@bounded-sh/client 0.0.103 → 0.0.105

package/dist/{index.native-3T0IcOed.mjs → index.native-BSOqaKIz.mjs}

@@ -181,10 +181,14 @@ function getPlatform() {
 }
 
 /**
- * OffchainAuthProvider wraps a real auth provider (e.g., Phantom) for the poofnet environment.
+ * OffchainAuthProvider wraps a real auth provider (Turnkey, Phantom, ...) for the
+ * poofnet environment.
  *
- * signMessage shows a custom confirmation modal and then delegates to the wrapped
- * provider for a real detached signature over the exact offchain transaction message.
+ * Poofnet has no chain, but its onchain writes are still signed: the worker
+ * issues an unsendable approval message and verifies the wallet's signature
+ * before committing. So `signTransaction` and `signMessage` go straight to the
+ * wrapped wallet, whose own prompt is the only one the user sees. Only a raw
+ * submit - which needs a real cluster - is refused here.
  */
 class OffchainAuthProvider {
     constructor(wrappedProvider, config = {}) {
@@ -219,10 +223,7 @@ class OffchainAuthProvider {
         return null;
     }
     async signTransaction(tx) {
-        if (getPlatform().hasDOM) {
-            await this.showUnsupportedTransactionModal();
-        }
-        throw new Error('Poofnet does not support real Solana transactions. Deploy your project to mainnet to use this feature.');
+        return this.wrappedProvider.signTransaction(tx);
     }
     /**
      * Sign and submit transaction - not supported in poofnet environment.
@@ -247,21 +248,11 @@ class OffchainAuthProvider {
         }
         await this.wrappedProvider.exportWallet(address);
     }
-    // ============ signMessage delegates to wrapped provider ============
     async signMessage(message) {
         var _a, _b, _c, _d, _e, _f;
         (_b = (_a = this.config).onSigningStart) === null || _b === void 0 ? void 0 : _b.call(_a);
         try {
-            // On RN (no DOM), auto-confirm — there's no modal to show.
-            // On web, show the confirmation modal.
-            if (getPlatform().hasDOM) {
-                const confirmed = await this.showTransactionModal(message);
-                if (!confirmed) {
-                    throw new Error("Transaction rejected by user");
-                }
-            }
             const signature = await this.wrappedProvider.signMessage(message);
-            // Callback: signing complete
             (_d = (_c = this.config).onSigningComplete) === null || _d === void 0 ? void 0 : _d.call(_c, signature);
             return signature;
         }
@@ -352,99 +343,6 @@ class OffchainAuthProvider {
             document.addEventListener("keydown", escHandler);
         });
     }
-    async showTransactionModal(message) {
-        return new Promise((resolve) => {
-            // Parse the transaction message for display
-            let parsed = {};
-            try {
-                parsed = JSON.parse(message);
-            }
-            catch (_a) {
-                // If not JSON, just show raw message
-            }
-            // Create modal container. Captured in this closure so every teardown
-            // path acts on exactly this prompt, never on a newer one that may have
-            // replaced a shared field.
-            const container = document.createElement("div");
-            container.id = "poofnet-tx-modal";
-            container.appendChild(this.buildTransactionModalContent(parsed, message));
-            document.body.appendChild(container);
-            // Add styles
-            const style = document.createElement("style");
-            style.textContent = this.getModalStyles();
-            container.appendChild(style);
-            // Mark all OTHER body children as inert to disable focus traps from
-            // other modals, recording only the ones this modal changed (skipping
-            // any already-inert) so cleanup restores exactly what we set and never
-            // re-enables app-owned inert regions.
-            const selfInerted = [];
-            document.body.childNodes.forEach((child) => {
-                if (child !== container &&
-                    child instanceof HTMLElement &&
-                    !child.hasAttribute("inert")) {
-                    child.setAttribute("inert", "");
-                    selfInerted.push(child);
-                }
-            });
-            // Animate in
-            requestAnimationFrame(() => {
-                const overlay = container.querySelector(".poofnet-modal-overlay");
-                const content = container.querySelector(".poofnet-modal-content");
-                if (overlay)
-                    overlay.style.opacity = "1";
-                if (content) {
-                    content.style.opacity = "1";
-                    content.style.transform = "translateY(0)";
-                }
-            });
-            // Single idempotent teardown for every settlement path: removes the key
-            // handler, restores only self-added inert, and removes exactly this
-            // captured container after the exit animation.
-            let settled = false;
-            const escHandler = (e) => {
-                if (e.key === "Escape")
-                    settle(false);
-            };
-            const cleanup = () => {
-                if (settled)
-                    return;
-                settled = true;
-                document.removeEventListener("keydown", escHandler);
-                for (const el of selfInerted)
-                    el.removeAttribute("inert");
-                const overlay = container.querySelector(".poofnet-modal-overlay");
-                const content = container.querySelector(".poofnet-modal-content");
-                if (overlay)
-                    overlay.style.opacity = "0";
-                if (content) {
-                    content.style.opacity = "0";
-                    content.style.transform = "translateY(20px)";
-                }
-                setTimeout(() => container.remove(), 200);
-            };
-            const settle = (confirmed) => {
-                cleanup();
-                resolve(confirmed);
-            };
-            // Handle confirm
-            const confirmBtn = container.querySelector("#poofnet-confirm-btn");
-            confirmBtn === null || confirmBtn === void 0 ? void 0 : confirmBtn.addEventListener("click", () => settle(true));
-            // Handle cancel
-            const cancelBtn = container.querySelector("#poofnet-cancel-btn");
-            cancelBtn === null || cancelBtn === void 0 ? void 0 : cancelBtn.addEventListener("click", () => settle(false));
-            // Handle close button
-            const closeBtn = container.querySelector("#poofnet-close-btn");
-            closeBtn === null || closeBtn === void 0 ? void 0 : closeBtn.addEventListener("click", () => settle(false));
-            // Handle overlay click
-            const overlay = container.querySelector(".poofnet-modal-overlay");
-            overlay === null || overlay === void 0 ? void 0 : overlay.addEventListener("click", (e) => {
-                if (e.target === overlay)
-                    settle(false);
-            });
-            // Handle escape key
-            document.addEventListener("keydown", escHandler);
-        });
-    }
     createElement(tag, className, text) {
         const el = document.createElement(tag);
         if (className)
@@ -499,113 +397,6 @@ class OffchainAuthProvider {
         footer.appendChild(close);
         return overlay;
     }
-    formatPath(path) {
-        const parts = path.split("/").filter(Boolean);
-        if (parts.length >= 2) {
-            return {
-                collection: parts[0],
-                documentId: parts[parts.length - 1],
-            };
-        }
-        return { collection: parts[0] || path, documentId: null };
-    }
-    formatFieldValue(value) {
-        if (value === null || value === undefined)
-            return "null";
-        if (typeof value === "string") {
-            return value.length > 30
-                ? `"${value.slice(0, 30)}..."`
-                : `"${value}"`;
-        }
-        if (typeof value === "number" || typeof value === "boolean")
-            return String(value);
-        if (Array.isArray(value))
-            return `[${value.length} items]`;
-        if (typeof value === "object")
-            return `{${Object.keys(value).length} fields}`;
-        return String(value);
-    }
-    getActionDescription(type, collection, isNew) {
-        if (type === "delete")
-            return `Delete from ${collection}`;
-        return isNew ? `Create in ${collection}` : `Update ${collection}`;
-    }
-    buildTransactionModalContent(parsed, rawMessage) {
-        const instructions = parsed.instructions || [];
-        // Group instructions by type for summary
-        const sets = instructions.filter((i) => i.type === "set");
-        const deletes = instructions.filter((i) => i.type === "delete");
-        // Create summary text
-        let summaryText = "";
-        if (sets.length > 0 && deletes.length > 0) {
-            summaryText = `${sets.length} update${sets.length > 1 ? "s" : ""}, ${deletes.length} delete${deletes.length > 1 ? "s" : ""}`;
-        }
-        else if (sets.length > 0) {
-            summaryText = `${sets.length} update${sets.length > 1 ? "s" : ""}`;
-        }
-        else if (deletes.length > 0) {
-            summaryText = `${deletes.length} delete${deletes.length > 1 ? "s" : ""}`;
-        }
-        const { overlay, body, footer } = this.buildModalShell("🔐", "Confirm Transaction");
-        if (instructions.length > 0) {
-            if (summaryText) {
-                this.appendTextElement(body, "div", "poofnet-summary", summaryText);
-            }
-            const list = this.createElement("div", "poofnet-instructions-list");
-            for (const inst of instructions) {
-                list.appendChild(this.buildInstructionElement(inst));
-            }
-            body.appendChild(list);
-        }
-        else {
-            const section = this.createElement("div", "poofnet-section");
-            this.appendTextElement(section, "h3", "poofnet-section-title", "Message");
-            const raw = this.createElement("pre", "poofnet-raw-message", rawMessage.slice(0, 200) + (rawMessage.length > 200 ? "..." : ""));
-            section.appendChild(raw);
-            body.appendChild(section);
-        }
-        body.appendChild(this.buildInfoBox("This is a simulated transaction. No real fees will be charged."));
-        const cancel = this.createElement("button", "poofnet-btn poofnet-btn-cancel", "Cancel");
-        cancel.id = "poofnet-cancel-btn";
-        cancel.type = "button";
-        footer.appendChild(cancel);
-        const confirm = this.createElement("button", "poofnet-btn poofnet-btn-confirm", "Confirm");
-        confirm.id = "poofnet-confirm-btn";
-        confirm.type = "button";
-        footer.appendChild(confirm);
-        return overlay;
-    }
-    buildInstructionElement(inst) {
-        const { collection, documentId } = this.formatPath(inst.path);
-        const isDelete = inst.type === "delete";
-        const card = this.createElement("div", `poofnet-instruction ${isDelete ? "poofnet-action-delete" : "poofnet-action-set"}`);
-        const header = this.createElement("div", "poofnet-instruction-header");
-        this.appendTextElement(header, "span", "poofnet-instruction-icon", isDelete ? "🗑️" : "✏️");
-        this.appendTextElement(header, "span", "poofnet-instruction-action", isDelete ? "Delete" : "Save");
-        this.appendTextElement(header, "span", "poofnet-instruction-collection", collection);
-        card.appendChild(header);
-        if (documentId) {
-            this.appendTextElement(card, "div", "poofnet-instruction-id", `ID: ${documentId}`);
-        }
-        if (inst.data && !isDelete) {
-            const fieldKeys = Object.keys(inst.data).filter((key) => !key.startsWith("_"));
-            const visibleFields = fieldKeys.slice(0, 4);
-            if (visibleFields.length > 0) {
-                const fields = this.createElement("div", "poofnet-fields");
-                for (const key of visibleFields) {
-                    const row = this.createElement("div", "poofnet-field");
-                    this.appendTextElement(row, "span", "poofnet-field-key", `${key}:`);
-                    this.appendTextElement(row, "span", "poofnet-field-value", this.formatFieldValue(inst.data[key]));
-                    fields.appendChild(row);
-                }
-                if (fieldKeys.length > 4) {
-                    this.appendTextElement(fields, "div", "poofnet-field-more", `+${fieldKeys.length - 4} more fields`);
-                }
-                card.appendChild(fields);
-            }
-        }
-        return card;
-    }
     getModalStyles() {
         return `
       /* Ensure inert elements remain visible while being non-interactive */
@@ -702,130 +493,6 @@ class OffchainAuthProvider {
         flex: 1;
       }
 
-      .poofnet-summary {
-        font-size: 13px;
-        color: #6b7280;
-        margin-bottom: 12px;
-        text-align: center;
-      }
-
-      .poofnet-section {
-        margin-bottom: 16px;
-      }
-
-      .poofnet-section-title {
-        font-size: 12px;
-        font-weight: 600;
-        color: #666;
-        text-transform: uppercase;
-        letter-spacing: 0.5px;
-        margin: 0 0 8px;
-      }
-
-      .poofnet-instructions-list {
-        display: flex;
-        flex-direction: column;
-        gap: 10px;
-      }
-
-      .poofnet-instruction {
-        background: #f9fafb;
-        border-radius: 10px;
-        padding: 12px;
-        border-left: 3px solid #8b5cf6;
-      }
-
-      .poofnet-instruction.poofnet-action-delete {
-        border-left-color: #ef4444;
-      }
-
-      .poofnet-instruction-header {
-        display: flex;
-        align-items: center;
-        gap: 8px;
-        margin-bottom: 4px;
-      }
-
-      .poofnet-instruction-icon {
-        font-size: 16px;
-        flex-shrink: 0;
-      }
-
-      .poofnet-instruction-action {
-        font-size: 13px;
-        font-weight: 600;
-        color: #8b5cf6;
-      }
-
-      .poofnet-action-delete .poofnet-instruction-action {
-        color: #ef4444;
-      }
-
-      .poofnet-instruction-collection {
-        font-size: 13px;
-        font-weight: 500;
-        color: #374151;
-      }
-
-      .poofnet-instruction-id {
-        font-size: 11px;
-        color: #9ca3af;
-        font-family: monospace;
-        margin-bottom: 8px;
-        word-break: break-all;
-      }
-
-      .poofnet-fields {
-        background: white;
-        border-radius: 6px;
-        padding: 8px 10px;
-        margin-top: 8px;
-      }
-
-      .poofnet-field {
-        display: flex;
-        gap: 8px;
-        padding: 4px 0;
-        font-size: 12px;
-        border-bottom: 1px solid #f3f4f6;
-      }
-
-      .poofnet-field:last-child {
-        border-bottom: none;
-      }
-
-      .poofnet-field-key {
-        color: #6b7280;
-        font-weight: 500;
-        flex-shrink: 0;
-      }
-
-      .poofnet-field-value {
-        color: #374151;
-        word-break: break-all;
-      }
-
-      .poofnet-field-more {
-        font-size: 11px;
-        color: #9ca3af;
-        padding-top: 4px;
-        font-style: italic;
-      }
-
-      .poofnet-raw-message {
-        background: #f9fafb;
-        border-radius: 8px;
-        padding: 12px;
-        font-size: 11px;
-        font-family: monospace;
-        color: #4b5563;
-        white-space: pre-wrap;
-        word-break: break-all;
-        margin: 0;
-        max-height: 120px;
-        overflow-y: auto;
-      }
-
       .poofnet-info-box {
         display: flex;
         align-items: center;
@@ -874,15 +541,6 @@ class OffchainAuthProvider {
       .poofnet-btn-cancel:hover {
         background: #e5e7eb;
       }
-
-      .poofnet-btn-confirm {
-        background: #8b5cf6;
-        color: white;
-      }
-
-      .poofnet-btn-confirm:hover {
-        background: #7c3aed;
-      }
     `;
     }
 }
@@ -5151,9 +4809,18 @@ const OIDC_NO_WALLET = 'This session has no Turnkey wallet. Sign in again to pro
 // same tab (redirect + popup, or two popups) each own a distinct record, so a second
 // attempt cannot clobber the first's verifier/state/redirectUri.
 const PKCE_STORE_PREFIX = 'bounded.oidc.pkce';
+const STATE_PREFIX = 'bounded.';
+const LOGIN_TIMEOUT_MS = 10 * 60000;
+const CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description', 'iss'];
 function pkceKey(state) {
     return `${PKCE_STORE_PREFIX}.${state}`;
 }
+function removeAttempt(state) {
+    try {
+        sessionStorage.removeItem(pkceKey(state));
+    }
+    catch ( /* Storage may have been disabled mid-login. */_a) { /* Storage may have been disabled mid-login. */ }
+}
 const ISSUER_SESSION_KIND_KEY = 'bounded_issuer_session_kind';
 // Active session store (Web on web, RN on React Native) — selected by config,
 // not by `typeof window` (truthy on RN). OIDC redirect/popup is web-only, but the
@@ -5262,6 +4929,165 @@ async function makePkce() {
 function randomState() {
     return b64url(getPlatform().getRandomBytes(16));
 }
+let pendingCompletion;
+let loginReturnError;
+/** The last OAuth return failure in this initialization, or null. Initialization
+ * remains usable so the UI can display this error and offer a fresh sign-in. */
+function getLoginReturnError() {
+    return (loginReturnError === null || loginReturnError === void 0 ? void 0 : loginReturnError.generation) === getInitializationGeneration() ? loginReturnError.error : null;
+}
+// A hosted page can contain both an app bundle and the platform widget's SDK.
+// They share one code exchange, while adopting the session in their own registries.
+const COMPLETIONS = Symbol.for('bounded.oidc.completions');
+function cleanCallbackUrl(url) {
+    const clean = new URL(url);
+    for (const key of CALLBACK_PARAMS)
+        clean.searchParams.delete(key);
+    return clean;
+}
+async function validateAttempt(pkce, callback) {
+    const cfg = await getConfig();
+    if (!pkce || typeof pkce.verifier !== 'string' || !pkce.verifier ||
+        pkce.appId !== cfg.appId || pkce.issuer !== await issuerBase()) {
+        throw new Error('Login belongs to a different app or auth server. Start sign-in again.');
+    }
+    if (!Number.isFinite(pkce.createdAt) || Date.now() - pkce.createdAt > LOGIN_TIMEOUT_MS || pkce.createdAt > Date.now()) {
+        throw new Error('Login expired. Start sign-in again.');
+    }
+    if (callback && (cleanCallbackUrl(callback).href !== cleanCallbackUrl(new URL(pkce.redirectUri)).href ||
+        (callback.searchParams.has('iss') && callback.searchParams.get('iss') !== pkce.issuer))) {
+        throw new Error('Login returned to a different address or from a different auth server. Start sign-in again.');
+    }
+}
+// The receiver acknowledges only after checking origin, window and state. An
+// absent/disconnected opener must never leave a popup claiming success.
+async function handOffPopup(url, state) {
+    const cfg = await getConfig();
+    const issuer = await issuerBase();
+    const opener = window.opener;
+    if (!opener || opener === window || opener.closed) {
+        throw new Error('The original sign-in window is unavailable. Close this window and sign in again in the original tab.');
+    }
+    return new Promise((resolve, reject) => {
+        const cleanup = () => { clearTimeout(timer); window.removeEventListener('message', onMessage); };
+        const onMessage = (event) => {
+            var _a;
+            if (event.source !== opener || event.origin !== url.origin ||
+                ((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) !== 'bounded-oidc-accepted' || event.data.state !== state)
+                return;
+            cleanup();
+            try {
+                window.close();
+            }
+            catch ( /* The opener also closes its own popup handle. */_b) { /* The opener also closes its own popup handle. */ }
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error('Could not reach the original sign-in tab. Close this window and start sign-in again.'));
+        }, 10000);
+        window.addEventListener('message', onMessage);
+        try {
+            opener.postMessage({ type: 'bounded-oidc-code', state, code: url.searchParams.get('code'),
+                error: url.searchParams.get('error'), errorDescription: url.searchParams.get('error_description'),
+                callbackUrl: url.href, appId: cfg.appId, issuer }, url.origin);
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
+    });
+}
+async function finishLoginReturn(url, state) {
+    try {
+        if (!/^bounded\.(popup|redirect)\.[A-Za-z0-9_-]{22}$/.test(state)) {
+            throw new Error('Invalid login state. Start sign-in again.');
+        }
+        if (state.startsWith('bounded.popup.')) {
+            await handOffPopup(url, state);
+            return { handled: true, user: null };
+        }
+        const raw = sessionStorage.getItem(pkceKey(state));
+        if (!raw)
+            throw new Error('Missing login attempt. Start sign-in again in this tab.');
+        const pkce = JSON.parse(raw);
+        if (pkce.state !== state)
+            throw new Error('OAuth state mismatch. Start sign-in again.');
+        await validateAttempt(pkce, url);
+        const error = url.searchParams.get('error');
+        if (error)
+            throw new Error(url.searchParams.get('error_description') || `Login failed: ${error}`);
+        const user = await exchangeCode(url.searchParams.get('code'), pkce);
+        return { handled: true, user, idToken: sessionManager().getIdToken() };
+    }
+    finally {
+        removeAttempt(state);
+        const clean = cleanCallbackUrl(url);
+        if (window.location.href === url.href) {
+            window.history.replaceState(window.history.state, document.title, clean.pathname + clean.search + clean.hash);
+        }
+    }
+}
+/** Internal initialization step. Unrelated OAuth callbacks are left untouched. */
+function completePendingLogin() {
+    if (!hasDOM$1())
+        return Promise.resolve({ handled: false, user: null });
+    const url = new URL(window.location.href);
+    const state = url.searchParams.get('state');
+    if (!(state === null || state === void 0 ? void 0 : state.startsWith(STATE_PREFIX)) || (!url.searchParams.get('code') && !url.searchParams.get('error'))) {
+        return Promise.resolve({ handled: false, user: null });
+    }
+    const generation = getInitializationGeneration();
+    if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.href) === url.href && pendingCompletion.generation === generation)
+        return pendingCompletion.promise;
+    const promise = finishSharedLoginReturn(url, state).catch((error) => {
+        loginReturnError = { generation, error: error instanceof Error ? error : new Error(String(error)) };
+        throw loginReturnError.error;
+    }).finally(() => {
+        if ((pendingCompletion === null || pendingCompletion === void 0 ? void 0 : pendingCompletion.promise) === promise)
+            pendingCompletion = undefined;
+    });
+    pendingCompletion = { href: url.href, generation, promise };
+    return promise;
+}
+async function finishSharedLoginReturn(url, state) {
+    var _a;
+    var _b;
+    const cfg = await getConfig();
+    const issuer = await issuerBase();
+    if (state.startsWith('bounded.redirect.')) {
+        const raw = sessionStorage.getItem(pkceKey(state));
+        // A second SDK configured for another app/issuer on this page does not own
+        // this return. Leave its URL and proof available to the initiating app.
+        try {
+            const attempt = raw && JSON.parse(raw);
+            if (attempt && (attempt.appId !== cfg.appId || attempt.issuer !== issuer))
+                return { handled: false, user: null };
+        }
+        catch ( /* The owning completion reports malformed attempt data. */_c) { /* The owning completion reports malformed attempt data. */ }
+    }
+    const shared = (_a = (_b = window)[COMPLETIONS]) !== null && _a !== void 0 ? _a : (_b[COMPLETIONS] = new Map());
+    const key = JSON.stringify([url.href, cfg.appId, issuer]);
+    const existing = shared.get(key);
+    if (!existing) {
+        const completion = finishLoginReturn(url, state);
+        shared.set(key, completion);
+        return completion;
+    }
+    const generation = getInitializationGeneration();
+    const result = await existing;
+    if (result.user) {
+        if (!result.idToken || sessionManager().getIdToken() !== result.idToken) {
+            throw new Error('The completed login session has changed. Start sign-in again.');
+        }
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc',
+            user: Object.assign(Object.assign({}, result.user), { provider: oidcProviderSingleton }), beforeCommit: () => {
+                if (generation !== getInitializationGeneration())
+                    throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+            } });
+    }
+    return result;
+}
 function normalizeMethod(value) {
     const normalized = String(value || '').trim().toLowerCase();
     return /^[a-z0-9_-]{1,40}$/.test(normalized) ? normalized : null;
@@ -5304,7 +5130,8 @@ function appendHostedLoginHints(params, opts) {
 // native (expo-web-browser) path. The caller decides where the PkceState lives
 // (web → sessionStorage across the full-page redirect; native → in-memory across
 // the awaited browser session).
-async function buildAuthorize(opts) {
+async function buildAuthorize(opts, mode = 'redirect') {
+    loginReturnError = undefined;
     const cfg = await getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
@@ -5313,15 +5140,23 @@ async function buildAuthorize(opts) {
     const redirectUri = opts.redirectUri || (hasDOM$1() ? window.location.origin + window.location.pathname : undefined);
     if (!redirectUri)
         throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
+    if (hasDOM$1()) {
+        const redirect = new URL(redirectUri);
+        if (redirect.origin !== window.location.origin || redirect.hash || CALLBACK_PARAMS.some((key) => redirect.searchParams.has(key))) {
+            throw new Error('redirectUri must be on this app origin, without a fragment or OAuth callback parameters.');
+        }
+    }
     const { verifier, challenge } = await makePkce();
-    const state = randomState();
+    const state = `${STATE_PREFIX}${mode}.${randomState()}`;
     const base = await issuerBase();
     const params = new URLSearchParams({
         client_id: cfg.appId, redirect_uri: redirectUri, response_type: 'code', scope: 'openid profile email',
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
+    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: {
+            verifier, state, redirectUri, appId: cfg.appId, issuer: base, createdAt: Date.now(),
+        } };
 }
 // Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
 // expo-web-browser driver vs. the web full-page-redirect/popup driver.
@@ -5370,8 +5205,7 @@ function parseCallbackParams(callbackUrl) {
 }
 // Full native login: open the hosted page in the system auth session, await the
 // universal-link callback, verify state, and run the SAME PKCE code→token exchange
-// as web. Returns the signed-in User (native completes inline — there's no separate
-// completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
+// as web. Returns the signed-in User inline; web redirects complete on the next init().
 async function runNativeLogin(opts) {
     var _a, _b;
     const { url, pkce } = await buildAuthorize(opts);
@@ -5398,7 +5232,7 @@ async function runNativeLogin(opts) {
         if (!returnedState || returnedState !== pkce.state) {
             throw new Error('OAuth state mismatch — possible CSRF; aborting');
         }
-        return await exchangeCode(code, pkce.verifier, pkce.redirectUri);
+        return await exchangeCode(code, pkce);
     }
     finally {
         setAuthLoading(false);
@@ -5407,7 +5241,7 @@ async function runNativeLogin(opts) {
 /** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
  *
  *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
- *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *  unloads; init() completes the return to redirectUri automatically.
  *
  *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
  *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
@@ -5425,63 +5259,32 @@ async function loginWithRedirect(opts) {
     // is per-tab and cleared on close — appropriate for a short-lived auth handshake. Keyed by
     // this attempt's own state so a second concurrent login cannot overwrite it.
     sessionStorage.setItem(pkceKey(pkce.state), JSON.stringify(pkce));
-    setAuthLoading(true); // reflect "signing in…" right up to navigation; the return page's
-    window.location.href = url; // completeLoginFromRedirect() keeps it true until the user resolves.
-}
-/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
- *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
- *
- *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
- *  loginWithRedirect() (which resolves with the User), so there is no separate redirect
- *  page to finish from. Calling it on RN is harmless. */
-async function completeLoginFromRedirect() {
-    if (!hasDOM$1())
-        return null;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const returnedState = url.searchParams.get('state');
-    if (!code)
-        return null;
-    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
-    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
-    // The opener is the same app/origin, so post to our own origin (the opener's message
-    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
-    if (window.opener && window.opener !== window) {
-        try {
-            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
-        }
-        catch ( /* ignore */_a) { /* ignore */ }
-        try {
-            window.close();
-        }
-        catch ( /* ignore */_b) { /* ignore */ }
-        return null;
-    }
+    // This promise represents dispatch, not authentication on the next page.
+    // Browsers can cancel navigation (for example at beforeunload) without firing
+    // pageshow. Never leave this document's SDK loading after dispatch settles.
     setAuthLoading(true);
     try {
-        // Read back the exact record THIS attempt wrote, keyed by the state the issuer
-        // returned, so a concurrent login's record is never consumed by mistake.
-        const raw = returnedState ? sessionStorage.getItem(pkceKey(returnedState)) : null;
-        if (!raw)
-            throw new Error('Missing PKCE state — start login with loginWithRedirect()');
-        const pkce = JSON.parse(raw);
-        if (!returnedState || returnedState !== pkce.state)
-            throw new Error('OAuth state mismatch — possible CSRF; aborting');
-        const user = await exchangeCode(code, pkce.verifier, pkce.redirectUri);
-        sessionStorage.removeItem(pkceKey(returnedState));
-        // Strip code/state from the URL so a reload doesn't re-exchange (codes are single-use anyway).
-        url.searchParams.delete('code');
-        url.searchParams.delete('state');
-        window.history.replaceState({}, document.title, url.pathname + url.search + url.hash);
-        return user;
+        window.location.href = url;
+    }
+    catch (error) {
+        removeAttempt(pkce.state);
+        throw error;
     }
     finally {
         setAuthLoading(false);
     }
 }
+/** Optional explicit completion. Normal apps only await init(), which already finishes login.
+ * Concurrent calls share one exchange. Returns null when no Bounded return is present. */
+async function completeLoginFromRedirect() {
+    const result = await completePendingLogin();
+    const error = getLoginReturnError();
+    if (error)
+        throw error;
+    return result.user;
+}
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
- *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
+ *  redirect_uri page initializes the SDK, which hands the code back automatically. */
 async function loginWithPopup(opts) {
     if (!hasDOM$1())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -5500,7 +5303,7 @@ async function loginWithPopup(opts) {
         throw new Error('Popup blocked — use loginWithRedirect() instead');
     let authorization;
     try {
-        authorization = await buildAuthorize(opts);
+        authorization = await buildAuthorize(opts, 'popup');
     }
     catch (error) {
         try {
@@ -5535,6 +5338,7 @@ async function loginWithPopup(opts) {
             popup.location.href = url;
         }
         catch (_d) {
+            removeAttempt(pkce.state);
             try {
                 popup.close();
             }
@@ -5550,17 +5354,21 @@ async function loginWithPopup(opts) {
             let settled = false;
             let timer;
             let navigationTimer;
+            let completionTimer;
             const cleanup = () => {
                 settled = true;
                 clearInterval(timer);
                 clearTimeout(navigationTimer);
+                clearTimeout(completionTimer);
                 window.removeEventListener('message', onMsg);
+                removeAttempt(pkce.state);
             };
             const onMsg = async (ev) => {
-                if (ev.origin !== expectedOrigin)
-                    return; // only trust the redirect_uri origin
+                if (settled || ev.origin !== expectedOrigin || ev.source !== popup)
+                    return;
                 const d = ev.data;
-                if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
+                if (!d || d.type !== 'bounded-oidc-code' ||
+                    (typeof d.code !== 'string' && typeof d.error !== 'string'))
                     return;
                 // Validate state BEFORE tearing down this listener, against the record THIS
                 // attempt captured in the closure (`pkce`), not a shared sessionStorage reread.
@@ -5568,10 +5376,15 @@ async function loginWithPopup(opts) {
                 // stay registered for our own code, instead of cleaning up on another's message.
                 if (d.state !== pkce.state)
                     return;
+                if (d.appId !== pkce.appId || d.issuer !== pkce.issuer)
+                    return;
                 cleanup();
                 try {
-                    const user = await exchangeCode(d.code, pkce.verifier, pkce.redirectUri);
-                    sessionStorage.removeItem(pkceKey(pkce.state));
+                    await validateAttempt(pkce, new URL(d.callbackUrl));
+                    popup.postMessage({ type: 'bounded-oidc-accepted', state: pkce.state }, expectedOrigin);
+                    if (d.error)
+                        throw new Error(typeof d.errorDescription === 'string' ? d.errorDescription : `Login failed: ${d.error}`);
+                    const user = await exchangeCode(d.code, pkce);
                     try {
                         popup.close();
                     }
@@ -5579,10 +5392,22 @@ async function loginWithPopup(opts) {
                     resolve(user);
                 }
                 catch (e) {
+                    try {
+                        popup.close();
+                    }
+                    catch ( /* ignore */_b) { /* ignore */ }
                     reject(e);
                 }
             };
             window.addEventListener('message', onMsg);
+            completionTimer = setTimeout(() => {
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                reject(new Error('Login expired or its popup disconnected. Start sign-in again.'));
+            }, LOGIN_TIMEOUT_MS);
             // Some browser/extension combinations can return a real popup handle but
             // strand the window at about:blank instead of navigating to the hosted
             // authorize URL. The old code then waited forever because the popup was
@@ -5640,33 +5465,20 @@ async function loginWithPopup(opts) {
         setAuthLoading(false);
     }
 }
-/** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
- *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */
-function completeLoginInPopup(openerOrigin) {
-    if (!hasDOM$1() || !window.opener)
-        return;
-    const url = new URL(window.location.href);
-    const code = url.searchParams.get('code');
-    const state = url.searchParams.get('state');
-    if (!code)
-        return;
-    try {
-        window.opener.postMessage({ type: 'bounded-oidc-code', code, state }, openerOrigin);
-    }
-    catch ( /* ignore */_a) { /* ignore */ }
-    try {
-        window.close();
-    }
-    catch ( /* ignore */_b) { /* ignore */ }
-}
-async function exchangeCode(code, verifier, redirectUri) {
-    const cfg = await getConfig();
-    const base = await issuerBase();
+async function exchangeCode(code, pkce) {
+    const generation = getInitializationGeneration();
+    const beforeCommit = () => {
+        if (generation !== getInitializationGeneration())
+            throw new Error('Login was superseded by SDK reinitialization. Start sign-in again.');
+    };
+    await validateAttempt(pkce);
+    beforeCommit();
+    const base = pkce.issuer;
     // OIDC token endpoint: application/x-www-form-urlencoded (the standard). Public client (no
     // secret) authenticated by PKCE. The code is single-use + short-TTL on the server.
     const body = new URLSearchParams({
-        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
-        client_id: cfg.appId, code_verifier: verifier,
+        grant_type: 'authorization_code', code, redirect_uri: pkce.redirectUri,
+        client_id: pkce.appId, code_verifier: pkce.verifier,
     });
     let res;
     try {
@@ -5690,10 +5502,20 @@ async function exchangeCode(code, verifier, redirectUri) {
     const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
     const refreshToken = boundedRefreshTokenField(data);
     const user = userFromIdToken(idToken);
-    await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base);
+    // Reinitialization while the request was in flight must not install this
+    // app's result under a different app's session manager/configuration.
+    beforeCommit();
+    const rollback = await sessionManager().storeSession(String(user.address || ''), accessToken, idToken, refreshToken, base, beforeCommit);
     // Adopt on EVERY session surface (see establishInlineSession) - hosted
     // popup/redirect completions all land here, so this closes their gap too.
-    await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user });
+    try {
+        await adoptSessionProvider({ provider: oidcProviderSingleton, method: 'email', configKey: 'direct:oidc', user, beforeCommit });
+    }
+    catch (error) {
+        if (typeof rollback === 'function')
+            await rollback();
+        throw error;
+    }
     // OIDC login does establish the issuer's Better Auth browser cookie. Record
     // that fact separately from the provider name so logout clears the cookie
     // and returns through the registered app origin. Stamped AFTER the adoption
@@ -6044,7 +5866,7 @@ async function getAuthProvider(config) {
             // manager as legacy email sessions. Human login should be started
             // with loginWithRedirect(); this provider is kept as the restore and
             // logout surface for those sessions.
-            currentAuthProvider = new (await import('./email-auth-provider-Ct3YA68i.mjs')).EmailAuthProvider();
+            currentAuthProvider = new (await import('./email-auth-provider-D9SQu9c1.mjs')).EmailAuthProvider();
             break;
         case "phantom": {
             // First-class Solana WALLET LOGIN (the poof/TaroBase-style "connect
@@ -6086,7 +5908,7 @@ async function getAuthProvider(config) {
             // (bounded-login-widget.ts), so registration never counts as
             // evidence the user has a wallet.
             await ensureSolanaMobileWalletRegistered(config, configuredNetwork);
-            const { InjectedWalletProvider } = await import('./injected-wallet-provider-BnmYbm79.mjs');
+            const { InjectedWalletProvider } = await import('./injected-wallet-provider-DZOwvKgd.mjs');
             currentAuthProvider = new InjectedWalletProvider(resolveInjectedWalletConfig(config), rpcUrl, configuredNetwork);
             break;
         }
@@ -6099,7 +5921,7 @@ async function getAuthProvider(config) {
             // Selecting authMethod:'evm-wallet' IS the opt-in — pass evmWalletConfig
             // to point at a specific wallet or set chainId/domain.
             const evmWalletConfig = ((_a = config.evmWalletConfig) !== null && _a !== void 0 ? _a : {});
-            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-C8rBnyO1.mjs');
+            const { InjectedEvmWalletProvider } = await import('./injected-evm-wallet-provider-Xb2G-ZGI.mjs');
             currentAuthProvider = new InjectedEvmWalletProvider(evmWalletConfig);
             break;
         }
@@ -6124,7 +5946,7 @@ async function getAuthProvider(config) {
             break;
         case "guest":
             // Anonymous auth: a device-local ed25519 keypair signs the challenge.
-            currentAuthProvider = new (await import('./guest-auth-provider-DMtDTZeA.mjs')).GuestAuthProvider();
+            currentAuthProvider = new (await import('./guest-auth-provider-DsFTB844.mjs')).GuestAuthProvider();
             break;
     }
     if (!currentAuthProvider) {
@@ -6186,7 +6008,7 @@ async function signInAnonymously() {
     // Lazy-load the guest provider so its ed25519/web3 dependencies stay out of
     // the main bundle for data-only apps. Specifier is a static string literal
     // so bundle-splitting can see it.
-    const provider = new (await import('./guest-auth-provider-DMtDTZeA.mjs')).GuestAuthProvider();
+    const provider = new (await import('./guest-auth-provider-DsFTB844.mjs')).GuestAuthProvider();
     setAuthLoading(true); // reflect "signing in…" while the guest keypair session is minted
     // adoptSessionProvider awaits only getConfig() (already resolved here) and then
     // runs every write - provider/method/config/marker/user - in one synchronous
@@ -6357,7 +6179,7 @@ function ensureSharedWalletLoginReady() {
     if (!sharedWalletReady) {
         sharedWalletReady = (async () => {
             await getConfig();
-            await import('./injected-wallet-provider-BnmYbm79.mjs');
+            await import('./injected-wallet-provider-DZOwvKgd.mjs');
         })().catch((error) => {
             sharedWalletReady = null;
             throw error;
@@ -6640,6 +6462,10 @@ let authLoadingListeners = [];
 let initCompleted = false;
 let isAuthLoading = false;
 let authReadyPromise = null;
+let initializingConfig = null;
+let initializationGeneration = 0;
+/** Internal guard for a login result arriving after the app reconfigured the SDK. */
+function getInitializationGeneration() { return initializationGeneration; }
 // This file acts as a middleware for the global state of the SDK
 // This mostly involves setting up the AuthProvider and managing the current user
 async function initialize(newConfig) {
@@ -6665,6 +6491,19 @@ async function initialize(newConfig) {
         authProviderInstance = await getAuthProvider(newConfig);
         // Initialize config with auth provider
         await init$1(Object.assign(Object.assign({}, newConfig), { authProvider: authProviderInstance }));
+        // A return establishes its own provider/session, or hands off a popup.
+        // Restoring the old provider afterwards would overwrite the new login.
+        try {
+            if ((await completePendingLogin()).handled) {
+                initCompleted = true;
+                return;
+            }
+        }
+        catch (_a) {
+            // A cancelled/failed return is a login failure, not a broken SDK.
+            // The completion layer keeps it in getLoginReturnError(); restore
+            // any existing session and leave sign-in/readiness usable for retry.
+        }
         // Now that core is initialized, update the auth method on the config
         const authMethod = getCurrentAuthMethod();
         if (authMethod) {
@@ -6696,7 +6535,42 @@ async function initialize(newConfig) {
         setAuthLoading(false);
     }
 }
+// Compare data options by value, but preserve identity for callbacks and class
+// instances such as providers. Comparing only app/endpoints would silently drop
+// a concurrent change to wallet policy or provider configuration.
+function sameConfigValue(a, b, seen = new WeakMap()) {
+    var _a;
+    if (Object.is(a, b))
+        return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    if (Array.isArray(a) && a.length !== b.length)
+        return false;
+    if (!Array.isArray(a)) {
+        for (const value of [a, b]) {
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== null && ((_a = prototype.constructor) === null || _a === void 0 ? void 0 : _a.name) !== 'Object')
+                return false;
+        }
+    }
+    if (seen.has(a))
+        return seen.get(a) === b;
+    seen.set(a, b);
+    const left = Object.keys(a), right = Object.keys(b);
+    return left.length === right.length && left.every((key) => Object.prototype.hasOwnProperty.call(b, key)
+        && sameConfigValue(a[key], b[key], seen));
+}
 function init(newConfig) {
+    if (initializingConfig) {
+        if (sameConfigValue(initializingConfig, newConfig)) {
+            return authReadyPromise;
+        }
+        return Promise.reject(new Error('SDK initialization is in progress. Await init() before changing its configuration.'));
+    }
+    initializingConfig = Object.assign({}, newConfig);
+    initializationGeneration++;
     let resolveReady;
     let rejectReady;
     const ready = new Promise((resolve, reject) => {
@@ -6707,7 +6581,7 @@ function init(newConfig) {
     // auth-loading listener to call waitForAuthReady() synchronously when init()
     // announces that session restoration has begun.
     authReadyPromise = ready;
-    void initialize(newConfig).then(resolveReady, rejectReady);
+    void initialize(initializingConfig).then(() => { initializingConfig = null; resolveReady(); }, (error) => { initializingConfig = null; rejectReady(error); });
     return ready;
 }
 /**
@@ -8685,5 +8559,5 @@ class PrivyExpoProvider {
     }
 }
 
-export { BUILD_REVIEW_CAPABILITY_SCHEMA as $, logout as A, getAuthProvider as B, signInAnonymously as C, loginWithPrivy as D, loginWithRedirect as E, completeLoginFromRedirect as F, loginWithPopup as G, completeLoginInPopup as H, useAuth as I, useQuery as J, useBuildRun as K, apps as L, getIdToken as M, onramp as N, onrampQuote as O, onrampStatus as P, setPlatform as Q, OffchainAuthProvider as R, PrivyExpoProvider as S, builds as T, BuildsApiError as U, mediaAgentTools as V, NON_TERMINAL_STATES as W, TERMINAL_STATES as X, RUN_STATES as Y, PARK_REASONS as Z, FAILURE_REASONS as _, signMessageWithTurnkey as a, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a0, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a1, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, isSolanaMobileWallet as i, solanaMobileWalletLeavesPage as j, setAuthLoading as k, bufferExports as l, setStoredAuthMethod as m, normalizeSolanaRpcUrl as n, confirmAndCheckTransaction as o, resolveSolanaRpcUrl as p, init as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, waitForAuthReady as y, login as z };
-//# sourceMappingURL=index.native-3T0IcOed.mjs.map
+export { BUILD_REVIEW_CAPABILITY_SCHEMA as $, logout as A, getAuthProvider as B, signInAnonymously as C, loginWithPrivy as D, loginWithRedirect as E, completeLoginFromRedirect as F, getLoginReturnError as G, loginWithPopup as H, useAuth as I, useQuery as J, useBuildRun as K, apps as L, getIdToken as M, onramp as N, onrampQuote as O, onrampStatus as P, setPlatform as Q, OffchainAuthProvider as R, PrivyExpoProvider as S, builds as T, BuildsApiError as U, mediaAgentTools as V, NON_TERMINAL_STATES as W, TERMINAL_STATES as X, RUN_STATES as Y, PARK_REASONS as Z, FAILURE_REASONS as _, signMessageWithTurnkey as a, BUILD_REVIEW_CAPABILITY_REFRESH_SCHEMA as a0, BUILD_DELEGATED_REVIEW_CAPABILITY_SCHEMA as a1, signTransactionWithTurnkey as b, signTransactionV1WithTurnkey as c, signAndSubmitTransactionWithTurnkey as d, bs58 as e, getWallets as f, getPlatform as g, hasTurnkeyWallet as h, isSolanaMobileWallet as i, solanaMobileWalletLeavesPage as j, setAuthLoading as k, bufferExports as l, setStoredAuthMethod as m, normalizeSolanaRpcUrl as n, confirmAndCheckTransaction as o, resolveSolanaRpcUrl as p, init as q, resolveSolanaWalletStandardChain as r, setCurrentUser as s, transactionHasSignature as t, getCurrentUser as u, onAuthStateChanged as v, onAuthLoadingChanged as w, getAuthLoading as x, waitForAuthReady as y, login as z };
+//# sourceMappingURL=index.native-BSOqaKIz.mjs.map