@bounded-sh/client 0.0.103 → 0.0.105

package/dist/{index.native-PGrxu7RO.js → index.native-BpcNwWQX.js}

@@ -202,10 +202,14 @@ function getPlatform() {
 }
 
 /**
- * OffchainAuthProvider wraps a real auth provider (e.g., Phantom) for the poofnet environment.
+ * OffchainAuthProvider wraps a real auth provider (Turnkey, Phantom, ...) for the
+ * poofnet environment.
  *
- * signMessage shows a custom confirmation modal and then delegates to the wrapped
- * provider for a real detached signature over the exact offchain transaction message.
+ * Poofnet has no chain, but its onchain writes are still signed: the worker
+ * issues an unsendable approval message and verifies the wallet's signature
+ * before committing. So `signTransaction` and `signMessage` go straight to the
+ * wrapped wallet, whose own prompt is the only one the user sees. Only a raw
+ * submit - which needs a real cluster - is refused here.
  */
 class OffchainAuthProvider {
     constructor(wrappedProvider, config = {}) {
@@ -240,10 +244,7 @@ class OffchainAuthProvider {
         return null;
     }
     async signTransaction(tx) {
-        if (getPlatform().hasDOM) {
-            await this.showUnsupportedTransactionModal();
-        }
-        throw new Error('Poofnet does not support real Solana transactions. Deploy your project to mainnet to use this feature.');
+        return this.wrappedProvider.signTransaction(tx);
     }
     /**
      * Sign and submit transaction - not supported in poofnet environment.
@@ -268,21 +269,11 @@ class OffchainAuthProvider {
         }
         await this.wrappedProvider.exportWallet(address);
     }
-    // ============ signMessage delegates to wrapped provider ============
     async signMessage(message) {
         var _a, _b, _c, _d, _e, _f;
         (_b = (_a = this.config).onSigningStart) === null || _b === void 0 ? void 0 : _b.call(_a);
         try {
-            // On RN (no DOM), auto-confirm — there's no modal to show.
-            // On web, show the confirmation modal.
-            if (getPlatform().hasDOM) {
-                const confirmed = await this.showTransactionModal(message);
-                if (!confirmed) {
-                    throw new Error("Transaction rejected by user");
-                }
-            }
             const signature = await this.wrappedProvider.signMessage(message);
-            // Callback: signing complete
             (_d = (_c = this.config).onSigningComplete) === null || _d === void 0 ? void 0 : _d.call(_c, signature);
             return signature;
         }
@@ -373,99 +364,6 @@ class OffchainAuthProvider {
             document.addEventListener("keydown", escHandler);
         });
     }
-    async showTransactionModal(message) {
-        return new Promise((resolve) => {
-            // Parse the transaction message for display
-            let parsed = {};
-            try {
-                parsed = JSON.parse(message);
-            }
-            catch (_a) {
-                // If not JSON, just show raw message
-            }
-            // Create modal container. Captured in this closure so every teardown
-            // path acts on exactly this prompt, never on a newer one that may have
-            // replaced a shared field.
-            const container = document.createElement("div");
-            container.id = "poofnet-tx-modal";
-            container.appendChild(this.buildTransactionModalContent(parsed, message));
-            document.body.appendChild(container);
-            // Add styles
-            const style = document.createElement("style");
-            style.textContent = this.getModalStyles();
-            container.appendChild(style);
-            // Mark all OTHER body children as inert to disable focus traps from
-            // other modals, recording only the ones this modal changed (skipping
-            // any already-inert) so cleanup restores exactly what we set and never
-            // re-enables app-owned inert regions.
-            const selfInerted = [];
-            document.body.childNodes.forEach((child) => {
-                if (child !== container &&
-                    child instanceof HTMLElement &&
-                    !child.hasAttribute("inert")) {
-                    child.setAttribute("inert", "");
-                    selfInerted.push(child);
-                }
-            });
-            // Animate in
-            requestAnimationFrame(() => {
-                const overlay = container.querySelector(".poofnet-modal-overlay");
-                const content = container.querySelector(".poofnet-modal-content");
-                if (overlay)
-                    overlay.style.opacity = "1";
-                if (content) {
-                    content.style.opacity = "1";
-                    content.style.transform = "translateY(0)";
-                }
-            });
-            // Single idempotent teardown for every settlement path: removes the key
-            // handler, restores only self-added inert, and removes exactly this
-            // captured container after the exit animation.
-            let settled = false;
-            const escHandler = (e) => {
-                if (e.key === "Escape")
-                    settle(false);
-            };
-            const cleanup = () => {
-                if (settled)
-                    return;
-                settled = true;
-                document.removeEventListener("keydown", escHandler);
-                for (const el of selfInerted)
-                    el.removeAttribute("inert");
-                const overlay = container.querySelector(".poofnet-modal-overlay");
-                const content = container.querySelector(".poofnet-modal-content");
-                if (overlay)
-                    overlay.style.opacity = "0";
-                if (content) {
-                    content.style.opacity = "0";
-                    content.style.transform = "translateY(20px)";
-                }
-                setTimeout(() => container.remove(), 200);
-            };
-            const settle = (confirmed) => {
-                cleanup();
-                resolve(confirmed);
-            };
-            // Handle confirm
-            const confirmBtn = container.querySelector("#poofnet-confirm-btn");
-            confirmBtn === null || confirmBtn === void 0 ? void 0 : confirmBtn.addEventListener("click", () => settle(true));
-            // Handle cancel
-            const cancelBtn = container.querySelector("#poofnet-cancel-btn");
-            cancelBtn === null || cancelBtn === void 0 ? void 0 : cancelBtn.addEventListener("click", () => settle(false));
-            // Handle close button
-            const closeBtn = container.querySelector("#poofnet-close-btn");
-            closeBtn === null || closeBtn === void 0 ? void 0 : closeBtn.addEventListener("click", () => settle(false));
-            // Handle overlay click
-            const overlay = container.querySelector(".poofnet-modal-overlay");
-            overlay === null || overlay === void 0 ? void 0 : overlay.addEventListener("click", (e) => {
-                if (e.target === overlay)
-                    settle(false);
-            });
-            // Handle escape key
-            document.addEventListener("keydown", escHandler);
-        });
-    }
     createElement(tag, className, text) {
         const el = document.createElement(tag);
         if (className)
@@ -520,113 +418,6 @@ class OffchainAuthProvider {
         footer.appendChild(close);
         return overlay;
     }
-    formatPath(path) {
-        const parts = path.split("/").filter(Boolean);
-        if (parts.length >= 2) {
-            return {
-                collection: parts[0],
-                documentId: parts[parts.length - 1],
-            };
-        }
-        return { collection: parts[0] || path, documentId: null };
-    }
-    formatFieldValue(value) {
-        if (value === null || value === undefined)
-            return "null";
-        if (typeof value === "string") {
-            return value.length > 30
-                ? `"${value.slice(0, 30)}..."`
-                : `"${value}"`;
-        }
-        if (typeof value === "number" || typeof value === "boolean")
-            return String(value);
-        if (Array.isArray(value))
-            return `[${value.length} items]`;
-        if (typeof value === "object")
-            return `{${Object.keys(value).length} fields}`;
-        return String(value);
-    }
-    getActionDescription(type, collection, isNew) {
-        if (type === "delete")
-            return `Delete from ${collection}`;
-        return isNew ? `Create in ${collection}` : `Update ${collection}`;
-    }
-    buildTransactionModalContent(parsed, rawMessage) {
-        const instructions = parsed.instructions || [];
-        // Group instructions by type for summary
-        const sets = instructions.filter((i) => i.type === "set");
-        const deletes = instructions.filter((i) => i.type === "delete");
-        // Create summary text
-        let summaryText = "";
-        if (sets.length > 0 && deletes.length > 0) {
-            summaryText = `${sets.length} update${sets.length > 1 ? "s" : ""}, ${deletes.length} delete${deletes.length > 1 ? "s" : ""}`;
-        }
-        else if (sets.length > 0) {
-            summaryText = `${sets.length} update${sets.length > 1 ? "s" : ""}`;
-        }
-        else if (deletes.length > 0) {
-            summaryText = `${deletes.length} delete${deletes.length > 1 ? "s" : ""}`;
-        }
-        const { overlay, body, footer } = this.buildModalShell("🔐", "Confirm Transaction");
-        if (instructions.length > 0) {
-            if (summaryText) {
-                this.appendTextElement(body, "div", "poofnet-summary", summaryText);
-            }
-            const list = this.createElement("div", "poofnet-instructions-list");
-            for (const inst of instructions) {
-                list.appendChild(this.buildInstructionElement(inst));
-            }
-            body.appendChild(list);
-        }
-        else {
-            const section = this.createElement("div", "poofnet-section");
-            this.appendTextElement(section, "h3", "poofnet-section-title", "Message");
-            const raw = this.createElement("pre", "poofnet-raw-message", rawMessage.slice(0, 200) + (rawMessage.length > 200 ? "..." : ""));
-            section.appendChild(raw);
-            body.appendChild(section);
-        }
-        body.appendChild(this.buildInfoBox("This is a simulated transaction. No real fees will be charged."));
-        const cancel = this.createElement("button", "poofnet-btn poofnet-btn-cancel", "Cancel");
-        cancel.id = "poofnet-cancel-btn";
-        cancel.type = "button";
-        footer.appendChild(cancel);
-        const confirm = this.createElement("button", "poofnet-btn poofnet-btn-confirm", "Confirm");
-        confirm.id = "poofnet-confirm-btn";
-        confirm.type = "button";
-        footer.appendChild(confirm);
-        return overlay;
-    }
-    buildInstructionElement(inst) {
-        const { collection, documentId } = this.formatPath(inst.path);
-        const isDelete = inst.type === "delete";
-        const card = this.createElement("div", `poofnet-instruction ${isDelete ? "poofnet-action-delete" : "poofnet-action-set"}`);
-        const header = this.createElement("div", "poofnet-instruction-header");
-        this.appendTextElement(header, "span", "poofnet-instruction-icon", isDelete ? "🗑️" : "✏️");
-        this.appendTextElement(header, "span", "poofnet-instruction-action", isDelete ? "Delete" : "Save");
-        this.appendTextElement(header, "span", "poofnet-instruction-collection", collection);
-        card.appendChild(header);
-        if (documentId) {
-            this.appendTextElement(card, "div", "poofnet-instruction-id", `ID: ${documentId}`);
-        }
-        if (inst.data && !isDelete) {
-            const fieldKeys = Object.keys(inst.data).filter((key) => !key.startsWith("_"));
-            const visibleFields = fieldKeys.slice(0, 4);
-            if (visibleFields.length > 0) {
-                const fields = this.createElement("div", "poofnet-fields");
-                for (const key of visibleFields) {
-                    const row = this.createElement("div", "poofnet-field");
-                    this.appendTextElement(row, "span", "poofnet-field-key", `${key}:`);
-                    this.appendTextElement(row, "span", "poofnet-field-value", this.formatFieldValue(inst.data[key]));
-                    fields.appendChild(row);
-                }
-                if (fieldKeys.length > 4) {
-                    this.appendTextElement(fields, "div", "poofnet-field-more", `+${fieldKeys.length - 4} more fields`);
-                }
-                card.appendChild(fields);
-            }
-        }
-        return card;
-    }
     getModalStyles() {
         return `
       /* Ensure inert elements remain visible while being non-interactive */
@@ -723,130 +514,6 @@ class OffchainAuthProvider {
         flex: 1;
       }
 
-      .poofnet-summary {
-        font-size: 13px;
-        color: #6b7280;
-        margin-bottom: 12px;
-        text-align: center;
-      }
-
-      .poofnet-section {
-        margin-bottom: 16px;
-      }
-
-      .poofnet-section-title {
-        font-size: 12px;
-        font-weight: 600;
-        color: #666;
-        text-transform: uppercase;
-        letter-spacing: 0.5px;
-        margin: 0 0 8px;
-      }
-
-      .poofnet-instructions-list {
-        display: flex;
-        flex-direction: column;
-        gap: 10px;
-      }
-
-      .poofnet-instruction {
-        background: #f9fafb;
-        border-radius: 10px;
-        padding: 12px;
-        border-left: 3px solid #8b5cf6;
-      }
-
-      .poofnet-instruction.poofnet-action-delete {
-        border-left-color: #ef4444;
-      }
-
-      .poofnet-instruction-header {
-        display: flex;
-        align-items: center;
-        gap: 8px;
-        margin-bottom: 4px;
-      }
-
-      .poofnet-instruction-icon {
-        font-size: 16px;
-        flex-shrink: 0;
-      }
-
-      .poofnet-instruction-action {
-        font-size: 13px;
-        font-weight: 600;
-        color: #8b5cf6;
-      }
-
-      .poofnet-action-delete .poofnet-instruction-action {
-        color: #ef4444;
-      }
-
-      .poofnet-instruction-collection {
-        font-size: 13px;
-        font-weight: 500;
-        color: #374151;
-      }
-
-      .poofnet-instruction-id {
-        font-size: 11px;
-        color: #9ca3af;
-        font-family: monospace;
-        margin-bottom: 8px;
-        word-break: break-all;
-      }
-
-      .poofnet-fields {
-        background: white;
-        border-radius: 6px;
-        padding: 8px 10px;
-        margin-top: 8px;
-      }
-
-      .poofnet-field {
-        display: flex;
-        gap: 8px;
-        padding: 4px 0;
-        font-size: 12px;
-        border-bottom: 1px solid #f3f4f6;
-      }
-
-      .poofnet-field:last-child {
-        border-bottom: none;
-      }
-
-      .poofnet-field-key {
-        color: #6b7280;
-        font-weight: 500;
-        flex-shrink: 0;
-      }
-
-      .poofnet-field-value {
-        color: #374151;
-        word-break: break-all;
-      }
-
-      .poofnet-field-more {
-        font-size: 11px;
-        color: #9ca3af;
-        padding-top: 4px;
-        font-style: italic;
-      }
-
-      .poofnet-raw-message {
-        background: #f9fafb;
-        border-radius: 8px;
-        padding: 12px;
-        font-size: 11px;
-        font-family: monospace;
-        color: #4b5563;
-        white-space: pre-wrap;
-        word-break: break-all;
-        margin: 0;
-        max-height: 120px;
-        overflow-y: auto;
-      }
-
       .poofnet-info-box {
         display: flex;
         align-items: center;
@@ -895,15 +562,6 @@ class OffchainAuthProvider {
       .poofnet-btn-cancel:hover {
         background: #e5e7eb;
       }
-
-      .poofnet-btn-confirm {
-        background: #8b5cf6;
-        color: white;
-      }
-
-      .poofnet-btn-confirm:hover {
-        background: #7c3aed;
-      }
     `;
     }
 }
@@ -5172,9 +4830,18 @@ const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to pro
 // same tab (redirect + popup, or two popups) each own a distinct record, so a second
 // attempt cannot clobber the first's verifier/state/redirectUri.
 const PKCE_STORE_PREFIX = 'bounded.oidc.pkce';
+const STATE_PREFIX = 'bounded.';
+const LOGIN_TIMEOUT_MS = 10 * 60000;
+const CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description', 'iss'];
 function pkceKey(state) {
     return `${PKCE_STORE_PREFIX}.${state}`;
 }
+function removeAttempt(state) {
+    try {
+        sessionStorage.removeItem(pkceKey(state));
+    }
+    catch ( /* Storage may have been disabled mid-login. */_a) { /* Storage may have been disabled mid-login. */ }
+}
 const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 // Active session store (Web on web, RN on React Native) — selected by config,
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
@@ -5283,6 +4950,165 @@ async function makePkce() {
 function randomState() {
     return b64url(getPlatform().getRandomBytes(16));
 }
+let pendingCompletion;
+let loginReturnError;
+/** The last OAuth return failure in this initialization, or null. Initialization
+ * remains usable so the UI can display this error and offer a fresh sign-in. */
+function getLoginReturnError() {
+    return (loginReturnError === null || loginReturnError === void 0 ? void 0 : loginReturnError.generation) === getInitializationGeneration() ? loginReturnError.error : null;
+}
+// A hosted page can contain both an app bundle and the platform widget's SDK.
+// They share one code exchange, while adopting the session in their own registries.
+const COMPLETIONS = Symbol.for('bounded.oidc.completions');
+function cleanCallbackUrl(url) {
+    const clean = new URL(url);
+    for (const key of CALLBACK_PARAMS)
+        clean.searchParams.delete(key);
+    return clean;
+}
+async function validateAttempt(pkce, callback) {
+    const cfg = await core.getConfig();
+    if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
+        pkce.appId !== cfg.appId || pkce.issuer !== await issuerBase()) {
+        throw new Error('Login belongs to a different app or auth server. Start sign-in again.');
+    }
+    if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
+        throw new Error('Login expired. Start sign-in again.');
+    }
+    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+        (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
+        throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
+    }
+}
+// The receiver acknowledges only after checking origin, window and state. An
+// absent/disconnected opener must never leave a popup claiming success.
+async function handOffPopup(url, state) {
+    const cfg = await core.getConfig();
+    const issuer = await issuerBase();
+    const opener = window.opener;
+    if (!opener || opener === window || opener.closed) {
+        throw new Error('The original sign-in window is unavailable. Close this window and sign in again in the original tab.');
+    }
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { clearTimeout(timer); window.removeEventListener('message', onMessage); };
+        const onMessage = (event) => {
+            var _a;
+            if (event.source !== opener || event.origin !== url.origin ||
+                ((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) !== 'bounded-oidc-accepted' || event.data.state !== state)
+                return;
+            cleanup();
+            try {
+                window.close();
+            }
+            catch ( /* The opener also closes its own popup handle. */_b) { /* The opener also closes its own popup handle. */ }
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error('Could not reach the original sign-in tab. Close this window and start sign-in again.'));
+        }, 10000);
+        window.addEventListener('message', onMessage);
+        try {
+            opener.postMessage({ type: 'bounded-oidc-code', state, code: url.searchParams.get('code'),
+                error: url.searchParams.get('error'), errorDescription: url.searchParams.get('error_description'),
+                callbackUrl: url.href, appId: cfg.appId, issuer }, url.origin);
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
+    });
+}
+async function finishLoginReturn(url, state) {
+    try {
+        if (!/^bounded\.(popup|redirect)\.[A-Za-z0-9_-]{22}$/.test(state)) {
+            throw new Error('Invalid login state. Start sign-in again.');
+        }
+        if (state.startsWith('bounded.popup.')) {
+            await handOffPopup(url, state);
+            return { handled: true, user: null };
+        }
+        const raw = sessionStorage.getItem(pkceKey(state));
+        if (!raw)
+            throw new Error('Missing login attempt. Start sign-in again in this tab.');
+        const pkce = JSON.parse(raw);
+        if (pkce.state !== state)
+            throw new Error('OAuth state mismatch. Start sign-in again.');
+        await validateAttempt(pkce, url);
+        const error = url.searchParams.get('error');
+        if (error)
+            throw new Error(url.searchParams.get('error_description') || `Login failed: ${error}`);
+        const user = await exchangeCode(url.searchParams.get('code'), pkce);
+        return { handled: true, user, idToken: sessionManager().getIdToken() };
+    }
+    finally {
+        removeAttempt(state);
+        const clean = cleanCallbackUrl(url);
+        if (window.location.href === url.href) {
+            window.history.replaceState(window.history.state, document.title, clean.pathname + clean.search + clean.hash);
+        }
+    }
+}
+/** Internal initialization step. Unrelated OAuth callbacks are left untouched. */
+function completePendingLogin() {
+    if (!hasDOM$1())
+        return Promise.resolve({ handled: false, user: null });
+    const url = new URL(window.location.href);
+    const state = url.searchParams.get('state');
+    if (!(state === null || state === void 0 ? void 0 : state.startsWith(STATE_PREFIX)) || (!url.searchParams.get('code') && !url.searchParams.get('error'))) {
+        return Promise.resolve({ handled: false, user: null });
+    }
+    const generation = getInitializationGeneration();
+    if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.href) === url.href && pendingCompletion.generation === generation)
+        return pendingCompletion.promise;
+    const promise = finishSharedLoginReturn(url, state).catch((error) => {
+        loginReturnError = { generation, error: error instanceof Error ? error : new Error(String(error)) };
+        throw loginReturnError.error;
+    }).finally(() => {
+        if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.promise) === promise)
+            pendingCompletion = undefined;
+    });
+    pendingCompletion = { href: url.href, generation, promise };
+    return promise;
+}
+async function finishSharedLoginReturn(url, state) {
+    var _a;
+    var _b;
+    const cfg = await core.getConfig();
+    const issuer = await issuerBase();
+    if (state.startsWith('bounded.redirect.')) {
+        const raw = sessionStorage.getItem(pkceKey(state));
+        // A second SDK configured for another app/issuer on this page does not own
+        // this return. Leave its URL and proof available to the initiating app.
+        try {
+            const attempt = raw && JSON.parse(raw);
+            if (attempt && (attempt.appId !== cfg.appId || attempt.issuer !== issuer))
+                return { handled: false, user: null };
+        }
+        catch ( /* The owning completion reports malformed attempt data. */_c) { /* The owning completion reports malformed attempt data. */ }
+    }
+    const shared = (_a = (_b = window)[COMPLETIONS]) !== null && _a !== void 0 ? _a : (_b[COMPLETIONS] = new Map());
+    const key = JSON.stringify([url.href, cfg.appId, issuer]);
+    const existing = shared.get(key);
+    if (!existing) {
+        const completion = finishLoginReturn(url, state);
+        shared.set(key, completion);
+        return completion;
+    }
+    const generation = getInitializationGeneration();
+    const result = await existing;
+    if (result.user) {
+        if (!result.idToken || sessionManager().getIdToken() !== result.idToken) {
+            throw new Error('The completed login session has changed. Start sign-in again.');
+        }
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc',
+            user: Object.assign(Object.assign({}, result.user), { provider: oidcProviderSingleton }), beforeCommit: () => {
+                if (generation !== getInitializationGeneration())
+                    throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+            } });
+    }
+    return result;
+}
 function normalizeMethod(value) {
     const normalized = String(value || '').trim().toLowerCase();
     return /^[a-z0-9_-]{1,40}$/.test(normalized) ? normalized : null;
@@ -5325,7 +5151,8 @@ function appendHostedLoginHints(params, opts) {
 // native (expo-web-browser) path. The caller decides where the PkceState lives
 // (web → sessionStorage across the full-page redirect; native → in-memory across
 // the awaited browser session).
-async function buildAuthorize(opts) {
+async function buildAuthorize(opts, mode = 'redirect') {
+    loginReturnError = undefined;
     const cfg = await core.getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
@@ -5334,15 +5161,23 @@ async function buildAuthorize(opts) {
     const redirectUri = opts.redirectUri || (hasDOM$1() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
+    if (hasDOM$1()) {
+        const redirect = new URL(redirectUri);
+        if (redirect.origin !== window.location.origin || redirect.hash || CALLBACK_PARAMS.some((key) => redirect.searchParams.has(key))) {
+            throw new Error('redirectUri must be on this app origin, without a fragment or OAuth callback parameters.');
+        }
+    }
     const { verifier, challenge } = await makePkce();
-    const state = randomState();
+    const state = `${STATE_PREFIX}${mode}.${randomState()}`;
     const base = await issuerBase();
     const params = new URLSearchParams({
         client_id: cfg.appId, redirect_uri: redirectUri, response_type: 'code', scope: 'openid profile email',
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
+    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: {
+            verifier, state, redirectUri, appId: cfg.appId, issuer: base, createdAt: Date.now(),
+        } };
 }
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
@@ -5391,8 +5226,7 @@ function parseCallbackParams(callbackUrl) {
 }
 // Full native login: open the hosted page in the system auth session, await the
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
-// as web. Returns the signed-in User (native completes inline — there's no separate
-// completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
+// as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
     var _a, _b;
     const { url, pkce } = await buildAuthorize(opts);
@@ -5419,7 +5253,7 @@ async function runNativeLogin(opts) {
         if (!returnedState || returnedState !== pkce.state) {
             throw new Error('OAuth state mismatch — possible CSRF; aborting');
         }
-        return await exchangeCode(code, pkce.verifier, pkce.redirectUri);
+        return await exchangeCode(code, pkce);
     }
     finally {
         setAuthLoading(false);
@@ -5428,7 +5262,7 @@ async function runNativeLogin(opts) {
 /** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
  *
  *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
- *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *  unloads; init() completes the return to redirectUri automatically.
  *
  *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
@@ -5446,63 +5280,32 @@ async function loginWithRedirect(opts) {
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
     sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
-    setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
-    window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
-}
-/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
- *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *
- *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
- *  page to finish from. Calling it on RN is harmless. */
-async function completeLoginFromRedirect() {
-    if (!hasDOM$1())
-        return null;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const returnedState = url.searchParams.get('state');
-    if (!code)
-        return null;
-    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
-    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
-    // The opener is the same app/origin, so post to our own origin (the opener's message
-    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
-    if (window.opener && window.opener !== window) {
-        try {
-            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
-        }
-        catch ( /* ignore */_a) { /* ignore */ }
-        try {
-            window.close();
-        }
-        catch ( /* ignore */_b) { /* ignore */ }
-        return null;
-    }
+    // This promise represents dispatch, not authentication on the next page.
+    // Browsers can cancel navigation (for example at beforeunload) without firing
+    // pageshow. Never leave this document's SDK loading after dispatch settles.
     setAuthLoading(true);
     try {
-        // Read back the exact record THIS attempt wrote, keyed by the state the issuer
-        // returned, so a concurrent login's record is never consumed by mistake.
-        const raw = returnedState ? sessionStorage.getItem(pkceKey(returnedState)) : null;
-        if (!raw)
-            throw new Error('Missing PKCE state — start login with loginWithRedirect()');
-        const pkce = JSON.parse(raw);
-        if (!returnedState || returnedState !== pkce.state)
-            throw new Error('OAuth state mismatch — possible CSRF; aborting');
-        const user = await exchangeCode(code, pkce.verifier, pkce.redirectUri);
-        sessionStorage.removeItem(pkceKey(returnedState));
-        // Strip code/state from the URL so a reload doesn't re-exchange (codes are single-use anyway).
-        url.searchParams.delete('code');
-        url.searchParams.delete('state');
-        window.history.replaceState({}, document.title, url.pathname + url.search + url.hash);
-        return user;
+        window.location.href = url;
+    }
+    catch (error) {
+        removeAttempt(pkce.state);
+        throw error;
     }
     finally {
         setAuthLoading(false);
     }
 }
+/** Optional explicit completion. Normal apps only await init(), which already finishes login.
+ * Concurrent calls share one exchange. Returns null when no Bounded return is present. */
+async function completeLoginFromRedirect() {
+    const result = await completePendingLogin();
+    const error = getLoginReturnError();
+    if (error)
+        throw error;
+    return result.user;
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
- *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
+ *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
     if (!hasDOM$1())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -5521,7 +5324,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts);
+        authorization = await buildAuthorize(opts, 'popup');
     }
     catch (error) {
         try {
@@ -5556,6 +5359,7 @@ async function loginWithPopup(opts) {
             popup.location.href = url;
         }
         catch (_d) {
+            removeAttempt(pkce.state);
             try {
                 popup.close();
             }
@@ -5571,17 +5375,21 @@ async function loginWithPopup(opts) {
             let settled = false;
             let timer;
             let navigationTimer;
+            let completionTimer;
             const cleanup = () => {
                 settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
+                clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
+                removeAttempt(pkce.state);
             };
             const onMsg = async (ev) => {
-                if (ev.origin !== expectedOrigin)
-                    return; // only trust the redirect_uri origin
+                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                    return;
                 const d = ev.data;
-                if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
+                if (!d || d.type !== 'bounded-oidc-code' ||
+                    (typeof d.code !== 'string' && typeof d.error !== 'string'))
                     return;
                 // Validate state BEFORE tearing down this listener, against the record THIS
                 // attempt captured in the closure (`pkce`), not a shared sessionStorage reread.
@@ -5589,10 +5397,15 @@ async function loginWithPopup(opts) {
                 // stay registered for our own code, instead of cleaning up on another's message.
                 if (d.state !== pkce.state)
                     return;
+                if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
+                    return;
                 cleanup();
                 try {
-                    const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
-                    sessionStorage.removeItem(pkceKey(pkce.state));
+                    await validateAttempt(pkce, new URL(d.callbackUrl));
+                    popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
+                    if (d.error)
+                        throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
+                    const user = await exchangeCode(d.code, pkce);
                     try {
                         popup.close();
                     }
@@ -5600,10 +5413,22 @@ async function loginWithPopup(opts) {
                     resolve(user);
                 }
                 catch (e) {
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
                     reject(e);
                 }
             };
             window.addEventListener('message', onMsg);
+            completionTimer = setTimeout(() => {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+            }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
             // authorize URL. The old code then waited forever because the popup was
@@ -5661,33 +5486,20 @@ async function loginWithPopup(opts) {
         setAuthLoading(false);
     }
 }
-/** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
- *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
-function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$1() || !window.opener)
-        return;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const state = url.searchParams.get('state');
-    if (!code)
-        return;
-    try {
-        window.opener.postMessage({ type: 'bounded-oidc-code', code, state }, openerOrigin);
-    }
-    catch ( /* ignore */_a) { /* ignore */ }
-    try {
-        window.close();
-    }
-    catch ( /* ignore */_b) { /* ignore */ }
-}
-async function exchangeCode(code, verifier, redirectUri) {
-    const cfg = await core.getConfig();
-    const base = await issuerBase();
+async function exchangeCode(code, pkce) {
+    const generation = getInitializationGeneration();
+    const beforeCommit = () => {
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
+    await validateAttempt(pkce);
+    beforeCommit();
+    const base = pkce.issuer;
     // OIDC token endpoint: application/x-www-form-urlencoded (the standard). Public client (no
     // secret) authenticated by PKCE. The code is single-use + short-TTL on the server.
     const body = new URLSearchParams({
-        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
-        client_id: cfg.appId, code_verifier: verifier,
+        grant_type: 'authorization_code', code, redirect_uri: pkce.redirectUri,
+        client_id: pkce.appId, code_verifier: pkce.verifier,
     });
     let res;
     try {
@@ -5711,10 +5523,20 @@ async function exchangeCode(code, verifier, redirectUri) {
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    // Reinitialization while the request was in flight must not install this
+    // app's result under a different app's session manager/configuration.
+    beforeCommit();
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, beforeCommit);
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
-    await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user });
+    try {
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+    }
+    catch (error) {
+        if (typeof rollback === 'function')
+            await rollback();
+        throw error;
+    }
     // OIDC login does establish the issuer's Better Auth browser cookie. Record
     // that fact separately from the provider name so logout clears the cookie
     // and returns through the registered app origin. Stamped AFTER the adoption
@@ -6065,7 +5887,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-DCZ93FYg.js'); })).EmailAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./email-auth-provider-Czo-xM6n.js'); })).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6107,7 +5929,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-29eTkM-A.js'); });
+            const { InjectedWalletProvider } = await Promise.resolve().then(function () { return require('./injected-wallet-provider-C7Q0haGY.js'); });
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6120,7 +5942,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-BNu6Z-iN.js'); });
+            const { InjectedEvmWalletProvider } = await Promise.resolve().then(function () { return require('./injected-evm-wallet-provider-_UNpc_hM.js'); });
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6145,7 +5967,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider--Sqlucfr.js'); })).GuestAuthProvider();
+            currentAuthProvider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DJ5nCGjq.js'); })).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6207,7 +6029,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider--Sqlucfr.js'); })).GuestAuthProvider();
+    const provider = new (await Promise.resolve().then(function () { return require('./guest-auth-provider-DJ5nCGjq.js'); })).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6378,7 +6200,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await core.getConfig();
-            await Promise.resolve().then(function () { return require('./injected-wallet-provider-29eTkM-A.js'); });
+            await Promise.resolve().then(function () { return require('./injected-wallet-provider-C7Q0haGY.js'); });
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6661,6 +6483,10 @@ let authLoadingListeners = [];
 let initCompleted = false;
 let isAuthLoading = false;
 let authReadyPromise = null;
+let initializingConfig = null;
+let initializationGeneration = 0;
+/** Internal guard for a login result arriving after the app reconfigured the SDK. */
+function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
 async function initialize(newConfig) {
@@ -6686,6 +6512,19 @@ async function initialize(newConfig) {
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
         await core.init(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
+        // A return establishes its own provider/session, or hands off a popup.
+        // Restoring the old provider afterwards would overwrite the new login.
+        try {
+            if ((await completePendingLogin()).handled) {
+                initCompleted = true;
+                return;
+            }
+        }
+        catch (_a) {
+            // A cancelled/failed return is a login failure, not a broken SDK.
+            // The completion layer keeps it in getLoginReturnError(); restore
+            // any existing session and leave sign-in/readiness usable for retry.
+        }
         // Now that core is initialized, update the auth method on the config
         const authMethod = getCurrentAuthMethod();
         if (authMethod) {
@@ -6717,7 +6556,42 @@ async function initialize(newConfig) {
         setAuthLoading(false);
     }
 }
+// Compare data options by value, but preserve identity for callbacks and class
+// instances such as providers. Comparing only app/endpoints would silently drop
+// a concurrent change to wallet policy or provider configuration.
+function sameConfigValue(a, b, seen = new WeakMap()) {
+    var _a;
+    if (Object.is(a, b))
+        return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    if (Array.isArray(a) && a.length !== b.length)
+        return false;
+    if (!Array.isArray(a)) {
+        for (const value of [a, b]) {
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== null && ((_a = prototype.constructor) === null || _a === void 0 ? void 0 : _a.name) !== 'Object')
+                return false;
+        }
+    }
+    if (seen.has(a))
+        return seen.get(a) === b;
+    seen.set(a, b);
+    const left = Object.keys(a), right = Object.keys(b);
+    return left.length === right.length && left.every((key) => Object.prototype.hasOwnProperty.call(b, key)
+        && sameConfigValue(a[key], b[key], seen));
+}
 function init(newConfig) {
+    if (initializingConfig) {
+        if (sameConfigValue(initializingConfig, newConfig)) {
+            return authReadyPromise;
+        }
+        return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
+    }
+    initializingConfig = Object.assign({}, newConfig);
+    initializationGeneration++;
     let resolveReady;
     let rejectReady;
     const ready = new Promise((resolve, reject) => {
@@ -6728,7 +6602,7 @@ function init(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(newConfig).then(resolveReady, rejectReady);
+    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -8722,12 +8596,12 @@ exports.bs58 = bs58;
 exports.bufferExports = bufferExports;
 exports.builds = builds;
 exports.completeLoginFromRedirect = completeLoginFromRedirect;
-exports.completeLoginInPopup = completeLoginInPopup;
 exports.confirmAndCheckTransaction = confirmAndCheckTransaction;
 exports.getAuthLoading = getAuthLoading;
 exports.getAuthProvider = getAuthProvider;
 exports.getCurrentUser = getCurrentUser;
 exports.getIdToken = getIdToken;
+exports.getLoginReturnError = getLoginReturnError;
 exports.getPlatform = getPlatform;
 exports.getWallets = getWallets;
 exports.hasTurnkeyWallet = hasTurnkeyWallet;
@@ -8762,4 +8636,4 @@ exports.useAuth = useAuth;
 exports.useBuildRun = useBuildRun;
 exports.useQuery = useQuery;
 exports.waitForAuthReady = waitForAuthReady;
-//# sourceMappingURL=index.native-PGrxu7RO.js.map
+//# sourceMappingURL=index.native-BpcNwWQX.js.map