@cedros/login-react 0.0.14 → 0.0.16

package/dist/{silentWalletEnroll-DWt6Pr3B.js → silentWalletEnroll-CRHzr4Zy.js}

@@ -1,6 +1,6 @@
 import { A as g } from "./useCedrosLogin-_94MmGGq.js";
-import { g as f, a as w, D as i, b as K, t as b, c as p, w as S } from "./useAuth-C3dpk0po.js";
-import { s as T, a as k, g as B, p as D } from "./shamir-L-s-Tp1Z.js";
+import { g as f, a as w, D as i, b as K, t as b, c as p, w as S } from "./useAuth-D1NSN6yY.js";
+import { s as T, a as k, g as B, p as D } from "./shamir-CDbZS8I1.js";
 async function P(u) {
   const { password: A, serverUrl: h, accessToken: r, timeoutMs: y = 3e4 } = u, s = [];
   try {

package/dist/{silentWalletEnroll-DWt6Pr3B.js.map → silentWalletEnroll-CRHzr4Zy.js.map}

@@ -1 +1 @@
-{"version":3,"file":"silentWalletEnroll-DWt6Pr3B.js","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":";;;AA2DA,eAAsBA,EACpBC,GAC6B;AAC7B,QAAM,EAAE,UAAAC,GAAU,WAAAC,GAAW,aAAAC,GAAa,WAAAC,IAAY,QAAUJ,GAG1DK,IAA8B,CAAA;AAEpC,MAAI;AAEF,UAAMC,IAAOC,EAAA;AACb,IAAAF,EAAc,KAAKC,CAAI;AAGvB,UAAM,EAAE,QAAAE,GAAQ,QAAAC,MAAWC,EAAYJ,CAAI;AAC3C,IAAAD,EAAc,KAAKG,GAAQC,CAAM;AAGjC,UAAME,IAAOC,EAAA,GACPC,IAAM,MAAMC,EAAqBb,GAAUU,GAAMI,CAAkB;AACzE,IAAAV,EAAc,KAAKQ,CAAG;AAGtB,UAAMG,IAAa,MAAMC,EAAsBT,GAAQU,EAAgBL,CAAG,CAAC,GAGrEM,IAAYC,EAAqBd,CAAI,GACrCe,IAAeC,EAAkBH,CAAS,GAI1CI,IAA+B;AAAA,MACnC,cAAAF;AAAA,MACA,kBAAkB;AAAA,MAClB,kBAAkBL,EAAW;AAAA,MAC7B,aAAaA,EAAW;AAAA,MACxB,QAAQQ,EAAmBf,CAAM;AAAA,MACjC,eAAee,EAAmBb,CAAI;AAAA,MACtC,iBAAiBI;AAAA,IAAA;AAWnB,iBANkB,IAAIU,EAAU;AAAA,MAC9B,SAASvB;AAAA,MACT,WAAAE;AAAA,MACA,gBAAgBD,IAAc,MAAMA,IAAc;AAAA,IAAA,CACnD,EAEe,KAAK,kBAAkBoB,CAAO,GAEvC;AAAA,MACL,SAAS;AAAA,MACT,cAAAF;AAAA,IAAA;AAAA,EAEJ,SAASK,GAAK;AAGZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAJmBA,aAAe,QAAQA,EAAI,UAAU;AAAA,IAIjD;AAAA,EAEX,UAAA;AAEE,IAAAC,EAAQ,GAAGtB,CAAa;AAAA,EAC1B;AACF;"}
+{"version":3,"file":"silentWalletEnroll-CRHzr4Zy.js","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":";;;AA2DA,eAAsBA,EACpBC,GAC6B;AAC7B,QAAM,EAAE,UAAAC,GAAU,WAAAC,GAAW,aAAAC,GAAa,WAAAC,IAAY,QAAUJ,GAG1DK,IAA8B,CAAA;AAEpC,MAAI;AAEF,UAAMC,IAAOC,EAAA;AACb,IAAAF,EAAc,KAAKC,CAAI;AAGvB,UAAM,EAAE,QAAAE,GAAQ,QAAAC,MAAWC,EAAYJ,CAAI;AAC3C,IAAAD,EAAc,KAAKG,GAAQC,CAAM;AAGjC,UAAME,IAAOC,EAAA,GACPC,IAAM,MAAMC,EAAqBb,GAAUU,GAAMI,CAAkB;AACzE,IAAAV,EAAc,KAAKQ,CAAG;AAGtB,UAAMG,IAAa,MAAMC,EAAsBT,GAAQU,EAAgBL,CAAG,CAAC,GAGrEM,IAAYC,EAAqBd,CAAI,GACrCe,IAAeC,EAAkBH,CAAS,GAI1CI,IAA+B;AAAA,MACnC,cAAAF;AAAA,MACA,kBAAkB;AAAA,MAClB,kBAAkBL,EAAW;AAAA,MAC7B,aAAaA,EAAW;AAAA,MACxB,QAAQQ,EAAmBf,CAAM;AAAA,MACjC,eAAee,EAAmBb,CAAI;AAAA,MACtC,iBAAiBI;AAAA,IAAA;AAWnB,iBANkB,IAAIU,EAAU;AAAA,MAC9B,SAASvB;AAAA,MACT,WAAAE;AAAA,MACA,gBAAgBD,IAAc,MAAMA,IAAc;AAAA,IAAA,CACnD,EAEe,KAAK,kBAAkBoB,CAAO,GAEvC;AAAA,MACL,SAAS;AAAA,MACT,cAAAF;AAAA,IAAA;AAAA,EAEJ,SAASK,GAAK;AAGZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAJmBA,aAAe,QAAQA,EAAI,UAAU;AAAA,IAIjD;AAAA,EAEX,UAAA;AAEE,IAAAC,EAAQ,GAAGtB,CAAa;AAAA,EAC1B;AACF;"}

package/dist/{silentWalletEnroll-BgTb4H5I.cjs → silentWalletEnroll-Dl_oFapH.cjs}

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const S=require("./useCedrosLogin-C9MrcZvh.cjs"),e=require("./useAuth-D3Pk_H3z.cjs"),t=require("./shamir-4DyQMJCk.cjs");async function T(A){const{password:p,serverUrl:h,accessToken:n,timeoutMs:y=3e4}=A,r=[];try{const s=e.generateSeed();r.push(s);const{shareA:a,shareB:o}=t.splitSecret(s);r.push(a,o);const c=e.generateArgon2Salt(),l=await t.argon2DeriveInWorker(p,c,e.DEFAULT_KDF_PARAMS);r.push(l);const i=await e.aesGcmEncryptToBase64(a,e.toEncryptionKey(l)),d=t.getPublicKeyFromSeed(s),u=t.publicKeyToBase58(d),g={solanaPubkey:u,shareAAuthMethod:"password",shareACiphertext:i.ciphertext,shareANonce:i.nonce,shareB:e.uint8ArrayToBase64(o),shareAKdfSalt:e.uint8ArrayToBase64(c),shareAKdfParams:e.DEFAULT_KDF_PARAMS};return await new S.ApiClient({baseUrl:h,timeoutMs:y,getAccessToken:n?()=>n:void 0}).post("/wallet/enroll",g),{success:!0,solanaPubkey:u}}catch(s){return{success:!1,error:s instanceof Error?s.message:"Wallet enrollment failed"}}finally{e.wipeAll(...r)}}exports.silentWalletEnroll=T;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const S=require("./useCedrosLogin-C9MrcZvh.cjs"),e=require("./useAuth-dS_6wAMp.cjs"),t=require("./shamir-DAa54dMh.cjs");async function T(A){const{password:p,serverUrl:h,accessToken:n,timeoutMs:y=3e4}=A,r=[];try{const s=e.generateSeed();r.push(s);const{shareA:a,shareB:o}=t.splitSecret(s);r.push(a,o);const c=e.generateArgon2Salt(),l=await t.argon2DeriveInWorker(p,c,e.DEFAULT_KDF_PARAMS);r.push(l);const i=await e.aesGcmEncryptToBase64(a,e.toEncryptionKey(l)),d=t.getPublicKeyFromSeed(s),u=t.publicKeyToBase58(d),g={solanaPubkey:u,shareAAuthMethod:"password",shareACiphertext:i.ciphertext,shareANonce:i.nonce,shareB:e.uint8ArrayToBase64(o),shareAKdfSalt:e.uint8ArrayToBase64(c),shareAKdfParams:e.DEFAULT_KDF_PARAMS};return await new S.ApiClient({baseUrl:h,timeoutMs:y,getAccessToken:n?()=>n:void 0}).post("/wallet/enroll",g),{success:!0,solanaPubkey:u}}catch(s){return{success:!1,error:s instanceof Error?s.message:"Wallet enrollment failed"}}finally{e.wipeAll(...r)}}exports.silentWalletEnroll=T;

package/dist/{silentWalletEnroll-BgTb4H5I.cjs.map → silentWalletEnroll-Dl_oFapH.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"silentWalletEnroll-BgTb4H5I.cjs","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":"wMA2DA,eAAsBA,EACpBC,EAC6B,CAC7B,KAAM,CAAE,SAAAC,EAAU,UAAAC,EAAW,YAAAC,EAAa,UAAAC,EAAY,KAAUJ,EAG1DK,EAA8B,CAAA,EAEpC,GAAI,CAEF,MAAMC,EAAOC,EAAAA,aAAA,EACbF,EAAc,KAAKC,CAAI,EAGvB,KAAM,CAAE,OAAAE,EAAQ,OAAAC,GAAWC,EAAAA,YAAYJ,CAAI,EAC3CD,EAAc,KAAKG,EAAQC,CAAM,EAGjC,MAAME,EAAOC,EAAAA,mBAAA,EACPC,EAAM,MAAMC,EAAAA,qBAAqBb,EAAUU,EAAMI,EAAAA,kBAAkB,EACzEV,EAAc,KAAKQ,CAAG,EAGtB,MAAMG,EAAa,MAAMC,EAAAA,sBAAsBT,EAAQU,EAAAA,gBAAgBL,CAAG,CAAC,EAGrEM,EAAYC,EAAAA,qBAAqBd,CAAI,EACrCe,EAAeC,EAAAA,kBAAkBH,CAAS,EAI1CI,EAA+B,CACnC,aAAAF,EACA,iBAAkB,WAClB,iBAAkBL,EAAW,WAC7B,YAAaA,EAAW,MACxB,OAAQQ,EAAAA,mBAAmBf,CAAM,EACjC,cAAee,EAAAA,mBAAmBb,CAAI,EACtC,gBAAiBI,EAAAA,kBAAA,EAWnB,aANkB,IAAIU,YAAU,CAC9B,QAASvB,EACT,UAAAE,EACA,eAAgBD,EAAc,IAAMA,EAAc,MAAA,CACnD,EAEe,KAAK,iBAAkBoB,CAAO,EAEvC,CACL,QAAS,GACT,aAAAF,CAAA,CAEJ,OAASK,EAAK,CAGZ,MAAO,CACL,QAAS,GACT,MAJmBA,aAAe,MAAQA,EAAI,QAAU,0BAIjD,CAEX,QAAA,CAEEC,EAAAA,QAAQ,GAAGtB,CAAa,CAC1B,CACF"}
+{"version":3,"file":"silentWalletEnroll-Dl_oFapH.cjs","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":"wMA2DA,eAAsBA,EACpBC,EAC6B,CAC7B,KAAM,CAAE,SAAAC,EAAU,UAAAC,EAAW,YAAAC,EAAa,UAAAC,EAAY,KAAUJ,EAG1DK,EAA8B,CAAA,EAEpC,GAAI,CAEF,MAAMC,EAAOC,EAAAA,aAAA,EACbF,EAAc,KAAKC,CAAI,EAGvB,KAAM,CAAE,OAAAE,EAAQ,OAAAC,GAAWC,EAAAA,YAAYJ,CAAI,EAC3CD,EAAc,KAAKG,EAAQC,CAAM,EAGjC,MAAME,EAAOC,EAAAA,mBAAA,EACPC,EAAM,MAAMC,EAAAA,qBAAqBb,EAAUU,EAAMI,EAAAA,kBAAkB,EACzEV,EAAc,KAAKQ,CAAG,EAGtB,MAAMG,EAAa,MAAMC,EAAAA,sBAAsBT,EAAQU,EAAAA,gBAAgBL,CAAG,CAAC,EAGrEM,EAAYC,EAAAA,qBAAqBd,CAAI,EACrCe,EAAeC,EAAAA,kBAAkBH,CAAS,EAI1CI,EAA+B,CACnC,aAAAF,EACA,iBAAkB,WAClB,iBAAkBL,EAAW,WAC7B,YAAaA,EAAW,MACxB,OAAQQ,EAAAA,mBAAmBf,CAAM,EACjC,cAAee,EAAAA,mBAAmBb,CAAI,EACtC,gBAAiBI,EAAAA,kBAAA,EAWnB,aANkB,IAAIU,YAAU,CAC9B,QAASvB,EACT,UAAAE,EACA,eAAgBD,EAAc,IAAMA,EAAc,MAAA,CACnD,EAEe,KAAK,iBAAkBoB,CAAO,EAEvC,CACL,QAAS,GACT,aAAAF,CAAA,CAEJ,OAASK,EAAK,CAGZ,MAAO,CACL,QAAS,GACT,MAJmBA,aAAe,MAAQA,EAAI,QAAU,0BAIjD,CAEX,QAAA,CAEEC,EAAAA,QAAQ,GAAGtB,CAAa,CAC1B,CACF"}

package/dist/solana-only.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("./useAuth-D3Pk_H3z.cjs"),r=require("./useCedrosLogin-C9MrcZvh.cjs"),o=require("./SolanaLoginButton-BjOxpE1C.cjs"),n=require("./LoadingSpinner-d6sSxgQN.cjs"),s=require("./ErrorMessage-CHbYbVi2.cjs");exports.CedrosLoginProvider=e.CedrosLoginProvider;exports.useAuth=e.useAuth;exports.useCedrosLogin=r.useCedrosLogin;exports.SolanaLoginButton=o.SolanaLoginButton;exports.useSolanaAuth=o.useSolanaAuth;exports.LoadingSpinner=n.LoadingSpinner;exports.ErrorMessage=s.ErrorMessage;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const r=require("./useAuth-dS_6wAMp.cjs"),o=require("./useCedrosLogin-C9MrcZvh.cjs"),e=require("./mobileWalletAdapter-Dp4yFxCm.cjs"),n=require("./LoadingSpinner-d6sSxgQN.cjs"),i=require("./ErrorMessage-CHbYbVi2.cjs");exports.CedrosLoginProvider=r.CedrosLoginProvider;exports.useAuth=r.useAuth;exports.useCedrosLogin=o.useCedrosLogin;exports.SolanaLoginButton=e.SolanaLoginButton;exports.registerMobileWallet=e.registerMobileWallet;exports.useSolanaAuth=e.useSolanaAuth;exports.LoadingSpinner=n.LoadingSpinner;exports.ErrorMessage=i.ErrorMessage;

package/dist/solana-only.d.ts

@@ -98,16 +98,44 @@ export declare interface AuthUser {
 }
 
 /**
- * Full configuration for CedrosLoginProvider
+ * Full configuration for the authentication system.
+ *
+ * **Note:** When passing config to `<CedrosLoginProvider>`, use
+ * {@link CedrosLoginProviderConfig} instead — it extends this type
+ * with `features: 'auto'` support. This base type is used internally
+ * after the provider resolves auto-discovery.
+ *
+ * ```
+ * CedrosLoginProviderConfig   (public prop type — accepts features: 'auto')
+ *   └── CedrosLoginConfig     (internal type — features is always FeatureFlags)
+ * ```
  */
 export declare interface CedrosLoginConfig {
     /** Auth server base URL */
     serverUrl: string;
     /** App name for Solana message: "Login to {appName}". Default: window.location.hostname */
     appName?: string;
-    /** Google OAuth client ID. Required if Google auth enabled */
+    /**
+     * Google OAuth client ID. Required if Google auth enabled.
+     *
+     * **CSP requirements** (when using Google One Tap / credential popup):
+     * ```
+     * script-src https://accounts.google.com;
+     * connect-src https://accounts.google.com;
+     * frame-src https://accounts.google.com;
+     * ```
+     */
     googleClientId?: string;
-    /** Apple Sign In client ID (Services ID). Required if Apple auth enabled */
+    /**
+     * Apple Sign In client ID (Services ID). Required if Apple auth enabled.
+     *
+     * **CSP requirements** (when using Apple Sign In popup):
+     * ```
+     * script-src https://appleid.cdn-apple.com;
+     * connect-src https://appleid.apple.com;
+     * frame-src https://appleid.apple.com;
+     * ```
+     */
     appleClientId?: string;
     /** Solana configuration options */
     solana?: SolanaConfig;
@@ -160,9 +188,31 @@ declare interface CedrosLoginInternalAPI {
 export declare function CedrosLoginProvider({ config, children }: CedrosLoginProviderProps): JSX.Element | null;
 
 /**
- * Config accepted by CedrosLoginProvider.
- * Same as CedrosLoginConfig but `features` also accepts `'auto'`
- * to fetch enabled methods from the server at startup.
+ * Config prop type for `<CedrosLoginProvider>`.
+ *
+ * Extends {@link CedrosLoginConfig} with one additional feature:
+ * the `features` field also accepts `'auto'` to fetch enabled
+ * auth methods from the server at startup.
+ *
+ * **`features: 'auto'` discovery contract:**
+ * - Calls `GET {serverUrl}/features` (no auth required, credentials omitted).
+ * - Response shape: `{ email, google, apple, solana, webauthn, instantLink }` (all booleans).
+ * - Timeout: `requestTimeout` or 5 000 ms. 1 retry on failure.
+ * - Fallback: all methods enabled (so the login page is never blank).
+ * - Children are not rendered until discovery completes.
+ * - `walletEnrollment` flag is client-only and is not part of the server response.
+ *
+ * When `features` is omitted or set to a `FeatureFlags` object, no server
+ * call is made and the flags are used as-is.
+ *
+ * @example
+ * ```tsx
+ * // Auto-discover enabled methods from the server:
+ * <CedrosLoginProvider config={{ serverUrl: '...', features: 'auto' }}>
+ *
+ * // Or specify explicitly:
+ * <CedrosLoginProvider config={{ serverUrl: '...', features: { email: true, google: true } }}>
+ * ```
  */
 declare type CedrosLoginProviderConfig = Omit<CedrosLoginConfig, 'features'> & {
     features?: FeatureFlags | 'auto';
@@ -292,6 +342,62 @@ declare interface LoadingSpinnerProps {
     announce?: boolean;
 }
 
+/**
+ * Mobile Wallet Adapter (MWA) registration for web.
+ *
+ * On Android Chrome, MWA lets users authenticate with their installed Solana
+ * wallet app (e.g., Phantom, Solflare) via Android Intents — no browser
+ * extension needed.
+ *
+ * Once registered, MWA appears as a wallet option in the wallet adapter's
+ * wallet list (alongside browser extension wallets). Users see it as
+ * "Use Installed Wallet" in the wallet selector.
+ *
+ * Requires the optional peer dependency: @solana-mobile/wallet-standard-mobile
+ *
+ * @see https://docs.solanamobile.com/get-started/web/installation
+ */
+export declare interface MobileWalletConfig {
+    /** App name shown in the wallet's authorization dialog */
+    name?: string;
+    /** App URI for identity verification */
+    uri?: string;
+    /** App icon path/URL shown in the wallet dialog */
+    icon?: string;
+    /** Solana cluster(s) to support. Default: ['solana:mainnet'] */
+    chains?: string[];
+}
+
+/**
+ * Register Mobile Wallet Adapter as a wallet-standard wallet.
+ *
+ * Call this once at your application root (before rendering). After registration,
+ * MWA automatically appears as "Use Installed Wallet" for users browsing on
+ * Android Chrome with a Solana wallet app installed.
+ *
+ * Must be called in a non-SSR context (browser only). For Next.js, call in a
+ * Client Component with `'use client'`.
+ *
+ * @example
+ * ```tsx
+ * import { registerMobileWallet, CedrosLoginProvider } from '@cedros/login-react';
+ *
+ * // Register before provider mounts
+ * registerMobileWallet({ name: 'My App', uri: 'https://myapp.com' });
+ *
+ * function App() {
+ *   return (
+ *     <CedrosLoginProvider config={{ serverUrl: '...' }}>
+ *       <LoginForm />
+ *     </CedrosLoginProvider>
+ *   );
+ * }
+ * ```
+ *
+ * @returns true if registration succeeded, false if package not installed or SSR
+ */
+export declare function registerMobileWallet(config?: MobileWalletConfig): boolean;
+
 /**
  * Session handling configuration
  *

package/dist/solana-only.js

@@ -1,6 +1,6 @@
-import { C as e, u as s } from "./useAuth-C3dpk0po.js";
-import { u as n } from "./useCedrosLogin-_94MmGGq.js";
-import { S as u, u as i } from "./SolanaLoginButton-P22QjBaO.js";
+import { C as e, u as s } from "./useAuth-D1NSN6yY.js";
+import { u as t } from "./useCedrosLogin-_94MmGGq.js";
+import { S as u, r as i, u as g } from "./mobileWalletAdapter-coZRD4Yx.js";
 import { L as f } from "./LoadingSpinner-6vml-zwr.js";
 import { E as m } from "./ErrorMessage-CcEK0pYO.js";
 export {
@@ -8,7 +8,8 @@ export {
   m as ErrorMessage,
   f as LoadingSpinner,
   u as SolanaLoginButton,
+  i as registerMobileWallet,
   s as useAuth,
-  n as useCedrosLogin,
-  i as useSolanaAuth
+  t as useCedrosLogin,
+  g as useSolanaAuth
 };