@bounded-sh/client 0.0.95 → 0.0.97

package/dist/auth/turnkey-auth.d.ts

@@ -3,15 +3,17 @@ export interface TurnkeyEmailLoginHandle {
     /** The email the code was sent to (echo, for the widget's "code sent to ..." line). */
     email: string;
     /**
-     * Complete login with the 6-digit code the user received. Seals the code to Turnkey,
-     * verifies it server-side, and resolves with the signed-in User. Rejects with a
-     * user-safe Error on an invalid/expired code (the handle stays usable for a retry).
+     * Drive the login through the Bounded OTP frame mounted at `iframe`. The frame renders the code
+     * input, seals the code with a frame-generated key registered against the ceremony, verifies it
+     * server-side, and hands back the app session, which this establishes inline. Resolves with the
+     * signed-in User. Rejects with a user-safe Error if the frame cannot start or reports a failure.
      */
-    verify(code: string): Promise<User>;
+    run(iframe: HTMLIFrameElement): Promise<User>;
 }
 /**
- * Begin authMode:"turnkey" login: ask Turnkey to email a one-time code to `email`.
- * Resolves with a handle whose `verify(code)` finishes the login. Web-only (the sealing
- * step needs the signer iframe); on React Native use loginWithRedirect() instead.
+ * Begin authMode:"turnkey" login: ask Turnkey to email a one-time code to `email`, and open a
+ * server-bound login ceremony. Resolves with a handle whose `run(iframe)` finishes the login inside
+ * the Bounded OTP frame. Web-only (the sealing runs in the frame); on React Native use
+ * loginWithRedirect() instead.
  */
 export declare function startTurnkeyEmailLogin(email: string): Promise<TurnkeyEmailLoginHandle>;

package/dist/bounded-widget-modal-C0Z7gmxH.mjs

@@ -0,0 +1,31 @@
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because the wallet's 24h signing session lives in that
+//     origin's storage, out of every app's reach).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+/**
+ * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
+ * whether there was one. Logout needs this: a signing session can live in that document's
+ * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
+ * throwaway iframe opened by the sweep can only ever clear the shared store, never another
+ * document's memory. Removing the iframe discards its browsing context, which takes the
+ * mirror with it.
+ *
+ * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
+ * every logout of every app, most of which never mounted one.
+ */
+function detachWarmSignerIframe(origin) {
+    return false;
+}
+
+export { detachWarmSignerIframe };
+//# sourceMappingURL=bounded-widget-modal-C0Z7gmxH.mjs.map

package/dist/bounded-widget-modal-C0Z7gmxH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-widget-modal-C0Z7gmxH.mjs","sources":["../.rollup-tmp/auth/bounded-widget-modal.js"],"sourcesContent":["// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login\n// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded\n// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a\n// bottom-sheet on mobile, a height tween as content swaps, and a clean close.\n//\n// It hosts EITHER:\n//   - NATIVE content (the login card the SDK renders itself), or\n//   - an IFRAME (the Bounded-owned signer page, which must run on the single\n//     signer origin because the wallet's 24h signing session lives in that\n//     origin's storage, out of every app's reach).\n//\n// The modal is a warm singleton: it stays mounted (hidden) between uses so a\n// second open - or a signature right after login - is instant and, when it is\n// already open, a clean in-place view swap rather than a reopen.\nfunction hasDOM() {\n    return typeof window !== \"undefined\" && typeof document !== \"undefined\";\n}\nconst OVERLAY_CSS = `\n:host{all:initial}\n*{box-sizing:border-box}\n.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;\n  font-family:\"Schibsted Grotesk\",\"Helvetica Neue\",Arial,sans-serif}\n.bw-ov.mounted{display:block}\n.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;\n  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}\n.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}\n.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;\n  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);\n  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);\n  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;\n  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),\n    height .3s cubic-bezier(.2,.8,.2,1)}\n.bw-ov.show .bw-back{opacity:1}\n.bw-ov.show .bw-panel{opacity:1;transform:none}\n.bw-ov.closing .bw-back{opacity:0}\n.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}\n.bw-content{position:absolute;inset:0;overflow:hidden}\n.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}\n/* editorial corner crop-marks, matching the reference frame */\n.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;\n  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}\n.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}\n.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}\n.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}\n.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}\n@media(max-width:560px){\n  .bw-wrap{align-items:flex-end;padding:0}\n  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}\n  .bw-content{overflow-y:auto}\n  .bw-ov.show .bw-panel{transform:none}\n  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}\n}\n@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}\n`;\nlet modal = null;\nexport function getModal() {\n    if (modal)\n        return modal;\n    const root = document.createElement(\"div\");\n    root.setAttribute(\"data-bounded-widget\", \"\");\n    const shadow = root.attachShadow({ mode: \"open\" });\n    const style = document.createElement(\"style\");\n    style.textContent = OVERLAY_CSS;\n    shadow.appendChild(style);\n    const overlay = document.createElement(\"div\");\n    overlay.className = \"bw-ov\";\n    const back = document.createElement(\"div\");\n    back.className = \"bw-back\";\n    const wrap = document.createElement(\"div\");\n    wrap.className = \"bw-wrap\";\n    const panel = document.createElement(\"div\");\n    panel.className = \"bw-panel\";\n    const content = document.createElement(\"div\");\n    content.className = \"bw-content\";\n    panel.appendChild(content);\n    for (const corner of [\"tl\", \"tr\", \"bl\", \"br\"]) {\n        const mk = document.createElement(\"span\");\n        mk.className = \"bw-mk \" + corner;\n        panel.appendChild(mk);\n    }\n    wrap.appendChild(panel);\n    overlay.appendChild(back);\n    overlay.appendChild(wrap);\n    shadow.appendChild(overlay);\n    (document.body || document.documentElement).appendChild(root);\n    const m = {\n        root,\n        overlay,\n        panel,\n        content,\n        iframe: null,\n        iframeOrigin: \"\",\n        iframeReady: false,\n        onBackdrop: null,\n        onIframeMessage: null,\n        chain: Promise.resolve(),\n        fitObserver: null,\n        generation: 0,\n        onSupersede: null,\n    };\n    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer\n    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks\n    // outside the panel. Fire only when the click lands on the wrap itself, never\n    // when it bubbles up from the panel or its content.\n    wrap.addEventListener(\"click\", (event) => {\n        if (event.target === wrap && m.onBackdrop)\n            m.onBackdrop();\n    });\n    window.addEventListener(\"message\", (event) => {\n        if (!m.iframe)\n            return;\n        if (event.origin !== m.iframeOrigin)\n            return;\n        if (event.source !== m.iframe.contentWindow)\n            return;\n        const d = event.data;\n        if (!d || typeof d !== \"object\")\n            return;\n        if (m.onIframeMessage)\n            m.onIframeMessage(d);\n    });\n    modal = m;\n    return m;\n}\nexport function modalIsMounted() {\n    return !!modal && modal.overlay.classList.contains(\"mounted\");\n}\nexport function showModal(m) {\n    m.overlay.classList.remove(\"closing\");\n    m.overlay.classList.add(\"mounted\");\n    // Force a reflow so the .show transition runs from the hidden state every open.\n    void m.panel.offsetWidth;\n    m.overlay.classList.add(\"show\");\n}\nexport function hideModal(m, after) {\n    m.overlay.classList.remove(\"show\");\n    m.overlay.classList.add(\"closing\");\n    // Capture the generation at hide time. If a newer open re-shows the modal within\n    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the\n    // freshly reopened widget - only tear down when we are still the same open.\n    const gen = m.generation;\n    window.setTimeout(() => {\n        if (m.generation === gen)\n            m.overlay.classList.remove(\"mounted\", \"closing\");\n        if (after)\n            after();\n    }, 260);\n}\nexport function setPanelHeight(m, px) {\n    const h = Math.max(140, Math.min(680, Math.round(px)));\n    m.panel.style.height = h + \"px\";\n}\n// True outer height of the mounted card: the max of its padding-box scroll height\n// (catches overflowing descendants) and its border-box height plus own vertical\n// margins (catches border + margins, which scrollHeight omits). Ceiled so a\n// sub-pixel row is never clipped under `overflow:hidden`.\nfunction measureOuterHeight(target) {\n    var _a;\n    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);\n    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;\n    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);\n    const rect = target.getBoundingClientRect().height;\n    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));\n}\n/**\n * Measure the currently mounted native content and tween the panel to fit it.\n * Re-fits automatically when the card's intrinsic height changes - notably after\n * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px\n * after first paint) and on inline view swaps (email -> OTP code -> success).\n */\nexport function fitPanelToContent(m) {\n    var _a, _b;\n    const first = m.content.firstElementChild;\n    const target = first || m.content;\n    const apply = () => {\n        // Only fit while this exact node is still the mounted card.\n        if (m.content.firstElementChild !== first && first)\n            return;\n        const h = measureOuterHeight(target);\n        if (h > 0)\n            setPanelHeight(m, h);\n    };\n    apply();\n    const view = target.ownerDocument.defaultView;\n    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers\n    // have painted, so the height never lags a late reflow.\n    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);\n    const fonts = target.ownerDocument.fonts;\n    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)\n        fonts.ready.then(apply).catch(() => { });\n    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();\n    m.fitObserver = null;\n    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === \"function\") {\n        const ro = new view.ResizeObserver(() => apply());\n        ro.observe(first);\n        m.fitObserver = ro;\n    }\n}\n/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */\nexport function mountContent(m, node) {\n    var _a;\n    detachIframe(m);\n    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();\n    m.fitObserver = null;\n    m.content.replaceChildren(node);\n    m.content.style.display = \"block\";\n}\n/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */\nexport function ensureIframe(m, url, origin) {\n    var _a;\n    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)\n        return m.iframe;\n    detachIframe(m);\n    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();\n    m.fitObserver = null;\n    m.content.style.display = \"none\";\n    const iframe = document.createElement(\"iframe\");\n    iframe.className = \"bw-frame\";\n    iframe.setAttribute(\"title\", \"Bounded\");\n    iframe.setAttribute(\"allow\", \"clipboard-write\");\n    iframe.src = url;\n    m.iframeOrigin = origin;\n    m.iframeReady = false;\n    m.panel.appendChild(iframe);\n    m.iframe = iframe;\n    return iframe;\n}\n/**\n * Destroy the warm signer iframe if one is currently mounted for `origin`, and report\n * whether there was one. Logout needs this: a signing session can live in that document's\n * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a\n * throwaway iframe opened by the sweep can only ever clear the shared store, never another\n * document's memory. Removing the iframe discards its browsing context, which takes the\n * mirror with it.\n *\n * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on\n * every logout of every app, most of which never mounted one.\n */\nexport function detachWarmSignerIframe(origin) {\n    if (!modal || !modal.iframe || modal.iframeOrigin !== origin)\n        return false;\n    detachIframe(modal);\n    return true;\n}\nexport function detachIframe(m) {\n    if (m.iframe) {\n        try {\n            m.iframe.remove();\n        }\n        catch (_a) {\n            /* ignore */\n        }\n    }\n    m.iframe = null;\n    m.iframeReady = false;\n    m.iframeOrigin = \"\";\n    m.onIframeMessage = null;\n}\n// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +\n// JetBrains Mono) once at the document level so they apply inside the shadow root. A\n// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.\nconst FONTS_HREF = \"https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap\";\nexport function ensureFonts() {\n    if (!hasDOM())\n        return;\n    if (document.querySelector('link[data-bounded-fonts=\"1\"]'))\n        return;\n    const pre1 = document.createElement(\"link\");\n    pre1.rel = \"preconnect\";\n    pre1.href = \"https://fonts.googleapis.com\";\n    const pre2 = document.createElement(\"link\");\n    pre2.rel = \"preconnect\";\n    pre2.href = \"https://fonts.gstatic.com\";\n    pre2.crossOrigin = \"anonymous\";\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = FONTS_HREF;\n    link.setAttribute(\"data-bounded-fonts\", \"1\");\n    document.head.append(pre1, pre2, link);\n}\nexport { hasDOM };\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAsNA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,sBAAsB,CAAC,MAAM,EAAE;AAC/C,IACQ,OAAO,KAAK;AAGpB;;;;"}

package/dist/bounded-widget-modal-s0PL86Y-.js

@@ -0,0 +1,33 @@
+'use strict';
+
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because the wallet's 24h signing session lives in that
+//     origin's storage, out of every app's reach).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+/**
+ * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
+ * whether there was one. Logout needs this: a signing session can live in that document's
+ * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
+ * throwaway iframe opened by the sweep can only ever clear the shared store, never another
+ * document's memory. Removing the iframe discards its browsing context, which takes the
+ * mirror with it.
+ *
+ * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
+ * every logout of every app, most of which never mounted one.
+ */
+function detachWarmSignerIframe(origin) {
+    return false;
+}
+
+exports.detachWarmSignerIframe = detachWarmSignerIframe;
+//# sourceMappingURL=bounded-widget-modal-s0PL86Y-.js.map

package/dist/bounded-widget-modal-s0PL86Y-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-widget-modal-s0PL86Y-.js","sources":["../.rollup-tmp/auth/bounded-widget-modal.js"],"sourcesContent":["// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login\n// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded\n// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a\n// bottom-sheet on mobile, a height tween as content swaps, and a clean close.\n//\n// It hosts EITHER:\n//   - NATIVE content (the login card the SDK renders itself), or\n//   - an IFRAME (the Bounded-owned signer page, which must run on the single\n//     signer origin because the wallet's 24h signing session lives in that\n//     origin's storage, out of every app's reach).\n//\n// The modal is a warm singleton: it stays mounted (hidden) between uses so a\n// second open - or a signature right after login - is instant and, when it is\n// already open, a clean in-place view swap rather than a reopen.\nfunction hasDOM() {\n    return typeof window !== \"undefined\" && typeof document !== \"undefined\";\n}\nconst OVERLAY_CSS = `\n:host{all:initial}\n*{box-sizing:border-box}\n.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;\n  font-family:\"Schibsted Grotesk\",\"Helvetica Neue\",Arial,sans-serif}\n.bw-ov.mounted{display:block}\n.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;\n  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}\n.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}\n.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;\n  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);\n  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);\n  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;\n  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),\n    height .3s cubic-bezier(.2,.8,.2,1)}\n.bw-ov.show .bw-back{opacity:1}\n.bw-ov.show .bw-panel{opacity:1;transform:none}\n.bw-ov.closing .bw-back{opacity:0}\n.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}\n.bw-content{position:absolute;inset:0;overflow:hidden}\n.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}\n/* editorial corner crop-marks, matching the reference frame */\n.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;\n  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}\n.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}\n.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}\n.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}\n.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}\n@media(max-width:560px){\n  .bw-wrap{align-items:flex-end;padding:0}\n  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}\n  .bw-content{overflow-y:auto}\n  .bw-ov.show .bw-panel{transform:none}\n  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}\n}\n@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}\n`;\nlet modal = null;\nexport function getModal() {\n    if (modal)\n        return modal;\n    const root = document.createElement(\"div\");\n    root.setAttribute(\"data-bounded-widget\", \"\");\n    const shadow = root.attachShadow({ mode: \"open\" });\n    const style = document.createElement(\"style\");\n    style.textContent = OVERLAY_CSS;\n    shadow.appendChild(style);\n    const overlay = document.createElement(\"div\");\n    overlay.className = \"bw-ov\";\n    const back = document.createElement(\"div\");\n    back.className = \"bw-back\";\n    const wrap = document.createElement(\"div\");\n    wrap.className = \"bw-wrap\";\n    const panel = document.createElement(\"div\");\n    panel.className = \"bw-panel\";\n    const content = document.createElement(\"div\");\n    content.className = \"bw-content\";\n    panel.appendChild(content);\n    for (const corner of [\"tl\", \"tr\", \"bl\", \"br\"]) {\n        const mk = document.createElement(\"span\");\n        mk.className = \"bw-mk \" + corner;\n        panel.appendChild(mk);\n    }\n    wrap.appendChild(panel);\n    overlay.appendChild(back);\n    overlay.appendChild(wrap);\n    shadow.appendChild(overlay);\n    (document.body || document.documentElement).appendChild(root);\n    const m = {\n        root,\n        overlay,\n        panel,\n        content,\n        iframe: null,\n        iframeOrigin: \"\",\n        iframeReady: false,\n        onBackdrop: null,\n        onIframeMessage: null,\n        chain: Promise.resolve(),\n        fitObserver: null,\n        generation: 0,\n        onSupersede: null,\n    };\n    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer\n    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks\n    // outside the panel. Fire only when the click lands on the wrap itself, never\n    // when it bubbles up from the panel or its content.\n    wrap.addEventListener(\"click\", (event) => {\n        if (event.target === wrap && m.onBackdrop)\n            m.onBackdrop();\n    });\n    window.addEventListener(\"message\", (event) => {\n        if (!m.iframe)\n            return;\n        if (event.origin !== m.iframeOrigin)\n            return;\n        if (event.source !== m.iframe.contentWindow)\n            return;\n        const d = event.data;\n        if (!d || typeof d !== \"object\")\n            return;\n        if (m.onIframeMessage)\n            m.onIframeMessage(d);\n    });\n    modal = m;\n    return m;\n}\nexport function modalIsMounted() {\n    return !!modal && modal.overlay.classList.contains(\"mounted\");\n}\nexport function showModal(m) {\n    m.overlay.classList.remove(\"closing\");\n    m.overlay.classList.add(\"mounted\");\n    // Force a reflow so the .show transition runs from the hidden state every open.\n    void m.panel.offsetWidth;\n    m.overlay.classList.add(\"show\");\n}\nexport function hideModal(m, after) {\n    m.overlay.classList.remove(\"show\");\n    m.overlay.classList.add(\"closing\");\n    // Capture the generation at hide time. If a newer open re-shows the modal within\n    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the\n    // freshly reopened widget - only tear down when we are still the same open.\n    const gen = m.generation;\n    window.setTimeout(() => {\n        if (m.generation === gen)\n            m.overlay.classList.remove(\"mounted\", \"closing\");\n        if (after)\n            after();\n    }, 260);\n}\nexport function setPanelHeight(m, px) {\n    const h = Math.max(140, Math.min(680, Math.round(px)));\n    m.panel.style.height = h + \"px\";\n}\n// True outer height of the mounted card: the max of its padding-box scroll height\n// (catches overflowing descendants) and its border-box height plus own vertical\n// margins (catches border + margins, which scrollHeight omits). Ceiled so a\n// sub-pixel row is never clipped under `overflow:hidden`.\nfunction measureOuterHeight(target) {\n    var _a;\n    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);\n    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;\n    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);\n    const rect = target.getBoundingClientRect().height;\n    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));\n}\n/**\n * Measure the currently mounted native content and tween the panel to fit it.\n * Re-fits automatically when the card's intrinsic height changes - notably after\n * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px\n * after first paint) and on inline view swaps (email -> OTP code -> success).\n */\nexport function fitPanelToContent(m) {\n    var _a, _b;\n    const first = m.content.firstElementChild;\n    const target = first || m.content;\n    const apply = () => {\n        // Only fit while this exact node is still the mounted card.\n        if (m.content.firstElementChild !== first && first)\n            return;\n        const h = measureOuterHeight(target);\n        if (h > 0)\n            setPanelHeight(m, h);\n    };\n    apply();\n    const view = target.ownerDocument.defaultView;\n    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers\n    // have painted, so the height never lags a late reflow.\n    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);\n    const fonts = target.ownerDocument.fonts;\n    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)\n        fonts.ready.then(apply).catch(() => { });\n    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();\n    m.fitObserver = null;\n    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === \"function\") {\n        const ro = new view.ResizeObserver(() => apply());\n        ro.observe(first);\n        m.fitObserver = ro;\n    }\n}\n/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */\nexport function mountContent(m, node) {\n    var _a;\n    detachIframe(m);\n    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();\n    m.fitObserver = null;\n    m.content.replaceChildren(node);\n    m.content.style.display = \"block\";\n}\n/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */\nexport function ensureIframe(m, url, origin) {\n    var _a;\n    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)\n        return m.iframe;\n    detachIframe(m);\n    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();\n    m.fitObserver = null;\n    m.content.style.display = \"none\";\n    const iframe = document.createElement(\"iframe\");\n    iframe.className = \"bw-frame\";\n    iframe.setAttribute(\"title\", \"Bounded\");\n    iframe.setAttribute(\"allow\", \"clipboard-write\");\n    iframe.src = url;\n    m.iframeOrigin = origin;\n    m.iframeReady = false;\n    m.panel.appendChild(iframe);\n    m.iframe = iframe;\n    return iframe;\n}\n/**\n * Destroy the warm signer iframe if one is currently mounted for `origin`, and report\n * whether there was one. Logout needs this: a signing session can live in that document's\n * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a\n * throwaway iframe opened by the sweep can only ever clear the shared store, never another\n * document's memory. Removing the iframe discards its browsing context, which takes the\n * mirror with it.\n *\n * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on\n * every logout of every app, most of which never mounted one.\n */\nexport function detachWarmSignerIframe(origin) {\n    if (!modal || !modal.iframe || modal.iframeOrigin !== origin)\n        return false;\n    detachIframe(modal);\n    return true;\n}\nexport function detachIframe(m) {\n    if (m.iframe) {\n        try {\n            m.iframe.remove();\n        }\n        catch (_a) {\n            /* ignore */\n        }\n    }\n    m.iframe = null;\n    m.iframeReady = false;\n    m.iframeOrigin = \"\";\n    m.onIframeMessage = null;\n}\n// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +\n// JetBrains Mono) once at the document level so they apply inside the shadow root. A\n// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.\nconst FONTS_HREF = \"https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap\";\nexport function ensureFonts() {\n    if (!hasDOM())\n        return;\n    if (document.querySelector('link[data-bounded-fonts=\"1\"]'))\n        return;\n    const pre1 = document.createElement(\"link\");\n    pre1.rel = \"preconnect\";\n    pre1.href = \"https://fonts.googleapis.com\";\n    const pre2 = document.createElement(\"link\");\n    pre2.rel = \"preconnect\";\n    pre2.href = \"https://fonts.gstatic.com\";\n    pre2.crossOrigin = \"anonymous\";\n    const link = document.createElement(\"link\");\n    link.rel = \"stylesheet\";\n    link.href = FONTS_HREF;\n    link.setAttribute(\"data-bounded-fonts\", \"1\");\n    document.head.append(pre1, pre2, link);\n}\nexport { hasDOM };\n"],"names":[],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAsNA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,sBAAsB,CAAC,MAAM,EAAE;AAC/C,IACQ,OAAO,KAAK;AAGpB;;;;"}

package/dist/builds/client.d.ts

@@ -25,7 +25,38 @@ export type BuildSubmitOptions = {
     effort?: string;
     profile?: string;
     baseDeploymentId?: string;
+    source?: {
+        artifact: {
+            artifactId: string;
+        };
+    };
+    attachments?: Array<{
+        name: string;
+        contentType: string;
+        bytes: number;
+        ref: string;
+    }>;
+    contributedPatch?: {
+        baseRev: string;
+        diff: string;
+        proposalId: string;
+    };
 } & BuildIdempotencyOptions;
+export interface BuildInputArtifact {
+    artifactId: string;
+    kind: 'source' | 'attachment';
+    name: string;
+    contentType: string;
+    bytes: number;
+    sha256: string;
+}
+/** Source is a safe tar.gz tree; attachments remain model input, never executable files. */
+export declare function uploadInput(appId: string, options: {
+    kind: 'source' | 'attachment';
+    name: string;
+    contentType: string;
+    data: Blob | Uint8Array;
+}): Promise<BuildInputArtifact>;
 /**
  * Gate decision plus one idempotency strategy. A client-only `intentKey` can
  * replace a caller-minted `idempotencyKey` and survives refresh replays.

package/dist/builds/index.d.ts

@@ -1,4 +1,4 @@
-import { cancel, decideGate, events, get, getReviewCapability, list, refreshReviewCapability, submit, topup } from './client';
+import { cancel, decideGate, events, get, getReviewCapability, list, refreshReviewCapability, submit, topup, uploadInput } from './client';
 import { watch } from './watch';
 /**
  * Registered first-party product surfaces only, with
@@ -14,10 +14,11 @@ export declare const builds: {
     decideGate: typeof decideGate;
     refreshReviewCapability: typeof refreshReviewCapability;
     topup: typeof topup;
+    uploadInput: typeof uploadInput;
     list: typeof list;
     watch: typeof watch;
 };
 export { BuildsApiError } from './client';
-export type { BuildGateDecisionOptions, BuildDelegatedReviewCapabilityOptions, BuildReviewCapabilityRefreshOptions, BuildSubmitOptions, BuildTopupOptions, } from './client';
+export type { BuildGateDecisionOptions, BuildDelegatedReviewCapabilityOptions, BuildReviewCapabilityRefreshOptions, BuildSubmitOptions, BuildTopupOptions, BuildInputArtifact, } from './client';
 export type { BuildRunWatchHandle, BuildRunWatchOptions, BuildRunWatchUpdate, } from './watch';
 export * from './types';

package/dist/{email-auth-provider-mNpHuk1i.js → email-auth-provider-BhYzRN0r.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index_native = require('./index.native-vfNe1Pga.js');
+var index_native = require('./index.native-BZOWS_sR.js');
 require('react');
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -96,4 +96,4 @@ const emailProviderSingleton = new EmailAuthProvider();
 
 exports.EmailAuthProvider = EmailAuthProvider;
 exports.emailProviderSingleton = emailProviderSingleton;
-//# sourceMappingURL=email-auth-provider-mNpHuk1i.js.map
+//# sourceMappingURL=email-auth-provider-BhYzRN0r.js.map

package/dist/{email-auth-provider-mNpHuk1i.js.map → email-auth-provider-BhYzRN0r.js.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-mNpHuk1i.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,mCAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,uCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,yCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,6BAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,gDAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}
+{"version":3,"file":"email-auth-provider-BhYzRN0r.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,mCAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,uCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,yCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,6BAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,6BAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,gDAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}

package/dist/{email-auth-provider-H6Dw5Z9x.mjs → email-auth-provider-CiPAD3vz.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager } from '@bounded-sh/core';
-import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index.native-DHFDc9Vy.mjs';
+import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index.native-gVbAsohv.mjs';
 import 'react';
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -93,4 +93,4 @@ class EmailAuthProvider {
 const emailProviderSingleton = new EmailAuthProvider();
 
 export { EmailAuthProvider, emailProviderSingleton };
-//# sourceMappingURL=email-auth-provider-H6Dw5Z9x.mjs.map
+//# sourceMappingURL=email-auth-provider-CiPAD3vz.mjs.map

package/dist/{email-auth-provider-H6Dw5Z9x.mjs.map → email-auth-provider-CiPAD3vz.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-H6Dw5Z9x.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}
+{"version":3,"file":"email-auth-provider-CiPAD3vz.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}

package/dist/{email-auth-provider-D7wnHbb3.mjs → email-auth-provider-DbBN1MXS.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager } from '@bounded-sh/core';
-import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index-D3mp2wpM.mjs';
+import { s as setCurrentUser, h as hasTurnkeyWallet, a as signMessageWithTurnkey, b as signTransactionWithTurnkey, c as signTransactionV1WithTurnkey, d as signAndSubmitTransactionWithTurnkey, g as getPlatform } from './index-C01Q7k1A.mjs';
 import 'react';
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -93,4 +93,4 @@ class EmailAuthProvider {
 const emailProviderSingleton = new EmailAuthProvider();
 
 export { EmailAuthProvider, emailProviderSingleton };
-//# sourceMappingURL=email-auth-provider-D7wnHbb3.mjs.map
+//# sourceMappingURL=email-auth-provider-DbBN1MXS.mjs.map

package/dist/{email-auth-provider-D7wnHbb3.mjs.map → email-auth-provider-DbBN1MXS.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-D7wnHbb3.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}
+{"version":3,"file":"email-auth-provider-DbBN1MXS.mjs","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAG,uBAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,cAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,sBAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,0BAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,4BAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAO,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAAC,gBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;"}

package/dist/{email-auth-provider-DqXtds8G.js → email-auth-provider-SqE5H8jv.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index = require('./index-BiytVNMk.js');
+var index = require('./index-Bb7I-AoO.js');
 require('react');
 
 // Web uses localStorage (WebSessionManager); React Native uses the configured
@@ -96,4 +96,4 @@ const emailProviderSingleton = new EmailAuthProvider();
 
 exports.EmailAuthProvider = EmailAuthProvider;
 exports.emailProviderSingleton = emailProviderSingleton;
-//# sourceMappingURL=email-auth-provider-DqXtds8G.js.map
+//# sourceMappingURL=email-auth-provider-SqE5H8jv.js.map

package/dist/{email-auth-provider-DqXtds8G.js.map → email-auth-provider-SqE5H8jv.js.map}

@@ -1 +1 @@
-{"version":3,"file":"email-auth-provider-DqXtds8G.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,4BAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,gCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,kCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,sBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,yCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}
+{"version":3,"file":"email-auth-provider-SqE5H8jv.js","sources":["../.rollup-tmp/auth/providers/email-auth-provider.js"],"sourcesContent":["import { getActiveSessionManager } from '@bounded-sh/core';\nimport { setCurrentUser } from '../../global';\nimport { getPlatform } from '../../platform';\nimport { hasTurnkeyWallet, signAndSubmitTransactionWithTurnkey, signMessageWithTurnkey, signTransactionWithTurnkey, signTransactionV1WithTurnkey, } from '../turnkey-signer-bridge';\n// Web uses localStorage (WebSessionManager); React Native uses the configured\n// ReactNativeSessionManager. getActiveSessionManager() picks the right one by\n// whether the RN manager was configured (NOT `typeof window`, which is truthy on\n// RN too and would wrongly route to localStorage). Same selector the core\n// request path uses, so hosted Bounded Auth sessions persist + authenticate on BOTH.\nconst sessionManager = getActiveSessionManager;\nconst NO_WALLET = 'This session has no Turnkey wallet. Sign in again to provision the default ' +\n    'embedded wallet, or check whether the app explicitly sets auth.wallets:false.';\n// ---------------------------------------------------------------------------\n// token / session helpers\n// ---------------------------------------------------------------------------\nfunction decodeJwt(token) {\n    try {\n        let b64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');\n        const pad = b64.length % 4;\n        if (pad === 2)\n            b64 += '==';\n        else if (pad === 3)\n            b64 += '=';\n        // getPlatform().atob is RN-safe (global atob is undefined on Hermes/JSC).\n        return JSON.parse(getPlatform().atob(b64));\n    }\n    catch (_a) {\n        return {};\n    }\n}\nfunction userFromIdToken(idToken, fallbackEmail) {\n    const c = decodeJwt(idToken);\n    const id = c['custom:userId'] || c.sub || c['custom:walletAddress'] || '';\n    const email = (c.email || fallbackEmail || null);\n    return {\n        id,\n        address: (c['custom:walletProvider'] === 'turnkey' && c['custom:walletAddress'] || null),\n        evmAddress: null,\n        email,\n        provider: emailProviderSingleton,\n    };\n}\n// ---------------------------------------------------------------------------\n// provider\n// ---------------------------------------------------------------------------\nexport class EmailAuthProvider {\n    async login() {\n        throw new Error('login() no longer opens inline email OTP. Use loginWithRedirect({ redirectUri }) ' +\n            'or loginWithPopup({ redirectUri }) for hosted Bounded Auth.');\n    }\n    async restoreSession() {\n        const sm = sessionManager();\n        const session = await sm.getSession();\n        if (!session)\n            return null;\n        const idToken = sm.getIdToken();\n        if (!idToken)\n            return null;\n        const user = userFromIdToken(idToken);\n        setCurrentUser(user);\n        return user;\n    }\n    async logout() {\n        await sessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signMessageWithTurnkey(message);\n    }\n    async signTransaction(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionWithTurnkey(transaction);\n    }\n    async signTransactionV1(transaction) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signTransactionV1WithTurnkey(transaction);\n    }\n    /** The hosted Turnkey signer decodes SIMD-0385 v1 messages, so v1 is advertised alongside legacy and v0. */\n    supportedTransactionVersions() {\n        return hasTurnkeyWallet() ? ['legacy', 0, 1] : ['legacy', 0];\n    }\n    async signAndSubmitTransaction(transaction, feePayer) {\n        if (!hasTurnkeyWallet())\n            throw new Error(NO_WALLET);\n        return signAndSubmitTransactionWithTurnkey(transaction, feePayer);\n    }\n    async getNativeMethods() { return {}; }\n}\nconst emailProviderSingleton = new EmailAuthProvider();\nexport { emailProviderSingleton };\n"],"names":["getActiveSessionManager","getPlatform","setCurrentUser","hasTurnkeyWallet","signMessageWithTurnkey","signTransactionWithTurnkey","signTransactionV1WithTurnkey","signAndSubmitTransactionWithTurnkey"],"mappings":";;;;;;AAIA;AACA;AACA;AACA;AACA;AACA,MAAM,cAAc,GAAGA,4BAAuB;AAC9C,MAAM,SAAS,GAAG,6EAA6E;AAC/F,IAAI,+EAA+E;AACnF;AACA;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,IAAI,IAAI;AACR,QAAQ,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAC3E,QAAQ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AAClC,QAAQ,IAAI,GAAG,KAAK,CAAC;AACrB,YAAY,GAAG,IAAI,IAAI;AACvB,aAAa,IAAI,GAAG,KAAK,CAAC;AAC1B,YAAY,GAAG,IAAI,GAAG;AACtB;AACA,QAAQ,OAAO,IAAI,CAAC,KAAK,CAACC,iBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE;AACf,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;AACjD,IAAI,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;AAChC,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE;AAC7E,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,IAAI,CAAC;AACpD,IAAI,OAAO;AACX,QAAQ,EAAE;AACV,QAAQ,OAAO,GAAG,CAAC,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;AAChG,QAAQ,UAAU,EAAE,IAAI;AACxB,QAAQ,KAAK;AACb,QAAQ,QAAQ,EAAE,sBAAsB;AACxC,KAAK;AACL;AACA;AACA;AACA;AACO,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,MAAM,IAAI,KAAK,CAAC,mFAAmF;AAC3G,YAAY,6DAA6D,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,GAAG,cAAc,EAAE;AACnC,QAAQ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,EAAE;AAC7C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE;AACvC,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AAC7C,QAAQC,oBAAc,CAAC,IAAI,CAAC;AAC5B,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,cAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQA,oBAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,IAAI,CAACC,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOC,4BAAsB,CAAC,OAAO,CAAC;AAC9C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE;AACvC,QAAQ,IAAI,CAACD,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOE,gCAA0B,CAAC,WAAW,CAAC;AACtD,IAAI;AACJ,IAAI,MAAM,iBAAiB,CAAC,WAAW,EAAE;AACzC,QAAQ,IAAI,CAACF,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOG,kCAA4B,CAAC,WAAW,CAAC;AACxD,IAAI;AACJ;AACA,IAAI,4BAA4B,GAAG;AACnC,QAAQ,OAAOH,sBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpE,IAAI;AACJ,IAAI,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC1D,QAAQ,IAAI,CAACA,sBAAgB,EAAE;AAC/B,YAAY,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;AACtC,QAAQ,OAAOI,yCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC;AACzE,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C;AACK,MAAC,sBAAsB,GAAG,IAAI,iBAAiB;;;;;"}

package/dist/{guest-auth-provider-DwgEfPWe.js → guest-auth-provider-BiM35KHb.js}

@@ -1,7 +1,7 @@
 'use strict';
 
 var core = require('@bounded-sh/core');
-var index_native = require('./index.native-vfNe1Pga.js');
+var index_native = require('./index.native-BZOWS_sR.js');
 require('react');
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -334,4 +334,4 @@ class GuestAuthProvider {
 }
 
 exports.GuestAuthProvider = GuestAuthProvider;
-//# sourceMappingURL=guest-auth-provider-DwgEfPWe.js.map
+//# sourceMappingURL=guest-auth-provider-BiM35KHb.js.map

package/dist/{guest-auth-provider-DwgEfPWe.js.map → guest-auth-provider-BiM35KHb.js.map}

@@ -1 +1 @@
-{"version":3,"file":"guest-auth-provider-DwgEfPWe.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            await manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}
+{"version":3,"file":"guest-auth-provider-BiM35KHb.js","sources":["../.rollup-tmp/auth/providers/guest-keystore.js","../.rollup-tmp/auth/providers/guest-auth-provider.js"],"sourcesContent":["// guest-keystore.ts — durable per-device keypair for anonymous (\"guest\") auth.\n//\n// A guest is an ed25519 keypair generated on the device. Its public key is the\n// Bounded account address; it signs the auth challenge exactly like a wallet.\n//\n// Guest auth has one backend: WebCrypto Ed25519 + IndexedDB. The key is\n// NON-EXTRACTABLE: an XSS can ask it to sign but can never read the private\n// bytes. If WebCrypto or IndexedDB is unavailable, guest auth fails closed\n// instead of silently creating an extractable/stored-secret credential.\n//\n// The public output is a base58 address + a base64\n// detached signature, which is the format the session endpoint already accepts.\nimport bs58 from 'bs58';\nimport { getPlatform } from '../../platform';\nconst LEGACY_STORED_SECRET_KEY = 'bounded_guest_key_v1';\nconst IDB_NAME = 'bounded-guest';\nconst IDB_STORE = 'keys';\nconst IDB_KEY = 'ed25519';\nconst GUEST_KEY_REQUIREMENT = 'Guest auth requires non-extractable WebCrypto Ed25519 keys persisted in IndexedDB; ' +\n    'stored-secret guest credentials are disabled.';\nfunction toBase64(bytes) {\n    let bin = '';\n    for (let i = 0; i < bytes.length; i++)\n        bin += String.fromCharCode(bytes[i]);\n    // btoa exists in browsers + RN (Hermes) ; Buffer is the Node/SSR fallback.\n    return typeof btoa !== 'undefined' ? btoa(bin) : Buffer.from(bytes).toString('base64');\n}\n// ----- WebCrypto (non-extractable) backend -----------------------------------\nfunction subtle() {\n    const c = globalThis === null || globalThis === void 0 ? void 0 : globalThis.crypto;\n    return c && c.subtle ? c.subtle : null;\n}\nfunction idb() {\n    return new Promise((resolve, reject) => {\n        const req = globalThis.indexedDB.open(IDB_NAME, 1);\n        req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE);\n        req.onsuccess = () => resolve(req.result);\n        req.onerror = () => reject(req.error);\n    });\n}\nfunction idbGet(db, key) {\n    return new Promise((resolve, reject) => {\n        const r = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).get(key);\n        r.onsuccess = () => resolve(r.result);\n        r.onerror = () => reject(r.error);\n    });\n}\n// Atomic create-if-absent: the get and the conditional put happen inside ONE\n// readwrite transaction, so a concurrent creation cannot land between the read and\n// the write. Returns whatever ends up stored - the EXISTING key when another writer\n// won the race, otherwise the candidate. It NEVER overwrites an existing key, so a\n// racing tab's identity can no longer be stranded (DS4-0032).\n//\n// It settles on the TRANSACTION, not on the requests. A successful IndexedDB request\n// is not a durable write: the transaction can still abort at commit (quota exhausted\n// at flush, storage eviction), rolling the put back. Resolving from the request would\n// report a key as saved that is not on disk, and the caller would then mint a session\n// for an address this device cannot sign for - the same stranded identity from the\n// other direction.\nfunction idbGetOrPut(db, key, candidate) {\n    return new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        const store = tx.objectStore(IDB_STORE);\n        let stored;\n        const getReq = store.get(key);\n        getReq.onsuccess = () => {\n            const existing = getReq.result;\n            if (existing !== undefined && existing !== null) {\n                stored = existing;\n                return;\n            }\n            const putReq = store.put(candidate, key);\n            putReq.onsuccess = () => { stored = candidate; };\n        };\n        // A committed transaction that produced neither an existing key nor a stored\n        // candidate cannot happen, but resolving `undefined` would hand the caller a\n        // key-less identity, so refuse instead of guessing.\n        tx.oncomplete = () => stored === undefined || stored === null\n            ? reject(new Error('IndexedDB guest-key write committed without a key'))\n            : resolve(stored);\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key write failed')); };\n    });\n}\nfunction guestKeyUnavailable(cause) {\n    const detail = cause instanceof Error && cause.message ? ` Cause: ${cause.message}` : '';\n    return new Error(`${GUEST_KEY_REQUIREMENT}${detail}`);\n}\nasync function webCryptoKey(createIfMissing) {\n    const s = subtle();\n    if (!s)\n        throw guestKeyUnavailable(new Error('WebCrypto subtle crypto is unavailable.'));\n    if (typeof globalThis.indexedDB === 'undefined') {\n        throw guestKeyUnavailable(new Error('IndexedDB is unavailable.'));\n    }\n    try {\n        const db = await idb();\n        let pair = (await idbGet(db, IDB_KEY));\n        if (!pair) {\n            if (!createIfMissing)\n                return null;\n            // Probe Ed25519 support by generating (throws on unsupported engines).\n            const candidate = (await s.generateKey({ name: 'Ed25519' }, /* extractable */ false, [\n                'sign',\n                'verify',\n            ]));\n            // Persist atomically. If a concurrent creation already stored a key, keep\n            // THEIRS and discard our candidate - never overwrite (DS4-0032). CryptoKey is\n            // structured-cloneable; the private bytes are never exposed.\n            pair = (await idbGetOrPut(db, IDB_KEY, candidate));\n        }\n        const raw = new Uint8Array(await s.exportKey('raw', pair.publicKey)); // public is exportable\n        const address = bs58.encode(raw);\n        return {\n            address,\n            nonExtractable: true,\n            async sign(message) {\n                const data = new TextEncoder().encode(message);\n                const sig = new Uint8Array(await s.sign({ name: 'Ed25519' }, pair.privateKey, data));\n                return toBase64(sig);\n            },\n        };\n    }\n    catch (error) {\n        throw guestKeyUnavailable(error);\n    }\n}\nlet cached = null;\n// Single-flight for creation: concurrent callers in ONE realm (a retry, two awaits,\n// two components mounting at once) share a single creation rather than each racing\n// to generate + persist. Cross-tab races are handled durably by idbGetOrPut; this\n// closes the same-realm window where `cached` is not yet set (DS4-0032).\nlet creating = null;\n/** Get (or create) this device's durable guest key. */\nexport async function getGuestKey() {\n    if (cached)\n        return cached;\n    if (creating)\n        return creating;\n    creating = (async () => {\n        const key = await webCryptoKey(true);\n        if (!key)\n            throw guestKeyUnavailable(new Error('Guest key creation returned no key.'));\n        cached = key;\n        return key;\n    })();\n    try {\n        return await creating;\n    }\n    finally {\n        creating = null;\n    }\n}\n/** Read the existing durable guest key without ever minting a replacement. */\nexport async function getExistingGuestKey() {\n    if (cached)\n        return cached;\n    cached = await webCryptoKey(false);\n    return cached;\n}\n/** Forget the guest key on this device (a fresh signInAnonymously mints a new one). */\nexport async function clearGuestKey() {\n    cached = null;\n    // The legacy stored-secret cleanup stays best-effort: that key is not the durable\n    // guest credential (it is a removed backend) and its absence is the normal case.\n    try {\n        getPlatform().storage.removeItem(LEGACY_STORED_SECRET_KEY);\n    }\n    catch (_a) { }\n    // The IndexedDB delete is the DURABLE forget. A failure here must PROPAGATE\n    // (DS2-0284): swallowing it - or resolving on the delete request's onerror -\n    // reported a successful forget while the device key was still on disk, so a\n    // caller (forgetGuest) believed the guest identity was wiped when it was not.\n    if (typeof globalThis.indexedDB === 'undefined')\n        return;\n    const db = await idb();\n    // Settle on the transaction for the same reason as idbGetOrPut: a delete request\n    // that succeeded inside a transaction that later aborts leaves the key on disk,\n    // and reporting THAT as a successful forget is exactly the DS2-0284 failure.\n    await new Promise((resolve, reject) => {\n        const tx = db.transaction(IDB_STORE, 'readwrite');\n        tx.objectStore(IDB_STORE).delete(IDB_KEY);\n        tx.oncomplete = () => resolve();\n        tx.onabort = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete was rolled back')); };\n        tx.onerror = () => { var _a; return reject((_a = tx.error) !== null && _a !== void 0 ? _a : new Error('IndexedDB guest-key delete failed')); };\n    });\n}\n","import { getActiveSessionManager as SessionManager, browserSignInDomain, createSessionWithSignature, genAuthNonce, genSolanaMessage, genSolanaSignInMessage, } from '@bounded-sh/core';\nimport { getPlatform } from '../../platform';\nimport { setCurrentUser, setAuthLoading } from '../../global';\nimport { getGuestKey, getExistingGuestKey, clearGuestKey } from './guest-keystore';\nconst GUEST_TX_UNSUPPORTED = 'Guest (anonymous) auth is offchain-only — it cannot sign or submit Solana transactions. ' +\n    'Use a wallet provider for onchain actions.';\nexport class GuestAuthProvider {\n    async loginInternal(commitGlobalState, manageLoading) {\n        if (manageLoading)\n            setAuthLoading(true);\n        try {\n            const key = await getGuestKey();\n            // Reuse a still-valid session for this exact guest.\n            const existing = await SessionManager().getSession();\n            if (existing && existing.address === key.address) {\n                if (!this.tokenIsGuest(SessionManager().getIdToken(), key.address)) {\n                    throw new Error('The active session for this device key is not anonymous. Sign out explicitly before starting a guest session.');\n                }\n                const user = { address: key.address, isAnonymous: true, provider: this };\n                if (commitGlobalState)\n                    setCurrentUser(user);\n                return user;\n            }\n            // Mint a fresh session: nonce -> the login text -> local signature. A browser page\n            // sends its Origin, so it must sign the Sign In With Solana text naming the page host\n            // (SEC-01); the device key is the SDK's own, so the SDK stamps that host itself.\n            // Off-browser (React Native) no Origin is sent and the legacy template rides the\n            // origin-less lane.\n            const nonce = await genAuthNonce();\n            const domain = browserSignInDomain();\n            const message = domain\n                ? await genSolanaSignInMessage(key.address, nonce, domain)\n                : await genSolanaMessage(key.address, nonce);\n            const signature = await key.sign(message); // base64 detached ed25519\n            // Pass the discriminator explicitly. During a transactional switch the\n            // shared core config intentionally remains on the previous provider until\n            // this session is safely minted and persisted.\n            const result = await createSessionWithSignature(key.address, message, signature, 'guest');\n            if (!this.tokenIsGuest(result.idToken, key.address)) {\n                throw new Error('Guest session issuer returned a non-anonymous or identity-mismatched token.');\n            }\n            await SessionManager().storeSession(key.address, result.accessToken, result.idToken, result.refreshToken);\n            const user = { address: key.address, isAnonymous: true, provider: this };\n            if (commitGlobalState)\n                setCurrentUser(user);\n            return user;\n        }\n        finally {\n            if (manageLoading)\n                setAuthLoading(false);\n        }\n    }\n    async login() {\n        return this.loginInternal(true, true);\n    }\n    /** @internal Stage a guest session without exposing mixed provider/user state. */\n    async loginForProviderSwitch() {\n        return this.loginInternal(false, false);\n    }\n    tokenIsGuest(idToken, expectedAddress) {\n        var _a;\n        try {\n            if (!idToken)\n                return false;\n            let b64 = (_a = idToken.split('.')[1]) === null || _a === void 0 ? void 0 : _a.replace(/-/g, '+').replace(/_/g, '/');\n            if (!b64)\n                return false;\n            const pad = b64.length % 4;\n            if (pad === 2)\n                b64 += '==';\n            else if (pad === 3)\n                b64 += '=';\n            const claims = JSON.parse(getPlatform().atob(b64));\n            if ((claims === null || claims === void 0 ? void 0 : claims.is_anonymous) !== true)\n                return false;\n            if (expectedAddress && (claims === null || claims === void 0 ? void 0 : claims['custom:walletAddress']) !== expectedAddress)\n                return false;\n            return true;\n        }\n        catch (_b) {\n            return false;\n        }\n    }\n    async restoreSessionInternal(commitGlobalState) {\n        const manager = SessionManager();\n        const session = await manager.getSession();\n        if (!session)\n            return null;\n        // The marker/provider choice is not authority. A guest provider may only\n        // continue with an issuer-stamped guest bearer whose persisted device key\n        // still controls the exact same address. Anything else is an identity split\n        // and must lose bearer authority immediately.\n        if (!this.tokenIsGuest(manager.getIdToken(), session.address)) {\n            await manager.clearSession();\n            return null;\n        }\n        let key;\n        try {\n            key = await getExistingGuestKey();\n        }\n        catch (_a) {\n            await manager.clearSession();\n            return null;\n        }\n        if (!key || session.address !== key.address) {\n            await manager.clearSession();\n            return null;\n        }\n        const user = { address: key.address, isAnonymous: true, provider: this };\n        if (commitGlobalState)\n            setCurrentUser(user);\n        return user;\n    }\n    async restoreSession() {\n        return this.restoreSessionInternal(true);\n    }\n    /** @internal Reconcile an applied-yet-error guest mint before committing a switch. */\n    async restoreSessionForProviderSwitch() {\n        return this.restoreSessionInternal(false);\n    }\n    async logout() {\n        // Clears the SESSION but keeps the device key, so logging back in returns the\n        // SAME guest identity (and its data). Use forgetGuest() to wipe the key too.\n        await SessionManager().clearSession();\n        setCurrentUser(null);\n    }\n    /** Wipe the device key — the next login() is a brand-new guest identity. */\n    async forgetGuest() {\n        await SessionManager().clearSession();\n        await clearGuestKey();\n        setCurrentUser(null);\n    }\n    async signMessage(message) {\n        const key = await getGuestKey();\n        return key.sign(message);\n    }\n    async signTransaction(_t) {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async signAndSubmitTransaction() {\n        throw new Error(GUEST_TX_UNSUPPORTED);\n    }\n    async getNativeMethods() {\n        return {};\n    }\n}\n"],"names":["bs58","getPlatform","setAuthLoading","SessionManager","setCurrentUser","genAuthNonce","browserSignInDomain","genSolanaSignInMessage","genSolanaMessage","createSessionWithSignature"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAGA,MAAM,wBAAwB,GAAG,sBAAsB;AACvD,MAAM,QAAQ,GAAG,eAAe;AAChC,MAAM,SAAS,GAAG,MAAM;AACxB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,qBAAqB,GAAG,qFAAqF;AACnH,IAAI,+CAA+C;AACnD,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,IAAI,IAAI,GAAG,GAAG,EAAE;AAChB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;AACzC,QAAQ,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5C;AACA,IAAI,OAAO,OAAO,IAAI,KAAK,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;AAC1F;AACA;AACA,SAAS,MAAM,GAAG;AAClB,IAAI,MAAM,CAAC,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM;AACvF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI;AAC1C;AACA,SAAS,GAAG,GAAG;AACf,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,QAAQ,GAAG,CAAC,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;AAC3E,QAAQ,GAAG,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACjD,QAAQ,GAAG,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7C,IAAI,CAAC,CAAC;AACN;AACA,SAAS,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE;AACzB,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,QAAQ,CAAC,CAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7C,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,CAAC;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;AACzC,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC5C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;AAC/C,QAAQ,IAAI,MAAM;AAClB,QAAQ,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,QAAQ,MAAM,CAAC,SAAS,GAAG,MAAM;AACjC,YAAY,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC1C,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE;AAC7D,gBAAgB,MAAM,GAAG,QAAQ;AACjC,gBAAgB;AAChB,YAAY;AACZ,YAAY,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;AACpD,YAAY,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAC5D,QAAQ,CAAC;AACT;AACA;AACA;AACA,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK;AACjE,cAAc,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC;AACnF,cAAc,OAAO,CAAC,MAAM,CAAC;AAC7B,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrJ,IAAI,CAAC,CAAC;AACN;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE;AAC5F,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD;AACA,eAAe,YAAY,CAAC,eAAe,EAAE;AAC7C,IAAI,MAAM,CAAC,GAAG,MAAM,EAAE;AACtB,IAAI,IAAI,CAAC,CAAC;AACV,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvF,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW,EAAE;AACrD,QAAQ,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI;AACR,QAAQ,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC9B,QAAQ,IAAI,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,QAAQ,IAAI,CAAC,IAAI,EAAE;AACnB,YAAY,IAAI,CAAC,eAAe;AAChC,gBAAgB,OAAO,IAAI;AAC3B;AACA,YAAY,MAAM,SAAS,IAAI,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,KAAK,EAAE;AACjG,gBAAgB,MAAM;AACtB,gBAAgB,QAAQ;AACxB,aAAa,CAAC,CAAC;AACf;AACA;AACA;AACA,YAAY,IAAI,IAAI,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9D,QAAQ;AACR,QAAQ,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,QAAQ,MAAM,OAAO,GAAGA,iBAAI,CAAC,MAAM,CAAC,GAAG,CAAC;AACxC,QAAQ,OAAO;AACf,YAAY,OAAO;AACnB,YAAY,cAAc,EAAE,IAAI;AAChC,YAAY,MAAM,IAAI,CAAC,OAAO,EAAE;AAChC,gBAAgB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;AAC9D,gBAAgB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACpG,gBAAgB,OAAO,QAAQ,CAAC,GAAG,CAAC;AACpC,YAAY,CAAC;AACb,SAAS;AACT,IAAI;AACJ,IAAI,OAAO,KAAK,EAAE;AAClB,QAAQ,MAAM,mBAAmB,CAAC,KAAK,CAAC;AACxC,IAAI;AACJ;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,IAAI;AACnB;AACO,eAAe,WAAW,GAAG;AACpC,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,IAAI,QAAQ;AAChB,QAAQ,OAAO,QAAQ;AACvB,IAAI,QAAQ,GAAG,CAAC,YAAY;AAC5B,QAAQ,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AAC5C,QAAQ,IAAI,CAAC,GAAG;AAChB,YAAY,MAAM,mBAAmB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACvF,QAAQ,MAAM,GAAG,GAAG;AACpB,QAAQ,OAAO,GAAG;AAClB,IAAI,CAAC,GAAG;AACR,IAAI,IAAI;AACR,QAAQ,OAAO,MAAM,QAAQ;AAC7B,IAAI;AACJ,YAAY;AACZ,QAAQ,QAAQ,GAAG,IAAI;AACvB,IAAI;AACJ;AACA;AACO,eAAe,mBAAmB,GAAG;AAC5C,IAAI,IAAI,MAAM;AACd,QAAQ,OAAO,MAAM;AACrB,IAAI,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AACtC,IAAI,OAAO,MAAM;AACjB;AACA;AACO,eAAe,aAAa,GAAG;AACtC,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA,IAAI,IAAI;AACR,QAAQC,wBAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;AAClE,IAAI;AACJ,IAAI,OAAO,EAAE,EAAE,EAAE;AACjB;AACA;AACA;AACA;AACA,IAAI,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,WAAW;AACnD,QAAQ;AACR,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE;AAC1B;AACA;AACA;AACA,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK;AAC3C,QAAQ,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;AACzD,QAAQ,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjD,QAAQ,EAAE,CAAC,UAAU,GAAG,MAAM,OAAO,EAAE;AACvC,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/J,QAAQ,EAAE,CAAC,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,KAAK,MAAM,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtJ,IAAI,CAAC,CAAC;AACN;;ACtLA,MAAM,oBAAoB,GAAG,0FAA0F;AACvH,IAAI,4CAA4C;AACzC,MAAM,iBAAiB,CAAC;AAC/B,IAAI,MAAM,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE;AAC1D,QAAQ,IAAI,aAAa;AACzB,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,IAAI;AACZ,YAAY,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AAC3C;AACA,YAAY,MAAM,QAAQ,GAAG,MAAMC,4BAAc,EAAE,CAAC,UAAU,EAAE;AAChE,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AAC9D,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAACA,4BAAc,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACpF,oBAAoB,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC;AACpJ,gBAAgB;AAChB,gBAAgB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACxF,gBAAgB,IAAI,iBAAiB;AACrC,oBAAoBC,2BAAc,CAAC,IAAI,CAAC;AACxC,gBAAgB,OAAO,IAAI;AAC3B,YAAY;AACZ;AACA;AACA;AACA;AACA;AACA,YAAY,MAAM,KAAK,GAAG,MAAMC,iBAAY,EAAE;AAC9C,YAAY,MAAM,MAAM,GAAGC,wBAAmB,EAAE;AAChD,YAAY,MAAM,OAAO,GAAG;AAC5B,kBAAkB,MAAMC,2BAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;AACzE,kBAAkB,MAAMC,qBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC5D,YAAY,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD;AACA;AACA;AACA,YAAY,MAAM,MAAM,GAAG,MAAMC,+BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AACrG,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;AACjE,gBAAgB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC;AAC9G,YAAY;AACZ,YAAY,MAAMN,4BAAc,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACrH,YAAY,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpF,YAAY,IAAI,iBAAiB;AACjC,gBAAgBC,2BAAc,CAAC,IAAI,CAAC;AACpC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,gBAAgB;AAChB,YAAY,IAAI,aAAa;AAC7B,gBAAgBF,2BAAc,CAAC,KAAK,CAAC;AACrC,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG;AAClB,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7C,IAAI;AACJ;AACA,IAAI,MAAM,sBAAsB,GAAG;AACnC,QAAQ,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;AAC/C,IAAI;AACJ,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE;AAC3C,QAAQ,IAAI,EAAE;AACd,QAAQ,IAAI;AACZ,YAAY,IAAI,CAAC,OAAO;AACxB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAChI,YAAY,IAAI,CAAC,GAAG;AACpB,gBAAgB,OAAO,KAAK;AAC5B,YAAY,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;AACtC,YAAY,IAAI,GAAG,KAAK,CAAC;AACzB,gBAAgB,GAAG,IAAI,IAAI;AAC3B,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC9B,gBAAgB,GAAG,IAAI,GAAG;AAC1B,YAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAACD,wBAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,YAAY,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,YAAY,MAAM,IAAI;AAC9F,gBAAgB,OAAO,KAAK;AAC5B,YAAY,IAAI,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC,MAAM,eAAe;AACvI,gBAAgB,OAAO,KAAK;AAC5B,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,OAAO,KAAK;AACxB,QAAQ;AACR,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,iBAAiB,EAAE;AACpD,QAAQ,MAAM,OAAO,GAAGE,4BAAc,EAAE;AACxC,QAAQ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;AAClD,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,IAAI;AACvB;AACA;AACA;AACA;AACA,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;AACvE,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,GAAG;AACf,QAAQ,IAAI;AACZ,YAAY,GAAG,GAAG,MAAM,mBAAmB,EAAE;AAC7C,QAAQ;AACR,QAAQ,OAAO,EAAE,EAAE;AACnB,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE;AACrD,YAAY,MAAM,OAAO,CAAC,YAAY,EAAE;AACxC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAChF,QAAQ,IAAI,iBAAiB;AAC7B,YAAYC,2BAAc,CAAC,IAAI,CAAC;AAChC,QAAQ,OAAO,IAAI;AACnB,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ;AACA,IAAI,MAAM,+BAA+B,GAAG;AAC5C,QAAQ,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB;AACA;AACA,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ;AACA,IAAI,MAAM,WAAW,GAAG;AACxB,QAAQ,MAAMD,4BAAc,EAAE,CAAC,YAAY,EAAE;AAC7C,QAAQ,MAAM,aAAa,EAAE;AAC7B,QAAQC,2BAAc,CAAC,IAAI,CAAC;AAC5B,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE;AAC/B,QAAQ,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE;AACvC,QAAQ,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;AAChC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,EAAE,EAAE;AAC9B,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,wBAAwB,GAAG;AACrC,QAAQ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC;AAC7C,IAAI;AACJ,IAAI,MAAM,gBAAgB,GAAG;AAC7B,QAAQ,OAAO,EAAE;AACjB,IAAI;AACJ;;;;"}

package/dist/{guest-auth-provider-CenCVVnc.mjs → guest-auth-provider-Dtsq4QaY.mjs}

@@ -1,5 +1,5 @@
 import { getActiveSessionManager, genAuthNonce, browserSignInDomain, genSolanaSignInMessage, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
-import { g as getPlatform, e as bs58, k as setAuthLoading, s as setCurrentUser } from './index.native-DHFDc9Vy.mjs';
+import { g as getPlatform, e as bs58, k as setAuthLoading, s as setCurrentUser } from './index.native-gVbAsohv.mjs';
 import 'react';
 
 // guest-keystore.ts — durable per-device keypair for anonymous ("guest") auth.
@@ -332,4 +332,4 @@ class GuestAuthProvider {
 }
 
 export { GuestAuthProvider };
-//# sourceMappingURL=guest-auth-provider-CenCVVnc.mjs.map
+//# sourceMappingURL=guest-auth-provider-Dtsq4QaY.mjs.map