@bounded-sh/client 0.0.97 → 0.0.100-performance.0

package/dist/{index-Bb7I-AoO.js → index-DUVRmF9-.js}

@@ -22,6 +22,60 @@ function _interopNamespaceDefault(e) {
 
 var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
 
+function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
+    const base = baseUrl.replace(/\/$/, '');
+    const scope = claims['custom:walletScope'];
+    const protocol = claims['custom:walletProtocol'];
+    if (scope !== undefined && scope !== 'legacy' && scope !== 'app')
+        throw new Error('wallet_scope_invalid');
+    if ((scope === 'app' && protocol !== 2) || (scope === 'legacy' && protocol !== 1)
+        || (scope === undefined && protocol !== undefined))
+        throw new Error('wallet_protocol_invalid');
+    const appId = claims['custom:appId'];
+    const userId = claims['custom:userId'];
+    const address = claims['custom:walletAddress'];
+    if (scope === 'app' && (appId !== expectedAppId || typeof appId !== 'string'
+        || !/^[a-f0-9]{24}$/.test(appId) || typeof userId !== 'string' || !userId
+        || claims.iss !== base))
+        throw new Error('wallet_session_context_invalid');
+    const resolvedScope = scope === 'app' ? 'app' : 'legacy';
+    const route = resolvedScope === 'app' ? `/wallet/turnkey/app/${appId}` : '/wallet/turnkey';
+    return {
+        scope: resolvedScope, appId: String(appId || expectedAppId), userId: String(userId || ''),
+        address: typeof address === 'string' ? address : '', base, origin: new URL(base).origin,
+        url: `${base}${route}/signer${resolvedScope === 'app' ? `?origin=${encodeURIComponent(tenantOrigin)}` : ''}`,
+        key: JSON.stringify([base, appId || expectedAppId, userId || '', address || '', resolvedScope]),
+    };
+}
+let loginGeneration = 0;
+function invalidatePendingWalletLogin() { ++loginGeneration; }
+function walletOperationGuard() {
+    const generation = loginGeneration;
+    return () => {
+        if (generation !== loginGeneration)
+            throw new Error('wallet_session_changed');
+    };
+}
+function walletLoginGuard(signal) {
+    const generation = ++loginGeneration;
+    return () => {
+        if ((signal === null || signal === void 0 ? void 0 : signal.aborted) || generation !== loginGeneration)
+            throw new Error('wallet_login_cancelled');
+    };
+}
+// This realm owns one active SDK session and one retained signer frame.
+let activeWalletState;
+function setWalletSessionState(key, state) { activeWalletState = { key, state }; }
+function walletSessionState(key) {
+    if ((activeWalletState === null || activeWalletState === void 0 ? void 0 : activeWalletState.key) !== key)
+        return { status: 'verification-required' };
+    const state = activeWalletState.state;
+    if (state.status === 'ready' && (!Number.isFinite(state.expiresAt) || state.expiresAt <= Date.now())) {
+        return { status: 'verification-required', reason: 'wallet_session_expired' };
+    }
+    return state;
+}
+
 /**
  * Platform abstraction layer for React Native compatibility.
  *
@@ -965,7 +1019,10 @@ function registerAuthRegistrySync(fn) {
  * Returns the normalized user published by this commit, or null when omitted.
  */
 async function adoptSessionProvider(opts) {
+    var _a;
     const coreConfig = await core.getConfig();
+    (_a = opts.beforeCommit) === null || _a === void 0 ? void 0 : _a.call(opts);
+    invalidatePendingWalletLogin();
     coreConfig.authProvider = opts.provider;
     coreConfig.authMethod = opts.method;
     setAuthProviderInstance(opts.provider);
@@ -4199,145 +4256,562 @@ async function ensureSolanaMobileWalletRegistered(config, network) {
 
 var bufferExports = requireBuffer();
 
-// turnkey-signer-frame.ts - a HIDDEN, offscreen iframe of the Bounded signer page
-// for UI-less signer exchanges: sealing a login code (bounded:turnkey:encryptOtp),
-// establishing the 24h signing session right after login
-// (bounded:turnkey:establishSigningSession), and destroying it on logout
-// (bounded:turnkey:clearSigningSession).
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
 //
-// One handle = one live frame. The frame is kept across requests so multi-step
-// exchanges (seal a code, then establish the session with the keypair the SEAL
-// left in that exact page instance) talk to the same page. Origin + source +
-// requestId are all pinned; dispose() tears everything down.
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because the wallet's 24h signing session lives in that
+//     origin's storage, out of every app's reach).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
 function hasDOM$5() {
-    return typeof window !== 'undefined' && typeof document !== 'undefined';
+    return typeof window !== "undefined" && typeof document !== "undefined";
 }
-async function signerPage() {
-    const cfg = await core.getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
 }
-/** Mount the hidden signer frame. Callers MUST dispose() when done. */
-async function openHiddenSignerFrame() {
-    if (!hasDOM$5())
-        throw new Error('The Bounded signer frame is only available in the browser.');
-    const { url, origin } = await signerPage();
-    const frame = document.createElement('iframe');
-    frame.setAttribute('aria-hidden', 'true');
-    frame.style.cssText =
-        'position:fixed;width:1px;height:1px;left:-9999px;top:-9999px;border:0;opacity:0;pointer-events:none';
-    let disposed = false;
-    let readyResolve = null;
-    const ready = new Promise((resolve) => { readyResolve = resolve; });
-    const pending = new Map();
-    const onMsg = (event) => {
-        if (event.origin !== origin || event.source !== frame.contentWindow)
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
+    }
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        iframeContext: "",
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
+        generation: 0,
+        onSupersede: null,
+    };
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
             return;
-        const d = event.data;
-        if (!d || typeof d !== 'object')
+        if (event.origin !== m.iframeOrigin)
             return;
-        if (d.type === 'bounded:turnkey:ready') {
-            readyResolve === null || readyResolve === void 0 ? void 0 : readyResolve();
+        if (event.source !== m.iframe.contentWindow)
             return;
-        }
-        if (d.type === 'bounded:turnkey:result' && typeof d.requestId === 'string') {
-            const settle = pending.get(d.requestId);
-            if (settle) {
-                pending.delete(d.requestId);
-                settle(d);
-            }
-        }
-    };
-    window.addEventListener('message', onMsg);
-    frame.src = url;
-    document.body.appendChild(frame);
-    const dispose = () => {
-        if (disposed)
+        const d = event.data;
+        if (!d || typeof d !== "object")
             return;
-        disposed = true;
-        window.removeEventListener('message', onMsg);
-        pending.clear();
-        try {
-            frame.remove();
-        }
-        catch ( /* already gone */_a) { /* already gone */ }
-    };
-    return {
-        dispose,
-        request(message, timeoutMs) {
-            const requestId = String(message.requestId || '');
-            if (!requestId)
-                return Promise.reject(new Error('signer frame request needs a requestId'));
-            if (disposed)
-                return Promise.reject(new Error('signer frame disposed'));
-            return new Promise((resolve, reject) => {
-                let timer;
-                pending.set(requestId, (d) => {
-                    if (timer)
-                        clearTimeout(timer);
-                    resolve(d);
-                });
-                timer = setTimeout(() => {
-                    pending.delete(requestId);
-                    reject(new Error('The Bounded signer did not respond in time.'));
-                }, timeoutMs);
-                ready.then(() => {
-                    var _a;
-                    if (disposed || !pending.has(requestId))
-                        return;
-                    try {
-                        (_a = frame.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(message, origin);
-                    }
-                    catch ( /* frame gone; timeout rejects */_b) { /* frame gone; timeout rejects */ }
-                });
-            });
-        },
-    };
+        // Readiness belongs to the document, even while login owns the modal and no
+        // signing exchange is listening. The retained frame will not load again.
+        if (d.type === "bounded:turnkey:ready")
+            m.iframeReady = true;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
+    });
+    modal = m;
+    return m;
 }
-
-// turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
-// kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
-//
-// The hosted Turnkey signer refuses to sign unless the request carries an issuer-signed
-// SIGNING CAPABILITY bound to the app id, the requesting origin, and the EXACT payload
-// hash. `requestTurnkeySigningCapability` mints one for the given bytes and
-// `buildTurnkeySignRequest` assembles the signer request that carries it. The bridge
-// (turnkey-signer-bridge.ts) supplies the base url + id token and routes through both,
-// so a regression here (a dropped capability, a wrong route, a swallowed error) is
-// caught without a browser.
-// POST the Bounded id token + payload hash to the issuer's capability mint route and
-// return the issuer-signed capability for exactly these bytes. Credential-free: identity
-// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
-// would not carry). Throws with the same stable messages the bridge relied on inline.
-async function requestTurnkeySigningCapability(opts) {
-    const base = opts.baseUrl.replace(/\/$/, '');
-    let res;
-    try {
-        res = await opts.fetchImpl(`${base}/wallet/turnkey/capability`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ idToken: opts.idToken, messageHex: opts.messageHex }),
-        });
-    }
-    catch (_a) {
-        throw new Error('Could not reach the Bounded signer to authorize this signature.');
-    }
-    if (!res.ok) {
-        let error = 'signing_capability_denied';
-        try {
-            const d = (await res.json());
-            if (d && typeof d.error === 'string')
-                error = d.error;
-        }
-        catch (_b) {
-            /* keep the default marker */
-        }
-        throw new Error(`Turnkey signing was not authorized (${error}).`);
-    }
-    const d = (await res.json());
-    if (!d || typeof d.capability !== 'string' || !d.capability) {
-        throw new Error('Turnkey signing capability was malformed.');
-    }
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    // Capture the generation at hide time. If a newer open re-shows the modal within
+    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the
+    // freshly reopened widget - only tear down when we are still the same open.
+    const gen = m.generation;
+    window.setTimeout(() => {
+        if (m.generation === gen)
+            m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+// True outer height of the mounted card: the max of its padding-box scroll height
+// (catches overflowing descendants) and its border-box height plus own vertical
+// margins (catches border + margins, which scrollHeight omits). Ceiled so a
+// sub-pixel row is never clipped under `overflow:hidden`.
+function measureOuterHeight(target) {
+    var _a;
+    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
+    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
+    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
+    const rect = target.getBoundingClientRect().height;
+    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
+}
+/**
+ * Measure the currently mounted native content and tween the panel to fit it.
+ * Re-fits automatically when the card's intrinsic height changes - notably after
+ * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
+ * after first paint) and on inline view swaps (email -> OTP code -> success).
+ */
+function fitPanelToContent(m) {
+    var _a, _b;
+    const first = m.content.firstElementChild;
+    const target = first || m.content;
+    const apply = () => {
+        // Only fit while this exact node is still the mounted card.
+        if (m.content.firstElementChild !== first && first)
+            return;
+        const h = measureOuterHeight(target);
+        if (h > 0)
+            setPanelHeight(m, h);
+    };
+    apply();
+    const view = target.ownerDocument.defaultView;
+    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
+    // have painted, so the height never lags a late reflow.
+    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
+    const fonts = target.ownerDocument.fonts;
+    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
+        fonts.ready.then(apply).catch(() => { });
+    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
+    m.fitObserver = null;
+    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
+        const ro = new view.ResizeObserver(() => apply());
+        ro.observe(first);
+        m.fitObserver = ro;
+    }
+}
+/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
+function mountContent(m, node) {
+    var _a;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.replaceChildren(node);
+    m.content.style.display = "block";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin, context = "") {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url && m.iframeContext === context)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    iframe.setAttribute("allow", "clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeContext = context;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+/**
+ * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
+ * whether there was one. Logout needs this: a signing session can live in that document's
+ * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
+ * throwaway iframe opened by the sweep can only ever clear the shared store, never another
+ * document's memory. Removing the iframe discards its browsing context, which takes the
+ * mirror with it.
+ *
+ * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
+ * every logout of every app, most of which never mounted one.
+ */
+function detachWarmSignerIframe(origin) {
+    if (!modal || !modal.iframe || (origin))
+        return false;
+    detachIframe(modal);
+    return true;
+}
+/** A removed frame cannot still supply its in-memory signing session. */
+function hasWarmSignerFrame(context) {
+    var _a;
+    return Boolean(((_a = modal === null || modal === void 0 ? void 0 : modal.iframe) === null || _a === void 0 ? void 0 : _a.isConnected) && modal.iframeContext === context);
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.iframeContext = "";
+    m.onIframeMessage = null;
+}
+// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
+// JetBrains Mono) once at the document level so they apply inside the shadow root. A
+// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
+const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
+function ensureFonts() {
+    if (!hasDOM$5())
+        return;
+    if (document.querySelector('link[data-bounded-fonts="1"]'))
+        return;
+    const pre1 = document.createElement("link");
+    pre1.rel = "preconnect";
+    pre1.href = "https://fonts.googleapis.com";
+    const pre2 = document.createElement("link");
+    pre2.rel = "preconnect";
+    pre2.href = "https://fonts.gstatic.com";
+    pre2.crossOrigin = "anonymous";
+    const link = document.createElement("link");
+    link.rel = "stylesheet";
+    link.href = FONTS_HREF;
+    link.setAttribute("data-bounded-fonts", "1");
+    document.head.append(pre1, pre2, link);
+}
+/** Tag the already mounted login document without moving or navigating it. */
+function bindWarmSignerFrame(frame, context) {
+    if ((modal === null || modal === void 0 ? void 0 : modal.iframe) === frame)
+        modal.iframeContext = context;
+}
+
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app approve
+// card (with inline code entry when the 24h signing session must first be
+// established), never a jarring popup.
+//
+// WHY AN IFRAME: the wallet's signing session lives in the single Bounded signer
+// origin's storage, out of every app's reach, so signing MUST run on that origin;
+// the iframe brings it in-app.
+//
+// Restricted embedders: if the frame never loads, the SAME request reruns through
+// `popupFallback` (a real window). Callers pass a popup implementation and never
+// see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot be mounted
+ * or never loads.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$5())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: the approve card is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        var _a;
+        let settled = false;
+        let usedFallback = false;
+        (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
+        const iframe = ensureIframe(m, url, signerOrigin, ex.context);
+        const send = () => {
+            var _a;
+            if (!iframe.contentWindow)
+                return;
+            try {
+                (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_b) {
+                finish(() => reject(new Error('wallet_session_changed')));
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        // The frame is WARM across exchanges, so an abandoned approval must be told to drop its
+        // in-flight ceremony. Otherwise the signer keeps `approving` set for a card nobody is
+        // looking at and refuses every later create/sign as `signer_request_superseded` (the
+        // BSA-2026-012 guard) until the page reloads.
+        const cancelInFrame = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage({ type: "bounded:turnkey:cancel", requestId }, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            cancelInFrame();
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                cancelInFrame();
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
+// turnkey-signer-frame.ts - a HIDDEN, offscreen iframe of the Bounded signer page
+// for UI-less signer exchanges: sealing a login code (bounded:turnkey:encryptOtp),
+// establishing the 24h signing session right after login
+// (bounded:turnkey:establishSigningSession), and destroying it on logout
+// (bounded:turnkey:clearSigningSession).
+//
+// One handle = one live frame. The frame is kept across requests so multi-step
+// exchanges (seal a code, then establish the session with the keypair the SEAL
+// left in that exact page instance) talk to the same page. Origin + source +
+// requestId are all pinned; dispose() tears everything down.
+function hasDOM$4() {
+    return typeof window !== 'undefined' && typeof document !== 'undefined';
+}
+async function signerPage() {
+    const cfg = await core.getConfig();
+    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
+    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+}
+/** Mount the hidden signer frame. Callers MUST dispose() when done. */
+async function openHiddenSignerFrame(page) {
+    if (!hasDOM$4())
+        throw new Error('The Bounded signer frame is only available in the browser.');
+    const { url, origin } = page !== null && page !== void 0 ? page : await signerPage();
+    const frame = document.createElement('iframe');
+    frame.setAttribute('aria-hidden', 'true');
+    frame.style.cssText =
+        'position:fixed;width:1px;height:1px;left:-9999px;top:-9999px;border:0;opacity:0;pointer-events:none';
+    let disposed = false;
+    let readyResolve = null;
+    const ready = new Promise((resolve) => { readyResolve = resolve; });
+    const pending = new Map();
+    const onMsg = (event) => {
+        if (event.origin !== origin || event.source !== frame.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== 'object')
+            return;
+        if (d.type === 'bounded:turnkey:ready') {
+            readyResolve === null || readyResolve === void 0 ? void 0 : readyResolve();
+            return;
+        }
+        if (d.type === 'bounded:turnkey:result' && typeof d.requestId === 'string') {
+            const settle = pending.get(d.requestId);
+            if (settle) {
+                pending.delete(d.requestId);
+                settle(d);
+            }
+        }
+    };
+    window.addEventListener('message', onMsg);
+    frame.src = url;
+    document.body.appendChild(frame);
+    const dispose = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        window.removeEventListener('message', onMsg);
+        pending.clear();
+        try {
+            frame.remove();
+        }
+        catch ( /* already gone */_a) { /* already gone */ }
+    };
+    return {
+        dispose,
+        request(message, timeoutMs) {
+            const requestId = String(message.requestId || '');
+            if (!requestId)
+                return Promise.reject(new Error('signer frame request needs a requestId'));
+            if (disposed)
+                return Promise.reject(new Error('signer frame disposed'));
+            return new Promise((resolve, reject) => {
+                let timer;
+                pending.set(requestId, (d) => {
+                    if (timer)
+                        clearTimeout(timer);
+                    resolve(d);
+                });
+                timer = setTimeout(() => {
+                    pending.delete(requestId);
+                    reject(new Error('The Bounded signer did not respond in time.'));
+                }, timeoutMs);
+                ready.then(() => {
+                    var _a;
+                    if (disposed || !pending.has(requestId))
+                        return;
+                    try {
+                        (_a = frame.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(message, origin);
+                    }
+                    catch ( /* frame gone; timeout rejects */_b) { /* frame gone; timeout rejects */ }
+                });
+            });
+        },
+    };
+}
+
+// turnkey-signing-capability.ts - the pure AS-02 (DS2-0112) signing-capability logic,
+// kept import-free (no DOM, no session, no @bounded-sh/core) so it is unit-testable.
+//
+// The hosted Turnkey signer refuses to sign unless the request carries an issuer-signed
+// SIGNING CAPABILITY bound to the app id, the requesting origin, and the EXACT payload
+// hash. `requestTurnkeySigningCapability` mints one for the given bytes and
+// `buildTurnkeySignRequest` assembles the signer request that carries it. The bridge
+// (turnkey-signer-bridge.ts) supplies the base url + id token and routes through both,
+// so a regression here (a dropped capability, a wrong route, a swallowed error) is
+// caught without a browser.
+// POST the Bounded id token + payload hash to the issuer's capability mint route and
+// return the issuer-signed capability for exactly these bytes. Credential-free: identity
+// is proven with the id token in the body (not an ambient cookie the cross-origin fetch
+// would not carry). Throws with the same stable messages the bridge relied on inline.
+async function requestTurnkeySigningCapability(opts) {
+    const base = opts.baseUrl.replace(/\/$/, '');
+    let res;
+    try {
+        res = await opts.fetchImpl(`${base}/wallet/turnkey/capability`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ idToken: opts.idToken, messageHex: opts.messageHex, walletProtocol: 2 }),
+        });
+    }
+    catch (_a) {
+        throw new Error('Could not reach the Bounded signer to authorize this signature.');
+    }
+    if (!res.ok) {
+        let error = 'signing_capability_denied';
+        try {
+            const d = (await res.json());
+            if (d && typeof d.error === 'string')
+                error = d.error;
+        }
+        catch (_b) {
+            /* keep the default marker */
+        }
+        throw new Error(`Turnkey signing was not authorized (${error}).`);
+    }
+    const d = (await res.json());
+    if (!d || typeof d.capability !== 'string' || !d.capability) {
+        throw new Error('Turnkey signing capability was malformed.');
+    }
     return d.capability;
 }
 // Assemble the `bounded:turnkey:sign` postMessage request, carrying the issuer-signed
@@ -4368,7 +4842,7 @@ async function requestTurnkeyActionAuthorization(opts) {
         res = await opts.fetchImpl(`${base}/wallet/turnkey/action-authorization`, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ idToken: opts.idToken, action: opts.action }),
+            body: JSON.stringify({ idToken: opts.idToken, action: opts.action, walletProtocol: 2 }),
         });
     }
     catch (_a) {
@@ -4420,26 +4894,46 @@ function buildTurnkeyActionRequest(opts) {
 // code is the sole signing authority; within a live session every signature is one
 // approval click). The app retains the transaction itself.
 //
-// ONE ORIGIN, ONE SESSION: the signing session lives in the signer origin's own
-// storage, out of every app's reach, so ALL Bounded apps (any subdomain / custom
-// domain) sign through this one origin - giving every user one wallet that roams
-// across every app.
-function hasDOM$4() {
+// Signing keys remain on the trusted signer origin. New apps use independently
+// bound wallets and storage slots; legacy apps retain their shared wallet.
+function hasDOM$3() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
-// BSA-2026-006: dispatch every signing / get-or-create exchange through a TOP-LEVEL
-// POPUP the caller opened from the user gesture - NEVER a framed widget. An authorized
-// tenant that embedded the signer could overlay its predictable Approve control and steal
-// one concealed click into a fund-moving signature; a top-level window it cannot reach or
-// visually redress closes that. A blocked popup surfaces `popup_blocked` (runPopup) and we
-// never silently fall back to an iframe.
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (no DOM, or the frame never mounts/loads). Nothing in the
+// email-session flow needs a popup by preference: the code entry and the approval
+// click both run fine inside a cross-origin iframe on every engine (the old
+// Safari popup preference existed only for in-iframe WebAuthn CREATE).
 async function deliver(url, origin, ex) {
-    return runPopup(url, origin, ex);
-}
-async function turnkeySignerPage() {
+    var _a, _b;
+    const popup = () => runPopup(url, origin, ex);
+    (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
+    const result = await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
+    (_b = ex.assertCurrent) === null || _b === void 0 ? void 0 : _b.call(ex);
+    return result;
+}
+async function turnkeySignerPage(token) {
+    const assertGeneration = walletOperationGuard();
+    const idToken = token === undefined ? core.getActiveSessionManager().getIdToken() : token;
     const cfg = await core.getConfig();
     const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+    const context = walletContextFromClaims(idToken ? decodeJwt$1(idToken) : {}, base, cfg.appId, window.location.origin);
+    return Object.assign(Object.assign({}, context), { idToken: idToken || '', assertCurrent() {
+            assertGeneration();
+            const current = core.getActiveSessionManager().getIdToken();
+            if (!current)
+                throw new Error('wallet_session_changed');
+            const next = walletContextFromClaims(decodeJwt$1(current), base, cfg.appId, window.location.origin);
+            if (next.key !== context.key)
+                throw new Error('wallet_session_changed');
+        } });
+}
+async function getTurnkeyWalletSessionState() {
+    const context = await turnkeySignerPage();
+    context.assertCurrent();
+    if (!hasWarmSignerFrame(context.key))
+        return { status: 'verification-required' };
+    return walletSessionState(context.key);
 }
 function toHex(bytes) {
     let h = '';
@@ -4495,7 +4989,7 @@ async function runPopup(url, signerOrigin, ex) {
     const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
     const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup) {
-        throw new Error('popup_blocked - the wallet approval window was blocked. Call this from a user gesture (e.g. a click handler) so it can open; we never fall back to an in-page frame.');
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the wallet approval window can open.');
     }
     return await new Promise((resolve, reject) => {
         let settled = false;
@@ -4511,11 +5005,12 @@ async function runPopup(url, signerOrigin, ex) {
         let closeTimer;
         const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
             clearInterval(closeTimer); };
-        const sendRequest = () => { if (settled || acked)
+        const sendRequest = () => { var _a; if (settled || acked)
             return; try {
+            (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
             popup.postMessage(ex.request, signerOrigin);
         }
-        catch ( /* popup gone */_a) { /* popup gone */ } };
+        catch ( /* popup gone */_b) { /* popup gone */ } };
         const onMsg = (event) => {
             if (event.origin !== signerOrigin)
                 return;
@@ -4585,16 +5080,9 @@ async function runPopup(url, signerOrigin, ex) {
 // identity with the Bounded id token WE minted (a body secret, RS256-verified server-side), not
 // an ambient cookie - the issuer's session cookie is SameSite-scoped to its own origin and is
 // not sent on this cross-origin fetch, so the token is what carries the session's wallet.
-async function fetchSigningCapability(messageHex) {
-    const cfg = await core.getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    let idToken = null;
-    try {
-        idToken = core.getActiveSessionManager().getIdToken();
-    }
-    catch (_a) {
-        idToken = null;
-    }
+async function fetchSigningCapability(messageHex, context) {
+    context.assertCurrent();
+    const { base, idToken } = context;
     if (!idToken) {
         throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
     }
@@ -4609,16 +5097,9 @@ async function fetchSigningCapability(messageHex) {
 // requires an issuer-signed authorization bound to this app origin and exact action. Fetch it
 // before posting to the signer. Walletless sessions are valid for createWallet because that is
 // the operation that provisions their first wallet.
-async function fetchActionAuthorization(action) {
-    const cfg = await core.getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    let idToken = null;
-    try {
-        idToken = core.getActiveSessionManager().getIdToken();
-    }
-    catch (_a) {
-        idToken = null;
-    }
+async function fetchActionAuthorization(action, context) {
+    context.assertCurrent();
+    const { base, idToken } = context;
     if (!idToken) {
         throw new Error('Sign in again to set up your Turnkey wallet.');
     }
@@ -4637,32 +5118,24 @@ async function fetchActionAuthorization(action) {
  * signer iframe, and a blocked/offline frame must never block logout itself;
  * an unswept session is account-bound and unusable without a live authorization,
  * it just costs its owner nothing and a stranger nothing.
- */
-async function clearTurnkeySigningSession() {
-    if (!hasDOM$4())
-        return;
-    // The session can live in TWO places, and the sweep has to reach both:
-    //   1. the signer origin's store, shared by every signer frame in this app's partition -
-    //      cleared by posting into a throwaway frame below;
-    //   2. the WARM widget iframe's memory. The signer keeps an in-memory mirror when the
-    //      browser blocks its storage, and hideModal deliberately leaves that iframe mounted
-    //      between signatures, so the mirror outlives logout. A throwaway frame cannot see
-    //      another document's memory - the only way to take it is to destroy that document.
-    // Done first, and synchronously, so it lands even if the frame exchange below fails.
-    try {
-        const { origin } = await turnkeySignerPage();
-        (await Promise.resolve().then(function () { return boundedWidgetModal; })).detachWarmSignerIframe(origin);
-    }
-    catch (_a) {
-        /* no modal module / no warm frame: nothing to take */
-    }
+ */
+async function clearTurnkeySigningSession(idToken) {
+    if (!hasDOM$3())
+        return;
+    // Destroy the trusted in-memory key even if configuration or token parsing fails.
+    // Do it synchronously, before a different login can mount a replacement frame.
+    detachWarmSignerIframe();
+    // Capture the session before asynchronous teardown clears the SDK's token.
+    const contextPromise = turnkeySignerPage(idToken);
     let frame = null;
     try {
-        frame = await openHiddenSignerFrame();
+        const context = await contextPromise;
+        setWalletSessionState(context.key, { status: 'verification-required', reason: 'logged_out' });
+        frame = await openHiddenSignerFrame(context);
         await frame.request({ type: 'bounded:turnkey:clearSigningSession', requestId: `tkclear_${Date.now()}_${++requestSeq}` }, 4000);
     }
-    catch (_b) {
-        /* best-effort: never block or fail logout on the sweep */
+    catch (_a) {
+        // The warm frame was destroyed; the bounded store sweep is best effort.
     }
     finally {
         frame === null || frame === void 0 ? void 0 : frame.dispose();
@@ -4680,12 +5153,14 @@ function hasTurnkeyWallet() {
  * Use this to learn the fee-payer address BEFORE building a transaction to sign.
  */
 async function getOrCreateTurnkeyWallet() {
-    if (!hasDOM$4())
-        throw new Error('Turnkey embedded wallets are only available in the browser (popup-based).');
-    const { url, origin } = await turnkeySignerPage();
+    if (!hasDOM$3())
+        throw new Error('Turnkey embedded wallets are only available in the browser (trusted wallet UI).');
+    const context = await turnkeySignerPage();
+    const { url, origin } = context;
     const requestId = `tkcreate_${Date.now()}_${++requestSeq}`;
-    const authorization = await fetchActionAuthorization('createWallet');
+    const authorization = await fetchActionAuthorization('createWallet', context);
     return await deliver(url, origin, {
+        context: context.key, assertCurrent: context.assertCurrent,
         request: buildTurnkeyActionRequest({ requestId, action: 'createWallet', authorization }),
         onResult: (d) => {
             if (d.ok && typeof d.address === 'string')
@@ -4705,7 +5180,7 @@ async function getOrCreateTurnkeyWallet() {
  * that tab - it never transits Bounded.
  */
 async function openTurnkeyKeyExport() {
-    if (!hasDOM$4())
+    if (!hasDOM$3())
         throw new Error('Turnkey key export is only available in the browser.');
     if (!hasTurnkeyWallet())
         throw new Error('This session has no Turnkey wallet to export.');
@@ -4726,10 +5201,11 @@ async function openTurnkeyKeyExport() {
     }
     catch ( /* older engines: the tab still cannot read us cross-origin */_a) { /* older engines: the tab still cannot read us cross-origin */ }
     try {
-        const cfg = await core.getConfig();
-        const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-        const authorization = await fetchActionAuthorization('exportWallet');
-        handle.location.href = `${base}/wallet/turnkey/export#authorization=${encodeURIComponent(authorization)}`;
+        const context = await turnkeySignerPage();
+        const authorization = await fetchActionAuthorization('exportWallet', context);
+        context.assertCurrent();
+        const path = context.scope === 'app' ? `/wallet/turnkey/app/${context.appId}` : '/wallet/turnkey';
+        handle.location.href = `${context.base}${path}/export#authorization=${encodeURIComponent(authorization)}`;
     }
     catch (error) {
         // Never strand a blank tab on a failed mint.
@@ -4741,10 +5217,9 @@ async function openTurnkeyKeyExport() {
     }
 }
 /**
- * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
- * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
- * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
- * browser blocks the popup.
+ * Open the Bounded Turnkey approval card and sign `message` (raw bytes) with the
+ * user's Turnkey wallet, resolving with the ed25519 signature and wallet address.
+ * Call from a user gesture so a deliberate browser fallback can open if needed.
  *
  * The signer shows an approve card (wallet address, requesting origin, Approve /
  * Cancel). With a live 24-hour signing session (normally established by the login
@@ -4753,24 +5228,27 @@ async function openTurnkeyKeyExport() {
  * completes the signature.
  */
 async function signSolanaMessageViaTurnkey(message) {
-    if (!hasDOM$4()) {
-        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+    if (!hasDOM$3()) {
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (trusted wallet UI).');
     }
-    const { url, origin } = await turnkeySignerPage();
+    const context = await turnkeySignerPage();
+    const { url, origin } = context;
     const requestId = `tksign_${Date.now()}_${++requestSeq}`;
     const messageHex = toHex(message);
     // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
     // refuse (capability_required) without it. Fetched per signature (each is single-payload).
-    const capability = await fetchSigningCapability(messageHex);
+    const capability = await fetchSigningCapability(messageHex, context);
     // Inline (authMode:"turnkey") sessions plant no Better Auth cookie on the issuer, so the
     // signer's same-origin status/create fetches need a bearer session proof: attach the
     // createWallet action authorization (it covers the sign flow's get-or-create too). Minted
     // from the same id token as the capability, so a session that minted one can mint both.
-    const authorization = await fetchActionAuthorization('createWallet');
+    const authorization = await fetchActionAuthorization('createWallet', context);
     return await deliver(url, origin, {
+        context: context.key, assertCurrent: context.assertCurrent,
         request: buildTurnkeySignRequest({ requestId, messageHex, capability, authorization }),
         onResult: (d) => {
             if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                setWalletSessionState(context.key, { status: 'ready', expiresAt: Number(d.signingSessionExpiresAt) });
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
             }
             return { error: String(d.error || 'Turnkey signing failed') };
@@ -4880,11 +5358,21 @@ async function signAndSubmitTransactionWithTurnkey(transaction, feePayer) {
     }
     return signature;
 }
+/** Save this trusted URL to recover the wallet even after the app is deleted. */
+async function getTurnkeyWalletRecoveryUrl() {
+    const context = await turnkeySignerPage();
+    context.assertCurrent();
+    if (!context.address || !hasTurnkeyWallet())
+        throw new Error('wallet_unavailable');
+    return `${context.base}/wallet/turnkey/recover/${encodeURIComponent(context.address)}`;
+}
 
 var turnkeySignerBridge = /*#__PURE__*/Object.freeze({
     __proto__: null,
     clearTurnkeySigningSession: clearTurnkeySigningSession,
     getOrCreateTurnkeyWallet: getOrCreateTurnkeyWallet,
+    getTurnkeyWalletRecoveryUrl: getTurnkeyWalletRecoveryUrl,
+    getTurnkeyWalletSessionState: getTurnkeyWalletSessionState,
     hasTurnkeyWallet: hasTurnkeyWallet,
     openTurnkeyKeyExport: openTurnkeyKeyExport,
     signAndSubmitTransactionWithTurnkey: signAndSubmitTransactionWithTurnkey,
@@ -4911,7 +5399,7 @@ const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
 // session it mints is read back through this same selector everywhere.
 const sessionManager = core.getActiveSessionManager;
-function hasDOM$3() {
+function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
 function decodeJwt(token) {
@@ -5062,7 +5550,7 @@ async function buildAuthorize(opts) {
         throw new Error('appId is not configured (init the SDK with your appId)');
     // Web: default to the current page so callers don't have to pass redirectUri. Native has no
     // window — it MUST pass an https universal link (the system auth session needs a real URL).
-    const redirectUri = opts.redirectUri || (hasDOM$3() ? window.location.origin + window.location.pathname : undefined);
+    const redirectUri = opts.redirectUri || (hasDOM$2() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
@@ -5170,7 +5658,7 @@ async function runNativeLogin(opts) {
 async function loginWithRedirect(opts) {
     if (isNative())
         return runNativeLogin(opts);
-    if (!hasDOM$3())
+    if (!hasDOM$2())
         throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
     const { url, pkce } = await buildAuthorize(opts);
     // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
@@ -5187,7 +5675,7 @@ async function loginWithRedirect(opts) {
  *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
  *  page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
-    if (!hasDOM$3())
+    if (!hasDOM$2())
         return null;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -5235,7 +5723,7 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
  *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
-    if (!hasDOM$3())
+    if (!hasDOM$2())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
     // Open synchronously, before PKCE/config awaits consume the click's user-
     // activation window. Opening only after buildAuthorize() intermittently
@@ -5395,7 +5883,7 @@ async function loginWithPopup(opts) {
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
 function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$3() || !window.opener)
+    if (!hasDOM$2() || !window.opener)
         return;
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
@@ -5416,19 +5904,27 @@ function completeLoginInPopup(openerOrigin) {
 // Turnkey-native login path (authMode:"turnkey"), which mints the session server-side
 // after Turnkey verifies the email OTP - there is no OIDC code to exchange. Wiring is
 // identical to exchangeCode's tail so the realtime worker cannot tell them apart.
-async function establishInlineSession(data) {
+async function establishInlineSession(data, beforeCommit, beforeStore) {
     const base = await issuerBase();
+    beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit();
     const idToken = tokenField(data, 'id_token', 'idToken');
     if (!idToken)
         throw new Error('No id_token in the inline session response');
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, () => { beforeCommit === null || beforeCommit === void 0 ? void 0 : beforeCommit(); beforeStore === null || beforeStore === void 0 ? void 0 : beforeStore(); });
     // Adopt the OIDC provider on EVERY session surface - including core's signing
     // pointer (getConfig().authProvider), which this path used to skip, leaving
     // onchain writes routed through a previous (e.g. logged-out wallet) provider.
-    await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user });
+    try {
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+    }
+    catch (error) {
+        if (typeof rollback === 'function')
+            await rollback();
+        throw error;
+    }
     // Turnkey-native OTP mints an app session directly. It does not establish a
     // Better Auth browser cookie on the issuer, so logout must not navigate
     // through the issuer's cookie-clearing /logout endpoint. Stamped AFTER the
@@ -5492,9 +5988,6 @@ async function exchangeCode(code, verifier, redirectUri) {
     return user;
 }
 
-// NOTE: Provider class re-exports have been moved to index.ts (web) and
-// index.native.ts (RN) to avoid eager resolution of web-only dependencies
-// (react-dom) when this module is imported on RN.
 let currentAuthProvider = null;
 let currentAuthMethod = null;
 let currentAuthProviderConfigKey = null;
@@ -5849,7 +6342,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-SqE5H8jv.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-C6SFJd9L.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -5891,7 +6384,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CDl-az6P.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B3LLEpfp.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -5904,7 +6397,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-ZrxW8UES.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-Dq3FDV1M.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -5929,7 +6422,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-JE0zdREA.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-pC-AheTZ.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -5991,7 +6484,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-JE0zdREA.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-pC-AheTZ.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6162,7 +6655,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-CDl-az6P.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-B3LLEpfp.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6265,7 +6758,7 @@ async function loginWithWallet(options) {
         await ensureSharedWalletLoginReady();
     else
         await ensureWalletLoginReady();
-    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-CDl-az6P.js'); });
+    const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-B3LLEpfp.js'); });
     // Keep the RAW wallet provider: the offchain wrapper forwards only a fixed
     // set of methods, so cleanup below must speak to the provider that actually
     // holds the config rather than to whatever is wrapping it.
@@ -6427,13 +6920,14 @@ async function exchangeLogoutHint(issuerBase, idToken) {
 // which can be blocked or offline), so its failures are the one thing logout may
 // tolerate - never revokeSession's. Lazy import per this module's rule (the signer
 // bridge is browser-only machinery). Never rejects.
-async function sweepTurnkeySigningSession() {
+async function sweepTurnkeySigningSession(idToken) {
     try {
-        await (await Promise.resolve().then(function () { return turnkeySignerBridge; })).clearTurnkeySigningSession();
+        await (await Promise.resolve().then(function () { return turnkeySignerBridge; })).clearTurnkeySigningSession(idToken);
     }
     catch ( /* best-effort: never block or fail logout on the sweep */_a) { /* best-effort: never block or fail logout on the sweep */ }
 }
 async function logout$1(options) {
+    invalidatePendingWalletLogin();
     // Re-initialize the provider if it was cleared by a prior logout — the exact mirror
     // of login()'s self-heal above. Every session-establishment path now adopts through
     // session-provider.ts, so this is a REPAIR (the registry was cleared by a previous
@@ -6465,7 +6959,7 @@ async function logout$1(options) {
     // sweep is a hidden signer-iframe exchange; start it now (after revocation is
     // committed - a failed logout leaves the still-logged-in user their session) and
     // let it overlap the provider teardown. sweepTurnkeySigningSession never rejects.
-    const signingSessionSweep = sweepTurnkeySigningSession();
+    const signingSessionSweep = sweepTurnkeySigningSession(idTokenHint);
     // Only OIDC-hosted sessions own an issuer browser cookie. Turnkey-native
     // email OTP is also an email auth method, but it mints the app session
     // inline and has no issuer cookie to clear. Use the explicit session-kind
@@ -6682,383 +7176,113 @@ async function waitForAuthReady() {
         throw new Error('SDK not initialized. Please call init() first.');
     }
     await ready;
-    return currentUser;
-}
-function onAuthStateChanged(callback) {
-    authStateListeners.push(callback);
-    if (initCompleted || hasRunFirstTime) {
-        // Call the callback immediately with the current user.
-        // We check hasRunFirstTime in addition to initCompleted to handle the race
-        // where the Phantom auto-login effect calls setCurrentUser() before init()
-        // finishes. Without this, listeners registered between auto-login's
-        // setCurrentUser and init()'s initCompleted would never fire (init's
-        // setCurrentUser is a no-op for same-address and initCompleted is still false).
-        callback(currentUser);
-    }
-    return () => {
-        authStateListeners = authStateListeners.filter((listener) => listener !== callback);
-    };
-}
-function onAuthLoadingChanged(callback) {
-    authLoadingListeners.push(callback);
-    // Call immediately with current loading state
-    callback(isAuthLoading);
-    return () => {
-        authLoadingListeners = authLoadingListeners.filter((listener) => listener !== callback);
-    };
-}
-function setAuthLoading(loading) {
-    if (isAuthLoading !== loading) {
-        isAuthLoading = loading;
-        authLoadingListeners.forEach((callback) => callback(loading));
-    }
-}
-function getAuthLoading() {
-    return isAuthLoading;
-}
-async function login(options) {
-    if (!authProviderInstance) {
-        throw new Error('SDK not initialized. Please call init() first.');
-    }
-    const loggedInUser = await login$1(options);
-    setCurrentUser(loggedInUser);
-    return currentUser;
-}
-async function logout(options) {
-    if (!authProviderInstance) {
-        throw new Error('SDK not initialized. Please call init() first.');
-    }
-    await logout$1(options);
-    setCurrentUser(null);
-}
-var hasRunFirstTime = false;
-function userPrincipalKey(user) {
-    var _a, _b, _c;
-    if (!user)
-        return null;
-    return (_c = (_b = (_a = user.id) !== null && _a !== void 0 ? _a : user.address) !== null && _b !== void 0 ? _b : user.email) !== null && _c !== void 0 ? _c : null;
-}
-// Update the currentUser and notify listeners
-function setCurrentUser(user) {
-    // Enrich with the universal identity fields (id/email) derived from the
-    // active session's idToken — central chokepoint so every provider's user
-    // object gains { id, address, email } without each construction site
-    // having to set them.
-    user = withUserIdentity(user);
-    const lastUser = currentUser;
-    const wasInitializedBefore = hasRunFirstTime;
-    const lastPrincipal = userPrincipalKey(currentUser);
-    const nextPrincipal = userPrincipalKey(user);
-    const shouldRunListeners = !hasRunFirstTime || lastPrincipal !== nextPrincipal;
-    hasRunFirstTime = true;
-    currentUser = user;
-    if (shouldRunListeners) {
-        // Isolate each listener: a consumer callback that throws (during logout in
-        // particular) must not abort the notification loop OR skip the socket reopen
-        // below. Before this, a single throwing listener propagated out of
-        // setCurrentUser, so the realtime socket kept streaming as the signed-out
-        // user and the other listeners were never told the principal changed.
-        authStateListeners.forEach((callback) => {
-            try {
-                callback(user);
-            }
-            catch (error) {
-                console.error('Error in onAuthStateChanged listener:', error);
-            }
-        });
-        // Reconnect WebSocket connections with new auth when user changes.
-        // Skip on the first setCurrentUser call during init() — there are no
-        // existing connections to reconnect at that point.
-        if (wasInitializedBefore && userPrincipalKey(lastUser) !== nextPrincipal) {
-            core.reconnectWithNewAuth().catch((error) => {
-                console.error('Error reconnecting WebSocket after auth change:', error);
-            });
-        }
-    }
-    // Return this commit's normalized snapshot. A listener can start another
-    // login, so the mutable currentUser may already belong to a newer session.
-    return user;
-}
-function getCurrentUser() {
-    return currentUser;
-}
-/** @internal Snapshot/restore surface for transactional auth-provider switches. */
-function getAuthProviderInstance() {
-    return authProviderInstance;
-}
-function setAuthProviderInstance(provider) {
-    authProviderInstance = provider;
-}
-
-// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
-// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
-// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
-// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
-//
-// It hosts EITHER:
-//   - NATIVE content (the login card the SDK renders itself), or
-//   - an IFRAME (the Bounded-owned signer page, which must run on the single
-//     signer origin because the wallet's 24h signing session lives in that
-//     origin's storage, out of every app's reach).
-//
-// The modal is a warm singleton: it stays mounted (hidden) between uses so a
-// second open - or a signature right after login - is instant and, when it is
-// already open, a clean in-place view swap rather than a reopen.
-function hasDOM$2() {
-    return typeof window !== "undefined" && typeof document !== "undefined";
-}
-const OVERLAY_CSS = `
-:host{all:initial}
-*{box-sizing:border-box}
-.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
-  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
-.bw-ov.mounted{display:block}
-.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
-  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
-.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
-.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
-  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
-  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
-  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
-  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
-    height .3s cubic-bezier(.2,.8,.2,1)}
-.bw-ov.show .bw-back{opacity:1}
-.bw-ov.show .bw-panel{opacity:1;transform:none}
-.bw-ov.closing .bw-back{opacity:0}
-.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
-.bw-content{position:absolute;inset:0;overflow:hidden}
-.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
-/* editorial corner crop-marks, matching the reference frame */
-.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
-  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
-.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
-.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
-.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
-.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
-@media(max-width:560px){
-  .bw-wrap{align-items:flex-end;padding:0}
-  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
-  .bw-content{overflow-y:auto}
-  .bw-ov.show .bw-panel{transform:none}
-  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
-}
-@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
-`;
-let modal = null;
-function getModal() {
-    if (modal)
-        return modal;
-    const root = document.createElement("div");
-    root.setAttribute("data-bounded-widget", "");
-    const shadow = root.attachShadow({ mode: "open" });
-    const style = document.createElement("style");
-    style.textContent = OVERLAY_CSS;
-    shadow.appendChild(style);
-    const overlay = document.createElement("div");
-    overlay.className = "bw-ov";
-    const back = document.createElement("div");
-    back.className = "bw-back";
-    const wrap = document.createElement("div");
-    wrap.className = "bw-wrap";
-    const panel = document.createElement("div");
-    panel.className = "bw-panel";
-    const content = document.createElement("div");
-    content.className = "bw-content";
-    panel.appendChild(content);
-    for (const corner of ["tl", "tr", "bl", "br"]) {
-        const mk = document.createElement("span");
-        mk.className = "bw-mk " + corner;
-        panel.appendChild(mk);
-    }
-    wrap.appendChild(panel);
-    overlay.appendChild(back);
-    overlay.appendChild(wrap);
-    shadow.appendChild(overlay);
-    (document.body || document.documentElement).appendChild(root);
-    const m = {
-        root,
-        overlay,
-        panel,
-        content,
-        iframe: null,
-        iframeOrigin: "",
-        iframeReady: false,
-        onBackdrop: null,
-        onIframeMessage: null,
-        chain: Promise.resolve(),
-        fitObserver: null,
-        generation: 0,
-        onSupersede: null,
-    };
-    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
-    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
-    // outside the panel. Fire only when the click lands on the wrap itself, never
-    // when it bubbles up from the panel or its content.
-    wrap.addEventListener("click", (event) => {
-        if (event.target === wrap && m.onBackdrop)
-            m.onBackdrop();
-    });
-    window.addEventListener("message", (event) => {
-        if (!m.iframe)
-            return;
-        if (event.origin !== m.iframeOrigin)
-            return;
-        if (event.source !== m.iframe.contentWindow)
-            return;
-        const d = event.data;
-        if (!d || typeof d !== "object")
-            return;
-        if (m.onIframeMessage)
-            m.onIframeMessage(d);
-    });
-    modal = m;
-    return m;
+    return currentUser;
 }
-function showModal(m) {
-    m.overlay.classList.remove("closing");
-    m.overlay.classList.add("mounted");
-    // Force a reflow so the .show transition runs from the hidden state every open.
-    void m.panel.offsetWidth;
-    m.overlay.classList.add("show");
+function onAuthStateChanged(callback) {
+    authStateListeners.push(callback);
+    if (initCompleted || hasRunFirstTime) {
+        // Call the callback immediately with the current user.
+        // We check hasRunFirstTime in addition to initCompleted to handle the race
+        // where the Phantom auto-login effect calls setCurrentUser() before init()
+        // finishes. Without this, listeners registered between auto-login's
+        // setCurrentUser and init()'s initCompleted would never fire (init's
+        // setCurrentUser is a no-op for same-address and initCompleted is still false).
+        callback(currentUser);
+    }
+    return () => {
+        authStateListeners = authStateListeners.filter((listener) => listener !== callback);
+    };
 }
-function hideModal(m, after) {
-    m.overlay.classList.remove("show");
-    m.overlay.classList.add("closing");
-    // Capture the generation at hide time. If a newer open re-shows the modal within
-    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the
-    // freshly reopened widget - only tear down when we are still the same open.
-    const gen = m.generation;
-    window.setTimeout(() => {
-        if (m.generation === gen)
-            m.overlay.classList.remove("mounted", "closing");
-    }, 260);
+function onAuthLoadingChanged(callback) {
+    authLoadingListeners.push(callback);
+    // Call immediately with current loading state
+    callback(isAuthLoading);
+    return () => {
+        authLoadingListeners = authLoadingListeners.filter((listener) => listener !== callback);
+    };
 }
-function setPanelHeight(m, px) {
-    const h = Math.max(140, Math.min(680, Math.round(px)));
-    m.panel.style.height = h + "px";
+function setAuthLoading(loading) {
+    if (isAuthLoading !== loading) {
+        isAuthLoading = loading;
+        authLoadingListeners.forEach((callback) => callback(loading));
+    }
 }
-// True outer height of the mounted card: the max of its padding-box scroll height
-// (catches overflowing descendants) and its border-box height plus own vertical
-// margins (catches border + margins, which scrollHeight omits). Ceiled so a
-// sub-pixel row is never clipped under `overflow:hidden`.
-function measureOuterHeight(target) {
-    var _a;
-    const cs = (_a = target.ownerDocument.defaultView) === null || _a === void 0 ? void 0 : _a.getComputedStyle(target);
-    const marginY = cs ? parseFloat(cs.marginTop) + parseFloat(cs.marginBottom) : 0;
-    const borderBox = target.offsetHeight + (Number.isFinite(marginY) ? marginY : 0);
-    const rect = target.getBoundingClientRect().height;
-    return Math.ceil(Math.max(target.scrollHeight, borderBox, rect));
+function getAuthLoading() {
+    return isAuthLoading;
 }
-/**
- * Measure the currently mounted native content and tween the panel to fit it.
- * Re-fits automatically when the card's intrinsic height changes - notably after
- * the Newsreader/Schibsted web fonts swap in (which grows line boxes a few px
- * after first paint) and on inline view swaps (email -> OTP code -> success).
- */
-function fitPanelToContent(m) {
-    var _a, _b;
-    const first = m.content.firstElementChild;
-    const target = first || m.content;
-    const apply = () => {
-        // Only fit while this exact node is still the mounted card.
-        if (m.content.firstElementChild !== first && first)
-            return;
-        const h = measureOuterHeight(target);
-        if (h > 0)
-            setPanelHeight(m, h);
-    };
-    apply();
-    const view = target.ownerDocument.defaultView;
-    // Re-fit after fonts load (one-shot) and once the ResizeObserver-less browsers
-    // have painted, so the height never lags a late reflow.
-    (_a = view === null || view === void 0 ? void 0 : view.requestAnimationFrame) === null || _a === void 0 ? void 0 : _a.call(view, apply);
-    const fonts = target.ownerDocument.fonts;
-    if (fonts === null || fonts === void 0 ? void 0 : fonts.ready)
-        fonts.ready.then(apply).catch(() => { });
-    (_b = m.fitObserver) === null || _b === void 0 ? void 0 : _b.disconnect();
-    m.fitObserver = null;
-    if (first && typeof (view === null || view === void 0 ? void 0 : view.ResizeObserver) === "function") {
-        const ro = new view.ResizeObserver(() => apply());
-        ro.observe(first);
-        m.fitObserver = ro;
+async function login(options) {
+    if (!authProviderInstance) {
+        throw new Error('SDK not initialized. Please call init() first.');
     }
+    const loggedInUser = await login$1(options);
+    setCurrentUser(loggedInUser);
+    return currentUser;
 }
-/** Switch the modal into NATIVE-content mode: detach any iframe, mount `node`. */
-function mountContent(m, node) {
-    var _a;
-    detachIframe(m);
-    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-    m.fitObserver = null;
-    m.content.replaceChildren(node);
-    m.content.style.display = "block";
+async function logout(options) {
+    if (!authProviderInstance) {
+        throw new Error('SDK not initialized. Please call init() first.');
+    }
+    await logout$1(options);
+    setCurrentUser(null);
 }
-/**
- * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
- * whether there was one. Logout needs this: a signing session can live in that document's
- * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
- * throwaway iframe opened by the sweep can only ever clear the shared store, never another
- * document's memory. Removing the iframe discards its browsing context, which takes the
- * mirror with it.
- *
- * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
- * every logout of every app, most of which never mounted one.
- */
-function detachWarmSignerIframe(origin) {
-    if (!modal || !modal.iframe || modal.iframeOrigin !== origin)
-        return false;
-    detachIframe(modal);
-    return true;
+var hasRunFirstTime = false;
+function userPrincipalKey(user) {
+    var _a, _b, _c;
+    if (!user)
+        return null;
+    return (_c = (_b = (_a = user.id) !== null && _a !== void 0 ? _a : user.address) !== null && _b !== void 0 ? _b : user.email) !== null && _c !== void 0 ? _c : null;
 }
-function detachIframe(m) {
-    if (m.iframe) {
-        try {
-            m.iframe.remove();
-        }
-        catch (_a) {
-            /* ignore */
+// Update the currentUser and notify listeners
+function setCurrentUser(user) {
+    // Enrich with the universal identity fields (id/email) derived from the
+    // active session's idToken — central chokepoint so every provider's user
+    // object gains { id, address, email } without each construction site
+    // having to set them.
+    user = withUserIdentity(user);
+    const lastUser = currentUser;
+    const wasInitializedBefore = hasRunFirstTime;
+    const lastPrincipal = userPrincipalKey(currentUser);
+    const nextPrincipal = userPrincipalKey(user);
+    const shouldRunListeners = !hasRunFirstTime || lastPrincipal !== nextPrincipal;
+    hasRunFirstTime = true;
+    currentUser = user;
+    if (shouldRunListeners) {
+        // Isolate each listener: a consumer callback that throws (during logout in
+        // particular) must not abort the notification loop OR skip the socket reopen
+        // below. Before this, a single throwing listener propagated out of
+        // setCurrentUser, so the realtime socket kept streaming as the signed-out
+        // user and the other listeners were never told the principal changed.
+        authStateListeners.forEach((callback) => {
+            try {
+                callback(user);
+            }
+            catch (error) {
+                console.error('Error in onAuthStateChanged listener:', error);
+            }
+        });
+        // Reconnect WebSocket connections with new auth when user changes.
+        // Skip on the first setCurrentUser call during init() — there are no
+        // existing connections to reconnect at that point.
+        if (wasInitializedBefore && userPrincipalKey(lastUser) !== nextPrincipal) {
+            core.reconnectWithNewAuth().catch((error) => {
+                console.error('Error reconnecting WebSocket after auth change:', error);
+            });
         }
     }
-    m.iframe = null;
-    m.iframeReady = false;
-    m.iframeOrigin = "";
-    m.onIframeMessage = null;
+    // Return this commit's normalized snapshot. A listener can start another
+    // login, so the mutable currentUser may already belong to a newer session.
+    return user;
 }
-// Load the Bounded editorial typefaces (Newsreader display + Schibsted Grotesk body +
-// JetBrains Mono) once at the document level so they apply inside the shadow root. A
-// no-op if already present or off-DOM. Fonts loaded here match the hosted auth page.
-const FONTS_HREF = "https://fonts.googleapis.com/css2?family=Newsreader:opsz,wght@6..72,400;6..72,500&family=Schibsted+Grotesk:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap";
-function ensureFonts() {
-    if (!hasDOM$2())
-        return;
-    if (document.querySelector('link[data-bounded-fonts="1"]'))
-        return;
-    const pre1 = document.createElement("link");
-    pre1.rel = "preconnect";
-    pre1.href = "https://fonts.googleapis.com";
-    const pre2 = document.createElement("link");
-    pre2.rel = "preconnect";
-    pre2.href = "https://fonts.gstatic.com";
-    pre2.crossOrigin = "anonymous";
-    const link = document.createElement("link");
-    link.rel = "stylesheet";
-    link.href = FONTS_HREF;
-    link.setAttribute("data-bounded-fonts", "1");
-    document.head.append(pre1, pre2, link);
+function getCurrentUser() {
+    return currentUser;
+}
+/** @internal Snapshot/restore surface for transactional auth-provider switches. */
+function getAuthProviderInstance() {
+    return authProviderInstance;
+}
+function setAuthProviderInstance(provider) {
+    authProviderInstance = provider;
 }
-
-var boundedWidgetModal = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    detachIframe: detachIframe,
-    detachWarmSignerIframe: detachWarmSignerIframe,
-    ensureFonts: ensureFonts,
-    fitPanelToContent: fitPanelToContent,
-    getModal: getModal,
-    hasDOM: hasDOM$2,
-    hideModal: hideModal,
-    mountContent: mountContent,
-    setPanelHeight: setPanelHeight,
-    showModal: showModal
-});
 
 // bounded-widget-ownership.ts - per-open ownership generation for the singleton
 // login/signing modal (bounded-widget-modal.ts).
@@ -7519,7 +7743,7 @@ async function startTurnkeyEmailLogin(email) {
     const res = await fetch(`${base}/wallet/turnkey/auth/init`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ email: trimmed, appId }),
+        body: JSON.stringify({ email: trimmed, appId, walletProtocol: 2 }),
     });
     const data = await res.json().catch(() => null);
     if (!res.ok || !data || typeof data.otpId !== 'string' || typeof data.otpEncryptionTargetBundle !== 'string') {
@@ -7531,13 +7755,21 @@ async function startTurnkeyEmailLogin(email) {
     // (there is nothing to bind the frame key to), which is the correct fail-closed posture.
     const ceremonyId = typeof data.ceremonyId === 'string' ? data.ceremonyId : '';
     const signerOrigin = new URL(base).origin;
+    if (data.walletScope !== 'app' && data.walletScope !== 'legacy')
+        throw new Error('wallet_scope_config_unavailable');
+    if (data.walletProtocol !== (data.walletScope === 'app' ? 2 : 1))
+        throw new Error('wallet_protocol_invalid');
+    const frameUrl = data.walletScope === 'app'
+        ? `${base.replace(/\/$/, '')}/wallet/turnkey/app/${appId}/signer?origin=${encodeURIComponent(window.location.origin)}`
+        : undefined;
     return {
-        email: trimmed,
-        run(iframe) {
+        email: trimmed, frameUrl, signerOrigin,
+        run(iframe, signal) {
             if (!ceremonyId) {
                 return Promise.reject(new Error('This app is not configured for in-frame wallet login. Please try again.'));
             }
-            return runOtpFrame({ iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId });
+            const run = { iframe, base, signerOrigin, appId, email: trimmed, otpId, otpEncryptionTargetBundle, ceremonyId };
+            return frameUrl ? runScopedOtpFrame(run, frameUrl, signal) : runOtpFrame(run);
         },
     };
 }
@@ -7566,6 +7798,12 @@ function runOtpFrame(run) {
             const d = event.data;
             if (!d || typeof d !== 'object')
                 return;
+            if (d.type === 'bounded:otp:resize') {
+                if (typeof d.height === 'number' && Number.isFinite(d.height) && d.height > 0) {
+                    run.iframe.style.height = `${Math.max(140, Math.min(680, Math.ceil(d.height)))}px`;
+                }
+                return;
+            }
             if (d.type === 'bounded:otp:ready') {
                 if (started)
                     return;
@@ -7615,8 +7853,7 @@ function runOtpFrame(run) {
                 reject(new Error(String((d && d.error) || 'Invalid or expired code.')));
                 return;
             }
-            // 'bounded:otp:resize' / 'bounded:otp:registered' are advisory; the widget host may size the
-            // frame from resize, but login does not depend on them.
+            // 'bounded:otp:registered' is advisory; login does not depend on it.
         };
         const post = (msg) => {
             var _a;
@@ -7637,6 +7874,104 @@ function runOtpFrame(run) {
         run.iframe.src = url;
     });
 }
+// The scoped document owns both OTP and signing. Adopt only its sanitized app
+// session, acknowledge with a narrow grant, then wait for wallet readiness.
+function runScopedOtpFrame(run, frameUrl, signal) {
+    const assertCurrent = walletLoginGuard(signal);
+    const beforeStore = core.getActiveSessionManager().captureSessionEstablishment();
+    return new Promise((resolve, reject) => {
+        let settled = false, adopting = false, started = false;
+        let user = null;
+        let adoptedToken = '';
+        let context = null;
+        const post = (data) => { var _a; return (_a = run.iframe.contentWindow) === null || _a === void 0 ? void 0 : _a.postMessage(data, run.signerOrigin); };
+        const cleanup = () => {
+            settled = true;
+            clearTimeout(timer);
+            window.removeEventListener('message', onMessage);
+            signal === null || signal === void 0 ? void 0 : signal.removeEventListener('abort', abort);
+        };
+        const fail = (error) => { cleanup(); reject(error instanceof Error ? error : new Error(String(error))); };
+        const abort = () => { post({ type: 'bounded:otp:cancel' }); fail(new Error('wallet_login_cancelled')); };
+        const finish = (ready, reason, expiresAt) => {
+            if (!user || !context || core.getActiveSessionManager().getIdToken() !== adoptedToken) {
+                fail(new Error('wallet_session_changed'));
+                return;
+            }
+            setWalletSessionState(context.key, ready && Number.isFinite(expiresAt) && expiresAt > Date.now()
+                ? { status: 'ready', expiresAt: expiresAt } : { status: 'verification-required', reason });
+            cleanup();
+            resolve(user);
+        };
+        const onMessage = async (event) => {
+            if (settled || event.origin !== run.signerOrigin || event.source !== run.iframe.contentWindow)
+                return;
+            const d = event.data;
+            if (!d || typeof d !== 'object')
+                return;
+            if (d.type === 'bounded:otp:ready' && !started) {
+                started = true;
+                post({ type: 'bounded:otp:start', email: run.email, ceremonyId: run.ceremonyId,
+                    otpId: run.otpId, otpEncryptionTargetBundle: run.otpEncryptionTargetBundle });
+            }
+            if (d.type === 'bounded:otp:wallet-ready' && user) {
+                finish(d.ok === true, typeof d.error === 'string' ? d.error : 'wallet_session_unavailable', d.expiresAt);
+            }
+            if (d.type !== 'bounded:otp:result' || adopting)
+                return;
+            if (d.ok !== true || !d.session || typeof d.session.idToken !== 'string') {
+                fail(new Error(String(d.error || 'wallet_login_failed')));
+                return;
+            }
+            adopting = true;
+            try {
+                assertCurrent();
+                const token = d.session.idToken;
+                const claims = JSON.parse(getPlatform().atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')));
+                context = walletContextFromClaims(claims, run.base, run.appId, window.location.origin);
+                if (context.scope !== 'app')
+                    throw new Error('wallet_scope_mismatch');
+                user = await establishInlineSession(d.session, () => { assertCurrent(); if (settled)
+                    throw new Error('wallet_login_cancelled'); }, beforeStore);
+                adoptedToken = token;
+                bindWarmSignerFrame(run.iframe, context.key);
+                if (settled || (signal === null || signal === void 0 ? void 0 : signal.aborted) || core.getActiveSessionManager().getIdToken() !== token)
+                    throw new Error('wallet_session_changed');
+                setWalletSessionState(context.key, { status: 'verification-required', reason: 'wallet_session_pending' });
+                const authorization = await requestTurnkeyActionAuthorization({
+                    baseUrl: run.base, idToken: token, action: 'createWallet', fetchImpl: (u, i) => fetch(u, i),
+                });
+                if (settled || core.getActiveSessionManager().getIdToken() !== token)
+                    throw new Error('wallet_session_changed');
+                post({ type: 'bounded:otp:authorization', authorization });
+            }
+            catch (error) {
+                if (user && adoptedToken) {
+                    post({ type: 'bounded:otp:authorization', authorization: '' });
+                    finish(false, 'wallet_session_unavailable');
+                }
+                else
+                    fail(error);
+            }
+        };
+        const timer = setTimeout(() => {
+            if (user)
+                finish(false, 'wallet_session_timeout');
+            else
+                fail(new Error('The sign-in code entry timed out. Please try again.'));
+        }, 180000);
+        window.addEventListener('message', onMessage);
+        signal === null || signal === void 0 ? void 0 : signal.addEventListener('abort', abort, { once: true });
+        if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+            abort();
+            return;
+        }
+        if (run.iframe.src !== frameUrl)
+            run.iframe.src = frameUrl;
+        // Readiness can predate listener installation when reusing a mounted frame.
+        post({ type: 'bounded:otp:hello' });
+    });
+}
 
 // bounded-login-widget.ts - the UNIFIED Bounded login surface: one in-app card
 // (Shadow-DOM modal from bounded-widget-modal.ts, Bounded look + motion) that folds
@@ -7860,7 +8195,7 @@ function untilCancelled(work, pending) {
  * run first; call from a user gesture so social/wallet popups are allowed.
  */
 async function openBoundedWidget(opts = {}) {
-    if (!hasDOM$2()) {
+    if (!hasDOM$5()) {
         throw new Error("openBoundedWidget is web-only - on React Native use loginWithRedirect()");
     }
     // Registered before the first await - see PendingOpen.
@@ -8022,6 +8357,7 @@ async function prepareAndOpen(opts, pending) {
         // the underlying promise SETTLES, whoever owns the card by then.
         let attemptSeq = 0;
         let activeAttempt = 0;
+        let abortScopedLogin = null;
         let abortGesture = null;
         /** Reject a gesture promise already waiting on a view that is going away. */
         const abortPendingGesture = () => {
@@ -8053,6 +8389,8 @@ async function prepareAndOpen(opts, pending) {
         /** Take the card back (Back, a lane switch, settling the modal). Deliberately
          *  NOT a release: the login underneath keeps running - see above. */
         const invalidateAttempts = () => {
+            abortScopedLogin === null || abortScopedLogin === void 0 ? void 0 : abortScopedLogin();
+            abortScopedLogin = null;
             activeAttempt = 0;
             abortPendingGesture();
         };
@@ -8105,7 +8443,8 @@ async function prepareAndOpen(opts, pending) {
         m.onBackdrop = cancel;
         const style = el("style");
         style.textContent = CARD_CSS;
-        const renderChoose = () => {
+        let emailDraft = "";
+        const renderChoose = (initialError) => {
             const card = el("div", "c");
             card.appendChild(style.cloneNode(true));
             const x = el("button", "x", "Close");
@@ -8115,13 +8454,15 @@ async function prepareAndOpen(opts, pending) {
             card.appendChild(x);
             card.appendChild(el("h1", undefined, title !== null && title !== void 0 ? title : "Sign in"));
             if (subtitle !== "") {
-                card.appendChild(el("p", "sub", subtitle !== null && subtitle !== void 0 ? subtitle : "One account and wallet across every Bounded app."));
+                card.appendChild(el("p", "sub", subtitle !== null && subtitle !== void 0 ? subtitle : "Sign in to continue to this app."));
             }
             const status = el("div", "status");
             const setErr = (msg) => {
                 status.textContent = msg;
                 status.classList.add("err");
             };
+            if (initialError)
+                setErr(initialError);
             const setBusy = (btn, label) => {
                 status.classList.remove("err");
                 status.textContent = "";
@@ -8139,6 +8480,8 @@ async function prepareAndOpen(opts, pending) {
                 input.autocomplete = "email";
                 input.placeholder = "you@example.com";
                 input.required = true;
+                input.value = emailDraft;
+                input.addEventListener("input", () => { emailDraft = input.value; });
                 const submit = el("button", "btn primary");
                 submit.type = "submit";
                 submit.textContent = "Continue";
@@ -8147,6 +8490,7 @@ async function prepareAndOpen(opts, pending) {
                     e.preventDefault();
                     if (!input.value)
                         return;
+                    emailDraft = input.value;
                     // Starting another lane takes the card from a wallet attempt still
                     // preparing, and this lane holds the lock until its own request
                     // settles - otherwise a failed email login would keep every other lane
@@ -8162,11 +8506,39 @@ async function prepareAndOpen(opts, pending) {
                         // arrives; the code entry claims its own when the user verifies.
                         setBusy(submit, "Sending code\u2026");
                         startTurnkeyEmailLogin(input.value)
-                            .then((handle) => { if (settleAttempt(attempt))
-                            swap(renderOtpFrame(handle)); })
+                            .then(async (handle) => {
+                            if (!attemptIsCurrent(attempt)) {
+                                settleAttempt(attempt);
+                                return;
+                            }
+                            if (!handle.frameUrl || !handle.signerOrigin) {
+                                if (settleAttempt(attempt))
+                                    swap(renderOtpFrame(handle));
+                                return;
+                            }
+                            const controller = new AbortController();
+                            abortScopedLogin = () => controller.abort();
+                            // Mount once in the shared modal. Moving a live iframe would discard
+                            // the trusted document holding the private in-memory session key.
+                            detachIframe(m);
+                            const frame = ensureIframe(m, handle.frameUrl, handle.signerOrigin, `login:${attempt}`);
+                            setPanelHeight(m, 380);
+                            const completion = handle.run(frame, controller.signal);
+                            m.chain = completion.then(() => undefined, () => undefined);
+                            const user = await completion;
+                            abortScopedLogin = null;
+                            settleAttempt(attempt);
+                            succeed(user);
+                        })
                             .catch((err) => {
                             if (!settleAttempt(attempt))
                                 return;
+                            if (abortScopedLogin) {
+                                abortScopedLogin = null;
+                                detachIframe(m);
+                                swap(renderChoose(errText(err)));
+                                return;
+                            }
                             submit.disabled = false;
                             submit.textContent = "Continue";
                             setErr(errText(err));
@@ -8176,6 +8548,7 @@ async function prepareAndOpen(opts, pending) {
                     setBusy(submit, "Opening secure sign-in\u2026");
                     const emailOpts = {
                         provider: "email",
+                        prompt: "login",
                         loginHint: input.value,
                         redirectUri: opts.redirectUri,
                     };
@@ -8457,13 +8830,11 @@ async function prepareAndOpen(opts, pending) {
             const back = el("button", "back", "\u2190 Back");
             back.type = "button";
             card.appendChild(back);
-            card.appendChild(el("h1", undefined, "Enter your code"));
-            card.appendChild(el("p", "sub", `We sent a 6-digit code to ${handle.email}.`));
             const status = el("div", "status");
             const setErr = (msg) => { status.textContent = msg; status.classList.add("err"); };
             // The Bounded-origin OTP frame. Its route restricts frame-ancestors to this exact origin, so
-            // only this app may embed it; the code + the P-256 key never leave it into this realm. A fixed
-            // height comfortably fits the frame's code card (heading + input + button + status).
+            // only this app may embed it; the code + the P-256 key never leave it into this realm.
+            // Its trusted resize messages fit the heading, input, and any error copy.
             const frame = document.createElement("iframe");
             frame.setAttribute("title", "Enter your code");
             frame.style.cssText = "width:100%;height:210px;border:0;background:transparent;color-scheme:dark";
@@ -10163,6 +10534,8 @@ exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
 exports.getOrCreateTurnkeyWallet = getOrCreateTurnkeyWallet;
 exports.getPlatform = getPlatform;
+exports.getTurnkeyWalletRecoveryUrl = getTurnkeyWalletRecoveryUrl;
+exports.getTurnkeyWalletSessionState = getTurnkeyWalletSessionState;
 exports.hasTurnkeyWallet = hasTurnkeyWallet;
 exports.init = init;
 exports.login = login;
@@ -10198,4 +10571,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index-Bb7I-AoO.js.map
+//# sourceMappingURL=index-DUVRmF9-.js.map