work for OIDC sessions, mirroring email.
-// Signing surface (slice 2): a hosted login on a wallets-enabled app carries an
-// embedded Crossmint wallet (@user.address). signAndSubmitTransaction routes
-// through the Bounded signer popup; signMessage/signTransaction are structurally
-// unsupported for Crossmint smart wallets (sign+submit atomically, no raw sig).
+// Turnkey supplies the default Solana wallet and supports raw message and transaction
+// signatures through the Bounded signer window.
 const oidcProviderSingleton = {
     async login() {
         const idToken = sessionManager().getIdToken();
@@ -3744,37 +4127,38 @@ const oidcProviderSingleton = {
         return idToken ? userFromIdToken(idToken) : null;
     },
     async logout() { await sessionManager().clearSession(); },
-    async signMessage(_message) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signMessage(message) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signMessageWithTurnkey(message);
     },
-    async signTransaction(_t) {
-        throw new Error(hasEmbeddedWallet() ? EMBEDDED_WALLET_UNSUPPORTED : OIDC_NO_WALLET);
+    async signTransaction(transaction) {
+        if (!hasTurnkeyWallet())
+            throw new Error(OIDC_NO_WALLET);
+        return signTransactionWithTurnkey(transaction);
     },
-    async runTransaction(evm, sol, options) {
+    async runTransaction(evm, sol, _options) {
         if (evm && sol)
             throw new Error('A transaction cannot target EVM and Solana at the same time.');
-        if (!evm)
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false)
-            throw new Error('Embedded EVM wallets sign and submit atomically; shouldSubmitTx:false is unsupported.');
-        if (!hasEmbeddedEvmWallet())
-            throw new Error('This login has no embedded EVM wallet. Enable auth.wallets on an app with an EVM collection and sign in again.');
-        return embeddedRunEvmTransaction(evm);
+        if (evm)
+            throw new Error('Turnkey embedded wallets currently support Solana only. Connect an EVM wallet for EVM transactions.');
+        throw new Error('This Solana transaction shape is not supported by the Turnkey provider. Use a pre-built transaction.');
     },
-    async signAndSubmitTransaction(transaction, _feePayer) {
-        if (!hasEmbeddedWallet())
+    async signAndSubmitTransaction(transaction, feePayer) {
+        if (!hasTurnkeyWallet())
             throw new Error(OIDC_NO_WALLET);
-        return embeddedSignAndSubmit(transaction);
+        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);
     },
 };
 function userFromIdToken(idToken) {
     const c = decodeJwt(idToken);
     const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';
     return {
-        id, address: (c['custom:walletAddress'] || null),
-        evmAddress: typeof c['custom:evmWalletAddress'] === 'string' && /^0x[0-9a-fA-F]{40}$/.test(c['custom:evmWalletAddress'])
-            ? c['custom:evmWalletAddress'].toLowerCase()
-            : null,
+        id,
+        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),
+        evmAddress: null,
         email: (c.email || null), provider: oidcProviderSingleton,
     };
 }
@@ -4497,7 +4881,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-BttT2sZK.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-DYtoSrdm.js'); })).EmailAuthProvider();
             break;
         case "wallet":
         case "phantom": {
@@ -4516,7 +4900,7 @@ async function getAuthProvider(config) {
             if (!isWalletLoginEnabled(config)) {
                 throw walletLoginNotEnabledError(authMethod);
             }
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-BMDJntMD.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-DvwlPJea.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -4529,7 +4913,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-7XawIUdJ.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-BAToKWZo.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -4557,7 +4941,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BcR-MQ0g.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CoI0r92a.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -4613,7 +4997,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-BcR-MQ0g.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-CoI0r92a.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     const commit = (user) => {
         // No await/interleaving inside this block: provider/method/config/marker
@@ -5851,18 +6235,6 @@ async function list() {
  */
 const apps = { create, list, buildCreateRedirectUrl };
 
-async function deserializeTransaction(tx) {
-    // Literal specifier so bundlers can code-split the lazy chunk.
-    const { Transaction, VersionedTransaction } = await import('@solana/web3.js');
-    const buf = Buffer.isBuffer(tx) ? tx : Buffer.from(tx, 'base64');
-    if ((buf[0] & 0x80) !== 0) {
-        return VersionedTransaction.deserialize(buf);
-    }
-    else {
-        return Transaction.from(buf);
-    }
-}
-
 // bounded.onramp() - fund the signed-in user's wallet with Coinbase Onramp.
 //
 // Web-only. Opens Coinbase's hosted checkout (pay.coinbase.com) in a popup
@@ -5904,16 +6276,16 @@ async function readError(res) {
     }
 }
 function sessionBody(options, extra) {
-    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.address ? { address: options.address } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
+    return JSON.stringify(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (options.asset ? { asset: options.asset } : {})), (options.amountUsd !== undefined ? { amountUsd: options.amountUsd } : {})), (options.minAmountOut !== undefined ? { minAmountOut: options.minAmountOut } : {})), (options.slippagePad !== undefined ? { slippagePad: options.slippagePad } : {})), extra));
 }
-function resolveAddress(options) {
-    var _a, _b;
+function resolveAddress() {
+    var _a;
     const user = getCurrentUser();
-    const address = (_b = (_a = options.address) !== null && _a !== void 0 ? _a : user === null || user === void 0 ? void 0 : user.address) !== null && _b !== void 0 ? _b : undefined;
+    const address = (_a = user === null || user === void 0 ? void 0 : user.address) !== null && _a !== void 0 ? _a : undefined;
     if (!address) {
         throw new Error(user
-            ? 'onramp: the signed-in account has no wallet address - pass { address } explicitly'
-            : 'onramp: no signed-in user - call login() first or pass { address }');
+            ? 'onramp: the signed-in account has no wallet address (create one via the embedded wallet flow)'
+            : 'onramp: no signed-in user - call login() first');
     }
     return address;
 }
@@ -5924,7 +6296,7 @@ function resolveAddress(options) {
 async function onrampQuote(options = {}) {
     if (!hasDOM())
         throw new Error('onrampQuote is web-only');
-    resolveAddress(options);
+    resolveAddress();
     const res = await authedFetch('/__bounded/onramp/session', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -5982,7 +6354,7 @@ async function onramp(options = {}) {
     var _a;
     if (!hasDOM())
         throw new Error('onramp() is web-only');
-    resolveAddress(options);
+    resolveAddress();
     // Open the window synchronously so the click's user-activation window is not
     // consumed by the fetch below (same hard-won pattern as loginWithPopup).
     let popup = null;
@@ -6205,84 +6577,12 @@ class PrivyExpoProvider {
         setCurrentUser(user);
         return user;
     }
-    async runTransaction(_evmTransactionData, solTransactionData, options) {
-        var _a;
-        await this.ensureReady();
-        const [{ Connection, PublicKey }, programSdk] = await Promise.all([
-            import('@solana/web3.js'),
-            import('@coral-xyz/anchor'),
-        ]);
-        if (!solTransactionData) {
-            throw new Error('Solana transaction data is required');
-        }
-        const wallet = await this.getWalletOrThrow();
-        const rpcUrl = this.getRpcUrl(solTransactionData.network);
-        const connection = new Connection(rpcUrl, 'confirmed');
-        const remainingAccounts = core.convertRemainingAccounts(solTransactionData.txArgs[0].remainingAccounts);
-        const app_id = solTransactionData.appId;
-        if (!app_id) {
-            throw new Error('App ID is required');
-        }
-        // Create a mock wallet adapter for Anchor (only publicKey needed for building TX)
-        const walletPublicKey = new PublicKey(wallet.address);
-        const walletAdapter = {
-            publicKey: walletPublicKey,
-            signTransaction: async (tx) => tx,
-            signAllTransactions: async (txs) => txs,
-        };
-        const ProviderClass = programSdk[['Anch', 'orProvider'].join('')];
-        const programProvider = new ProviderClass(connection, walletAdapter, ProviderClass.defaultOptions());
-        const finalDeduped = [];
-        for (const acc of remainingAccounts) {
-            const existing = finalDeduped.find((d) => d.pubkey.equals(acc.pubkey));
-            if (existing) {
-                existing.isSigner = existing.isSigner || acc.isSigner;
-                existing.isWritable = existing.isWritable || acc.isWritable;
-            }
-            else {
-                finalDeduped.push(acc);
-            }
-        }
-        const { tx, blockhash, lastValidBlockHeight } = await core.buildSetDocumentsTransaction(connection, solTransactionData.txArgs[0].idl, programProvider, walletPublicKey, {
-            app_id,
-            documents: solTransactionData.txArgs[0].setDocumentData,
-            delete_paths: solTransactionData.txArgs[0].deletePaths,
-            txData: solTransactionData.txArgs[0].txData,
-        }, finalDeduped, solTransactionData.lutKey, solTransactionData.preInstructions, false, solTransactionData.additionalLutAddresses);
-        // Set blockhash
-        const isLegacyTx = 'recentBlockhash' in tx &&
-            !('message' in tx && 'staticAccountKeys' in tx.message);
-        if (isLegacyTx) {
-            tx.recentBlockhash = blockhash;
-            tx.lastValidBlockHeight = lastValidBlockHeight;
-        }
-        else {
-            tx.message.recentBlockhash = blockhash;
-        }
-        try {
-            if ((options === null || options === void 0 ? void 0 : options.shouldSubmitTx) === false) {
-                // Sign only — don't submit
-                const signed = await wallet.signTransaction(tx);
-                return {
-                    signedTransaction: signed.signedTransaction,
-                    blockNumber: 0,
-                    gasUsed: '0',
-                    data: '',
-                };
-            }
-            // Sign and submit
-            const { signature, txInfo } = await this.signAndSubmitInternal(tx, wallet, connection);
-            return {
-                transactionSignature: signature,
-                blockNumber: (txInfo === null || txInfo === void 0 ? void 0 : txInfo.slot) || 0,
-                gasUsed: ((_a = txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta) === null || _a === void 0 ? void 0 : _a.fee.toString()) || '0',
-                data: txInfo === null || txInfo === void 0 ? void 0 : txInfo.meta,
-            };
-        }
-        catch (err) {
-            console.error(err);
-            throw err;
-        }
+    async runTransaction(_evmTransactionData, _solTransactionData, _options) {
+        // Client-side Solana transaction building is retired: the realtime
+        // worker returns a fully-built (and, when sponsored, partially-signed)
+        // transaction on its 202, which the SDK validates and signs via
+        // signTransaction. This provider serves no EVM payload either.
+        throw new Error('runTransaction is not supported by this provider; Bounded returns pre-built Solana transactions that are signed with signTransaction.');
     }
     async signMessage(message) {
         await this.ensureReady();
@@ -6443,7 +6743,6 @@ exports.BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA = BUILD_DELEGATED_REVIEW_CAPABI
 exports.BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA = BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA;
 exports.BUILD_REVIEW_CAPABILITY_SCHEMA = BUILD_REVIEW_CAPABILITY_SCHEMA;
 exports.BuildsApiError = BuildsApiError;
-exports.EMBEDDED_WALLET_UNSUPPORTED = EMBEDDED_WALLET_UNSUPPORTED;
 exports.FAILURE_REASONS = FAILURE_REASONS;
 exports.NON_TERMINAL_STATES = NON_TERMINAL_STATES;
 exports.OffchainAuthProvider = OffchainAuthProvider;
@@ -6458,16 +6757,12 @@ exports.builds = builds;
 exports.completeLoginFromRedirect = completeLoginFromRedirect;
 exports.completeLoginInPopup = completeLoginInPopup;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
-exports.deserializeTransaction = deserializeTransaction;
-exports.embeddedRunEvmTransaction = embeddedRunEvmTransaction;
-exports.embeddedSignAndSubmit = embeddedSignAndSubmit;
 exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
 exports.getPlatform = getPlatform;
-exports.hasEmbeddedEvmWallet = hasEmbeddedEvmWallet;
-exports.hasEmbeddedWallet = hasEmbeddedWallet;
+exports.hasTurnkeyWallet = hasTurnkeyWallet;
 exports.init = init;
 exports.login = login;
 exports.loginWithPopup = loginWithPopup;
@@ -6484,8 +6779,11 @@ exports.resolveSolanaRpcUrl = resolveSolanaRpcUrl;
 exports.setAuthLoading = setAuthLoading;
 exports.setCurrentUser = setCurrentUser;
 exports.setPlatform = setPlatform;
+exports.signAndSubmitTransactionWithTurnkey = signAndSubmitTransactionWithTurnkey;
 exports.signInAnonymously = signInAnonymously;
+exports.signMessageWithTurnkey = signMessageWithTurnkey;
+exports.signTransactionWithTurnkey = signTransactionWithTurnkey;
 exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
-//# sourceMappingURL=index.native-BSheiGj2.js.map
+//# sourceMappingURL=index.native-CAHw3k3_.js.map