@bounded-sh/client 0.0.98 → 0.0.100-performance.0

package/dist/{index.native-gVbAsohv.mjs → index.native-r1I-9E8e.mjs}

@@ -1,6 +1,42 @@
 import { getConfig, getActiveSessionManager, WebSessionManager, ReactNativeSessionManager, revokeSession, init as init$1, reconnectWithNewAuth, onSessionCleared, deriveUserIdentityFromIdToken, subscribe, getFreshAuthToken, getSessionGeneration, getIdToken as getIdToken$1, genAuthNonce, genSolanaMessage, createSessionWithSignature } from '@bounded-sh/core';
 import * as React from 'react';
 
+function walletContextFromClaims(claims, baseUrl, expectedAppId, tenantOrigin) {
+    const base = baseUrl.replace(/\/$/, '');
+    const scope = claims['custom:walletScope'];
+    const protocol = claims['custom:walletProtocol'];
+    if (scope !== undefined && scope !== 'legacy' && scope !== 'app')
+        throw new Error('wallet_scope_invalid');
+    if ((scope === 'app' && protocol !== 2) || (scope === 'legacy' && protocol !== 1)
+        || (scope === undefined && protocol !== undefined))
+        throw new Error('wallet_protocol_invalid');
+    const appId = claims['custom:appId'];
+    const userId = claims['custom:userId'];
+    const address = claims['custom:walletAddress'];
+    if (scope === 'app' && (appId !== expectedAppId || typeof appId !== 'string'
+        || !/^[a-f0-9]{24}$/.test(appId) || typeof userId !== 'string' || !userId
+        || claims.iss !== base))
+        throw new Error('wallet_session_context_invalid');
+    const resolvedScope = scope === 'app' ? 'app' : 'legacy';
+    const route = resolvedScope === 'app' ? `/wallet/turnkey/app/${appId}` : '/wallet/turnkey';
+    return {
+        scope: resolvedScope, appId: String(appId || expectedAppId), userId: String(userId || ''),
+        address: typeof address === 'string' ? address : '', base, origin: new URL(base).origin,
+        url: `${base}${route}/signer${resolvedScope === 'app' ? `?origin=${encodeURIComponent(tenantOrigin)}` : ''}`,
+        key: JSON.stringify([base, appId || expectedAppId, userId || '', address || '', resolvedScope]),
+    };
+}
+let loginGeneration = 0;
+function invalidatePendingWalletLogin() { ++loginGeneration; }
+function walletOperationGuard() {
+    const generation = loginGeneration;
+    return () => {
+        if (generation !== loginGeneration)
+            throw new Error('wallet_session_changed');
+    };
+}
+function setWalletSessionState(key, state) { }
+
 /**
  * Platform abstraction layer for React Native compatibility.
  *
@@ -944,7 +980,10 @@ function registerAuthRegistrySync(fn) {
  * Returns the normalized user published by this commit, or null when omitted.
  */
 async function adoptSessionProvider(opts) {
+    var _a;
     const coreConfig = await getConfig();
+    (_a = opts.beforeCommit) === null || _a === void 0 ? void 0 : _a.call(opts);
+    invalidatePendingWalletLogin();
     coreConfig.authProvider = opts.provider;
     coreConfig.authMethod = opts.method;
     setAuthProviderInstance(opts.provider);
@@ -4167,6 +4206,336 @@ async function ensureSolanaMobileWalletRegistered(config, network) {
 
 var bufferExports = requireBuffer();
 
+// bounded-widget-modal.ts - the shared in-app WIDGET shell for Bounded's login
+// and signing surfaces. One Shadow-DOM overlay + panel that matches the Bounded
+// widget (Seal) look and MOTION: a backdrop fade, a panel rise on desktop, a
+// bottom-sheet on mobile, a height tween as content swaps, and a clean close.
+//
+// It hosts EITHER:
+//   - NATIVE content (the login card the SDK renders itself), or
+//   - an IFRAME (the Bounded-owned signer page, which must run on the single
+//     signer origin because the wallet's 24h signing session lives in that
+//     origin's storage, out of every app's reach).
+//
+// The modal is a warm singleton: it stays mounted (hidden) between uses so a
+// second open - or a signature right after login - is instant and, when it is
+// already open, a clean in-place view swap rather than a reopen.
+function hasDOM$4() {
+    return typeof window !== "undefined" && typeof document !== "undefined";
+}
+const OVERLAY_CSS = `
+:host{all:initial}
+*{box-sizing:border-box}
+.bw-ov{position:fixed;inset:0;z-index:2147483647;display:none;
+  font-family:"Schibsted Grotesk","Helvetica Neue",Arial,sans-serif}
+.bw-ov.mounted{display:block}
+.bw-back{position:fixed;inset:0;background:rgba(4,4,5,.62);opacity:0;
+  transition:opacity .24s ease;-webkit-backdrop-filter:blur(5px);backdrop-filter:blur(5px)}
+.bw-wrap{position:fixed;inset:0;display:flex;align-items:center;justify-content:center;padding:20px}
+.bw-panel{position:relative;width:420px;max-width:calc(100vw - 28px);height:280px;
+  border-radius:14px;overflow:hidden;background:#0e0f11;border:1px solid rgba(232,230,222,.08);
+  box-shadow:0 1px 0 rgba(232,230,222,.03) inset,0 40px 90px -45px rgba(0,0,0,.85);
+  opacity:0;transform:translateY(14px) scale(.98);will-change:transform,opacity,height;
+  transition:opacity .28s cubic-bezier(.2,.8,.2,1),transform .28s cubic-bezier(.2,.8,.2,1),
+    height .3s cubic-bezier(.2,.8,.2,1)}
+.bw-ov.show .bw-back{opacity:1}
+.bw-ov.show .bw-panel{opacity:1;transform:none}
+.bw-ov.closing .bw-back{opacity:0}
+.bw-ov.closing .bw-panel{opacity:0;transform:translateY(12px) scale(.99)}
+.bw-content{position:absolute;inset:0;overflow:hidden}
+.bw-frame{display:block;width:100%;height:100%;border:0;background:transparent;color-scheme:dark}
+/* editorial corner crop-marks, matching the reference frame */
+.bw-mk{position:absolute;width:13px;height:13px;pointer-events:none;z-index:2;
+  border-color:rgba(232,230,222,.22);border-style:solid;border-width:0}
+.bw-mk.tl{top:11px;left:11px;border-top-width:1px;border-left-width:1px}
+.bw-mk.tr{top:11px;right:11px;border-top-width:1px;border-right-width:1px}
+.bw-mk.bl{bottom:11px;left:11px;border-bottom-width:1px;border-left-width:1px}
+.bw-mk.br{bottom:11px;right:11px;border-bottom-width:1px;border-right-width:1px}
+@media(max-width:560px){
+  .bw-wrap{align-items:flex-end;padding:0}
+  .bw-panel{width:100%;max-width:100%;border-radius:18px 18px 0 0;border-bottom:0}
+  .bw-content{overflow-y:auto}
+  .bw-ov.show .bw-panel{transform:none}
+  .bw-ov:not(.show) .bw-panel,.bw-ov.closing .bw-panel{transform:translateY(18%)}
+}
+@media(prefers-reduced-motion:reduce){.bw-back,.bw-panel{transition:opacity .12s linear!important}}
+`;
+let modal = null;
+function getModal() {
+    if (modal)
+        return modal;
+    const root = document.createElement("div");
+    root.setAttribute("data-bounded-widget", "");
+    const shadow = root.attachShadow({ mode: "open" });
+    const style = document.createElement("style");
+    style.textContent = OVERLAY_CSS;
+    shadow.appendChild(style);
+    const overlay = document.createElement("div");
+    overlay.className = "bw-ov";
+    const back = document.createElement("div");
+    back.className = "bw-back";
+    const wrap = document.createElement("div");
+    wrap.className = "bw-wrap";
+    const panel = document.createElement("div");
+    panel.className = "bw-panel";
+    const content = document.createElement("div");
+    content.className = "bw-content";
+    panel.appendChild(content);
+    for (const corner of ["tl", "tr", "bl", "br"]) {
+        const mk = document.createElement("span");
+        mk.className = "bw-mk " + corner;
+        panel.appendChild(mk);
+    }
+    wrap.appendChild(panel);
+    overlay.appendChild(back);
+    overlay.appendChild(wrap);
+    shadow.appendChild(overlay);
+    (document.body || document.documentElement).appendChild(root);
+    const m = {
+        root,
+        overlay,
+        panel,
+        content,
+        iframe: null,
+        iframeOrigin: "",
+        iframeReady: false,
+        iframeContext: "",
+        onBackdrop: null,
+        onIframeMessage: null,
+        chain: Promise.resolve(),
+        fitObserver: null,
+        generation: 0,
+        onSupersede: null,
+    };
+    // The dismiss handler lives on `.bw-wrap`: it is the full-viewport flex layer
+    // that sits ABOVE `.bw-back`, so it (not the backdrop element) receives clicks
+    // outside the panel. Fire only when the click lands on the wrap itself, never
+    // when it bubbles up from the panel or its content.
+    wrap.addEventListener("click", (event) => {
+        if (event.target === wrap && m.onBackdrop)
+            m.onBackdrop();
+    });
+    window.addEventListener("message", (event) => {
+        if (!m.iframe)
+            return;
+        if (event.origin !== m.iframeOrigin)
+            return;
+        if (event.source !== m.iframe.contentWindow)
+            return;
+        const d = event.data;
+        if (!d || typeof d !== "object")
+            return;
+        // Readiness belongs to the document, even while login owns the modal and no
+        // signing exchange is listening. The retained frame will not load again.
+        if (d.type === "bounded:turnkey:ready")
+            m.iframeReady = true;
+        if (m.onIframeMessage)
+            m.onIframeMessage(d);
+    });
+    modal = m;
+    return m;
+}
+function showModal(m) {
+    m.overlay.classList.remove("closing");
+    m.overlay.classList.add("mounted");
+    // Force a reflow so the .show transition runs from the hidden state every open.
+    void m.panel.offsetWidth;
+    m.overlay.classList.add("show");
+}
+function hideModal(m, after) {
+    m.overlay.classList.remove("show");
+    m.overlay.classList.add("closing");
+    // Capture the generation at hide time. If a newer open re-shows the modal within
+    // the close tween, this stale timer must NOT strip `.mounted`/`.closing` off the
+    // freshly reopened widget - only tear down when we are still the same open.
+    const gen = m.generation;
+    window.setTimeout(() => {
+        if (m.generation === gen)
+            m.overlay.classList.remove("mounted", "closing");
+    }, 260);
+}
+function setPanelHeight(m, px) {
+    const h = Math.max(140, Math.min(680, Math.round(px)));
+    m.panel.style.height = h + "px";
+}
+/** Get (or lazily create) the warm iframe for signer/hosted-page mode. */
+function ensureIframe(m, url, origin, context = "") {
+    var _a;
+    if (m.iframe && m.iframeOrigin === origin && m.iframe.src === url && m.iframeContext === context)
+        return m.iframe;
+    detachIframe(m);
+    (_a = m.fitObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    m.fitObserver = null;
+    m.content.style.display = "none";
+    const iframe = document.createElement("iframe");
+    iframe.className = "bw-frame";
+    iframe.setAttribute("title", "Bounded");
+    iframe.setAttribute("allow", "clipboard-write");
+    iframe.src = url;
+    m.iframeOrigin = origin;
+    m.iframeContext = context;
+    m.iframeReady = false;
+    m.panel.appendChild(iframe);
+    m.iframe = iframe;
+    return iframe;
+}
+/**
+ * Destroy the warm signer iframe if one is currently mounted for `origin`, and report
+ * whether there was one. Logout needs this: a signing session can live in that document's
+ * MEMORY (the signer keeps an in-memory mirror when the browser blocks its storage), and a
+ * throwaway iframe opened by the sweep can only ever clear the shared store, never another
+ * document's memory. Removing the iframe discards its browsing context, which takes the
+ * mirror with it.
+ *
+ * Deliberately does NOT call getModal(): that would BUILD a modal just to tear it down, on
+ * every logout of every app, most of which never mounted one.
+ */
+function detachWarmSignerIframe(origin) {
+    if (!modal || !modal.iframe || (origin))
+        return false;
+    detachIframe(modal);
+    return true;
+}
+function detachIframe(m) {
+    if (m.iframe) {
+        try {
+            m.iframe.remove();
+        }
+        catch (_a) {
+            /* ignore */
+        }
+    }
+    m.iframe = null;
+    m.iframeReady = false;
+    m.iframeOrigin = "";
+    m.iframeContext = "";
+    m.onIframeMessage = null;
+}
+
+// turnkey-wallet-widget.ts - runs one Turnkey signer exchange inside the shared
+// in-app WIDGET (bounded-widget-modal.ts). The Bounded-owned signer page is loaded
+// in a warm iframe behind the modal so signing feels native: an in-app approve
+// card (with inline code entry when the 24h signing session must first be
+// established), never a jarring popup.
+//
+// WHY AN IFRAME: the wallet's signing session lives in the single Bounded signer
+// origin's storage, out of every app's reach, so signing MUST run on that origin;
+// the iframe brings it in-app.
+//
+// Restricted embedders: if the frame never loads, the SAME request reruns through
+// `popupFallback` (a real window). Callers pass a popup implementation and never
+// see the difference.
+/**
+ * Run one signer exchange through the in-app widget. Resolves when `onResult`
+ * accepts a result; falls back to `popupFallback` if the frame cannot be mounted
+ * or never loads.
+ */
+async function runWidget(url, signerOrigin, ex, popupFallback) {
+    if (!hasDOM$4())
+        return popupFallback();
+    const m = getModal();
+    const requestId = String(ex.request.requestId);
+    // Serialize: the approve card is modal, and one warm frame handles one request at a time.
+    const run = m.chain.then(() => new Promise((resolve, reject) => {
+        var _a;
+        let settled = false;
+        let usedFallback = false;
+        (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
+        const iframe = ensureIframe(m, url, signerOrigin, ex.context);
+        const send = () => {
+            var _a;
+            if (!iframe.contentWindow)
+                return;
+            try {
+                (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
+                iframe.contentWindow.postMessage(ex.request, signerOrigin);
+            }
+            catch (_b) {
+                finish(() => reject(new Error('wallet_session_changed')));
+            }
+        };
+        let loadTimer = 0;
+        let ceilingTimer = 0;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            m.onIframeMessage = null;
+            m.onBackdrop = null;
+            window.clearTimeout(loadTimer);
+            window.clearTimeout(ceilingTimer);
+            fn();
+        };
+        // The frame is WARM across exchanges, so an abandoned approval must be told to drop its
+        // in-flight ceremony. Otherwise the signer keeps `approving` set for a card nobody is
+        // looking at and refuses every later create/sign as `signer_request_superseded` (the
+        // BSA-2026-012 guard) until the page reloads.
+        const cancelInFrame = () => {
+            if (!iframe.contentWindow)
+                return;
+            try {
+                iframe.contentWindow.postMessage({ type: "bounded:turnkey:cancel", requestId }, signerOrigin);
+            }
+            catch (_a) {
+                /* frame gone */
+            }
+        };
+        const goFallback = () => {
+            if (usedFallback || settled)
+                return;
+            usedFallback = true;
+            hideModal(m);
+            finish(() => popupFallback().then(resolve, reject));
+        };
+        m.onBackdrop = () => {
+            cancelInFrame();
+            hideModal(m);
+            finish(() => reject(new Error("cancelled")));
+        };
+        m.onIframeMessage = (d) => {
+            if (d.type === "bounded:turnkey:ready") {
+                send();
+                return;
+            }
+            if (d.type === "bounded:turnkey:resize" && typeof d.height === "number") {
+                setPanelHeight(m, d.height);
+                return;
+            }
+            if (d.type === "bounded:turnkey:result" && d.requestId === requestId) {
+                const outcome = ex.onResult(d);
+                if ("error" in outcome) {
+                    hideModal(m);
+                    finish(() => reject(new Error(outcome.error)));
+                    return;
+                }
+                if (outcome.done) {
+                    hideModal(m);
+                    finish(() => resolve(outcome.value));
+                }
+            }
+        };
+        showModal(m);
+        if (m.iframeReady)
+            send();
+        // If the frame never loads, degrade to the popup (best-effort - a post-load
+        // popup may be blocked without a gesture, in which case the fallback rejects).
+        loadTimer = window.setTimeout(() => {
+            if (!m.iframeReady && !settled)
+                goFallback();
+        }, 8000);
+        // Absolute ceiling so a stuck flow cannot hang forever.
+        ceilingTimer = window.setTimeout(() => {
+            if (!settled) {
+                cancelInFrame();
+                hideModal(m);
+                finish(() => reject(new Error("Wallet approval timed out.")));
+            }
+        }, 5 * 60 * 1000);
+    }));
+    m.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+
 // turnkey-signer-frame.ts - a HIDDEN, offscreen iframe of the Bounded signer page
 // for UI-less signer exchanges: sealing a login code (bounded:turnkey:encryptOtp),
 // establishing the 24h signing session right after login
@@ -4186,10 +4555,10 @@ async function signerPage() {
     return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
 }
 /** Mount the hidden signer frame. Callers MUST dispose() when done. */
-async function openHiddenSignerFrame() {
+async function openHiddenSignerFrame(page) {
     if (!hasDOM$3())
         throw new Error('The Bounded signer frame is only available in the browser.');
-    const { url, origin } = await signerPage();
+    const { url, origin } = page !== null && page !== void 0 ? page : await signerPage();
     const frame = document.createElement('iframe');
     frame.setAttribute('aria-hidden', 'true');
     frame.style.cssText =
@@ -4284,7 +4653,7 @@ async function requestTurnkeySigningCapability(opts) {
         res = await opts.fetchImpl(`${base}/wallet/turnkey/capability`, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ idToken: opts.idToken, messageHex: opts.messageHex }),
+            body: JSON.stringify({ idToken: opts.idToken, messageHex: opts.messageHex, walletProtocol: 2 }),
         });
     }
     catch (_a) {
@@ -4336,7 +4705,7 @@ async function requestTurnkeyActionAuthorization(opts) {
         res = await opts.fetchImpl(`${base}/wallet/turnkey/action-authorization`, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ idToken: opts.idToken, action: opts.action }),
+            body: JSON.stringify({ idToken: opts.idToken, action: opts.action, walletProtocol: 2 }),
         });
     }
     catch (_a) {
@@ -4376,26 +4745,39 @@ async function requestTurnkeyActionAuthorization(opts) {
 // code is the sole signing authority; within a live session every signature is one
 // approval click). The app retains the transaction itself.
 //
-// ONE ORIGIN, ONE SESSION: the signing session lives in the signer origin's own
-// storage, out of every app's reach, so ALL Bounded apps (any subdomain / custom
-// domain) sign through this one origin - giving every user one wallet that roams
-// across every app.
+// Signing keys remain on the trusted signer origin. New apps use independently
+// bound wallets and storage slots; legacy apps retain their shared wallet.
 function hasDOM$2() {
     return typeof window !== 'undefined' && typeof document !== 'undefined';
 }
-// BSA-2026-006: dispatch every signing / get-or-create exchange through a TOP-LEVEL
-// POPUP the caller opened from the user gesture - NEVER a framed widget. An authorized
-// tenant that embedded the signer could overlay its predictable Approve control and steal
-// one concealed click into a fund-moving signature; a top-level window it cannot reach or
-// visually redress closes that. A blocked popup surfaces `popup_blocked` (runPopup) and we
-// never silently fall back to an iframe.
+// Dispatch one signer exchange through the in-app WIDGET, degrading to the POPUP
+// when we cannot embed (no DOM, or the frame never mounts/loads). Nothing in the
+// email-session flow needs a popup by preference: the code entry and the approval
+// click both run fine inside a cross-origin iframe on every engine (the old
+// Safari popup preference existed only for in-iframe WebAuthn CREATE).
 async function deliver(url, origin, ex) {
-    return runPopup(url, origin, ex);
-}
-async function turnkeySignerPage() {
+    var _a, _b;
+    const popup = () => runPopup(url, origin, ex);
+    (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
+    const result = await runWidget(url, origin, { request: ex.request, onResult: ex.onResult, context: ex.context, assertCurrent: ex.assertCurrent }, popup);
+    (_b = ex.assertCurrent) === null || _b === void 0 ? void 0 : _b.call(ex);
+    return result;
+}
+async function turnkeySignerPage(token) {
+    const assertGeneration = walletOperationGuard();
+    const idToken = token === undefined ? getActiveSessionManager().getIdToken() : token;
     const cfg = await getConfig();
     const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    return { url: `${base}/wallet/turnkey/signer`, origin: new URL(base).origin };
+    const context = walletContextFromClaims(idToken ? decodeJwt$1(idToken) : {}, base, cfg.appId, window.location.origin);
+    return Object.assign(Object.assign({}, context), { idToken: idToken || '', assertCurrent() {
+            assertGeneration();
+            const current = getActiveSessionManager().getIdToken();
+            if (!current)
+                throw new Error('wallet_session_changed');
+            const next = walletContextFromClaims(decodeJwt$1(current), base, cfg.appId, window.location.origin);
+            if (next.key !== context.key)
+                throw new Error('wallet_session_changed');
+        } });
 }
 function toHex(bytes) {
     let h = '';
@@ -4451,7 +4833,7 @@ async function runPopup(url, signerOrigin, ex) {
     const top = window.screenY + Math.max(0, (window.outerHeight - h) / 2);
     const popup = window.open(url, 'bounded-turnkey-signer', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup) {
-        throw new Error('popup_blocked - the wallet approval window was blocked. Call this from a user gesture (e.g. a click handler) so it can open; we never fall back to an in-page frame.');
+        throw new Error('Popup blocked - call this from a user gesture (e.g. a click handler) so the wallet approval window can open.');
     }
     return await new Promise((resolve, reject) => {
         let settled = false;
@@ -4467,11 +4849,12 @@ async function runPopup(url, signerOrigin, ex) {
         let closeTimer;
         const cleanup = () => { settled = true; window.removeEventListener('message', onMsg); if (closeTimer)
             clearInterval(closeTimer); };
-        const sendRequest = () => { if (settled || acked)
+        const sendRequest = () => { var _a; if (settled || acked)
             return; try {
+            (_a = ex.assertCurrent) === null || _a === void 0 ? void 0 : _a.call(ex);
             popup.postMessage(ex.request, signerOrigin);
         }
-        catch ( /* popup gone */_a) { /* popup gone */ } };
+        catch ( /* popup gone */_b) { /* popup gone */ } };
         const onMsg = (event) => {
             if (event.origin !== signerOrigin)
                 return;
@@ -4541,16 +4924,9 @@ async function runPopup(url, signerOrigin, ex) {
 // identity with the Bounded id token WE minted (a body secret, RS256-verified server-side), not
 // an ambient cookie - the issuer's session cookie is SameSite-scoped to its own origin and is
 // not sent on this cross-origin fetch, so the token is what carries the session's wallet.
-async function fetchSigningCapability(messageHex) {
-    const cfg = await getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    let idToken = null;
-    try {
-        idToken = getActiveSessionManager().getIdToken();
-    }
-    catch (_a) {
-        idToken = null;
-    }
+async function fetchSigningCapability(messageHex, context) {
+    context.assertCurrent();
+    const { base, idToken } = context;
     if (!idToken) {
         throw new Error('This session has no Turnkey wallet. Sign in again to provision one.');
     }
@@ -4565,16 +4941,9 @@ async function fetchSigningCapability(messageHex) {
 // requires an issuer-signed authorization bound to this app origin and exact action. Fetch it
 // before posting to the signer. Walletless sessions are valid for createWallet because that is
 // the operation that provisions their first wallet.
-async function fetchActionAuthorization(action) {
-    const cfg = await getConfig();
-    const base = (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
-    let idToken = null;
-    try {
-        idToken = getActiveSessionManager().getIdToken();
-    }
-    catch (_a) {
-        idToken = null;
-    }
+async function fetchActionAuthorization(action, context) {
+    context.assertCurrent();
+    const { base, idToken } = context;
     if (!idToken) {
         throw new Error('Sign in again to set up your Turnkey wallet.');
     }
@@ -4594,31 +4963,23 @@ async function fetchActionAuthorization(action) {
  * an unswept session is account-bound and unusable without a live authorization,
  * it just costs its owner nothing and a stranger nothing.
  */
-async function clearTurnkeySigningSession() {
+async function clearTurnkeySigningSession(idToken) {
     if (!hasDOM$2())
         return;
-    // The session can live in TWO places, and the sweep has to reach both:
-    //   1. the signer origin's store, shared by every signer frame in this app's partition -
-    //      cleared by posting into a throwaway frame below;
-    //   2. the WARM widget iframe's memory. The signer keeps an in-memory mirror when the
-    //      browser blocks its storage, and hideModal deliberately leaves that iframe mounted
-    //      between signatures, so the mirror outlives logout. A throwaway frame cannot see
-    //      another document's memory - the only way to take it is to destroy that document.
-    // Done first, and synchronously, so it lands even if the frame exchange below fails.
-    try {
-        const { origin } = await turnkeySignerPage();
-        (await import('./bounded-widget-modal-C0Z7gmxH.mjs')).detachWarmSignerIframe(origin);
-    }
-    catch (_a) {
-        /* no modal module / no warm frame: nothing to take */
-    }
+    // Destroy the trusted in-memory key even if configuration or token parsing fails.
+    // Do it synchronously, before a different login can mount a replacement frame.
+    detachWarmSignerIframe();
+    // Capture the session before asynchronous teardown clears the SDK's token.
+    const contextPromise = turnkeySignerPage(idToken);
     let frame = null;
     try {
-        frame = await openHiddenSignerFrame();
+        const context = await contextPromise;
+        setWalletSessionState(context.key, { status: 'verification-required', reason: 'logged_out' });
+        frame = await openHiddenSignerFrame(context);
         await frame.request({ type: 'bounded:turnkey:clearSigningSession', requestId: `tkclear_${Date.now()}_${++requestSeq}` }, 4000);
     }
-    catch (_b) {
-        /* best-effort: never block or fail logout on the sweep */
+    catch (_a) {
+        // The warm frame was destroyed; the bounded store sweep is best effort.
     }
     finally {
         frame === null || frame === void 0 ? void 0 : frame.dispose();
@@ -4628,10 +4989,9 @@ function hasTurnkeyWallet() {
     return activeTurnkeyAddress() !== null;
 }
 /**
- * Open the Bounded Turnkey signer popup and sign `message` (raw bytes) with the
- * user's non-custodial Turnkey wallet, resolving with the ed25519 signature +
- * the wallet address. MUST be called from a USER GESTURE (click/tap) or the
- * browser blocks the popup.
+ * Open the Bounded Turnkey approval card and sign `message` (raw bytes) with the
+ * user's Turnkey wallet, resolving with the ed25519 signature and wallet address.
+ * Call from a user gesture so a deliberate browser fallback can open if needed.
  *
  * The signer shows an approve card (wallet address, requesting origin, Approve /
  * Cancel). With a live 24-hour signing session (normally established by the login
@@ -4641,23 +5001,26 @@ function hasTurnkeyWallet() {
  */
 async function signSolanaMessageViaTurnkey(message) {
     if (!hasDOM$2()) {
-        throw new Error('Turnkey embedded-wallet signing is only available in the browser (popup-based).');
+        throw new Error('Turnkey embedded-wallet signing is only available in the browser (trusted wallet UI).');
     }
-    const { url, origin } = await turnkeySignerPage();
+    const context = await turnkeySignerPage();
+    const { url, origin } = context;
     const requestId = `tksign_${Date.now()}_${++requestSeq}`;
     const messageHex = toHex(message);
     // AS-02: obtain the issuer-signed capability for THESE exact bytes first; the signer will
     // refuse (capability_required) without it. Fetched per signature (each is single-payload).
-    const capability = await fetchSigningCapability(messageHex);
+    const capability = await fetchSigningCapability(messageHex, context);
     // Inline (authMode:"turnkey") sessions plant no Better Auth cookie on the issuer, so the
     // signer's same-origin status/create fetches need a bearer session proof: attach the
     // createWallet action authorization (it covers the sign flow's get-or-create too). Minted
     // from the same id token as the capability, so a session that minted one can mint both.
-    const authorization = await fetchActionAuthorization('createWallet');
+    const authorization = await fetchActionAuthorization('createWallet', context);
     return await deliver(url, origin, {
+        context: context.key, assertCurrent: context.assertCurrent,
         request: buildTurnkeySignRequest({ requestId, messageHex, capability, authorization }),
         onResult: (d) => {
             if (d.ok && typeof d.signatureHex === 'string' && typeof d.address === 'string') {
+                setWalletSessionState(context.key, { expiresAt: Number(d.signingSessionExpiresAt) });
                 return { done: true, value: { signature: fromHex(d.signatureHex), address: d.address, subOrgId: String(d.subOrgId || '') } };
             }
             return { error: String(d.error || 'Turnkey signing failed') };
@@ -5342,9 +5705,6 @@ async function exchangeCode(code, verifier, redirectUri) {
     return user;
 }
 
-// NOTE: Provider class re-exports have been moved to index.ts (web) and
-// index.native.ts (RN) to avoid eager resolution of web-only dependencies
-// (react-dom) when this module is imported on RN.
 let currentAuthProvider = null;
 let currentAuthMethod = null;
 let currentAuthProviderConfigKey = null;
@@ -5684,7 +6044,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-CiPAD3vz.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-CIRbOSM3.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -5726,7 +6086,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DH8yLpyf.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BlSdRbgq.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -5739,7 +6099,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-K0j697jt.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-CkhN5u3d.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -5764,7 +6124,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-Dtsq4QaY.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-C23vWrOT.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -5826,7 +6186,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-Dtsq4QaY.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-C23vWrOT.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -5997,7 +6357,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-DH8yLpyf.mjs');
+            await import('./injected-wallet-provider-BlSdRbgq.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6134,13 +6494,14 @@ async function exchangeLogoutHint(issuerBase, idToken) {
 // which can be blocked or offline), so its failures are the one thing logout may
 // tolerate - never revokeSession's. Lazy import per this module's rule (the signer
 // bridge is browser-only machinery). Never rejects.
-async function sweepTurnkeySigningSession() {
+async function sweepTurnkeySigningSession(idToken) {
     try {
-        await (await Promise.resolve().then(function () { return turnkeySignerBridge; })).clearTurnkeySigningSession();
+        await (await Promise.resolve().then(function () { return turnkeySignerBridge; })).clearTurnkeySigningSession(idToken);
     }
     catch ( /* best-effort: never block or fail logout on the sweep */_a) { /* best-effort: never block or fail logout on the sweep */ }
 }
 async function logout$1(options) {
+    invalidatePendingWalletLogin();
     // Re-initialize the provider if it was cleared by a prior logout — the exact mirror
     // of login()'s self-heal above. Every session-establishment path now adopts through
     // session-provider.ts, so this is a REPAIR (the registry was cleared by a previous
@@ -6172,7 +6533,7 @@ async function logout$1(options) {
     // sweep is a hidden signer-iframe exchange; start it now (after revocation is
     // committed - a failed logout leaves the still-logged-in user their session) and
     // let it overlap the provider teardown. sweepTurnkeySigningSession never rejects.
-    const signingSessionSweep = sweepTurnkeySigningSession();
+    const signingSessionSweep = sweepTurnkeySigningSession(idTokenHint);
     // Only OIDC-hosted sessions own an issuer browser cookie. Turnkey-native
     // email OTP is also an email auth method, but it mints the app session
     // inline and has no issuer cookie to clear. Use the explicit session-kind
@@ -7964,4 +8325,4 @@ class PrivyExpoProvider {
 }
 
 export { BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as $, logout as A, getAuthProvider as B, signInAnonymously as C, loginWithPrivy as D, loginWithRedirect as E, completeLoginFromRedirect as F, loginWithPopup as G, completeLoginInPopup as H, useAuth as I, useQuery as J, useBuildRun as K, apps as L, getIdToken as M, onramp as N, onrampQuote as O, onrampStatus as P, setPlatform as Q, OffchainAuthProvider as R, PrivyExpoProvider as S, builds as T, BuildsApiError as U, NON_TERMINAL_STATES as V, TERMINAL_STATES as W, RUN_STATES as X, PARK_REASONS as Y, FAILURE_REASONS as Z, BUILD_REVIEW_CAPABILITY_SCHEMA as _, signMessageWithTurnkey as a, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a0, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, isSolanaMobileWallet as i, solanaMobileWalletLeavesPage as j, setAuthLoading as k, bufferExports as l, setStoredAuthMethod as m, normalizeSolanaRpcUrl as n, confirmAndCheckTransaction as o, resolveSolanaRpcUrl as p, init as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, waitForAuthReady as y, login as z };
-//# sourceMappingURL=index.native-gVbAsohv.mjs.map
+//# sourceMappingURL=index.native-r1I-9E8e.mjs.map