@polyester/sdk 0.27.0 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @polyester/sdk
 
+## 0.27.1
+
+### Patch Changes
+
+- Accept `phantom` as a wallet provider in login and refresh, preserving its metadata in browser and server sessions. ([#164](https://github.com/Fabric-Labs/polyester-sdk-typescript/pull/164))
+
 ## 0.27.0
 
 ### Minor Changes

package/dist/account-signer/types.d.ts

@@ -19,7 +19,9 @@ interface AccountSigner {
   /**
    * Sign the exact UTF-8 message with EIP-191 semantics. For login this must be
    * the owner EOA's raw 65-byte signature (0x + 130 hex chars), not a
-   * smart-account wrapped one.
+   * smart-account wrapped one. Login SIWE uses Ethereum mainnet (1); wallet
+   * adapters must select that network before signing when required (e.g. Phantom).
+   * This does not change the Polyester environment used for Safe signing.
    */
   signMessage(message: string): Promise<Hex>;
 }

package/dist/account-signer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/account-signer/types.ts"],"mappings":";;KAIY;;;;;;;;;UAUK;;WAEJ;;WAGA,gBAAgB;;WAGhB,eAAe;;;;;;EAOxB,YAAY,kBAAkB,QAAQ;;;;;;KAO9B,6BAA6B,uBAAuB,QAAQ;;;;;KAM5D,sBAAsB,gBAAgB;;;;iBAKlC,uBACZ,QAAQ,sBACT,UAAU;;;;iBA4BS,qBAClB,QAAQ,kCACT,QAAQ"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/account-signer/types.ts"],"mappings":";;KAIY;;;;;;;;;UAUK;;WAEJ;;WAGA,gBAAgB;;WAGhB,eAAe;;;;;;;;EASxB,YAAY,kBAAkB,QAAQ;;;;;;KAO9B,6BAA6B,uBAAuB,QAAQ;;;;;KAM5D,sBAAsB,gBAAgB;;;;iBAKlC,uBACZ,QAAQ,sBACT,UAAU;;;;iBA4BS,qBAClB,QAAQ,kCACT,QAAQ"}

package/dist/account-signer/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../src/account-signer/types.ts"],"sourcesContent":["import type { Hex } from \"viem\";\nimport { isEvmAddress } from \"../utils/evm.js\";\nimport { ConfigurationError } from \"../shared/errors.js\";\n\nexport type HexAddress = `0x${string}`;\n\n/**\n * Minimal account signer interface for SDK operations.\n *\n * The SDK authenticates the Polyester smart account address. When ownerAddress\n * is present it is declared as the LOGIN challenge signer, and signMessage must\n * return that EOA's raw 65-byte EIP-191 signature: login rejects Safe/ERC-6492\n * wrapped signatures. Subaccount creation accepts either form.\n */\nexport interface AccountSigner {\n    /** Fingerprint of the PolyesterEnvironment this signer was created for */\n    readonly environmentFingerprint: string;\n\n    /** The smart account address (used for authentication and trading) */\n    readonly accountAddress: HexAddress;\n\n    /** The owner/EOA address. Declared as the LOGIN challenge signer when present; otherwise accountAddress signs. */\n    readonly ownerAddress?: HexAddress;\n\n    /**\n     * Sign the exact UTF-8 message with EIP-191 semantics. For login this must be\n     * the owner EOA's raw 65-byte signature (0x + 130 hex chars), not a\n     * smart-account wrapped one.\n     */\n    signMessage(message: string): Promise<Hex>;\n}\n\n/**\n * Factory function type for lazy account signer initialization.\n * Useful when the signer might not be available at client creation time.\n */\nexport type AccountSignerFactory = () => AccountSigner | null | Promise<AccountSigner | null>;\n\n/**\n * Account signer configuration for the client.\n * Can be a signer instance or a factory for lazy initialization.\n */\nexport type AccountSignerConfig = AccountSigner | AccountSignerFactory;\n\n/**\n * Helper to check if an account signer config is a factory function.\n */\nexport function isAccountSignerFactory(\n    config: AccountSignerConfig,\n): config is AccountSignerFactory {\n    return typeof config === \"function\";\n}\n\n/**\n * Asserts that a value implements the account signer contract.\n */\nexport function assertAccountSigner(value: AccountSigner): void {\n    if (typeof value !== \"object\" || value === null) {\n        throw new ConfigurationError(\"Account signer must be an object or factory function.\");\n    }\n    if (!value.environmentFingerprint) {\n        throw new ConfigurationError(\"Account signer must include an environmentFingerprint.\");\n    }\n    if (!isEvmAddress(value.accountAddress)) {\n        throw new ConfigurationError(\"Account signer must include a valid accountAddress.\");\n    }\n    if (value.ownerAddress && !isEvmAddress(value.ownerAddress)) {\n        throw new ConfigurationError(\"Account signer ownerAddress must be a valid address.\");\n    }\n    if (typeof value.signMessage !== \"function\") {\n        throw new ConfigurationError(\"Account signer must include a signMessage function.\");\n    }\n}\n\n/**\n * Helper to resolve an account signer from config.\n */\nexport async function resolveAccountSigner(\n    config: AccountSignerConfig | undefined,\n): Promise<AccountSigner | null> {\n    if (!config) return null;\n    const accountSigner = isAccountSignerFactory(config) ? await config() : config;\n    if (accountSigner) assertAccountSigner(accountSigner);\n    return accountSigner;\n}\n"],"mappings":";;;;;;AA+CA,SAAgB,uBACZ,QAC8B;CAC9B,OAAO,OAAO,WAAW;AAC7B;;;;AAKA,SAAgB,oBAAoB,OAA4B;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MACvC,MAAM,IAAI,mBAAmB,uDAAuD;CAExF,IAAI,CAAC,MAAM,wBACP,MAAM,IAAI,mBAAmB,wDAAwD;CAEzF,IAAI,CAAC,aAAa,MAAM,cAAc,GAClC,MAAM,IAAI,mBAAmB,qDAAqD;CAEtF,IAAI,MAAM,gBAAgB,CAAC,aAAa,MAAM,YAAY,GACtD,MAAM,IAAI,mBAAmB,sDAAsD;CAEvF,IAAI,OAAO,MAAM,gBAAgB,YAC7B,MAAM,IAAI,mBAAmB,qDAAqD;AAE1F;;;;AAKA,eAAsB,qBAClB,QAC6B;CAC7B,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,gBAAgB,uBAAuB,MAAM,IAAI,MAAM,OAAO,IAAI;CACxE,IAAI,eAAe,oBAAoB,aAAa;CACpD,OAAO;AACX"}
+{"version":3,"file":"types.js","names":[],"sources":["../../src/account-signer/types.ts"],"sourcesContent":["import type { Hex } from \"viem\";\nimport { isEvmAddress } from \"../utils/evm.js\";\nimport { ConfigurationError } from \"../shared/errors.js\";\n\nexport type HexAddress = `0x${string}`;\n\n/**\n * Minimal account signer interface for SDK operations.\n *\n * The SDK authenticates the Polyester smart account address. When ownerAddress\n * is present it is declared as the LOGIN challenge signer, and signMessage must\n * return that EOA's raw 65-byte EIP-191 signature: login rejects Safe/ERC-6492\n * wrapped signatures. Subaccount creation accepts either form.\n */\nexport interface AccountSigner {\n    /** Fingerprint of the PolyesterEnvironment this signer was created for */\n    readonly environmentFingerprint: string;\n\n    /** The smart account address (used for authentication and trading) */\n    readonly accountAddress: HexAddress;\n\n    /** The owner/EOA address. Declared as the LOGIN challenge signer when present; otherwise accountAddress signs. */\n    readonly ownerAddress?: HexAddress;\n\n    /**\n     * Sign the exact UTF-8 message with EIP-191 semantics. For login this must be\n     * the owner EOA's raw 65-byte signature (0x + 130 hex chars), not a\n     * smart-account wrapped one. Login SIWE uses Ethereum mainnet (1); wallet\n     * adapters must select that network before signing when required (e.g. Phantom).\n     * This does not change the Polyester environment used for Safe signing.\n     */\n    signMessage(message: string): Promise<Hex>;\n}\n\n/**\n * Factory function type for lazy account signer initialization.\n * Useful when the signer might not be available at client creation time.\n */\nexport type AccountSignerFactory = () => AccountSigner | null | Promise<AccountSigner | null>;\n\n/**\n * Account signer configuration for the client.\n * Can be a signer instance or a factory for lazy initialization.\n */\nexport type AccountSignerConfig = AccountSigner | AccountSignerFactory;\n\n/**\n * Helper to check if an account signer config is a factory function.\n */\nexport function isAccountSignerFactory(\n    config: AccountSignerConfig,\n): config is AccountSignerFactory {\n    return typeof config === \"function\";\n}\n\n/**\n * Asserts that a value implements the account signer contract.\n */\nexport function assertAccountSigner(value: AccountSigner): void {\n    if (typeof value !== \"object\" || value === null) {\n        throw new ConfigurationError(\"Account signer must be an object or factory function.\");\n    }\n    if (!value.environmentFingerprint) {\n        throw new ConfigurationError(\"Account signer must include an environmentFingerprint.\");\n    }\n    if (!isEvmAddress(value.accountAddress)) {\n        throw new ConfigurationError(\"Account signer must include a valid accountAddress.\");\n    }\n    if (value.ownerAddress && !isEvmAddress(value.ownerAddress)) {\n        throw new ConfigurationError(\"Account signer ownerAddress must be a valid address.\");\n    }\n    if (typeof value.signMessage !== \"function\") {\n        throw new ConfigurationError(\"Account signer must include a signMessage function.\");\n    }\n}\n\n/**\n * Helper to resolve an account signer from config.\n */\nexport async function resolveAccountSigner(\n    config: AccountSignerConfig | undefined,\n): Promise<AccountSigner | null> {\n    if (!config) return null;\n    const accountSigner = isAccountSignerFactory(config) ? await config() : config;\n    if (accountSigner) assertAccountSigner(accountSigner);\n    return accountSigner;\n}\n"],"mappings":";;;;;;AAiDA,SAAgB,uBACZ,QAC8B;CAC9B,OAAO,OAAO,WAAW;AAC7B;;;;AAKA,SAAgB,oBAAoB,OAA4B;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MACvC,MAAM,IAAI,mBAAmB,uDAAuD;CAExF,IAAI,CAAC,MAAM,wBACP,MAAM,IAAI,mBAAmB,wDAAwD;CAEzF,IAAI,CAAC,aAAa,MAAM,cAAc,GAClC,MAAM,IAAI,mBAAmB,qDAAqD;CAEtF,IAAI,MAAM,gBAAgB,CAAC,aAAa,MAAM,YAAY,GACtD,MAAM,IAAI,mBAAmB,sDAAsD;CAEvF,IAAI,OAAO,MAAM,gBAAgB,YAC7B,MAAM,IAAI,mBAAmB,qDAAqD;AAE1F;;;;AAKA,eAAsB,qBAClB,QAC6B;CAC7B,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,gBAAgB,uBAAuB,MAAM,IAAI,MAAM,OAAO,IAAI;CACxE,IAAI,eAAe,oBAAoB,aAAa;CACpD,OAAO;AACX"}

package/dist/services/auth/account-signer-auth.d.ts

@@ -8,7 +8,7 @@ import { SubaccountChallenge } from "../subaccounts/subaccounts.schemas.js";
 import { SubaccountsService } from "../subaccounts/subaccounts.js";
 import "../subaccounts/index.js";
 import { AuthTokenStorage } from "./token-storage.js";
-import { AuthHydrationData, AuthLoginMethod, AuthState } from "./session.types.js";
+import { AuthHydrationData, AuthLoginMethod, AuthState, SessionData } from "./session.types.js";
 import { AuthSessionStore } from "./session.js";
 import { EventEmitter } from "../../utils/event-emitter.js";
 //#region src/services/auth/account-signer-auth.d.ts
@@ -34,7 +34,7 @@ interface LoginOptions {
   /**
    * The wallet provider to use for login.
    */
-  provider: "metamask" | "turnkey" | "other";
+  provider: SessionData["provider"];
   /** Browser origin requesting the signature; defaults to location.origin in browsers. Required outside browsers. */
   uri?: string;
   loginMethod?: AuthLoginMethod | null;
@@ -114,7 +114,7 @@ declare class AccountSignerAuthService extends AuthService {
   refreshSession(params?: {
     /** Overrides the origin remembered from login. */
     uri?: string;
-    provider?: "metamask" | "turnkey" | "other";
+    provider?: SessionData["provider"];
     loginMethod?: AuthLoginMethod | null;
   }): Promise<LoginResult>;
   /**

package/dist/services/auth/account-signer-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-signer-auth.d.ts","names":[],"sources":["../../../src/services/auth/account-signer-auth.ts"],"mappings":";;;;;;;;;;;;;;UAyBiB;EACb;IAAiB;IAAmB;;EACpC;EACA;IAAS;IAAc;;EACvB;EACA,aAAa;;UAGA;EACb;EACA;EACA,WAAW;;UAGE;;;;EAIb;;EAEA;EACA,cAAc;;UAGD;;;;;;EAMb,eACM,kBACE,WAAW,wBAAwB,gBAAgB,QAAQ;;EAEnE;;EAEA;;EAEA,eAAe;;UAGF;EACb;EACA;EACA;;;;;cAWS,iCAAiC;;WACjC,QAAM,aAAA;EAoBH,cACR,YACA,qBACA,aACA,aACA,UACA,cACA;IAEA,YAAY;IACZ,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,UAAU;IACV,cAAc;IACd,eAAe;;;;;EAmBnB,sBAAsB,aAAa;;;;EAOnC,iBAAiB,eAAe;;;;EAWhC,oBAAoB;;;;EAOd,MAAM,SAAS,eAAe,QAAQ;;;;EAyF5C,iBAAiB,OAAO;;;;EAyBlB,kBAAkB;IAAU;IAAmB;;;;;EA0E/C,UAAU;;;;EAqChB;;;;EASM,eAAe;;IAEjB;IACA;IACA,cAAc;MACd,QAAQ;;;;EAmBZ,cACI,mBACA;IAAY;IAA8B;;IACzC;IAAmB;;;EAuBxB,oBAAoB;;;;EASd,iBAAiB,QAAQ,yBAAyB,QAAQ;;;;EAyDhE,YAAY"}
+{"version":3,"file":"account-signer-auth.d.ts","names":[],"sources":["../../../src/services/auth/account-signer-auth.ts"],"mappings":";;;;;;;;;;;;;;UAyBiB;EACb;IAAiB;IAAmB;;EACpC;EACA;IAAS;IAAc;;EACvB;EACA,aAAa;;UAGA;EACb;EACA;EACA,WAAW;;UAGE;;;;EAIb,UAAU;;EAEV;EACA,cAAc;;UAGD;;;;;;EAMb,eACM,kBACE,WAAW,wBAAwB,gBAAgB,QAAQ;;EAEnE;;EAEA;;EAEA,eAAe;;UAGF;EACb;EACA;EACA;;;;;cAWS,iCAAiC;;WACjC,QAAM,aAAA;EAoBH,cACR,YACA,qBACA,aACA,aACA,UACA,cACA;IAEA,YAAY;IACZ,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,UAAU;IACV,cAAc;IACd,eAAe;;;;;EAmBnB,sBAAsB,aAAa;;;;EAOnC,iBAAiB,eAAe;;;;EAWhC,oBAAoB;;;;EAOd,MAAM,SAAS,eAAe,QAAQ;;;;EAyF5C,iBAAiB,OAAO;;;;EAyBlB,kBAAkB;IAAU;IAAmB;;;;;EA0E/C,UAAU;;;;EAqChB;;;;EASM,eAAe;;IAEjB;IACA,WAAW;IACX,cAAc;MACd,QAAQ;;;;EAmBZ,cACI,mBACA;IAAY;IAA8B;;IACzC;IAAmB;;;EAuBxB,oBAAoB;;;;EASd,iBAAiB,QAAQ,yBAAyB,QAAQ;;;;EAyDhE,YAAY"}

package/dist/services/auth/account-signer-auth.js

@@ -87,7 +87,7 @@ var AccountSignerAuthService = class extends AuthService {
 		});
 		if (!this.#isCurrentAuthOperation(generation, startingToken)) throw new DOMException("Authentication operation superseded", "AbortError");
 		const environmentSession = this.#getEnvironmentSession();
-		const resolvedLoginMethod = loginMethod ?? this.#loginMethod ?? environmentSession?.loginMethod ?? (provider === "metamask" ? "metamask" : null);
+		const resolvedLoginMethod = loginMethod ?? this.#loginMethod ?? environmentSession?.loginMethod ?? (provider === "metamask" || provider === "phantom" ? provider : null);
 		const tokenOptions = createAuthTokenStorageSetOptions(response.accessToken);
 		const activeAccount = previousActiveAccount?.mainAccountId === response.accountId ? previousActiveAccount : void 0;
 		this.#sessionStore.commitLogin({

package/dist/services/auth/account-signer-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-signer-auth.js","names":["#accountSignerConfig","#environmentFingerprint","#subaccounts","#tokenStorage","#realtime","#sessionStore","#assertAccountSignerEnvironment","#beginAuthOperation","#accountSigner","#accountIdentity","#identityFromSigner","#notifyStateChange","#login","#resolveAccountSigner","#challengeUri","#isCurrentAuthOperation","#getEnvironmentSession","#loginMethod","#isAuthenticated","#mainAccountId","#activeAccountId","#walletProvider","#loginResult","#getEnvironmentBoundToken","#clearExpiredSessionState","#getCurrentTokenStorageOptions","#resolveRefreshProvider","#authOperationGeneration"],"sources":["../../../src/services/auth/account-signer-auth.ts"],"sourcesContent":["import { AuthService, type LoginWithWalletResponse } from \"./auth.js\";\nimport { AuthenticationError, ConfigurationError } from \"../../shared/errors.js\";\nimport { toPolyesterError } from \"../../shared/connect-error-mapping.js\";\nimport { AuthSessionStore } from \"./session.js\";\nimport type { AccountSigner, AccountSignerConfig, HexAddress } from \"../../account-signer/types.js\";\nimport { assertAccountSigner, resolveAccountSigner } from \"../../account-signer/types.js\";\nimport { EventEmitter } from \"../../utils/event-emitter.js\";\nimport { isJwtValid, getJwtTimeToExpiry } from \"../../utils/jwt.js\";\nimport type { SubaccountChallenge, SubaccountsService } from \"../subaccounts/index.js\";\nimport type {\n    AuthState,\n    AuthHydrationData,\n    AuthLoginMethod,\n    SessionData,\n    ActiveAccountInfo,\n} from \"./session.types.js\";\nimport type { PolyesterRealtime } from \"../../realtime/index.js\";\nimport type { PolyesterEnvironment } from \"../../environment.js\";\nimport type { AuthAndPublicApiTransports } from \"../../shared/transports.js\";\nimport {\n    createAuthTokenStorageSetOptions,\n    type AuthTokenStorage,\n    type AuthTokenStorageSetOptions,\n} from \"./token-storage.js\";\n\nexport interface AccountSignerAuthEvents {\n    authenticated: { accountId: string; username: string };\n    loggedOut: void;\n    error: { code: string; message: string };\n    servicesReady: void;\n    stateChange: AuthState;\n}\n\nexport interface LoginResult {\n    accountId: string;\n    username: string;\n    expiresAt: Date;\n}\n\nexport interface LoginOptions {\n    /**\n     * The wallet provider to use for login.\n     */\n    provider: \"metamask\" | \"turnkey\" | \"other\";\n    /** Browser origin requesting the signature; defaults to location.origin in browsers. Required outside browsers. */\n    uri?: string;\n    loginMethod?: AuthLoginMethod | null;\n}\n\nexport interface CreateSubaccountParams {\n    /**\n     * Signer for the new subaccount, or a factory that derives it from the server challenge\n     * (for example via Turnkey with `challenge.smartAccountSaltNonce`). Its accountAddress must\n     * equal `challenge.smartAccountAddress`.\n     */\n    accountSigner:\n        | AccountSigner\n        | ((challenge: SubaccountChallenge) => AccountSigner | Promise<AccountSigner>);\n    /** Optional human-readable label for this subaccount */\n    label?: string;\n    /** Browser origin requesting the signature; defaults to location.origin in browsers. Required outside browsers. */\n    uri?: string;\n    /** Root owner EOA bound to the authenticated account; defaults to the configured signer's owner. */\n    ownerAddress?: HexAddress;\n}\n\nexport interface CreateSubaccountResult {\n    subaccountId: string;\n    smartAccountSaltNonce: number;\n    revision: string;\n}\n\ninterface AccountIdentity {\n    accountAddress: HexAddress;\n    ownerAddress?: HexAddress;\n}\n\n/**\n * Coordinates wallet/account-signer authentication, session storage, subaccount selection, and session refresh.\n */\nexport class AccountSignerAuthService extends AuthService {\n    readonly events = new EventEmitter<AccountSignerAuthEvents>();\n\n    #accountSignerConfig: AccountSignerConfig | undefined;\n    #accountSigner: AccountSigner | null = null;\n    #accountIdentity: AccountIdentity | null = null;\n    #isAuthenticated = false;\n    #mainAccountId: string | null = null;\n    #activeAccountId: string | null = null;\n    #subaccounts: SubaccountsService;\n    #walletProvider: \"metamask\" | \"turnkey\" | \"other\" | undefined = undefined;\n    #loginMethod: AuthLoginMethod | null = null;\n    #challengeUri: string | undefined = undefined;\n    #environmentFingerprint: string;\n    #tokenStorage: AuthTokenStorage;\n    #sessionStore: AuthSessionStore;\n    #realtime: PolyesterRealtime;\n    // Every asynchronous auth transition captures this generation. A later login,\n    // logout, signer change, or restore makes older work observational only.\n    #authOperationGeneration = 0;\n\n    constructor({\n        transports,\n        accountSignerConfig,\n        environment,\n        subaccounts,\n        realtime,\n        tokenStorage,\n        sessionStore,\n    }: {\n        transports: AuthAndPublicApiTransports;\n        accountSignerConfig?: AccountSignerConfig;\n        environment: PolyesterEnvironment;\n        subaccounts: SubaccountsService;\n        realtime: PolyesterRealtime;\n        tokenStorage: AuthTokenStorage;\n        sessionStore?: AuthSessionStore;\n    }) {\n        super(transports, realtime);\n\n        this.#accountSignerConfig = accountSignerConfig;\n        this.#environmentFingerprint = environment.fingerprint;\n        this.#subaccounts = subaccounts;\n        this.#tokenStorage = tokenStorage;\n        this.#realtime = realtime;\n        this.#sessionStore =\n            sessionStore ??\n            new AuthSessionStore({\n                environmentFingerprint: environment.fingerprint,\n            });\n    }\n\n    /**\n     * Attaches the subaccounts service used when creating a subaccount during authenticated flows.\n     */\n    setSubaccountsService(subaccounts: SubaccountsService): void {\n        this.#subaccounts = subaccounts;\n    }\n\n    /**\n     * Sets the account signer used to sign login and account-switch challenges.\n     */\n    setAccountSigner(accountSigner: AccountSigner | null): void {\n        if (accountSigner) this.#assertAccountSignerEnvironment(accountSigner);\n        this.#beginAuthOperation();\n        this.#accountSigner = accountSigner;\n        this.#accountIdentity = accountSigner ? this.#identityFromSigner(accountSigner) : null;\n        this.#notifyStateChange();\n    }\n\n    /**\n     * Returns the active account signer, throwing if one has not been configured.\n     */\n    getAccountSigner(): AccountSigner | null {\n        return this.#accountSigner;\n    }\n\n    /**\n     * Signs a server-issued SIWE message with the configured account signer, exchanges it for a session token, and stores the hydrated account/subaccount session state.\n     */\n    async login(options: LoginOptions): Promise<LoginResult> {\n        return this.#login(options);\n    }\n\n    async #login(\n        options: LoginOptions,\n        previousActiveAccount?: ActiveAccountInfo,\n    ): Promise<LoginResult> {\n        const generation = this.#beginAuthOperation();\n        const startingToken = this.#tokenStorage.get();\n        const { provider, loginMethod } = options;\n\n        const accountSigner = await this.#resolveAccountSigner();\n\n        if (!accountSigner) {\n            throw new ConfigurationError(\n                \"No account signer configured. Call setAccountSigner() or pass accountSigner in config.\",\n            );\n        }\n\n        const smartAccountAddress = accountSigner.accountAddress;\n        const ownerAddress = accountSigner.ownerAddress ?? accountSigner.accountAddress;\n\n        const uri = resolveChallengeUri(options.uri ?? this.#challengeUri);\n        const { message } = await this.createWalletChallenge({\n            smartAccountAddress,\n            signerAddress: ownerAddress,\n            uri,\n        });\n        const signature = await accountSigner.signMessage(message);\n\n        const response = await this.loginWithWallet({\n            smartAccountAddress,\n            message,\n            signature,\n            walletProvider: provider,\n        });\n\n        if (!this.#isCurrentAuthOperation(generation, startingToken)) {\n            throw new DOMException(\"Authentication operation superseded\", \"AbortError\");\n        }\n        const environmentSession = this.#getEnvironmentSession();\n        const resolvedLoginMethod =\n            loginMethod ??\n            this.#loginMethod ??\n            environmentSession?.loginMethod ??\n            (provider === \"metamask\" ? \"metamask\" : null);\n\n        const tokenOptions = createAuthTokenStorageSetOptions(response.accessToken);\n        const activeAccount =\n            previousActiveAccount?.mainAccountId === response.accountId\n                ? previousActiveAccount\n                : undefined;\n        this.#sessionStore.commitLogin(\n            {\n                accessToken: response.accessToken,\n                tokenOptions,\n                provider,\n                loginMethod: resolvedLoginMethod,\n                primaryWallet: ownerAddress,\n                smartAccount: smartAccountAddress,\n                accountId: response.accountId,\n                activeAccount,\n                username: response.username ?? undefined,\n            },\n            this.#tokenStorage,\n        );\n        this.#isAuthenticated = true;\n        this.#mainAccountId = response.accountId;\n        this.#activeAccountId = activeAccount?.accountId ?? response.accountId;\n        this.#walletProvider = provider;\n        this.#loginMethod = resolvedLoginMethod;\n        this.#challengeUri = uri;\n        this.#accountSigner = accountSigner;\n        this.#accountIdentity = this.#identityFromSigner(accountSigner);\n\n        this.#notifyStateChange();\n\n        this.events.emit(\"authenticated\", {\n            accountId: response.accountId,\n            username: response.username,\n        });\n\n        return this.#loginResult(response);\n    }\n\n    /**\n     * Builds auth state from a session token and optional active account override.\n     */\n    hydrateAuthState(state: AuthHydrationData): void {\n        this.#beginAuthOperation();\n        const existingToken = this.#getEnvironmentBoundToken();\n        if (!existingToken || !isJwtValid(existingToken)) return;\n\n        const existingSession = this.#getEnvironmentSession();\n        this.#walletProvider = existingSession?.provider ?? this.#walletProvider;\n        this.#loginMethod = existingSession?.loginMethod ?? this.#loginMethod;\n\n        this.#isAuthenticated = true;\n        this.#mainAccountId = state.mainAccountId;\n        this.#activeAccountId = state.activeAccountId ?? state.mainAccountId;\n        this.#accountIdentity = state.smartAccountAddress\n            ? {\n                  accountAddress: state.smartAccountAddress,\n                  ownerAddress: state.ownerAddress,\n              }\n            : null;\n\n        this.#notifyStateChange();\n    }\n\n    /**\n     * Loads the stored token, validates that it still belongs to this environment, and restores auth state when possible.\n     */\n    async restoreSession(): Promise<{ accountId: string; username: string } | null> {\n        const generation = this.#beginAuthOperation();\n        const existingToken = this.#getEnvironmentBoundToken();\n\n        if (!existingToken || !isJwtValid(existingToken)) {\n            if (this.#isCurrentAuthOperation(generation)) this.#clearExpiredSessionState();\n            return null;\n        }\n\n        let me: Awaited<ReturnType<AuthService[\"me\"]>>;\n        try {\n            me = await this.me();\n        } catch (error) {\n            if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n            const mappedError = toPolyesterError(error);\n            if (mappedError instanceof AuthenticationError) {\n                this.#clearExpiredSessionState();\n                return null;\n            }\n            throw mappedError;\n        }\n        if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n\n        let accountSigner = this.#accountSigner;\n        if (!accountSigner) {\n            try {\n                accountSigner = await resolveAccountSigner(this.#accountSignerConfig);\n            } catch (error) {\n                if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n                throw error;\n            }\n            if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n            if (accountSigner) this.#assertAccountSignerEnvironment(accountSigner);\n        }\n\n        if (!isJwtValid(existingToken) || this.#getEnvironmentBoundToken() !== existingToken) {\n            this.#clearExpiredSessionState();\n            return null;\n        }\n\n        const existingSession = this.#getEnvironmentSession();\n        const walletProvider = existingSession?.provider ?? this.#walletProvider;\n        const loginMethod = existingSession?.loginMethod ?? this.#loginMethod;\n        const activeAccountId =\n            this.#activeAccountId ?? existingSession?.activeAccount?.accountId ?? me.accountId;\n\n        // Publish runtime state only after asynchronous restoration has completed.\n        if (accountSigner) {\n            this.#sessionStore.ensureSession(\n                {\n                    provider: walletProvider ?? \"other\",\n                    loginMethod: loginMethod ?? (walletProvider === \"metamask\" ? \"metamask\" : null),\n                    primaryWallet: accountSigner.ownerAddress ?? accountSigner.accountAddress,\n                    smartAccount: accountSigner.accountAddress,\n                    accountId: me.accountId,\n                    username: me.username ?? undefined,\n                },\n                { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds },\n            );\n            this.#accountSigner = accountSigner;\n            this.#accountIdentity = this.#identityFromSigner(accountSigner);\n        }\n        this.#isAuthenticated = true;\n        this.#mainAccountId = me.accountId;\n        this.#activeAccountId = activeAccountId;\n        this.#walletProvider = walletProvider ?? (accountSigner ? \"other\" : undefined);\n        this.#loginMethod = loginMethod;\n        this.#notifyStateChange();\n        return { accountId: me.accountId, username: me.username };\n    }\n\n    /**\n     * Clears stored auth state and removes the persisted auth token.\n     */\n    async logout(): Promise<void> {\n        this.#beginAuthOperation();\n        this.#realtime.disconnectPrivate();\n        this.#tokenStorage.clear();\n        this.#isAuthenticated = false;\n        this.#mainAccountId = null;\n        this.#activeAccountId = null;\n        this.#loginMethod = null;\n        this.#challengeUri = undefined;\n        this.#accountIdentity = null;\n\n        this.#sessionStore.clear();\n\n        this.#notifyStateChange();\n        this.events.emit(\"loggedOut\", undefined);\n    }\n\n    #clearExpiredSessionState(): void {\n        const shouldEmitLoggedOut = this.#isAuthenticated;\n        this.#realtime.disconnectPrivate();\n        this.#tokenStorage.clear();\n        this.#sessionStore.clear();\n        this.#isAuthenticated = false;\n        this.#mainAccountId = null;\n        this.#activeAccountId = null;\n        this.#loginMethod = null;\n        this.#challengeUri = undefined;\n        this.#accountIdentity = null;\n        this.#notifyStateChange();\n        if (shouldEmitLoggedOut) {\n            this.events.emit(\"loggedOut\", undefined);\n        }\n    }\n\n    /**\n     * Returns the remaining lifetime of the stored session token in milliseconds.\n     */\n    getSessionTimeToExpiry(): number {\n        const token = this.#getEnvironmentBoundToken();\n        if (!token || !isJwtValid(token)) return 0;\n        return getJwtTimeToExpiry(token);\n    }\n\n    /**\n     * Refreshes the active account-signer session and updates persisted auth state.\n     */\n    async refreshSession(params?: {\n        /** Overrides the origin remembered from login. */\n        uri?: string;\n        provider?: \"metamask\" | \"turnkey\" | \"other\";\n        loginMethod?: AuthLoginMethod | null;\n    }): Promise<LoginResult> {\n        if (!this.#isAuthenticated) {\n            throw new AuthenticationError(\"Must be authenticated to refresh session\");\n        }\n\n        const currentSession = this.#getEnvironmentSession();\n        return this.#login(\n            {\n                provider: this.#resolveRefreshProvider(params?.provider),\n                uri: params?.uri,\n                loginMethod: params?.loginMethod ?? this.#loginMethod,\n            },\n            currentSession?.activeAccount,\n        );\n    }\n\n    /**\n     * Switches the active account/subaccount by signing the required account switch flow.\n     */\n    switchAccount(\n        accountId: string,\n        options?: { smartAccountAddress?: string; label?: string },\n    ): { accountId: string; isMain: boolean } {\n        if (!this.#isAuthenticated || !this.#mainAccountId) {\n            throw new AuthenticationError(\"Must be authenticated to switch accounts\");\n        }\n\n        this.#activeAccountId = accountId;\n        const isMain = accountId === this.#mainAccountId;\n\n        this.#sessionStore.setActiveAccount(\n            {\n                accountId,\n                isMain,\n                smartAccountAddress: options?.smartAccountAddress,\n                label: options?.label,\n            },\n            { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds },\n        );\n        this.#notifyStateChange();\n\n        return { accountId, isMain };\n    }\n\n    /** Keeps the display-session identity current for the next server render. */\n    syncSessionUsername(username: string | null): void {\n        this.#sessionStore.setUsername(username, {\n            maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds,\n        });\n    }\n\n    /**\n     * Creates a subaccount for the authenticated account and makes it available to the session state.\n     */\n    async createSubaccount(params: CreateSubaccountParams): Promise<CreateSubaccountResult> {\n        if (!this.#isAuthenticated) {\n            throw new AuthenticationError(\"Must be authenticated to create subaccounts\");\n        }\n\n        if (!this.#subaccounts) {\n            throw new ConfigurationError(\n                \"SubaccountsService not configured. Pass it to constructor or call setSubaccountsService().\",\n            );\n        }\n\n        const identity = this.#accountSigner ?? this.#accountIdentity;\n        const ownerAddress =\n            params.ownerAddress ?? identity?.ownerAddress ?? identity?.accountAddress;\n        if (!ownerAddress) {\n            throw new ConfigurationError(\n                \"No root owner address available. Pass ownerAddress or configure an account signer.\",\n            );\n        }\n\n        const { label = \"\" } = params;\n        const challenge = await this.#subaccounts.createChallenge({\n            ownerAddress,\n            uri: resolveChallengeUri(params.uri ?? this.#challengeUri),\n        });\n        const accountSigner =\n            typeof params.accountSigner === \"function\"\n                ? await params.accountSigner(challenge)\n                : params.accountSigner;\n        this.#assertAccountSignerEnvironment(accountSigner);\n        if (\n            accountSigner.accountAddress.toLowerCase() !==\n            challenge.smartAccountAddress.toLowerCase()\n        ) {\n            throw new ConfigurationError(\n                `Subaccount signer address ${accountSigner.accountAddress} does not match the server-derived smart account ${challenge.smartAccountAddress}.`,\n            );\n        }\n        const signature = await accountSigner.signMessage(challenge.message);\n\n        const response = await this.#subaccounts.create({\n            label,\n            smartAccountAddress: challenge.smartAccountAddress,\n            message: challenge.message,\n            signature,\n        });\n\n        return {\n            subaccountId: response.subaccountId,\n            smartAccountSaltNonce: response.smartAccountSaltNonce,\n            revision: response.revision,\n        };\n    }\n\n    /**\n     * Returns the current account-signer auth state snapshot.\n     */\n    getState(): AuthState {\n        const accountIdentity = this.#accountSigner ?? this.#accountIdentity;\n\n        return {\n            isAuthenticated: this.#isAuthenticated,\n            accountAddress: accountIdentity?.accountAddress ?? null,\n            ownerAddress: accountIdentity?.ownerAddress ?? null,\n            mainAccountId: this.#mainAccountId,\n            activeAccount:\n                this.#activeAccountId && this.#mainAccountId\n                    ? {\n                          accountId: this.#activeAccountId,\n                          isMain: this.#activeAccountId === this.#mainAccountId,\n                          mainAccountId: this.#mainAccountId,\n                          smartAccountAddress: accountIdentity?.accountAddress,\n                      }\n                    : null,\n        };\n    }\n\n    async #resolveAccountSigner(): Promise<AccountSigner | null> {\n        if (this.#accountSigner) {\n            this.#assertAccountSignerEnvironment(this.#accountSigner);\n            return this.#accountSigner;\n        }\n\n        const resolved = await resolveAccountSigner(this.#accountSignerConfig);\n        if (resolved) {\n            this.#assertAccountSignerEnvironment(resolved);\n        }\n        return resolved;\n    }\n\n    #notifyStateChange(): void {\n        this.events.emit(\"stateChange\", this.getState());\n    }\n\n    #beginAuthOperation(): number {\n        this.#authOperationGeneration += 1;\n        return this.#authOperationGeneration;\n    }\n\n    #isCurrentAuthOperation(generation: number, token?: string | null): boolean {\n        return (\n            generation === this.#authOperationGeneration &&\n            (token === undefined || this.#tokenStorage.get() === token)\n        );\n    }\n\n    #loginResult(response: LoginWithWalletResponse): LoginResult {\n        const expiresAt = response.expiresAt\n            ? new Date(\n                  Number(response.expiresAt.seconds) * 1000 +\n                      (response.expiresAt.nanos ?? 0) / 1_000_000,\n              )\n            : new Date();\n        return { accountId: response.accountId, username: response.username, expiresAt };\n    }\n\n    #getEnvironmentBoundToken(): string | null {\n        return this.#sessionStore.getEnvironmentBoundToken(this.#tokenStorage);\n    }\n\n    #getCurrentTokenStorageOptions(): AuthTokenStorageSetOptions {\n        const token = this.#tokenStorage.get();\n        if (!token) return { expiresAt: null, maxAgeSeconds: null };\n        return createAuthTokenStorageSetOptions(token);\n    }\n\n    #resolveRefreshProvider(\n        provider?: \"metamask\" | \"turnkey\" | \"other\",\n    ): \"metamask\" | \"turnkey\" | \"other\" {\n        return (\n            provider ?? this.#walletProvider ?? this.#getEnvironmentSession()?.provider ?? \"other\"\n        );\n    }\n\n    #assertAccountSignerEnvironment(accountSigner: AccountSigner): void {\n        assertAccountSigner(accountSigner);\n        if (accountSigner.environmentFingerprint !== this.#environmentFingerprint) {\n            throw new ConfigurationError(\n                \"Account signer environment does not match client environment.\",\n            );\n        }\n    }\n\n    #identityFromSigner(accountSigner: AccountSigner): AccountIdentity {\n        return {\n            accountAddress: accountSigner.accountAddress,\n            ownerAddress: accountSigner.ownerAddress,\n        };\n    }\n\n    #getEnvironmentSession(): SessionData | null {\n        return this.#sessionStore.get();\n    }\n}\n\nfunction resolveChallengeUri(uri: string | undefined): string {\n    const resolved = uri ?? (typeof location === \"undefined\" ? undefined : location.origin);\n    if (!resolved)\n        throw new ConfigurationError(\n            \"Wallet authentication requires a browser origin URI. Pass uri outside a browser.\",\n        );\n    return resolved;\n}\n"],"mappings":";;;;;;;;;;;;AAgFA,IAAa,2BAAb,cAA8C,YAAY;CACtD,SAAkB,IAAI,aAAsC;CAE5D;CACA,iBAAuC;CACvC,mBAA2C;CAC3C,mBAAmB;CACnB,iBAAgC;CAChC,mBAAkC;CAClC;CACA,kBAAgE,KAAA;CAChE,eAAuC;CACvC,gBAAoC,KAAA;CACpC;CACA;CACA;CACA;CAGA,2BAA2B;CAE3B,YAAY,EACR,YACA,qBACA,aACA,aACA,UACA,cACA,gBASD;EACC,MAAM,YAAY,QAAQ;EAE1B,KAAKA,uBAAuB;EAC5B,KAAKC,0BAA0B,YAAY;EAC3C,KAAKC,eAAe;EACpB,KAAKC,gBAAgB;EACrB,KAAKC,YAAY;EACjB,KAAKC,gBACD,gBACA,IAAI,iBAAiB,EACjB,wBAAwB,YAAY,YACxC,CAAC;CACT;;;;CAKA,sBAAsB,aAAuC;EACzD,KAAKH,eAAe;CACxB;;;;CAKA,iBAAiB,eAA2C;EACxD,IAAI,eAAe,KAAKI,gCAAgC,aAAa;EACrE,KAAKC,oBAAoB;EACzB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB,gBAAgB,KAAKC,oBAAoB,aAAa,IAAI;EAClF,KAAKC,mBAAmB;CAC5B;;;;CAKA,mBAAyC;EACrC,OAAO,KAAKH;CAChB;;;;CAKA,MAAM,MAAM,SAA6C;EACrD,OAAO,KAAKI,OAAO,OAAO;CAC9B;CAEA,MAAMA,OACF,SACA,uBACoB;EACpB,MAAM,aAAa,KAAKL,oBAAoB;EAC5C,MAAM,gBAAgB,KAAKJ,cAAc,IAAI;EAC7C,MAAM,EAAE,UAAU,gBAAgB;EAElC,MAAM,gBAAgB,MAAM,KAAKU,sBAAsB;EAEvD,IAAI,CAAC,eACD,MAAM,IAAI,mBACN,wFACJ;EAGJ,MAAM,sBAAsB,cAAc;EAC1C,MAAM,eAAe,cAAc,gBAAgB,cAAc;EAEjE,MAAM,MAAM,oBAAoB,QAAQ,OAAO,KAAKC,aAAa;EACjE,MAAM,EAAE,YAAY,MAAM,KAAK,sBAAsB;GACjD;GACA,eAAe;GACf;EACJ,CAAC;EACD,MAAM,YAAY,MAAM,cAAc,YAAY,OAAO;EAEzD,MAAM,WAAW,MAAM,KAAK,gBAAgB;GACxC;GACA;GACA;GACA,gBAAgB;EACpB,CAAC;EAED,IAAI,CAAC,KAAKC,wBAAwB,YAAY,aAAa,GACvD,MAAM,IAAI,aAAa,uCAAuC,YAAY;EAE9E,MAAM,qBAAqB,KAAKC,uBAAuB;EACvD,MAAM,sBACF,eACA,KAAKC,gBACL,oBAAoB,gBACnB,aAAa,aAAa,aAAa;EAE5C,MAAM,eAAe,iCAAiC,SAAS,WAAW;EAC1E,MAAM,gBACF,uBAAuB,kBAAkB,SAAS,YAC5C,wBACA,KAAA;EACV,KAAKZ,cAAc,YACf;GACI,aAAa,SAAS;GACtB;GACA;GACA,aAAa;GACb,eAAe;GACf,cAAc;GACd,WAAW,SAAS;GACpB;GACA,UAAU,SAAS,YAAY,KAAA;EACnC,GACA,KAAKF,aACT;EACA,KAAKe,mBAAmB;EACxB,KAAKC,iBAAiB,SAAS;EAC/B,KAAKC,mBAAmB,eAAe,aAAa,SAAS;EAC7D,KAAKC,kBAAkB;EACvB,KAAKJ,eAAe;EACpB,KAAKH,gBAAgB;EACrB,KAAKN,iBAAiB;EACtB,KAAKC,mBAAmB,KAAKC,oBAAoB,aAAa;EAE9D,KAAKC,mBAAmB;EAExB,KAAK,OAAO,KAAK,iBAAiB;GAC9B,WAAW,SAAS;GACpB,UAAU,SAAS;EACvB,CAAC;EAED,OAAO,KAAKW,aAAa,QAAQ;CACrC;;;;CAKA,iBAAiB,OAAgC;EAC7C,KAAKf,oBAAoB;EACzB,MAAM,gBAAgB,KAAKgB,0BAA0B;EACrD,IAAI,CAAC,iBAAiB,CAAC,WAAW,aAAa,GAAG;EAElD,MAAM,kBAAkB,KAAKP,uBAAuB;EACpD,KAAKK,kBAAkB,iBAAiB,YAAY,KAAKA;EACzD,KAAKJ,eAAe,iBAAiB,eAAe,KAAKA;EAEzD,KAAKC,mBAAmB;EACxB,KAAKC,iBAAiB,MAAM;EAC5B,KAAKC,mBAAmB,MAAM,mBAAmB,MAAM;EACvD,KAAKX,mBAAmB,MAAM,sBACxB;GACI,gBAAgB,MAAM;GACtB,cAAc,MAAM;EACxB,IACA;EAEN,KAAKE,mBAAmB;CAC5B;;;;CAKA,MAAM,iBAA0E;EAC5E,MAAM,aAAa,KAAKJ,oBAAoB;EAC5C,MAAM,gBAAgB,KAAKgB,0BAA0B;EAErD,IAAI,CAAC,iBAAiB,CAAC,WAAW,aAAa,GAAG;GAC9C,IAAI,KAAKR,wBAAwB,UAAU,GAAG,KAAKS,0BAA0B;GAC7E,OAAO;EACX;EAEA,IAAI;EACJ,IAAI;GACA,KAAK,MAAM,KAAK,GAAG;EACvB,SAAS,OAAO;GACZ,IAAI,CAAC,KAAKT,wBAAwB,YAAY,aAAa,GAAG,OAAO;GACrE,MAAM,cAAc,iBAAiB,KAAK;GAC1C,IAAI,uBAAuB,qBAAqB;IAC5C,KAAKS,0BAA0B;IAC/B,OAAO;GACX;GACA,MAAM;EACV;EACA,IAAI,CAAC,KAAKT,wBAAwB,YAAY,aAAa,GAAG,OAAO;EAErE,IAAI,gBAAgB,KAAKP;EACzB,IAAI,CAAC,eAAe;GAChB,IAAI;IACA,gBAAgB,MAAM,qBAAqB,KAAKR,oBAAoB;GACxE,SAAS,OAAO;IACZ,IAAI,CAAC,KAAKe,wBAAwB,YAAY,aAAa,GAAG,OAAO;IACrE,MAAM;GACV;GACA,IAAI,CAAC,KAAKA,wBAAwB,YAAY,aAAa,GAAG,OAAO;GACrE,IAAI,eAAe,KAAKT,gCAAgC,aAAa;EACzE;EAEA,IAAI,CAAC,WAAW,aAAa,KAAK,KAAKiB,0BAA0B,MAAM,eAAe;GAClF,KAAKC,0BAA0B;GAC/B,OAAO;EACX;EAEA,MAAM,kBAAkB,KAAKR,uBAAuB;EACpD,MAAM,iBAAiB,iBAAiB,YAAY,KAAKK;EACzD,MAAM,cAAc,iBAAiB,eAAe,KAAKJ;EACzD,MAAM,kBACF,KAAKG,oBAAoB,iBAAiB,eAAe,aAAa,GAAG;EAG7E,IAAI,eAAe;GACf,KAAKf,cAAc,cACf;IACI,UAAU,kBAAkB;IAC5B,aAAa,gBAAgB,mBAAmB,aAAa,aAAa;IAC1E,eAAe,cAAc,gBAAgB,cAAc;IAC3D,cAAc,cAAc;IAC5B,WAAW,GAAG;IACd,UAAU,GAAG,YAAY,KAAA;GAC7B,GACA,EAAE,eAAe,KAAKoB,+BAA+B,CAAC,CAAC,cAAc,CACzE;GACA,KAAKjB,iBAAiB;GACtB,KAAKC,mBAAmB,KAAKC,oBAAoB,aAAa;EAClE;EACA,KAAKQ,mBAAmB;EACxB,KAAKC,iBAAiB,GAAG;EACzB,KAAKC,mBAAmB;EACxB,KAAKC,kBAAkB,mBAAmB,gBAAgB,UAAU,KAAA;EACpE,KAAKJ,eAAe;EACpB,KAAKN,mBAAmB;EACxB,OAAO;GAAE,WAAW,GAAG;GAAW,UAAU,GAAG;EAAS;CAC5D;;;;CAKA,MAAM,SAAwB;EAC1B,KAAKJ,oBAAoB;EACzB,KAAKH,UAAU,kBAAkB;EACjC,KAAKD,cAAc,MAAM;EACzB,KAAKe,mBAAmB;EACxB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB;EACxB,KAAKH,eAAe;EACpB,KAAKH,gBAAgB,KAAA;EACrB,KAAKL,mBAAmB;EAExB,KAAKJ,cAAc,MAAM;EAEzB,KAAKM,mBAAmB;EACxB,KAAK,OAAO,KAAK,aAAa,KAAA,CAAS;CAC3C;CAEA,4BAAkC;EAC9B,MAAM,sBAAsB,KAAKO;EACjC,KAAKd,UAAU,kBAAkB;EACjC,KAAKD,cAAc,MAAM;EACzB,KAAKE,cAAc,MAAM;EACzB,KAAKa,mBAAmB;EACxB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB;EACxB,KAAKH,eAAe;EACpB,KAAKH,gBAAgB,KAAA;EACrB,KAAKL,mBAAmB;EACxB,KAAKE,mBAAmB;EACxB,IAAI,qBACA,KAAK,OAAO,KAAK,aAAa,KAAA,CAAS;CAE/C;;;;CAKA,yBAAiC;EAC7B,MAAM,QAAQ,KAAKY,0BAA0B;EAC7C,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,GAAG,OAAO;EACzC,OAAO,mBAAmB,KAAK;CACnC;;;;CAKA,MAAM,eAAe,QAKI;EACrB,IAAI,CAAC,KAAKL,kBACN,MAAM,IAAI,oBAAoB,0CAA0C;EAG5E,MAAM,iBAAiB,KAAKF,uBAAuB;EACnD,OAAO,KAAKJ,OACR;GACI,UAAU,KAAKc,wBAAwB,QAAQ,QAAQ;GACvD,KAAK,QAAQ;GACb,aAAa,QAAQ,eAAe,KAAKT;EAC7C,GACA,gBAAgB,aACpB;CACJ;;;;CAKA,cACI,WACA,SACsC;EACtC,IAAI,CAAC,KAAKC,oBAAoB,CAAC,KAAKC,gBAChC,MAAM,IAAI,oBAAoB,0CAA0C;EAG5E,KAAKC,mBAAmB;EACxB,MAAM,SAAS,cAAc,KAAKD;EAElC,KAAKd,cAAc,iBACf;GACI;GACA;GACA,qBAAqB,SAAS;GAC9B,OAAO,SAAS;EACpB,GACA,EAAE,eAAe,KAAKoB,+BAA+B,CAAC,CAAC,cAAc,CACzE;EACA,KAAKd,mBAAmB;EAExB,OAAO;GAAE;GAAW;EAAO;CAC/B;;CAGA,oBAAoB,UAA+B;EAC/C,KAAKN,cAAc,YAAY,UAAU,EACrC,eAAe,KAAKoB,+BAA+B,CAAC,CAAC,cACzD,CAAC;CACL;;;;CAKA,MAAM,iBAAiB,QAAiE;EACpF,IAAI,CAAC,KAAKP,kBACN,MAAM,IAAI,oBAAoB,6CAA6C;EAG/E,IAAI,CAAC,KAAKhB,cACN,MAAM,IAAI,mBACN,4FACJ;EAGJ,MAAM,WAAW,KAAKM,kBAAkB,KAAKC;EAC7C,MAAM,eACF,OAAO,gBAAgB,UAAU,gBAAgB,UAAU;EAC/D,IAAI,CAAC,cACD,MAAM,IAAI,mBACN,oFACJ;EAGJ,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,YAAY,MAAM,KAAKP,aAAa,gBAAgB;GACtD;GACA,KAAK,oBAAoB,OAAO,OAAO,KAAKY,aAAa;EAC7D,CAAC;EACD,MAAM,gBACF,OAAO,OAAO,kBAAkB,aAC1B,MAAM,OAAO,cAAc,SAAS,IACpC,OAAO;EACjB,KAAKR,gCAAgC,aAAa;EAClD,IACI,cAAc,eAAe,YAAY,MACzC,UAAU,oBAAoB,YAAY,GAE1C,MAAM,IAAI,mBACN,6BAA6B,cAAc,eAAe,mDAAmD,UAAU,oBAAoB,EAC/I;EAEJ,MAAM,YAAY,MAAM,cAAc,YAAY,UAAU,OAAO;EAEnE,MAAM,WAAW,MAAM,KAAKJ,aAAa,OAAO;GAC5C;GACA,qBAAqB,UAAU;GAC/B,SAAS,UAAU;GACnB;EACJ,CAAC;EAED,OAAO;GACH,cAAc,SAAS;GACvB,uBAAuB,SAAS;GAChC,UAAU,SAAS;EACvB;CACJ;;;;CAKA,WAAsB;EAClB,MAAM,kBAAkB,KAAKM,kBAAkB,KAAKC;EAEpD,OAAO;GACH,iBAAiB,KAAKS;GACtB,gBAAgB,iBAAiB,kBAAkB;GACnD,cAAc,iBAAiB,gBAAgB;GAC/C,eAAe,KAAKC;GACpB,eACI,KAAKC,oBAAoB,KAAKD,iBACxB;IACI,WAAW,KAAKC;IAChB,QAAQ,KAAKA,qBAAqB,KAAKD;IACvC,eAAe,KAAKA;IACpB,qBAAqB,iBAAiB;GAC1C,IACA;EACd;CACJ;CAEA,MAAMN,wBAAuD;EACzD,IAAI,KAAKL,gBAAgB;GACrB,KAAKF,gCAAgC,KAAKE,cAAc;GACxD,OAAO,KAAKA;EAChB;EAEA,MAAM,WAAW,MAAM,qBAAqB,KAAKR,oBAAoB;EACrE,IAAI,UACA,KAAKM,gCAAgC,QAAQ;EAEjD,OAAO;CACX;CAEA,qBAA2B;EACvB,KAAK,OAAO,KAAK,eAAe,KAAK,SAAS,CAAC;CACnD;CAEA,sBAA8B;EAC1B,KAAKqB,4BAA4B;EACjC,OAAO,KAAKA;CAChB;CAEA,wBAAwB,YAAoB,OAAgC;EACxE,OACI,eAAe,KAAKA,6BACnB,UAAU,KAAA,KAAa,KAAKxB,cAAc,IAAI,MAAM;CAE7D;CAEA,aAAa,UAAgD;EACzD,MAAM,YAAY,SAAS,4BACrB,IAAI,KACA,OAAO,SAAS,UAAU,OAAO,IAAI,OAChC,SAAS,UAAU,SAAS,KAAK,GAC1C,oBACA,IAAI,KAAK;EACf,OAAO;GAAE,WAAW,SAAS;GAAW,UAAU,SAAS;GAAU;EAAU;CACnF;CAEA,4BAA2C;EACvC,OAAO,KAAKE,cAAc,yBAAyB,KAAKF,aAAa;CACzE;CAEA,iCAA6D;EACzD,MAAM,QAAQ,KAAKA,cAAc,IAAI;EACrC,IAAI,CAAC,OAAO,OAAO;GAAE,WAAW;GAAM,eAAe;EAAK;EAC1D,OAAO,iCAAiC,KAAK;CACjD;CAEA,wBACI,UACgC;EAChC,OACI,YAAY,KAAKkB,mBAAmB,KAAKL,uBAAuB,CAAC,EAAE,YAAY;CAEvF;CAEA,gCAAgC,eAAoC;EAChE,oBAAoB,aAAa;EACjC,IAAI,cAAc,2BAA2B,KAAKf,yBAC9C,MAAM,IAAI,mBACN,+DACJ;CAER;CAEA,oBAAoB,eAA+C;EAC/D,OAAO;GACH,gBAAgB,cAAc;GAC9B,cAAc,cAAc;EAChC;CACJ;CAEA,yBAA6C;EACzC,OAAO,KAAKI,cAAc,IAAI;CAClC;AACJ;AAEA,SAAS,oBAAoB,KAAiC;CAC1D,MAAM,WAAW,QAAQ,OAAO,aAAa,cAAc,KAAA,IAAY,SAAS;CAChF,IAAI,CAAC,UACD,MAAM,IAAI,mBACN,kFACJ;CACJ,OAAO;AACX"}
+{"version":3,"file":"account-signer-auth.js","names":["#accountSignerConfig","#environmentFingerprint","#subaccounts","#tokenStorage","#realtime","#sessionStore","#assertAccountSignerEnvironment","#beginAuthOperation","#accountSigner","#accountIdentity","#identityFromSigner","#notifyStateChange","#login","#resolveAccountSigner","#challengeUri","#isCurrentAuthOperation","#getEnvironmentSession","#loginMethod","#isAuthenticated","#mainAccountId","#activeAccountId","#walletProvider","#loginResult","#getEnvironmentBoundToken","#clearExpiredSessionState","#getCurrentTokenStorageOptions","#resolveRefreshProvider","#authOperationGeneration"],"sources":["../../../src/services/auth/account-signer-auth.ts"],"sourcesContent":["import { AuthService, type LoginWithWalletResponse } from \"./auth.js\";\nimport { AuthenticationError, ConfigurationError } from \"../../shared/errors.js\";\nimport { toPolyesterError } from \"../../shared/connect-error-mapping.js\";\nimport { AuthSessionStore } from \"./session.js\";\nimport type { AccountSigner, AccountSignerConfig, HexAddress } from \"../../account-signer/types.js\";\nimport { assertAccountSigner, resolveAccountSigner } from \"../../account-signer/types.js\";\nimport { EventEmitter } from \"../../utils/event-emitter.js\";\nimport { isJwtValid, getJwtTimeToExpiry } from \"../../utils/jwt.js\";\nimport type { SubaccountChallenge, SubaccountsService } from \"../subaccounts/index.js\";\nimport type {\n    AuthState,\n    AuthHydrationData,\n    AuthLoginMethod,\n    SessionData,\n    ActiveAccountInfo,\n} from \"./session.types.js\";\nimport type { PolyesterRealtime } from \"../../realtime/index.js\";\nimport type { PolyesterEnvironment } from \"../../environment.js\";\nimport type { AuthAndPublicApiTransports } from \"../../shared/transports.js\";\nimport {\n    createAuthTokenStorageSetOptions,\n    type AuthTokenStorage,\n    type AuthTokenStorageSetOptions,\n} from \"./token-storage.js\";\n\nexport interface AccountSignerAuthEvents {\n    authenticated: { accountId: string; username: string };\n    loggedOut: void;\n    error: { code: string; message: string };\n    servicesReady: void;\n    stateChange: AuthState;\n}\n\nexport interface LoginResult {\n    accountId: string;\n    username: string;\n    expiresAt: Date;\n}\n\nexport interface LoginOptions {\n    /**\n     * The wallet provider to use for login.\n     */\n    provider: SessionData[\"provider\"];\n    /** Browser origin requesting the signature; defaults to location.origin in browsers. Required outside browsers. */\n    uri?: string;\n    loginMethod?: AuthLoginMethod | null;\n}\n\nexport interface CreateSubaccountParams {\n    /**\n     * Signer for the new subaccount, or a factory that derives it from the server challenge\n     * (for example via Turnkey with `challenge.smartAccountSaltNonce`). Its accountAddress must\n     * equal `challenge.smartAccountAddress`.\n     */\n    accountSigner:\n        | AccountSigner\n        | ((challenge: SubaccountChallenge) => AccountSigner | Promise<AccountSigner>);\n    /** Optional human-readable label for this subaccount */\n    label?: string;\n    /** Browser origin requesting the signature; defaults to location.origin in browsers. Required outside browsers. */\n    uri?: string;\n    /** Root owner EOA bound to the authenticated account; defaults to the configured signer's owner. */\n    ownerAddress?: HexAddress;\n}\n\nexport interface CreateSubaccountResult {\n    subaccountId: string;\n    smartAccountSaltNonce: number;\n    revision: string;\n}\n\ninterface AccountIdentity {\n    accountAddress: HexAddress;\n    ownerAddress?: HexAddress;\n}\n\n/**\n * Coordinates wallet/account-signer authentication, session storage, subaccount selection, and session refresh.\n */\nexport class AccountSignerAuthService extends AuthService {\n    readonly events = new EventEmitter<AccountSignerAuthEvents>();\n\n    #accountSignerConfig: AccountSignerConfig | undefined;\n    #accountSigner: AccountSigner | null = null;\n    #accountIdentity: AccountIdentity | null = null;\n    #isAuthenticated = false;\n    #mainAccountId: string | null = null;\n    #activeAccountId: string | null = null;\n    #subaccounts: SubaccountsService;\n    #walletProvider: SessionData[\"provider\"] | undefined = undefined;\n    #loginMethod: AuthLoginMethod | null = null;\n    #challengeUri: string | undefined = undefined;\n    #environmentFingerprint: string;\n    #tokenStorage: AuthTokenStorage;\n    #sessionStore: AuthSessionStore;\n    #realtime: PolyesterRealtime;\n    // Every asynchronous auth transition captures this generation. A later login,\n    // logout, signer change, or restore makes older work observational only.\n    #authOperationGeneration = 0;\n\n    constructor({\n        transports,\n        accountSignerConfig,\n        environment,\n        subaccounts,\n        realtime,\n        tokenStorage,\n        sessionStore,\n    }: {\n        transports: AuthAndPublicApiTransports;\n        accountSignerConfig?: AccountSignerConfig;\n        environment: PolyesterEnvironment;\n        subaccounts: SubaccountsService;\n        realtime: PolyesterRealtime;\n        tokenStorage: AuthTokenStorage;\n        sessionStore?: AuthSessionStore;\n    }) {\n        super(transports, realtime);\n\n        this.#accountSignerConfig = accountSignerConfig;\n        this.#environmentFingerprint = environment.fingerprint;\n        this.#subaccounts = subaccounts;\n        this.#tokenStorage = tokenStorage;\n        this.#realtime = realtime;\n        this.#sessionStore =\n            sessionStore ??\n            new AuthSessionStore({\n                environmentFingerprint: environment.fingerprint,\n            });\n    }\n\n    /**\n     * Attaches the subaccounts service used when creating a subaccount during authenticated flows.\n     */\n    setSubaccountsService(subaccounts: SubaccountsService): void {\n        this.#subaccounts = subaccounts;\n    }\n\n    /**\n     * Sets the account signer used to sign login and account-switch challenges.\n     */\n    setAccountSigner(accountSigner: AccountSigner | null): void {\n        if (accountSigner) this.#assertAccountSignerEnvironment(accountSigner);\n        this.#beginAuthOperation();\n        this.#accountSigner = accountSigner;\n        this.#accountIdentity = accountSigner ? this.#identityFromSigner(accountSigner) : null;\n        this.#notifyStateChange();\n    }\n\n    /**\n     * Returns the active account signer, throwing if one has not been configured.\n     */\n    getAccountSigner(): AccountSigner | null {\n        return this.#accountSigner;\n    }\n\n    /**\n     * Signs a server-issued SIWE message with the configured account signer, exchanges it for a session token, and stores the hydrated account/subaccount session state.\n     */\n    async login(options: LoginOptions): Promise<LoginResult> {\n        return this.#login(options);\n    }\n\n    async #login(\n        options: LoginOptions,\n        previousActiveAccount?: ActiveAccountInfo,\n    ): Promise<LoginResult> {\n        const generation = this.#beginAuthOperation();\n        const startingToken = this.#tokenStorage.get();\n        const { provider, loginMethod } = options;\n\n        const accountSigner = await this.#resolveAccountSigner();\n\n        if (!accountSigner) {\n            throw new ConfigurationError(\n                \"No account signer configured. Call setAccountSigner() or pass accountSigner in config.\",\n            );\n        }\n\n        const smartAccountAddress = accountSigner.accountAddress;\n        const ownerAddress = accountSigner.ownerAddress ?? accountSigner.accountAddress;\n\n        const uri = resolveChallengeUri(options.uri ?? this.#challengeUri);\n        const { message } = await this.createWalletChallenge({\n            smartAccountAddress,\n            signerAddress: ownerAddress,\n            uri,\n        });\n        const signature = await accountSigner.signMessage(message);\n\n        const response = await this.loginWithWallet({\n            smartAccountAddress,\n            message,\n            signature,\n            walletProvider: provider,\n        });\n\n        if (!this.#isCurrentAuthOperation(generation, startingToken)) {\n            throw new DOMException(\"Authentication operation superseded\", \"AbortError\");\n        }\n        const environmentSession = this.#getEnvironmentSession();\n        const resolvedLoginMethod =\n            loginMethod ??\n            this.#loginMethod ??\n            environmentSession?.loginMethod ??\n            (provider === \"metamask\" || provider === \"phantom\" ? provider : null);\n\n        const tokenOptions = createAuthTokenStorageSetOptions(response.accessToken);\n        const activeAccount =\n            previousActiveAccount?.mainAccountId === response.accountId\n                ? previousActiveAccount\n                : undefined;\n        this.#sessionStore.commitLogin(\n            {\n                accessToken: response.accessToken,\n                tokenOptions,\n                provider,\n                loginMethod: resolvedLoginMethod,\n                primaryWallet: ownerAddress,\n                smartAccount: smartAccountAddress,\n                accountId: response.accountId,\n                activeAccount,\n                username: response.username ?? undefined,\n            },\n            this.#tokenStorage,\n        );\n        this.#isAuthenticated = true;\n        this.#mainAccountId = response.accountId;\n        this.#activeAccountId = activeAccount?.accountId ?? response.accountId;\n        this.#walletProvider = provider;\n        this.#loginMethod = resolvedLoginMethod;\n        this.#challengeUri = uri;\n        this.#accountSigner = accountSigner;\n        this.#accountIdentity = this.#identityFromSigner(accountSigner);\n\n        this.#notifyStateChange();\n\n        this.events.emit(\"authenticated\", {\n            accountId: response.accountId,\n            username: response.username,\n        });\n\n        return this.#loginResult(response);\n    }\n\n    /**\n     * Builds auth state from a session token and optional active account override.\n     */\n    hydrateAuthState(state: AuthHydrationData): void {\n        this.#beginAuthOperation();\n        const existingToken = this.#getEnvironmentBoundToken();\n        if (!existingToken || !isJwtValid(existingToken)) return;\n\n        const existingSession = this.#getEnvironmentSession();\n        this.#walletProvider = existingSession?.provider ?? this.#walletProvider;\n        this.#loginMethod = existingSession?.loginMethod ?? this.#loginMethod;\n\n        this.#isAuthenticated = true;\n        this.#mainAccountId = state.mainAccountId;\n        this.#activeAccountId = state.activeAccountId ?? state.mainAccountId;\n        this.#accountIdentity = state.smartAccountAddress\n            ? {\n                  accountAddress: state.smartAccountAddress,\n                  ownerAddress: state.ownerAddress,\n              }\n            : null;\n\n        this.#notifyStateChange();\n    }\n\n    /**\n     * Loads the stored token, validates that it still belongs to this environment, and restores auth state when possible.\n     */\n    async restoreSession(): Promise<{ accountId: string; username: string } | null> {\n        const generation = this.#beginAuthOperation();\n        const existingToken = this.#getEnvironmentBoundToken();\n\n        if (!existingToken || !isJwtValid(existingToken)) {\n            if (this.#isCurrentAuthOperation(generation)) this.#clearExpiredSessionState();\n            return null;\n        }\n\n        let me: Awaited<ReturnType<AuthService[\"me\"]>>;\n        try {\n            me = await this.me();\n        } catch (error) {\n            if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n            const mappedError = toPolyesterError(error);\n            if (mappedError instanceof AuthenticationError) {\n                this.#clearExpiredSessionState();\n                return null;\n            }\n            throw mappedError;\n        }\n        if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n\n        let accountSigner = this.#accountSigner;\n        if (!accountSigner) {\n            try {\n                accountSigner = await resolveAccountSigner(this.#accountSignerConfig);\n            } catch (error) {\n                if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n                throw error;\n            }\n            if (!this.#isCurrentAuthOperation(generation, existingToken)) return null;\n            if (accountSigner) this.#assertAccountSignerEnvironment(accountSigner);\n        }\n\n        if (!isJwtValid(existingToken) || this.#getEnvironmentBoundToken() !== existingToken) {\n            this.#clearExpiredSessionState();\n            return null;\n        }\n\n        const existingSession = this.#getEnvironmentSession();\n        const walletProvider = existingSession?.provider ?? this.#walletProvider;\n        const loginMethod = existingSession?.loginMethod ?? this.#loginMethod;\n        const activeAccountId =\n            this.#activeAccountId ?? existingSession?.activeAccount?.accountId ?? me.accountId;\n\n        // Publish runtime state only after asynchronous restoration has completed.\n        if (accountSigner) {\n            this.#sessionStore.ensureSession(\n                {\n                    provider: walletProvider ?? \"other\",\n                    loginMethod: loginMethod ?? (walletProvider === \"metamask\" ? \"metamask\" : null),\n                    primaryWallet: accountSigner.ownerAddress ?? accountSigner.accountAddress,\n                    smartAccount: accountSigner.accountAddress,\n                    accountId: me.accountId,\n                    username: me.username ?? undefined,\n                },\n                { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds },\n            );\n            this.#accountSigner = accountSigner;\n            this.#accountIdentity = this.#identityFromSigner(accountSigner);\n        }\n        this.#isAuthenticated = true;\n        this.#mainAccountId = me.accountId;\n        this.#activeAccountId = activeAccountId;\n        this.#walletProvider = walletProvider ?? (accountSigner ? \"other\" : undefined);\n        this.#loginMethod = loginMethod;\n        this.#notifyStateChange();\n        return { accountId: me.accountId, username: me.username };\n    }\n\n    /**\n     * Clears stored auth state and removes the persisted auth token.\n     */\n    async logout(): Promise<void> {\n        this.#beginAuthOperation();\n        this.#realtime.disconnectPrivate();\n        this.#tokenStorage.clear();\n        this.#isAuthenticated = false;\n        this.#mainAccountId = null;\n        this.#activeAccountId = null;\n        this.#loginMethod = null;\n        this.#challengeUri = undefined;\n        this.#accountIdentity = null;\n\n        this.#sessionStore.clear();\n\n        this.#notifyStateChange();\n        this.events.emit(\"loggedOut\", undefined);\n    }\n\n    #clearExpiredSessionState(): void {\n        const shouldEmitLoggedOut = this.#isAuthenticated;\n        this.#realtime.disconnectPrivate();\n        this.#tokenStorage.clear();\n        this.#sessionStore.clear();\n        this.#isAuthenticated = false;\n        this.#mainAccountId = null;\n        this.#activeAccountId = null;\n        this.#loginMethod = null;\n        this.#challengeUri = undefined;\n        this.#accountIdentity = null;\n        this.#notifyStateChange();\n        if (shouldEmitLoggedOut) {\n            this.events.emit(\"loggedOut\", undefined);\n        }\n    }\n\n    /**\n     * Returns the remaining lifetime of the stored session token in milliseconds.\n     */\n    getSessionTimeToExpiry(): number {\n        const token = this.#getEnvironmentBoundToken();\n        if (!token || !isJwtValid(token)) return 0;\n        return getJwtTimeToExpiry(token);\n    }\n\n    /**\n     * Refreshes the active account-signer session and updates persisted auth state.\n     */\n    async refreshSession(params?: {\n        /** Overrides the origin remembered from login. */\n        uri?: string;\n        provider?: SessionData[\"provider\"];\n        loginMethod?: AuthLoginMethod | null;\n    }): Promise<LoginResult> {\n        if (!this.#isAuthenticated) {\n            throw new AuthenticationError(\"Must be authenticated to refresh session\");\n        }\n\n        const currentSession = this.#getEnvironmentSession();\n        return this.#login(\n            {\n                provider: this.#resolveRefreshProvider(params?.provider),\n                uri: params?.uri,\n                loginMethod: params?.loginMethod ?? this.#loginMethod,\n            },\n            currentSession?.activeAccount,\n        );\n    }\n\n    /**\n     * Switches the active account/subaccount by signing the required account switch flow.\n     */\n    switchAccount(\n        accountId: string,\n        options?: { smartAccountAddress?: string; label?: string },\n    ): { accountId: string; isMain: boolean } {\n        if (!this.#isAuthenticated || !this.#mainAccountId) {\n            throw new AuthenticationError(\"Must be authenticated to switch accounts\");\n        }\n\n        this.#activeAccountId = accountId;\n        const isMain = accountId === this.#mainAccountId;\n\n        this.#sessionStore.setActiveAccount(\n            {\n                accountId,\n                isMain,\n                smartAccountAddress: options?.smartAccountAddress,\n                label: options?.label,\n            },\n            { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds },\n        );\n        this.#notifyStateChange();\n\n        return { accountId, isMain };\n    }\n\n    /** Keeps the display-session identity current for the next server render. */\n    syncSessionUsername(username: string | null): void {\n        this.#sessionStore.setUsername(username, {\n            maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds,\n        });\n    }\n\n    /**\n     * Creates a subaccount for the authenticated account and makes it available to the session state.\n     */\n    async createSubaccount(params: CreateSubaccountParams): Promise<CreateSubaccountResult> {\n        if (!this.#isAuthenticated) {\n            throw new AuthenticationError(\"Must be authenticated to create subaccounts\");\n        }\n\n        if (!this.#subaccounts) {\n            throw new ConfigurationError(\n                \"SubaccountsService not configured. Pass it to constructor or call setSubaccountsService().\",\n            );\n        }\n\n        const identity = this.#accountSigner ?? this.#accountIdentity;\n        const ownerAddress =\n            params.ownerAddress ?? identity?.ownerAddress ?? identity?.accountAddress;\n        if (!ownerAddress) {\n            throw new ConfigurationError(\n                \"No root owner address available. Pass ownerAddress or configure an account signer.\",\n            );\n        }\n\n        const { label = \"\" } = params;\n        const challenge = await this.#subaccounts.createChallenge({\n            ownerAddress,\n            uri: resolveChallengeUri(params.uri ?? this.#challengeUri),\n        });\n        const accountSigner =\n            typeof params.accountSigner === \"function\"\n                ? await params.accountSigner(challenge)\n                : params.accountSigner;\n        this.#assertAccountSignerEnvironment(accountSigner);\n        if (\n            accountSigner.accountAddress.toLowerCase() !==\n            challenge.smartAccountAddress.toLowerCase()\n        ) {\n            throw new ConfigurationError(\n                `Subaccount signer address ${accountSigner.accountAddress} does not match the server-derived smart account ${challenge.smartAccountAddress}.`,\n            );\n        }\n        const signature = await accountSigner.signMessage(challenge.message);\n\n        const response = await this.#subaccounts.create({\n            label,\n            smartAccountAddress: challenge.smartAccountAddress,\n            message: challenge.message,\n            signature,\n        });\n\n        return {\n            subaccountId: response.subaccountId,\n            smartAccountSaltNonce: response.smartAccountSaltNonce,\n            revision: response.revision,\n        };\n    }\n\n    /**\n     * Returns the current account-signer auth state snapshot.\n     */\n    getState(): AuthState {\n        const accountIdentity = this.#accountSigner ?? this.#accountIdentity;\n\n        return {\n            isAuthenticated: this.#isAuthenticated,\n            accountAddress: accountIdentity?.accountAddress ?? null,\n            ownerAddress: accountIdentity?.ownerAddress ?? null,\n            mainAccountId: this.#mainAccountId,\n            activeAccount:\n                this.#activeAccountId && this.#mainAccountId\n                    ? {\n                          accountId: this.#activeAccountId,\n                          isMain: this.#activeAccountId === this.#mainAccountId,\n                          mainAccountId: this.#mainAccountId,\n                          smartAccountAddress: accountIdentity?.accountAddress,\n                      }\n                    : null,\n        };\n    }\n\n    async #resolveAccountSigner(): Promise<AccountSigner | null> {\n        if (this.#accountSigner) {\n            this.#assertAccountSignerEnvironment(this.#accountSigner);\n            return this.#accountSigner;\n        }\n\n        const resolved = await resolveAccountSigner(this.#accountSignerConfig);\n        if (resolved) {\n            this.#assertAccountSignerEnvironment(resolved);\n        }\n        return resolved;\n    }\n\n    #notifyStateChange(): void {\n        this.events.emit(\"stateChange\", this.getState());\n    }\n\n    #beginAuthOperation(): number {\n        this.#authOperationGeneration += 1;\n        return this.#authOperationGeneration;\n    }\n\n    #isCurrentAuthOperation(generation: number, token?: string | null): boolean {\n        return (\n            generation === this.#authOperationGeneration &&\n            (token === undefined || this.#tokenStorage.get() === token)\n        );\n    }\n\n    #loginResult(response: LoginWithWalletResponse): LoginResult {\n        const expiresAt = response.expiresAt\n            ? new Date(\n                  Number(response.expiresAt.seconds) * 1000 +\n                      (response.expiresAt.nanos ?? 0) / 1_000_000,\n              )\n            : new Date();\n        return { accountId: response.accountId, username: response.username, expiresAt };\n    }\n\n    #getEnvironmentBoundToken(): string | null {\n        return this.#sessionStore.getEnvironmentBoundToken(this.#tokenStorage);\n    }\n\n    #getCurrentTokenStorageOptions(): AuthTokenStorageSetOptions {\n        const token = this.#tokenStorage.get();\n        if (!token) return { expiresAt: null, maxAgeSeconds: null };\n        return createAuthTokenStorageSetOptions(token);\n    }\n\n    #resolveRefreshProvider(provider?: SessionData[\"provider\"]): SessionData[\"provider\"] {\n        return (\n            provider ?? this.#walletProvider ?? this.#getEnvironmentSession()?.provider ?? \"other\"\n        );\n    }\n\n    #assertAccountSignerEnvironment(accountSigner: AccountSigner): void {\n        assertAccountSigner(accountSigner);\n        if (accountSigner.environmentFingerprint !== this.#environmentFingerprint) {\n            throw new ConfigurationError(\n                \"Account signer environment does not match client environment.\",\n            );\n        }\n    }\n\n    #identityFromSigner(accountSigner: AccountSigner): AccountIdentity {\n        return {\n            accountAddress: accountSigner.accountAddress,\n            ownerAddress: accountSigner.ownerAddress,\n        };\n    }\n\n    #getEnvironmentSession(): SessionData | null {\n        return this.#sessionStore.get();\n    }\n}\n\nfunction resolveChallengeUri(uri: string | undefined): string {\n    const resolved = uri ?? (typeof location === \"undefined\" ? undefined : location.origin);\n    if (!resolved)\n        throw new ConfigurationError(\n            \"Wallet authentication requires a browser origin URI. Pass uri outside a browser.\",\n        );\n    return resolved;\n}\n"],"mappings":";;;;;;;;;;;;AAgFA,IAAa,2BAAb,cAA8C,YAAY;CACtD,SAAkB,IAAI,aAAsC;CAE5D;CACA,iBAAuC;CACvC,mBAA2C;CAC3C,mBAAmB;CACnB,iBAAgC;CAChC,mBAAkC;CAClC;CACA,kBAAuD,KAAA;CACvD,eAAuC;CACvC,gBAAoC,KAAA;CACpC;CACA;CACA;CACA;CAGA,2BAA2B;CAE3B,YAAY,EACR,YACA,qBACA,aACA,aACA,UACA,cACA,gBASD;EACC,MAAM,YAAY,QAAQ;EAE1B,KAAKA,uBAAuB;EAC5B,KAAKC,0BAA0B,YAAY;EAC3C,KAAKC,eAAe;EACpB,KAAKC,gBAAgB;EACrB,KAAKC,YAAY;EACjB,KAAKC,gBACD,gBACA,IAAI,iBAAiB,EACjB,wBAAwB,YAAY,YACxC,CAAC;CACT;;;;CAKA,sBAAsB,aAAuC;EACzD,KAAKH,eAAe;CACxB;;;;CAKA,iBAAiB,eAA2C;EACxD,IAAI,eAAe,KAAKI,gCAAgC,aAAa;EACrE,KAAKC,oBAAoB;EACzB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB,gBAAgB,KAAKC,oBAAoB,aAAa,IAAI;EAClF,KAAKC,mBAAmB;CAC5B;;;;CAKA,mBAAyC;EACrC,OAAO,KAAKH;CAChB;;;;CAKA,MAAM,MAAM,SAA6C;EACrD,OAAO,KAAKI,OAAO,OAAO;CAC9B;CAEA,MAAMA,OACF,SACA,uBACoB;EACpB,MAAM,aAAa,KAAKL,oBAAoB;EAC5C,MAAM,gBAAgB,KAAKJ,cAAc,IAAI;EAC7C,MAAM,EAAE,UAAU,gBAAgB;EAElC,MAAM,gBAAgB,MAAM,KAAKU,sBAAsB;EAEvD,IAAI,CAAC,eACD,MAAM,IAAI,mBACN,wFACJ;EAGJ,MAAM,sBAAsB,cAAc;EAC1C,MAAM,eAAe,cAAc,gBAAgB,cAAc;EAEjE,MAAM,MAAM,oBAAoB,QAAQ,OAAO,KAAKC,aAAa;EACjE,MAAM,EAAE,YAAY,MAAM,KAAK,sBAAsB;GACjD;GACA,eAAe;GACf;EACJ,CAAC;EACD,MAAM,YAAY,MAAM,cAAc,YAAY,OAAO;EAEzD,MAAM,WAAW,MAAM,KAAK,gBAAgB;GACxC;GACA;GACA;GACA,gBAAgB;EACpB,CAAC;EAED,IAAI,CAAC,KAAKC,wBAAwB,YAAY,aAAa,GACvD,MAAM,IAAI,aAAa,uCAAuC,YAAY;EAE9E,MAAM,qBAAqB,KAAKC,uBAAuB;EACvD,MAAM,sBACF,eACA,KAAKC,gBACL,oBAAoB,gBACnB,aAAa,cAAc,aAAa,YAAY,WAAW;EAEpE,MAAM,eAAe,iCAAiC,SAAS,WAAW;EAC1E,MAAM,gBACF,uBAAuB,kBAAkB,SAAS,YAC5C,wBACA,KAAA;EACV,KAAKZ,cAAc,YACf;GACI,aAAa,SAAS;GACtB;GACA;GACA,aAAa;GACb,eAAe;GACf,cAAc;GACd,WAAW,SAAS;GACpB;GACA,UAAU,SAAS,YAAY,KAAA;EACnC,GACA,KAAKF,aACT;EACA,KAAKe,mBAAmB;EACxB,KAAKC,iBAAiB,SAAS;EAC/B,KAAKC,mBAAmB,eAAe,aAAa,SAAS;EAC7D,KAAKC,kBAAkB;EACvB,KAAKJ,eAAe;EACpB,KAAKH,gBAAgB;EACrB,KAAKN,iBAAiB;EACtB,KAAKC,mBAAmB,KAAKC,oBAAoB,aAAa;EAE9D,KAAKC,mBAAmB;EAExB,KAAK,OAAO,KAAK,iBAAiB;GAC9B,WAAW,SAAS;GACpB,UAAU,SAAS;EACvB,CAAC;EAED,OAAO,KAAKW,aAAa,QAAQ;CACrC;;;;CAKA,iBAAiB,OAAgC;EAC7C,KAAKf,oBAAoB;EACzB,MAAM,gBAAgB,KAAKgB,0BAA0B;EACrD,IAAI,CAAC,iBAAiB,CAAC,WAAW,aAAa,GAAG;EAElD,MAAM,kBAAkB,KAAKP,uBAAuB;EACpD,KAAKK,kBAAkB,iBAAiB,YAAY,KAAKA;EACzD,KAAKJ,eAAe,iBAAiB,eAAe,KAAKA;EAEzD,KAAKC,mBAAmB;EACxB,KAAKC,iBAAiB,MAAM;EAC5B,KAAKC,mBAAmB,MAAM,mBAAmB,MAAM;EACvD,KAAKX,mBAAmB,MAAM,sBACxB;GACI,gBAAgB,MAAM;GACtB,cAAc,MAAM;EACxB,IACA;EAEN,KAAKE,mBAAmB;CAC5B;;;;CAKA,MAAM,iBAA0E;EAC5E,MAAM,aAAa,KAAKJ,oBAAoB;EAC5C,MAAM,gBAAgB,KAAKgB,0BAA0B;EAErD,IAAI,CAAC,iBAAiB,CAAC,WAAW,aAAa,GAAG;GAC9C,IAAI,KAAKR,wBAAwB,UAAU,GAAG,KAAKS,0BAA0B;GAC7E,OAAO;EACX;EAEA,IAAI;EACJ,IAAI;GACA,KAAK,MAAM,KAAK,GAAG;EACvB,SAAS,OAAO;GACZ,IAAI,CAAC,KAAKT,wBAAwB,YAAY,aAAa,GAAG,OAAO;GACrE,MAAM,cAAc,iBAAiB,KAAK;GAC1C,IAAI,uBAAuB,qBAAqB;IAC5C,KAAKS,0BAA0B;IAC/B,OAAO;GACX;GACA,MAAM;EACV;EACA,IAAI,CAAC,KAAKT,wBAAwB,YAAY,aAAa,GAAG,OAAO;EAErE,IAAI,gBAAgB,KAAKP;EACzB,IAAI,CAAC,eAAe;GAChB,IAAI;IACA,gBAAgB,MAAM,qBAAqB,KAAKR,oBAAoB;GACxE,SAAS,OAAO;IACZ,IAAI,CAAC,KAAKe,wBAAwB,YAAY,aAAa,GAAG,OAAO;IACrE,MAAM;GACV;GACA,IAAI,CAAC,KAAKA,wBAAwB,YAAY,aAAa,GAAG,OAAO;GACrE,IAAI,eAAe,KAAKT,gCAAgC,aAAa;EACzE;EAEA,IAAI,CAAC,WAAW,aAAa,KAAK,KAAKiB,0BAA0B,MAAM,eAAe;GAClF,KAAKC,0BAA0B;GAC/B,OAAO;EACX;EAEA,MAAM,kBAAkB,KAAKR,uBAAuB;EACpD,MAAM,iBAAiB,iBAAiB,YAAY,KAAKK;EACzD,MAAM,cAAc,iBAAiB,eAAe,KAAKJ;EACzD,MAAM,kBACF,KAAKG,oBAAoB,iBAAiB,eAAe,aAAa,GAAG;EAG7E,IAAI,eAAe;GACf,KAAKf,cAAc,cACf;IACI,UAAU,kBAAkB;IAC5B,aAAa,gBAAgB,mBAAmB,aAAa,aAAa;IAC1E,eAAe,cAAc,gBAAgB,cAAc;IAC3D,cAAc,cAAc;IAC5B,WAAW,GAAG;IACd,UAAU,GAAG,YAAY,KAAA;GAC7B,GACA,EAAE,eAAe,KAAKoB,+BAA+B,CAAC,CAAC,cAAc,CACzE;GACA,KAAKjB,iBAAiB;GACtB,KAAKC,mBAAmB,KAAKC,oBAAoB,aAAa;EAClE;EACA,KAAKQ,mBAAmB;EACxB,KAAKC,iBAAiB,GAAG;EACzB,KAAKC,mBAAmB;EACxB,KAAKC,kBAAkB,mBAAmB,gBAAgB,UAAU,KAAA;EACpE,KAAKJ,eAAe;EACpB,KAAKN,mBAAmB;EACxB,OAAO;GAAE,WAAW,GAAG;GAAW,UAAU,GAAG;EAAS;CAC5D;;;;CAKA,MAAM,SAAwB;EAC1B,KAAKJ,oBAAoB;EACzB,KAAKH,UAAU,kBAAkB;EACjC,KAAKD,cAAc,MAAM;EACzB,KAAKe,mBAAmB;EACxB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB;EACxB,KAAKH,eAAe;EACpB,KAAKH,gBAAgB,KAAA;EACrB,KAAKL,mBAAmB;EAExB,KAAKJ,cAAc,MAAM;EAEzB,KAAKM,mBAAmB;EACxB,KAAK,OAAO,KAAK,aAAa,KAAA,CAAS;CAC3C;CAEA,4BAAkC;EAC9B,MAAM,sBAAsB,KAAKO;EACjC,KAAKd,UAAU,kBAAkB;EACjC,KAAKD,cAAc,MAAM;EACzB,KAAKE,cAAc,MAAM;EACzB,KAAKa,mBAAmB;EACxB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB;EACxB,KAAKH,eAAe;EACpB,KAAKH,gBAAgB,KAAA;EACrB,KAAKL,mBAAmB;EACxB,KAAKE,mBAAmB;EACxB,IAAI,qBACA,KAAK,OAAO,KAAK,aAAa,KAAA,CAAS;CAE/C;;;;CAKA,yBAAiC;EAC7B,MAAM,QAAQ,KAAKY,0BAA0B;EAC7C,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,GAAG,OAAO;EACzC,OAAO,mBAAmB,KAAK;CACnC;;;;CAKA,MAAM,eAAe,QAKI;EACrB,IAAI,CAAC,KAAKL,kBACN,MAAM,IAAI,oBAAoB,0CAA0C;EAG5E,MAAM,iBAAiB,KAAKF,uBAAuB;EACnD,OAAO,KAAKJ,OACR;GACI,UAAU,KAAKc,wBAAwB,QAAQ,QAAQ;GACvD,KAAK,QAAQ;GACb,aAAa,QAAQ,eAAe,KAAKT;EAC7C,GACA,gBAAgB,aACpB;CACJ;;;;CAKA,cACI,WACA,SACsC;EACtC,IAAI,CAAC,KAAKC,oBAAoB,CAAC,KAAKC,gBAChC,MAAM,IAAI,oBAAoB,0CAA0C;EAG5E,KAAKC,mBAAmB;EACxB,MAAM,SAAS,cAAc,KAAKD;EAElC,KAAKd,cAAc,iBACf;GACI;GACA;GACA,qBAAqB,SAAS;GAC9B,OAAO,SAAS;EACpB,GACA,EAAE,eAAe,KAAKoB,+BAA+B,CAAC,CAAC,cAAc,CACzE;EACA,KAAKd,mBAAmB;EAExB,OAAO;GAAE;GAAW;EAAO;CAC/B;;CAGA,oBAAoB,UAA+B;EAC/C,KAAKN,cAAc,YAAY,UAAU,EACrC,eAAe,KAAKoB,+BAA+B,CAAC,CAAC,cACzD,CAAC;CACL;;;;CAKA,MAAM,iBAAiB,QAAiE;EACpF,IAAI,CAAC,KAAKP,kBACN,MAAM,IAAI,oBAAoB,6CAA6C;EAG/E,IAAI,CAAC,KAAKhB,cACN,MAAM,IAAI,mBACN,4FACJ;EAGJ,MAAM,WAAW,KAAKM,kBAAkB,KAAKC;EAC7C,MAAM,eACF,OAAO,gBAAgB,UAAU,gBAAgB,UAAU;EAC/D,IAAI,CAAC,cACD,MAAM,IAAI,mBACN,oFACJ;EAGJ,MAAM,EAAE,QAAQ,OAAO;EACvB,MAAM,YAAY,MAAM,KAAKP,aAAa,gBAAgB;GACtD;GACA,KAAK,oBAAoB,OAAO,OAAO,KAAKY,aAAa;EAC7D,CAAC;EACD,MAAM,gBACF,OAAO,OAAO,kBAAkB,aAC1B,MAAM,OAAO,cAAc,SAAS,IACpC,OAAO;EACjB,KAAKR,gCAAgC,aAAa;EAClD,IACI,cAAc,eAAe,YAAY,MACzC,UAAU,oBAAoB,YAAY,GAE1C,MAAM,IAAI,mBACN,6BAA6B,cAAc,eAAe,mDAAmD,UAAU,oBAAoB,EAC/I;EAEJ,MAAM,YAAY,MAAM,cAAc,YAAY,UAAU,OAAO;EAEnE,MAAM,WAAW,MAAM,KAAKJ,aAAa,OAAO;GAC5C;GACA,qBAAqB,UAAU;GAC/B,SAAS,UAAU;GACnB;EACJ,CAAC;EAED,OAAO;GACH,cAAc,SAAS;GACvB,uBAAuB,SAAS;GAChC,UAAU,SAAS;EACvB;CACJ;;;;CAKA,WAAsB;EAClB,MAAM,kBAAkB,KAAKM,kBAAkB,KAAKC;EAEpD,OAAO;GACH,iBAAiB,KAAKS;GACtB,gBAAgB,iBAAiB,kBAAkB;GACnD,cAAc,iBAAiB,gBAAgB;GAC/C,eAAe,KAAKC;GACpB,eACI,KAAKC,oBAAoB,KAAKD,iBACxB;IACI,WAAW,KAAKC;IAChB,QAAQ,KAAKA,qBAAqB,KAAKD;IACvC,eAAe,KAAKA;IACpB,qBAAqB,iBAAiB;GAC1C,IACA;EACd;CACJ;CAEA,MAAMN,wBAAuD;EACzD,IAAI,KAAKL,gBAAgB;GACrB,KAAKF,gCAAgC,KAAKE,cAAc;GACxD,OAAO,KAAKA;EAChB;EAEA,MAAM,WAAW,MAAM,qBAAqB,KAAKR,oBAAoB;EACrE,IAAI,UACA,KAAKM,gCAAgC,QAAQ;EAEjD,OAAO;CACX;CAEA,qBAA2B;EACvB,KAAK,OAAO,KAAK,eAAe,KAAK,SAAS,CAAC;CACnD;CAEA,sBAA8B;EAC1B,KAAKqB,4BAA4B;EACjC,OAAO,KAAKA;CAChB;CAEA,wBAAwB,YAAoB,OAAgC;EACxE,OACI,eAAe,KAAKA,6BACnB,UAAU,KAAA,KAAa,KAAKxB,cAAc,IAAI,MAAM;CAE7D;CAEA,aAAa,UAAgD;EACzD,MAAM,YAAY,SAAS,4BACrB,IAAI,KACA,OAAO,SAAS,UAAU,OAAO,IAAI,OAChC,SAAS,UAAU,SAAS,KAAK,GAC1C,oBACA,IAAI,KAAK;EACf,OAAO;GAAE,WAAW,SAAS;GAAW,UAAU,SAAS;GAAU;EAAU;CACnF;CAEA,4BAA2C;EACvC,OAAO,KAAKE,cAAc,yBAAyB,KAAKF,aAAa;CACzE;CAEA,iCAA6D;EACzD,MAAM,QAAQ,KAAKA,cAAc,IAAI;EACrC,IAAI,CAAC,OAAO,OAAO;GAAE,WAAW;GAAM,eAAe;EAAK;EAC1D,OAAO,iCAAiC,KAAK;CACjD;CAEA,wBAAwB,UAA6D;EACjF,OACI,YAAY,KAAKkB,mBAAmB,KAAKL,uBAAuB,CAAC,EAAE,YAAY;CAEvF;CAEA,gCAAgC,eAAoC;EAChE,oBAAoB,aAAa;EACjC,IAAI,cAAc,2BAA2B,KAAKf,yBAC9C,MAAM,IAAI,mBACN,+DACJ;CAER;CAEA,oBAAoB,eAA+C;EAC/D,OAAO;GACH,gBAAgB,cAAc;GAC9B,cAAc,cAAc;EAChC;CACJ;CAEA,yBAA6C;EACzC,OAAO,KAAKI,cAAc,IAAI;CAClC;AACJ;AAEA,SAAS,oBAAoB,KAAiC;CAC1D,MAAM,WAAW,QAAQ,OAAO,aAAa,cAAc,KAAA,IAAY,SAAS;CAChF,IAAI,CAAC,UACD,MAAM,IAAI,mBACN,kFACJ;CACJ,OAAO;AACX"}

package/dist/services/auth/auth.d.ts

@@ -90,6 +90,9 @@ declare class AuthService {
   /**
    * Requests a server-issued SIWE login message. Sign its exact UTF-8 bytes with
    * personal_sign; do not hash or reconstruct it. Expiry is epoch milliseconds.
+   * The backend sets SIWE Chain ID to Ethereum mainnet (1) and binds the
+   * Polyester chain in Resources. Do not send a chain ID or rewrite either binding.
+   * Wallet adapters must select Ethereum mainnet before signing if required by the wallet.
    * Subaccount creation uses `subaccounts.createChallenge` instead.
    */
   createWalletChallenge(input: CreateWalletChallengeInput, options?: PolyesterRequestOptions): Promise<WalletChallenge>;

package/dist/services/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","names":[],"sources":["../../../src/services/auth/auth.ts"],"mappings":";;;;;;;cAyBa,kCAAgC,EAAA;;;;;KAKjC,6BAA6B,EAAE,kBAAkB;cAWhD,4BAA0B,EAAA;;;;;;;;KAS3B,uBAAuB,EAAE,kBAAkB;cAEjD,UAAQ,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;KAOF,KAAK,EAAE,mBAAmB;cAEhC,+BAA6B,EAAA;;;;;;;;;KAOvB,0BAA0B,EAAE,mBAAmB;cAErD,uBAAqB,EAAA;;;;;;;;;;KAKf,kBAAkB,EAAE,mBAAmB;;;;cAKtC;;EAGT,SAAS;EAEG,YAAA,YAAY,4BAA4B,UAAU;;;;EASxD,GAAG,UAAU,0BAA0B,QAAQ;;;;;;;EAW/C,YAAY,UAAU,2BAA2B;;;;;;EASjD,sBACF,OAAO,4BACP,UAAU,0BACX,QAAQ;;;;YAcK,gBACZ,OAAO,sBACP,UAAU,2BACX,QAAQ"}
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../../src/services/auth/auth.ts"],"mappings":";;;;;;;cAyBa,kCAAgC,EAAA;;;;;KAKjC,6BAA6B,EAAE,kBAAkB;cAWhD,4BAA0B,EAAA;;;;;;;;KAS3B,uBAAuB,EAAE,kBAAkB;cAEjD,UAAQ,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;KAOF,KAAK,EAAE,mBAAmB;cAEhC,+BAA6B,EAAA;;;;;;;;;KAOvB,0BAA0B,EAAE,mBAAmB;cAErD,uBAAqB,EAAA;;;;;;;;;;KAKf,kBAAkB,EAAE,mBAAmB;;;;cAKtC;;EAGT,SAAS;EAEG,YAAA,YAAY,4BAA4B,UAAU;;;;EASxD,GAAG,UAAU,0BAA0B,QAAQ;;;;;;;EAW/C,YAAY,UAAU,2BAA2B;;;;;;;;;EAYjD,sBACF,OAAO,4BACP,UAAU,0BACX,QAAQ;;;;YAcK,gBACZ,OAAO,sBACP,UAAU,2BACX,QAAQ"}

package/dist/services/auth/auth.js

@@ -70,6 +70,9 @@ var AuthService = class {
 	/**
 	* Requests a server-issued SIWE login message. Sign its exact UTF-8 bytes with
 	* personal_sign; do not hash or reconstruct it. Expiry is epoch milliseconds.
+	* The backend sets SIWE Chain ID to Ethereum mainnet (1) and binds the
+	* Polyester chain in Resources. Do not send a chain ID or rewrite either binding.
+	* Wallet adapters must select Ethereum mainnet before signing if required by the wallet.
 	* Subaccount creation uses `subaccounts.createChallenge` instead.
 	*/
 	async createWalletChallenge(input, options) {

package/dist/services/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["#publicClient","Proto.AuthService","#authClient"],"sources":["../../../src/services/auth/auth.ts"],"sourcesContent":["import { createClient, type Client } from \"@connectrpc/connect\";\nimport * as Proto from \"../../gen/auth/v1/auth_pb.js\";\nimport * as v from \"valibot\";\nimport { parse } from \"../../shared/validation.js\";\nimport { ProfileService } from \"./profile/profile.js\";\nimport {\n    OptionalTimestampMsSchema,\n    PublicIdSchema,\n    TimestampSchema,\n} from \"../../shared/schemas.js\";\nimport {\n    toConnectCallOptions,\n    type PolyesterMutationOptions,\n    type PolyesterRequestOptions,\n} from \"../../shared/request-options.js\";\nimport { MfaSessionInfoSchema } from \"../mfa/mfa.schemas.js\";\nimport type { PolyesterRealtime } from \"../../realtime/index.js\";\nimport type { AuthAndPublicApiTransports } from \"../../shared/transports.js\";\n\nimport {\n    WalletAddressSchema,\n    WalletChallengeUriSchema,\n    WalletChallengeMessageSchema,\n} from \"./wallet-challenge.schemas.js\";\n\nexport const CreateWalletChallengeInputSchema = v.strictObject({\n    smartAccountAddress: WalletAddressSchema,\n    signerAddress: WalletAddressSchema,\n    uri: WalletChallengeUriSchema,\n});\nexport type CreateWalletChallengeInput = v.InferInput<typeof CreateWalletChallengeInputSchema>;\n\n/** An EIP-191 EOA signature: 65 hexadecimal bytes, with an optional 0x prefix. */\nconst LoginEoaSignatureSchema = v.pipe(\n    v.string(),\n    v.regex(\n        /^(?:0x)?[0-9a-fA-F]{130}$/,\n        \"Login signature must be a 65-byte hexadecimal EOA signature.\",\n    ),\n);\n\nexport const LoginWithWalletInputSchema = v.strictObject({\n    smartAccountAddress: WalletAddressSchema,\n    message: WalletChallengeMessageSchema,\n    signature: LoginEoaSignatureSchema,\n    userAgent: v.optional(v.string(), \"\"),\n    ip: v.optional(v.string(), \"\"),\n    walletProvider: v.optional(v.string(), \"\"),\n});\n\nexport type LoginWithWalletInput = v.InferInput<typeof LoginWithWalletInputSchema>;\n\nconst MeSchema = v.object({\n    accountId: PublicIdSchema,\n    apiKeyId: v.optional(v.string()),\n    username: v.string(),\n    session: v.optional(MfaSessionInfoSchema),\n});\n\nexport type Me = v.InferOutput<typeof MeSchema>;\n\nconst LoginWithWalletResponseSchema = v.object({\n    accessToken: v.string(),\n    expiresAt: v.optional(TimestampSchema),\n    accountId: PublicIdSchema,\n    username: v.string(),\n});\n\nexport type LoginWithWalletResponse = v.InferOutput<typeof LoginWithWalletResponseSchema>;\n\nconst WalletChallengeSchema = v.object({\n    message: WalletChallengeMessageSchema,\n    expiresAt: OptionalTimestampMsSchema,\n});\n\nexport type WalletChallenge = v.InferOutput<typeof WalletChallengeSchema>;\n\n/**\n * Handles wallet-based authentication, caller introspection, and authenticated profile operations.\n */\nexport class AuthService {\n    #publicClient: Client<typeof Proto.AuthService>;\n    #authClient: Client<typeof Proto.AuthService>;\n    profile: ProfileService;\n\n    constructor(transports: AuthAndPublicApiTransports, realtime: PolyesterRealtime) {\n        this.#publicClient = createClient(Proto.AuthService, transports.publicApi);\n        this.#authClient = createClient(Proto.AuthService, transports.authApi);\n        this.profile = new ProfileService(transports, realtime);\n    }\n\n    /**\n     * Returns the authenticated caller's account context, including account ID, optional API key ID, username, and session assurance details from the presented token or API key.\n     */\n    async me(options?: PolyesterRequestOptions): Promise<Me> {\n        const res = await this.#authClient.me({}, toConnectCallOptions(options));\n        return parse(MeSchema, res);\n    }\n\n    /**\n     * Records explicit consent to the current terms for the caller's root account.\n     * Call only after the user consents. Requires an interactive JWT session;\n     * API keys are not allowed. Repeated acceptance succeeds without changing\n     * the first acceptance time. No MFA is required.\n     */\n    async acceptTerms(options?: PolyesterMutationOptions): Promise<void> {\n        await this.#authClient.acceptTerms({}, toConnectCallOptions(options));\n    }\n\n    /**\n     * Requests a server-issued SIWE login message. Sign its exact UTF-8 bytes with\n     * personal_sign; do not hash or reconstruct it. Expiry is epoch milliseconds.\n     * Subaccount creation uses `subaccounts.createChallenge` instead.\n     */\n    async createWalletChallenge(\n        input: CreateWalletChallengeInput,\n        options?: PolyesterRequestOptions,\n    ): Promise<WalletChallenge> {\n        const validated = parse(CreateWalletChallengeInputSchema, input);\n        return parse(\n            WalletChallengeSchema,\n            await this.#publicClient.createWalletChallenge(\n                { ...validated, purpose: Proto.WalletChallengePurpose.LOGIN },\n                toConnectCallOptions(options),\n            ),\n        );\n    }\n\n    /**\n     * Exchanges a signed SIWE message for an authenticated session token and account identity returned by the auth API.\n     */\n    protected async loginWithWallet(\n        input: LoginWithWalletInput,\n        options?: PolyesterMutationOptions,\n    ): Promise<LoginWithWalletResponse> {\n        const validatedInput = parse(LoginWithWalletInputSchema, input);\n        const res = await this.#publicClient.loginWithWallet(\n            validatedInput,\n            toConnectCallOptions(options),\n        );\n        return parse(LoginWithWalletResponseSchema, res);\n    }\n}\n"],"mappings":";;;;;;;;;;AAyBA,MAAa,mCAAmC,EAAE,aAAa;CAC3D,qBAAqB;CACrB,eAAe;CACf,KAAK;AACT,CAAC;;AAID,MAAM,0BAA0B,EAAE,KAC9B,EAAE,OAAO,GACT,EAAE,MACE,6BACA,8DACJ,CACJ;AAEA,MAAa,6BAA6B,EAAE,aAAa;CACrD,qBAAqB;CACrB,SAAS;CACT,WAAW;CACX,WAAW,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;CACpC,IAAI,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;CAC7B,gBAAgB,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;AAC7C,CAAC;AAID,MAAM,WAAW,EAAE,OAAO;CACtB,WAAW;CACX,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,UAAU,EAAE,OAAO;CACnB,SAAS,EAAE,SAAS,oBAAoB;AAC5C,CAAC;AAID,MAAM,gCAAgC,EAAE,OAAO;CAC3C,aAAa,EAAE,OAAO;CACtB,WAAW,EAAE,SAAS,eAAe;CACrC,WAAW;CACX,UAAU,EAAE,OAAO;AACvB,CAAC;AAID,MAAM,wBAAwB,EAAE,OAAO;CACnC,SAAS;CACT,WAAW;AACf,CAAC;;;;AAOD,IAAa,cAAb,MAAyB;CACrB;CACA;CACA;CAEA,YAAY,YAAwC,UAA6B;EAC7E,KAAKA,gBAAgB,aAAaC,eAAmB,WAAW,SAAS;EACzE,KAAKC,cAAc,aAAaD,eAAmB,WAAW,OAAO;EACrE,KAAK,UAAU,IAAI,eAAe,YAAY,QAAQ;CAC1D;;;;CAKA,MAAM,GAAG,SAAgD;EACrD,MAAM,MAAM,MAAM,KAAKC,YAAY,GAAG,CAAC,GAAG,qBAAqB,OAAO,CAAC;EACvE,OAAO,MAAM,UAAU,GAAG;CAC9B;;;;;;;CAQA,MAAM,YAAY,SAAmD;EACjE,MAAM,KAAKA,YAAY,YAAY,CAAC,GAAG,qBAAqB,OAAO,CAAC;CACxE;;;;;;CAOA,MAAM,sBACF,OACA,SACwB;EACxB,MAAM,YAAY,MAAM,kCAAkC,KAAK;EAC/D,OAAO,MACH,uBACA,MAAM,KAAKF,cAAc,sBACrB;GAAE,GAAG;GAAW,SAAA;EAA4C,GAC5D,qBAAqB,OAAO,CAChC,CACJ;CACJ;;;;CAKA,MAAgB,gBACZ,OACA,SACgC;EAChC,MAAM,iBAAiB,MAAM,4BAA4B,KAAK;EAC9D,MAAM,MAAM,MAAM,KAAKA,cAAc,gBACjC,gBACA,qBAAqB,OAAO,CAChC;EACA,OAAO,MAAM,+BAA+B,GAAG;CACnD;AACJ"}
+{"version":3,"file":"auth.js","names":["#publicClient","Proto.AuthService","#authClient"],"sources":["../../../src/services/auth/auth.ts"],"sourcesContent":["import { createClient, type Client } from \"@connectrpc/connect\";\nimport * as Proto from \"../../gen/auth/v1/auth_pb.js\";\nimport * as v from \"valibot\";\nimport { parse } from \"../../shared/validation.js\";\nimport { ProfileService } from \"./profile/profile.js\";\nimport {\n    OptionalTimestampMsSchema,\n    PublicIdSchema,\n    TimestampSchema,\n} from \"../../shared/schemas.js\";\nimport {\n    toConnectCallOptions,\n    type PolyesterMutationOptions,\n    type PolyesterRequestOptions,\n} from \"../../shared/request-options.js\";\nimport { MfaSessionInfoSchema } from \"../mfa/mfa.schemas.js\";\nimport type { PolyesterRealtime } from \"../../realtime/index.js\";\nimport type { AuthAndPublicApiTransports } from \"../../shared/transports.js\";\n\nimport {\n    WalletAddressSchema,\n    WalletChallengeUriSchema,\n    WalletChallengeMessageSchema,\n} from \"./wallet-challenge.schemas.js\";\n\nexport const CreateWalletChallengeInputSchema = v.strictObject({\n    smartAccountAddress: WalletAddressSchema,\n    signerAddress: WalletAddressSchema,\n    uri: WalletChallengeUriSchema,\n});\nexport type CreateWalletChallengeInput = v.InferInput<typeof CreateWalletChallengeInputSchema>;\n\n/** An EIP-191 EOA signature: 65 hexadecimal bytes, with an optional 0x prefix. */\nconst LoginEoaSignatureSchema = v.pipe(\n    v.string(),\n    v.regex(\n        /^(?:0x)?[0-9a-fA-F]{130}$/,\n        \"Login signature must be a 65-byte hexadecimal EOA signature.\",\n    ),\n);\n\nexport const LoginWithWalletInputSchema = v.strictObject({\n    smartAccountAddress: WalletAddressSchema,\n    message: WalletChallengeMessageSchema,\n    signature: LoginEoaSignatureSchema,\n    userAgent: v.optional(v.string(), \"\"),\n    ip: v.optional(v.string(), \"\"),\n    walletProvider: v.optional(v.string(), \"\"),\n});\n\nexport type LoginWithWalletInput = v.InferInput<typeof LoginWithWalletInputSchema>;\n\nconst MeSchema = v.object({\n    accountId: PublicIdSchema,\n    apiKeyId: v.optional(v.string()),\n    username: v.string(),\n    session: v.optional(MfaSessionInfoSchema),\n});\n\nexport type Me = v.InferOutput<typeof MeSchema>;\n\nconst LoginWithWalletResponseSchema = v.object({\n    accessToken: v.string(),\n    expiresAt: v.optional(TimestampSchema),\n    accountId: PublicIdSchema,\n    username: v.string(),\n});\n\nexport type LoginWithWalletResponse = v.InferOutput<typeof LoginWithWalletResponseSchema>;\n\nconst WalletChallengeSchema = v.object({\n    message: WalletChallengeMessageSchema,\n    expiresAt: OptionalTimestampMsSchema,\n});\n\nexport type WalletChallenge = v.InferOutput<typeof WalletChallengeSchema>;\n\n/**\n * Handles wallet-based authentication, caller introspection, and authenticated profile operations.\n */\nexport class AuthService {\n    #publicClient: Client<typeof Proto.AuthService>;\n    #authClient: Client<typeof Proto.AuthService>;\n    profile: ProfileService;\n\n    constructor(transports: AuthAndPublicApiTransports, realtime: PolyesterRealtime) {\n        this.#publicClient = createClient(Proto.AuthService, transports.publicApi);\n        this.#authClient = createClient(Proto.AuthService, transports.authApi);\n        this.profile = new ProfileService(transports, realtime);\n    }\n\n    /**\n     * Returns the authenticated caller's account context, including account ID, optional API key ID, username, and session assurance details from the presented token or API key.\n     */\n    async me(options?: PolyesterRequestOptions): Promise<Me> {\n        const res = await this.#authClient.me({}, toConnectCallOptions(options));\n        return parse(MeSchema, res);\n    }\n\n    /**\n     * Records explicit consent to the current terms for the caller's root account.\n     * Call only after the user consents. Requires an interactive JWT session;\n     * API keys are not allowed. Repeated acceptance succeeds without changing\n     * the first acceptance time. No MFA is required.\n     */\n    async acceptTerms(options?: PolyesterMutationOptions): Promise<void> {\n        await this.#authClient.acceptTerms({}, toConnectCallOptions(options));\n    }\n\n    /**\n     * Requests a server-issued SIWE login message. Sign its exact UTF-8 bytes with\n     * personal_sign; do not hash or reconstruct it. Expiry is epoch milliseconds.\n     * The backend sets SIWE Chain ID to Ethereum mainnet (1) and binds the\n     * Polyester chain in Resources. Do not send a chain ID or rewrite either binding.\n     * Wallet adapters must select Ethereum mainnet before signing if required by the wallet.\n     * Subaccount creation uses `subaccounts.createChallenge` instead.\n     */\n    async createWalletChallenge(\n        input: CreateWalletChallengeInput,\n        options?: PolyesterRequestOptions,\n    ): Promise<WalletChallenge> {\n        const validated = parse(CreateWalletChallengeInputSchema, input);\n        return parse(\n            WalletChallengeSchema,\n            await this.#publicClient.createWalletChallenge(\n                { ...validated, purpose: Proto.WalletChallengePurpose.LOGIN },\n                toConnectCallOptions(options),\n            ),\n        );\n    }\n\n    /**\n     * Exchanges a signed SIWE message for an authenticated session token and account identity returned by the auth API.\n     */\n    protected async loginWithWallet(\n        input: LoginWithWalletInput,\n        options?: PolyesterMutationOptions,\n    ): Promise<LoginWithWalletResponse> {\n        const validatedInput = parse(LoginWithWalletInputSchema, input);\n        const res = await this.#publicClient.loginWithWallet(\n            validatedInput,\n            toConnectCallOptions(options),\n        );\n        return parse(LoginWithWalletResponseSchema, res);\n    }\n}\n"],"mappings":";;;;;;;;;;AAyBA,MAAa,mCAAmC,EAAE,aAAa;CAC3D,qBAAqB;CACrB,eAAe;CACf,KAAK;AACT,CAAC;;AAID,MAAM,0BAA0B,EAAE,KAC9B,EAAE,OAAO,GACT,EAAE,MACE,6BACA,8DACJ,CACJ;AAEA,MAAa,6BAA6B,EAAE,aAAa;CACrD,qBAAqB;CACrB,SAAS;CACT,WAAW;CACX,WAAW,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;CACpC,IAAI,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;CAC7B,gBAAgB,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;AAC7C,CAAC;AAID,MAAM,WAAW,EAAE,OAAO;CACtB,WAAW;CACX,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/B,UAAU,EAAE,OAAO;CACnB,SAAS,EAAE,SAAS,oBAAoB;AAC5C,CAAC;AAID,MAAM,gCAAgC,EAAE,OAAO;CAC3C,aAAa,EAAE,OAAO;CACtB,WAAW,EAAE,SAAS,eAAe;CACrC,WAAW;CACX,UAAU,EAAE,OAAO;AACvB,CAAC;AAID,MAAM,wBAAwB,EAAE,OAAO;CACnC,SAAS;CACT,WAAW;AACf,CAAC;;;;AAOD,IAAa,cAAb,MAAyB;CACrB;CACA;CACA;CAEA,YAAY,YAAwC,UAA6B;EAC7E,KAAKA,gBAAgB,aAAaC,eAAmB,WAAW,SAAS;EACzE,KAAKC,cAAc,aAAaD,eAAmB,WAAW,OAAO;EACrE,KAAK,UAAU,IAAI,eAAe,YAAY,QAAQ;CAC1D;;;;CAKA,MAAM,GAAG,SAAgD;EACrD,MAAM,MAAM,MAAM,KAAKC,YAAY,GAAG,CAAC,GAAG,qBAAqB,OAAO,CAAC;EACvE,OAAO,MAAM,UAAU,GAAG;CAC9B;;;;;;;CAQA,MAAM,YAAY,SAAmD;EACjE,MAAM,KAAKA,YAAY,YAAY,CAAC,GAAG,qBAAqB,OAAO,CAAC;CACxE;;;;;;;;;CAUA,MAAM,sBACF,OACA,SACwB;EACxB,MAAM,YAAY,MAAM,kCAAkC,KAAK;EAC/D,OAAO,MACH,uBACA,MAAM,KAAKF,cAAc,sBACrB;GAAE,GAAG;GAAW,SAAA;EAA4C,GAC5D,qBAAqB,OAAO,CAChC,CACJ;CACJ;;;;CAKA,MAAgB,gBACZ,OACA,SACgC;EAChC,MAAM,iBAAiB,MAAM,4BAA4B,KAAK;EAC9D,MAAM,MAAM,MAAM,KAAKA,cAAc,gBACjC,gBACA,qBAAqB,OAAO,CAChC;EACA,OAAO,MAAM,+BAA+B,GAAG;CACnD;AACJ"}

package/dist/services/auth/session.schemas.js

@@ -19,6 +19,7 @@ const SessionDataSchema = v.object({
 	environmentFingerprint: v.string(),
 	provider: v.picklist([
 		"metamask",
+		"phantom",
 		"turnkey",
 		"other"
 	]),

package/dist/services/auth/session.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.schemas.js","names":[],"sources":["../../../src/services/auth/session.schemas.ts"],"sourcesContent":["import * as v from \"valibot\";\nimport type { SessionData } from \"./session.types.js\";\n\nexport const AuthLoginMethodSchema = v.picklist([\n    \"google\",\n    \"email\",\n    \"metamask\",\n    \"rabby\",\n    \"phantom\",\n    \"walletconnect\",\n]);\n\nexport const ActiveAccountInfoSchema = v.object({\n    accountId: v.string(),\n    isMain: v.boolean(),\n    mainAccountId: v.string(),\n    smartAccountAddress: v.optional(v.string()),\n    label: v.optional(v.string()),\n});\n\nexport const SessionDataSchema = v.object({\n    environmentFingerprint: v.string(),\n    provider: v.picklist([\"metamask\", \"turnkey\", \"other\"]),\n    loginMethod: v.nullable(AuthLoginMethodSchema),\n    primaryWallet: v.string(),\n    smartAccount: v.string(),\n    activeAccount: v.optional(ActiveAccountInfoSchema),\n    username: v.optional(v.string()),\n});\n\n/**\n * Parses raw session data into the SDK session shape.\n */\nexport function parseSessionData(value: unknown): SessionData | null {\n    const parsed = v.safeParse(SessionDataSchema, value);\n    return parsed.success ? parsed.output : null;\n}\n"],"mappings":";;AAGA,MAAa,wBAAwB,EAAE,SAAS;CAC5C;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,MAAa,0BAA0B,EAAE,OAAO;CAC5C,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,QAAQ;CAClB,eAAe,EAAE,OAAO;CACxB,qBAAqB,EAAE,SAAS,EAAE,OAAO,CAAC;CAC1C,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AAChC,CAAC;AAED,MAAa,oBAAoB,EAAE,OAAO;CACtC,wBAAwB,EAAE,OAAO;CACjC,UAAU,EAAE,SAAS;EAAC;EAAY;EAAW;CAAO,CAAC;CACrD,aAAa,EAAE,SAAS,qBAAqB;CAC7C,eAAe,EAAE,OAAO;CACxB,cAAc,EAAE,OAAO;CACvB,eAAe,EAAE,SAAS,uBAAuB;CACjD,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;AACnC,CAAC;;;;AAKD,SAAgB,iBAAiB,OAAoC;CACjE,MAAM,SAAS,EAAE,UAAU,mBAAmB,KAAK;CACnD,OAAO,OAAO,UAAU,OAAO,SAAS;AAC5C"}
+{"version":3,"file":"session.schemas.js","names":[],"sources":["../../../src/services/auth/session.schemas.ts"],"sourcesContent":["import * as v from \"valibot\";\nimport type { SessionData } from \"./session.types.js\";\n\nexport const AuthLoginMethodSchema = v.picklist([\n    \"google\",\n    \"email\",\n    \"metamask\",\n    \"rabby\",\n    \"phantom\",\n    \"walletconnect\",\n]);\n\nexport const ActiveAccountInfoSchema = v.object({\n    accountId: v.string(),\n    isMain: v.boolean(),\n    mainAccountId: v.string(),\n    smartAccountAddress: v.optional(v.string()),\n    label: v.optional(v.string()),\n});\n\nexport const SessionDataSchema = v.object({\n    environmentFingerprint: v.string(),\n    provider: v.picklist([\"metamask\", \"phantom\", \"turnkey\", \"other\"]),\n    loginMethod: v.nullable(AuthLoginMethodSchema),\n    primaryWallet: v.string(),\n    smartAccount: v.string(),\n    activeAccount: v.optional(ActiveAccountInfoSchema),\n    username: v.optional(v.string()),\n});\n\n/**\n * Parses raw session data into the SDK session shape.\n */\nexport function parseSessionData(value: unknown): SessionData | null {\n    const parsed = v.safeParse(SessionDataSchema, value);\n    return parsed.success ? parsed.output : null;\n}\n"],"mappings":";;AAGA,MAAa,wBAAwB,EAAE,SAAS;CAC5C;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,MAAa,0BAA0B,EAAE,OAAO;CAC5C,WAAW,EAAE,OAAO;CACpB,QAAQ,EAAE,QAAQ;CAClB,eAAe,EAAE,OAAO;CACxB,qBAAqB,EAAE,SAAS,EAAE,OAAO,CAAC;CAC1C,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;AAChC,CAAC;AAED,MAAa,oBAAoB,EAAE,OAAO;CACtC,wBAAwB,EAAE,OAAO;CACjC,UAAU,EAAE,SAAS;EAAC;EAAY;EAAW;EAAW;CAAO,CAAC;CAChE,aAAa,EAAE,SAAS,qBAAqB;CAC7C,eAAe,EAAE,OAAO;CACxB,cAAc,EAAE,OAAO;CACvB,eAAe,EAAE,SAAS,uBAAuB;CACjD,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;AACnC,CAAC;;;;AAKD,SAAgB,iBAAiB,OAAoC;CACjE,MAAM,SAAS,EAAE,UAAU,mBAAmB,KAAK;CACnD,OAAO,OAAO,UAAU,OAAO,SAAS;AAC5C"}

package/dist/services/auth/session.types.d.ts

@@ -18,7 +18,7 @@ type AuthLoginMethod = "google" | "email" | "metamask" | "rabby" | "phantom" | "
  */
 interface SessionData {
   environmentFingerprint: string;
-  provider: "metamask" | "turnkey" | "other";
+  provider: "metamask" | "phantom" | "turnkey" | "other";
   loginMethod: AuthLoginMethod | null;
   primaryWallet: string;
   smartAccount: string;

package/dist/services/candles/candles.schemas.d.ts

@@ -11,7 +11,7 @@ type TimestampInit = {
 };
 declare function createCandleRowSchema(scales: SdkScales): v.SchemaWithPipe<readonly [v.ObjectSchema<{
   readonly symbolId: v.NumberSchema<undefined>;
-  readonly timeframe: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">>]>;
+  readonly timeframe: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">>]>;
   readonly tsSec: v.BigintSchema<undefined>;
   readonly open: v.BigintSchema<undefined>;
   readonly high: v.BigintSchema<undefined>;
@@ -22,7 +22,7 @@ declare function createCandleRowSchema(scales: SdkScales): v.SchemaWithPipe<read
   readonly isClosed: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
 }, undefined>, v.TransformAction<{
   symbolId: number;
-  timeframe: DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">;
+  timeframe: DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">;
   tsSec: bigint;
   open: bigint;
   high: bigint;
@@ -33,7 +33,7 @@ declare function createCandleRowSchema(scales: SdkScales): v.SchemaWithPipe<read
   isClosed: boolean;
 }, {
   symbolId: number;
-  timeframe: DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">;
+  timeframe: DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">;
   time: number;
   open: string;
   high: string;
@@ -46,7 +46,7 @@ declare function createCandleRowSchema(scales: SdkScales): v.SchemaWithPipe<read
 declare const createCandleRowIntSchema: typeof createCandleRowSchema;
 declare function createCandleColumnarSchema(scales: SdkScales): v.SchemaWithPipe<readonly [v.ObjectSchema<{
   readonly symbolId: v.NumberSchema<undefined>;
-  readonly timeframe: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">>]>;
+  readonly timeframe: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">>]>;
   readonly tsSec: v.ArraySchema<v.BigintSchema<undefined>, undefined>;
   readonly open: v.ArraySchema<v.BigintSchema<undefined>, undefined>;
   readonly high: v.ArraySchema<v.BigintSchema<undefined>, undefined>;
@@ -63,7 +63,7 @@ declare function createCandleColumnarSchema(scales: SdkScales): v.SchemaWithPipe
   readonly nextPageToken: v.OptionalSchema<v.StringSchema<undefined>, "">;
 }, undefined>, v.TransformAction<{
   symbolId: number;
-  timeframe: DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">;
+  timeframe: DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">;
   tsSec: bigint[];
   open: bigint[];
   high: bigint[];
@@ -80,7 +80,7 @@ declare function createCandleColumnarSchema(scales: SdkScales): v.SchemaWithPipe
   nextPageToken: string;
 }, {
   symbolId: number;
-  timeframe: DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">;
+  timeframe: DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">;
   time: number[];
   open: string[];
   high: string[];
@@ -100,7 +100,7 @@ declare function createCandleColumnarSchema(scales: SdkScales): v.SchemaWithPipe
 }>]>;
 declare function createCandleColumnarIntSchema(scales: SdkScales): v.SchemaWithPipe<readonly [v.ObjectSchema<{
   readonly symbolId: v.NumberSchema<undefined>;
-  readonly timeframe: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">>]>;
+  readonly timeframe: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">>]>;
   readonly tsSec: v.ArraySchema<v.BigintSchema<undefined>, undefined>;
   readonly open: v.ArraySchema<v.BigintSchema<undefined>, undefined>;
   readonly high: v.ArraySchema<v.BigintSchema<undefined>, undefined>;
@@ -117,7 +117,7 @@ declare function createCandleColumnarIntSchema(scales: SdkScales): v.SchemaWithP
   readonly nextPageToken: v.OptionalSchema<v.StringSchema<undefined>, "">;
 }, undefined>, v.TransformAction<{
   symbolId: number;
-  timeframe: DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">;
+  timeframe: DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">;
   tsSec: bigint[];
   open: bigint[];
   high: bigint[];
@@ -134,7 +134,7 @@ declare function createCandleColumnarIntSchema(scales: SdkScales): v.SchemaWithP
   nextPageToken: string;
 }, {
   symbolId: number;
-  timeframe: DecodedEnum<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo">;
+  timeframe: DecodedEnum<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo">;
   tsSec: number[];
   open: string[];
   high: string[];
@@ -158,7 +158,7 @@ type CandleColumnar = v.InferOutput<ReturnType<typeof createCandleColumnarSchema
 type CandleColumnarInt = v.InferOutput<ReturnType<typeof createCandleColumnarIntSchema>>;
 declare function createListCandlesInputSchema(): v.SchemaWithPipe<readonly [v.ObjectSchema<{
   readonly symbolId: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.GtValueAction<number, 0, undefined>, v.MaxValueAction<number, 4294967295, undefined>]>;
-  readonly timeframe: v.SchemaWithPipe<readonly [v.PicklistSchema<readonly ["1s", "1m", "5m", "15m", "30m", "1h", "4h", "12h", "1d", "1w", "1mo"], undefined>, v.TransformAction<"1d" | "1h" | "1w" | "1m" | "1s" | "5m" | "15m" | "30m" | "4h" | "12h" | "1mo", Timeframe$1.SEC_1 | Timeframe$1.MIN_1 | Timeframe$1.MIN_5 | Timeframe$1.MIN_15 | Timeframe$1.MIN_30 | Timeframe$1.HOUR_1 | Timeframe$1.HOUR_4 | Timeframe$1.DAY_1 | Timeframe$1.HOUR_12 | Timeframe$1.WEEK_1 | Timeframe$1.MONTH_1>]>;
+  readonly timeframe: v.SchemaWithPipe<readonly [v.PicklistSchema<readonly ["1s", "1m", "5m", "15m", "30m", "1h", "4h", "12h", "1d", "1w", "1mo"], undefined>, v.TransformAction<"1d" | "1s" | "1m" | "5m" | "15m" | "30m" | "1h" | "4h" | "12h" | "1w" | "1mo", Timeframe$1.SEC_1 | Timeframe$1.MIN_1 | Timeframe$1.MIN_5 | Timeframe$1.MIN_15 | Timeframe$1.MIN_30 | Timeframe$1.HOUR_1 | Timeframe$1.HOUR_4 | Timeframe$1.DAY_1 | Timeframe$1.HOUR_12 | Timeframe$1.WEEK_1 | Timeframe$1.MONTH_1>]>;
   readonly limit: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.GtValueAction<number, 0, undefined>, v.MaxValueAction<number, 10000, undefined>]>, undefined>;
   readonly includeIncomplete: v.OptionalSchema<v.BooleanSchema<undefined>, false>;
   readonly includeReference: v.OptionalSchema<v.BooleanSchema<undefined>, false>;

package/dist/services/heatmap/heatmap.schemas.d.ts

@@ -13,8 +13,8 @@ type TimestampInit = {
 };
 declare const GetOrderbookHeatmapInputSchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
   readonly symbolId: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.GtValueAction<number, 0, undefined>, v.MaxValueAction<number, 4294967295, undefined>]>;
-  readonly interval: v.SchemaWithPipe<readonly [v.OptionalSchema<v.PicklistSchema<readonly ["1s", "1m", "5m", "1h"], undefined>, "1s">, v.TransformAction<"1h" | "1m" | "1s" | "5m", HeatmapInterval>]>;
-  readonly depth: v.SchemaWithPipe<readonly [v.OptionalSchema<v.PicklistSchema<readonly [1, 5, 10, 20, 50, 100, 200, 500, 1000], undefined>, 50>, v.TransformAction<1 | 10 | 5 | 20 | 200 | 500 | 1000 | 100 | 50, HeatmapDepth>]>;
+  readonly interval: v.SchemaWithPipe<readonly [v.OptionalSchema<v.PicklistSchema<readonly ["1s", "1m", "5m", "1h"], undefined>, "1s">, v.TransformAction<"1s" | "1m" | "5m" | "1h", HeatmapInterval>]>;
+  readonly depth: v.SchemaWithPipe<readonly [v.OptionalSchema<v.PicklistSchema<readonly [1, 5, 10, 20, 50, 100, 200, 500, 1000], undefined>, 50>, v.TransformAction<1 | 10 | 5 | 20 | 200 | 500 | 100 | 50 | 1000, HeatmapDepth>]>;
   readonly quantityMode: v.SchemaWithPipe<readonly [v.OptionalSchema<v.PicklistSchema<readonly ["close", "peak"], undefined>, "close">, v.TransformAction<"close" | "peak", HeatmapQuantityMode>]>;
   readonly limit: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.GtValueAction<number, 0, undefined>, v.MaxValueAction<number, 20000, undefined>]>;
   readonly startTsSec: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>, v.MaxValueAction<number, number, undefined>, v.TransformAction<number, bigint>]>, undefined>;
@@ -122,7 +122,7 @@ declare function convertHeatmapDeltaBucket(bucket: OrderbookHeatmapDeltaBucketRa
 type OrderbookHeatmapDeltaBucket = ReturnType<typeof convertHeatmapDeltaBucket>;
 declare const OrderbookHeatmapLiveBucketRawSchema: v.ObjectSchema<{
   readonly symbolId: v.NumberSchema<undefined>;
-  readonly interval: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1h" | "1m" | "1s" | "5m">>]>;
+  readonly interval: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1s" | "1m" | "5m" | "1h">>]>;
   readonly tsSec: v.SchemaWithPipe<readonly [v.BigintSchema<undefined>, v.TransformAction<bigint, number>]>;
   readonly isFinal: v.BooleanSchema<undefined>;
   readonly bids: v.OptionalSchema<v.ObjectSchema<{
@@ -142,7 +142,7 @@ declare const OrderbookHeatmapLiveBucketRawSchema: v.ObjectSchema<{
 type OrderbookHeatmapLiveBucketRaw = v.InferOutput<typeof OrderbookHeatmapLiveBucketRawSchema>;
 declare function convertHeatmapLiveBucket(bucket: OrderbookHeatmapLiveBucketRaw, scales: SdkScales): {
   symbolId: number;
-  interval: DecodedEnum<"1h" | "1m" | "1s" | "5m">;
+  interval: DecodedEnum<"1s" | "1m" | "5m" | "1h">;
   tsSec: number;
   isFinal: boolean;
   bids: {
@@ -226,8 +226,8 @@ declare function convertHeatmapDeltaChain(chain: OrderbookHeatmapDeltaChainRaw,
 type OrderbookHeatmapDeltaChain = ReturnType<typeof convertHeatmapDeltaChain>;
 declare function createOrderbookHeatmapResponseSchema(scales: SdkScales): v.SchemaWithPipe<readonly [v.ObjectSchema<{
   readonly symbolId: v.NumberSchema<undefined>;
-  readonly interval: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1h" | "1m" | "1s" | "5m">>]>;
-  readonly depth: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, 1 | "unspecified" | 10 | 5 | 20 | 200 | 500 | 1000 | 100 | 50>]>;
+  readonly interval: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1s" | "1m" | "5m" | "1h">>]>;
+  readonly depth: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, 1 | "unspecified" | 10 | 5 | 20 | 200 | 500 | 100 | 50 | 1000>]>;
   readonly chain: v.OptionalSchema<v.ObjectSchema<{
     readonly baseKeyframe: v.OptionalSchema<v.ObjectSchema<{
       readonly tsSec: v.SchemaWithPipe<readonly [v.BigintSchema<undefined>, v.TransformAction<bigint, number>]>;
@@ -267,7 +267,7 @@ declare function createOrderbookHeatmapResponseSchema(scales: SdkScales): v.Sche
   readonly quantityMode: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"close" | "peak">>]>;
   readonly liveBucket: v.OptionalSchema<v.ObjectSchema<{
     readonly symbolId: v.NumberSchema<undefined>;
-    readonly interval: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1h" | "1m" | "1s" | "5m">>]>;
+    readonly interval: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.TransformAction<number, DecodedEnum<"1s" | "1m" | "5m" | "1h">>]>;
     readonly tsSec: v.SchemaWithPipe<readonly [v.BigintSchema<undefined>, v.TransformAction<bigint, number>]>;
     readonly isFinal: v.BooleanSchema<undefined>;
     readonly bids: v.OptionalSchema<v.ObjectSchema<{
@@ -286,8 +286,8 @@ declare function createOrderbookHeatmapResponseSchema(scales: SdkScales): v.Sche
   }, undefined>, undefined>;
 }, undefined>, v.TransformAction<{
   symbolId: number;
-  interval: DecodedEnum<"1h" | "1m" | "1s" | "5m">;
-  depth: 1 | "unspecified" | 10 | 5 | 20 | 200 | 500 | 1000 | 100 | 50;
+  interval: DecodedEnum<"1s" | "1m" | "5m" | "1h">;
+  depth: 1 | "unspecified" | 10 | 5 | 20 | 200 | 500 | 100 | 50 | 1000;
   chain?: {
     baseKeyframe?: {
       tsSec: number;
@@ -327,7 +327,7 @@ declare function createOrderbookHeatmapResponseSchema(scales: SdkScales): v.Sche
   quantityMode: DecodedEnum<"close" | "peak">;
   liveBucket?: {
     symbolId: number;
-    interval: DecodedEnum<"1h" | "1m" | "1s" | "5m">;
+    interval: DecodedEnum<"1s" | "1m" | "5m" | "1h">;
     tsSec: number;
     isFinal: boolean;
     bids?: {
@@ -346,8 +346,8 @@ declare function createOrderbookHeatmapResponseSchema(scales: SdkScales): v.Sche
   } | undefined;
 }, {
   symbolId: number;
-  interval: DecodedEnum<"1h" | "1m" | "1s" | "5m">;
-  depth: 1 | "unspecified" | 10 | 5 | 20 | 200 | 500 | 1000 | 100 | 50;
+  interval: DecodedEnum<"1s" | "1m" | "5m" | "1h">;
+  depth: 1 | "unspecified" | 10 | 5 | 20 | 200 | 500 | 100 | 50 | 1000;
   chain: {
     baseKeyframe: {
       tsSec: number;
@@ -387,7 +387,7 @@ declare function createOrderbookHeatmapResponseSchema(scales: SdkScales): v.Sche
   quantityMode: DecodedEnum<"close" | "peak">;
   liveBucket: {
     symbolId: number;
-    interval: DecodedEnum<"1h" | "1m" | "1s" | "5m">;
+    interval: DecodedEnum<"1s" | "1m" | "5m" | "1h">;
     tsSec: number;
     isFinal: boolean;
     bids: {