@bounded-sh/client 0.0.96 → 0.0.98

package/dist/{index-B5Luqobz.mjs → index-Cflemdaf.mjs}

@@ -4178,402 +4178,6 @@ async function ensureSolanaMobileWalletRegistered(config, network) {
 
 var bufferExports = requireBuffer();
 
-// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
-// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
-// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
-// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
-//
-// It hosts EITHER:
-//   - NATIVE content (the login card the SDK renders itself), or
-//   - an IFRAME (the Bounded-owned signer page, which must run on the single
-//     signer origin because the wallet's 24h signing session lives in that
-//     origin's storage, out of every app's reach).
-//
-// The modal is a warm singleton: it stays mounted (hidden) between uses so a
-// second open - or a signature right after login - is instant and, when it is
-// already open, a clean in-place view swap rather than a reopen.
-function hasDOM$5() {
-    return typeof window !== "undefined" && typeof document !== "undefined";
-}
-const OVERLAY_CSS = `
-:host{all:initial}
-*{box-sizing:border-box}
-.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
-.bw-ov.mounted{display:block}
-.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
-  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
-.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
-.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
-  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
-  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
-  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
-  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
-    height .3s cubic-bezier(.2,.8,.2,1)}
-.bw-ov.show .bw-back{opacity:1}
-.bw-ov.show .bw-panel{opacity:1;transform:none}
-.bw-ov.closing .bw-back{opacity:0}
-.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
-.bw-content{position:absolute;inset:0;overflow:hidden}
-.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
-/* editorial corner crop-marks, matching the reference frame */
-.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
-  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
-.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
-.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
-.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
-.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
-@media(max-width:560px){
-  .bw-wrap{align-items:flex-end;padding:0}
-  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
-  .bw-content{overflow-y:auto}
-  .bw-ov.show .bw-panel{transform:none}
-  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
-}
-@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
-`;
-let modal = null;
-function getModal() {
-    if (modal)
-        return modal;
-    const root = document.createElement("div");
-    root.setAttribute("data-bounded-widget", "");
-    const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
-    const overlay = document.createElement("div");
-    overlay.className = "bw-ov";
-    const back = document.createElement("div");
-    back.className = "bw-back";
-    const wrap = document.createElement("div");
-    wrap.className = "bw-wrap";
-    const panel = document.createElement("div");
-    panel.className = "bw-panel";
-    const content = document.createElement("div");
-    content.className = "bw-content";
-    panel.appendChild(content);
-    for (const corner of ["tl", "tr", "bl", "br"]) {
-        const mk = document.createElement("span");
-        mk.className = "bw-mk " + corner;
-        panel.appendChild(mk);
-    }
-    wrap.appendChild(panel);
-    overlay.appendChild(back);
-    overlay.appendChild(wrap);
-    shadow.appendChild(overlay);
-    (document.body || document.documentElement).appendChild(root);
-    const m = {
-        root,
-        overlay,
-        panel,
-        content,
-        iframe: null,
-        iframeOrigin: "",
-        iframeReady: false,
-        onBackdrop: null,
-        onIframeMessage: null,
-        chain: Promise.resolve(),
-        fitObserver: null,
-        generation: 0,
-        onSupersede: null,
-    };
-    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
-    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
-    // outside the panel. Fire only when the click lands on the wrap itself, never
-    // when it bubbles up from the panel or its content.
-    wrap.addEventListener("click", (event) => {
-        if (event.target === wrap && m.onBackdrop)
-            m.onBackdrop();
-    });
-    window.addEventListener("message", (event) => {
-        if (!m.iframe)
-            return;
-        if (event.origin !== m.iframeOrigin)
-            return;
-        if (event.source !== m.iframe.contentWindow)
-            return;
-        const d = event.data;
-        if (!d || typeof d !== "object")
-            return;
-        if (m.onIframeMessage)
-            m.onIframeMessage(d);
-    });
-    modal = m;
-    return m;
-}
-function showModal(m) {
-    m.overlay.classList.remove("closing");
-    m.overlay.classList.add("mounted");
-    // Force a reflow so the .show transition runs from the hidden state every open.
-    void m.panel.offsetWidth;
-    m.overlay.classList.add("show");
-}
-function hideModal(m, after) {
-    m.overlay.classList.remove("show");
-    m.overlay.classList.add("closing");
-    // Capture the generation at hide time. If a newer open re-shows the modal within
-    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the
-    // freshly reopened widget - only tear down when we are still the same open.
-    const gen = m.generation;
-    window.setTimeout(() => {
-        if (m.generation === gen)
-            m.overlay.classList.remove("mounted", "closing");
-    }, 260);
-}
-function setPanelHeight(m, px) {
-    const h = Math.max(140, Math.min(680, Math.round(px)));
-    m.panel.style.height = h + "px";
-}
-// True outer height of the mounted card: the max of its padding-box scroll height
-// (catches overflowing descendants) and its border-box height plus own vertical
-// margins (catches border + margins, which scrollHeight omits). Ceiled so a
-// sub-pixel row is never clipped under `overflow:hidden`.
-function measureOuterHeight(target) {
-    var _a;
-    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
-    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
-    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
-    const rect = target.getBoundingClientRect().height;
-    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
-}
-/**
- * Measure the currently mounted native content and tween the panel to fit it.
- * Re-fits automatically when the card's intrinsic height changes - notably after
- * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
- * after first paint) and on inline view swaps (email -> OTP code -> success).
- */
-function fitPanelToContent(m) {
-    var _a, _b;
-    const first = m.content.firstElementChild;
-    const target = first || m.content;
-    const apply = () => {
-        // Only fit while this exact node is still the mounted card.
-        if (m.content.firstElementChild !== first && first)
-            return;
-        const h = measureOuterHeight(target);
-        if (h > 0)
-            setPanelHeight(m, h);
-    };
-    apply();
-    const view = target.ownerDocument.defaultView;
-    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
-    // have painted, so the height never lags a late reflow.
-    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
-    const fonts = target.ownerDocument.fonts;
-    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
-        fonts.ready.then(apply).catch(() => { });
-    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
-    m.fitObserver = null;
-    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
-        const ro = new view.ResizeObserver(() => apply());
-        ro.observe(first);
-        m.fitObserver = ro;
-    }
-}
-/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
-function mountContent(m, node) {
-    var _a;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.replaceChildren(node);
-    m.content.style.display = "block";
-}
-/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
-function ensureIframe(m, url, origin) {
-    var _a;
-    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url)
-        return m.iframe;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.style.display = "none";
-    const iframe = document.createElement("iframe");
-    iframe.className = "bw-frame";
-    iframe.setAttribute("title", "Bounded");
-    iframe.setAttribute("allow", "clipboard-write");
-    iframe.src = url;
-    m.iframeOrigin = origin;
-    m.iframeReady = false;
-    m.panel.appendChild(iframe);
-    m.iframe = iframe;
-    return iframe;
-}
-/**
- * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
- * whether there was one. Logout needs this: a signing session can live in that document's
- * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
- * throwaway iframe opened by the sweep can only ever clear the shared store, never another
- * document's memory. Removing the iframe discards its browsing context, which takes the
- * mirror with it.
- *
- * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
- * every logout of every app, most of which never mounted one.
- */
-function detachWarmSignerIframe(origin) {
-    if (!modal || !modal.iframe || modal.iframeOrigin !== origin)
-        return false;
-    detachIframe(modal);
-    return true;
-}
-function detachIframe(m) {
-    if (m.iframe) {
-        try {
-            m.iframe.remove();
-        }
-        catch (_a) {
-            /* ignore */
-        }
-    }
-    m.iframe = null;
-    m.iframeReady = false;
-    m.iframeOrigin = "";
-    m.onIframeMessage = null;
-}
-// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
-// JetBrains Mono) once at the document level so they apply inside the shadow root. A
-// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
-const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
-function ensureFonts() {
-    if (!hasDOM$5())
-        return;
-    if (document.querySelector('link[data-bounded-fonts="1"]'))
-        return;
-    const pre1 = document.createElement("link");
-    pre1.rel = "preconnect";
-    pre1.href = "https://fonts.googleapis.com";
-    const pre2 = document.createElement("link");
-    pre2.rel = "preconnect";
-    pre2.href = "https://fonts.gstatic.com";
-    pre2.crossOrigin = "anonymous";
-    const link = document.createElement("link");
-    link.rel = "stylesheet";
-    link.href = FONTS_HREF;
-    link.setAttribute("data-bounded-fonts", "1");
-    document.head.append(pre1, pre2, link);
-}
-
-var boundedWidgetModal = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    detachIframe: detachIframe,
-    detachWarmSignerIframe: detachWarmSignerIframe,
-    ensureFonts: ensureFonts,
-    ensureIframe: ensureIframe,
-    fitPanelToContent: fitPanelToContent,
-    getModal: getModal,
-    hasDOM: hasDOM$5,
-    hideModal: hideModal,
-    mountContent: mountContent,
-    setPanelHeight: setPanelHeight,
-    showModal: showModal
-});
-
-// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
-// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
-// in a warm iframe behind the modal so signing feels native: an in-app approve
-// card (with inline code entry when the 24h signing session must first be
-// established), never a jarring popup.
-//
-// WHY AN IFRAME: the wallet's signing session lives in the single Bounded signer
-// origin's storage, out of every app's reach, so signing MUST run on that origin;
-// the iframe brings it in-app.
-//
-// Restricted embedders: if the frame never loads, the SAME request reruns through
-// `popupFallback` (a real window). Callers pass a popup implementation and never
-// see the difference.
-/**
- * Run one signer exchange through the in-app widget. Resolves when `onResult`
- * accepts a result; falls back to `popupFallback` if the frame cannot be mounted
- * or never loads.
- */
-async function runWidget(url, signerOrigin, ex, popupFallback) {
-    if (!hasDOM$5())
-        return popupFallback();
-    const m = getModal();
-    const requestId = String(ex.request.requestId);
-    // Serialize: the approve card is modal, and one warm frame handles one request at a time.
-    const run = m.chain.then(() => new Promise((resolve, reject) => {
-        let settled = false;
-        let usedFallback = false;
-        const iframe = ensureIframe(m, url, signerOrigin);
-        const send = () => {
-            if (!iframe.contentWindow)
-                return;
-            try {
-                iframe.contentWindow.postMessage(ex.request, signerOrigin);
-            }
-            catch (_a) {
-                /* frame gone */
-            }
-        };
-        let loadTimer = 0;
-        let ceilingTimer = 0;
-        const finish = (fn) => {
-            if (settled)
-                return;
-            settled = true;
-            m.onIframeMessage = null;
-            m.onBackdrop = null;
-            window.clearTimeout(loadTimer);
-            window.clearTimeout(ceilingTimer);
-            fn();
-        };
-        const goFallback = () => {
-            if (usedFallback || settled)
-                return;
-            usedFallback = true;
-            hideModal(m);
-            finish(() => popupFallback().then(resolve, reject));
-        };
-        m.onBackdrop = () => {
-            hideModal(m);
-            finish(() => reject(new Error("cancelled")));
-        };
-        m.onIframeMessage = (d) => {
-            if (d.type === "bounded:turnkey:ready") {
-                m.iframeReady = true;
-                send();
-                return;
-            }
-            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
-                setPanelHeight(m, d.height);
-                return;
-            }
-            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
-                const outcome = ex.onResult(d);
-                if ("error" in outcome) {
-                    hideModal(m);
-                    finish(() => reject(new Error(outcome.error)));
-                    return;
-                }
-                if (outcome.done) {
-                    hideModal(m);
-                    finish(() => resolve(outcome.value));
-                }
-            }
-        };
-        showModal(m);
-        if (m.iframeReady)
-            send();
-        // If the frame never loads, degrade to the popup (best-effort - a post-load
-        // popup may be blocked without a gesture, in which case the fallback rejects).
-        loadTimer = window.setTimeout(() => {
-            if (!m.iframeReady && !settled)
-                goFallback();
-        }, 8000);
-        // Absolute ceiling so a stuck flow cannot hang forever.
-        ceilingTimer = window.setTimeout(() => {
-            if (!settled) {
-                hideModal(m);
-                finish(() => reject(new Error("Wallet approval timed out.")));
-            }
-        }, 5 * 60 * 1000);
-    }));
-    m.chain = run.then(() => undefined, () => undefined);
-    return run;
-}
-
 // turnkey-signer-frame.ts - a HIDDEN, offscreen iframe of the Bounded signer page
 // for UI-less signer exchanges: sealing a login code (bounded:turnkey:encryptOtp),
 // establishing the 24h signing session right after login
@@ -4584,7 +4188,7 @@ async function runWidget(url, signerOrigin, ex, popupFallback) {
 // exchanges (seal a code, then establish the session with the keypair the SEAL
 // left in that exact page instance) talk to the same page. Origin + source +
 // requestId are all pinned; dispose() tears everything down.
-function hasDOM$4() {
+function hasDOM$5() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 async function signerPage() {
@@ -4594,7 +4198,7 @@ async function signerPage() {
 }
 /** Mount the hidden signer frame. Callers MUST dispose() when done. */
 async function openHiddenSignerFrame() {
-    if (!hasDOM$4())
+    if (!hasDOM$5())
         throw new Error('The Bounded signer frame is only available in the browser.');
     const { url, origin } = await signerPage();
     const frame = document.createElement('iframe');
@@ -4799,17 +4403,17 @@ function buildTurnkeyActionRequest(opts) {
 // storage, out of every app's reach, so ALL Bounded apps (any subdomain / custom
 // domain) sign through this one origin - giving every user one wallet that roams
 // across every app.
-function hasDOM$3() {
+function hasDOM$4() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
-// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
-// when we cannot embed (no DOM, or the frame never mounts/loads). Nothing in the
-// email-session flow needs a popup by preference: the code entry and the approval
-// click both run fine inside a cross-origin iframe on every engine (the old
-// Safari popup preference existed only for in-iframe WebAuthn CREATE).
+// BSA-2026-006: dispatch every signing / get-or-create exchange through a TOP-LEVEL
+// POPUP the caller opened from the user gesture - NEVER a framed widget. An authorized
+// tenant that embedded the signer could overlay its predictable Approve control and steal
+// one concealed click into a fund-moving signature; a top-level window it cannot reach or
+// visually redress closes that. A blocked popup surfaces `popup_blocked` (runPopup) and we
+// never silently fall back to an iframe.
 async function deliver(url, origin, ex) {
-    const popup = () => runPopup(url, origin, ex);
-    return runWidget(url, origin, { request: ex.request, onResult: ex.onResult }, popup);
+    return runPopup(url, origin, ex);
 }
 async function turnkeySignerPage() {
     const cfg = await getConfig();
@@ -4860,7 +4464,7 @@ function activeTurnkeyAddress() {
         ? address
         : null;
 }
-let requestSeq$1 = 0;
+let requestSeq = 0;
 // Shared popup driver: open the signer page, do the ready/postMessage handshake, and
 // resolve when `onResult` accepts a result message. Origin + source are pinned.
 async function runPopup(url, signerOrigin, ex) {
@@ -4870,7 +4474,7 @@ async function runPopup(url, signerOrigin, ex) {
     const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
     const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup) {
-        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the wallet approval window can open.');
+        throw new Error('popup_blocked - the wallet approval window was blocked. Call this from a user gesture (e.g. a click handler) so it can open; we never fall back to an in-page frame.');
     }
     return await new Promise((resolve, reject) => {
         let settled = false;
@@ -5014,7 +4618,7 @@ async function fetchActionAuthorization(action) {
  * it just costs its owner nothing and a stranger nothing.
  */
 async function clearTurnkeySigningSession() {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         return;
     // The session can live in TWO places, and the sweep has to reach both:
     //   1. the signer origin's store, shared by every signer frame in this app's partition -
@@ -5034,7 +4638,7 @@ async function clearTurnkeySigningSession() {
     let frame = null;
     try {
         frame = await openHiddenSignerFrame();
-        await frame.request({ type: 'bounded:turnkey:clearSigningSession', requestId: `tkclear_${Date.now()}_${++requestSeq$1}` }, 4000);
+        await frame.request({ type: 'bounded:turnkey:clearSigningSession', requestId: `tkclear_${Date.now()}_${++requestSeq}` }, 4000);
     }
     catch (_b) {
         /* best-effort: never block or fail logout on the sweep */
@@ -5055,10 +4659,10 @@ function hasTurnkeyWallet() {
  * Use this to learn the fee-payer address BEFORE building a transaction to sign.
  */
 async function getOrCreateTurnkeyWallet() {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
     const { url, origin } = await turnkeySignerPage();
-    const requestId = `tkcreate_${Date.now()}_${++requestSeq$1}`;
+    const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
     const authorization = await fetchActionAuthorization('createWallet');
     return await deliver(url, origin, {
         request: buildTurnkeyActionRequest({ requestId, action: 'createWallet', authorization }),
@@ -5080,7 +4684,7 @@ async function getOrCreateTurnkeyWallet() {
  * that tab - it never transits Bounded.
  */
 async function openTurnkeyKeyExport() {
-    if (!hasDOM$3())
+    if (!hasDOM$4())
         throw new Error('Turnkey key export is only available in the browser.');
     if (!hasTurnkeyWallet())
         throw new Error('This session has no Turnkey wallet to export.');
@@ -5128,11 +4732,11 @@ async function openTurnkeyKeyExport() {
  * completes the signature.
  */
 async function signSolanaMessageViaTurnkey(message) {
-    if (!hasDOM$3()) {
+    if (!hasDOM$4()) {
         throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
     }
     const { url, origin } = await turnkeySignerPage();
-    const requestId = `tksign_${Date.now()}_${++requestSeq$1}`;
+    const requestId = `tksign_${Date.now()}_${++requestSeq}`;
     const messageHex = toHex(message);
     // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
     // refuse (capability_required) without it. Fetched per signature (each is single-payload).
@@ -5286,7 +4890,7 @@ const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = getActiveSessionManager;
-function hasDOM$2() {
+function hasDOM$3() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -5437,7 +5041,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM$2() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$3() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -5545,7 +5149,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -5562,7 +5166,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -5610,7 +5214,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM$2())
+    if (!hasDOM$3())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -5770,7 +5374,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$2() || !window.opener)
+    if (!hasDOM$3() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -6224,7 +5828,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-Dhu15el8.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-DF7Urh8i.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6266,7 +5870,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-CJFZ9O7q.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dlo96aV9.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6279,7 +5883,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-Da6kghfZ.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-CMqUqqxN.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6304,7 +5908,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-U-zsTm0z.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-DVw-tITC.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6366,7 +5970,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-U-zsTm0z.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-DVw-tITC.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6537,7 +6141,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-CJFZ9O7q.mjs');
+            await import('./injected-wallet-provider-Dlo96aV9.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6640,7 +6244,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await import('./injected-wallet-provider-CJFZ9O7q.mjs');
+    const { InjectedWalletProvider } = await import('./injected-wallet-provider-Dlo96aV9.mjs');
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -7091,80 +6695,350 @@ function setAuthLoading(loading) {
 function getAuthLoading() {
     return isAuthLoading;
 }
-async function login(options) {
-    if (!authProviderInstance) {
-        throw new Error('SDK not initialized. Please call init() first.');
+async function login(options) {
+    if (!authProviderInstance) {
+        throw new Error('SDK not initialized. Please call init() first.');
+    }
+    const loggedInUser = await login$1(options);
+    setCurrentUser(loggedInUser);
+    return currentUser;
+}
+async function logout(options) {
+    if (!authProviderInstance) {
+        throw new Error('SDK not initialized. Please call init() first.');
+    }
+    await logout$1(options);
+    setCurrentUser(null);
+}
+var hasRunFirstTime = false;
+function userPrincipalKey(user) {
+    var _a, _b, _c;
+    if (!user)
+        return null;
+    return (_c = (_b = (_a = user.id) !== null && _a !== void 0 ? _a : user.address) !== null && _b !== void 0 ? _b : user.email) !== null && _c !== void 0 ? _c : null;
+}
+// Update the currentUser and notify listeners
+function setCurrentUser(user) {
+    // Enrich with the universal identity fields (id/email) derived from the
+    // active session's idToken — central chokepoint so every provider's user
+    // object gains { id, address, email } without each construction site
+    // having to set them.
+    user = withUserIdentity(user);
+    const lastUser = currentUser;
+    const wasInitializedBefore = hasRunFirstTime;
+    const lastPrincipal = userPrincipalKey(currentUser);
+    const nextPrincipal = userPrincipalKey(user);
+    const shouldRunListeners = !hasRunFirstTime || lastPrincipal !== nextPrincipal;
+    hasRunFirstTime = true;
+    currentUser = user;
+    if (shouldRunListeners) {
+        // Isolate each listener: a consumer callback that throws (during logout in
+        // particular) must not abort the notification loop OR skip the socket reopen
+        // below. Before this, a single throwing listener propagated out of
+        // setCurrentUser, so the realtime socket kept streaming as the signed-out
+        // user and the other listeners were never told the principal changed.
+        authStateListeners.forEach((callback) => {
+            try {
+                callback(user);
+            }
+            catch (error) {
+                console.error('Error in onAuthStateChanged listener:', error);
+            }
+        });
+        // Reconnect WebSocket connections with new auth when user changes.
+        // Skip on the first setCurrentUser call during init() — there are no
+        // existing connections to reconnect at that point.
+        if (wasInitializedBefore && userPrincipalKey(lastUser) !== nextPrincipal) {
+            reconnectWithNewAuth().catch((error) => {
+                console.error('Error reconnecting WebSocket after auth change:', error);
+            });
+        }
+    }
+    // Return this commit's normalized snapshot. A listener can start another
+    // login, so the mutable currentUser may already belong to a newer session.
+    return user;
+}
+function getCurrentUser() {
+    return currentUser;
+}
+/** @internal Snapshot/restore surface for transactional auth-provider switches. */
+function getAuthProviderInstance() {
+    return authProviderInstance;
+}
+function setAuthProviderInstance(provider) {
+    authProviderInstance = provider;
+}
+
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because the wallet's 24h signing session lives in that
+//     origin's storage, out of every app's reach).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$2() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
+}
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
+}
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
+    }
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
+        generation: 0,
+        onSupersede: null,
+    };
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
+    });
+    modal = m;
+    return m;
+}
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    // Capture the generation at hide time. If a newer open re-shows the modal within
+    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the
+    // freshly reopened widget - only tear down when we are still the same open.
+    const gen = m.generation;
+    window.setTimeout(() => {
+        if (m.generation === gen)
+            m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+// True outer height of the mounted card: the max of its padding-box scroll height
+// (catches overflowing descendants) and its border-box height plus own vertical
+// margins (catches border + margins, which scrollHeight omits). Ceiled so a
+// sub-pixel row is never clipped under `overflow:hidden`.
+function measureOuterHeight(target) {
+    var _a;
+    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
+    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
+    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
+    const rect = target.getBoundingClientRect().height;
+    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
+}
+/**
+ * Measure the currently mounted native content and tween the panel to fit it.
+ * Re-fits automatically when the card's intrinsic height changes - notably after
+ * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
+ * after first paint) and on inline view swaps (email -> OTP code -> success).
+ */
+function fitPanelToContent(m) {
+    var _a, _b;
+    const first = m.content.firstElementChild;
+    const target = first || m.content;
+    const apply = () => {
+        // Only fit while this exact node is still the mounted card.
+        if (m.content.firstElementChild !== first && first)
+            return;
+        const h = measureOuterHeight(target);
+        if (h > 0)
+            setPanelHeight(m, h);
+    };
+    apply();
+    const view = target.ownerDocument.defaultView;
+    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
+    // have painted, so the height never lags a late reflow.
+    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
+    const fonts = target.ownerDocument.fonts;
+    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
+        fonts.ready.then(apply).catch(() => { });
+    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
+    m.fitObserver = null;
+    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
+        const ro = new view.ResizeObserver(() => apply());
+        ro.observe(first);
+        m.fitObserver = ro;
     }
-    const loggedInUser = await login$1(options);
-    setCurrentUser(loggedInUser);
-    return currentUser;
 }
-async function logout(options) {
-    if (!authProviderInstance) {
-        throw new Error('SDK not initialized. Please call init() first.');
-    }
-    await logout$1(options);
-    setCurrentUser(null);
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
+function mountContent(m, node) {
+    var _a;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.replaceChildren(node);
+    m.content.style.display = "block";
 }
-var hasRunFirstTime = false;
-function userPrincipalKey(user) {
-    var _a, _b, _c;
-    if (!user)
-        return null;
-    return (_c = (_b = (_a = user.id) !== null && _a !== void 0 ? _a : user.address) !== null && _b !== void 0 ? _b : user.email) !== null && _c !== void 0 ? _c : null;
+/**
+ * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
+ * whether there was one. Logout needs this: a signing session can live in that document's
+ * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
+ * throwaway iframe opened by the sweep can only ever clear the shared store, never another
+ * document's memory. Removing the iframe discards its browsing context, which takes the
+ * mirror with it.
+ *
+ * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
+ * every logout of every app, most of which never mounted one.
+ */
+function detachWarmSignerIframe(origin) {
+    if (!modal || !modal.iframe || modal.iframeOrigin !== origin)
+        return false;
+    detachIframe(modal);
+    return true;
 }
-// Update the currentUser and notify listeners
-function setCurrentUser(user) {
-    // Enrich with the universal identity fields (id/email) derived from the
-    // active session's idToken — central chokepoint so every provider's user
-    // object gains { id, address, email } without each construction site
-    // having to set them.
-    user = withUserIdentity(user);
-    const lastUser = currentUser;
-    const wasInitializedBefore = hasRunFirstTime;
-    const lastPrincipal = userPrincipalKey(currentUser);
-    const nextPrincipal = userPrincipalKey(user);
-    const shouldRunListeners = !hasRunFirstTime || lastPrincipal !== nextPrincipal;
-    hasRunFirstTime = true;
-    currentUser = user;
-    if (shouldRunListeners) {
-        // Isolate each listener: a consumer callback that throws (during logout in
-        // particular) must not abort the notification loop OR skip the socket reopen
-        // below. Before this, a single throwing listener propagated out of
-        // setCurrentUser, so the realtime socket kept streaming as the signed-out
-        // user and the other listeners were never told the principal changed.
-        authStateListeners.forEach((callback) => {
-            try {
-                callback(user);
-            }
-            catch (error) {
-                console.error('Error in onAuthStateChanged listener:', error);
-            }
-        });
-        // Reconnect WebSocket connections with new auth when user changes.
-        // Skip on the first setCurrentUser call during init() — there are no
-        // existing connections to reconnect at that point.
-        if (wasInitializedBefore && userPrincipalKey(lastUser) !== nextPrincipal) {
-            reconnectWithNewAuth().catch((error) => {
-                console.error('Error reconnecting WebSocket after auth change:', error);
-            });
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
         }
     }
-    // Return this commit's normalized snapshot. A listener can start another
-    // login, so the mutable currentUser may already belong to a newer session.
-    return user;
-}
-function getCurrentUser() {
-    return currentUser;
-}
-/** @internal Snapshot/restore surface for transactional auth-provider switches. */
-function getAuthProviderInstance() {
-    return authProviderInstance;
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.onIframeMessage = null;
 }
-function setAuthProviderInstance(provider) {
-    authProviderInstance = provider;
+// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
+// JetBrains Mono) once at the document level so they apply inside the shadow root. A
+// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
+const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+function ensureFonts() {
+    if (!hasDOM$2())
+        return;
+    if (document.querySelector('link[data-bounded-fonts="1"]'))
+        return;
+    const pre1 = document.createElement("link");
+    pre1.rel = "preconnect";
+    pre1.href = "https://fonts.googleapis.com";
+    const pre2 = document.createElement("link");
+    pre2.rel = "preconnect";
+    pre2.href = "https://fonts.gstatic.com";
+    pre2.crossOrigin = "anonymous";
+    const link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = FONTS_HREF;
+    link.setAttribute("data-bounded-fonts", "1");
+    document.head.append(pre1, pre2, link);
 }
 
+var boundedWidgetModal = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    detachIframe: detachIframe,
+    detachWarmSignerIframe: detachWarmSignerIframe,
+    ensureFonts: ensureFonts,
+    fitPanelToContent: fitPanelToContent,
+    getModal: getModal,
+    hasDOM: hasDOM$2,
+    hideModal: hideModal,
+    mountContent: mountContent,
+    setPanelHeight: setPanelHeight,
+    showModal: showModal
+});
+
 // bounded-widget-ownership.ts - per-open ownership generation for the singleton
 // login/signing modal (bounded-widget-modal.ts).
 //
@@ -7605,72 +7479,11 @@ function shouldOfferSolanaMobileWallet(input) {
 function hasDOM$1() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
-let requestSeq = 0;
-// Seal the OTP in the given hidden signer iframe on the Bounded origin. The signer page
-// runs the vendored @turnkey/crypto encryptOtpCodeToBundle (which verifies the enclave's
-// signature on the target bundle first) and KEEPS the sealing keypair for the follow-up
-// establishSigningSession exchange below.
-async function sealOtpInFrame(frame, code, otpEncryptionTargetBundle) {
-    const d = await frame.request({
-        type: 'bounded:turnkey:encryptOtp',
-        requestId: `tkotp_${Date.now()}_${++requestSeq}`,
-        otpCode: code,
-        otpEncryptionTargetBundle,
-    }, 30000).catch(() => { throw new Error('Securing the code timed out. Please try again.'); });
-    if (d.ok && typeof d.encryptedOtpBundle === 'string' && d.encryptedOtpBundle) {
-        return d.encryptedOtpBundle;
-    }
-    throw new Error(String(d.error || 'Could not secure the code. Please try again.'));
-}
-// Best-effort login-time signing-session establishment. Runs AFTER the login session is
-// live (the action authorization is minted from the freshly-established id token) against
-// the SAME frame that sealed the code - only that page instance holds the keypair the
-// verificationToken is bound to. Owns the frame: disposes it whatever happens. Never
-// throws; a failure only means the first signature costs one inline code.
-async function establishSigningSessionInBackground(frame, baseUrl, signingSession) {
-    // The moment this work begins - captured before ANY await, because verify() has already
-    // resolved and the user can hit logout throughout the authorization mint below. The
-    // signer drops a session whose work began at-or-before the newest logout, so a stamp
-    // taken later (in the frame, after the mint) would let this establishment out-run a
-    // logout and resurrect the session.
-    const startedAtMs = Date.now();
-    try {
-        let idToken = null;
-        try {
-            idToken = getActiveSessionManager().getIdToken();
-        }
-        catch (_a) {
-            idToken = null;
-        }
-        if (!idToken)
-            return;
-        const authorization = await requestTurnkeyActionAuthorization({
-            baseUrl,
-            idToken,
-            action: 'createWallet',
-            fetchImpl: (url, init) => fetch(url, init),
-        });
-        const d = await frame.request({
-            type: 'bounded:turnkey:establishSigningSession',
-            requestId: `tkestablish_${Date.now()}_${++requestSeq}`,
-            verificationToken: signingSession.verificationToken,
-            authorization,
-            startedAtMs,
-        }, 20000);
-        if (!d.ok)
-            throw new Error(String(d.error || 'establish_failed'));
-    }
-    catch (_b) {
-        /* best-effort: the signer's inline code flow covers the first signature */
-    }
-    finally {
-        frame.dispose();
-    }
-}
 /**
- * Begin authMode:"turnkey" login: ask Turnkey to email a one-time code to `email`.
- * Resolves with a handle whose `verify(code)` finishes the login. Web-only (the sealing
- * step needs the signer iframe); on React Native use loginWithRedirect() instead.
+ * Begin authMode:"turnkey" login: ask Turnkey to email a one-time code to `email`, and open a
+ * server-bound login ceremony. Resolves with a handle whose `run(iframe)` finishes the login inside
+ * the Bounded OTP frame. Web-only (the sealing runs in the frame); on React Native use
+ * loginWithRedirect() instead.
  */
 async function startTurnkeyEmailLogin(email) {
     if (!hasDOM$1()) {
@@ -7693,51 +7506,120 @@ async function startTurnkeyEmailLogin(email) {
     }
     const otpId = data.otpId;
     const otpEncryptionTargetBundle = data.otpEncryptionTargetBundle;
+    // A tenant-origin login always gets a ceremony id; without one the OTP frame refuses to run
+    // (there is nothing to bind the frame key to), which is the correct fail-closed posture.
+    const ceremonyId = typeof data.ceremonyId === 'string' ? data.ceremonyId : '';
+    const signerOrigin = new URL(base).origin;
     return {
         email: trimmed,
-        async verify(code) {
-            const trimmedCode = (code || '').trim();
-            if (!trimmedCode)
-                throw new Error('Enter the code from your email.');
-            // One frame per attempt: the sealing keypair lives in this exact page instance,
-            // and a failed attempt's frame (and keypair) is discarded with it.
-            const frame = await openHiddenSignerFrame();
-            let vdata = null;
-            try {
-                const encryptedOtpBundle = await sealOtpInFrame(frame, trimmedCode, otpEncryptionTargetBundle);
-                const vres = await fetch(`${base}/wallet/turnkey/auth/verify`, {
-                    method: 'POST',
-                    headers: { 'content-type': 'application/json' },
-                    body: JSON.stringify({ email: trimmed, appId, otpId, encryptedOtpBundle }),
-                });
-                vdata = await vres.json().catch(() => null);
-                if (!vres.ok || !vdata) {
-                    throw new Error(String((vdata && vdata.error) || 'Invalid or expired code.'));
+        run(iframe) {
+            if (!ceremonyId) {
+                return Promise.reject(new Error('This app is not configured for in-frame wallet login. Please try again.'));
+            }
+            return runOtpFrame({ iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId });
+        },
+    };
+}
+// Point the iframe at the Bounded OTP frame and run the postMessage handshake:
+//   frame 'ready' -> we post {otpId, targetBundle}; frame registers its key + shows the input;
+//   frame 'result' {session} -> we establish the inline session and resolve the User.
+// When the frame asks for the signing-session authorization ('need-authorization') we mint a
+// createWallet action authorization on THIS (registered) origin and post it in - never a key.
+function runOtpFrame(run) {
+    const tenantOrigin = window.location.origin;
+    const url = `${run.base.replace(/\/$/, '')}/wallet/turnkey/otp-frame`
+        + `?appId=${encodeURIComponent(run.appId)}`
+        + `&origin=${encodeURIComponent(tenantOrigin)}`
+        + `&email=${encodeURIComponent(run.email)}`
+        + `&ceremonyId=${encodeURIComponent(run.ceremonyId)}`;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let started = false;
+        const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); window.clearTimeout(timer); };
+        const onMsg = async (event) => {
+            if (settled)
+                return;
+            // Trust ONLY the signer origin and the frame's own window.
+            if (event.origin !== run.signerOrigin || event.source !== run.iframe.contentWindow)
+                return;
+            const d = event.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:otp:resize') {
+                if (typeof d.height === 'number' && Number.isFinite(d.height) && d.height > 0) {
+                    run.iframe.style.height = `${Math.max(140, Math.min(680, Math.ceil(d.height)))}px`;
                 }
+                return;
             }
-            catch (error) {
-                frame.dispose();
-                throw error;
+            if (d.type === 'bounded:otp:ready') {
+                if (started)
+                    return;
+                started = true;
+                post({ type: 'bounded:otp:start', otpId: run.otpId, otpEncryptionTargetBundle: run.otpEncryptionTargetBundle });
+                return;
             }
-            const user = await establishInlineSession(vdata).catch((error) => {
-                frame.dispose();
-                throw error;
-            });
-            // SINGLE CODE AT LOGIN: turn the same code's verificationToken into the 24h
-            // signing session, in the background - login is already resolved and must never
-            // wait on (or fail with) this. The task owns the frame's disposal.
-            const signingSession = vdata.signingSession;
-            if (signingSession && typeof signingSession.verificationToken === 'string' && signingSession.verificationToken) {
-                void establishSigningSessionInBackground(frame, base, {
-                    verificationToken: signingSession.verificationToken,
-                });
+            if (d.type === 'bounded:otp:need-authorization') {
+                // Best-effort: mint the createWallet authorization on our own registered origin and hand it
+                // to the frame so it can complete the 24h signing session with the key it holds. Never throws.
+                try {
+                    let idToken = null;
+                    try {
+                        idToken = getActiveSessionManager().getIdToken();
+                    }
+                    catch (_a) {
+                        idToken = null;
+                    }
+                    if (!idToken) {
+                        post({ type: 'bounded:otp:authorization', authorization: '' });
+                        return;
+                    }
+                    const authorization = await requestTurnkeyActionAuthorization({
+                        baseUrl: run.base, idToken, action: 'createWallet', fetchImpl: (u, i) => fetch(u, i),
+                    });
+                    post({ type: 'bounded:otp:authorization', authorization });
+                }
+                catch (_b) {
+                    post({ type: 'bounded:otp:authorization', authorization: '' });
+                }
+                return;
             }
-            else {
-                frame.dispose();
+            if (d.type === 'bounded:otp:result') {
+                if (d.ok && d.session && typeof d.session === 'object') {
+                    try {
+                        const user = await establishInlineSession(d.session);
+                        cleanup();
+                        resolve(user);
+                    }
+                    catch (error) {
+                        cleanup();
+                        reject(error instanceof Error ? error : new Error(String(error)));
+                    }
+                    return;
+                }
+                cleanup();
+                reject(new Error(String((d && d.error) || 'Invalid or expired code.')));
+                return;
             }
-            return user;
-        },
-    };
+            // 'bounded:otp:registered' is advisory; login does not depend on it.
+        };
+        const post = (msg) => {
+            var _a;
+            try {
+                (_a = run.iframe.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(msg, run.signerOrigin);
+            }
+            catch ( /* frame gone */_b) { /* frame gone */ }
+        };
+        window.addEventListener('message', onMsg);
+        // 3 minutes: the human must read the email and type the code. A frame that never reports is a
+        // failed login the user can retry.
+        const timer = window.setTimeout(() => {
+            if (settled)
+                return;
+            cleanup();
+            reject(new Error('The sign-in code entry timed out. Please try again.'));
+        }, 3 * 60 * 1000);
+        run.iframe.src = url;
+    });
 }
 
 // bounded-login-widget.ts - the UNIFIED Bounded login surface: one in-app card
@@ -7962,7 +7844,7 @@ function untilCancelled(work, pending) {
  * run first; call from a user gesture so social/wallet popups are allowed.
  */
 async function openBoundedWidget(opts = {}) {
-    if (!hasDOM$5()) {
+    if (!hasDOM$2()) {
         throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
     }
     // Registered before the first await - see PendingOpen.
@@ -8207,6 +8089,7 @@ async function prepareAndOpen(opts, pending) {
         m.onBackdrop = cancel;
         const style = el("style");
         style.textContent = CARD_CSS;
+        let emailDraft = "";
         const renderChoose = () => {
             const card = el("div", "c");
             card.appendChild(style.cloneNode(true));
@@ -8241,6 +8124,8 @@ async function prepareAndOpen(opts, pending) {
                 input.autocomplete = "email";
                 input.placeholder = "you@example.com";
                 input.required = true;
+                input.value = emailDraft;
+                input.addEventListener("input", () => { emailDraft = input.value; });
                 const submit = el("button", "btn primary");
                 submit.type = "submit";
                 submit.textContent = "Continue";
@@ -8249,6 +8134,7 @@ async function prepareAndOpen(opts, pending) {
                     e.preventDefault();
                     if (!input.value)
                         return;
+                    emailDraft = input.value;
                     // Starting another lane takes the card from a wallet attempt still
                     // preparing, and this lane holds the lock until its own request
                     // settles - otherwise a failed email login would keep every other lane
@@ -8265,7 +8151,7 @@ async function prepareAndOpen(opts, pending) {
                         setBusy(submit, "Sending code\u2026");
                         startTurnkeyEmailLogin(input.value)
                             .then((handle) => { if (settleAttempt(attempt))
-                            swap(renderOtp(handle)); })
+                            swap(renderOtpFrame(handle)); })
                             .catch((err) => {
                             if (!settleAttempt(attempt))
                                 return;
@@ -8278,6 +8164,7 @@ async function prepareAndOpen(opts, pending) {
                     setBusy(submit, "Opening secure sign-in\u2026");
                     const emailOpts = {
                         provider: "email",
+                        prompt: "login",
                         loginHint: input.value,
                         redirectUri: opts.redirectUri,
                     };
@@ -8549,75 +8436,25 @@ async function prepareAndOpen(opts, pending) {
             card.appendChild(status);
             return card;
         };
-        // authMode:"turnkey" inline code entry. Same editorial card; the code is sealed
-        // on the Bounded signer origin and verified server-side by Turnkey.
-        const renderOtp = (handle) => {
+        // BSA-2026-004: authMode:"turnkey" code entry runs ENTIRELY inside a Bounded-origin OTP frame,
+        // never in this tenant DOM. The widget only embeds that frame and reacts to its result - it
+        // never sees the plaintext code or the sealing key. The editorial card wraps the frame so the
+        // experience still feels native; the code input, sealing, and verify all live behind the frame.
+        const renderOtpFrame = (handle) => {
             const card = el("div", "c");
             card.appendChild(style.cloneNode(true));
             const back = el("button", "back", "\u2190 Back");
             back.type = "button";
-            // Abandoning the code entry settles the email attempt that opened it, so
-            // the next lane the user picks is not refused by a claim nobody owns.
-            back.addEventListener("click", () => { invalidateAttempts(); swap(renderChoose()); });
             card.appendChild(back);
-            card.appendChild(el("h1", undefined, "Enter your code"));
-            card.appendChild(el("p", "sub", `We sent a 6-digit code to ${handle.email}.`));
             const status = el("div", "status");
             const setErr = (msg) => { status.textContent = msg; status.classList.add("err"); };
-            const form = el("form");
-            const label = el("label");
-            label.htmlFor = "bw-otp";
-            label.textContent = "Verification code";
-            const input = el("input", "otp");
-            input.id = "bw-otp";
-            input.type = "text";
-            input.inputMode = "numeric";
-            input.autocomplete = "one-time-code";
-            input.maxLength = 6;
-            input.placeholder = "000000";
-            input.required = true;
-            const submit = el("button", "btn primary");
-            submit.type = "submit";
-            submit.textContent = "Verify";
-            form.append(label, input, submit);
-            const verify = () => {
-                const code = input.value.replace(/\D+/g, "");
-                if (code.length < 6) {
-                    setErr("Enter the 6-digit code.");
-                    return;
-                }
-                // Verifying MINTS a session, so it takes the lock like every other lane.
-                const attempt = beginAttempt();
-                if (attempt === null) {
-                    setErr(BUSY_MSG);
-                    return;
-                }
-                status.classList.remove("err");
-                status.textContent = "";
-                submit.disabled = true;
-                input.disabled = true;
-                submit.replaceChildren(el("span", "spin"), document.createTextNode("Verifying\u2026"));
-                handle
-                    .verify(code)
-                    .then((u) => { settleAttempt(attempt); succeed(u); })
-                    .catch((err) => {
-                    if (!settleAttempt(attempt))
-                        return;
-                    submit.disabled = false;
-                    input.disabled = false;
-                    submit.textContent = "Verify";
-                    input.value = "";
-                    input.focus();
-                    setErr(errText(err));
-                });
-            };
-            form.addEventListener("submit", (e) => { e.preventDefault(); verify(); });
-            // Auto-submit once six digits are in - the buttery one-shot paste/type path.
-            input.addEventListener("input", () => {
-                if (input.value.replace(/\D+/g, "").length === 6 && !submit.disabled)
-                    verify();
-            });
-            card.appendChild(form);
+            // The Bounded-origin OTP frame. Its route restricts frame-ancestors to this exact origin, so
+            // only this app may embed it; the code + the P-256 key never leave it into this realm.
+            // Its trusted resize messages fit the heading, input, and any error copy.
+            const frame = document.createElement("iframe");
+            frame.setAttribute("title", "Enter your code");
+            frame.style.cssText = "width:100%;height:210px;border:0;background:transparent;color-scheme:dark";
+            card.appendChild(frame);
             card.appendChild(status);
             const foot = el("div", "foot");
             const poweredBy = el("a", undefined, "Powered by Bounded");
@@ -8626,7 +8463,22 @@ async function prepareAndOpen(opts, pending) {
             poweredBy.rel = "noopener";
             foot.appendChild(poweredBy);
             card.appendChild(foot);
-            requestAnimationFrame(() => input.focus());
+            // Running the frame MINTS a session, so it takes the lock like every other lane. Abandoning
+            // via Back settles it so the next lane the user picks is not refused by a claim nobody owns.
+            const attempt = beginAttempt();
+            if (attempt === null) {
+                setErr(BUSY_MSG);
+                return card;
+            }
+            back.addEventListener("click", () => { settleAttempt(attempt); invalidateAttempts(); swap(renderChoose()); });
+            handle
+                .run(frame)
+                .then((u) => { settleAttempt(attempt); succeed(u); })
+                .catch((err) => {
+                if (!settleAttempt(attempt))
+                    return;
+                setErr(errText(err));
+            });
             return card;
         };
         const swap = (node) => {
@@ -10268,4 +10120,4 @@ function defaultInjectedEvmProvider() {
 }
 
 export { OffchainAuthProvider as $, getAuthProvider as A, signInAnonymously as B, loginWithPrivy as C, loginWithWallet as D, ensureWalletLoginReady as E, ensureSharedWalletLoginReady as F, preloadWalletLogin as G, loginWithRedirect as H, completeLoginFromRedirect as I, loginWithPopup as J, completeLoginInPopup as K, openBoundedWidget as L, ensureSignedIn as M, useAuth as N, useQuery as O, useBuildRun as P, apps as Q, signSolanaMessageViaTurnkey as R, getOrCreateTurnkeyWallet as S, openTurnkeyKeyExport as T, startTurnkeyEmailLogin as U, getIdToken as V, WalletConfigError as W, onramp as X, onrampQuote as Y, onrampStatus as Z, setPlatform as _, signMessageWithTurnkey as a, PrivyExpoProvider as a0, requestEip6963Providers as a1, builds as a2, BuildsApiError as a3, NON_TERMINAL_STATES as a4, TERMINAL_STATES as a5, RUN_STATES as a6, PARK_REASONS as a7, FAILURE_REASONS as a8, BUILD_REVIEW_CAPABILITY_SCHEMA as a9, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as aa, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as ab, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, defaultInjectedProvider as f, getPlatform as g, hasTurnkeyWallet as h, firstStandardWalletProvider as i, setAuthLoading as j, bufferExports as k, setStoredAuthMethod as l, confirmAndCheckTransaction as m, normalizeSolanaRpcUrl as n, defaultInjectedEvmProvider as o, init as p, getCurrentUser as q, resolveSolanaRpcUrl as r, setCurrentUser as s, transactionHasSignature as t, onAuthStateChanged as u, onAuthLoadingChanged as v, getAuthLoading as w, waitForAuthReady as x, login as y, logout as z };
-//# sourceMappingURL=index-B5Luqobz.mjs.map
+//# sourceMappingURL=index-Cflemdaf.mjs.map