@benji-money/connect-sdk 1.1.4-beta.4 → 1.1.4-beta.6

package/dist/connect-sdk.umd.global.js

@@ -110,7 +110,7 @@ var ConnectSDK = (() => {
   // src/utils/config.ts
   var buildContext = () => ({
     namespace: "benji-connect-sdk" ? "benji-connect-sdk" : "benji-connect-sdk",
-    version: "1.1.4-beta.4" ? String("1.1.4-beta.4") : "0.0.0"
+    version: "1.1.4-beta.6" ? String("1.1.4-beta.6") : "0.0.0"
   });
   function isBenjiConnectEnvironment(environment) {
     return environment === "local" /* LOCAL */ || environment === "development" /* DEVELOPMENT */ || environment === "sandbox" /* SANDBOX */ || environment === "production" /* PRODUCTION */;
@@ -247,6 +247,150 @@ var ConnectSDK = (() => {
     return ensureAuthLinkStateNonce(url, nonce);
   }
 
+  // src/utils/verifyAppUrl.ts
+  var DEFAULT_LOCAL_VERIFY_ORIGIN = "http://localhost:3000";
+  var REMOTE_VERIFY_ORIGINS = [
+    "https://verifyapp-staging.withbenji.com",
+    "https://verifyapp-dev.withbenji.com",
+    "https://verifyapp.withbenji.com"
+  ];
+  function rewriteVerifyAppUrlForLocalConnect(partnerLoginLink, localOrigin = DEFAULT_LOCAL_VERIFY_ORIGIN) {
+    if (!partnerLoginLink) {
+      return partnerLoginLink;
+    }
+    let url = partnerLoginLink;
+    for (const remote of REMOTE_VERIFY_ORIGINS) {
+      url = url.replaceAll(remote, localOrigin);
+      url = url.replaceAll(
+        remote.replace(/^https:\/\//, "https%3A//"),
+        localOrigin.replace(/^http:\/\//, "http%3A//")
+      );
+      url = url.replaceAll(encodeURIComponent(remote), encodeURIComponent(localOrigin));
+    }
+    return url;
+  }
+
+  // src/utils/loginTransport.ts
+  var LOGIN_PENDING_STORAGE_KEY = "benji_login_pending";
+  var LOGIN_FORCE_REDIRECT_STORAGE_KEY = "benji_force_login_redirect";
+  var LOGIN_RESUME_QUERY_FLAG = "login_resume";
+  var LOGIN_RETURN_STATE_SEPARATOR = ".benji_return.";
+  function isIosSafari(userAgent, maxTouchPoints) {
+    const isIos = /iPhone|iPad|iPod/.test(userAgent) || userAgent.includes("Macintosh") && maxTouchPoints > 1;
+    const isSafari = /Safari/.test(userAgent) && !/CriOS|FxiOS|EdgiOS|OPiOS|Chrome/.test(userAgent);
+    return isIos && isSafari;
+  }
+  function shouldUseSameTabLogin(args) {
+    if (!args.isNonDummyLogin) return false;
+    if (args.forceRedirect) return true;
+    return isIosSafari(args.userAgent, args.maxTouchPoints);
+  }
+  function isNonDummyLogin(mode, authType) {
+    return mode === 5 /* LOGIN */ && authType != null && authType !== 0 /* DUMMY */;
+  }
+  function isLocalForceRedirectEnabled(environment, storage) {
+    if (environment !== "local" /* LOCAL */) return false;
+    if (!storage) return false;
+    return storage.getItem(LOGIN_FORCE_REDIRECT_STORAGE_KEY) === "1";
+  }
+  function canStampLoginReturnState(partnerAuthLink, configToken) {
+    try {
+      const state = new URL(partnerAuthLink).searchParams.get("state");
+      return !state || state === configToken;
+    } catch {
+      return false;
+    }
+  }
+  function writeLoginPending(storage, payload) {
+    storage.setItem(LOGIN_PENDING_STORAGE_KEY, JSON.stringify(payload));
+  }
+  function buildRequestCodeExchangeMessage(args) {
+    const { configToken } = decodeLoginReturnState(args.token);
+    return {
+      type: "request_code_exchange",
+      data: {
+        partnerId: args.partnerId,
+        code: args.code,
+        token: configToken,
+        redirect_uri: args.redirectUri
+      }
+    };
+  }
+  function toBase64Url(value) {
+    const bytes = new TextEncoder().encode(value);
+    let binary = "";
+    for (const byte of bytes) {
+      binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  }
+  function fromBase64Url(value) {
+    try {
+      const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+      const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+      const binary = atob(padded + pad);
+      const bytes = Uint8Array.from(binary, (ch) => ch.charCodeAt(0));
+      return new TextDecoder().decode(bytes);
+    } catch {
+      return null;
+    }
+  }
+  function encodeLoginReturnState(configToken, returnOrigin) {
+    return `${configToken}${LOGIN_RETURN_STATE_SEPARATOR}${toBase64Url(returnOrigin)}`;
+  }
+  function decodeLoginReturnState(state) {
+    const separatorIndex = state.indexOf(LOGIN_RETURN_STATE_SEPARATOR);
+    if (separatorIndex <= 0) {
+      return { configToken: state };
+    }
+    const configToken = state.slice(0, separatorIndex);
+    const encodedOrigin = state.slice(
+      separatorIndex + LOGIN_RETURN_STATE_SEPARATOR.length
+    );
+    if (!configToken || !encodedOrigin) {
+      return { configToken: state };
+    }
+    const returnOrigin = fromBase64Url(encodedOrigin);
+    if (!returnOrigin) {
+      return { configToken: state };
+    }
+    return { configToken, returnOrigin };
+  }
+  function stampLoginReturnState(url, configToken, returnOrigin) {
+    if (!canStampLoginReturnState(url, configToken)) {
+      throw new Error("Partner sign-in URL contains incompatible OAuth state.");
+    }
+    const state = encodeLoginReturnState(configToken, returnOrigin);
+    try {
+      const parsed = new URL(url);
+      parsed.searchParams.set("state", state);
+      return parsed.toString();
+    } catch {
+      if (url.includes("state=")) {
+        return url.replace(
+          /([?&]state=)[^&]*/,
+          `$1${encodeURIComponent(state)}`
+        );
+      }
+      const separator = url.includes("?") ? "&" : "?";
+      return `${url}${separator}state=${encodeURIComponent(state)}`;
+    }
+  }
+  function buildSameTabPartnerAuthUrl(args) {
+    let prepared = args.configToken ? preparePartnerAuthUrl(args.partnerAuthLink, args.configToken) : args.partnerAuthLink;
+    if (args.configToken && args.returnOrigin) {
+      prepared = stampLoginReturnState(
+        prepared,
+        args.configToken,
+        args.returnOrigin
+      );
+    }
+    if (!args.rewriteForLocalConnect) {
+      return prepared;
+    }
+    return rewriteVerifyAppUrlForLocalConnect(prepared);
+  }
+
   // src/utils/placement.ts
   var IFRAME_WIDTH = 400;
   var IFRAME_HEIGHT = 645;
@@ -711,10 +855,11 @@ var ConnectSDK = (() => {
     "request_code_exchange",
     "request_code_with_login",
     "request_code_with_phone",
-    "request_loyalty_verification",
-    "request_phone_verification"
+    "request_phone_verification",
+    "request_loyalty_verification"
   ]);
   var CONNECT_MESSAGE_TYPES = new Set(Object.values(BenjiConnectEventType));
+  var LOGIN_PARTNER_POPUP_NAME = "benji_partner_auth";
   function isAuthMessageType(data2) {
     if (!data2 || typeof data2 !== "object") return false;
     const type = data2.type;
@@ -723,9 +868,18 @@ var ConnectSDK = (() => {
   function shouldRelayMessage(mode, data2) {
     return mode === 5 /* LOGIN */ && isAuthMessageType(data2);
   }
+  function isMessageWindow(source) {
+    if (!source || typeof source !== "object") return false;
+    try {
+      return typeof source.closed === "boolean";
+    } catch {
+      return false;
+    }
+  }
   function sourceOpenerIsHost(source) {
     try {
-      return source instanceof Window && source.opener === window;
+      if (!isMessageWindow(source)) return false;
+      return source.opener === window;
     } catch {
       return false;
     }
@@ -740,7 +894,53 @@ var ConnectSDK = (() => {
     if (sourceOpenerIsHost(event.source)) {
       return true;
     }
-    return event.source instanceof Window && event.origin === connectOrigin && event.source !== iframeWindow;
+    return isMessageWindow(event.source) && event.origin === connectOrigin && event.source !== iframeWindow;
+  }
+  function canDeliverAuthToConnectIframe(iframe) {
+    var _a;
+    const iframeWindow = (_a = iframe == null ? void 0 : iframe.contentWindow) != null ? _a : null;
+    if (!iframeWindow) return false;
+    try {
+      const href = iframeWindow.location.href;
+      return Boolean(href) && href !== "about:blank" && href !== "";
+    } catch {
+      return true;
+    }
+  }
+  function authMessageType(data2) {
+    if (!data2 || typeof data2 !== "object") return void 0;
+    const type = data2.type;
+    return typeof type === "string" ? type : void 0;
+  }
+  function resolveLoginPartnerWindow(loginPopup, lastVerifiedPopupSource) {
+    var _a;
+    const candidates = [];
+    if (lastVerifiedPopupSource && !lastVerifiedPopupSource.closed) {
+      candidates.push(lastVerifiedPopupSource);
+    }
+    if (loginPopup && !loginPopup.closed && loginPopup !== lastVerifiedPopupSource) {
+      candidates.push(loginPopup);
+    }
+    if (candidates.length === 0) {
+      try {
+        const named = window.open("", LOGIN_PARTNER_POPUP_NAME);
+        if (named && !named.closed) {
+          console.debug("[Benji Connect SDK] LOGIN named_reacquire", { success: true });
+          candidates.push(named);
+        } else {
+          console.debug("[Benji Connect SDK] LOGIN named_reacquire", { success: false });
+        }
+      } catch {
+        console.debug("[Benji Connect SDK] LOGIN named_reacquire", { success: false });
+      }
+    }
+    return (_a = candidates[0]) != null ? _a : null;
+  }
+  function describeLoginPartnerWindowTarget(target, loginPopup, lastVerifiedPopupSource) {
+    if (!target) return "none";
+    if (target === lastVerifiedPopupSource) return "lastVerified";
+    if (target === loginPopup) return "loginPopup";
+    return "named";
   }
   function isConnectMessageType(data2) {
     if (!data2 || typeof data2 !== "object") return false;
@@ -861,6 +1061,8 @@ var ConnectSDK = (() => {
   };
 
   // src/router/message.ts
+  var IFRAME_DELIVERABILITY_POLL_MS = 100;
+  var HOST_AUTH_REDELIVERY_MS = 500;
   var _MessageRouter = class _MessageRouter {
     static configureMessageRouter(config) {
       this.onSuccess = config.onSuccess;
@@ -876,8 +1078,11 @@ var ConnectSDK = (() => {
       this.loginPopup = context.loginPopup;
       this.mode = context.mode;
       this.connectOrigin = new URL(Endpoints.benji_connect_auth_url).origin;
-      if (this.isIframeReady) {
+      if (this.canDeliverToConnectIframe()) {
+        this.flushPendingHostAuth();
         this.flushPendingPopupAuth();
+      } else {
+        this.startIframeDeliverabilityPoll();
       }
     }
     static resetIframeReady() {
@@ -885,6 +1090,9 @@ var ConnectSDK = (() => {
     }
     static setMode(mode) {
       this.mode = mode;
+      if (mode !== 5 /* LOGIN */) {
+        this.stopIframeDeliverabilityPoll();
+      }
     }
     static addEventListeners() {
       if (this.configuredListeners) return;
@@ -897,6 +1105,8 @@ var ConnectSDK = (() => {
       window.removeEventListener("error", this.errorEventHandler);
       window.removeEventListener("unhandledrejection", this.errorEventHandler);
       window.removeEventListener("message", this.messageEventHandler);
+      this.stopIframeDeliverabilityPoll();
+      this.stopHostAuthRedelivery();
       this.configuredListeners = false;
       this.iframe = null;
       this.loginPopup = null;
@@ -904,6 +1114,8 @@ var ConnectSDK = (() => {
       this.connectOrigin = "";
       this.isIframeReady = false;
       this.pendingPopupAuth = [];
+      this.pendingHostAuth = [];
+      this.lastVerifiedPopupSource = null;
     }
     static handleErrorMessage(event) {
       switch (event.type) {
@@ -923,29 +1135,143 @@ var ConnectSDK = (() => {
         }
       }
     }
-    // Forward popup/tab auth payloads into Connect. Queue until the iframe has loaded;
-    // otherwise fast SSO (Safari or already-authenticated) can arrive before contentWindow is usable.
+    static canDeliverToConnectIframe() {
+      return canDeliverAuthToConnectIframe(this.iframe);
+    }
+    static startIframeDeliverabilityPoll() {
+      if (this.iframeDeliverabilityPoll !== null || this.mode !== 5 /* LOGIN */ || this.pendingPopupAuth.length === 0) {
+        return;
+      }
+      this.iframeDeliverabilityPoll = window.setInterval(() => {
+        if (this.mode !== 5 /* LOGIN */ || this.pendingPopupAuth.length === 0) {
+          this.stopIframeDeliverabilityPoll();
+          return;
+        }
+        if (this.canDeliverToConnectIframe()) {
+          this.flushPendingPopupAuth();
+        }
+      }, IFRAME_DELIVERABILITY_POLL_MS);
+    }
+    static stopIframeDeliverabilityPoll() {
+      if (this.iframeDeliverabilityPoll === null) return;
+      window.clearInterval(this.iframeDeliverabilityPoll);
+      this.iframeDeliverabilityPoll = null;
+    }
+    // Forward popup/tab auth payloads into Connect. Queue until deliverable.
     static relayToIframe(event) {
       var _a;
+      const type = authMessageType(event.data);
+      const deliverable = this.canDeliverToConnectIframe();
       const iframeWindow = (_a = this.iframe) == null ? void 0 : _a.contentWindow;
-      if (!this.isIframeReady || !iframeWindow) {
+      if (!iframeWindow || !deliverable) {
         this.pendingPopupAuth.push(event);
+        this.startIframeDeliverabilityPoll();
+        console.debug("[Benji Connect SDK] LOGIN relayToIframe queued", {
+          type,
+          queued: true,
+          pendingCount: this.pendingPopupAuth.length,
+          isIframeReady: this.isIframeReady,
+          deliverable
+        });
         return;
       }
+      if (this.pendingPopupAuth.length > 0) {
+        this.flushPendingPopupAuth();
+      }
       iframeWindow.postMessage(event.data, this.connectOrigin);
+      console.debug("[Benji Connect SDK] LOGIN relayToIframe posted", {
+        type,
+        queued: false,
+        pendingCount: this.pendingPopupAuth.length,
+        isIframeReady: this.isIframeReady,
+        deliverable
+      });
+    }
+    /**
+     * Same-tab LOGIN resume: post immediately, then re-post on an interval until
+     * FLOW_SUCCESS / onError / close stops redelivery. Connect dedupes repeats.
+     */
+    static startHostAuthRedelivery(payload, intervalMs = HOST_AUTH_REDELIVERY_MS) {
+      this.stopHostAuthRedelivery();
+      this.upsertPendingHostAuth(payload);
+      this.flushPendingHostAuth();
+      this.hostAuthRedeliveryId = window.setInterval(() => {
+        if (!this.pendingHostAuth.length) {
+          this.stopHostAuthRedelivery();
+          return;
+        }
+        this.flushPendingHostAuth();
+      }, intervalMs);
+    }
+    static stopHostAuthRedelivery() {
+      if (this.hostAuthRedeliveryId !== null) {
+        window.clearInterval(this.hostAuthRedeliveryId);
+        this.hostAuthRedeliveryId = null;
+      }
+      this.pendingHostAuth = [];
+    }
+    static upsertPendingHostAuth(payload) {
+      const type = authMessageType(payload);
+      if (!type) {
+        this.pendingHostAuth.push(payload);
+        return;
+      }
+      const existingIndex = this.pendingHostAuth.findIndex(
+        (item) => authMessageType(item) === type
+      );
+      if (existingIndex >= 0) {
+        this.pendingHostAuth[existingIndex] = payload;
+      } else {
+        this.pendingHostAuth.push(payload);
+      }
+    }
+    static flushPendingHostAuth() {
+      var _a, _b;
+      if (!this.pendingHostAuth.length) return;
+      const iframeWindow = (_b = (_a = this.iframe) == null ? void 0 : _a.contentWindow) != null ? _b : null;
+      if (!iframeWindow || !this.canDeliverToConnectIframe()) {
+        return;
+      }
+      const queued = [...this.pendingHostAuth];
+      for (const payload of queued) {
+        iframeWindow.postMessage(payload, this.connectOrigin);
+      }
+      console.debug("[Benji Connect SDK] LOGIN flushPendingHostAuth", {
+        flushedCount: queued.length
+      });
     }
     static markIframeReady(iframe) {
       if (this.iframe !== iframe) return;
       this.isIframeReady = true;
+      console.debug("[Benji Connect SDK] LOGIN iframe_load");
+      this.flushPendingHostAuth();
       this.flushPendingPopupAuth();
     }
     static flushPendingPopupAuth() {
       var _a, _b;
-      if (!this.isIframeReady || !this.pendingPopupAuth.length) return;
-      const expectedOrigin = this.connectOrigin || new URL(Endpoints.benji_connect_auth_url).origin;
       const iframeWindow = (_b = (_a = this.iframe) == null ? void 0 : _a.contentWindow) != null ? _b : null;
-      const queued = this.pendingPopupAuth;
-      this.pendingPopupAuth = [];
+      if (!this.pendingPopupAuth.length) {
+        this.stopIframeDeliverabilityPoll();
+        return;
+      }
+      if (!iframeWindow) {
+        this.startIframeDeliverabilityPoll();
+        return;
+      }
+      if (!this.canDeliverToConnectIframe()) {
+        this.startIframeDeliverabilityPoll();
+        console.debug("[Benji Connect SDK] LOGIN flushPendingPopupAuth skipped", {
+          pendingCount: this.pendingPopupAuth.length,
+          isIframeReady: this.isIframeReady,
+          deliverable: false
+        });
+        return;
+      }
+      const expectedOrigin = this.connectOrigin || new URL(Endpoints.benji_connect_auth_url).origin;
+      const queued = [...this.pendingPopupAuth];
+      let flushedCount = 0;
+      let skippedNotOriginated = 0;
+      const remaining = [];
       for (const event of queued) {
         if (!isPopupOriginatedAuth(
           event,
@@ -953,18 +1279,58 @@ var ConnectSDK = (() => {
           iframeWindow,
           expectedOrigin
         )) {
+          skippedNotOriginated += 1;
+          continue;
+        }
+        if (!this.canDeliverToConnectIframe()) {
+          remaining.push(event);
           continue;
         }
-        this.relayToIframe(event);
+        iframeWindow.postMessage(event.data, this.connectOrigin);
+        flushedCount += 1;
       }
+      this.pendingPopupAuth = remaining;
+      if (this.pendingPopupAuth.length === 0) {
+        this.stopIframeDeliverabilityPoll();
+      } else {
+        this.startIframeDeliverabilityPoll();
+      }
+      console.debug("[Benji Connect SDK] LOGIN flushPendingPopupAuth", {
+        pendingCount: queued.length,
+        flushedCount,
+        skippedNotOriginated,
+        remainingCount: this.pendingPopupAuth.length
+      });
     }
     static relayToPopup(payload) {
-      if (!this.loginPopup) {
-        console.warn("[Benji Connect SDK] Skipping login auth relay, no login popup");
+      var _a, _b, _c, _d, _e, _f, _g, _h;
+      const type = authMessageType(payload);
+      const target = resolveLoginPartnerWindow(
+        this.loginPopup,
+        this.lastVerifiedPopupSource
+      );
+      const targetLabel = describeLoginPartnerWindowTarget(
+        target,
+        this.loginPopup,
+        this.lastVerifiedPopupSource
+      );
+      if (!target) {
+        console.warn("[Benji Connect SDK] Skipping login auth relay, no live partner window", {
+          type,
+          target: targetLabel,
+          loginPopupClosed: (_b = (_a = this.loginPopup) == null ? void 0 : _a.closed) != null ? _b : true,
+          lastVerifiedClosed: (_d = (_c = this.lastVerifiedPopupSource) == null ? void 0 : _c.closed) != null ? _d : true
+        });
         return;
       }
+      console.debug("[Benji Connect SDK] LOGIN relayToPopup", {
+        type,
+        target: targetLabel,
+        loginPopupClosed: (_f = (_e = this.loginPopup) == null ? void 0 : _e.closed) != null ? _f : true,
+        lastVerifiedClosed: (_h = (_g = this.lastVerifiedPopupSource) == null ? void 0 : _g.closed) != null ? _h : true
+      });
       try {
-        this.loginPopup.postMessage(payload, "*");
+        target.postMessage(payload, "*");
       } catch (error) {
         console.error("[Benji Connect SDK] Failed to forward login auth message to popup", error);
       }
@@ -974,6 +1340,7 @@ var ConnectSDK = (() => {
       if (shouldRelayMessage(this.mode, event.data)) {
         const expectedOrigin2 = this.connectOrigin || new URL(Endpoints.benji_connect_auth_url).origin;
         const iframeWindow = (_a = this.iframe) == null ? void 0 : _a.contentWindow;
+        const type = authMessageType(event.data);
         if (iframeWindow && event.source === iframeWindow) {
           if (event.origin !== expectedOrigin2) {
             console.warn(
@@ -983,13 +1350,30 @@ var ConnectSDK = (() => {
             );
             return;
           }
+          console.debug("[Benji Connect SDK] LOGIN auth relay", {
+            type,
+            origin: event.origin,
+            direction: "iframe_to_popup"
+          });
           this.relayToPopup(event.data);
           return;
         }
         if (isPopupOriginatedAuth(event, this.loginPopup, iframeWindow != null ? iframeWindow : null, expectedOrigin2)) {
+          if (isMessageWindow(event.source)) {
+            this.lastVerifiedPopupSource = event.source;
+          }
+          console.debug("[Benji Connect SDK] LOGIN auth relay", {
+            type,
+            origin: event.origin,
+            direction: "popup_to_iframe"
+          });
           this.relayToIframe(event);
           return;
         }
+        console.warn("[Benji Connect SDK] LOGIN auth relay unclassified", {
+          type,
+          origin: event.origin
+        });
         return;
       }
       if (!isConnectMessageType(event.data)) return;
@@ -1066,6 +1450,18 @@ var ConnectSDK = (() => {
   _MessageRouter.connectOrigin = "";
   _MessageRouter.isIframeReady = false;
   _MessageRouter.pendingPopupAuth = [];
+  /**
+   * Sticky host→iframe auth (same-tab LOGIN resume). Kept after each post so
+   * redelivery can cover the window where the iframe is "deliverable" but
+   * Connect has not installed its message listener yet.
+   * Invariant: only `startHostAuthRedelivery` writes this queue, and it always
+   * owns a timer while the queue is non-empty. The deliverability poll is
+   * popup-only so it cannot double-post this payload.
+   */
+  _MessageRouter.pendingHostAuth = [];
+  _MessageRouter.hostAuthRedeliveryId = null;
+  _MessageRouter.lastVerifiedPopupSource = null;
+  _MessageRouter.iframeDeliverabilityPoll = null;
   _MessageRouter.errorEventHandler = (event) => {
     return _MessageRouter.handleErrorMessage(event);
   };
@@ -1076,6 +1472,7 @@ var ConnectSDK = (() => {
 
   // src/connect-sdk.ts
   var POPUP_CLOSED_POLL_MS = 500;
+  var SAME_TAB_RESUME_TIMEOUT_MS = 45e3;
   var ConnectSDK = class {
     constructor(config) {
       this.iframe = null;
@@ -1105,6 +1502,9 @@ var ConnectSDK = (() => {
        * while the in-flight open() still mounts the iframe.
        */
       this.openAbortController = null;
+      /** Same-tab LOGIN resume mounts the iframe headless without partner auth type. */
+      this.isResumingSameTabLogin = false;
+      this.sameTabResumeTimeoutId = null;
       this.onIframeLoad = () => {
         if (this.isClosing || !this.iframe) return;
         MessageRouter.markIframeReady(this.iframe);
@@ -1122,9 +1522,64 @@ var ConnectSDK = (() => {
     }
     isLoginPopupOnly() {
       var _a;
-      const mode = (_a = this.sdkConfig.mode) != null ? _a : 1 /* CONNECT */;
-      const authType = this.resolveAuthType();
-      return mode === 5 /* LOGIN */ && authType != null && authType !== 0 /* DUMMY */;
+      return isNonDummyLogin(
+        (_a = this.sdkConfig.mode) != null ? _a : 1 /* CONNECT */,
+        this.resolveAuthType()
+      );
+    }
+    shouldOpenSameTabLogin() {
+      var _a, _b, _c;
+      if (!this.isLoginPopupOnly()) return false;
+      const partnerAuthLink = (_a = this.sdkConfig.tokenData) == null ? void 0 : _a.partnerAuthLink;
+      const configToken = (_b = this.sdkConfig.tokenData) == null ? void 0 : _b.configToken;
+      if (!partnerAuthLink || !configToken || !canStampLoginReturnState(partnerAuthLink, configToken)) {
+        return false;
+      }
+      const storage = typeof sessionStorage === "undefined" ? null : sessionStorage;
+      return shouldUseSameTabLogin({
+        isNonDummyLogin: true,
+        userAgent: typeof navigator === "undefined" ? "" : navigator.userAgent,
+        maxTouchPoints: typeof navigator === "undefined" ? 0 : (_c = navigator.maxTouchPoints) != null ? _c : 0,
+        forceRedirect: isLocalForceRedirectEnabled(Environment, storage)
+      });
+    }
+    openSameTabLogin() {
+      var _a, _b, _c, _d, _e, _f;
+      const partnerAuthLink = (_a = this.sdkConfig.tokenData) == null ? void 0 : _a.partnerAuthLink;
+      if (!partnerAuthLink) {
+        console.warn("[Connect SDK] Same-tab LOGIN missing partnerAuthLink");
+        (_c = (_b = this.sdkConfig).onError) == null ? void 0 : _c.call(
+          _b,
+          new Error("Partner sign-in URL is missing."),
+          "400",
+          { context: buildContext() }
+        );
+        return;
+      }
+      const rewriteForLocalConnect = Environment === "local" /* LOCAL */;
+      const returnOrigin = window.location.origin;
+      const url = buildSameTabPartnerAuthUrl({
+        partnerAuthLink,
+        configToken: (_d = this.sdkConfig.tokenData) == null ? void 0 : _d.configToken,
+        rewriteForLocalConnect,
+        returnOrigin
+      });
+      try {
+        writeLoginPending(sessionStorage, {
+          connectToken: this.sdkConfig.token,
+          path: `${window.location.pathname}${window.location.search}`
+        });
+      } catch (error) {
+        console.warn("[Connect SDK] Failed to persist LOGIN pending state", error);
+        (_f = (_e = this.sdkConfig).onError) == null ? void 0 : _f.call(
+          _e,
+          new Error("Sign-in could not be started."),
+          "400",
+          { context: buildContext() }
+        );
+        return;
+      }
+      window.location.assign(url);
     }
     isSessionActive() {
       return this.iframe != null || this.loginPopup != null;
@@ -1137,8 +1592,22 @@ var ConnectSDK = (() => {
     }
     initialize() {
       MessageRouter.configureMessageRouter({
-        onSuccess: this.sdkConfig.onSuccess,
-        onError: this.sdkConfig.onError,
+        onSuccess: (token, metadata) => {
+          var _a, _b;
+          this.clearSameTabResumeTimeout();
+          MessageRouter.stopHostAuthRedelivery();
+          (_b = (_a = this.sdkConfig).onSuccess) == null ? void 0 : _b.call(_a, token, metadata);
+        },
+        onError: (error, errorId, metadata) => {
+          var _a, _b;
+          if (this.isResumingSameTabLogin) {
+            this.close();
+          } else {
+            this.clearSameTabResumeTimeout();
+            MessageRouter.stopHostAuthRedelivery();
+          }
+          (_b = (_a = this.sdkConfig).onError) == null ? void 0 : _b.call(_a, error, errorId, metadata);
+        },
         onExit: this.sdkConfig.onExit,
         onEvent: this.sdkConfig.onEvent,
         close: () => this.close(),
@@ -1159,7 +1628,7 @@ var ConnectSDK = (() => {
       const popupUrl = preparedLink ? appendLoginPopupFlag(preparedLink) : "about:blank";
       this.loginPopup = window.open(
         popupUrl,
-        "benji_partner_auth",
+        LOGIN_PARTNER_POPUP_NAME,
         buildLoginPopupFeatures(position)
       );
       if (!this.loginPopup) {
@@ -1186,6 +1655,15 @@ var ConnectSDK = (() => {
         var _a, _b, _c;
         if (this.isClosing) return;
         if ((_a = this.loginPopup) == null ? void 0 : _a.closed) {
+          const live = resolveLoginPartnerWindow(
+            this.loginPopup,
+            MessageRouter.lastVerifiedPopupSource
+          );
+          if (live) {
+            console.debug("[Benji Connect SDK] LOGIN popup_closed_poll skipped, live partner window remains");
+            return;
+          }
+          console.debug("[Benji Connect SDK] LOGIN popup_closed_poll exit, no live partner window");
           (_c = (_b = this.sdkConfig).onExit) == null ? void 0 : _c.call(_b, {
             context: buildContext(),
             trigger: "POPUP_CLOSED" /* POPUP_CLOSED */
@@ -1223,6 +1701,11 @@ var ConnectSDK = (() => {
       const abortController = new AbortController();
       this.openAbortController = abortController;
       const { signal } = abortController;
+      if (this.shouldOpenSameTabLogin()) {
+        this.openSameTabLogin();
+        this.abortInflightOpen();
+        return;
+      }
       this.initialize();
       if (signal.aborted) return;
       MessageRouter.setMode(mode);
@@ -1243,6 +1726,55 @@ var ConnectSDK = (() => {
       this.openUI();
       this.syncLoginContext(mode);
     }
+    /**
+     * Finishes a same-tab LOGIN after the partner redirect returns to the host.
+     * The Connect callback page has no session of its own, so the code exchange
+     * runs in the headless Connect iframe, which authenticates with the connect
+     * token. Completion arrives through the usual FLOW_SUCCESS → onSuccess path.
+     */
+    async resumeSameTabLogin(params) {
+      var _a;
+      if (this.isSessionActive()) return;
+      this.sdkConfig.mode = 5 /* LOGIN */;
+      this.isResumingSameTabLogin = true;
+      this.initialize();
+      MessageRouter.setMode(5 /* LOGIN */);
+      MessageRouter.addEventListeners();
+      this.openUI();
+      this.syncLoginContext(5 /* LOGIN */);
+      const payload = buildRequestCodeExchangeMessage({
+        partnerId: params.partnerId,
+        code: params.code,
+        token: params.state,
+        redirectUri: (_a = params.redirectUri) != null ? _a : this.buildCallbackUrl(params.partnerId)
+      });
+      MessageRouter.startHostAuthRedelivery(payload);
+      this.startSameTabResumeTimeout();
+    }
+    buildCallbackUrl(partnerId) {
+      const origin = new URL(Endpoints.benji_connect_auth_url).origin;
+      return `${origin}/auth/${partnerId}/callback`;
+    }
+    startSameTabResumeTimeout() {
+      this.clearSameTabResumeTimeout();
+      this.sameTabResumeTimeoutId = setTimeout(() => {
+        var _a, _b;
+        this.sameTabResumeTimeoutId = null;
+        console.warn("[Connect SDK] Same-tab LOGIN resume timed out");
+        (_b = (_a = this.sdkConfig).onError) == null ? void 0 : _b.call(
+          _a,
+          new Error("Sign-in could not be completed. Please try again."),
+          "408",
+          { context: buildContext() }
+        );
+        this.close();
+      }, SAME_TAB_RESUME_TIMEOUT_MS);
+    }
+    clearSameTabResumeTimeout() {
+      if (this.sameTabResumeTimeoutId === null) return;
+      clearTimeout(this.sameTabResumeTimeoutId);
+      this.sameTabResumeTimeoutId = null;
+    }
     syncLoginContext(mode) {
       MessageRouter.setLoginContext({
         iframe: this.iframe,
@@ -1254,7 +1786,7 @@ var ConnectSDK = (() => {
       var _a, _b;
       if (this.iframe) return;
       MessageRouter.resetIframeReady();
-      const headless = this.isLoginPopupOnly();
+      const headless = this.isResumingSameTabLogin || this.isLoginPopupOnly();
       this.container = document.createElement("div");
       if (headless) {
         applyHeadlessContainerStyle(this.container);
@@ -1270,6 +1802,9 @@ var ConnectSDK = (() => {
       if (this.sdkConfig.mode != null) {
         url.searchParams.set("mode", String(this.sdkConfig.mode));
       }
+      if (this.isResumingSameTabLogin) {
+        url.searchParams.set(LOGIN_RESUME_QUERY_FLAG, "1");
+      }
       this.iframe = document.createElement("iframe");
       this.syncLoginContext((_a = this.sdkConfig.mode) != null ? _a : 1 /* CONNECT */);
       this.iframe.addEventListener("load", this.onIframeLoad);
@@ -1316,6 +1851,10 @@ var ConnectSDK = (() => {
       this.syncLoginContext((_b = this.sdkConfig.mode) != null ? _b : 1 /* CONNECT */);
     }
     navigateLoginPopup(url) {
+      if (this.isResumingSameTabLogin) {
+        console.debug("[Connect SDK] Ignoring PARTNER_LOGIN_OPEN during same-tab resume");
+        return;
+      }
       if (this.hasLoginPopupUrl) return;
       if (!this.loginPopup || this.loginPopup.closed) {
         console.warn("[Connect SDK] Cannot navigate LOGIN popup \u2014 window unavailable");
@@ -1344,6 +1883,9 @@ var ConnectSDK = (() => {
     close() {
       var _a, _b;
       this.abortInflightOpen();
+      this.clearSameTabResumeTimeout();
+      MessageRouter.stopHostAuthRedelivery();
+      this.isResumingSameTabLogin = false;
       this.isClosing = true;
       this.stopPopupClosedPoll();
       this.closeLoginPopup();