@wishknish/knishio-client-ts 1.2.0 → 1.3.0

package/dist/index.d.cts

@@ -425,7 +425,6 @@ declare class AtomMeta {
     setAtomWallet(wallet: any): AtomMeta;
     setMetaWallet(wallet: any): AtomMeta;
     setShadowWalletClaim(shadowWalletClaim: boolean | number): AtomMeta;
-    setSigningWallet(signingWallet: any): AtomMeta;
     addPolicy(policy: Record<string, any>): AtomMeta;
     get(): NormalizedMeta[];
     toObject(): Record<string, any>;
@@ -817,7 +816,7 @@ declare class Molecule {
         metaType: string;
         metaId: string;
         rule: Rule[] | any[] | any;
-        policy?: Record<string, any>;
+        policy?: Record<string, any> | null;
     }): Molecule;
     initTokenRequest({ token, amount, metaType, metaId, meta, batchId }: {
         token: string;
@@ -846,9 +845,8 @@ declare class Molecule {
         amount: number;
         tradeRates?: Record<string, any>;
     }): Molecule;
-    initWithdrawBuffer({ recipients, signingWallet }: {
+    initWithdrawBuffer({ recipients }: {
         recipients: Record<string, number>;
-        signingWallet?: any | null;
     }): Molecule;
     initShadowWalletClaim(wallet: Wallet): Molecule;
     initIdentifierCreation({ type, contact, code }: {
@@ -980,6 +978,7 @@ type AuthTokenSnapshot = {
     pubkey: string;
     encrypt: boolean;
     wallet?: {
+        token?: string;
         position: string | null;
         characters: string | null;
         mlKemParameterSet?: 1024 | 768;
@@ -1343,8 +1342,9 @@ declare class KnishIOClient {
         fields?: string[] | null;
         raw?: boolean;
     }): Promise<any>;
-    queryContinuId({ bundle }: {
+    queryContinuId({ bundle, token }: {
         bundle: BundleHash | string;
+        token?: string | null;
     }): Promise<Response>;
     queryMeta({ metaType, metaId, key, value, latest, fields: _fields, filter, queryArgs, count, countBy, throughAtom, throughMolecule, values, keys, atomValues, requestPolicy }: {
         metaType: MetaType | string;
@@ -1543,11 +1543,10 @@ declare class KnishIOClient {
         tradeRates: Record<string, number>;
         sourceWallet?: Wallet | null;
     }): Promise<Response>;
-    withdrawBufferToken({ tokenSlug, amount, sourceWallet, signingWallet }: {
+    withdrawBufferToken({ tokenSlug, amount, sourceWallet }: {
         tokenSlug: TokenSlug | string;
         amount: number | string;
         sourceWallet?: Wallet | null;
-        signingWallet?: Wallet | null;
     }): Promise<Response>;
     requestGuestAuthToken({ cellSlug, encrypt }?: {
         cellSlug?: CellSlug | string | null;
@@ -1557,6 +1556,8 @@ declare class KnishIOClient {
         secret: string;
         encrypt?: boolean;
     }): Promise<ResponseRequestAuthorization>;
+    private proposeProfileAuthorization;
+    private acceptProfileAuthorization;
     registerPeer({ host }: {
         host: string;
     }): Promise<Response>;
@@ -2339,12 +2340,12 @@ declare function withSecureBytes<T>(bytes: Uint8Array, fn: (bytes: Uint8Array) =
 declare function withSecureString<T>(secret: string, fn: (cleanSecret: string) => Promise<T> | T): Promise<T>;
 declare function constantTimeCompare(a: Uint8Array | string, b: Uint8Array | string): boolean;
 
-declare const SDK_VERSION = "1.2.0";
+declare const SDK_VERSION = "1.3.0";
 declare const SDK_NAME = "KnishIO-Client-TS";
 declare const COMPATIBLE_SERVER_VERSIONS: number[];
 declare const SDK_INFO: {
     readonly name: "KnishIO-Client-TS";
-    readonly version: "1.2.0";
+    readonly version: "1.3.0";
     readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
     readonly compatibleServerVersions: number[];
     readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2372,7 +2373,7 @@ declare const DevUtils: {
         nodeVersion: string;
         environment: string;
         name: "KnishIO-Client-TS";
-        version: "1.2.0";
+        version: "1.3.0";
         description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         compatibleServerVersions: number[];
         features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2399,7 +2400,7 @@ declare const KnishIO: {
     SDK_VERSION: string;
     SDK_INFO: {
         readonly name: "KnishIO-Client-TS";
-        readonly version: "1.2.0";
+        readonly version: "1.3.0";
         readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         readonly compatibleServerVersions: number[];
         readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];

package/dist/index.d.ts

@@ -425,7 +425,6 @@ declare class AtomMeta {
     setAtomWallet(wallet: any): AtomMeta;
     setMetaWallet(wallet: any): AtomMeta;
     setShadowWalletClaim(shadowWalletClaim: boolean | number): AtomMeta;
-    setSigningWallet(signingWallet: any): AtomMeta;
     addPolicy(policy: Record<string, any>): AtomMeta;
     get(): NormalizedMeta[];
     toObject(): Record<string, any>;
@@ -817,7 +816,7 @@ declare class Molecule {
         metaType: string;
         metaId: string;
         rule: Rule[] | any[] | any;
-        policy?: Record<string, any>;
+        policy?: Record<string, any> | null;
     }): Molecule;
     initTokenRequest({ token, amount, metaType, metaId, meta, batchId }: {
         token: string;
@@ -846,9 +845,8 @@ declare class Molecule {
         amount: number;
         tradeRates?: Record<string, any>;
     }): Molecule;
-    initWithdrawBuffer({ recipients, signingWallet }: {
+    initWithdrawBuffer({ recipients }: {
         recipients: Record<string, number>;
-        signingWallet?: any | null;
     }): Molecule;
     initShadowWalletClaim(wallet: Wallet): Molecule;
     initIdentifierCreation({ type, contact, code }: {
@@ -980,6 +978,7 @@ type AuthTokenSnapshot = {
     pubkey: string;
     encrypt: boolean;
     wallet?: {
+        token?: string;
         position: string | null;
         characters: string | null;
         mlKemParameterSet?: 1024 | 768;
@@ -1343,8 +1342,9 @@ declare class KnishIOClient {
         fields?: string[] | null;
         raw?: boolean;
     }): Promise<any>;
-    queryContinuId({ bundle }: {
+    queryContinuId({ bundle, token }: {
         bundle: BundleHash | string;
+        token?: string | null;
     }): Promise<Response>;
     queryMeta({ metaType, metaId, key, value, latest, fields: _fields, filter, queryArgs, count, countBy, throughAtom, throughMolecule, values, keys, atomValues, requestPolicy }: {
         metaType: MetaType | string;
@@ -1543,11 +1543,10 @@ declare class KnishIOClient {
         tradeRates: Record<string, number>;
         sourceWallet?: Wallet | null;
     }): Promise<Response>;
-    withdrawBufferToken({ tokenSlug, amount, sourceWallet, signingWallet }: {
+    withdrawBufferToken({ tokenSlug, amount, sourceWallet }: {
         tokenSlug: TokenSlug | string;
         amount: number | string;
         sourceWallet?: Wallet | null;
-        signingWallet?: Wallet | null;
     }): Promise<Response>;
     requestGuestAuthToken({ cellSlug, encrypt }?: {
         cellSlug?: CellSlug | string | null;
@@ -1557,6 +1556,8 @@ declare class KnishIOClient {
         secret: string;
         encrypt?: boolean;
     }): Promise<ResponseRequestAuthorization>;
+    private proposeProfileAuthorization;
+    private acceptProfileAuthorization;
     registerPeer({ host }: {
         host: string;
     }): Promise<Response>;
@@ -2339,12 +2340,12 @@ declare function withSecureBytes<T>(bytes: Uint8Array, fn: (bytes: Uint8Array) =
 declare function withSecureString<T>(secret: string, fn: (cleanSecret: string) => Promise<T> | T): Promise<T>;
 declare function constantTimeCompare(a: Uint8Array | string, b: Uint8Array | string): boolean;
 
-declare const SDK_VERSION = "1.2.0";
+declare const SDK_VERSION = "1.3.0";
 declare const SDK_NAME = "KnishIO-Client-TS";
 declare const COMPATIBLE_SERVER_VERSIONS: number[];
 declare const SDK_INFO: {
     readonly name: "KnishIO-Client-TS";
-    readonly version: "1.2.0";
+    readonly version: "1.3.0";
     readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
     readonly compatibleServerVersions: number[];
     readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2372,7 +2373,7 @@ declare const DevUtils: {
         nodeVersion: string;
         environment: string;
         name: "KnishIO-Client-TS";
-        version: "1.2.0";
+        version: "1.3.0";
         description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         compatibleServerVersions: number[];
         features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2399,7 +2400,7 @@ declare const KnishIO: {
     SDK_VERSION: string;
     SDK_INFO: {
         readonly name: "KnishIO-Client-TS";
-        readonly version: "1.2.0";
+        readonly version: "1.3.0";
         readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         readonly compatibleServerVersions: number[];
         readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];

package/dist/index.iife.js

@@ -54,11 +54,20 @@ var KnishIO = (function (exports) {
   var __getOwnPropNames = Object.getOwnPropertyNames;
   var __getProtoOf = Object.getPrototypeOf;
   var __hasOwnProp = Object.prototype.hasOwnProperty;
-  var __esm = (fn, res) => function __init() {
-    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  var __esm = (fn, res, err) => function __init() {
+    if (err) throw err[0];
+    try {
+      return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+    } catch (e4) {
+      throw err = [e4], e4;
+    }
   };
   var __commonJS = (cb, mod) => function __require() {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    try {
+      return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    } catch (e4) {
+      throw mod = 0, e4;
+    }
   };
   var __export = (target, all) => {
     for (var name2 in all)
@@ -41540,24 +41549,6 @@ ${operationTypes.join("\n")}
       this.merge({ shadowWalletClaim: Number(shadowWalletClaim) });
       return this;
     }
-    /**
-     * Set signing wallet metadata
-     * @param signingWallet - Wallet used for signing
-     * @return This instance for chaining
-     */
-    setSigningWallet(signingWallet) {
-      this.merge({
-        signingWallet: JSON.stringify({
-          tokenSlug: signingWallet.token,
-          bundleHash: signingWallet.bundle,
-          address: signingWallet.address,
-          position: signingWallet.position,
-          pubkey: signingWallet.pubkey,
-          characters: signingWallet.characters
-        })
-      });
-      return this;
-    }
     /**
      * Add policy metadata
      * @param policy - Policy object to add
@@ -44508,7 +44499,6 @@ ${operationTypes.join("\n")}
 
   // src/libraries/CheckMolecule.ts
   init_exception();
-  init_Dot();
   var CheckMolecule = class _CheckMolecule {
     molecule;
     /**
@@ -44596,12 +44586,13 @@ ${operationTypes.join("\n")}
     /**
      * Validate isotope U atoms
      * @return True if valid
-     * @throws WrongTokenTypeException if token is not AUTH
+     * @throws WrongTokenTypeException if token is neither AUTH (fresh login) nor USER (re-login
+     *   signed from the ContinuID pointer)
      * @throws AtomIndexException if index is not 0
      */
     isotopeU() {
       for (const atom of this.molecule.getIsotopes("U")) {
-        if (atom.token !== "AUTH") {
+        if (atom.token !== "AUTH" && atom.token !== "USER") {
           throw new WrongTokenTypeException(`Check::isotopeU() - "${atom.token}" is not a valid Token slug for "${atom.isotope}" isotope Atoms!`);
         }
         if (atom.index !== 0) {
@@ -44990,16 +44981,7 @@ ${operationTypes.join("\n")}
       if (!signingAtom) {
         throw new exports.SignatureMismatchException();
       }
-      let signingAddress = signingAtom.walletAddress;
-      const signingWallet = exports.Dot.get(signingAtom.aggregatedMeta(), "signingWallet");
-      if (signingWallet) {
-        const parsedWallet = JSON.parse(signingWallet);
-        const walletAddress = exports.Dot.get(parsedWallet, "address");
-        if (walletAddress) {
-          signingAddress = walletAddress;
-        }
-      }
-      if (address !== signingAddress) {
+      if (address !== signingAtom.walletAddress) {
         throw new exports.SignatureMismatchException();
       }
       return true;
@@ -45334,18 +45316,7 @@ ${operationTypes.join("\n")}
       if (!signingAtom) {
         throw new SignatureMalformedException("No atoms available for signing!");
       }
-      let signingPosition = signingAtom.position;
-      const signingWalletMeta = signingAtom.aggregatedMeta ? signingAtom.aggregatedMeta() : null;
-      const signingWalletJson = signingWalletMeta?.signingWallet;
-      if (signingWalletJson) {
-        try {
-          const parsedSigningWallet = JSON.parse(signingWalletJson);
-          if (parsedSigningWallet.position) {
-            signingPosition = parsedSigningWallet.position;
-          }
-        } catch {
-        }
-      }
+      const signingPosition = signingAtom.position;
       if (!signingPosition) {
         throw new SignatureMalformedException("Signing wallet must have a position!");
       }
@@ -45748,9 +45719,7 @@ ${operationTypes.join("\n")}
       const atomMeta = new AtomMeta({
         rule: JSON.stringify(rules)
       });
-      if (policy && Object.keys(policy).length > 0) {
-        atomMeta.addPolicy(policy);
-      }
+      atomMeta.addPolicy(policy ?? {});
       this.addAtom(Atom.create({
         isotope: "R",
         wallet: this.sourceWallet,
@@ -46003,12 +45972,10 @@ ${operationTypes.join("\n")}
      * Matches JavaScript SDK Molecule.initWithdrawBuffer implementation exactly
      *
      * @param recipients - Map of recipientBundle → amount
-     * @param signingWallet - Optional signing wallet for reconciliation
      * @return This molecule instance for chaining
      */
     initWithdrawBuffer({
-      recipients,
-      signingWallet = null
+      recipients
     }) {
       if (!this.sourceWallet) {
         throw new Error("Source wallet required for buffer withdrawal");
@@ -46020,15 +45987,10 @@ ${operationTypes.join("\n")}
       if (Number(this.sourceWallet.balance) - amount < 0) {
         throw new BalanceInsufficientException();
       }
-      const firstAtomMeta = new AtomMeta();
-      if (signingWallet) {
-        firstAtomMeta.setSigningWallet(signingWallet);
-      }
       this.addAtom(Atom.create({
         isotope: "B",
         wallet: this.sourceWallet,
         value: -Number(this.sourceWallet.balance),
-        meta: firstAtomMeta,
         metaType: "walletBundle",
         metaId: this.sourceWallet.bundle
       }));
@@ -48887,7 +48849,7 @@ ${operationTypes.join("\n")}
     static restore(snapshot, secret) {
       const wallet = new Wallet({
         secret,
-        token: "AUTH",
+        token: snapshot.wallet?.token ?? "AUTH",
         position: snapshot.wallet?.position ?? null,
         characters: snapshot.wallet?.characters ?? null,
         mlKemParameterSet: _AuthToken.resolveMlKemParameterSet(snapshot)
@@ -48970,6 +48932,7 @@ ${operationTypes.join("\n")}
         encrypt: this.$__encrypt,
         ...this.$__wallet ? {
           wallet: {
+            token: this.$__wallet.token,
             position: this.$__wallet.position,
             characters: this.$__wallet.characters,
             mlKemParameterSet: this.$__wallet.mlKemParameterSet
@@ -50469,8 +50432,8 @@ ${operationTypes.join("\n")}
      */
     constructor(graphQLClient, knishIOClient) {
       super(graphQLClient, knishIOClient);
-      this.$__query = gql`query ($bundle: String!) {
-      ContinuId(bundle: $bundle) {
+      this.$__query = gql`query ($bundle: String!, $token: String) {
+      ContinuId(bundle: $bundle, token: $token) {
         address,
         bundleHash,
         tokenSlug,
@@ -51770,7 +51733,7 @@ ${operationTypes.join("\n")}
           code: "HASH_MISMATCH"
         });
       }
-      if (/ots.*position.*reuse|position.*already.*used|ots.*verification/.test(lc)) {
+      if (/ots.*(?:position|key).*reuse|position.*already.*(?:used|consumed)|ots.*verification/.test(lc)) {
         return new exports.SignatureMismatchException(reason, {
           details: { reason },
           code: "OTS_VERIFICATION_FAILED"
@@ -51788,6 +51751,18 @@ ${operationTypes.join("\n")}
           code: "VERIFICATION_FAILED"
         });
       }
+      if (/signer address mismatch/.test(lc)) {
+        return new exports.SignatureMismatchException(reason, {
+          details: { reason },
+          code: "SIGNER_ADDRESS_MISMATCH"
+        });
+      }
+      if (/no accepted origin available/.test(lc)) {
+        return new exports.AtomIndexException(reason, {
+          details: { reason },
+          code: "ORIGIN_PENDING"
+        });
+      }
       return null;
     }
     /**
@@ -52289,12 +52264,10 @@ ${operationTypes.join("\n")}
      * Fills the molecule with buffer withdrawal data
      */
     fillMolecule({
-      recipients,
-      signingWallet
+      recipients
     }) {
       this.$__molecule.initWithdrawBuffer({
-        recipients,
-        signingWallet
+        recipients
       });
       this.$__molecule.sign({});
       this.$__molecule.check(this.$__molecule.sourceWallet);
@@ -53792,24 +53765,27 @@ ${operationTypes.join("\n")}
         this.setCellSlug(cellSlug);
       }
       this.$__authInProcess = true;
-      let response;
-      if (secret) {
-        response = await this.requestProfileAuthToken({
-          secret,
-          encrypt
-        });
-      } else {
-        response = await this.requestGuestAuthToken({
-          cellSlug: cellSlug || this.getCellSlug(),
-          encrypt
-        });
-      }
-      if (this.$__authToken) {
-        this.log("info", `KnishIOClient::requestAuthToken() - Successfully retrieved auth token...`);
+      try {
+        let response;
+        if (secret) {
+          response = await this.requestProfileAuthToken({
+            secret,
+            encrypt
+          });
+        } else {
+          response = await this.requestGuestAuthToken({
+            cellSlug: cellSlug || this.getCellSlug(),
+            encrypt
+          });
+        }
+        if (this.$__authToken) {
+          this.log("info", `KnishIOClient::requestAuthToken() - Successfully retrieved auth token...`);
+        }
+        this.switchEncryption(encrypt);
+        return response;
+      } finally {
+        this.$__authInProcess = false;
       }
-      this.switchEncryption(encrypt);
-      this.$__authInProcess = false;
-      return response;
     }
     /**
      * Logging utility
@@ -53953,14 +53929,16 @@ ${operationTypes.join("\n")}
     }
     /**
      * Query next ContinuId wallet
+     *
+     * @param token - Restricts the lookup to wallets of this token. Without it the validator falls
+     *   back to the bundle's newest wallet of ANY token when the bundle has no ContinuID pointer.
      */
     async queryContinuId({
-      bundle
+      bundle,
+      token = null
     }) {
       const query = this.createQuery(QueryContinuId);
-      return this.executeQuery(query, {
-        bundle
-      });
+      return this.executeQuery(query, token ? { bundle, token } : { bundle });
     }
     /**
      * Query metadata
@@ -54777,8 +54755,7 @@ ${operationTypes.join("\n")}
     async withdrawBufferToken({
       tokenSlug,
       amount,
-      sourceWallet = null,
-      signingWallet = null
+      sourceWallet = null
     }) {
       this.log("info", `KnishIOClient::withdrawBufferToken() - Withdrawing ${amount} of ${tokenSlug} from buffer...`);
       if (!sourceWallet) {
@@ -54787,11 +54764,7 @@ ${operationTypes.join("\n")}
       const mutation = await this.createMoleculeMutation({ mutationClass: MutationWithdrawBufferToken });
       const recipients = {};
       recipients[this.getBundle()] = amount;
-      const fillMoleculeParams = { recipients };
-      if (signingWallet) {
-        fillMoleculeParams.signingWallet = signingWallet;
-      }
-      await mutation.fillMolecule(fillMoleculeParams);
+      await mutation.fillMolecule({ recipients });
       const response = await this.executeQuery(mutation);
       if (!response) {
         throw new CodeException("Buffer token withdrawal failed");
@@ -54809,21 +54782,33 @@ ${operationTypes.join("\n")}
       encrypt = false
     } = {}) {
       this.log("info", "KnishIOClient::requestGuestAuthToken() - Requesting guest auth token...");
-      const mutation = this.createQuery(MutationRequestAuthorizationGuest);
-      const response = await this.executeQuery(mutation, {
-        cellSlug: cellSlug || this.getCellSlug()
-      });
-      if (!response) {
-        throw new CodeException("Guest auth token request failed");
-      }
-      if (encrypt) {
-        this.switchEncryption(true);
+      const authInProcess = this.$__authInProcess;
+      this.$__authInProcess = true;
+      try {
+        const mutation = this.createQuery(MutationRequestAuthorizationGuest);
+        const response = await this.executeQuery(mutation, {
+          cellSlug: cellSlug || this.getCellSlug()
+        });
+        if (!response) {
+          throw new CodeException("Guest auth token request failed");
+        }
+        if (encrypt) {
+          this.switchEncryption(true);
+        }
+        return response;
+      } finally {
+        this.$__authInProcess = authInProcess;
       }
-      return response;
     }
     /**
      * Request profile authentication token
-     * Matches JavaScript SDK requestProfileAuthToken implementation
+     *
+     * A returning user (the bundle has a USER ContinuID pointer) signs from the USER wallet
+     * registered at that pointer, so validator 0.5.0+ marks the token proven and the identity keeps
+     * read/subscription access to permissioned and private cells. A first login — or a pointer this
+     * secret does not own — signs from a fresh AUTH wallet as before. A rejected pointer-signed
+     * login falls back to the AUTH login exactly once, so one call sends at most two
+     * authorization molecules (testnet allows 3 auths/min/IP).
      */
     async requestProfileAuthToken({
       secret,
@@ -54831,13 +54816,58 @@ ${operationTypes.join("\n")}
     }) {
       this.log("info", "KnishIOClient::requestProfileAuthToken() - Requesting profile auth token...");
       this.setSecret(secret);
-      const wallet = new Wallet({
-        secret,
-        token: "AUTH",
-        mlKemParameterSet: this.getMlKemParameterSet()
-      });
+      const authInProcess = this.$__authInProcess;
+      this.$__authInProcess = true;
+      try {
+        const pointer = (await this.queryContinuId({
+          bundle: this.getBundle(),
+          token: "USER"
+        }))?.payload();
+        let pointerWallet = null;
+        if (pointer && pointer.token === "USER" && pointer.position) {
+          const wallet2 = new Wallet({
+            secret,
+            token: "USER",
+            position: pointer.position,
+            mlKemParameterSet: this.getMlKemParameterSet()
+          });
+          if (!pointer.address || wallet2.address === pointer.address) {
+            pointerWallet = wallet2;
+          } else {
+            this.log("warn", "KnishIOClient::requestProfileAuthToken() - ContinuID wallet address does not derive from this secret; signing from a fresh AUTH wallet");
+          }
+        }
+        if (pointerWallet) {
+          const response2 = await this.proposeProfileAuthorization(pointerWallet, encrypt);
+          if (response2.success()) {
+            this.log("info", "KnishIOClient::requestProfileAuthToken() - Auth token signed from the ContinuID pointer (proven)");
+            return this.acceptProfileAuthorization(response2, pointerWallet, encrypt);
+          }
+          this.log("warn", `KnishIOClient::requestProfileAuthToken() - Pointer-signed authorization rejected (${response2.reason()}); falling back once to an AUTH-wallet login`);
+        }
+        const wallet = new Wallet({
+          secret,
+          token: "AUTH",
+          mlKemParameterSet: this.getMlKemParameterSet()
+        });
+        const response = await this.proposeProfileAuthorization(wallet, encrypt);
+        if (!response.success()) {
+          throw new AuthorizationRejectedException_default(
+            `KnishIOClient::requestProfileAuthToken() - Authorization attempt rejected by ledger. Reason: ${response.reason()}`
+          );
+        }
+        this.log("info", `KnishIOClient::requestProfileAuthToken() - Auth token signed from a fresh AUTH wallet (${pointerWallet ? "fallback after the pointer-signed login was rejected" : "no usable ContinuID pointer"})`);
+        return this.acceptProfileAuthorization(response, wallet, encrypt);
+      } finally {
+        this.$__authInProcess = authInProcess;
+      }
+    }
+    /**
+     * Signs and proposes a profile authorization molecule from the given source wallet.
+     */
+    async proposeProfileAuthorization(wallet, encrypt) {
       const molecule = await this.createMolecule({
-        secret,
+        secret: this.getSecret(),
         sourceWallet: wallet
       });
       const mutation = await this.createMoleculeMutation({
@@ -54855,19 +54885,20 @@ ${operationTypes.join("\n")}
       if (!response) {
         throw new CodeException("Profile auth token request failed");
       }
-      if (response.success()) {
-        const authToken = AuthToken.create({
-          token: response.token(),
-          expiresAt: response.expiresAt(),
-          encrypt: String(response.encrypt()) === "true",
-          pubkey: response.pubKey()
-        }, wallet);
-        this.setAuthToken(authToken);
-      } else {
-        throw new AuthorizationRejectedException_default(
-          `KnishIOClient::requestProfileAuthToken() - Authorization attempt rejected by ledger. Reason: ${response.reason()}`
-        );
-      }
+      return response;
+    }
+    /**
+     * Binds the accepted authorization's token to the wallet that signed it.
+     */
+    acceptProfileAuthorization(response, wallet, encrypt) {
+      const authToken = AuthToken.create({
+        token: response.token(),
+        expiresAt: response.expiresAt(),
+        encrypt: String(response.encrypt()) === "true",
+        pubkey: response.pubKey()
+      }, wallet);
+      this.setAuthToken(authToken);
+      this.lastMoleculeQuery = null;
       if (encrypt) {
         this.switchEncryption(true);
       }
@@ -56225,7 +56256,7 @@ ${operationTypes.join("\n")}
   }
 
   // src/index.ts
-  var SDK_VERSION = "1.2.0";
+  var SDK_VERSION = "1.3.0";
   var SDK_NAME = "KnishIO-Client-TS";
   var COMPATIBLE_SERVER_VERSIONS = [4, 5];
   var SDK_INFO = {