@embarkai/ui-kit 0.4.25 → 0.4.27

package/dist/chunk-7G3OIJGJ.js

@@ -1,1091 +0,0 @@
-import {
-  AccountAbstractionError,
-  DiscordIcon,
-  ErrorCodes,
-  GoogleIcon,
-  TelegramIcon,
-  TwitterIcon,
-  getIframeManager,
-  getServiceUrls,
-  init_assets,
-  init_initial
-} from "./chunk-MLUPZCC3.js";
-import {
-  __export,
-  __reExport
-} from "./chunk-DBFKMKYT.js";
-
-// src/internal/lib/site.ts
-var DAPP_NAME = "passport";
-
-// src/internal/auth/index.ts
-import {
-  JwtTokenManager,
-  createJwtTokenManager,
-  jwtTokenManager as jwtTokenManager2,
-  configureJwtModule,
-  logout,
-  verifyToken,
-  ensureValidToken,
-  getValidTokens,
-  authenticatedFetch,
-  loginWithUserId,
-  loginWithEmail,
-  loginWithTelegram,
-  syncKeyshareStatus
-} from "@embarkai/core/auth";
-
-// src/internal/auth/passkeyAuth.ts
-init_initial();
-import { jwtTokenManager } from "@embarkai/core/auth";
-
-// src/internal/utils/projectId.ts
-function addProjectIdToUrl(url) {
-  try {
-    const projectId = typeof window !== "undefined" ? window.__EMBARK_PROJECT_ID__ : void 0;
-    if (projectId) {
-      const separator = url.includes("?") ? "&" : "?";
-      return `${url}${separator}projectId=${encodeURIComponent(projectId)}`;
-    }
-  } catch {
-  }
-  return url;
-}
-function getProjectId() {
-  try {
-    return typeof window !== "undefined" ? window.__EMBARK_PROJECT_ID__ : void 0;
-  } catch {
-    return void 0;
-  }
-}
-
-// src/internal/auth/base64url.ts
-var base64url_exports = {};
-__export(base64url_exports, {
-  arrayBufferToBase64url: () => arrayBufferToBase64url,
-  base64urlToUint8Array: () => base64urlToUint8Array
-});
-__reExport(base64url_exports, auth_star);
-import * as auth_star from "@embarkai/core/auth";
-function arrayBufferToBase64url(buffer) {
-  const bytes = new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.byteLength; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  const base64 = btoa(binary);
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function base64urlToUint8Array(base64url) {
-  const base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
-  const pad = base64.length % 4 ? 4 - base64.length % 4 : 0;
-  const padded = base64 + "=".repeat(pad);
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-
-// src/internal/auth/webauthn.ts
-function credentialToAttestationPayload(credential) {
-  const response = credential.response;
-  const transports = response.getTransports?.() || [];
-  return {
-    id: credential.id,
-    rawId: arrayBufferToBase64url(credential.rawId),
-    type: credential.type,
-    response: {
-      clientDataJSON: arrayBufferToBase64url(response.clientDataJSON),
-      attestationObject: arrayBufferToBase64url(response.attestationObject),
-      transports
-    }
-  };
-}
-
-// src/internal/auth/passkeyAuth.ts
-function getTssUrl() {
-  return getServiceUrls().tssUrl;
-}
-async function beginPasskeyAuthentication(username) {
-  const response = await fetch(addProjectIdToUrl(`${getTssUrl()}/api/auth/passkey/login/begin`), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    credentials: "include",
-    body: JSON.stringify({ username })
-  });
-  if (!response.ok) {
-    const errorText = await response.text().catch(() => "Failed to begin authentication");
-    throw new Error(`Begin auth failed: ${response.status} ${errorText}`);
-  }
-  const beginResponse = await response.json();
-  const options = {
-    challenge: base64urlToUint8Array(beginResponse.challenge),
-    allowCredentials: (beginResponse.allowCredentials || []).map((cred) => ({
-      type: cred.type,
-      id: base64urlToUint8Array(cred.id),
-      transports: cred.transports
-    })),
-    timeout: beginResponse.timeout,
-    userVerification: beginResponse.userVerification || "preferred",
-    extensions: beginResponse.extensions
-  };
-  return {
-    challenge: beginResponse.challenge,
-    challengeId: beginResponse.challengeId,
-    options
-  };
-}
-async function completePasskeyAuthentication(challengeId, credential, options) {
-  const response = credential.response;
-  const credentialData = {
-    id: credential.id,
-    rawId: arrayBufferToBase64url(credential.rawId),
-    type: credential.type,
-    response: {
-      clientDataJSON: arrayBufferToBase64url(response.clientDataJSON),
-      authenticatorData: arrayBufferToBase64url(response.authenticatorData),
-      signature: arrayBufferToBase64url(response.signature),
-      userHandle: response.userHandle ? arrayBufferToBase64url(response.userHandle) : null
-    }
-  };
-  const completeResponse = await fetch(addProjectIdToUrl(`${getTssUrl()}/api/auth/passkey/login/complete`), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    credentials: "include",
-    body: JSON.stringify({ challengeId, credential: credentialData })
-  });
-  if (!completeResponse.ok) {
-    let message = "Authentication failed";
-    try {
-      const err = await completeResponse.json();
-      message = err?.message || message;
-    } catch {
-      try {
-        const text = await completeResponse.text();
-        message = (text || message).slice(0, 200);
-      } catch {
-      }
-    }
-    throw new Error(`Complete authentication failed: ${completeResponse.status} ${message}`);
-  }
-  const loginResponse = await completeResponse.json();
-  if (!options?.skipTokenSave) {
-    await jwtTokenManager.setTokens(loginResponse);
-  }
-  return loginResponse;
-}
-async function beginPasskeyRegistration(username) {
-  const response = await fetch(addProjectIdToUrl(`${getTssUrl()}/api/auth/passkey/register/begin`), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    credentials: "include",
-    body: JSON.stringify({ username })
-  });
-  if (!response.ok) {
-    const errorText = await response.text().catch(() => "Failed to begin registration");
-    throw new Error(`Begin registration failed: ${response.status} ${errorText}`);
-  }
-  const beginResponse = await response.json();
-  const options = {
-    rp: beginResponse.rp,
-    user: {
-      id: base64urlToUint8Array(beginResponse.user.id),
-      name: beginResponse.user.name,
-      displayName: beginResponse.user.displayName
-    },
-    challenge: base64urlToUint8Array(beginResponse.challenge),
-    pubKeyCredParams: beginResponse.pubKeyCredParams,
-    timeout: beginResponse.timeout,
-    attestation: beginResponse.attestation,
-    authenticatorSelection: {
-      ...beginResponse.authenticatorSelection,
-      residentKey: "preferred",
-      requireResidentKey: false,
-      userVerification: "preferred"
-    },
-    excludeCredentials: beginResponse.excludeCredentials?.map((cred) => ({
-      type: cred.type,
-      id: base64urlToUint8Array(cred.id),
-      transports: cred.transports
-    })) || void 0
-  };
-  return {
-    challengeId: beginResponse.challengeId,
-    options
-  };
-}
-async function completePasskeyRegistration(challengeId, credential, options) {
-  const credentialData = credentialToAttestationPayload(credential);
-  const completeResponse = await fetch(addProjectIdToUrl(`${getTssUrl()}/api/auth/passkey/register/complete`), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    credentials: "include",
-    body: JSON.stringify({ challengeId, credential: credentialData })
-  });
-  if (!completeResponse.ok) {
-    const errorText = await completeResponse.text().catch(() => "Registration failed");
-    throw new Error(errorText);
-  }
-  const loginResponse = await completeResponse.json();
-  if (!options?.skipTokenSave) {
-    await jwtTokenManager.setTokens(loginResponse);
-  }
-  return loginResponse;
-}
-
-// src/internal/auth/telegram.ts
-import { isHex, toHex, keccak256, stringToBytes } from "viem";
-function deriveDemoPrivateKey(user, salt) {
-  const base = `${user.id}:${salt}`;
-  const h = keccak256(stringToBytes(base));
-  const pk = h.slice(0, 66);
-  return isHex(pk) ? pk : toHex(h).slice(0, 66);
-}
-function initTelegramWidget(botUsername, onAuth, salt = "demo", rootId = "tg-root") {
-  const root = document.getElementById(rootId);
-  if (!root) {
-    console.warn(`[Telegram] No ${rootId} element found`);
-    return () => {
-    };
-  }
-  root.innerHTML = "";
-  window.onTelegramAuth = async (user) => {
-    if (!user?.id || !user.auth_date || !user.hash) throw new Error("Invalid Telegram auth payload");
-    const privateKey = deriveDemoPrivateKey(user, salt);
-    const displayName = user.first_name || user.username || `User ${user.id}`;
-    await onAuth({ user, privateKey, displayName });
-  };
-  const script = document.createElement("script");
-  script.async = true;
-  script.src = "https://telegram.org/js/telegram-widget.js?22";
-  script.setAttribute("data-telegram-login", botUsername);
-  script.setAttribute("data-size", "large");
-  script.setAttribute("data-userpic", "true");
-  script.setAttribute("data-onauth", "onTelegramAuth(user)");
-  script.setAttribute("data-request-access", "write");
-  script.onerror = (error) => {
-    console.error("[Telegram] Failed to load widget script:", error);
-  };
-  root.appendChild(script);
-  return () => {
-    try {
-      delete window.onTelegramAuth;
-      if (root) root.innerHTML = "";
-      if (script && script.parentElement && document.contains(script)) script.parentElement.removeChild(script);
-    } catch {
-    }
-  };
-}
-function hideTelegramWidget() {
-  try {
-    const root = document.getElementById("tg-root");
-    if (root) root.style.display = "none";
-  } catch {
-  }
-}
-function showTelegramWidget() {
-  try {
-    const root = document.getElementById("tg-root");
-    if (root) root.style.display = "";
-  } catch {
-  }
-}
-
-// src/internal/lib/iframe-mpc-client.ts
-import { logSdkError } from "@embarkai/core/internal/error-tracking";
-var currentSigningStats = null;
-async function ensureDkgAndGetOwner(userId, _clientSeedHex) {
-  try {
-    const iframeManager = getIframeManager();
-    const keyshareStatus = await iframeManager.checkKeyshare(userId);
-    if (keyshareStatus.hasKeyshare && keyshareStatus.address) {
-      return {
-        sessionId: "iframe-session",
-        ownerAddress: keyshareStatus.address
-      };
-    }
-    await iframeManager.authenticate(userId);
-    const { jwtTokenManager: jwtTokenManager3 } = await import("./auth-GP4VPOSM.js");
-    let accessToken = jwtTokenManager3.getAccessToken();
-    if (!accessToken) {
-      console.warn("[iframe-mpc-client] No access token available for DKG, attempting cookie-based session");
-      accessToken = void 0;
-    }
-    const ownerAddress = await iframeManager.startDKG(userId, accessToken);
-    return {
-      sessionId: "iframe-session",
-      ownerAddress
-    };
-  } catch (error) {
-    logSdkError(error instanceof Error ? error : new Error("DKG failed"), { userId }, "iframe-mpc");
-    throw error;
-  }
-}
-function isChannelError(error) {
-  const message = error.message.toLowerCase();
-  return message.includes("invalid sdk channel") || message.includes("sdk channel not found") || message.includes("sdk channel expired") || // Backward compatibility
-  message === "invalid session";
-}
-async function signDigestWithMpc(userId, digest32, userOpDetails) {
-  const MAX_RETRIES = 1;
-  const startTime = performance.now();
-  currentSigningStats = {
-    startTime,
-    rounds: []
-  };
-  let lastError;
-  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-    try {
-      const iframeManager = getIframeManager();
-      const { jwtTokenManager: jwtTokenManager3 } = await import("./auth-GP4VPOSM.js");
-      const accessToken = jwtTokenManager3.getAccessToken();
-      if (!accessToken) {
-        throw new Error("No access token available for signing");
-      }
-      const batchOperations = userOpDetails?.operations || [];
-      const firstBatchOperation = batchOperations[0];
-      const batchValue = batchOperations.length > 0 ? batchOperations.reduce((total, operation) => total + BigInt(operation.value || "0"), 0n).toString() : void 0;
-      const transaction = {
-        to: userOpDetails?.callTarget || firstBatchOperation?.to || "0x0000000000000000000000000000000000000000",
-        value: userOpDetails?.value || batchValue || "0",
-        data: userOpDetails?.callData || firstBatchOperation?.data || "0x",
-        digest32,
-        // Pre-computed digest - DO NOT recompute!
-        // Additional UserOp fields for display in confirmation modal
-        userOpDetails
-      };
-      const signature = await iframeManager.signTransaction(userId, transaction, accessToken);
-      const endTime = performance.now();
-      currentSigningStats.endTime = endTime;
-      currentSigningStats.totalDurationMs = endTime - startTime;
-      return signature;
-    } catch (error) {
-      lastError = error instanceof Error ? error : new Error("MPC signing failed");
-      if (isChannelError(lastError) && attempt < MAX_RETRIES) {
-        console.warn(`[MPC] SDK channel error, reconnecting and retrying (attempt ${attempt + 1})...`);
-        try {
-          await getIframeManager().reconnect();
-          continue;
-        } catch (reconnectError) {
-          console.error("[MPC] Reconnect failed:", reconnectError);
-        }
-      }
-      logSdkError(lastError, { userId, hasUserOpDetails: !!userOpDetails, attempt }, "iframe-mpc");
-      const endTime = performance.now();
-      if (currentSigningStats) {
-        currentSigningStats.endTime = endTime;
-        currentSigningStats.totalDurationMs = endTime - startTime;
-      }
-      if (lastError instanceof AccountAbstractionError) {
-        throw lastError;
-      }
-      throw new AccountAbstractionError(lastError.message, ErrorCodes.MPC_SIGNING_ERROR);
-    }
-  }
-  throw lastError || new Error("MPC signing failed after retries");
-}
-async function signTypedDataWithMpc(userId, digest32, typedData) {
-  const startTime = performance.now();
-  currentSigningStats = {
-    startTime,
-    rounds: []
-  };
-  try {
-    console.log("[signTypedDataWithMpc] Starting EIP712 signature request:", {
-      userId,
-      primaryType: typedData?.primaryType,
-      digest32
-    });
-    const iframeManager = getIframeManager();
-    const { jwtTokenManager: jwtTokenManager3 } = await import("./auth-GP4VPOSM.js");
-    const accessToken = jwtTokenManager3.getAccessToken();
-    if (!accessToken) {
-      console.error("[signTypedDataWithMpc] No access token available");
-      throw new Error("No access token available for signing");
-    }
-    console.log("[signTypedDataWithMpc] Calling iframeManager.signTypedData...");
-    const signature = await iframeManager.signTypedData(userId, typedData, digest32, accessToken);
-    console.log("[signTypedDataWithMpc] Signature received:", signature);
-    const endTime = performance.now();
-    currentSigningStats.endTime = endTime;
-    currentSigningStats.totalDurationMs = endTime - startTime;
-    return signature;
-  } catch (error) {
-    console.error("[signTypedDataWithMpc] Error occurred:", error);
-    logSdkError(
-      error instanceof Error ? error : new Error("EIP712 MPC signing failed"),
-      { userId, primaryType: typedData?.primaryType },
-      "iframe-mpc"
-    );
-    const endTime = performance.now();
-    if (currentSigningStats) {
-      currentSigningStats.endTime = endTime;
-      currentSigningStats.totalDurationMs = endTime - startTime;
-    }
-    if (error instanceof AccountAbstractionError) {
-      throw error;
-    }
-    throw new AccountAbstractionError(
-      error instanceof Error ? error.message : "EIP712 MPC signing failed",
-      ErrorCodes.MPC_SIGNING_ERROR
-    );
-  }
-}
-async function checkKeyshare(userId) {
-  try {
-    const iframeManager = getIframeManager();
-    return await iframeManager.checkKeyshare(userId);
-  } catch (error) {
-    console.error("[IframeMPC] Error checking keyshare:", error);
-    return { hasKeyshare: false };
-  }
-}
-
-// src/internal/auth/keyshare.ts
-async function checkKeyshareStatusWithSync(userId) {
-  const serverHasKeyshare = await syncKeyshareStatus();
-  return checkKeyshareStatus(userId, serverHasKeyshare);
-}
-async function checkKeyshareStatus(userId, serverHasKeyshare) {
-  const keyshareInfo = await checkKeyshare(userId);
-  const hasLocalKeyshare = keyshareInfo.hasKeyshare;
-  const localOwnerAddress = keyshareInfo.address;
-  console.log("[checkKeyshareStatus] Checking via iframe:", {
-    userId,
-    serverHasKeyshare,
-    hasLocalKeyshare,
-    ownerAddress: localOwnerAddress
-  });
-  let needsDkg = false;
-  let needsRecovery = false;
-  if (!serverHasKeyshare && !hasLocalKeyshare) needsDkg = true;
-  else if (serverHasKeyshare && !hasLocalKeyshare) needsRecovery = true;
-  else if (!serverHasKeyshare && hasLocalKeyshare) {
-    needsDkg = true;
-  }
-  const result = {
-    hasServerKeyshare: serverHasKeyshare,
-    hasLocalKeyshare,
-    needsDkg,
-    needsRecovery,
-    ownerAddress: localOwnerAddress
-  };
-  console.log("[checkKeyshareStatus] Result:", result);
-  return result;
-}
-async function ensureKeyshareForNewUser(userId, onProgress) {
-  onProgress?.("Setting up secure key management...");
-  const result = await ensureDkgAndGetOwner(userId);
-  if (!result.ownerAddress) throw new Error("DKG completed but no owner address received");
-  await syncKeyshareStatus();
-  onProgress?.("Key management setup complete");
-  return { ownerAddress: result.ownerAddress };
-}
-async function ensureKeyshare(userId, serverHasKeyshare, onProgress, isNewUser) {
-  console.log("[ensureKeyshare] Called with:", { userId, serverHasKeyshare, isNewUser });
-  const status = await checkKeyshareStatus(userId, serverHasKeyshare);
-  if (!status.needsDkg && !status.needsRecovery && status.ownerAddress) {
-    console.log("[ensureKeyshare] Keyshare already ready, returning");
-    onProgress?.("Keyshare ready");
-    return { ownerAddress: status.ownerAddress };
-  }
-  if (status.needsRecovery) {
-    console.log("[ensureKeyshare] Recovery needed, checking backups...");
-    onProgress?.("Checking backup availability...");
-    const { checkServerBackupAvailability, getBackupStatus } = await import("./vaultClient-MWKJKXZC.js");
-    const localBackupStatus = getBackupStatus(userId);
-    const serverBackupResult = await checkServerBackupAvailability();
-    const hasLocalBackup = localBackupStatus.local.enabled && localBackupStatus.local.lastBackup;
-    const hasCloudBackup = localBackupStatus.cloud.enabled && localBackupStatus.cloud.lastBackup;
-    const hasAnyBackup = serverBackupResult.hasBackup || hasLocalBackup || hasCloudBackup;
-    if (!serverBackupResult.serviceAvailable) {
-      if (!hasLocalBackup && !hasCloudBackup) {
-        const e = new Error("Your account exists but backup verification failed.\n\nThe backup server is currently unavailable.");
-        e.code = "BACKUP_SERVICE_UNAVAILABLE";
-        e.userId = userId;
-        e.serverHasKeyshare = true;
-        throw e;
-      }
-    } else if (!hasAnyBackup) {
-      const noBackupError = new Error("Your account exists but no backups are available for recovery.");
-      noBackupError.code = "NO_BACKUP_AVAILABLE";
-      noBackupError.userId = userId;
-      noBackupError.serverHasKeyshare = true;
-      throw noBackupError;
-    }
-    onProgress?.("Backup found - restoration required");
-    const recoveryError = new Error("Account exists on server but keyshare missing locally. Please restore from backup to access your account.");
-    recoveryError.code = "KEYSHARE_RECOVERY_NEEDED";
-    recoveryError.userId = userId;
-    recoveryError.serverHasKeyshare = true;
-    recoveryError.availableBackups = { server: serverBackupResult.hasBackup, local: hasLocalBackup, cloud: hasCloudBackup };
-    throw recoveryError;
-  }
-  if (status.needsDkg) {
-    onProgress?.("Setting up secure key management...");
-  } else {
-    throw new Error("Invalid keyshare state - neither DKG nor recovery needed but keyshare missing");
-  }
-  return ensureKeyshareForNewUser(userId, onProgress);
-}
-async function clearLocalKeyshare(userId) {
-  console.log("[clearLocalKeyshare] Keyshares are now managed by secure iframe");
-  console.log("[clearLocalKeyshare] To clear keyshares, user must revoke authorization in iframe");
-  if (typeof window !== "undefined" && window.localStorage) {
-    const keys = [
-      `tss.${userId}.keyshare`,
-      `tss.${userId}.ownerAddress`,
-      `tss.${userId}.sessionId`,
-      ...Object.keys(window.localStorage).filter((key) => key.startsWith(`tss.${userId}.dkg.`))
-    ];
-    keys.forEach((key) => window.localStorage.removeItem(key));
-    console.log("[clearLocalKeyshare] Cleared old localStorage keys for migration");
-  }
-}
-async function getKeyshareInfo(userId) {
-  const info = await checkKeyshare(userId);
-  return {
-    hasKeyshare: info.hasKeyshare,
-    ownerAddress: info.address,
-    sessionId: "iframe-session",
-    // Session managed by iframe
-    keyshareSize: void 0
-    // Size not exposed for security
-  };
-}
-
-// src/internal/auth/providers/types.ts
-init_assets();
-init_initial();
-import { Key, Mail, Wallet2 } from "lucide-react";
-function getTssUrl2() {
-  return getServiceUrls().tssUrl;
-}
-var PROVIDERS_META = {
-  passkey: { name: "Passkey", icon: Key, description: "Biometric authentication" },
-  email: { name: "Email", icon: Mail, description: "Email verification" },
-  telegram: { name: "Telegram", icon: TelegramIcon, description: "Telegram account" },
-  google: { name: "Google", icon: GoogleIcon, description: "Google account" },
-  discord: { name: "Discord", icon: DiscordIcon, description: "Discord account" },
-  twitter: { name: "X", icon: TwitterIcon, description: "X (Twitter) account" },
-  x: { name: "X", icon: TwitterIcon, description: "X (Twitter) account" },
-  // Alias for twitter (API uses 'x')
-  wallet: { name: "Wallet", icon: Wallet2, description: "External wallet (EOA)" }
-};
-var UNKNOWN_PROVIDER = { name: "Unknown", icon: Key, description: "Unknown provider" };
-function getProviderDisplayInfo(provider) {
-  return PROVIDERS_META[provider] || UNKNOWN_PROVIDER;
-}
-function formatDate(dateString) {
-  if (!dateString) return "Never";
-  try {
-    const date = new Date(dateString);
-    return `${date.toLocaleDateString()} ${date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })}`;
-  } catch {
-    return "Invalid date";
-  }
-}
-
-// src/internal/auth/providers/common.ts
-async function getLinkedProviders() {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const response = await authenticatedFetch(`${getTssUrl2()}/api/auth/providers`, { method: "GET" });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to fetch providers: ${response.statusText}`);
-  }
-  const data = await response.json();
-  return data.providers;
-}
-async function unlinkProvider(providerType, externalId) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  let url = `${getTssUrl2()}/api/auth/unlink/${providerType}`;
-  if (externalId) url += `?externalId=${encodeURIComponent(externalId)}`;
-  const response = await authenticatedFetch(url, { method: "DELETE" });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to unlink provider: ${response.statusText}`);
-  }
-  try {
-    const data = await response.json();
-    if (data?.accessToken && data?.refreshToken && data?.expiresIn) {
-      jwtTokenManager2.setTokens({
-        accessToken: data.accessToken,
-        refreshToken: data.refreshToken,
-        userId: jwtTokenManager2.getUserId() || "",
-        expiresIn: data.expiresIn,
-        hasKeyshare: jwtTokenManager2.getHasKeyshare() ?? false
-      });
-    }
-  } catch {
-  }
-}
-
-// src/internal/auth/providers/email.ts
-async function sendEmailLinkCode(email) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const response = await authenticatedFetch(`${getTssUrl2()}/api/auth/link/email/send-code`, {
-    method: "POST",
-    body: JSON.stringify({ email })
-  });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to send email verification code: ${response.statusText}`);
-  }
-}
-async function verifyEmailLinkCode(email, code) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const response = await authenticatedFetch(`${getTssUrl2()}/api/auth/link/email/verify-code`, {
-    method: "POST",
-    credentials: "include",
-    body: JSON.stringify({ email, code })
-  });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to verify email and link provider: ${response.statusText}`);
-  }
-}
-
-// src/internal/auth/providers/passkey.ts
-async function completePasskeyLinking(payload) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const response = await authenticatedFetch(`${getTssUrl2()}/api/auth/link/passkey/complete`, {
-    method: "POST",
-    body: JSON.stringify(payload)
-  });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to link passkey: ${response.statusText}`);
-  }
-}
-async function beginPasskeyLinking() {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  let res = await authenticatedFetch(`${getTssUrl2()}/api/auth/link/passkey/begin`, { method: "POST" });
-  if (res.ok) {
-    const begin2 = await res.json();
-    const options2 = {
-      rp: begin2.rp,
-      user: { id: base64urlToUint8Array(begin2.user.id), name: begin2.user.name, displayName: begin2.user.displayName },
-      challenge: base64urlToUint8Array(begin2.challenge),
-      pubKeyCredParams: begin2.pubKeyCredParams,
-      timeout: begin2.timeout,
-      attestation: begin2.attestation,
-      authenticatorSelection: { ...begin2.authenticatorSelection, residentKey: begin2.authenticatorSelection?.residentKey ?? "preferred", requireResidentKey: begin2.authenticatorSelection?.requireResidentKey ?? false, userVerification: begin2.authenticatorSelection?.userVerification ?? "preferred" },
-      excludeCredentials: begin2.excludeCredentials?.map((cred) => ({ type: cred.type, id: base64urlToUint8Array(cred.id), transports: cred.transports })) || void 0
-    };
-    return { challengeId: begin2.challengeId, options: options2 };
-  }
-  res = await authenticatedFetch(`${getTssUrl2()}/api/auth/link/passkey/options`, { method: "GET" });
-  if (!res.ok) throw new Error("Failed to get passkey linking options");
-  const begin = await res.json();
-  const options = {
-    rp: begin.rp,
-    user: { id: base64urlToUint8Array(begin.user.id), name: begin.user.name, displayName: begin.user.displayName },
-    challenge: base64urlToUint8Array(begin.challenge),
-    pubKeyCredParams: begin.pubKeyCredParams,
-    timeout: begin.timeout,
-    attestation: begin.attestation,
-    authenticatorSelection: { ...begin.authenticatorSelection, residentKey: "preferred", requireResidentKey: false, userVerification: "preferred" },
-    excludeCredentials: begin.excludeCredentials?.map((cred) => ({ type: cred.type, id: base64urlToUint8Array(cred.id), transports: cred.transports })) || void 0
-  };
-  return { challengeId: begin.challengeId, options };
-}
-async function linkPasskeyWithWebAuthn(optionsOverride) {
-  if (!("credentials" in navigator) || !("create" in navigator.credentials)) {
-    throw new Error("WebAuthn not supported in this browser");
-  }
-  const userId = jwtTokenManager2.getUserId();
-  if (!userId) throw new Error("No authenticated user");
-  let challengeId = null;
-  let publicKeyOptions = null;
-  try {
-    const begin = await beginPasskeyLinking();
-    challengeId = begin.challengeId;
-    publicKeyOptions = begin.options;
-  } catch {
-  }
-  if (!publicKeyOptions) {
-    const challenge = new Uint8Array(32);
-    crypto.getRandomValues(challenge);
-    publicKeyOptions = {
-      rp: { name: window.location.hostname || "EmbarkAI Wallet" },
-      user: {
-        id: new TextEncoder().encode(userId),
-        name: userId,
-        displayName: userId
-      },
-      challenge,
-      pubKeyCredParams: [{ type: "public-key", alg: -7 }],
-      attestation: "none",
-      authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" },
-      timeout: 6e4
-    };
-  }
-  try {
-    const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const friendlyDisplay = `EmbarkAI Wallet (${ts})`;
-    const friendlyName = `lumia-passport.${ts}`;
-    const originalUser = publicKeyOptions.user;
-    publicKeyOptions = {
-      ...publicKeyOptions,
-      user: {
-        ...originalUser,
-        name: friendlyName,
-        displayName: friendlyDisplay
-      }
-    };
-  } catch {
-  }
-  if (!(window.isSecureContext || window.location.hostname === "localhost")) {
-    throw new Error("Passkey requires secure context (https or localhost)");
-  }
-  try {
-    const originHost = window.location.hostname;
-    const rpId = publicKeyOptions.rp?.id;
-    const suffixMatches = (host, rp) => host === rp || host.endsWith(`.${rp}`);
-    if (rpId && !suffixMatches(originHost, rpId)) {
-      console.warn("[PasskeyLink] Adjusting rp.id to origin host for WebAuthn", { rpId, originHost });
-      publicKeyOptions = { ...publicKeyOptions, rp: { ...publicKeyOptions.rp, id: originHost } };
-    }
-  } catch {
-  }
-  console.log("[PasskeyLink] Calling navigator.credentials.create", {
-    rp: publicKeyOptions.rp,
-    timeout: publicKeyOptions.timeout,
-    attestation: publicKeyOptions.attestation
-  });
-  const credential = await navigator.credentials.create({ publicKey: { ...publicKeyOptions, ...optionsOverride } });
-  if (!credential) throw new Error("Passkey creation was cancelled");
-  const attestationPayload = credentialToAttestationPayload(credential);
-  const cid = challengeId || "local-" + Date.now();
-  await completePasskeyLinking({ challengeId: cid, credential: attestationPayload });
-  const rawIdB64 = btoa(String.fromCharCode(...new Uint8Array(credential.rawId)));
-  return { credentialId: credential.id, rawId: rawIdB64 };
-}
-
-// src/internal/auth/providers/telegram.ts
-async function linkTelegram(telegramData) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const formattedData = {
-    id: telegramData.id,
-    first_name: telegramData.first_name,
-    auth_date: telegramData.auth_date,
-    hash: telegramData.hash
-  };
-  if (telegramData.last_name) formattedData.last_name = telegramData.last_name;
-  if (telegramData.username) formattedData.username = telegramData.username;
-  if (telegramData.photo_url) formattedData.photo_url = telegramData.photo_url;
-  const response = await authenticatedFetch(`${getTssUrl2()}/api/auth/link/telegram`, {
-    method: "POST",
-    body: JSON.stringify(formattedData)
-  });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to link Telegram: ${response.statusText}`);
-  }
-}
-function mountTelegramLoginWidget(container, botUsername, onAuth, options) {
-  const scriptId = "telegram-login-widget";
-  if (!document.getElementById(scriptId)) {
-    const s = document.createElement("script");
-    s.id = scriptId;
-    s.src = "https://telegram.org/js/telegram-widget.js?22";
-    s.async = true;
-    s.defer = true;
-    container.parentElement?.appendChild(s);
-  }
-  const btn = document.createElement("div");
-  btn.setAttribute("class", "tg-login-button");
-  btn.setAttribute("data-telegram-login", botUsername);
-  btn.setAttribute("data-size", "large");
-  if (options?.requestAccess) btn.setAttribute("data-request-access", options.requestAccess);
-  const callbackName = `__lumia_tg_auth_cb_${Math.random().toString(36).slice(2)}`;
-  window[callbackName] = (user) => onAuth(user);
-  btn.setAttribute("data-onauth", callbackName);
-  container.innerHTML = "";
-  container.appendChild(btn);
-}
-
-// src/internal/auth/providers/wallet.ts
-async function walletLogin(walletData) {
-  const response = await fetch(addProjectIdToUrl(`${getTssUrl2()}/api/auth/wallet/login`), {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    credentials: "include",
-    body: JSON.stringify(walletData)
-  });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Wallet login failed: ${response.statusText}`);
-  }
-  return response.json();
-}
-async function linkWallet(walletData) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const response = await authenticatedFetch(`${getTssUrl2()}/api/auth/link/wallet`, {
-    method: "POST",
-    body: JSON.stringify(walletData)
-  });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to link wallet: ${response.statusText}`);
-  }
-}
-async function unlinkWallet(address) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const response = await authenticatedFetch(
-    `${getTssUrl2()}/api/auth/unlink/wallet?address=${encodeURIComponent(address)}`,
-    {
-      method: "DELETE"
-    }
-  );
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to unlink wallet: ${response.statusText}`);
-  }
-}
-var METADATA_API_URL = "https://dashboard.lumiapassport.com/api/public/project";
-var METADATA_CACHE_TTL = 36e5;
-var metadataCache = null;
-async function fetchProjectName(projectId) {
-  const now = Date.now();
-  if (metadataCache && now - metadataCache.timestamp < METADATA_CACHE_TTL) {
-    return metadataCache.data.name;
-  }
-  try {
-    const response = await fetch(`${METADATA_API_URL}/${projectId}/metadata`);
-    if (!response.ok) return "EmbarkAI";
-    const metadata = await response.json();
-    metadataCache = { data: metadata, timestamp: now };
-    return metadata.name;
-  } catch {
-    return "EmbarkAI";
-  }
-}
-function createSignatureMessage(address, projectName, nonce) {
-  const timestamp = Date.now();
-  const nonceValue = nonce || Math.random().toString(36).substring(2, 15);
-  return `${projectName} Wallet Link
-
-Address: ${address}
-Nonce: ${nonceValue}
-Timestamp: ${timestamp}
-
-Sign this message to link your wallet to ${projectName} Wallet`;
-}
-function createLoginMessage(address, projectName) {
-  const nonce = crypto.randomUUID();
-  const timestamp = Date.now();
-  return [
-    `${projectName} Wallet Login`,
-    "",
-    `Address: ${address}`,
-    `Nonce: ${nonce}`,
-    `Timestamp: ${timestamp}`,
-    "",
-    `Sign this message to login your wallet to ${projectName}`
-  ].join("\n");
-}
-
-// src/internal/auth/providers/x.ts
-async function linkX() {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  throw new Error('Use openSocialAuthPopup("x") to link X account');
-}
-async function loginWithX() {
-  throw new Error('Use openSocialAuthPopup("x") to login with X account');
-}
-async function unlinkX(externalId) {
-  const hasValidToken = await ensureValidToken();
-  if (!hasValidToken) throw new Error("No authentication token available");
-  const url = externalId ? `${getTssUrl2()}/api/auth/unlink/x?externalId=${encodeURIComponent(externalId)}` : `${getTssUrl2()}/api/auth/unlink/x`;
-  const response = await authenticatedFetch(url, {
-    method: "DELETE"
-  });
-  if (!response.ok) {
-    const errorData = await response.json().catch(() => ({}));
-    throw new Error(errorData.message || `Failed to unlink X account: ${response.statusText}`);
-  }
-}
-
-// src/internal/auth/index.ts
-var createInitialAuthState = () => ({ isAuthenticated: false });
-
-// src/internal/auth/passkey.ts
-var activeWebAuthnOperation = null;
-var conditionalUIStarting = false;
-function setGlobalConditionalUI(active) {
-  if (typeof window !== "undefined") window.__EMBARK_CONDITIONAL_UI_ACTIVE__ = active;
-}
-function resetWebAuthnFlags() {
-  activeWebAuthnOperation = null;
-  conditionalUIStarting = false;
-  setGlobalConditionalUI(false);
-}
-function generatePasskeyUsername() {
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  return `lumia-aa.${DAPP_NAME}-${timestamp}`;
-}
-function createPasskeyHelpers(mpcUserId) {
-  const getPasskeyKey = (key) => `passkey.${mpcUserId}.${key}`;
-  return {
-    getPasskeyKey,
-    getCredId: () => localStorage.getItem(getPasskeyKey("credId")),
-    getRawId: () => localStorage.getItem(getPasskeyKey("rawId")),
-    getOwnerPk: () => localStorage.getItem(getPasskeyKey("ownerPk")),
-    setCredId: (credId) => localStorage.setItem(getPasskeyKey("credId"), credId),
-    setRawId: (rawId) => localStorage.setItem(getPasskeyKey("rawId"), rawId),
-    setOwnerPk: (ownerPk) => localStorage.setItem(getPasskeyKey("ownerPk"), ownerPk),
-    clear: () => {
-      localStorage.removeItem(getPasskeyKey("credId"));
-      localStorage.removeItem(getPasskeyKey("rawId"));
-      localStorage.removeItem(getPasskeyKey("ownerPk"));
-    },
-    hasCredentials: () => !!(localStorage.getItem(getPasskeyKey("credId")) || localStorage.getItem(getPasskeyKey("rawId")))
-  };
-}
-function isWebAuthnSupported() {
-  return "credentials" in navigator && "create" in navigator.credentials && "get" in navigator.credentials;
-}
-async function hasAvailablePasskeys() {
-  if (!isWebAuthnSupported()) return false;
-  try {
-    const isAvailable = await Promise.race([
-      PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable(),
-      new Promise((_, reject) => setTimeout(() => reject(new Error("Timeout")), 3e3))
-    ]);
-    if (!isAvailable) return false;
-    try {
-      const credential = await Promise.race([
-        navigator.credentials.get({ publicKey: { challenge: new Uint8Array(32), timeout: 5e3, userVerification: "preferred" }, mediation: "silent" }),
-        new Promise((_, reject) => setTimeout(() => reject(new Error("Detection timeout")), 2e3))
-      ]);
-      return !!credential;
-    } catch {
-      return false;
-    }
-  } catch {
-    return false;
-  }
-}
-async function registerPasskey(mpcUserId, onProgress, options) {
-  if (!isWebAuthnSupported()) throw new Error("WebAuthn not supported in this browser");
-  const helpers = createPasskeyHelpers(mpcUserId);
-  onProgress?.("Starting passkey registration...");
-  const passkeyUsername = generatePasskeyUsername();
-  onProgress?.("Getting registration challenge...");
-  const { challengeId, options: credOptions } = await beginPasskeyRegistration(passkeyUsername);
-  onProgress?.("Creating passkey credential...");
-  const credential = await navigator.credentials.create({ publicKey: credOptions });
-  if (!credential) throw new Error("Failed to create passkey credential");
-  onProgress?.("Verifying passkey with server...");
-  const loginResponse = await completePasskeyRegistration(challengeId, credential, options);
-  const rawIdB64 = btoa(String.fromCharCode(...new Uint8Array(credential.rawId)));
-  const derivedOwnerPk = `0x${"0".repeat(40)}${credential.id.slice(-24)}`;
-  helpers.setCredId(credential.id);
-  helpers.setRawId(rawIdB64);
-  helpers.setOwnerPk(derivedOwnerPk);
-  onProgress?.("Passkey registered successfully!");
-  return {
-    credential: { id: credential.id, rawId: rawIdB64, ownerPublicKey: derivedOwnerPk },
-    loginResponse
-  };
-}
-async function authenticateWithPasskey(_username, onProgress, options) {
-  if (!isWebAuthnSupported()) throw new Error("WebAuthn not supported in this browser");
-  onProgress?.("Starting passkey authentication...");
-  const { challengeId, options: beginOptions } = await beginPasskeyAuthentication();
-  const getOptions = { ...beginOptions };
-  if (getOptions.allowCredentials && getOptions.allowCredentials.length === 0) delete getOptions.allowCredentials;
-  const assertion = await navigator.credentials.get({ publicKey: getOptions });
-  if (!assertion) throw new Error("Passkey authentication failed - no credential returned");
-  onProgress?.("Verifying passkey with server...");
-  const loginResponse = await completePasskeyAuthentication(challengeId, assertion, options);
-  const userHelpers = createPasskeyHelpers(loginResponse.userId);
-  const rawIdB64 = btoa(String.fromCharCode(...new Uint8Array(assertion.rawId)));
-  const derivedOwnerPk = `0x${"0".repeat(40)}${assertion.id.slice(-24)}`;
-  userHelpers.setCredId(assertion.id);
-  userHelpers.setRawId(rawIdB64);
-  userHelpers.setOwnerPk(derivedOwnerPk);
-  onProgress?.("Authentication complete!");
-  return {
-    credential: { id: assertion.id, rawId: rawIdB64, ownerPublicKey: derivedOwnerPk },
-    mpcUserId: loginResponse.userId,
-    loginResponse
-  };
-}
-
-export {
-  addProjectIdToUrl,
-  getProjectId,
-  beginPasskeyAuthentication,
-  completePasskeyAuthentication,
-  beginPasskeyRegistration,
-  completePasskeyRegistration,
-  deriveDemoPrivateKey,
-  initTelegramWidget,
-  hideTelegramWidget,
-  showTelegramWidget,
-  resetWebAuthnFlags,
-  createPasskeyHelpers,
-  isWebAuthnSupported,
-  hasAvailablePasskeys,
-  registerPasskey,
-  authenticateWithPasskey,
-  ensureDkgAndGetOwner,
-  signDigestWithMpc,
-  signTypedDataWithMpc,
-  getTssUrl2 as getTssUrl,
-  getProviderDisplayInfo,
-  formatDate,
-  completePasskeyLinking,
-  beginPasskeyLinking,
-  linkPasskeyWithWebAuthn,
-  getLinkedProviders,
-  unlinkProvider,
-  sendEmailLinkCode,
-  verifyEmailLinkCode,
-  linkTelegram,
-  mountTelegramLoginWidget,
-  walletLogin,
-  linkWallet,
-  unlinkWallet,
-  fetchProjectName,
-  createSignatureMessage,
-  createLoginMessage,
-  checkKeyshareStatusWithSync,
-  checkKeyshareStatus,
-  ensureKeyshare,
-  clearLocalKeyshare,
-  getKeyshareInfo,
-  linkX,
-  loginWithX,
-  unlinkX,
-  createInitialAuthState,
-  JwtTokenManager,
-  createJwtTokenManager,
-  jwtTokenManager2 as jwtTokenManager,
-  configureJwtModule,
-  logout,
-  verifyToken,
-  ensureValidToken,
-  getValidTokens,
-  authenticatedFetch,
-  loginWithUserId,
-  loginWithEmail,
-  loginWithTelegram,
-  syncKeyshareStatus
-};
-//# sourceMappingURL=chunk-7G3OIJGJ.js.map