@cedros/login-react 0.0.36 → 0.0.38

package/dist/{silentWalletEnroll-HPvsbd2J.cjs → silentWalletEnroll-B6a-fPgB.cjs}

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const S=require("./useCedrosLogin-DtJorrE7.cjs"),e=require("./useAuth-XZaciuLg.cjs"),t=require("./shamir-DBpHm7WN.cjs");async function T(A){const{password:p,serverUrl:h,accessToken:n,timeoutMs:y=3e4}=A,r=[];try{const s=e.generateSeed();r.push(s);const{shareA:a,shareB:o}=t.splitSecret(s);r.push(a,o);const c=e.generateArgon2Salt(),l=await t.argon2DeriveInWorker(p,c,e.DEFAULT_KDF_PARAMS);r.push(l);const i=await e.aesGcmEncryptToBase64(a,e.toEncryptionKey(l)),d=t.getPublicKeyFromSeed(s),u=t.publicKeyToBase58(d),g={solanaPubkey:u,shareAAuthMethod:"password",shareACiphertext:i.ciphertext,shareANonce:i.nonce,shareB:e.uint8ArrayToBase64(o),shareAKdfSalt:e.uint8ArrayToBase64(c),shareAKdfParams:e.DEFAULT_KDF_PARAMS};return await new S.ApiClient({baseUrl:h,timeoutMs:y,getAccessToken:n?()=>n:void 0}).post("/wallet/enroll",g),{success:!0,solanaPubkey:u}}catch(s){return{success:!1,error:s instanceof Error?s.message:"Wallet enrollment failed"}}finally{e.wipeAll(...r)}}exports.silentWalletEnroll=T;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const S=require("./useCedrosLogin-DtJorrE7.cjs"),e=require("./useAuth-GzGopI4v.cjs"),t=require("./shamir-BNuiZ2ry.cjs");async function T(A){const{password:p,serverUrl:h,accessToken:n,timeoutMs:y=3e4}=A,r=[];try{const s=e.generateSeed();r.push(s);const{shareA:a,shareB:o}=t.splitSecret(s);r.push(a,o);const c=e.generateArgon2Salt(),l=await t.argon2DeriveInWorker(p,c,e.DEFAULT_KDF_PARAMS);r.push(l);const i=await e.aesGcmEncryptToBase64(a,e.toEncryptionKey(l)),d=t.getPublicKeyFromSeed(s),u=t.publicKeyToBase58(d),g={solanaPubkey:u,shareAAuthMethod:"password",shareACiphertext:i.ciphertext,shareANonce:i.nonce,shareB:e.uint8ArrayToBase64(o),shareAKdfSalt:e.uint8ArrayToBase64(c),shareAKdfParams:e.DEFAULT_KDF_PARAMS};return await new S.ApiClient({baseUrl:h,timeoutMs:y,getAccessToken:n?()=>n:void 0}).post("/wallet/enroll",g),{success:!0,solanaPubkey:u}}catch(s){return{success:!1,error:s instanceof Error?s.message:"Wallet enrollment failed"}}finally{e.wipeAll(...r)}}exports.silentWalletEnroll=T;

package/dist/{silentWalletEnroll-HPvsbd2J.cjs.map → silentWalletEnroll-B6a-fPgB.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"silentWalletEnroll-HPvsbd2J.cjs","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":"wMA2DA,eAAsBA,EACpBC,EAC6B,CAC7B,KAAM,CAAE,SAAAC,EAAU,UAAAC,EAAW,YAAAC,EAAa,UAAAC,EAAY,KAAUJ,EAG1DK,EAA8B,CAAA,EAEpC,GAAI,CAEF,MAAMC,EAAOC,EAAAA,aAAA,EACbF,EAAc,KAAKC,CAAI,EAGvB,KAAM,CAAE,OAAAE,EAAQ,OAAAC,GAAWC,EAAAA,YAAYJ,CAAI,EAC3CD,EAAc,KAAKG,EAAQC,CAAM,EAGjC,MAAME,EAAOC,EAAAA,mBAAA,EACPC,EAAM,MAAMC,EAAAA,qBAAqBb,EAAUU,EAAMI,EAAAA,kBAAkB,EACzEV,EAAc,KAAKQ,CAAG,EAGtB,MAAMG,EAAa,MAAMC,EAAAA,sBAAsBT,EAAQU,EAAAA,gBAAgBL,CAAG,CAAC,EAGrEM,EAAYC,EAAAA,qBAAqBd,CAAI,EACrCe,EAAeC,EAAAA,kBAAkBH,CAAS,EAI1CI,EAA+B,CACnC,aAAAF,EACA,iBAAkB,WAClB,iBAAkBL,EAAW,WAC7B,YAAaA,EAAW,MACxB,OAAQQ,EAAAA,mBAAmBf,CAAM,EACjC,cAAee,EAAAA,mBAAmBb,CAAI,EACtC,gBAAiBI,EAAAA,kBAAA,EAWnB,aANkB,IAAIU,YAAU,CAC9B,QAASvB,EACT,UAAAE,EACA,eAAgBD,EAAc,IAAMA,EAAc,MAAA,CACnD,EAEe,KAAK,iBAAkBoB,CAAO,EAEvC,CACL,QAAS,GACT,aAAAF,CAAA,CAEJ,OAASK,EAAK,CAGZ,MAAO,CACL,QAAS,GACT,MAJmBA,aAAe,MAAQA,EAAI,QAAU,0BAIjD,CAEX,QAAA,CAEEC,EAAAA,QAAQ,GAAGtB,CAAa,CAC1B,CACF"}
+{"version":3,"file":"silentWalletEnroll-B6a-fPgB.cjs","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":"wMA2DA,eAAsBA,EACpBC,EAC6B,CAC7B,KAAM,CAAE,SAAAC,EAAU,UAAAC,EAAW,YAAAC,EAAa,UAAAC,EAAY,KAAUJ,EAG1DK,EAA8B,CAAA,EAEpC,GAAI,CAEF,MAAMC,EAAOC,EAAAA,aAAA,EACbF,EAAc,KAAKC,CAAI,EAGvB,KAAM,CAAE,OAAAE,EAAQ,OAAAC,GAAWC,EAAAA,YAAYJ,CAAI,EAC3CD,EAAc,KAAKG,EAAQC,CAAM,EAGjC,MAAME,EAAOC,EAAAA,mBAAA,EACPC,EAAM,MAAMC,EAAAA,qBAAqBb,EAAUU,EAAMI,EAAAA,kBAAkB,EACzEV,EAAc,KAAKQ,CAAG,EAGtB,MAAMG,EAAa,MAAMC,EAAAA,sBAAsBT,EAAQU,EAAAA,gBAAgBL,CAAG,CAAC,EAGrEM,EAAYC,EAAAA,qBAAqBd,CAAI,EACrCe,EAAeC,EAAAA,kBAAkBH,CAAS,EAI1CI,EAA+B,CACnC,aAAAF,EACA,iBAAkB,WAClB,iBAAkBL,EAAW,WAC7B,YAAaA,EAAW,MACxB,OAAQQ,EAAAA,mBAAmBf,CAAM,EACjC,cAAee,EAAAA,mBAAmBb,CAAI,EACtC,gBAAiBI,EAAAA,kBAAA,EAWnB,aANkB,IAAIU,YAAU,CAC9B,QAASvB,EACT,UAAAE,EACA,eAAgBD,EAAc,IAAMA,EAAc,MAAA,CACnD,EAEe,KAAK,iBAAkBoB,CAAO,EAEvC,CACL,QAAS,GACT,aAAAF,CAAA,CAEJ,OAASK,EAAK,CAGZ,MAAO,CACL,QAAS,GACT,MAJmBA,aAAe,MAAQA,EAAI,QAAU,0BAIjD,CAEX,QAAA,CAEEC,EAAAA,QAAQ,GAAGtB,CAAa,CAC1B,CACF"}

package/dist/{silentWalletEnroll-Dp1GTeNr.js → silentWalletEnroll-KHso2-HB.js}

@@ -1,6 +1,6 @@
 import { A as g } from "./useCedrosLogin-CFfID-0i.js";
-import { g as f, a as w, D as i, b as K, t as b, c as p, w as S } from "./useAuth-CVLv2oKA.js";
-import { s as T, a as k, g as B, p as D } from "./shamir-R8ddesFt.js";
+import { g as f, a as w, D as i, b as K, t as b, c as p, w as S } from "./useAuth-CWBApIWg.js";
+import { s as T, a as k, g as B, p as D } from "./shamir-BbDh58Zo.js";
 async function P(u) {
   const { password: A, serverUrl: h, accessToken: r, timeoutMs: y = 3e4 } = u, s = [];
   try {

package/dist/{silentWalletEnroll-Dp1GTeNr.js.map → silentWalletEnroll-KHso2-HB.js.map}

@@ -1 +1 @@
-{"version":3,"file":"silentWalletEnroll-Dp1GTeNr.js","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":";;;AA2DA,eAAsBA,EACpBC,GAC6B;AAC7B,QAAM,EAAE,UAAAC,GAAU,WAAAC,GAAW,aAAAC,GAAa,WAAAC,IAAY,QAAUJ,GAG1DK,IAA8B,CAAA;AAEpC,MAAI;AAEF,UAAMC,IAAOC,EAAA;AACb,IAAAF,EAAc,KAAKC,CAAI;AAGvB,UAAM,EAAE,QAAAE,GAAQ,QAAAC,MAAWC,EAAYJ,CAAI;AAC3C,IAAAD,EAAc,KAAKG,GAAQC,CAAM;AAGjC,UAAME,IAAOC,EAAA,GACPC,IAAM,MAAMC,EAAqBb,GAAUU,GAAMI,CAAkB;AACzE,IAAAV,EAAc,KAAKQ,CAAG;AAGtB,UAAMG,IAAa,MAAMC,EAAsBT,GAAQU,EAAgBL,CAAG,CAAC,GAGrEM,IAAYC,EAAqBd,CAAI,GACrCe,IAAeC,EAAkBH,CAAS,GAI1CI,IAA+B;AAAA,MACnC,cAAAF;AAAA,MACA,kBAAkB;AAAA,MAClB,kBAAkBL,EAAW;AAAA,MAC7B,aAAaA,EAAW;AAAA,MACxB,QAAQQ,EAAmBf,CAAM;AAAA,MACjC,eAAee,EAAmBb,CAAI;AAAA,MACtC,iBAAiBI;AAAA,IAAA;AAWnB,iBANkB,IAAIU,EAAU;AAAA,MAC9B,SAASvB;AAAA,MACT,WAAAE;AAAA,MACA,gBAAgBD,IAAc,MAAMA,IAAc;AAAA,IAAA,CACnD,EAEe,KAAK,kBAAkBoB,CAAO,GAEvC;AAAA,MACL,SAAS;AAAA,MACT,cAAAF;AAAA,IAAA;AAAA,EAEJ,SAASK,GAAK;AAGZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAJmBA,aAAe,QAAQA,EAAI,UAAU;AAAA,IAIjD;AAAA,EAEX,UAAA;AAEE,IAAAC,EAAQ,GAAGtB,CAAa;AAAA,EAC1B;AACF;"}
+{"version":3,"file":"silentWalletEnroll-KHso2-HB.js","sources":["../src/utils/silentWalletEnroll.ts"],"sourcesContent":["/**\n * Silent wallet enrollment utility\n *\n * Performs wallet enrollment in the background without UI interaction.\n * Used for auto-enrolling wallets during registration.\n *\n * Security: Uses the same Shamir Secret Sharing scheme as manual enrollment.\n * The recovery phrase is not shown - user can retrieve it later if needed.\n */\n\nimport {\n  generateSeed,\n  generateArgon2Salt,\n  splitSecret,\n  argon2DeriveInWorker,\n  aesGcmEncryptToBase64,\n  uint8ArrayToBase64,\n  getPublicKeyFromSeed,\n  publicKeyToBase58,\n  wipeAll,\n  toEncryptionKey,\n  DEFAULT_KDF_PARAMS,\n} from '../crypto';\nimport { ApiClient } from './apiClient';\nimport type { WalletEnrollRequest } from '../types/wallet';\n\nexport interface SilentEnrollOptions {\n  /** User's password for Share A encryption */\n  password: string;\n  /** Server base URL */\n  serverUrl: string;\n  /** Access token for authentication (optional if using cookies) */\n  accessToken?: string;\n  /** Request timeout in ms */\n  timeoutMs?: number;\n}\n\nexport interface SilentEnrollResult {\n  success: boolean;\n  solanaPubkey?: string;\n  error?: string;\n}\n\n/**\n * Silently enroll a wallet for a user\n *\n * This function performs the complete wallet enrollment process:\n * 1. Generate 32-byte seed\n * 2. Split into 3 Shamir shares (threshold 2)\n * 3. Encrypt Share A with password-derived key (Argon2id)\n * 4. Derive Solana public key from seed\n * 5. Upload encrypted Share A + plaintext Share B to server\n *\n * The recovery phrase (Share C) is not returned - user can recover it\n * later through the wallet recovery flow if needed.\n *\n * @param options - Enrollment options\n * @returns Result with success status and Solana public key\n */\nexport async function silentWalletEnroll(\n  options: SilentEnrollOptions\n): Promise<SilentEnrollResult> {\n  const { password, serverUrl, accessToken, timeoutMs = 30000 } = options;\n\n  // Track sensitive data for cleanup\n  const sensitiveData: Uint8Array[] = [];\n\n  try {\n    // Step 1: Generate seed\n    const seed = generateSeed();\n    sensitiveData.push(seed);\n\n    // Step 2: Split into shares\n    const { shareA, shareB } = splitSecret(seed);\n    sensitiveData.push(shareA, shareB);\n\n    // Step 3: Derive encryption key from password\n    const salt = generateArgon2Salt();\n    const key = await argon2DeriveInWorker(password, salt, DEFAULT_KDF_PARAMS);\n    sensitiveData.push(key);\n\n    // Step 4: Encrypt Share A\n    const encryptedA = await aesGcmEncryptToBase64(shareA, toEncryptionKey(key));\n\n    // Step 5: Derive Solana public key\n    const publicKey = getPublicKeyFromSeed(seed);\n    const solanaPubkey = publicKeyToBase58(publicKey);\n\n    // Step 6: Build enrollment request\n    // Only send encrypted shares — never send the raw seed to the server\n    const request: WalletEnrollRequest = {\n      solanaPubkey,\n      shareAAuthMethod: 'password',\n      shareACiphertext: encryptedA.ciphertext,\n      shareANonce: encryptedA.nonce,\n      shareB: uint8ArrayToBase64(shareB),\n      shareAKdfSalt: uint8ArrayToBase64(salt),\n      shareAKdfParams: DEFAULT_KDF_PARAMS,\n    };\n\n    // Step 7: Upload to server\n    // If accessToken provided, use it; otherwise rely on cookies\n    const apiClient = new ApiClient({\n      baseUrl: serverUrl,\n      timeoutMs,\n      getAccessToken: accessToken ? () => accessToken : undefined,\n    });\n\n    await apiClient.post('/wallet/enroll', request);\n\n    return {\n      success: true,\n      solanaPubkey,\n    };\n  } catch (err) {\n    const errorMessage = err instanceof Error ? err.message : 'Wallet enrollment failed';\n    // Silent failure - don't break registration flow\n    return {\n      success: false,\n      error: errorMessage,\n    };\n  } finally {\n    // Always wipe sensitive data\n    wipeAll(...sensitiveData);\n  }\n}\n"],"names":["silentWalletEnroll","options","password","serverUrl","accessToken","timeoutMs","sensitiveData","seed","generateSeed","shareA","shareB","splitSecret","salt","generateArgon2Salt","key","argon2DeriveInWorker","DEFAULT_KDF_PARAMS","encryptedA","aesGcmEncryptToBase64","toEncryptionKey","publicKey","getPublicKeyFromSeed","solanaPubkey","publicKeyToBase58","request","uint8ArrayToBase64","ApiClient","err","wipeAll"],"mappings":";;;AA2DA,eAAsBA,EACpBC,GAC6B;AAC7B,QAAM,EAAE,UAAAC,GAAU,WAAAC,GAAW,aAAAC,GAAa,WAAAC,IAAY,QAAUJ,GAG1DK,IAA8B,CAAA;AAEpC,MAAI;AAEF,UAAMC,IAAOC,EAAA;AACb,IAAAF,EAAc,KAAKC,CAAI;AAGvB,UAAM,EAAE,QAAAE,GAAQ,QAAAC,MAAWC,EAAYJ,CAAI;AAC3C,IAAAD,EAAc,KAAKG,GAAQC,CAAM;AAGjC,UAAME,IAAOC,EAAA,GACPC,IAAM,MAAMC,EAAqBb,GAAUU,GAAMI,CAAkB;AACzE,IAAAV,EAAc,KAAKQ,CAAG;AAGtB,UAAMG,IAAa,MAAMC,EAAsBT,GAAQU,EAAgBL,CAAG,CAAC,GAGrEM,IAAYC,EAAqBd,CAAI,GACrCe,IAAeC,EAAkBH,CAAS,GAI1CI,IAA+B;AAAA,MACnC,cAAAF;AAAA,MACA,kBAAkB;AAAA,MAClB,kBAAkBL,EAAW;AAAA,MAC7B,aAAaA,EAAW;AAAA,MACxB,QAAQQ,EAAmBf,CAAM;AAAA,MACjC,eAAee,EAAmBb,CAAI;AAAA,MACtC,iBAAiBI;AAAA,IAAA;AAWnB,iBANkB,IAAIU,EAAU;AAAA,MAC9B,SAASvB;AAAA,MACT,WAAAE;AAAA,MACA,gBAAgBD,IAAc,MAAMA,IAAc;AAAA,IAAA,CACnD,EAEe,KAAK,kBAAkBoB,CAAO,GAEvC;AAAA,MACL,SAAS;AAAA,MACT,cAAAF;AAAA,IAAA;AAAA,EAEJ,SAASK,GAAK;AAGZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAJmBA,aAAe,QAAQA,EAAI,UAAU;AAAA,IAIjD;AAAA,EAEX,UAAA;AAEE,IAAAC,EAAQ,GAAGtB,CAAa;AAAA,EAC1B;AACF;"}

package/dist/solana-only.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./useAuth-XZaciuLg.cjs"),r=require("./useCedrosLogin-DtJorrE7.cjs"),e=require("./SolanaLoginButton-nSJHVFpZ.cjs"),n=require("./LoadingSpinner-d6sSxgQN.cjs"),i=require("./ErrorMessage-CHbYbVi2.cjs");exports.CedrosLoginProvider=o.CedrosLoginProvider;exports.useAuth=o.useAuth;exports.useCedrosLogin=r.useCedrosLogin;exports.SolanaLoginButton=e.SolanaLoginButton;exports.registerMobileWallet=e.registerMobileWallet;exports.useSolanaAuth=e.useSolanaAuth;exports.LoadingSpinner=n.LoadingSpinner;exports.ErrorMessage=i.ErrorMessage;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./useAuth-GzGopI4v.cjs"),r=require("./useCedrosLogin-DtJorrE7.cjs"),e=require("./SolanaLoginButton-nSJHVFpZ.cjs"),n=require("./LoadingSpinner-d6sSxgQN.cjs"),i=require("./ErrorMessage-CHbYbVi2.cjs");exports.CedrosLoginProvider=o.CedrosLoginProvider;exports.useAuth=o.useAuth;exports.useCedrosLogin=r.useCedrosLogin;exports.SolanaLoginButton=e.SolanaLoginButton;exports.registerMobileWallet=e.registerMobileWallet;exports.useSolanaAuth=e.useSolanaAuth;exports.LoadingSpinner=n.LoadingSpinner;exports.ErrorMessage=i.ErrorMessage;

package/dist/solana-only.d.ts

@@ -91,6 +91,7 @@ export declare interface AuthUser {
     id: string;
     email?: string;
     name?: string;
+    username?: string;
     picture?: string;
     walletAddress?: string;
     authMethods: AuthMethod[];
@@ -378,8 +379,8 @@ export declare interface MobileWalletConfig {
  * Post-login action returned by the server after authentication
  */
 declare interface PostLoginAction {
-    /** Action type: "welcome", "complete_profile", "redirect", or "setup_mfa" */
-    action: 'welcome' | 'complete_profile' | 'redirect' | 'setup_mfa';
+    /** Action type: "welcome", "choose_username", "complete_profile", "redirect", or "setup_mfa" */
+    action: 'welcome' | 'choose_username' | 'complete_profile' | 'redirect' | 'setup_mfa';
     /** URL/route for redirect or welcome page */
     redirectUrl?: string;
 }

package/dist/solana-only.js

@@ -1,4 +1,4 @@
-import { C as e, u as s } from "./useAuth-CVLv2oKA.js";
+import { C as e, u as s } from "./useAuth-CWBApIWg.js";
 import { u as t } from "./useCedrosLogin-CFfID-0i.js";
 import { S as u, r as i, u as g } from "./SolanaLoginButton-B04dib6X.js";
 import { L as f } from "./LoadingSpinner-6vml-zwr.js";

package/dist/{useAuth-CVLv2oKA.js → useAuth-CWBApIWg.js}

@@ -1,5 +1,5 @@
 import { jsx as oe, jsxs as He } from "react/jsx-runtime";
-import { useEffect as O, useState as b, useRef as N, useCallback as E, useMemo as V } from "react";
+import { useEffect as O, useState as U, useRef as N, useCallback as E, useMemo as V } from "react";
 import { A as Je, a as Me, C as Ve } from "./LoadingSpinner-6vml-zwr.js";
 import { A as pe, g as se, a as ye, h as M, u as ke } from "./useCedrosLogin-CFfID-0i.js";
 let q = 0;
@@ -34,10 +34,10 @@ const Ne = {
   instantLink: !0
 };
 function Ye(e, t, A) {
-  const [i, r] = b(null), [n, o] = b(), [a, g] = b(), [s, k] = b(), [y, w] = b(t), U = N(!1);
+  const [i, r] = U(null), [n, o] = U(), [a, g] = U(), [s, k] = U(), [y, w] = U(), [b, Q] = U(t), u = N(!1);
   return O(() => {
-    if (!t || U.current) return;
-    U.current = !0, new pe({
+    if (!t || u.current) return;
+    u.current = !0, new pe({
       baseUrl: e,
       timeoutMs: A ?? 5e3,
       retryAttempts: 1
@@ -49,13 +49,13 @@ function Ye(e, t, A) {
         solana: C.solana,
         webauthn: C.webauthn,
         instantLink: C.instantLink
-      }), o(C.googleClientId), g(C.appleClientId), k(C.socialButtonOrder);
+      }), o(C.googleClientId), g(C.appleClientId), k(C.usernameEnabled), w(C.socialButtonOrder);
     }).catch(() => {
       r(Ne);
     }).finally(() => {
-      w(!1);
+      Q(!1);
     });
-  }, [t, e, A]), { features: i, googleClientId: n, appleClientId: a, socialButtonOrder: s, isLoading: y };
+  }, [t, e, A]), { features: i, googleClientId: n, appleClientId: a, usernameEnabled: s, socialButtonOrder: y, isLoading: b };
 }
 const Oe = "cedros_tokens", xe = 6e4;
 class ve {
@@ -310,18 +310,18 @@ function Xe({
   callbacks: A,
   requestTimeoutMs: i
 }) {
-  const [r, n] = b(null), [o, a] = b("idle"), g = N(null), s = N(null), k = N(A), y = N(!0), w = N(null), U = N(() => Promise.resolve()), Q = N(() => {
+  const [r, n] = U(null), [o, a] = U("idle"), g = N(null), s = N(null), k = N(A), y = N(!0), w = N(null), b = N(() => Promise.resolve()), Q = N(() => {
   });
   O(() => {
     k.current = A;
   }, [A]), O(() => (y.current = !0, () => {
     y.current = !1;
   }), []);
-  const C = E((h) => {
+  const u = E((h) => {
     y.current && n(h);
   }, []), B = E((h) => {
     y.current && a(h);
-  }, []), u = V(
+  }, []), C = V(
     () => ({
       storage: t?.storage ?? "cookie",
       autoRefresh: t?.autoRefresh ?? !0,
@@ -338,18 +338,18 @@ function Xe({
     ]
   );
   O(() => {
-    const h = new ve(u.storage, u.persistKey, {
-      allowWebStorage: u.allowWebStorage
+    const h = new ve(C.storage, C.persistKey, {
+      allowWebStorage: C.allowWebStorage
     });
-    return g.current = h, u.autoRefresh && h.setRefreshCallback(() => U.current()), h.setSessionExpiredCallback(() => Q.current()), u.syncTabs && (s.current = new Re()), () => {
+    return g.current = h, C.autoRefresh && h.setRefreshCallback(() => b.current()), h.setSessionExpiredCallback(() => Q.current()), C.syncTabs && (s.current = new Re()), () => {
       h.destroy(), g.current = null, s.current?.close();
     };
   }, [
-    u.storage,
-    u.syncTabs,
-    u.persistKey,
-    u.allowWebStorage,
-    u.autoRefresh
+    C.storage,
+    C.syncTabs,
+    C.persistKey,
+    C.allowWebStorage,
+    C.autoRefresh
   ]);
   const K = E(async () => {
     if (w.current)
@@ -377,7 +377,7 @@ function Xe({
           if (!Le(ne.tokens))
             throw new Error("Invalid token response structure");
           g.current?.setTokens(ne.tokens);
-        } else if (u.storage !== "cookie")
+        } else if (C.storage !== "cookie")
           throw new Error("Token refresh failed");
         s.current?.broadcastRefresh(), m();
       } catch (X) {
@@ -392,15 +392,15 @@ function Xe({
     } finally {
       w.current = null;
     }
-  }, [e, u.storage, i]), p = E(() => {
-    if (u.storage === "cookie") return;
+  }, [e, C.storage, i]), p = E(() => {
+    if (C.storage === "cookie") return;
     const h = g.current?.getAccessToken();
     if (h)
       return { Authorization: `Bearer ${h}` };
-  }, [u.storage]), F = E(() => {
-    g.current?.clear(), C(null), B("unauthenticated"), k.current?.onSessionExpired?.();
-  }, [B, C]);
-  U.current = K, Q.current = F;
+  }, [C.storage]), F = E(() => {
+    g.current?.clear(), u(null), B("unauthenticated"), k.current?.onSessionExpired?.();
+  }, [B, u]);
+  b.current = K, Q.current = F;
   const d = E(
     (h) => {
       const S = new AbortController(), G = i ?? 1e4, H = window.setTimeout(() => S.abort(), G), m = {}, J = p();
@@ -423,11 +423,11 @@ function Xe({
       if (S.ok) {
         const G = await S.json();
         if (_(G)) {
-          C(G.user), B("authenticated");
+          u(G.user), B("authenticated");
           return;
         }
       }
-      if (S.status === 401 && u.autoRefresh) {
+      if (S.status === 401 && C.autoRefresh) {
         try {
           await K();
         } catch {
@@ -440,7 +440,7 @@ function Xe({
           if (H.ok) {
             const m = await H.json();
             if (_(m)) {
-              C(m.user), B("authenticated");
+              u(m.user), B("authenticated");
               return;
             }
           }
@@ -448,29 +448,29 @@ function Xe({
           G.cleanup();
         }
       }
-      C(null), B("unauthenticated");
+      u(null), B("unauthenticated");
     } catch {
-      C(null), B("unauthenticated");
+      u(null), B("unauthenticated");
     } finally {
       h.cleanup();
     }
   }, [
     e,
-    u.autoRefresh,
+    C.autoRefresh,
     K,
     d,
     F,
     B,
-    C
+    u
   ]);
   O(() => {
-    !s.current || !u.syncTabs || s.current.setCallback((h) => {
+    !s.current || !C.syncTabs || s.current.setCallback((h) => {
       switch (h.type) {
         case "login":
-          C(h.user), B("authenticated");
+          u(h.user), B("authenticated");
           break;
         case "logout":
-          C(null), B("unauthenticated"), g.current?.clear();
+          u(null), B("unauthenticated"), g.current?.clear();
           break;
         case "refresh":
           l();
@@ -479,7 +479,7 @@ function Xe({
           console.warn("[Cedros Login] Unhandled tab sync event:", h);
       }
     });
-  }, [u.syncTabs, l, B, C]), O(() => {
+  }, [C.syncTabs, l, B, u]), O(() => {
     const h = new AbortController(), S = i ?? 1e4, G = window.setTimeout(() => h.abort(), S);
     return (async () => {
       B("loading");
@@ -492,11 +492,11 @@ function Xe({
         if (m.ok) {
           const J = await m.json();
           if (_(J)) {
-            C(J.user), B("authenticated");
+            u(J.user), B("authenticated");
             return;
           }
         }
-        if (m.status === 401 && u.autoRefresh) {
+        if (m.status === 401 && C.autoRefresh) {
           try {
             await K();
           } catch {
@@ -511,33 +511,33 @@ function Xe({
           if (J.ok) {
             const Y = await J.json();
             if (_(Y)) {
-              C(Y.user), B("authenticated");
+              u(Y.user), B("authenticated");
               return;
             }
           }
         }
-        C(null), B("unauthenticated");
+        u(null), B("unauthenticated");
       } catch {
-        C(null), B("unauthenticated");
+        u(null), B("unauthenticated");
       }
     })(), () => {
       window.clearTimeout(G), h.abort();
     };
   }, [
     e,
-    u.autoRefresh,
+    C.autoRefresh,
     K,
     p,
     F,
     B,
-    C,
+    u,
     i
   ]);
   const I = E(
     (h, S) => {
-      C(h), B("authenticated"), S && g.current?.setTokens(S), y.current && s.current?.broadcastLogin(h);
+      u(h), B("authenticated"), S && g.current?.setTokens(S), y.current && s.current?.broadcastLogin(h);
     },
-    [C, B]
+    [u, B]
   ), c = E(async () => {
     const h = se(), S = new AbortController(), G = i ?? 1e4, H = window.setTimeout(() => S.abort(), G);
     try {
@@ -552,9 +552,9 @@ function Xe({
       });
     } catch {
     } finally {
-      window.clearTimeout(H), C(null), B("unauthenticated"), g.current?.clear(), s.current?.broadcastLogout(), k.current?.onLogout?.();
+      window.clearTimeout(H), u(null), B("unauthenticated"), g.current?.clear(), s.current?.broadcastLogout(), k.current?.onLogout?.();
     }
-  }, [e, p, C, B, i]), f = E(() => g.current?.getAccessToken() ?? null, []);
+  }, [e, p, u, B, i]), f = E(() => g.current?.getAccessToken() ?? null, []);
   return {
     user: r,
     authState: o,
@@ -919,7 +919,7 @@ function me(e, t) {
       i = new Uint8Array(I, l, $);
     }), w = (l = null) => {
       r = !0, A.exports.Hash_Init(l);
-    }, U = (l) => {
+    }, b = (l) => {
       let I = 0;
       for (; I < l.length; ) {
         const c = l.subarray(I, I + $);
@@ -929,12 +929,12 @@ function me(e, t) {
       if (!r)
         throw new Error("update() called before init()");
       const I = v(l);
-      U(I);
-    }, C = new Uint8Array(t * 2), B = (l, I = null) => {
+      b(I);
+    }, u = new Uint8Array(t * 2), B = (l, I = null) => {
       if (!r)
         throw new Error("digest() called before init()");
-      return r = !1, A.exports.Hash_Final(I), l === "binary" ? i.slice(0, t) : ue(C, i, t);
-    }, u = () => {
+      return r = !1, A.exports.Hash_Final(I), l === "binary" ? i.slice(0, t) : ue(u, i, t);
+    }, C = () => {
       if (!r)
         throw new Error("save() can only be called after init() and before digest()");
       const l = A.exports.Hash_GetState(), I = s(), c = A.exports.memory.buffer, f = new Uint8Array(c, l, I), h = new Uint8Array(W + I);
@@ -975,7 +975,7 @@ function me(e, t) {
       if (!F(l, I))
         return w(I), Q(l), B("hex", c);
       const f = v(l);
-      return i.set(f), A.exports.Hash_Calculate(f.length, I, c), ue(C, i, t);
+      return i.set(f), A.exports.Hash_Calculate(f.length, I, c), ue(u, i, t);
     };
     return yield y(), {
       getMemory: o,
@@ -985,7 +985,7 @@ function me(e, t) {
       init: w,
       update: Q,
       digest: B,
-      save: u,
+      save: C,
       load: K,
       calculate: d,
       hashLength: t
@@ -1081,14 +1081,14 @@ function Ut(e) {
       fe(512)
     ]);
     y.setMemorySize(s * 1024 + 1024);
-    const U = new Uint8Array(24), Q = new DataView(U.buffer);
-    Q.setInt32(0, A, !0), Q.setInt32(4, r, !0), Q.setInt32(8, s, !0), Q.setInt32(12, i, !0), Q.setInt32(16, a, !0), Q.setInt32(20, g, !0), y.writeMemory(U, s * 1024), w.init(), w.update(U), w.update(x(n.length)), w.update(n), w.update(x(o.length)), w.update(o), w.update(x(k.length)), w.update(k), w.update(x(0));
-    const B = Math.floor(s / (A * 4)) * 4, u = new Uint8Array(72), K = w.digest("binary");
-    u.set(K);
+    const b = new Uint8Array(24), Q = new DataView(b.buffer);
+    Q.setInt32(0, A, !0), Q.setInt32(4, r, !0), Q.setInt32(8, s, !0), Q.setInt32(12, i, !0), Q.setInt32(16, a, !0), Q.setInt32(20, g, !0), y.writeMemory(b, s * 1024), w.init(), w.update(b), w.update(x(n.length)), w.update(n), w.update(x(o.length)), w.update(o), w.update(x(k.length)), w.update(k), w.update(x(0));
+    const B = Math.floor(s / (A * 4)) * 4, C = new Uint8Array(72), K = w.digest("binary");
+    C.set(K);
     for (let d = 0; d < A; d++) {
-      u.set(x(0), 64), u.set(x(d), 68);
-      let l = d * B, I = yield le(w, u, 1024);
-      y.writeMemory(I, l * 1024), l += 1, u.set(x(1), 64), I = yield le(w, u, 1024), y.writeMemory(I, l * 1024);
+      C.set(x(0), 64), C.set(x(d), 68);
+      let l = d * B, I = yield le(w, C, 1024);
+      y.writeMemory(I, l * 1024), l += 1, C.set(x(1), 64), I = yield le(w, C, 1024), y.writeMemory(I, l * 1024);
     }
     const p = new Uint8Array(1024);
     Ue(p, y.calculate(new Uint8Array([]), s));
@@ -1431,7 +1431,7 @@ function xt(e) {
   }
 }
 function vt() {
-  const e = ye(), [t, A] = b(!1), [i, r] = b(null), n = e?.config.serverUrl, o = e?.config.requestTimeout, a = e?.config.retryAttempts, g = e?._internal?.getAccessToken, s = V(() => e ? new pe({
+  const e = ye(), [t, A] = U(!1), [i, r] = U(null), n = e?.config.serverUrl, o = e?.config.requestTimeout, a = e?.config.retryAttempts, g = e?._internal?.getAccessToken, s = V(() => e ? new pe({
     baseUrl: n,
     timeoutMs: o,
     retryAttempts: a,
@@ -1477,7 +1477,7 @@ function vt() {
       }
     },
     [s]
-  ), U = E(
+  ), b = E(
     async (I) => {
       if (!s)
         throw new Error("useWalletMaterial must be used within a CedrosLoginProvider");
@@ -1507,7 +1507,7 @@ function vt() {
       }
     },
     [s]
-  ), C = E(
+  ), u = E(
     async (I) => {
       if (!s)
         throw new Error("useWalletMaterial must be used within a CedrosLoginProvider");
@@ -1540,7 +1540,7 @@ function vt() {
       }
     },
     [s]
-  ), u = E(async () => {
+  ), C = E(async () => {
     if (!s)
       throw new Error("useWalletMaterial must be used within a CedrosLoginProvider");
     A(!0), r(null);
@@ -1614,11 +1614,11 @@ function vt() {
     getStatus: k,
     getMaterial: y,
     enroll: w,
-    recover: U,
+    recover: b,
     signTransaction: Q,
-    rotateUserSecret: C,
+    rotateUserSecret: u,
     unlock: B,
-    lock: u,
+    lock: C,
     getShareBForRecovery: K,
     createDerivedWallet: p,
     listAllWallets: F,
@@ -1643,7 +1643,7 @@ const Tt = {
   }
 };
 function Rt() {
-  const t = ye() !== null, [A, i] = b("loading"), [r, n] = b(null), [o, a] = b(null), [g, s] = b(!1), [k, y] = b(!1), [w, U] = b(null), [Q, C] = b(null), { getStatus: B, isLoading: u } = vt(), K = N(!1);
+  const t = ye() !== null, [A, i] = U("loading"), [r, n] = U(null), [o, a] = U(null), [g, s] = U(!1), [k, y] = U(!1), [w, b] = U(null), [Q, u] = U(null), { getStatus: B, isLoading: C } = vt(), K = N(!1);
   O(() => {
     if (!t) return;
     let d = !1;
@@ -1651,12 +1651,12 @@ function Rt() {
       try {
         const I = await Ot();
         if (d) return;
-        U(I), I.allSupported || (i("error"), C(
+        b(I), I.allSupported || (i("error"), u(
           "Your browser or device does not support all required features. Please use a modern browser with a platform authenticator."
         ));
       } catch {
         if (d) return;
-        U(null), i("error"), C("Failed to check crypto capabilities");
+        b(null), i("error"), u("Failed to check crypto capabilities");
       }
     })(), () => {
       d = !0;
@@ -1664,19 +1664,19 @@ function Rt() {
   }, [t]);
   const p = E(async () => {
     if (!(!t || !w?.allSupported)) {
-      i("loading"), C(null);
+      i("loading"), u(null);
       try {
         const d = await B();
         n(d.solanaPubkey ?? null), a(d.authMethod ?? null), s(d.hasExternalWallet), y(d.unlocked), d.hasExternalWallet ? i("enrolled_unlocked") : d.enrolled ? i(d.unlocked ? "enrolled_unlocked" : "enrolled_locked") : i("not_enrolled");
       } catch (d) {
-        i("error"), C(d instanceof Error ? d.message : "Failed to fetch wallet status");
+        i("error"), u(d instanceof Error ? d.message : "Failed to fetch wallet status");
       }
     }
   }, [t, w?.allSupported, B]);
   O(() => {
-    t && w?.allSupported && !u && !K.current && (K.current = !0, p());
-  }, [t, w?.allSupported, u, p]);
-  const F = E(() => C(null), []);
+    t && w?.allSupported && !C && !K.current && (K.current = !0, p());
+  }, [t, w?.allSupported, C, p]);
+  const F = E(() => u(null), []);
   return t ? {
     status: A,
     solanaPubkey: r,
@@ -1726,7 +1726,7 @@ function Xt() {
   }, [n, o, t, A, i, r]), null;
 }
 function gA({ config: e, children: t }) {
-  const [A, i] = b(null), [r, n] = b(!1), o = N(e.callbacks);
+  const [A, i] = U(null), [r, n] = U(!1), o = N(e.callbacks);
   o.current = e.callbacks;
   const a = N({
     onLoginSuccess: (...L) => o.current?.onLoginSuccess?.(...L),
@@ -1738,7 +1738,7 @@ function gA({ config: e, children: t }) {
     googleClientId: k,
     appleClientId: y,
     socialButtonOrder: w,
-    isLoading: U
+    isLoading: b
   } = Ye(
     e.serverUrl,
     g,
@@ -1748,10 +1748,10 @@ function gA({ config: e, children: t }) {
     features: s,
     googleClientId: e.googleClientId ?? k,
     appleClientId: e.appleClientId ?? y
-  }, [e, g, s, k, y]), C = V(
+  }, [e, g, s, k, y]), u = V(
     () => JSON.stringify(Q.themeOverrides ?? null),
     [Q.themeOverrides]
-  ), B = V(() => JSON.stringify(Q.session ?? null), [Q.session]), u = V(() => JSON.stringify(Q.features ?? null), [Q.features]), K = V(() => JSON.stringify(Q.forms ?? null), [Q.forms]), p = V(
+  ), B = V(() => JSON.stringify(Q.session ?? null), [Q.session]), C = V(() => JSON.stringify(Q.features ?? null), [Q.features]), K = V(() => JSON.stringify(Q.forms ?? null), [Q.forms]), p = V(
     () => Q,
     // eslint-disable-next-line react-hooks/exhaustive-deps -- Using serialized keys for deep comparison; callbacks excluded (see UI-06)
     [
@@ -1761,9 +1761,9 @@ function gA({ config: e, children: t }) {
       Q.requestTimeout,
       Q.retryAttempts,
       Q.theme,
-      C,
-      B,
       u,
+      B,
+      C,
       K
     ]
   );
@@ -1816,7 +1816,7 @@ function gA({ config: e, children: t }) {
     () => ({ ...m, ...J }),
     [m, J]
   );
-  return g && U ? null : /* @__PURE__ */ oe(Je.Provider, { value: m, children: /* @__PURE__ */ oe(Me.Provider, { value: J, children: /* @__PURE__ */ He(Ve.Provider, { value: Y, children: [
+  return g && b ? null : /* @__PURE__ */ oe(Je.Provider, { value: m, children: /* @__PURE__ */ oe(Me.Provider, { value: J, children: /* @__PURE__ */ He(Ve.Provider, { value: Y, children: [
     /* @__PURE__ */ oe(Xt, {}),
     t
   ] }) }) });